@marcoscale98/pi-extensible-workflows 5.14.1-fork.1 → 5.17.0-fork.1

package/dist/src/index.js

@@ -370,6 +370,12 @@ function createLaunchSnapshot(input) {
 function loadLaunchSnapshot(input) {
   return deepFreeze(structuredClone(input));
 }
+function validateSchema(schema, at = "schema") {
+  if (!object(schema) || Object.getPrototypeOf(schema) !== Object.prototype || !jsonValue(schema)) fail("INVALID_SCHEMA", `${at} must be a plain JSON-compatible Schema object`);
+  if (typeof schema.type !== "string" && !Array.isArray(schema.type) && schema.$ref === void 0 && schema.anyOf === void 0 && schema.oneOf === void 0 && schema.allOf === void 0 && schema.const === void 0 && schema.enum === void 0) fail("INVALID_SCHEMA", `${at} has no JSON Schema shape`);
+  if (schema.required !== void 0 && (!Array.isArray(schema.required) || schema.required.some((key) => typeof key !== "string"))) fail("INVALID_SCHEMA", `${at}.required must be an array of strings`);
+  if (schema.properties !== void 0 && !object(schema.properties)) fail("INVALID_SCHEMA", `${at}.properties must be an object`);
+}
 
 // src/paths.ts
 import { createHash } from "node:crypto";
@@ -670,6 +676,23 @@ function resumeBudgetAllowed(budget, usage) {
   return exhaustedBudgetDimensions(budget, usage).length === 0;
 }
 
+// src/validation.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
+import * as acorn from "acorn";
+import { Script } from "node:vm";
+
+// src/roles.ts
+import { readFileSync as readFileSync3, readdirSync, statSync } from "node:fs";
+import { basename as basename3, dirname as dirname4, extname, join as join6, resolve as resolve4 } from "node:path";
+import { getAgentDir as getAgentDir2, parseFrontmatter } from "@earendil-works/pi-coding-agent";
+
+// src/registry.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join5 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { Value } from "typebox/value";
+
 // src/io.ts
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -690,7 +713,7 @@ async function renameWithRetry(from, to) {
     } catch (error) {
       const delayMs = RENAME_RETRY_DELAYS_MS[attempt];
       if (!retryableRenameError(error) || delayMs === void 0) throw error;
-      await new Promise((resolve7) => setTimeout(resolve7, delayMs));
+      await new Promise((resolve9) => setTimeout(resolve9, delayMs));
     }
   }
 }
@@ -894,7 +917,7 @@ function decodeWorkflowExtensions(value) {
     }
     if (namespace === "trajectory") {
       if (!object(raw) || Object.keys(raw).some((key) => key !== "port" && key !== "themes") || raw.port !== void 0 && (typeof raw.port !== "number" || !Number.isSafeInteger(raw.port) || raw.port < 1 || raw.port > 65535) || raw.themes !== void 0 && typeof raw.themes !== "boolean") return void 0;
-      normalized.trajectory = { ...raw.port === void 0 ? {} : { port: raw.port }, ...raw.themes === void 0 ? {} : { themes: raw.themes } };
+      normalized.trajectory = { ...raw.port === void 0 ? {} : { port: raw.port } };
       continue;
     }
     if (!jsonValue(raw)) return void 0;
@@ -2356,20 +2379,234 @@ var RunStore = class _RunStore {
   }
 };
 
-// src/validation.ts
-import { mkdirSync, readFileSync as readFileSync2, readdirSync, statSync } from "node:fs";
+// src/settings.ts
+import { mkdirSync, readFileSync } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { basename as basename3, dirname as dirname3, extname, join as join5, resolve as resolve3 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-import * as acorn from "acorn";
-import { Script } from "node:vm";
-import { getAgentDir, parseFrontmatter } from "@earendil-works/pi-coding-agent";
+import { dirname as dirname2, join as join4, resolve as resolve3 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+var ROLE_DIRECTORY = "pi-extensible-workflows";
+var DEFAULT_SETTINGS = Object.freeze({ concurrency: 8, backgroundWidget: true });
+function workflowSettingsPath(agentDir = getAgentDir()) {
+  return join4(agentDir, ROLE_DIRECTORY, "settings.json");
+}
+function normalizedResourcePath(value, settingsPath) {
+  if (value === "*") return value;
+  let expanded = value === "~" ? homedir4() : value.startsWith("~/") || value.startsWith("~\\") ? join4(homedir4(), value.slice(2)) : value;
+  if (expanded.startsWith("file://")) expanded = fileURLToPath(expanded);
+  const resolved = resolve3(dirname2(settingsPath), expanded);
+  if (expanded === "**" || expanded.startsWith("**/") || expanded.startsWith("**\\")) return expanded;
+  if (resourcePatternHasMagic(expanded)) {
+    const magicIndex = resolved.search(/[*?\x5b\x5d{}()]/);
+    const separatorIndex = Math.max(resolved.lastIndexOf("/", magicIndex), resolved.lastIndexOf("\\", magicIndex));
+    const rootBoundary = separatorIndex === 0 || separatorIndex === 2 && /^[A-Za-z]:[\\/]/.test(resolved);
+    const prefix = rootBoundary ? resolved.slice(0, separatorIndex + 1) : separatorIndex >= 0 ? resolved.slice(0, separatorIndex) : resolved;
+    const suffix = rootBoundary ? resolved.slice(separatorIndex + 1) : separatorIndex >= 0 ? resolved.slice(separatorIndex) : "";
+    return `${canonicalPath(prefix)}${suffix}`;
+  }
+  return canonicalPath(resolved);
+}
+function validateSelectorList(value, path, kind, errorCode2 = "INVALID_SETTINGS", normalizeExtensions = true) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) fail(errorCode2, `${path}.${kind} must be an array`);
+  const normalized = [];
+  for (const [index, entry] of value.entries()) {
+    if (typeof entry !== "string" || !entry.trim()) fail(errorCode2, `${path}.${kind}[${String(index)}] must be a non-empty string`);
+    let selector = entry.trim();
+    if (kind === "extensions" && normalizeExtensions) {
+      const negated = selector.startsWith("!");
+      const body = negated ? selector.slice(1) : selector;
+      if (!body) fail(errorCode2, `${path}.${kind}[${String(index)}] must be a valid minimatch pattern: Empty minimatch pattern ${JSON.stringify(selector)}`);
+      try {
+        selector = `${negated ? "!" : ""}${normalizedResourcePath(body, path)}`;
+      } catch (error) {
+        fail(errorCode2, `${path}.${kind}[${String(index)}] must be a valid path: ${errorText(error)}`);
+      }
+    }
+    try {
+      validateResourcePattern(selector);
+    } catch (error) {
+      fail(errorCode2, `${path}.${kind}[${String(index)}] must be a valid minimatch pattern: ${errorText(error)}`);
+    }
+    normalized.push(selector);
+  }
+  return Object.freeze(normalized);
+}
+function validateWorktreePostCreateCommand(value, settingsPath) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value) || value.length === 0) fail("INVALID_SETTINGS", `${settingsPath}.worktreePostCreateCommand must be a non-empty array`);
+  return Object.freeze(value.map((entry, index) => {
+    if (typeof entry !== "string" || !entry.trim()) fail("INVALID_SETTINGS", `${settingsPath}.worktreePostCreateCommand[${String(index)}] must be a non-empty string`);
+    return entry;
+  }));
+}
+function selectorsFromSettings(settings) {
+  return {
+    ...settings.skills === void 0 ? {} : { skills: settings.skills },
+    ...settings.extensions === void 0 ? {} : { extensions: settings.extensions },
+    ...settings.tools === void 0 ? {} : { tools: settings.tools }
+  };
+}
+function selectorSet(value) {
+  return { skills: [...value?.skills ?? []], extensions: [...value?.extensions ?? []], ...value?.tools === void 0 ? {} : { tools: [...value.tools] } };
+}
+function validateContextFileScopes(value, rolePath) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value) || !value.every(isContextFileScope)) fail("INVALID_METADATA", `${rolePath}.contextFiles must be an array containing only global, project, or cwd`);
+  return [...value];
+}
+function validateWorkflowExtensionSettings(value, settingsPath, errorCode2 = "INVALID_SETTINGS") {
+  if (value === void 0) return void 0;
+  const base = `${settingsPath}.extensionSettings`;
+  if (!object(value)) fail(errorCode2, `${base} must be an object`);
+  const normalized = {};
+  for (const [namespace, raw] of Object.entries(value)) {
+    if (!validWorkflowExtensionNamespace(namespace)) fail(errorCode2, `${base} contains an invalid namespace: ${namespace}`);
+    if (namespace === "herdr") {
+      if (!object(raw)) fail(errorCode2, `${base}.herdr must be an object`);
+      if (Object.keys(raw).some((key) => key !== "enableFullyInspectableMode")) fail(errorCode2, `${base}.herdr contains an unsupported setting`);
+      if (raw.enableFullyInspectableMode !== void 0 && typeof raw.enableFullyInspectableMode !== "boolean") fail(errorCode2, `${base}.herdr.enableFullyInspectableMode must be a boolean`);
+      normalized.herdr = Object.freeze({ ...raw.enableFullyInspectableMode === void 0 ? {} : { enableFullyInspectableMode: raw.enableFullyInspectableMode } });
+      continue;
+    }
+    if (namespace === "trajectory") {
+      if (!object(raw)) fail(errorCode2, `${base}.trajectory must be an object`);
+      if (Object.keys(raw).some((key) => key !== "port")) fail(errorCode2, `${base}.trajectory contains an unsupported setting`);
+      if (raw.port !== void 0 && (!positiveInteger(raw.port) || raw.port > 65535)) fail(errorCode2, `${base}.trajectory.port must be an integer from 1 to 65535`);
+      normalized.trajectory = Object.freeze({ ...raw.port === void 0 ? {} : { port: raw.port } });
+      continue;
+    }
+    if (!jsonValue(raw)) fail(errorCode2, `${base}.${namespace} must be JSON-compatible`);
+    normalized[namespace] = structuredClone(raw);
+  }
+  return deepFreeze(normalized);
+}
+function positiveRetentionInteger(value) {
+  return positiveInteger(value) && Number.isSafeInteger(value);
+}
+function validateRetention(value, settingsPath) {
+  if (value === void 0) return void 0;
+  const base = `${settingsPath}.retention`;
+  if (!object(value)) fail("INVALID_SETTINGS", `${base} must be an object`);
+  const unknown = Object.keys(value).find((key) => key !== "olderThanDays" && key !== "maxTerminalRuns");
+  if (unknown) fail("INVALID_SETTINGS", `Unknown retention setting at ${base}: ${unknown}`);
+  if (value.olderThanDays !== void 0 && !positiveRetentionInteger(value.olderThanDays)) fail("INVALID_SETTINGS", `${base}.olderThanDays must be a positive integer`);
+  if (value.maxTerminalRuns !== void 0 && !positiveRetentionInteger(value.maxTerminalRuns)) fail("INVALID_SETTINGS", `${base}.maxTerminalRuns must be a positive integer`);
+  return Object.freeze({ ...value.olderThanDays === void 0 ? {} : { olderThanDays: value.olderThanDays }, ...value.maxTerminalRuns === void 0 ? {} : { maxTerminalRuns: value.maxTerminalRuns } });
+}
+function parseSettings(path, partial) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    if (isNodeError(error, "ENOENT")) return partial ? Object.freeze({}) : DEFAULT_SETTINGS;
+    fail("CONFIG_ERROR", `Invalid workflow settings JSON at ${path}: ${errorText(error)}`);
+  }
+  if (!object(parsed)) fail("INVALID_SETTINGS", `Workflow settings at ${path} must be an object`);
+  const allowed = /* @__PURE__ */ new Set(["concurrency", "modelAliases", "skills", "extensions", "extensionSettings", "tools", "retention", "worktreePostCreateCommand", ...partial ? [] : ["backgroundWidget"]]);
+  const unknown = Object.keys(parsed).find((key) => !allowed.has(key));
+  if (Object.prototype.hasOwnProperty.call(parsed, "disabledAgentResources")) fail("INVALID_SETTINGS", `disabledAgentResources is no longer supported; use skills, extensions, and tools selectors (settings: ${path})`);
+  if (unknown) fail("INVALID_SETTINGS", `Unknown workflow setting at ${path}: ${unknown}`);
+  const concurrency = parsed.concurrency === void 0 ? partial ? void 0 : DEFAULT_SETTINGS.concurrency : parsed.concurrency;
+  if (concurrency !== void 0 && (!positiveInteger(concurrency) || concurrency > 16)) fail("INVALID_SETTINGS", `${path}.concurrency must be an integer from 1 to 16`);
+  const backgroundWidget = parsed.backgroundWidget === void 0 ? partial ? void 0 : DEFAULT_SETTINGS.backgroundWidget : parsed.backgroundWidget;
+  if (backgroundWidget !== void 0 && typeof backgroundWidget !== "boolean") fail("INVALID_SETTINGS", `${path}.backgroundWidget must be a boolean`);
+  const modelAliases = parsed.modelAliases === void 0 ? void 0 : validateModelAliases(parsed.modelAliases, path);
+  const skills = validateSelectorList(parsed.skills, path, "skills");
+  const tools = validateSelectorList(parsed.tools, path, "tools");
+  const extensions = validateSelectorList(parsed.extensions, path, "extensions");
+  const extensionSettings = parsed.extensionSettings === void 0 ? void 0 : validateWorkflowExtensionSettings(parsed.extensionSettings, path, "INVALID_SETTINGS");
+  const retention = validateRetention(parsed.retention, path);
+  const worktreePostCreateCommand = validateWorktreePostCreateCommand(parsed.worktreePostCreateCommand, path);
+  return Object.freeze({
+    ...concurrency === void 0 ? {} : { concurrency },
+    ...backgroundWidget === void 0 ? {} : { backgroundWidget },
+    ...modelAliases === void 0 ? {} : { modelAliases },
+    ...skills === void 0 ? {} : { skills },
+    ...extensions === void 0 ? {} : { extensions },
+    ...extensionSettings === void 0 ? {} : { extensionSettings },
+    ...tools === void 0 ? {} : { tools },
+    ...retention === void 0 ? {} : { retention },
+    ...worktreePostCreateCommand === void 0 ? {} : { worktreePostCreateCommand }
+  });
+}
+function loadSettings(path = workflowSettingsPath()) {
+  return parseSettings(path, false);
+}
+function loadSettingsOverrides(path) {
+  return parseSettings(path, true);
+}
+function resolveWorkflowSettings(cwd, projectTrusted2, globalSettingsPath = workflowSettingsPath()) {
+  const projectSettingsPath = workflowProjectSettingsPath(cwd);
+  const global = loadSettings(globalSettingsPath);
+  const project = projectTrusted2 ? loadSettingsOverrides(projectSettingsPath) : Object.freeze({});
+  const projectHas = (key) => Object.prototype.hasOwnProperty.call(project, key);
+  const sourceFor = (key) => projectHas(key) ? projectSettingsPath : globalSettingsPath;
+  const globalSelectors = selectorsFromSettings(global);
+  const projectSelectors = selectorsFromSettings(project);
+  const effectiveSelectors = selectorSet({
+    skills: [...globalSelectors.skills ?? [], ...projectSelectors.skills ?? []],
+    extensions: [...globalSelectors.extensions ?? [], ...projectSelectors.extensions ?? []],
+    ...globalSelectors.tools === void 0 && projectSelectors.tools === void 0 ? {} : { tools: [...globalSelectors.tools ?? [], ...projectSelectors.tools ?? []] }
+  });
+  const hasExtensionSelectors = global.extensions !== void 0 || project.extensions !== void 0;
+  const extensionSettings = projectHas("extensionSettings") ? project.extensionSettings : global.extensionSettings;
+  const sources = {
+    concurrency: projectHas("concurrency") ? projectSettingsPath : globalSettingsPath,
+    modelAliases: projectHas("modelAliases") ? projectSettingsPath : globalSettingsPath,
+    skills: sourceFor("skills"),
+    extensions: sourceFor("extensions"),
+    tools: sourceFor("tools"),
+    ...extensionSettings === void 0 ? {} : { extensionSettings: projectHas("extensionSettings") ? projectSettingsPath : globalSettingsPath },
+    ...project.retention === void 0 && global.retention === void 0 ? {} : { retention: project.retention === void 0 ? globalSettingsPath : projectSettingsPath },
+    ...projectHas("worktreePostCreateCommand") || global.worktreePostCreateCommand !== void 0 ? { worktreePostCreateCommand: projectHas("worktreePostCreateCommand") ? projectSettingsPath : globalSettingsPath } : {}
+  };
+  const effective = Object.freeze({
+    concurrency: project.concurrency ?? global.concurrency,
+    backgroundWidget: global.backgroundWidget ?? true,
+    ...projectHas("modelAliases") ? { modelAliases: project.modelAliases } : global.modelAliases === void 0 ? {} : { modelAliases: global.modelAliases },
+    ...effectiveSelectors.skills.length ? { skills: effectiveSelectors.skills } : global.skills !== void 0 || project.skills !== void 0 ? { skills: effectiveSelectors.skills } : {},
+    ...hasExtensionSelectors ? { extensions: effectiveSelectors.extensions } : {},
+    ...extensionSettings === void 0 ? {} : { extensionSettings },
+    ...effectiveSelectors.tools?.length ? { tools: effectiveSelectors.tools } : global.tools !== void 0 || project.tools !== void 0 ? { tools: effectiveSelectors.tools } : {},
+    ...(project.retention ?? global.retention) === void 0 ? {} : { retention: project.retention ?? global.retention },
+    ...projectHas("worktreePostCreateCommand") ? { worktreePostCreateCommand: project.worktreePostCreateCommand } : global.worktreePostCreateCommand === void 0 ? {} : { worktreePostCreateCommand: global.worktreePostCreateCommand }
+  });
+  return { globalSettingsPath, projectSettingsPath, projectTrusted: projectTrusted2, global, project, effective, sources };
+}
+function validateModelAliasAvailability(aliases, names, availableModels, knownModels, settingsPath) {
+  for (const name of names) {
+    try {
+      const target = modelCapability(name, aliases, knownModels, settingsPath);
+      if (!availableModels.has(target)) unknownModel(name, target, settingsPath);
+    } catch (error) {
+      throw annotateModelAliasError(error, name);
+    }
+  }
+}
+function resolveAgentResourcePolicy(cwd, projectTrusted2, globalSettingsPath = workflowSettingsPath()) {
+  const resolved = resolveWorkflowSettings(cwd, projectTrusted2, globalSettingsPath);
+  const global = selectorSet(selectorsFromSettings(resolved.global));
+  const project = selectorSet(selectorsFromSettings(resolved.project));
+  const effective = selectorSet(selectorsFromSettings(resolved.effective));
+  return { globalSettingsPath: resolved.globalSettingsPath, projectSettingsPath: resolved.projectSettingsPath, projectTrusted: projectTrusted2, global, project, effective, unmatchedSkills: [], unmatchedExtensions: [], unmatchedTools: [], selectorSources: { global: selectorsFromSettings(resolved.global), project: selectorsFromSettings(resolved.project) } };
+}
+function saveModelAliases(path = workflowSettingsPath(), aliases = {}) {
+  const normalized = validateModelAliases(aliases, path);
+  let parsed = {};
+  try {
+    loadSettings(path);
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    if (!isNodeError(error, "ENOENT")) throw error;
+  }
+  if (!object(parsed)) fail("INVALID_SETTINGS", `Workflow settings at ${path} must be an object`);
+  mkdirSync(dirname2(path), { recursive: true });
+  atomicWriteFile(path, `${JSON.stringify({ ...parsed, modelAliases: normalized }, null, 2)}
+`, true);
+}
 
 // src/registry.ts
-import { readFileSync } from "node:fs";
-import { basename as basename2, dirname as dirname2, isAbsolute, join as join4 } from "node:path";
-import { fileURLToPath } from "node:url";
-import { Value } from "typebox/value";
 var RESERVED_GLOBALS = /* @__PURE__ */ new Set(["agent", "shell", "prompt", "checkpoint", "parallel", "pipeline", "phase", "withWorktree", "log", "args", "Promise", "JSON", "Math", "Date", "eval", "Function", "WebAssembly", "process", "require", "module", "exports", "console", "fetch", "XMLHttpRequest", "WebSocket", "performance", "crypto", "setTimeout", "setInterval", "setImmediate", "queueMicrotask", "Intl", "SharedArrayBuffer", "Atomics", "globalThis", "global", "undefined", "NaN", "Infinity", "extensions", "workflow_catalog"]);
 var IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
 var SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
@@ -2378,10 +2615,10 @@ function normalizeRoleDirectory(value) {
   try {
     if (value instanceof URL) {
       if (value.protocol !== "file:") fail("INVALID_METADATA", "Workflow role directories require file URLs or absolute filesystem paths");
-      return fileURLToPath(value);
+      return fileURLToPath2(value);
     }
     if (typeof value === "string") {
-      if (value.startsWith("file:")) return fileURLToPath(value);
+      if (value.startsWith("file:")) return fileURLToPath2(value);
       if (isAbsolute(value)) return value;
     }
   } catch (error) {
@@ -2391,12 +2628,12 @@ function normalizeRoleDirectory(value) {
 }
 function isBuiltinRoleDirectory(path) {
   const canonical = canonicalPath(path);
-  const starterDirectory = dirname2(canonical);
+  const starterDirectory = dirname3(canonical);
   if (basename2(canonical) !== "roles" || basename2(starterDirectory) !== "starter") return false;
-  const distributionDirectory = dirname2(starterDirectory);
-  const packageRoot2 = basename2(distributionDirectory) === "dist" ? dirname2(distributionDirectory) : distributionDirectory;
+  const distributionDirectory = dirname3(starterDirectory);
+  const packageRoot2 = basename2(distributionDirectory) === "dist" ? dirname3(distributionDirectory) : distributionDirectory;
   try {
-    const metadata = JSON.parse(readFileSync(join4(packageRoot2, "package.json"), "utf8"));
+    const metadata = JSON.parse(readFileSync2(join5(packageRoot2, "package.json"), "utf8"));
     return object(metadata) && isCorePackageName(metadata.name);
   } catch {
     return false;
@@ -2671,276 +2908,52 @@ function beginWorkflowExtensionLoading() {
   const host = workflowRegistryHost();
   if (host.api.frozen && host.activeHosts === 0) resetWorkflowRegistry();
 }
-function retainWorkflowRegistry() {
-  const host = workflowRegistryHost();
-  host.activeHosts += 1;
-  let retained = true;
-  return () => {
-    if (!retained) return;
-    retained = false;
-    host.activeHosts -= 1;
-    if (host.activeHosts === 0) resetWorkflowRegistry();
-  };
-}
-function loadingRegistry() {
-  return workflowRegistryHost().api;
-}
-beginWorkflowExtensionLoading();
-function registerWorkflowExtension(extension) {
-  loadingRegistry().register(extension);
-}
-function workflowCatalog(context) {
-  return loadingRegistry().catalog(context);
-}
-function workflowCatalogIndex(context) {
-  return loadingRegistry().catalogIndex(context);
-}
-function workflowCatalogDetail(name, context) {
-  return loadingRegistry().catalogDetail(name, context);
-}
-function registeredWorkflowFunctions() {
-  return loadingRegistry().functions();
-}
-function registeredWorkflowFunctionSources() {
-  const sources = loadingRegistry().functionSources;
-  return typeof sources === "function" ? sources() : {};
-}
-function registeredWorkflowRoleDirectories() {
-  const directories = loadingRegistry().roleDirectories;
-  return typeof directories === "function" ? directories() : [];
-}
-function registeredWorkflowRoleDirectoryRegistrations() {
-  const registrations = loadingRegistry().roleDirectoryRegistrations;
-  return typeof registrations === "function" ? registrations() : [];
-}
-
-// src/validation.ts
-var DEFAULT_SETTINGS = Object.freeze({ concurrency: 8, backgroundWidget: true });
-function validateCheckpoint(value) {
-  if (!object(value) || Object.keys(value).some((key) => !["name", "prompt", "context"].includes(key)) || typeof value.name !== "string" || value.name.trim() === "" || typeof value.prompt !== "string" || !jsonValue(value.context)) fail("INVALID_METADATA", "checkpoint requires only name, prompt, and JSON context");
-  if (Buffer.byteLength(value.prompt) > 1024) fail("INVALID_METADATA", "checkpoint prompt exceeds 1024 UTF-8 bytes");
-  if (Buffer.byteLength(JSON.stringify(value.context)) > 4096) fail("INVALID_METADATA", "checkpoint context exceeds 4096 UTF-8 bytes");
-  return { name: value.name, prompt: value.prompt, context: value.context };
-}
-function workflowSettingsPath(agentDir = getAgentDir()) {
-  return join5(agentDir, ROLE_DIRECTORY, "settings.json");
-}
-function normalizedResourcePath(value, settingsPath) {
-  if (value === "*") return value;
-  let expanded = value === "~" ? homedir4() : value.startsWith("~/") || value.startsWith("~\\") ? join5(homedir4(), value.slice(2)) : value;
-  if (expanded.startsWith("file://")) expanded = fileURLToPath2(expanded);
-  const resolved = resolve3(dirname3(settingsPath), expanded);
-  if (expanded === "**" || expanded.startsWith("**/") || expanded.startsWith("**\\")) return expanded;
-  if (resourcePatternHasMagic(expanded)) {
-    const magicIndex = resolved.search(/[*?\x5b\x5d{}()]/);
-    const separatorIndex = Math.max(resolved.lastIndexOf("/", magicIndex), resolved.lastIndexOf("\\", magicIndex));
-    const rootBoundary = separatorIndex === 0 || separatorIndex === 2 && /^[A-Za-z]:[\\/]/.test(resolved);
-    const prefix = rootBoundary ? resolved.slice(0, separatorIndex + 1) : separatorIndex >= 0 ? resolved.slice(0, separatorIndex) : resolved;
-    const suffix = rootBoundary ? resolved.slice(separatorIndex + 1) : separatorIndex >= 0 ? resolved.slice(separatorIndex) : "";
-    return `${canonicalPath(prefix)}${suffix}`;
-  }
-  return canonicalPath(resolved);
-}
-function validateSelectorList(value, path, kind, errorCode2 = "INVALID_SETTINGS", normalizeExtensions = true) {
-  if (value === void 0) return void 0;
-  if (!Array.isArray(value)) fail(errorCode2, `${path}.${kind} must be an array`);
-  const normalized = [];
-  for (const [index, entry] of value.entries()) {
-    if (typeof entry !== "string" || !entry.trim()) fail(errorCode2, `${path}.${kind}[${String(index)}] must be a non-empty string`);
-    let selector = entry.trim();
-    if (kind === "extensions" && normalizeExtensions) {
-      const negated = selector.startsWith("!");
-      const body = negated ? selector.slice(1) : selector;
-      if (!body) fail(errorCode2, `${path}.${kind}[${String(index)}] must be a valid minimatch pattern: Empty minimatch pattern ${JSON.stringify(selector)}`);
-      try {
-        selector = `${negated ? "!" : ""}${normalizedResourcePath(body, path)}`;
-      } catch (error) {
-        fail(errorCode2, `${path}.${kind}[${String(index)}] must be a valid path: ${errorText(error)}`);
-      }
-    }
-    try {
-      validateResourcePattern(selector);
-    } catch (error) {
-      fail(errorCode2, `${path}.${kind}[${String(index)}] must be a valid minimatch pattern: ${errorText(error)}`);
-    }
-    normalized.push(selector);
-  }
-  return Object.freeze(normalized);
-}
-function validateWorktreePostCreateCommand(value, settingsPath) {
-  if (value === void 0) return void 0;
-  if (!Array.isArray(value) || value.length === 0) fail("INVALID_SETTINGS", `${settingsPath}.worktreePostCreateCommand must be a non-empty array`);
-  return Object.freeze(value.map((entry, index) => {
-    if (typeof entry !== "string" || !entry.trim()) fail("INVALID_SETTINGS", `${settingsPath}.worktreePostCreateCommand[${String(index)}] must be a non-empty string`);
-    return entry;
-  }));
-}
-function selectorsFromSettings(settings) {
-  return {
-    ...settings.skills === void 0 ? {} : { skills: settings.skills },
-    ...settings.extensions === void 0 ? {} : { extensions: settings.extensions },
-    ...settings.tools === void 0 ? {} : { tools: settings.tools }
-  };
-}
-function selectorSet(value) {
-  return { skills: [...value?.skills ?? []], extensions: [...value?.extensions ?? []], ...value?.tools === void 0 ? {} : { tools: [...value.tools] } };
-}
-function validateContextFileScopes(value, rolePath) {
-  if (value === void 0) return void 0;
-  if (!Array.isArray(value) || !value.every(isContextFileScope)) fail("INVALID_METADATA", `${rolePath}.contextFiles must be an array containing only global, project, or cwd`);
-  return [...value];
-}
-function validateWorkflowExtensionSettings(value, settingsPath, errorCode2 = "INVALID_SETTINGS", applyDefaults = true) {
-  if (value === void 0) return void 0;
-  const base = `${settingsPath}.extensionSettings`;
-  if (!object(value)) fail(errorCode2, `${base} must be an object`);
-  const normalized = {};
-  for (const [namespace, raw] of Object.entries(value)) {
-    if (!validWorkflowExtensionNamespace(namespace)) fail(errorCode2, `${base} contains an invalid namespace: ${namespace}`);
-    if (namespace === "herdr") {
-      if (!object(raw)) fail(errorCode2, `${base}.herdr must be an object`);
-      if (Object.keys(raw).some((key) => key !== "enableFullyInspectableMode")) fail(errorCode2, `${base}.herdr contains an unsupported setting`);
-      if (raw.enableFullyInspectableMode !== void 0 && typeof raw.enableFullyInspectableMode !== "boolean") fail(errorCode2, `${base}.herdr.enableFullyInspectableMode must be a boolean`);
-      normalized.herdr = Object.freeze({ ...raw.enableFullyInspectableMode === void 0 ? {} : { enableFullyInspectableMode: raw.enableFullyInspectableMode } });
-      continue;
-    }
-    if (namespace === "trajectory") {
-      if (!object(raw)) fail(errorCode2, `${base}.trajectory must be an object`);
-      if (Object.keys(raw).some((key) => key !== "port" && key !== "themes")) fail(errorCode2, `${base}.trajectory contains an unsupported setting`);
-      if (raw.port !== void 0 && (!positiveInteger(raw.port) || raw.port > 65535)) fail(errorCode2, `${base}.trajectory.port must be an integer from 1 to 65535`);
-      if (raw.themes !== void 0 && typeof raw.themes !== "boolean") fail(errorCode2, `${base}.trajectory.themes must be a boolean`);
-      normalized.trajectory = Object.freeze({ ...raw.port === void 0 ? {} : { port: raw.port }, ...raw.themes === void 0 ? applyDefaults ? { themes: false } : {} : { themes: raw.themes } });
-      continue;
-    }
-    if (!jsonValue(raw)) fail(errorCode2, `${base}.${namespace} must be JSON-compatible`);
-    normalized[namespace] = structuredClone(raw);
-  }
-  return deepFreeze(normalized);
+function retainWorkflowRegistry() {
+  const host = workflowRegistryHost();
+  host.activeHosts += 1;
+  let retained = true;
+  return () => {
+    if (!retained) return;
+    retained = false;
+    host.activeHosts -= 1;
+    if (host.activeHosts === 0) resetWorkflowRegistry();
+  };
 }
-function positiveRetentionInteger(value) {
-  return positiveInteger(value) && Number.isSafeInteger(value);
+function loadingRegistry() {
+  return workflowRegistryHost().api;
 }
-function validateRetention(value, settingsPath) {
-  if (value === void 0) return void 0;
-  const base = `${settingsPath}.retention`;
-  if (!object(value)) fail("INVALID_SETTINGS", `${base} must be an object`);
-  const unknown = Object.keys(value).find((key) => key !== "olderThanDays" && key !== "maxTerminalRuns");
-  if (unknown) fail("INVALID_SETTINGS", `Unknown retention setting at ${base}: ${unknown}`);
-  if (value.olderThanDays !== void 0 && !positiveRetentionInteger(value.olderThanDays)) fail("INVALID_SETTINGS", `${base}.olderThanDays must be a positive integer`);
-  if (value.maxTerminalRuns !== void 0 && !positiveRetentionInteger(value.maxTerminalRuns)) fail("INVALID_SETTINGS", `${base}.maxTerminalRuns must be a positive integer`);
-  return Object.freeze({ ...value.olderThanDays === void 0 ? {} : { olderThanDays: value.olderThanDays }, ...value.maxTerminalRuns === void 0 ? {} : { maxTerminalRuns: value.maxTerminalRuns } });
+beginWorkflowExtensionLoading();
+function registerWorkflowExtension(extension) {
+  loadingRegistry().register(extension);
 }
-function parseSettings(path, partial) {
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync2(path, "utf8"));
-  } catch (error) {
-    if (isNodeError(error, "ENOENT")) return partial ? Object.freeze({}) : DEFAULT_SETTINGS;
-    fail("CONFIG_ERROR", `Invalid workflow settings JSON at ${path}: ${errorText(error)}`);
-  }
-  if (!object(parsed)) fail("INVALID_SETTINGS", `Workflow settings at ${path} must be an object`);
-  const allowed = /* @__PURE__ */ new Set(["concurrency", "modelAliases", "skills", "extensions", "extensionSettings", "tools", "retention", "worktreePostCreateCommand", ...partial ? [] : ["backgroundWidget"]]);
-  const unknown = Object.keys(parsed).find((key) => !allowed.has(key));
-  if (Object.prototype.hasOwnProperty.call(parsed, "disabledAgentResources")) fail("INVALID_SETTINGS", `disabledAgentResources is no longer supported; use skills, extensions, and tools selectors (settings: ${path})`);
-  if (unknown) fail("INVALID_SETTINGS", `Unknown workflow setting at ${path}: ${unknown}`);
-  const concurrency = parsed.concurrency === void 0 ? partial ? void 0 : DEFAULT_SETTINGS.concurrency : parsed.concurrency;
-  if (concurrency !== void 0 && (!positiveInteger(concurrency) || concurrency > 16)) fail("INVALID_SETTINGS", `${path}.concurrency must be an integer from 1 to 16`);
-  const backgroundWidget = parsed.backgroundWidget === void 0 ? partial ? void 0 : DEFAULT_SETTINGS.backgroundWidget : parsed.backgroundWidget;
-  if (backgroundWidget !== void 0 && typeof backgroundWidget !== "boolean") fail("INVALID_SETTINGS", `${path}.backgroundWidget must be a boolean`);
-  const modelAliases = parsed.modelAliases === void 0 ? void 0 : validateModelAliases(parsed.modelAliases, path);
-  const skills = validateSelectorList(parsed.skills, path, "skills");
-  const tools = validateSelectorList(parsed.tools, path, "tools");
-  const extensions = validateSelectorList(parsed.extensions, path, "extensions");
-  const extensionSettings = parsed.extensionSettings === void 0 ? void 0 : validateWorkflowExtensionSettings(parsed.extensionSettings, path, "INVALID_SETTINGS", !partial);
-  const retention = validateRetention(parsed.retention, path);
-  const worktreePostCreateCommand = validateWorktreePostCreateCommand(parsed.worktreePostCreateCommand, path);
-  return Object.freeze({
-    ...concurrency === void 0 ? {} : { concurrency },
-    ...backgroundWidget === void 0 ? {} : { backgroundWidget },
-    ...modelAliases === void 0 ? {} : { modelAliases },
-    ...skills === void 0 ? {} : { skills },
-    ...extensions === void 0 ? {} : { extensions },
-    ...extensionSettings === void 0 ? {} : { extensionSettings },
-    ...tools === void 0 ? {} : { tools },
-    ...retention === void 0 ? {} : { retention },
-    ...worktreePostCreateCommand === void 0 ? {} : { worktreePostCreateCommand }
-  });
+function workflowCatalog(context) {
+  return loadingRegistry().catalog(context);
 }
-function loadSettings(path = workflowSettingsPath()) {
-  return parseSettings(path, false);
+function workflowCatalogIndex(context) {
+  return loadingRegistry().catalogIndex(context);
 }
-function loadSettingsOverrides(path) {
-  return parseSettings(path, true);
+function workflowCatalogDetail(name, context) {
+  return loadingRegistry().catalogDetail(name, context);
 }
-function resolveWorkflowSettings(cwd, projectTrusted2, globalSettingsPath = workflowSettingsPath()) {
-  const projectSettingsPath = workflowProjectSettingsPath(cwd);
-  const global = loadSettings(globalSettingsPath);
-  const project = projectTrusted2 ? loadSettingsOverrides(projectSettingsPath) : Object.freeze({});
-  const projectHas = (key) => Object.prototype.hasOwnProperty.call(project, key);
-  const sourceFor = (key) => projectHas(key) ? projectSettingsPath : globalSettingsPath;
-  const globalSelectors = selectorsFromSettings(global);
-  const projectSelectors = selectorsFromSettings(project);
-  const effectiveSelectors = selectorSet({
-    skills: [...globalSelectors.skills ?? [], ...projectSelectors.skills ?? []],
-    extensions: [...globalSelectors.extensions ?? [], ...projectSelectors.extensions ?? []],
-    ...globalSelectors.tools === void 0 && projectSelectors.tools === void 0 ? {} : { tools: [...globalSelectors.tools ?? [], ...projectSelectors.tools ?? []] }
-  });
-  const hasExtensionSelectors = global.extensions !== void 0 || project.extensions !== void 0;
-  const extensionSettings = projectHas("extensionSettings") ? project.extensionSettings : global.extensionSettings;
-  const sources = {
-    concurrency: projectHas("concurrency") ? projectSettingsPath : globalSettingsPath,
-    modelAliases: projectHas("modelAliases") ? projectSettingsPath : globalSettingsPath,
-    skills: sourceFor("skills"),
-    extensions: sourceFor("extensions"),
-    tools: sourceFor("tools"),
-    ...extensionSettings === void 0 ? {} : { extensionSettings: projectHas("extensionSettings") ? projectSettingsPath : globalSettingsPath },
-    ...project.retention === void 0 && global.retention === void 0 ? {} : { retention: project.retention === void 0 ? globalSettingsPath : projectSettingsPath },
-    ...projectHas("worktreePostCreateCommand") || global.worktreePostCreateCommand !== void 0 ? { worktreePostCreateCommand: projectHas("worktreePostCreateCommand") ? projectSettingsPath : globalSettingsPath } : {}
-  };
-  const effective = Object.freeze({
-    concurrency: project.concurrency ?? global.concurrency,
-    backgroundWidget: global.backgroundWidget ?? true,
-    ...projectHas("modelAliases") ? { modelAliases: project.modelAliases } : global.modelAliases === void 0 ? {} : { modelAliases: global.modelAliases },
-    ...effectiveSelectors.skills.length ? { skills: effectiveSelectors.skills } : global.skills !== void 0 || project.skills !== void 0 ? { skills: effectiveSelectors.skills } : {},
-    ...hasExtensionSelectors ? { extensions: effectiveSelectors.extensions } : {},
-    ...extensionSettings === void 0 ? {} : { extensionSettings },
-    ...effectiveSelectors.tools?.length ? { tools: effectiveSelectors.tools } : global.tools !== void 0 || project.tools !== void 0 ? { tools: effectiveSelectors.tools } : {},
-    ...(project.retention ?? global.retention) === void 0 ? {} : { retention: project.retention ?? global.retention },
-    ...projectHas("worktreePostCreateCommand") ? { worktreePostCreateCommand: project.worktreePostCreateCommand } : global.worktreePostCreateCommand === void 0 ? {} : { worktreePostCreateCommand: global.worktreePostCreateCommand }
-  });
-  return { globalSettingsPath, projectSettingsPath, projectTrusted: projectTrusted2, global, project, effective, sources };
+function registeredWorkflowFunctions() {
+  return loadingRegistry().functions();
 }
-function validateModelAliasAvailability(aliases, names, availableModels, knownModels, settingsPath) {
-  for (const name of names) {
-    try {
-      const target = modelCapability(name, aliases, knownModels, settingsPath);
-      if (!availableModels.has(target)) unknownModel(name, target, settingsPath);
-    } catch (error) {
-      throw annotateModelAliasError(error, name);
-    }
-  }
+function registeredWorkflowFunctionSources() {
+  const sources = loadingRegistry().functionSources;
+  return typeof sources === "function" ? sources() : {};
 }
-function resolveAgentResourcePolicy(cwd, projectTrusted2, globalSettingsPath = workflowSettingsPath()) {
-  const resolved = resolveWorkflowSettings(cwd, projectTrusted2, globalSettingsPath);
-  const global = selectorSet(selectorsFromSettings(resolved.global));
-  const project = selectorSet(selectorsFromSettings(resolved.project));
-  const effective = selectorSet(selectorsFromSettings(resolved.effective));
-  return { globalSettingsPath: resolved.globalSettingsPath, projectSettingsPath: resolved.projectSettingsPath, projectTrusted: projectTrusted2, global, project, effective, unmatchedSkills: [], unmatchedExtensions: [], unmatchedTools: [], selectorSources: { global: selectorsFromSettings(resolved.global), project: selectorsFromSettings(resolved.project) } };
+function registeredWorkflowRoleDirectories() {
+  const directories = loadingRegistry().roleDirectories;
+  return typeof directories === "function" ? directories() : [];
 }
-function saveModelAliases(path = workflowSettingsPath(), aliases = {}) {
-  const normalized = validateModelAliases(aliases, path);
-  let parsed = {};
-  try {
-    loadSettings(path);
-    parsed = JSON.parse(readFileSync2(path, "utf8"));
-  } catch (error) {
-    if (!isNodeError(error, "ENOENT")) throw error;
-  }
-  if (!object(parsed)) fail("INVALID_SETTINGS", `Workflow settings at ${path} must be an object`);
-  mkdirSync(dirname3(path), { recursive: true });
-  atomicWriteFile(path, `${JSON.stringify({ ...parsed, modelAliases: normalized }, null, 2)}
-`, true);
+function registeredWorkflowRoleDirectoryRegistrations() {
+  const registrations = loadingRegistry().roleDirectoryRegistrations;
+  return typeof registrations === "function" ? registrations() : [];
 }
+
+// src/roles.ts
+var ROLE_DIRECTORY2 = "pi-extensible-workflows";
+var roleDefinitionPaths = /* @__PURE__ */ new WeakMap();
 function parseRoleMarkdown(content, strict = false, rolePath) {
   if (!strict) {
     if (!content.startsWith("---\n")) return { prompt: content };
@@ -2967,7 +2980,7 @@ function parseRoleMarkdown(content, strict = false, rolePath) {
       }
     }
     const rolePathValue2 = rolePath ?? "<role>";
-    const normalizedExtensionSettings2 = validateWorkflowExtensionSettings(extensionSettings2, rolePathValue2, "INVALID_METADATA", false);
+    const normalizedExtensionSettings2 = validateWorkflowExtensionSettings(extensionSettings2, rolePathValue2, "INVALID_METADATA");
     const definition2 = { prompt: content.slice(end + 4).replace(/^\n/, "") };
     if (meta.model) {
       const model2 = unquote(meta.model);
@@ -3007,7 +3020,7 @@ function parseRoleMarkdown(content, strict = false, rolePath) {
   const normalizedTools = validateSelectorList(tools, rolePathValue, "tools", "INVALID_METADATA");
   const normalizedSkills = validateSelectorList(skills, rolePathValue, "skills", "INVALID_METADATA");
   const normalizedExtensions = validateSelectorList(extensions, rolePathValue, "extensions", "INVALID_METADATA");
-  const normalizedExtensionSettings = validateWorkflowExtensionSettings(extensionSettings, rolePathValue, "INVALID_METADATA", false);
+  const normalizedExtensionSettings = validateWorkflowExtensionSettings(extensionSettings, rolePathValue, "INVALID_METADATA");
   const normalizedDescription = typeof description === "string" ? description.trim() : void 0;
   const normalizedModel = typeof model === "string" ? model.trim() : void 0;
   if (normalizedModel !== void 0) assertModelThinking(normalizedModel, "Role model");
@@ -3022,12 +3035,11 @@ function parseRoleMarkdown(content, strict = false, rolePath) {
   if (normalizedContextFiles !== void 0) definition.contextFiles = normalizedContextFiles;
   return definition;
 }
-var ROLE_DIRECTORY = "pi-extensible-workflows";
-function workflowRoleDirectories(agentDir = getAgentDir()) {
-  return [join5(agentDir, ROLE_DIRECTORY, "roles")];
+function workflowRoleDirectories(agentDir = getAgentDir2()) {
+  return [join6(agentDir, ROLE_DIRECTORY2, "roles")];
 }
 function projectRoleDirectories(root) {
-  return [join5(root, ROLE_DIRECTORY, "roles")];
+  return [join6(root, ROLE_DIRECTORY2, "roles")];
 }
 function roleDirectorySources(dirs) {
   const seen = /* @__PURE__ */ new Set();
@@ -3046,7 +3058,7 @@ function isRoleFile(dir, entry) {
   if (entry.isFile()) return true;
   if (!entry.isSymbolicLink()) return false;
   try {
-    return statSync(join5(dir, entry.name)).isFile();
+    return statSync(join6(dir, entry.name)).isFile();
   } catch (error) {
     if (isNodeError(error, "ENOENT")) return false;
     throw error;
@@ -3062,11 +3074,11 @@ function scanRoleFiles(dirs, extension) {
       if (!extension && isNodeError(error, "ENOENT")) continue;
       fail("INVALID_METADATA", `${roleDirectoryLabel(source, extension)} role directory "${source.path}" could not be scanned: ${errorText(error)}`);
     }
-    for (const entry of entries) if (isRoleFile(source.path, entry)) files.push({ name: basename3(entry.name, ".md"), path: join5(source.path, entry.name), source });
+    for (const entry of entries) if (isRoleFile(source.path, entry)) files.push({ name: basename3(entry.name, ".md"), path: join6(source.path, entry.name), source });
   }
   return files.sort((left, right) => left.name.localeCompare(right.name) || left.path.localeCompare(right.path));
 }
-function readRoleDefinitions(dirs, extension = false) {
+function roleEntries(dirs, extension) {
   const files = scanRoleFiles(dirs, extension);
   const starterFiles = files.filter(({ source }) => source.builtin === true);
   const regularFiles = files.filter(({ source }) => source.builtin !== true);
@@ -3077,7 +3089,9 @@ function readRoleDefinitions(dirs, extension = false) {
   }
   const read = (roleFiles) => Object.fromEntries(roleFiles.map(({ name, path, source }) => {
     try {
-      return [name, parseRoleMarkdown(readFileSync2(path, "utf8"), true, path)];
+      const definition = parseRoleMarkdown(readFileSync3(path, "utf8"), true, path);
+      roleDefinitionPaths.set(definition, path);
+      return [name, { name, path, source, definition }];
     } catch (error) {
       if (extension) fail("INVALID_METADATA", `${roleDirectoryLabel(source)} role directory "${source.path}" contains invalid role "${name}" at "${path}": ${errorText(error)}`);
       throw error;
@@ -3085,11 +3099,127 @@ function readRoleDefinitions(dirs, extension = false) {
   }));
   return extension ? { ...read(starterFiles), ...read(regularFiles) } : read(files);
 }
+function discoveryInput(input) {
+  return { cwd: input.cwd, agentDir: input.agentDir ?? getAgentDir2(), projectTrusted: input.projectTrusted ?? true, extensionRoleDirectories: input.extensionRoleDirectories ?? registeredWorkflowRoleDirectoryRegistrations() };
+}
+function discoveredRoleEntries(input) {
+  const resolved = discoveryInput(input);
+  return {
+    ...roleEntries(resolved.extensionRoleDirectories, true),
+    ...roleEntries(workflowRoleDirectories(resolved.agentDir), false),
+    ...resolved.projectTrusted ? roleEntries(projectRoleDirectories(join6(resolved.cwd, ".pi")), false) : {}
+  };
+}
 function loadProjectAgentDefinitions(cwd) {
-  return readRoleDefinitions(projectRoleDirectories(join5(cwd, ".pi")));
+  return deepFreeze(Object.fromEntries(Object.entries(roleEntries(projectRoleDirectories(join6(cwd, ".pi")), false)).map(([name, entry]) => [name, entry.definition])));
+}
+function discoverRoles(input) {
+  return deepFreeze(Object.fromEntries(Object.entries(discoveredRoleEntries(input)).map(([name, entry]) => [name, entry.definition])));
+}
+function loadRole(name, input) {
+  const entry = discoveredRoleEntries(input)[name];
+  if (!entry) fail("UNKNOWN_AGENT_TYPE", `Unknown agent role: ${name}`);
+  return entry.definition;
+}
+function loadAgentDefinitions(cwd, agentDir = getAgentDir2(), projectTrusted2 = true, extensionRoleDirectories = registeredWorkflowRoleDirectoryRegistrations()) {
+  return discoverRoles({ cwd, agentDir, projectTrusted: projectTrusted2, extensionRoleDirectories });
+}
+function canonicalExtensionSelector(selector, base = process.cwd()) {
+  const negated = selector.startsWith("!");
+  const body = negated ? selector.slice(1) : selector;
+  if (body === "*" || body === "**" || body.startsWith("**/")) return selector;
+  const resolved = resolve4(base, body);
+  if (resourcePatternHasMagic(body)) return `${negated ? "!" : ""}${resolved}`;
+  return `${negated ? "!" : ""}${canonicalPath(resolved)}`;
 }
-function loadAgentDefinitions(cwd, agentDir = getAgentDir(), projectTrusted2 = true, extensionRoleDirectories = registeredWorkflowRoleDirectoryRegistrations()) {
-  return deepFreeze({ ...readRoleDefinitions(extensionRoleDirectories, true), ...readRoleDefinitions(workflowRoleDirectories(agentDir)), ...projectTrusted2 ? readRoleDefinitions(projectRoleDirectories(join5(cwd, ".pi"))) : {} });
+function selectorsFromSettings2(settings) {
+  return { ...settings.skills === void 0 ? {} : { skills: settings.skills }, ...settings.extensions === void 0 ? {} : { extensions: settings.extensions }, ...settings.tools === void 0 ? {} : { tools: settings.tools } };
+}
+function rootToolNames(value) {
+  return value === void 0 ? void 0 : value instanceof Set ? [...value] : [...value];
+}
+function roleDefinitionFor(name, options) {
+  if (name === void 0) return {};
+  if (options.definition !== void 0) {
+    const path = roleDefinitionPaths.get(options.definition);
+    return { definition: options.definition, ...path === void 0 ? {} : { path } };
+  }
+  if (options.definitions?.[name] !== void 0) {
+    const definition = options.definitions[name];
+    const path = roleDefinitionPaths.get(definition);
+    return { definition, ...path === void 0 ? {} : { path } };
+  }
+  const entries = discoveredRoleEntries(options);
+  const entry = entries[name];
+  if (!entry) fail("UNKNOWN_AGENT_TYPE", `Unknown agent role: ${name}`);
+  return entry;
+}
+function resolveRole(name, options) {
+  const { definition, path } = roleDefinitionFor(name, options);
+  const settings = options.selectorSources === void 0 ? resolveWorkflowSettings(options.cwd, options.projectTrusted ?? true, options.settingsPath ?? workflowSettingsPath(options.agentDir ?? getAgentDir2())) : void 0;
+  const baseSources = options.selectorSources ?? { global: selectorsFromSettings2(settings?.global ?? {}), project: selectorsFromSettings2(settings?.project ?? {}) };
+  const canonicalSources = (sources) => ({
+    ...sources,
+    global: { ...sources.global, ...sources.global.extensions === void 0 ? {} : { extensions: sources.global.extensions.map((selector) => canonicalExtensionSelector(selector, options.cwd)) } },
+    project: { ...sources.project, ...sources.project.extensions === void 0 ? {} : { extensions: sources.project.extensions.map((selector) => canonicalExtensionSelector(selector, options.cwd)) } },
+    ...sources.role === void 0 ? {} : { role: { ...sources.role, ...sources.role.extensions === void 0 ? {} : { extensions: sources.role.extensions.map((selector) => canonicalExtensionSelector(selector, options.cwd)) } } },
+    ...sources.call === void 0 ? {} : { call: { ...sources.call, ...sources.call.extensions === void 0 ? {} : { extensions: sources.call.extensions.map((selector) => canonicalExtensionSelector(selector, options.cwd)) } } }
+  });
+  const roleLayer = definition?.skills !== void 0 || definition?.extensions !== void 0 || definition?.tools !== void 0 ? { ...definition.skills === void 0 ? {} : { skills: definition.skills }, ...definition.extensions === void 0 ? {} : { extensions: definition.extensions.map((selector) => canonicalExtensionSelector(selector, path ? dirname4(path) : options.cwd)) }, ...definition.tools === void 0 ? {} : { tools: definition.tools } } : baseSources.role;
+  const callLayer = options.skills !== void 0 || options.extensions !== void 0 || options.tools !== void 0 ? { ...options.skills === void 0 ? {} : { skills: options.skills }, ...options.extensions === void 0 ? {} : { extensions: options.extensions.map((selector) => canonicalExtensionSelector(selector, options.cwd)) }, ...options.tools === void 0 ? {} : { tools: options.tools } } : baseSources.call;
+  const selectorSources = canonicalSources({ global: baseSources.global, project: baseSources.project, ...roleLayer === void 0 ? {} : { role: roleLayer }, ...callLayer === void 0 ? {} : { call: callLayer } });
+  const callSelectors = selectorSources.call;
+  const roleSelectors = selectorSources.role;
+  const selectorLayers = {
+    skills: [selectorSources.global.skills, selectorSources.project.skills, roleSelectors?.skills, callSelectors?.skills],
+    extensions: [selectorSources.global.extensions, selectorSources.project.extensions, roleSelectors?.extensions, callSelectors?.extensions],
+    tools: [selectorSources.global.tools, selectorSources.project.tools, roleSelectors?.tools, callSelectors?.tools]
+  };
+  const resources = options.resources ?? {};
+  const candidateTools = options.inheritedTools ?? rootToolNames(options.rootTools) ?? resources.tools;
+  const tools = options.effectiveTools ?? (candidateTools === void 0 ? void 0 : selectResourcesByLayers(selectorLayers.tools, candidateTools));
+  const rootTools = rootToolNames(options.rootTools);
+  if (rootTools !== void 0) {
+    const outsideEffectiveTool = options.effectiveTools?.find((tool) => !candidateTools?.includes(tool));
+    if (outsideEffectiveTool) fail("UNKNOWN_TOOL", `Tool is outside the launching session boundary: ${outsideEffectiveTool}`);
+    const outsideCallTool = (options.tools ?? []).find((tool) => !tool.startsWith("!") && !resourcePatternHasMagic(tool) && !candidateTools?.includes(tool));
+    if (outsideCallTool) fail("UNKNOWN_TOOL", `Tool is outside the launching session boundary: ${outsideCallTool}`);
+    const outsideRootTool = tools?.find((tool) => !rootTools.includes(tool));
+    if (outsideRootTool) fail("UNKNOWN_TOOL", `Tool is outside the launching session boundary: ${outsideRootTool}`);
+  }
+  const selectedSkills = resources.skills === void 0 ? void 0 : selectResourcesByLayers(selectorLayers.skills, resources.skills);
+  const extensionResources = resources.extensions?.map((extension) => canonicalPath(extension));
+  const selectedExtensions = extensionResources === void 0 ? void 0 : selectResourcesByLayers(selectorLayers.extensions, extensionResources);
+  const unmatchedSkills = resources.skills === void 0 ? void 0 : unmatchedResourcePatterns(selectorLayers.skills.flatMap((layer) => layer ?? []), resources.skills);
+  const unmatchedExtensions = extensionResources === void 0 ? void 0 : unmatchedResourcePatterns(selectorLayers.extensions.flatMap((layer) => layer ?? []), extensionResources);
+  const unmatchedTools = candidateTools === void 0 ? void 0 : unmatchedResourcePatterns(selectorLayers.tools.flatMap((layer) => layer ?? []), candidateTools);
+  const aliases = options.modelAliases ?? settings?.effective.modelAliases ?? {};
+  const requestedModel = options.model ?? (definition?.model && definition.thinking && !definition.model.includes(":") ? `${definition.model}:${definition.thinking}` : definition?.model);
+  const blockedAlias = requestedModel?.split(":", 1)[0];
+  if (requestedModel !== void 0 && blockedAlias && options.blockedAliases?.has(blockedAlias) && !modelAliasName(requestedModel, aliases)) {
+    const target = options.blockedAliasTargets?.[blockedAlias];
+    fail("UNKNOWN_MODEL", `Unknown model alias ${requestedModel}${target ? ` resolved to ${target}` : ""}${options.settingsPath ? ` (settings: ${options.settingsPath})` : ""}`);
+  }
+  let model = options.modelOverride;
+  if (model === void 0 && requestedModel !== void 0) {
+    assertModelThinking(requestedModel);
+    model = resolveModelReference(requestedModel, aliases, options.knownModels ?? options.availableModels, options.settingsPath ?? settings?.sources.modelAliases);
+  }
+  if (model === void 0) model = options.rootModel;
+  const availableModels = options.knownModels ?? options.availableModels ?? (options.rootModel === void 0 ? void 0 : /* @__PURE__ */ new Set([modelCapability(options.rootModel)]));
+  if (model !== void 0 && availableModels !== void 0 && !availableModels.has(modelCapability(model))) fail("UNKNOWN_MODEL", `Unknown model${requestedModel ? ` ${requestedModel} resolved to ${modelCapability(model)}` : ""}${options.settingsPath ? ` (settings: ${options.settingsPath})` : ""}`);
+  const prompt = definition?.prompt ?? "";
+  const overrideSystemPrompt = definition?.overrideSystemPrompt === true;
+  const contextFiles = options.contextFiles ?? definition?.contextFiles;
+  return { ...name === void 0 ? {} : { name }, ...definition === void 0 ? {} : { definition }, ...model === void 0 ? {} : { model }, ...modelAliasName(requestedModel ?? "", aliases) && requestedModel ? { requestedModel } : {}, ...tools === void 0 ? {} : { tools }, prompt, overrideSystemPrompt, systemPrompt: { mode: overrideSystemPrompt ? "override" : "append", text: prompt }, ...contextFiles === void 0 ? {} : { contextFiles: [...contextFiles] }, ...definition?.extensionSettings === void 0 ? {} : { extensionSettings: definition.extensionSettings }, selectorSources, selectorLayers, ...selectedSkills === void 0 ? {} : { selectedSkills }, ...selectedExtensions === void 0 ? {} : { selectedExtensions }, ...unmatchedSkills === void 0 ? {} : { unmatchedSkills }, ...unmatchedExtensions === void 0 ? {} : { unmatchedExtensions }, ...unmatchedTools === void 0 ? {} : { unmatchedTools } };
+}
+
+// src/validation.ts
+function validateCheckpoint(value) {
+  if (!object(value) || Object.keys(value).some((key) => !["name", "prompt", "context"].includes(key)) || typeof value.name !== "string" || value.name.trim() === "" || typeof value.prompt !== "string" || !jsonValue(value.context)) fail("INVALID_METADATA", "checkpoint requires only name, prompt, and JSON context");
+  if (Buffer.byteLength(value.prompt) > 1024) fail("INVALID_METADATA", "checkpoint prompt exceeds 1024 UTF-8 bytes");
+  if (Buffer.byteLength(JSON.stringify(value.context)) > 4096) fail("INVALID_METADATA", "checkpoint context exceeds 4096 UTF-8 bytes");
+  return { name: value.name, prompt: value.prompt, context: value.context };
 }
 function validateRolePolicies(definitions, roles, availableModels, aliases = {}, knownModels = availableModels, settingsPath) {
   for (const role of roles) {
@@ -3346,12 +3476,6 @@ function workflowPrompt(template, values) {
     return typeof value === "string" ? value : JSON.stringify(value, null, 2);
   });
 }
-function validateSchema(schema, at = "schema") {
-  if (!object(schema) || Object.getPrototypeOf(schema) !== Object.prototype || !jsonValue(schema)) fail("INVALID_SCHEMA", `${at} must be a plain JSON-compatible Schema object`);
-  if (typeof schema.type !== "string" && !Array.isArray(schema.type) && schema.$ref === void 0 && schema.anyOf === void 0 && schema.oneOf === void 0 && schema.allOf === void 0 && schema.const === void 0 && schema.enum === void 0) fail("INVALID_SCHEMA", `${at} has no JSON Schema shape`);
-  if (schema.required !== void 0 && (!Array.isArray(schema.required) || schema.required.some((key) => typeof key !== "string"))) fail("INVALID_SCHEMA", `${at}.required must be an array of strings`);
-  if (schema.properties !== void 0 && !object(schema.properties)) fail("INVALID_SCHEMA", `${at}.properties must be an object`);
-}
 var AGENT_OPTION_KEYS = /* @__PURE__ */ new Set(["label", "model", "tools", "skills", "extensions", "contextFiles", "role", "outputSchema", "retries", "timeoutMs"]);
 function validateAgentOption(key, value, aliases, knownModels, settingsPath) {
   switch (key) {
@@ -3597,7 +3721,7 @@ function validateWorkflowLaunchWithRegistry(params, context, registry) {
   let fileScript;
   if (scriptPath !== void 0) {
     try {
-      fileScript = readFileSync2(resolve3(context.cwd, scriptPath), "utf8");
+      fileScript = readFileSync4(resolve5(context.cwd, scriptPath), "utf8");
     } catch (error) {
       fail("INVALID_SYNTAX", `Cannot read workflow script file ${scriptPath}: ${errorText(error)}`);
     }
@@ -3631,7 +3755,7 @@ function validateWorkflowLaunchWithRegistry(params, context, registry) {
 import { fork, spawn } from "node:child_process";
 import { mkdtempSync, realpathSync as realpathSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 var RPC_LIMIT_BYTES = 10 * 1024 * 1024;
 var HEARTBEAT_TIMEOUT_MS = 5e3;
@@ -4037,7 +4161,7 @@ function shellProcessKill(child) {
   forceKill.unref();
 }
 function executeShellCommand(command, options, signal, cwd = process.cwd()) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     let child;
     try {
       child = spawn(command, { shell: true, cwd, env: { ...process.env, ...options.env ?? {} }, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
@@ -4107,7 +4231,7 @@ function executeShellCommand(command, options, signal, cwd = process.cwd()) {
         reject(error instanceof WorkflowError ? error : new WorkflowError("RPC_LIMIT_EXCEEDED", errorText(error)));
         return;
       }
-      resolve7(result);
+      resolve9(result);
     });
     if (signal.aborted) {
       onAbort();
@@ -4131,8 +4255,8 @@ function workflowErrorFromWorker(error) {
 function runWorkflow(script, args = null, bridge = {}, signal) {
   encoded(args);
   const config = JSON.stringify({ script: instrumentWorkflow(script), args: structuredClone(args), functions: bridge.functions ?? {} });
-  const childDir = realpathSync2(mkdtempSync(join6(tmpdir(), "pi-wf-")));
-  const childFile = join6(childDir, "child.cjs");
+  const childDir = realpathSync2(mkdtempSync(join7(tmpdir(), "pi-wf-")));
+  const childFile = join7(childDir, "child.cjs");
   writeFileSync2(childFile, childSource);
   const child = fork(childFile, [String(RPC_LIMIT_BYTES), config], {
     execArgv: (() => {
@@ -4172,7 +4296,7 @@ function runWorkflow(script, args = null, bridge = {}, signal) {
     }
     if (now - lastHeartbeatAt >= HEARTBEAT_TIMEOUT_MS) stop("WORKER_UNRESPONSIVE", "Workflow worker missed its five-second heartbeat");
   }, HEARTBEAT_INTERVAL_MS);
-  const result = new Promise((resolve7, reject) => {
+  const result = new Promise((resolve9, reject) => {
     rejectResult = reject;
     child.on("message", (raw) => {
       try {
@@ -4187,7 +4311,7 @@ function runWorkflow(script, args = null, bridge = {}, signal) {
         if (message.type === "result") {
           encoded(message.value);
           finish();
-          resolve7(message.value);
+          resolve9(message.value);
           return;
         }
         if (message.type === "error") {
@@ -4343,20 +4467,20 @@ async function persistAgentAttempts(store, id, attempts) {
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync2 } from "node:fs";
 import { copyFile as copyFile2, mkdir as mkdir4 } from "node:fs/promises";
-import { dirname as dirname7, join as join15 } from "node:path";
+import { dirname as dirname8, join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { Type as Type3 } from "@earendil-works/pi-ai";
-import { copyToClipboard, getAgentDir as getAgentDir4, ModelSelectorComponent } from "@earendil-works/pi-coding-agent";
+import { copyToClipboard, getAgentDir as getAgentDir5, ModelSelectorComponent } from "@earendil-works/pi-coding-agent";
 
 // src/agent-execution.ts
-import { existsSync, realpathSync as realpathSync3, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync, realpathSync as realpathSync3, readFileSync as readFileSync5 } from "node:fs";
 import { copyFile } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { basename as basename4, dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
+import { basename as basename4, dirname as dirname5, join as join8, resolve as resolve6 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { Type } from "@earendil-works/pi-ai";
 import { Compile } from "typebox/compile";
-import { createAgentSession, DefaultPackageManager, DefaultResourceLoader, defineTool, getAgentDir as getAgentDir2, ModelRuntime, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { createAgentSession, DefaultPackageManager, DefaultResourceLoader, defineTool, getAgentDir as getAgentDir3, ModelRuntime, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
 
 // src/pi-runtime-adapter.ts
 var TURN_START_EVENTS = /* @__PURE__ */ new Set(["turn_start", "turn_started", "turnStarted"]);
@@ -4631,8 +4755,8 @@ function createLiveSessionHandoff() {
   let request;
   const waitForBoundary = () => {
     if (!turnActive) return Promise.resolve();
-    boundary ??= new Promise((resolve7) => {
-      resolveBoundary = resolve7;
+    boundary ??= new Promise((resolve9) => {
+      resolveBoundary = resolve9;
     });
     return boundary;
   };
@@ -4664,11 +4788,11 @@ function createLiveSessionHandoff() {
       if (request) return request;
       if (isReleased()) return;
       state = "handoff-pending";
-      takeover = new Promise((resolve7) => {
-        resolveTakeover = resolve7;
+      takeover = new Promise((resolve9) => {
+        resolveTakeover = resolve9;
       });
-      resume = new Promise((resolve7) => {
-        resolveResume = resolve7;
+      resume = new Promise((resolve9) => {
+        resolveResume = resolve9;
       });
       request = (async () => {
         await waitForBoundary();
@@ -5195,36 +5319,28 @@ function parseModel(value, fallback, aliases = {}, knownModels, settingsPath) {
 function accounting(stats) {
   return { input: stats.tokens.input, output: stats.tokens.output, cacheRead: stats.tokens.cacheRead, cacheWrite: stats.tokens.cacheWrite, cost: stats.cost };
 }
-var extensionDirectory = dirname4(fileURLToPath3(import.meta.url));
-var workflowPackageRoot = basename4(dirname4(extensionDirectory)) === "dist" ? resolve4(extensionDirectory, "../..") : resolve4(extensionDirectory, "..");
+var extensionDirectory = dirname5(fileURLToPath3(import.meta.url));
+var workflowPackageRoot = basename4(dirname5(extensionDirectory)) === "dist" ? resolve6(extensionDirectory, "../..") : resolve6(extensionDirectory, "..");
 var WORKFLOW_HOST_ENTRIES = /* @__PURE__ */ new Set([
-  canonicalPath(resolve4(workflowPackageRoot, "src/index.ts")),
-  canonicalPath(resolve4(workflowPackageRoot, "dist/src/index.js")),
-  canonicalPath(resolve4(workflowPackageRoot, "starter/index.ts")),
-  canonicalPath(resolve4(workflowPackageRoot, "dist/starter/index.js")),
-  canonicalPath(resolve4(workflowPackageRoot, "subagents/index.ts")),
-  canonicalPath(resolve4(workflowPackageRoot, "dist/subagents/index.js"))
+  canonicalPath(resolve6(workflowPackageRoot, "src/index.ts")),
+  canonicalPath(resolve6(workflowPackageRoot, "dist/src/index.js")),
+  canonicalPath(resolve6(workflowPackageRoot, "starter/index.ts")),
+  canonicalPath(resolve6(workflowPackageRoot, "dist/starter/index.js")),
+  canonicalPath(resolve6(workflowPackageRoot, "subagents/index.ts")),
+  canonicalPath(resolve6(workflowPackageRoot, "dist/subagents/index.js"))
 ]);
-function canonicalExtensionSelector(selector, base = process.cwd()) {
-  const negated = selector.startsWith("!");
-  const body = negated ? selector.slice(1) : selector;
-  if (body === "*" || body === "**" || body.startsWith("**/")) return selector;
-  const resolved = resolve4(base, body);
-  if (resourcePatternHasMagic(body)) return `${negated ? "!" : ""}${resolved}`;
-  return `${negated ? "!" : ""}${canonicalPath(resolved)}`;
-}
 var WORKFLOW_DIRECTORY = "pi-extensible-workflows";
 function workflowSystemPromptPath(cwd, agentDir, projectTrusted2) {
-  const projectPath = join7(cwd, ".pi", WORKFLOW_DIRECTORY, "SYSTEM.md");
+  const projectPath = join8(cwd, ".pi", WORKFLOW_DIRECTORY, "SYSTEM.md");
   if (projectTrusted2 && existsSync(projectPath)) return projectPath;
-  const globalPaths = [join7(homedir5(), ".pi", WORKFLOW_DIRECTORY, "SYSTEM.md"), join7(agentDir, WORKFLOW_DIRECTORY, "SYSTEM.md")];
+  const globalPaths = [join8(homedir5(), ".pi", WORKFLOW_DIRECTORY, "SYSTEM.md"), join8(agentDir, WORKFLOW_DIRECTORY, "SYSTEM.md")];
   return globalPaths.find((path) => existsSync(path));
 }
 function filterContextFiles(base, scopes, cwd, agentDir) {
   const globalPath = canonicalPath(agentDir);
   const cwdPath = canonicalPath(cwd);
   return base.filter(({ path }) => {
-    const resolvedPath = canonicalPath(dirname4(path));
+    const resolvedPath = canonicalPath(dirname5(path));
     return scopes.some((scope) => scope === "global" ? resolvedPath === globalPath : scope === "cwd" ? resolvedPath === cwdPath : resolvedPath !== globalPath && resolvedPath !== cwdPath);
   });
 }
@@ -5250,10 +5366,10 @@ async function loadNativePromptTemplateModule() {
   const packageDirectory = await loadPiPackageDirectory();
   let promptTemplatePath;
   if (packageDirectory.directory) {
-    const candidate = resolve4(packageDirectory.directory, "dist/core/prompt-templates.js");
+    const candidate = resolve6(packageDirectory.directory, "dist/core/prompt-templates.js");
     if (existsSync(candidate)) promptTemplatePath = candidate;
   }
-  promptTemplatePath ??= resolve4(dirname4(fileURLToPath3(import.meta.resolve("@earendil-works/pi-coding-agent"))), "core/prompt-templates.js");
+  promptTemplatePath ??= resolve6(dirname5(fileURLToPath3(import.meta.resolve("@earendil-works/pi-coding-agent"))), "core/prompt-templates.js");
   const packageDirectoryError = packageDirectory.error ? ` Package directory lookup failed: ${packageDirectory.error}` : "";
   return nativePromptTemplateModule ??= import(promptTemplatePath).then((module) => module).catch((error) => {
     throw new Error(`Could not load Pi prompt templates.${packageDirectoryError}`, { cause: error });
@@ -5328,13 +5444,13 @@ function flushExtensionProviders(resourceLoader, modelRuntime) {
   return failures;
 }
 async function createLocalPiSessionHandle(input, sessionStartEvent) {
-  const agentDir = input.agentDir ?? getAgentDir2();
+  const agentDir = input.agentDir ?? getAgentDir3();
   const systemPromptSource = workflowSystemPromptPath(input.cwd, agentDir, input.resourcePolicy?.projectTrusted ?? true);
   const systemPromptOptions = input.systemPrompt !== void 0 ? { systemPromptOverride: () => input.systemPrompt } : systemPromptSource !== void 0 ? { systemPrompt: systemPromptSource } : {};
   const contextFilesOverride = input.contextFiles === void 0 ? void 0 : (base) => ({ ...base, agentsFiles: filterContextFiles(base.agentsFiles, input.contextFiles ?? [], input.cwd, agentDir) });
-  const manager = input.sessionManager ?? (input.sessionPath ? SessionManager.open(input.sessionPath, join7(agentDir, "sessions"), input.cwd) : input.agentDir ? SessionManager.create(input.cwd, join7(agentDir, "sessions")) : SessionManager.create(input.cwd));
+  const manager = input.sessionManager ?? (input.sessionPath ? SessionManager.open(input.sessionPath, join8(agentDir, "sessions"), input.cwd) : input.agentDir ? SessionManager.create(input.cwd, join8(agentDir, "sessions")) : SessionManager.create(input.cwd));
   if (!input.sessionPath) manager.appendSessionInfo(input.sessionLabel);
-  const modelRuntime = await ModelRuntime.create({ authPath: join7(agentDir, "auth.json"), modelsPath: join7(agentDir, "models.json") });
+  const modelRuntime = await ModelRuntime.create({ authPath: join8(agentDir, "auth.json"), modelsPath: join8(agentDir, "models.json") });
   const customTools = [...input.customTools ?? [], ...input.resultTool ? [input.resultTool] : []];
   const tools = [.../* @__PURE__ */ new Set([...input.tools, ...customTools.map(({ name }) => name)])];
   let settingsManager;
@@ -5347,20 +5463,22 @@ async function createLocalPiSessionHandle(input, sessionStartEvent) {
     const resolved = await packageManager.resolve();
     const discoveredExtensions = [...new Set(resolved.extensions.filter(({ enabled, metadata }) => enabled && (policy.projectTrusted || metadata.scope !== "project")).map(({ path }) => canonicalPath(path)))];
     const selectorSources = policy.selectorSources;
-    const extensionLayers = [selectorSources.global.extensions, selectorSources.project.extensions, selectorSources.role?.extensions, selectorSources.call?.extensions];
-    const extensionSelectors = extensionLayers.flatMap((layer) => (layer ?? []).map((original) => ({ original, matching: canonicalExtensionSelector(original, input.cwd) })));
-    const selectedExtensions = selectResourcesByLayers(extensionLayers.map((layer) => layer?.map((selector) => canonicalExtensionSelector(selector, input.cwd))), discoveredExtensions);
+    const selection = resolveRole(void 0, {
+      cwd: input.cwd,
+      selectorSources,
+      resources: { extensions: discoveredExtensions }
+    });
+    const selectedExtensions = selection.selectedExtensions ?? [];
     const extensionPaths = selectedExtensions.filter((path) => !WORKFLOW_HOST_ENTRIES.has(path));
-    const unmatchedExtensions = extensionSelectors.filter(({ matching }) => unmatchedResourcePatterns([matching], discoveredExtensions).length > 0).map(({ original }) => original);
     policy.selectedExtensions = selectedExtensions;
-    policy.unmatchedExtensions = unmatchedExtensions;
+    policy.unmatchedExtensions = selection.unmatchedExtensions ?? [];
     const skillPaths = [...new Set(resolved.skills.filter(({ enabled, metadata }) => enabled && (policy.projectTrusted || metadata.scope !== "project")).map(({ path }) => path))];
     const updateSkillMatches = (skills) => {
       const names = [...new Set(skills.map(({ name }) => name))];
-      const skillLayers = [selectorSources.global.skills, selectorSources.project.skills, selectorSources.role?.skills, selectorSources.call?.skills];
-      const selectedSkills = selectResourcesByLayers(skillLayers, names);
+      const selected = resolveRole(void 0, { cwd: input.cwd, selectorSources, resources: { skills: names } });
+      const selectedSkills = selected.selectedSkills ?? [];
       policy.selectedSkills = selectedSkills;
-      policy.unmatchedSkills = unmatchedResourcePatterns(skillLayers.flatMap((layer) => layer ?? []), names);
+      policy.unmatchedSkills = selected.unmatchedSkills ?? [];
       return new Set(names.filter((name) => !selectedSkills.includes(name)));
     };
     resourceLoader = new DefaultResourceLoader({
@@ -5852,27 +5970,27 @@ function appendResourcePolicyNarrowing(ceiling, candidate) {
   };
 }
 function packageRoot(start) {
-  let current = dirname4(realpathSync3(start));
+  let current = dirname5(realpathSync3(start));
   for (; ; ) {
-    const candidates = [current, join7(current, "..", "@earendil-works", "pi-coding-agent"), join7(current, "..", "pi-coding-agent")];
+    const candidates = [current, join8(current, "..", "@earendil-works", "pi-coding-agent"), join8(current, "..", "pi-coding-agent")];
     for (const candidate of candidates) {
-      const packageJsonPath = join7(candidate, "package.json");
+      const packageJsonPath = join8(candidate, "package.json");
       if (!existsSync(packageJsonPath)) continue;
-      const packageJson = JSON.parse(readFileSync3(packageJsonPath, "utf8"));
+      const packageJson = JSON.parse(readFileSync5(packageJsonPath, "utf8"));
       if (object(packageJson) && typeof packageJson.name === "string" && packageJson.name === "@earendil-works/pi-coding-agent") return candidate;
     }
-    const parent = dirname4(current);
+    const parent = dirname5(current);
     if (parent === current) return void 0;
     current = parent;
   }
 }
 function piPackageEntrypoint(root) {
-  const packageJson = JSON.parse(readFileSync3(join7(root, "package.json"), "utf8"));
+  const packageJson = JSON.parse(readFileSync5(join8(root, "package.json"), "utf8"));
   if (!object(packageJson)) throw new Error("the @earendil-works/pi-coding-agent package does not declare a pi CLI");
   const bin = packageJson.bin;
   const cli = typeof bin === "string" ? bin : object(bin) && typeof bin.pi === "string" ? bin.pi : void 0;
   if (!cli) throw new Error("the @earendil-works/pi-coding-agent package does not declare a pi CLI");
-  const entrypoint = resolve4(root, cli);
+  const entrypoint = resolve6(root, cli);
   if (!existsSync(entrypoint)) throw new Error(`the originating Pi CLI entrypoint is unavailable: ${entrypoint}`);
   return entrypoint;
 }
@@ -5913,7 +6031,7 @@ ${instruction}` : ""}`;
 }
 async function preparedAgentSession(input, initialPrompt) {
   const { runtime: piRuntime, error: piRuntimeError } = await piRuntimeResolution;
-  const systemPromptPath = input.systemPrompt === void 0 ? workflowSystemPromptPath(input.cwd, input.agentDir ?? getAgentDir2(), input.resourcePolicy?.projectTrusted ?? true) : void 0;
+  const systemPromptPath = input.systemPrompt === void 0 ? workflowSystemPromptPath(input.cwd, input.agentDir ?? getAgentDir3(), input.resourcePolicy?.projectTrusted ?? true) : void 0;
   const prepared = {
     cwd: input.cwd,
     model: Object.freeze({ ...input.model }),
@@ -5943,7 +6061,7 @@ function agentSetupSummary(setup, hookNames) {
   return { hookNames: [...hookNames], model: { provider: model.provider, model: model.model, ...model.thinking ? { thinking: model.thinking } : {} }, tools: [...setup.sessionInput.tools, ...setup.sessionInput.resultTool ? [setup.sessionInput.resultTool.name] : []], cwd: setup.sessionInput.cwd, ...setup.sessionInput.resourcePolicy ? { resourceSelectors: resourcePolicySummary(setup.sessionInput.resourcePolicy, setup.sessionInput.tools) } : {} };
 }
 async function attemptSessionInput(source, attempt) {
-  const target = join7(dirname4(source), `${basename4(source, ".jsonl")}-attempt-${String(attempt)}.jsonl`);
+  const target = join8(dirname5(source), `${basename4(source, ".jsonl")}-attempt-${String(attempt)}.jsonl`);
   await copyFile(source, target);
   return target;
 }
@@ -6053,7 +6171,6 @@ var WorkflowAgentExecutor = class {
     const roleName = typeof options.role === "string" ? options.role : void 0;
     const roleDefinition = roleName ? this.root.agentDefinitions?.[roleName] : void 0;
     if (roleName && !roleDefinition) throw new WorkflowError("UNKNOWN_AGENT_TYPE", `Unknown agent role: ${roleName}`);
-    const candidateTools = inheritedTools !== void 0 ? [...inheritedTools] : [...this.root.tools];
     if (inheritedTools === void 0) for (const pattern of roleDefinition?.tools ?? []) {
       const body = pattern.startsWith("!") ? pattern.slice(1) : pattern;
       if (!pattern.startsWith("!") && !resourcePatternHasMagic(pattern) && !this.root.tools.has(body)) {
@@ -6064,33 +6181,30 @@ var WorkflowAgentExecutor = class {
         }
       }
     }
-    const selectorLayers = [
-      this.root.resourceSelectors?.tools,
-      roleDefinition?.tools,
-      options.tools
-    ];
-    for (const pattern of options.tools ?? []) {
-      const body = pattern.startsWith("!") ? pattern.slice(1) : pattern;
-      if (!pattern.startsWith("!") && !resourcePatternHasMagic(pattern) && !candidateTools.includes(body)) throw new WorkflowError("UNKNOWN_TOOL", `Tool is outside the launching session boundary: ${body}`);
-    }
-    const outsideEffectiveTool = options.effectiveTools?.find((tool) => !candidateTools.includes(tool));
-    if (outsideEffectiveTool) throw new WorkflowError("UNKNOWN_TOOL", `Tool is outside the launching session boundary: ${outsideEffectiveTool}`);
-    const requested = options.effectiveTools ?? selectResourcesByLayers(selectorLayers, candidateTools);
-    const forbidden = requested.find((tool) => !this.root.tools.has(tool));
-    if (forbidden) throw new WorkflowError("UNKNOWN_TOOL", `Tool is outside the launching session boundary: ${forbidden}`);
-    const requestedModel = options.model ?? (roleDefinition?.model && roleDefinition.thinking && !roleDefinition.model.includes(":") ? `${roleDefinition.model}:${roleDefinition.thinking}` : roleDefinition?.model);
-    const alias = requestedModel === void 0 ? void 0 : modelAliasName(requestedModel, this.root.modelAliases ?? {});
-    const blockedAlias = requestedModel?.split(":", 1)[0];
-    if (requestedModel !== void 0 && blockedAlias && this.root.blockedAliases?.has(blockedAlias) && !alias) {
-      const target = this.root.blockedAliasTargets?.[blockedAlias];
-      throw new WorkflowError("UNKNOWN_MODEL", `Unknown model alias ${requestedModel}${target ? ` resolved to ${target}` : ""}${this.root.settingsPath ? ` (settings: ${this.root.settingsPath})` : ""}`);
-    }
-    const model = options.modelOverride ?? parseModel(requestedModel, this.root.model, this.root.modelAliases, this.root.knownModels ?? this.root.availableModels, this.root.settingsPath);
-    const availableModels = this.root.knownModels ?? this.root.availableModels ?? /* @__PURE__ */ new Set([modelCapability(this.root.model)]);
-    if (!availableModels.has(modelCapability(model))) throw new WorkflowError("UNKNOWN_MODEL", `Unknown model${requestedModel ? ` ${requestedModel} resolved to ${modelCapability(model)}` : ""}${this.root.settingsPath ? ` (settings: ${this.root.settingsPath})` : ""}`);
-    const overrideSystemPrompt = roleDefinition?.overrideSystemPrompt === true;
-    const contextFiles = options.contextFiles ?? roleDefinition?.contextFiles;
-    return { model, ...alias && requestedModel ? { requestedModel } : {}, tools: requested, ...overrideSystemPrompt ? { systemPrompt: roleDefinition.prompt ?? "" } : {}, systemPromptAppend: overrideSystemPrompt ? "" : roleDefinition?.prompt ?? "", ...contextFiles === void 0 ? {} : { contextFiles: [...contextFiles] } };
+    const resolved = resolveRole(roleName, {
+      cwd: this.root.cwd,
+      ...roleDefinition === void 0 ? {} : { definition: roleDefinition },
+      ...this.root.agentDefinitions === void 0 ? {} : { definitions: this.root.agentDefinitions },
+      ...this.root.agentDir === void 0 ? {} : { agentDir: this.root.agentDir },
+      selectorSources: { global: this.root.resourceSelectors ?? {}, project: {} },
+      ...this.root.modelAliases === void 0 ? {} : { modelAliases: this.root.modelAliases },
+      ...this.root.knownModels === void 0 ? {} : { knownModels: this.root.knownModels },
+      ...this.root.availableModels === void 0 ? {} : { availableModels: this.root.availableModels },
+      ...this.root.blockedAliases === void 0 ? {} : { blockedAliases: this.root.blockedAliases },
+      ...this.root.blockedAliasTargets === void 0 ? {} : { blockedAliasTargets: this.root.blockedAliasTargets },
+      ...this.root.settingsPath === void 0 ? {} : { settingsPath: this.root.settingsPath },
+      rootModel: this.root.model,
+      rootTools: this.root.tools,
+      ...inheritedTools === void 0 ? {} : { inheritedTools },
+      ...options.model === void 0 ? {} : { model: options.model },
+      ...options.modelOverride === void 0 ? {} : { modelOverride: options.modelOverride },
+      ...options.tools === void 0 ? {} : { tools: options.tools },
+      ...options.skills === void 0 ? {} : { skills: options.skills },
+      ...options.extensions === void 0 ? {} : { extensions: options.extensions },
+      ...options.contextFiles === void 0 ? {} : { contextFiles: options.contextFiles },
+      ...options.effectiveTools === void 0 ? {} : { effectiveTools: options.effectiveTools }
+    });
+    return { model: resolved.model ?? this.root.model, ...resolved.requestedModel === void 0 ? {} : { requestedModel: resolved.requestedModel }, tools: resolved.tools ?? [], ...resolved.overrideSystemPrompt ? { systemPrompt: resolved.prompt } : {}, systemPromptAppend: resolved.overrideSystemPrompt ? "" : resolved.prompt, ...resolved.contextFiles === void 0 ? {} : { contextFiles: resolved.contextFiles } };
   }
   async execute(task, options, signal, customTools = [], setSteer, beforeRetry) {
     const executionSignal = signal ?? this.root.runContext?.signal;
@@ -6376,12 +6490,12 @@ var FairAgentScheduler = class {
     const id = `${runId}:${String(++this.#nextId)}`;
     const tuiIndex = ++run.nextIndex;
     let resolveResult = () => void 0;
-    const promise = new Promise((resolve7) => {
-      resolveResult = resolve7;
+    const promise = new Promise((resolve9) => {
+      resolveResult = resolve9;
     });
     let resolveCompletion = () => void 0;
-    const completion = new Promise((resolve7) => {
-      resolveCompletion = resolve7;
+    const completion = new Promise((resolve9) => {
+      resolveCompletion = resolve9;
     });
     const node = { id, runId, ...parentId ? { parentId } : {}, prompt, options: effective, children: /* @__PURE__ */ new Set(), collected: false, collecting: false, resultQueue: Promise.resolve(), state: "queued", controller: new AbortController(), promise, resolve: resolveResult, completion, resolveCompletion, task: async () => void 0, restored: false };
     node.task = async () => {
@@ -6419,8 +6533,8 @@ var FairAgentScheduler = class {
     const childPromise = child.promise;
     const previousCollection = parent.resultQueue;
     let releaseCollection = () => void 0;
-    parent.resultQueue = new Promise((resolve7) => {
-      releaseCollection = resolve7;
+    parent.resultQueue = new Promise((resolve9) => {
+      releaseCollection = resolve9;
     });
     try {
       await previousCollection;
@@ -6429,9 +6543,9 @@ var FairAgentScheduler = class {
       this.#persist(parent.runId);
       this.#release(parent.runId);
       const outcome = await childPromise;
-      await new Promise((resolve7) => {
+      await new Promise((resolve9) => {
         this.#enqueue(parent.runId, void 0, () => {
-          resolve7();
+          resolve9();
         });
       });
       if (this.#cancelledOrSettled(parent)) {
@@ -6564,12 +6678,12 @@ var FairAgentScheduler = class {
     for (const record3 of ownership) {
       if (record3.id.split(":").slice(0, -1).join(":") !== runId) throw new WorkflowError("RESUME_INCOMPATIBLE", `Persisted agent belongs to another run: ${record3.id}`);
       let resolveResult = () => void 0;
-      const promise = new Promise((resolve7) => {
-        resolveResult = resolve7;
+      const promise = new Promise((resolve9) => {
+        resolveResult = resolve9;
       });
       let resolveCompletion = () => void 0;
-      const completion = new Promise((resolve7) => {
-        resolveCompletion = resolve7;
+      const completion = new Promise((resolve9) => {
+        resolveCompletion = resolve9;
       });
       const node = { id: record3.id, runId, ...record3.parentId ? { parentId: record3.parentId } : {}, ...record3.prompt === void 0 ? {} : { prompt: record3.prompt }, options: this.#inherit(run, void 0, record3.options), children: /* @__PURE__ */ new Set(), collected: false, collecting: false, resultQueue: Promise.resolve(), state: record3.state, controller: new AbortController(), promise, resolve: resolveResult, completion, resolveCompletion, task: async () => void 0, restored: true };
       this.#nodes.set(node.id, node);
@@ -6658,9 +6772,9 @@ var FairAgentScheduler = class {
       const child = this.#nodes.get(childId);
       if (child && !child.collected) this.#cancelTree(child);
     }
-    const resolve7 = node.resolve;
+    const resolve9 = node.resolve;
     node.resolve = void 0;
-    resolve7?.(result);
+    resolve9?.(result);
     node.resolveCompletion();
   }
   #cancelTree(node) {
@@ -6723,8 +6837,8 @@ var RunLifecycle = class {
     return this.#state;
   }
   async enter() {
-    while (this.#state === "pausing" || this.#state === "paused" || this.#state === "awaiting_input") await new Promise((resolve7) => {
-      this.#waiters.push(resolve7);
+    while (this.#state === "pausing" || this.#state === "paused" || this.#state === "awaiting_input") await new Promise((resolve9) => {
+      this.#waiters.push(resolve9);
     });
     if (this.#state !== "running") throw new WorkflowError("CANCELLED", `Run is ${this.#state}`);
     this.#active += 1;
@@ -6734,8 +6848,8 @@ var RunLifecycle = class {
     if (this.#state === "pausing" && this.#active === 0) await this.#set("paused", "pause");
   }
   async enterAwaitingInput() {
-    while (this.#state === "pausing" || this.#state === "paused") await new Promise((resolve7) => {
-      this.#waiters.push(resolve7);
+    while (this.#state === "pausing" || this.#state === "paused") await new Promise((resolve9) => {
+      this.#waiters.push(resolve9);
     });
     if (this.#state === "awaiting_input") return;
     if (this.#state !== "running") throw new WorkflowError("RESUME_INCOMPATIBLE", `Cannot await input for ${this.#state} run`);
@@ -6744,7 +6858,7 @@ var RunLifecycle = class {
   async resolveAwaitingInput() {
     if (this.#state !== "awaiting_input") return;
     await this.#set("running", "checkpoint_resolved");
-    for (const resolve7 of this.#waiters.splice(0)) resolve7();
+    for (const resolve9 of this.#waiters.splice(0)) resolve9();
   }
   async pause() {
     if (this.#state !== "running") throw new WorkflowError("RESUME_INCOMPATIBLE", `Cannot pause ${this.#state} run`);
@@ -6755,7 +6869,7 @@ var RunLifecycle = class {
   async resume() {
     if (this.#state !== "pausing" && this.#state !== "paused" && this.#state !== "interrupted" && this.#state !== "budget_exhausted") throw new WorkflowError("RESUME_INCOMPATIBLE", `Cannot resume ${this.#state} run`);
     await this.#set("running", "resume");
-    for (const resolve7 of this.#waiters.splice(0)) resolve7();
+    for (const resolve9 of this.#waiters.splice(0)) resolve9();
   }
   async providerPause() {
     await this.leave();
@@ -6765,7 +6879,7 @@ var RunLifecycle = class {
   async terminal(state, reason) {
     if (HARD_TERMINAL_RUN_STATES.has(this.#state)) throw new WorkflowError("RESUME_INCOMPATIBLE", `${this.#state} runs are terminal`);
     await this.#set(state, reason ?? state);
-    for (const resolve7 of this.#waiters.splice(0)) resolve7();
+    for (const resolve9 of this.#waiters.splice(0)) resolve9();
   }
   async #set(state, reason) {
     const previousState = this.#state;
@@ -7041,7 +7155,7 @@ function withWorkflowFunctions(bridge, store, runContext, registry, settings = O
 import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/host-delivery.ts
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 import { DEFAULT_MAX_BYTES } from "@earendil-works/pi-coding-agent";
 var FAILURE_DELIVERY_STATES = /* @__PURE__ */ new Set(["failed", "stopped", "interrupted", "budget_exhausted"]);
 var ForegroundDeliveryController = class {
@@ -7366,7 +7480,7 @@ async function createWorkflowFailureDiagnostics(store, metadata, error, run) {
     completedSiblingAgents,
     completedSiblingPaths,
     ...retry ? { retry } : {},
-    artifacts: { runDirectory: store.directory, statePath: join8(store.directory, "state.json"), journalPath: join8(store.directory, "journal.json") }
+    artifacts: { runDirectory: store.directory, statePath: join9(store.directory, "state.json"), journalPath: join9(store.directory, "journal.json") }
   });
 }
 function formatWorkflowFailureDiagnostics(diagnostic) {
@@ -7393,7 +7507,7 @@ function formatWorkflowFailureDeliveryFallback(workflowName, runId, runDirectory
   const code = errorCode(error) ?? "INTERNAL_ERROR";
   const failedPath = workflowFailedAt(error);
   const nextAction = retryable && code !== "BUDGET_EXHAUSTED" && code !== "CANCELLED" ? `; next action: workflow_retry({ runId: ${JSON.stringify(runId)} })` : "";
-  const line = `Workflow ${deliveryPart(workflowName, 128)} failed (runId=${deliveryPart(runId, 128)}): error=${code}: ${deliveryPart(formatWorkflowFailure(error), 768)}${failedPath ? `; failed path=${deliveryPart(failedPath, 512)}` : ""}${nextAction}; artifacts: runDirectory=${deliveryPart(runDirectory, 512)} statePath=${deliveryPart(join8(runDirectory, "state.json"), 512)} journalPath=${deliveryPart(join8(runDirectory, "journal.json"), 512)}`;
+  const line = `Workflow ${deliveryPart(workflowName, 128)} failed (runId=${deliveryPart(runId, 128)}): error=${code}: ${deliveryPart(formatWorkflowFailure(error), 768)}${failedPath ? `; failed path=${deliveryPart(failedPath, 512)}` : ""}${nextAction}; artifacts: runDirectory=${deliveryPart(runDirectory, 512)} statePath=${deliveryPart(join9(runDirectory, "state.json"), 512)} journalPath=${deliveryPart(join9(runDirectory, "journal.json"), 512)}`;
   return Buffer.byteLength(line) <= DELIVERY_LIMIT_BYTES ? line : utf8Prefix(line, DELIVERY_LIMIT_BYTES);
 }
 function serializeWorkflowFailureDiagnostics(diagnostic) {
@@ -7728,14 +7842,14 @@ function createWorkflowRecovery(deps) {
 
 // src/host-navigator.ts
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 import { SettingsManager as SettingsManager2, truncateToVisualLines as truncateToVisualLines2 } from "@earendil-works/pi-coding-agent";
 
 // src/workflow-artifacts.ts
 import { spawn as spawn2 } from "node:child_process";
 import { mkdtemp, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function workflowScriptArtifact(script) {
   return { extension: ".js", content: script };
 }
@@ -7749,23 +7863,23 @@ function workflowResultArtifact(value) {
 async function spawnWorkflowEditor(command, path) {
   const [editor, ...editorArgs] = command.split(" ");
   if (!editor) return null;
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     try {
       const child = spawn2(editor, [...editorArgs, path], { stdio: "inherit", shell: process.platform === "win32" });
       child.once("error", () => {
-        resolve7(null);
+        resolve9(null);
       });
       child.once("close", (code) => {
-        resolve7(code);
+        resolve9(code);
       });
     } catch {
-      resolve7(null);
+      resolve9(null);
     }
   });
 }
 async function openWorkflowArtifact(tui, command, artifact) {
-  const directory = await mkdtemp(join9(tmpdir2(), "pi-workflow-editor-"));
-  const path = join9(directory, `artifact${artifact.extension}`);
+  const directory = await mkdtemp(join10(tmpdir2(), "pi-workflow-editor-"));
+  const path = join10(directory, `artifact${artifact.extension}`);
   try {
     await writeFile3(path, artifact.content, { encoding: "utf8", mode: 384 });
     tui.stop();
@@ -7782,11 +7896,11 @@ async function openWorkflowArtifact(tui, command, artifact) {
 
 // src/host-view.ts
 import { keyHint, truncateToVisualLines } from "@earendil-works/pi-coding-agent";
-import { truncateToWidth as truncateToWidth2 } from "@earendil-works/pi-tui";
+import { truncateToWidth as truncateToWidth2, visibleWidth as visibleWidth2 } from "@earendil-works/pi-tui";
 
 // src/background-widget.ts
-import { readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { join as join11 } from "node:path";
 import { isKeyRelease, Key, matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 var KEY = "piewf-widget";
 var ENTRY_TYPE = "piewf-run-receipt";
@@ -7876,7 +7990,7 @@ function renderableRun(value) {
 }
 function readRun(directory) {
   try {
-    const state = JSON.parse(readFileSync4(join10(directory, "state.json"), "utf8"));
+    const state = JSON.parse(readFileSync6(join11(directory, "state.json"), "utf8"));
     if (!renderableRun(state)) return void 0;
     const startedAt = statSync2(directory).birthtimeMs;
     return { ...state, directory, startedAt };
@@ -8105,7 +8219,6 @@ function renderFrame(runs, now, width, offset = 0, theme, scrolling = false, siz
   const title = live.length === 1 ? "Workflow" : `Workflows \xB7 ${String(live.length)} runs`;
   sizeOut.rows = rows.length;
   const body = collapse(rows, MAX_ROWS - 2, paint, offset, scrolling);
-  const inner = Math.max(20, width - 4);
   const total = rows.length;
   const shown = body.length;
   const scrollbar = (index) => {
@@ -8117,6 +8230,11 @@ function renderFrame(runs, now, width, offset = 0, theme, scrolling = false, siz
     const top = limit === 0 ? 0 : start >= limit ? shown - size : Math.floor(start / limit * (shown - size));
     return index >= top && index < top + size ? "\u2588" : "\u2591";
   };
+  const hint = !__navigationForTests.enabled || maxOffset(total, MAX_ROWS - 2) === 0 ? "" : scrolling ? "\u2191/\u2193 to scroll \xB7 Esc to exit" : "Alt+O to scroll";
+  return drawFrame(title, hint, body, width, paint, accent, scrollbar);
+}
+function drawFrame(title, hint, body, width, paint, accent, scrollbar = () => void 0) {
+  const inner = Math.max(20, width - 4);
   const lines = body.map((row, index) => {
     const right = row.right ?? "";
     const rightWidth = right === "" ? 0 : visibleLength(right) + 2;
@@ -8128,7 +8246,6 @@ function renderFrame(runs, now, width, offset = 0, theme, scrolling = false, siz
     const bar = scrollbar(index);
     return `${rule} ${text} ${bar === void 0 ? rule : accent(bar)}`;
   });
-  const hint = !__navigationForTests.enabled || maxOffset(total, MAX_ROWS - 2) === 0 ? "" : scrolling ? "\u2191/\u2193 to scroll \xB7 Esc to exit" : "Alt+O to scroll";
   const label = ` ${title} `;
   const tail = hint === "" ? "" : ` ${hint} `;
   const spare = inner + 2 - visibleLength(label) - visibleLength(tail);
@@ -8507,7 +8624,7 @@ function widget(pi, enabled = true) {
         continue;
       }
       try {
-        const mtime = statSync2(join10(run.directory, "state.json")).mtimeMs;
+        const mtime = statSync2(join11(run.directory, "state.json")).mtimeMs;
         if (mtime === seen.get(runId)) continue;
         seen.set(runId, mtime);
         const fresh = readRun(run.directory);
@@ -8624,7 +8741,7 @@ function widget(pi, enabled = true) {
       const waiting = runs.get(runId)?.waiting;
       runs.set(runId, waiting ? { ...run, waiting } : run);
       try {
-        seen.set(runId, statSync2(join10(directory, "state.json")).mtimeMs);
+        seen.set(runId, statSync2(join11(directory, "state.json")).mtimeMs);
       } catch {
       }
       if (isRunTerminal(run.state) && !awaitingDedicatedReceipt.has(runId)) receipt(runId);
@@ -9020,7 +9137,7 @@ function formatLogTimestamp(timestamp) {
   if (Number.isNaN(date.getTime())) return "--:--:--";
   return [date.getHours(), date.getMinutes(), date.getSeconds()].map((part) => String(part).padStart(2, "0")).join(":");
 }
-function workflowLogLines(run, styles, expanded, width, showHint = false) {
+function workflowLogLines(run, styles, expanded, width, showHint = false, tail = 5) {
   const events = (run.events ?? []).filter((event) => event.type === "log");
   if (!events.length) return [];
   const indent = " ".repeat(11);
@@ -9030,7 +9147,7 @@ function workflowLogLines(run, styles, expanded, width, showHint = false) {
     const chunks = truncateToVisualLines(message, Number.MAX_SAFE_INTEGER, Math.max(1, width - 11), 0).visualLines;
     return chunks.map((chunk, chunkIndex) => `${chunkIndex === 0 ? prefix : indent}${chunk}`);
   }));
-  const visible = expanded ? visualLines : visualLines.slice(-5);
+  const visible = expanded ? visualLines : visualLines.slice(-tail);
   let hint = "";
   if (!expanded && showHint) {
     try {
@@ -9040,7 +9157,47 @@ function workflowLogLines(run, styles, expanded, width, showHint = false) {
   }
   return [expanded ? `  ${styles.muted("Logs")}` : `  ${styles.muted(`Logs${hint}`)}`, ...visible];
 }
-function formatWorkflowProgress(run, spinner2 = "\u25C7", styles = PLAIN_WORKFLOW_PROGRESS_STYLES, now = Date.now(), expanded = false, width, showHint = false) {
+var ACTIVE_AGENT_STATES = /* @__PURE__ */ new Set(["running", "waiting_for_child", "retrying", "paused"]);
+var COMPACT_RECENT_SETTLED = 3;
+var COMPACT_LOG_LINES = 3;
+function expandHint() {
+  try {
+    return ` (${keyHint("app.tools.expand", "to expand")})`;
+  } catch {
+    return "";
+  }
+}
+function agentEnd(agent) {
+  return (agent.startedAt ?? 0) + (agent.durationMs ?? 0);
+}
+function phaseSummary(agents, styles) {
+  const count = (state) => agents.filter((agent) => agent.state === state).length;
+  const starts = agents.map((agent) => agent.startedAt).filter((value) => value !== void 0);
+  const span = starts.length ? Math.max(...agents.map(agentEnd)) - Math.min(...starts) : 0;
+  const accounting2 = sumAccounting(agents.map((agent) => agent.accounting ?? zeroAccounting()));
+  const failed = count("failed");
+  const parts = [`${String(count("completed"))} done`, ...failed ? [styles.error(`${String(failed)} failed`)] : [], ...count("cancelled") ? [`${String(count("cancelled"))} cancelled`] : [], ...span > 0 ? [formatWorkflowRuntime(span)] : [], formatTokens(accounting2.input + accounting2.output), formatCost(accounting2.cost)].filter(Boolean);
+  return styles.muted(parts.join(" \xB7 "));
+}
+function formatWorkflowProgress(run, spinner2 = "\u25C7", styles = PLAIN_WORKFLOW_PROGRESS_STYLES, now = Date.now(), expanded = false, width, showHint = false, maxLines) {
+  const full = workflowProgressLines(run, spinner2, styles, now, expanded, width, showHint);
+  if (expanded || maxLines === void 0 || full.length <= maxLines) return full.join("\n");
+  const phases = run.phaseHistory?.length ? run.phaseHistory : run.phase ? [{ phase: run.phase, afterAgent: 0 }] : [];
+  const currentStart = Math.min(run.agents.length, phases.at(-1)?.afterAgent ?? 0);
+  const current = run.agents.slice(currentStart);
+  const recent = current.filter((agent) => SETTLED_AGENT_STATES.has(agent.state) && agent.state !== "failed").sort((left, right) => agentEnd(right) - agentEnd(left)).slice(0, COMPACT_RECENT_SETTLED);
+  const candidates = [...current.filter((agent) => agent.state === "failed"), ...current.filter((agent) => ACTIVE_AGENT_STATES.has(agent.state)), ...recent];
+  const render = (count) => workflowProgressLines(run, spinner2, styles, now, false, width, showHint, new Set(candidates.slice(0, count)));
+  let low = 0;
+  let high = candidates.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (render(middle).length <= maxLines) low = middle;
+    else high = middle - 1;
+  }
+  return render(low).join("\n");
+}
+function workflowProgressLines(run, spinner2, styles, now, expanded, width, showHint, shown) {
   const done = run.agents.filter((agent) => SETTLED_AGENT_STATES.has(agent.state)).length;
   const workflowIcon = runStateGlyph(run.state, spinner2);
   const iconStyle = workflowIconStyle(run.state, styles);
@@ -9055,14 +9212,15 @@ function formatWorkflowProgress(run, spinner2 = "\u25C7", styles = PLAIN_WORKFLO
   const shellActivity = scopedShells ? void 0 : formatShellActivity(run.activeShells, run.activeShellStartedAt, spinner2, styles, now);
   if (shellActivity) lines.push(`  ${shellActivity}`);
   const byId = new Map(run.agents.map((agent) => [agent.id, agent]));
-  const renderAgents = (agents, offset, nested2) => renderGroupedAgents(agents, ({ agent, index, depth }, grouped) => {
+  const position = new Map(run.agents.map((agent, index) => [agent, index]));
+  const renderAgents = (agents, nested2) => renderGroupedAgents(agents, ({ agent, depth }, grouped) => {
     const icon = agentStateGlyph(agent.state, spinner2);
     const indent = "  ".repeat((grouped ? 2 : 1) + depth);
     const activity = SETTLED_AGENT_STATES.has(agent.state) ? "" : formatAgentActivity(agent, spinner2, styles, now);
     const name = grouped ? agent.label ?? agent.name : styledAgentBreadcrumb(agent, byId, styles);
     const state2 = progressStyleForState(agent.state, styles);
     const detail = expanded ? formatWorkflowAgentDetail(agent, now) : "";
-    return `${indent}#${String(offset + index + 1)} ${state2(icon)} ${name} ${state2(`[${agent.state}]`)}${activity ? ` ${activity}` : ""}${detail ? ` ${detail}` : ""}`;
+    return `${indent}#${String((position.get(agent) ?? 0) + 1)} ${state2(icon)} ${name} ${state2(`[${agent.state}]`)}${activity ? ` ${activity}` : ""}${detail ? ` ${detail}` : ""}`;
   }, run.agents, (label) => styles.muted(label)).map((line) => nested2 ? `  ${line}` : line);
   const phases = run.phaseHistory?.length ? run.phaseHistory : run.phase ? [{ phase: run.phase, afterAgent: 0 }] : [];
   if (scopedShells) {
@@ -9075,10 +9233,22 @@ function formatWorkflowProgress(run, spinner2 = "\u25C7", styles = PLAIN_WORKFLO
   }
   let renderedAgents = 0;
   let nested = false;
+  const segment = (agents, closed) => {
+    if (!shown) return renderAgents(agents, nested);
+    const listed = agents.filter((agent) => closed ? agent.state === "failed" : shown.has(agent));
+    const hidden = closed ? [] : agents.filter((agent) => !shown.has(agent));
+    const counts = [["queued", hidden.filter((agent) => !SETTLED_AGENT_STATES.has(agent.state) && !ACTIVE_AGENT_STATES.has(agent.state)).length], ["running", hidden.filter((agent) => ACTIVE_AGENT_STATES.has(agent.state)).length], ["done", hidden.filter((agent) => SETTLED_AGENT_STATES.has(agent.state)).length]];
+    const summary = counts.filter(([, count]) => count > 0).map(([label, count]) => `+${String(count)} ${label}`).join(" \xB7 ");
+    return [...renderAgents(listed, nested), ...summary ? [`${nested ? "    " : "  "}${styles.muted(`\u2026 ${summary}${showHint ? expandHint() : ""}`)}`] : []];
+  };
   for (const [phaseIndex, phase] of phases.entries()) {
     const boundary = Math.max(renderedAgents, Math.min(run.agents.length, phase.afterAgent));
-    lines.push(...renderAgents(run.agents.slice(renderedAgents, boundary), renderedAgents, nested));
-    lines.push(`  ${styles.muted(`[Phase: ${phase.phase}]`)}`);
+    const before = run.agents.slice(renderedAgents, boundary);
+    if (shown && !nested && before.length) lines.push(`  ${phaseSummary(before, styles)}`);
+    lines.push(...segment(before, true));
+    const next = phases[phaseIndex + 1];
+    const phaseAgents = next ? run.agents.slice(boundary, Math.max(boundary, Math.min(run.agents.length, next.afterAgent))) : [];
+    lines.push(`  ${styles.muted(`[Phase: ${phase.phase}]`)}${shown && next ? ` ${phaseSummary(phaseAgents, styles)}` : ""}`);
     const phaseShell = scopedShells ? shellActivityFor(run, phaseIndex) : void 0;
     if (phaseShell) {
       const rendered = formatShellActivity(phaseShell.active, phaseShell.startedAt, spinner2, styles, now);
@@ -9087,9 +9257,9 @@ function formatWorkflowProgress(run, spinner2 = "\u25C7", styles = PLAIN_WORKFLO
     renderedAgents = boundary;
     nested = true;
   }
-  lines.push(...renderAgents(run.agents.slice(renderedAgents), renderedAgents, nested));
-  lines.push(...workflowLogLines(run, styles, expanded, width, showHint));
-  return lines.join("\n");
+  lines.push(...segment(run.agents.slice(renderedAgents), false));
+  lines.push(...workflowLogLines(run, styles, expanded, width, showHint, shown ? COMPACT_LOG_LINES : 5));
+  return lines;
 }
 var workflowSpinner = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var WORKFLOW_PROGRESS_REFRESH_MS = 1e3;
@@ -9331,7 +9501,9 @@ function workflowProgressBlock(run, theme, progress, refresh, invalidate, prefix
       }
       previousState = displayed.state;
       const frame = displayed.state === "running" ? workflowSpinner[Math.floor(now / 80) % workflowSpinner.length] ?? "\u25C7" : "\u25C7";
-      const progressText = formatWorkflowProgress(displayed, frame, styles, now, expanded, width, true);
+      const rows = freezeAt === void 0 && !terminal ? process.stdout.rows : void 0;
+      const maxLines = rows ? Math.max(6, rows - 10) - (prefix ? prefix.split("\n").length + 1 : 0) : void 0;
+      const progressText = formatWorkflowProgress(displayed, frame, styles, now, expanded, width, true, maxLines);
       return truncateWorkflowProgress(prefix ? `${prefix}
 
 ${progressText}` : progressText, width);
@@ -9627,10 +9799,7 @@ function formatWorkflowPhaseDashboard(run, snapshot, width, selection = {}, styl
   const model = buildWorkflowPhaseModel(run, snapshot);
   const tree = buildWorkflowPhaseTree(model);
   const expanded = selection.expandedNodeIds === void 0 ? workflowPhaseTreeInitialExpanded(tree) : new Set(selection.expandedNodeIds);
-  const wrap = (text, limit = safeWidth) => truncateToVisualLines(text, Number.MAX_SAFE_INTEGER, Math.max(1, limit), 0).visualLines.map((line) => line.trimEnd());
-  const ansiPattern = new RegExp(ANSI_SGR_SOURCE, "g");
-  const visibleLength2 = (text) => text.replace(ansiPattern, "").length;
-  const padTo = (text, limit) => `${text}${" ".repeat(Math.max(0, limit - visibleLength2(text)))}`;
+  const wrap = (text) => wrapNavigatorLine(text, safeWidth);
   const phaseStyle = (state) => phaseStyleForState(state, styles);
   const phase = selection.phaseId ? model.phases.find((candidate) => candidate.id === selection.phaseId) : void 0;
   const selectedByAgent = selection.agentId ? tree.nodes.find((node) => node.kind === "agent" && node.agentId === selection.agentId && (!selection.phaseId || node.phaseId === selection.phaseId)) : void 0;
@@ -9696,28 +9865,33 @@ function formatWorkflowPhaseDashboard(run, snapshot, width, selection = {}, styl
   const scopedShells = (run.activeShellsByPhase?.length ?? 0) > 0;
   const shellActivity = scopedShells ? void 0 : formatShellActivity(run.activeShells, run.activeShellStartedAt, "\u2826", styles, now);
   if (shellActivity) lines.push(`  ${shellActivity}`);
-  const renderTree = (limit) => [styles.bold("Tree"), ...visibleNodes.length ? visibleNodes.flatMap((node) => wrap(treeLine(node), limit)) : [styles.muted("(empty)")]];
   const actionRows = () => {
     const actions = selection.actions;
     if (!actions) return [];
     return ["", styles.bold(actions.title), ...actions.options.map((option, index) => `${index === actions.index ? "\u2192 " : "  "}${index === actions.index ? styles.accent(option) : option}`)];
   };
-  const detailRows = () => [...details(selectedNode), ...actionRows()];
+  const treeRows = [styles.bold("Tree"), ...visibleNodes.length ? visibleNodes.map(treeLine) : [styles.muted("(empty)")]];
+  lines.push(...formatNavigatorColumns(treeRows, [...details(selectedNode), ...actionRows()], safeWidth, selection));
+  if (model.unassignedAgents?.length && !tree.nodes.some((node) => node.phaseId === "unassigned")) lines.push(...wrap(styles.muted(`Unassigned agents: ${String(model.unassignedAgents.length)}`)));
+  return lines.flatMap((line) => wrap(line));
+}
+function wrapNavigatorLine(text, width) {
+  return truncateToVisualLines(text, Number.MAX_SAFE_INTEGER, Math.max(1, width), 0).visualLines.map((line) => line.trimEnd());
+}
+function formatNavigatorColumns(sidebar, detail, width, layout = {}) {
+  const safeWidth = Math.max(1, width);
   if (safeWidth >= 80) {
     const sidebarWidth = Math.min(42, Math.max(24, Math.floor((safeWidth - 3) * 0.38)));
-    const detailWidth = Math.max(1, safeWidth - sidebarWidth - 3);
-    const sidebar = renderTree(sidebarWidth).flatMap((line) => wrap(line, sidebarWidth));
-    const detail = detailRows().flatMap((line) => wrap(line, detailWidth));
-    const rows = Math.max(sidebar.length, detail.length);
-    for (let index = 0; index < rows; index += 1) lines.push(`${padTo(sidebar[index] ?? "", sidebarWidth)} | ${detail[index] ?? ""}`);
-  } else if (selection.detailsOnly) {
-    lines.push(...detailRows().flatMap((line) => wrap(line)));
-  } else {
-    lines.push(...renderTree(safeWidth));
-    if (!selection.treeOnly) lines.push("", ...detailRows().flatMap((line) => wrap(line)));
+    const left2 = sidebar.flatMap((line) => wrapNavigatorLine(line, sidebarWidth));
+    const right = detail.flatMap((line) => wrapNavigatorLine(line, safeWidth - sidebarWidth - 3));
+    return Array.from({ length: Math.max(left2.length, right.length) }, (_, index) => {
+      const cell = left2[index] ?? "";
+      return `${cell}${" ".repeat(Math.max(0, sidebarWidth - visibleWidth2(cell)))} | ${right[index] ?? ""}`;
+    });
   }
-  if (model.unassignedAgents?.length && !tree.nodes.some((node) => node.phaseId === "unassigned")) lines.push(...wrap(styles.muted(`Unassigned agents: ${String(model.unassignedAgents.length)}`)));
-  return lines.flatMap((line) => wrap(line));
+  if (layout.detailsOnly) return detail.flatMap((line) => wrapNavigatorLine(line, safeWidth));
+  const left = sidebar.flatMap((line) => wrapNavigatorLine(line, safeWidth));
+  return layout.treeOnly ? left : [...left, ...detail.flatMap((line) => wrapNavigatorLine(line, safeWidth))];
 }
 function formatCheckpointReview(checkpoint) {
   const context = JSON.stringify(checkpoint.context, null, 2);
@@ -9727,7 +9901,7 @@ function formatCheckpointReview(checkpoint) {
 // src/retention.ts
 import { lstat, readdir as readdir4, readFile as readFile4, stat as stat3 } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
-import { join as join11, resolve as resolve5 } from "node:path";
+import { join as join12, resolve as resolve7 } from "node:path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var REQUIRED_FILES = /* @__PURE__ */ new Set(["workflow.js", "state.json", "snapshot.json", "journal.json", "ownership.json", "worktrees.json", "borrowed-worktrees.json", "system-prompts.json"]);
 var OPTIONAL_FILES = /* @__PURE__ */ new Set(["result.json", "summary.json"]);
@@ -9736,21 +9910,21 @@ async function validateInventory(store, loaded) {
   const entries = await readdir4(store.directory, { withFileTypes: true });
   for (const entry of entries) {
     if (REQUIRED_DIRECTORIES.has(entry.name)) {
-      if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error(`Run artifact is not a regular directory: ${join11(store.directory, entry.name)}`);
+      if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error(`Run artifact is not a regular directory: ${join12(store.directory, entry.name)}`);
       continue;
     }
-    if (!REQUIRED_FILES.has(entry.name) && !OPTIONAL_FILES.has(entry.name)) throw new Error(`Run inventory contains an unrecognized artifact: ${join11(store.directory, entry.name)}`);
-    if (!entry.isFile() || entry.isSymbolicLink()) throw new Error(`Run artifact is not a regular file: ${join11(store.directory, entry.name)}`);
+    if (!REQUIRED_FILES.has(entry.name) && !OPTIONAL_FILES.has(entry.name)) throw new Error(`Run inventory contains an unrecognized artifact: ${join12(store.directory, entry.name)}`);
+    if (!entry.isFile() || entry.isSymbolicLink()) throw new Error(`Run artifact is not a regular file: ${join12(store.directory, entry.name)}`);
   }
   for (const name of REQUIRED_FILES) {
-    const entry = await lstat(join11(store.directory, name));
-    if (!entry.isFile() || entry.isSymbolicLink()) throw new Error(`Run artifact is not a regular file: ${join11(store.directory, name)}`);
+    const entry = await lstat(join12(store.directory, name));
+    if (!entry.isFile() || entry.isSymbolicLink()) throw new Error(`Run artifact is not a regular file: ${join12(store.directory, name)}`);
   }
   if (loaded.run.state === "completed") {
-    const result = await lstat(join11(store.directory, "result.json"));
-    if (!result.isFile() || result.isSymbolicLink()) throw new Error(`Run artifact is not a regular file: ${join11(store.directory, "result.json")}`);
+    const result = await lstat(join12(store.directory, "result.json"));
+    if (!result.isFile() || result.isSymbolicLink()) throw new Error(`Run artifact is not a regular file: ${join12(store.directory, "result.json")}`);
   }
-  if (await readFile4(join11(store.directory, "workflow.js"), "utf8") !== loaded.snapshot.script) throw new Error("Persisted workflow source does not match its launch snapshot");
+  if (await readFile4(join12(store.directory, "workflow.js"), "utf8") !== loaded.snapshot.script) throw new Error("Persisted workflow source does not match its launch snapshot");
 }
 function runDependencyIds(run, borrowed) {
   const dependencies = /* @__PURE__ */ new Set();
@@ -9772,7 +9946,7 @@ async function scanRun(cwd, sessionId, runId, home) {
   await store.validateDeletionWorktrees();
   await store.validateBorrowedWorktrees();
   if (loaded.run.retry) await store.validateRetrySource();
-  const stateMtimeMs = (await stat3(join11(store.directory, "state.json"))).mtimeMs;
+  const stateMtimeMs = (await stat3(join12(store.directory, "state.json"))).mtimeMs;
   const dependencies = runDependencyIds(loaded.run, await store.borrowedWorktrees());
   if (dependencies.includes(runId)) throw new Error(`Run ${runId} depends on itself`);
   return { sessionId, runId, store, run: loaded.run, stateMtimeMs, dependencies };
@@ -9827,9 +10001,9 @@ function cleanupOrder(runs, candidates) {
   return ordered;
 }
 async function recheck(run) {
-  const before = await stat3(join11(run.store.directory, "state.json"));
+  const before = await stat3(join12(run.store.directory, "state.json"));
   const loaded = await run.store.load();
-  const after = await stat3(join11(run.store.directory, "state.json"));
+  const after = await stat3(join12(run.store.directory, "state.json"));
   if (loaded.run.id !== run.runId || !HARD_TERMINAL_RUN_STATES.has(loaded.run.state) || before.mtimeMs !== after.mtimeMs || after.mtimeMs !== run.stateMtimeMs) throw new Error(`Retention candidate ${run.runId} changed before deletion`);
 }
 async function releaseLeases(leases) {
@@ -9837,8 +10011,8 @@ async function releaseLeases(leases) {
   for (const release of releases) if (release.status === "rejected") throw release.reason;
 }
 async function retainTerminalRuns(options) {
-  const home = resolve5(options.home ?? homedir6());
-  const cwd = resolve5(options.cwd);
+  const home = resolve7(options.home ?? homedir6());
+  const cwd = resolve7(options.cwd);
   const now = options.now ?? Date.now();
   if (!Number.isFinite(now)) throw new Error("Retention start time is invalid");
   if (options.retention.olderThanDays === void 0 && options.retention.maxTerminalRuns === void 0) return { candidates: [], deleted: [] };
@@ -9999,12 +10173,54 @@ var WORKFLOW_VIM_KEYS = { "tui.select.up": "k", "tui.select.down": "j", "tui.edi
 function workflowKeyMatches(keybindings, data, binding) {
   return keybindings.matches(data, binding) || WORKFLOW_VIM_KEYS[binding] === data;
 }
-function workflowKeyLabel(keybindings, binding, fallback, labels) {
+var WORKFLOW_KEY_LABELS = { up: "\u2191", down: "\u2193", left: "\u2190", right: "\u2192", pageUp: "pgup", pageDown: "pgdn" };
+function workflowKeyLabel(keybindings, binding, fallback, labels = WORKFLOW_KEY_LABELS) {
   const keys = keybindingKeys(keybindings, binding);
   const configured = keys?.length ? keys.map((key) => labels[key] ?? key) : [fallback];
   const vim = WORKFLOW_VIM_KEYS[binding];
   return [...new Set(vim ? [...configured, vim] : configured)].join("/");
 }
+function createInlineConfirm(requestRender) {
+  let pending;
+  const answer = (value) => {
+    const current = pending;
+    pending = void 0;
+    current?.resolve(value);
+    requestRender();
+  };
+  return {
+    ask(title, message) {
+      answer(false);
+      return new Promise((resolve9) => {
+        pending = { title, message, yes: true, resolve: resolve9 };
+        requestRender();
+      });
+    },
+    active() {
+      return pending !== void 0;
+    },
+    rows(width, styles) {
+      if (!pending) return [];
+      const yes = pending.yes;
+      const message = truncateToVisualLines2(pending.message, Number.MAX_SAFE_INTEGER, Math.max(1, width), 0).visualLines.map((line) => line.trimEnd());
+      return [styles.bold(pending.title), ...message, ...["Yes", "No"].map((option) => option === "Yes" === yes ? `\u2192 ${styles.accent(option)}` : `  ${option}`)];
+    },
+    hint(keybindings) {
+      return `${workflowKeyLabel(keybindings, "tui.select.up", "\u2191")}/${workflowKeyLabel(keybindings, "tui.select.down", "\u2193")} select \xB7 ${workflowKeyLabel(keybindings, "tui.select.confirm", "enter")} confirm \xB7 ${workflowKeyLabel(keybindings, "tui.select.cancel", "esc")} cancel`;
+    },
+    handleInput(keybindings, data) {
+      if (!pending) return;
+      if (workflowKeyMatches(keybindings, data, "tui.select.up") || workflowKeyMatches(keybindings, data, "tui.select.down")) {
+        pending.yes = !pending.yes;
+        requestRender();
+      } else if (workflowKeyMatches(keybindings, data, "tui.select.confirm")) answer(pending.yes);
+      else if (workflowKeyMatches(keybindings, data, "tui.select.cancel")) answer(false);
+    },
+    cancel() {
+      answer(false);
+    }
+  };
+}
 function registerWorkflowNavigator(deps) {
   const { pi, home, clipboard, extensionAgentDir, runs, terminalRunStates, hardTerminalRunStates, ensureSessionLease, answerCheckpoint, recovery, stopWorkflowRun, moveForegroundToBackground, isForegroundAttached, liveAgents, registry, projectTrusted: projectTrusted2, resumeHostContext: resumeHostContext2, resumeSelectedWorkflow, reportBlocked, setNavigatorOpen, trajectoryProvider, coordinateRunMutation: coordinateRunMutationDependency } = deps;
   const coordinateRunMutation = coordinateRunMutationDependency ?? ((task) => task());
@@ -10046,7 +10262,7 @@ function registerWorkflowNavigator(deps) {
         const setStatus = uiHostCapabilities(ctx.ui)?.setStatus;
         setStatus?.call(ctx.ui, "workflow-stop", text);
       };
-      const runAction = async (actionCommand, status = setWorkflowStatus) => {
+      const runAction = async (actionCommand, status = setWorkflowStatus, confirm = (title, message) => confirmWithBlocked(ctx.ui, reportBlocked, title, message)) => {
         const [action, runId, ...rest] = actionCommand.split(/\s+/);
         try {
           const run = runId ? runs.get(runId) : void 0;
@@ -10133,7 +10349,7 @@ function registerWorkflowNavigator(deps) {
           }
           if (action === "stop" && run) {
             const workflowName = stored?.loaded.run.workflowName ?? run.metadata.name;
-            if (!await confirmWithBlocked(ctx.ui, reportBlocked, "Stop workflow?", `Stop workflow ${workflowName} (${run.store.runId})? This cannot be undone.`)) return "dashboard";
+            if (!await confirm("Stop workflow?", `Stop workflow ${workflowName} (${run.store.runId})? This cannot be undone.`)) return "dashboard";
             status(`Stopping workflow ${workflowName}...`);
             await stopWorkflowRun(run.store.runId);
             status(`Workflow ${run.store.runId} stopped.`);
@@ -10494,8 +10710,18 @@ Mutations are available through workflow tools.`, "info");
               let selectedNodeId = tree.nodes[0]?.id;
               let expandedNodeIds = new Set(workflowPhaseTreeInitialExpanded(tree));
               const terminalRows = () => Math.max(1, tuiRows(tui) - WORKFLOW_PANEL_FOOTER_ROWS);
-              const keyLabels = { up: "\u2191", down: "\u2193", left: "\u2190", right: "\u2192", pageUp: "pgup", pageDown: "pgdn" };
-              const keyLabel = (binding, fallback) => workflowKeyLabel(keybindings, binding, fallback, keyLabels);
+              const keyLabel = (binding, fallback) => workflowKeyLabel(keybindings, binding, fallback);
+              const inlineConfirm = createInlineConfirm(() => {
+                if (!disposed) tui.requestRender();
+              });
+              const confirmInDashboard = async (title, message) => {
+                reportBlocked?.(true, title);
+                try {
+                  return await inlineConfirm.ask(title, message);
+                } finally {
+                  reportBlocked?.(false);
+                }
+              };
               const progressNow = () => {
                 const now = Date.now();
                 if (hardTerminalRunStates.has(view.run.state)) {
@@ -10572,7 +10798,7 @@ Mutations are available through workflow tools.`, "info");
                   stopStatus = status;
                   setWorkflowStatus(status);
                   if (!disposed) tui.requestRender();
-                }).then(async (outcome2) => {
+                }, confirmInDashboard).then(async (outcome2) => {
                   if (outcome2 === "stopped") {
                     done("__stopped__");
                     return;
@@ -10609,7 +10835,8 @@ Mutations are available through workflow tools.`, "info");
                   const content = [...statusLines, ...phaseLines];
                   const rows = terminalRows();
                   const hintRows = rows >= 3 ? 1 : 0;
-                  const viewport = Math.max(1, rows - hintRows);
+                  const confirmRows = inlineConfirm.rows(width, styles);
+                  const viewport = Math.max(1, rows - hintRows - confirmRows.length);
                   const maxOffset2 = Math.max(0, content.length - viewport);
                   dashboardOffset = Math.max(0, Math.min(maxOffset2, dashboardOffset));
                   if (actionMode) {
@@ -10630,12 +10857,16 @@ Mutations are available through workflow tools.`, "info");
                   dashboardOffset = Math.max(0, Math.min(maxOffset2, dashboardOffset));
                   const selectedNode = selectedNodeId ? tree.byId.get(selectedNodeId) : void 0;
                   const enterAction = selectedNode?.kind === "workflow" ? "run actions" : selectedNode?.kind === "agent" ? "agent actions" : selectedNode?.children.length ? "expand/collapse" : narrow ? "inspect" : "focus details";
-                  const hint = truncateToVisualLines2(theme.fg("dim", actionMode ? `${keyLabel("tui.select.up", "\u2191")}/${keyLabel("tui.select.down", "\u2193")} actions \xB7 ${keyLabel("tui.select.confirm", "enter")} run \xB7 ${keyLabel("tui.editor.cursorLeft", "\u2190")} tree \xB7 ${keyLabel("tui.select.cancel", "esc")} tree` : `${keyLabel("tui.select.up", "\u2191")}/${keyLabel("tui.select.down", "\u2193")} tree \xB7 ${keyLabel("tui.editor.cursorLeft", "\u2190")}/${keyLabel("tui.editor.cursorRight", "\u2192")} collapse/expand \xB7 ${keyLabel("tui.select.confirm", "enter")} ${enterAction} \xB7 a actions \xB7 ${keyLabel("tui.select.cancel", "esc")} ${narrow && detailsMode ? "tree" : "back"}${content.length > viewport ? ` \xB7 ${keyLabel("tui.select.pageUp", "pgup")}/${keyLabel("tui.select.pageDown", "pgdn")} scroll` : ""} \xB7 auto-refresh 1s`), Number.MAX_SAFE_INTEGER, width, 1).visualLines[0] ?? "";
-                  return [...content.slice(dashboardOffset, dashboardOffset + viewport), ...hintRows ? [hint] : []];
+                  const hint = truncateToVisualLines2(theme.fg("dim", inlineConfirm.active() ? inlineConfirm.hint(keybindings) : actionMode ? `${keyLabel("tui.select.up", "\u2191")}/${keyLabel("tui.select.down", "\u2193")} actions \xB7 ${keyLabel("tui.select.confirm", "enter")} run \xB7 ${keyLabel("tui.editor.cursorLeft", "\u2190")} tree \xB7 ${keyLabel("tui.select.cancel", "esc")} tree` : `${keyLabel("tui.select.up", "\u2191")}/${keyLabel("tui.select.down", "\u2193")} tree \xB7 ${keyLabel("tui.editor.cursorLeft", "\u2190")}/${keyLabel("tui.editor.cursorRight", "\u2192")} collapse/expand \xB7 ${keyLabel("tui.select.confirm", "enter")} ${enterAction} \xB7 a actions \xB7 ${keyLabel("tui.select.cancel", "esc")} ${narrow && detailsMode ? "tree" : "back"}${content.length > viewport ? ` \xB7 ${keyLabel("tui.select.pageUp", "pgup")}/${keyLabel("tui.select.pageDown", "pgdn")} scroll` : ""} \xB7 auto-refresh 1s`), Number.MAX_SAFE_INTEGER, width, 1).visualLines[0] ?? "";
+                  return [...content.slice(dashboardOffset, dashboardOffset + viewport), ...confirmRows, ...hintRows ? [hint] : []];
                 },
                 invalidate() {
                 },
                 handleInput(data) {
+                  if (inlineConfirm.active()) {
+                    inlineConfirm.handleInput(keybindings, data);
+                    return;
+                  }
                   if (stopRequested || editorRunning) return;
                   const narrow = renderedWidth < 80;
                   if (!actionMode && (data === "a" || data === "A")) {
@@ -10687,7 +10918,7 @@ Mutations are available through workflow tools.`, "info");
                             });
                           }
                         }
-                      } else if (action === "Open script in editor") void openArtifact(readFile5(join12(store.directory, "workflow.js"), "utf8").then(workflowScriptArtifact), "workflow script");
+                      } else if (action === "Open script in editor") void openArtifact(readFile5(join13(store.directory, "workflow.js"), "utf8").then(workflowScriptArtifact), "workflow script");
                       else if (action === "Stop") requestStop();
                       else done(action);
                     }
@@ -10755,6 +10986,7 @@ Mutations are available through workflow tools.`, "info");
                   disposed = true;
                   stopTimer();
                   setWorkflowStatus(void 0);
+                  inlineConfirm.cancel();
                 }
               };
             }) : await ctx.ui.select(view.dashboard, [...view.actions.keys(), "Back"]);
@@ -10809,8 +11041,7 @@ Mutations are available through workflow tools.`, "info");
                     const currentLayout = layout();
                     const maxOffset2 = Math.max(0, renderedLines.length - currentLayout.contentViewport);
                     offset = Math.min(offset, maxOffset2);
-                    const keyLabels = { up: "\u2191", down: "\u2193", left: "\u2190", right: "\u2192", pageUp: "pgup", pageDown: "pgdn" };
-                    const keyLabel = (binding, fallback) => workflowKeyLabel(keybindings, binding, fallback, keyLabels);
+                    const keyLabel = (binding, fallback) => workflowKeyLabel(keybindings, binding, fallback);
                     const hint = truncateToVisualLines2(theme.fg("dim", `${keyLabel("tui.select.up", "\u2191")}/${keyLabel("tui.select.down", "\u2193")}/pgup/pgdn scroll \xB7 enter select \xB7 esc cancel`), Number.MAX_SAFE_INTEGER, width, 1).visualLines[0] ?? "";
                     const controls = currentLayout.compactControls ? [options.map((option, index) => `${index === selectedIndex ? "[" : " "}${option}${index === selectedIndex ? "]" : " "}`).join(" ")] : options.map((option, index) => `${index === selectedIndex ? "\u2192 " : "  "}${option}`);
                     return [
@@ -10872,7 +11103,7 @@ Mutations are available through workflow tools.`, "info");
 
 // src/changelog.ts
 import { mkdir as mkdir3, readFile as readFile6 } from "node:fs/promises";
-import { dirname as dirname5, join as join13 } from "node:path";
+import { dirname as dirname6, join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var STATE_DIRECTORY = "pi-extensible-workflows";
 var STATE_FILE = "changelog-state.json";
@@ -10883,15 +11114,15 @@ function packageMetadata(value, directory) {
 }
 async function packageMetadataAt(directory) {
   try {
-    const value = JSON.parse(await readFile6(join13(directory, "package.json"), "utf8"));
+    const value = JSON.parse(await readFile6(join14(directory, "package.json"), "utf8"));
     return packageMetadata(value, directory);
   } catch {
     return void 0;
   }
 }
 async function installedPackageMetadata() {
-  const moduleDirectory = dirname5(fileURLToPath4(import.meta.url));
-  for (const directory of [join13(moduleDirectory, ".."), join13(moduleDirectory, "../..")]) {
+  const moduleDirectory = dirname6(fileURLToPath4(import.meta.url));
+  for (const directory of [join14(moduleDirectory, ".."), join14(moduleDirectory, "../..")]) {
     const metadata = await packageMetadataAt(directory);
     if (metadata) return metadata;
   }
@@ -10918,7 +11149,7 @@ ${line}` : line;
 }
 async function readChangelog(directory) {
   try {
-    return parseChangelog(await readFile6(join13(directory, "CHANGELOG.md"), "utf8"));
+    return parseChangelog(await readFile6(join14(directory, "CHANGELOG.md"), "utf8"));
   } catch {
     return [];
   }
@@ -10955,14 +11186,14 @@ async function showChangelogNotice(context, agentDir, packageDirectory) {
   try {
     const metadata = packageDirectory === void 0 ? await installedPackageMetadata() : await packageMetadataAt(packageDirectory);
     if (!metadata) return;
-    const statePath = join13(agentDir, STATE_DIRECTORY, STATE_FILE);
+    const statePath = join14(agentDir, STATE_DIRECTORY, STATE_FILE);
     const previousVersion = await lastNotifiedVersion(statePath);
     if (previousVersion === metadata.version) return;
     const entries = releaseEntries(await readChangelog(metadata.directory), metadata.version, previousVersion);
     if (!entries.length) return;
     ui.notify(noticeText(metadata.version, entries), "info");
     try {
-      await mkdir3(dirname5(statePath), { recursive: true, mode: 448 });
+      await mkdir3(dirname6(statePath), { recursive: true, mode: 448 });
       await atomicJson(statePath, { lastNotifiedVersion: metadata.version });
     } catch {
     }
@@ -10974,8 +11205,8 @@ async function showChangelogNotice(context, agentDir, packageDirectory) {
 import { createHash as createHash3 } from "node:crypto";
 import { open as open2, readFile as readFile7, readdir as readdir5, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
-import { basename as basename5, dirname as dirname6, join as join14, resolve as resolve6 } from "node:path";
-import { createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DefaultPackageManager as DefaultPackageManager2, getAgentDir as getAgentDir3, SettingsManager as SettingsManager3, DEFAULT_MAX_BYTES as DEFAULT_MAX_BYTES2 } from "@earendil-works/pi-coding-agent";
+import { basename as basename5, dirname as dirname7, join as join15, resolve as resolve8 } from "node:path";
+import { createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, DefaultPackageManager as DefaultPackageManager2, getAgentDir as getAgentDir4, SettingsManager as SettingsManager3, DEFAULT_MAX_BYTES as DEFAULT_MAX_BYTES2 } from "@earendil-works/pi-coding-agent";
 
 // subagents/src/contracts.ts
 import { Type as Type2 } from "@earendil-works/pi-ai";
@@ -11193,6 +11424,18 @@ function statusValue(value) {
 // src/trajectory.ts
 var TRAJECTORY_MAX_TRANSCRIPT_BYTES = 2 * 1024 * 1024;
 var TRAJECTORY_MAX_NON_TIMING_ENTRIES = 400;
+function subagentOutput(options) {
+  if (options.resultTruncated) return { status: "truncated", kind: "result", path: options.resultPath, bytes: options.resultBytes ?? 0 };
+  if (options.result !== void 0) return { status: "available", value: options.result, bytes: serializedJsonBytes(options.result) };
+  if (options.failureTruncated) return { status: "truncated", kind: "failure", path: options.failurePath, bytes: options.failureBytes ?? 0 };
+  if (options.failure !== void 0) return { status: "failed", code: options.failure.code, message: options.failure.message };
+  if (options.state === "failed" || options.state === "stopped") {
+    const error = options.statusError ?? options.attempt?.error;
+    return { status: options.state === "stopped" ? "cancelled" : "failed", code: error?.code ?? (options.state === "stopped" ? "CANCELLED" : "AGENT_FAILED"), message: error?.message ?? `Subagent ${options.state}` };
+  }
+  if (options.state === "completed") return { status: "unavailable" };
+  return { status: "pending" };
+}
 function sessionFile(reference) {
   const locator = reference?.locator;
   if (!object(locator) || typeof locator.sessionFile !== "string" || !locator.sessionFile) return void 0;
@@ -11330,20 +11573,20 @@ function canonicalExtensionSelector2(selector, base) {
   const negated = selector.startsWith("!");
   const body = negated ? selector.slice(1) : selector;
   if (body === "*" || body === "**" || body.startsWith("**/")) return selector;
-  const resolved = resolve6(base, body);
+  const resolved = resolve8(base, body);
   if (resourcePatternHasMagic(body)) return `${negated ? "!" : ""}${resolved}`;
   return `${negated ? "!" : ""}${canonicalPath(resolved)}`;
 }
 function skillNameFromPath(path) {
   const file = basename5(path);
-  return file.toLowerCase() === "skill.md" ? basename5(dirname6(path)) : file;
+  return file.toLowerCase() === "skill.md" ? basename5(dirname7(path)) : file;
 }
 var discoveredResourcesByCwd = /* @__PURE__ */ new Map();
 async function discoveredResources(cwd) {
   const cached = discoveredResourcesByCwd.get(cwd);
   if (cached) return cached;
   const pending = (async () => {
-    const agentDir = getAgentDir3();
+    const agentDir = getAgentDir4();
     const settingsManager = SettingsManager3.create(cwd, agentDir, { projectTrusted: false });
     const packageManager = new DefaultPackageManager2({ cwd, agentDir, settingsManager });
     const resolved = await packageManager.resolve();
@@ -11395,11 +11638,46 @@ function withoutAgentActivities(run) {
   });
   return agents.every((agent, index) => agent === run.agents[index]) ? run : { ...run, agents };
 }
+function serializedJsonBytes(value) {
+  const serialized = JSON.stringify(value);
+  return Buffer.byteLength(serialized, "utf8");
+}
+function failedAgentOutput(agent) {
+  const error = [...agent.attemptDetails ?? []].reverse().find((attempt) => attempt.error)?.error;
+  const status = agent.state === "cancelled" ? "cancelled" : "failed";
+  return { status, code: error?.code ?? (status === "cancelled" ? "CANCELLED" : "AGENT_FAILED"), message: error?.message ?? `Agent ${agent.state}` };
+}
+function outputForAgent(agent, operation) {
+  if (operation !== void 0) {
+    const bytes = serializedJsonBytes(operation.value);
+    return bytes > DEFAULT_MAX_BYTES2 ? { status: "truncated", kind: "result", bytes } : { status: "available", value: operation.value, bytes };
+  }
+  if (agent.state === "failed" || agent.state === "cancelled") return failedAgentOutput(agent);
+  if (agent.state === "completed") return { status: "unavailable" };
+  return { status: "pending" };
+}
+function applyTrajectoryAgentOutputs(run, operations) {
+  const byPath = new Map(operations.map((operation) => [operation.path, operation]));
+  const agents = run.agents.map((agent) => ({ ...agent, output: outputForAgent(agent, agent.resultPath === void 0 ? void 0 : byPath.get(agent.resultPath)) }));
+  return { ...run, agents };
+}
+function overlayTrajectoryRun(run, overlay) {
+  const overlaid = overlay(run);
+  const outputs = new Map(run.agents.map((agent) => [agent.id, agent.output]));
+  const agents = overlaid.agents.map((agent) => {
+    const previous = outputs.get(agent.id);
+    const output = previous?.status === "available" || previous?.status === "truncated" ? previous : outputForAgent(agent, void 0);
+    return { ...agent, output };
+  });
+  return { ...overlaid, agents };
+}
 async function loadTrajectoryRun(store, includeTranscripts = true) {
   const value = await store.load();
   const summary = await store.loadSummary().catch(() => void 0);
   const prompts = await store.systemPrompts().catch(() => []);
-  const run = withoutAgentActivities(await withResolvedResources(withPiToolDescriptions(applySystemPrompts(value.run, prompts)), store.cwd));
+  const prepared = withoutAgentActivities(await withResolvedResources(withPiToolDescriptions(applySystemPrompts(value.run, prompts)), store.cwd));
+  const operations = await store.replayableOperations().catch(() => []);
+  const run = applyTrajectoryAgentOutputs(prepared, operations);
   return { run, snapshot: value.snapshot, awaiting: await store.awaitingCheckpoints(), ...summary?.createdAt === void 0 ? {} : { createdAt: summary.createdAt }, transcripts: includeTranscripts ? await runTranscripts(run) : {} };
 }
 async function fileMtime(path) {
@@ -11408,8 +11686,8 @@ async function fileMtime(path) {
 function createCachedRunLoader(cwd, sessionId, home, load, transcriptSignature, overlay) {
   const cache = /* @__PURE__ */ new Map();
   const changed = async (store, entry) => {
-    if (await fileMtime(join14(store.directory, "state.json")) !== entry.stateMtimeMs) return true;
-    if (await fileMtime(join14(store.directory, "journal.json")) !== entry.journalMtimeMs) return true;
+    if (await fileMtime(join15(store.directory, "state.json")) !== entry.stateMtimeMs) return true;
+    if (await fileMtime(join15(store.directory, "journal.json")) !== entry.journalMtimeMs) return true;
     for (const [agentId, path] of transcriptPaths(entry.value.run)) if (await transcriptSignature(path) !== entry.transcripts.get(agentId)) return true;
     return false;
   };
@@ -11426,10 +11704,10 @@ function createCachedRunLoader(cwd, sessionId, home, load, transcriptSignature,
           const value = await load(store);
           const transcripts = /* @__PURE__ */ new Map();
           for (const [agentId, path] of transcriptPaths(value.run)) transcripts.set(agentId, await transcriptSignature(path));
-          entry = { value, stateMtimeMs: await fileMtime(join14(store.directory, "state.json")) ?? 0, journalMtimeMs: await fileMtime(join14(store.directory, "journal.json")) ?? 0, transcripts };
+          entry = { value, stateMtimeMs: await fileMtime(join15(store.directory, "state.json")) ?? 0, journalMtimeMs: await fileMtime(join15(store.directory, "journal.json")) ?? 0, transcripts };
           cache.set(runId, entry);
         }
-        loaded.push(overlay ? { ...entry.value, run: overlay(entry.value.run) } : entry.value);
+        loaded.push(overlay ? { ...entry.value, run: overlayTrajectoryRun(entry.value.run, overlay) } : entry.value);
       } catch {
         cache.delete(runId);
       }
@@ -11512,7 +11790,7 @@ function createTrajectoryTranscriptLoader(cwd, sessionId, home = homedir7(), age
         path = sessionFile(value.run.agents.find((agent) => agent.id === request.agentId)?.attemptDetails?.at(-1)?.session);
       } else if (request.subagentId !== void 0 && request.runId === void 0 && request.agentId === void 0) {
         if (!safeTrajectorySubagentId(request.subagentId)) return { status: "missing", revision: 0, entries: [], error: "Transcript not found" };
-        const rawStatus = await readSubagentJson(join14(agentDir, "subagents", request.subagentId, "status.json"));
+        const rawStatus = await readSubagentJson(join15(agentDir, "subagents", request.subagentId, "status.json"));
         const status = statusValue(rawStatus);
         const statusRecord = object(rawStatus) ? rawStatus : void 0;
         const statusCwd = statusRecord === void 0 ? void 0 : statusRecord.cwd;
@@ -11573,13 +11851,13 @@ function withoutProgressActivity(progress) {
 async function loadTrajectorySubagent(directory, cwd, sessionId, includeTranscript = true) {
   try {
     const id = basename5(directory);
-    const status = statusValue(await readSubagentJson(join14(directory, "status.json")));
+    const status = statusValue(await readSubagentJson(join15(directory, "status.json")));
     if (!status || status.id !== id) return void 0;
     if (status.sessionId !== sessionId) return "foreign";
     const progress = status.progress === void 0 ? void 0 : withoutProgressActivity(status.progress);
-    const request = normalizeSubagentRunRequest(await readSubagentJson(join14(directory, "request.json")));
-    const resultPath = join14(directory, "result.json");
-    const failurePath = join14(directory, "failure.json");
+    const request = normalizeSubagentRunRequest(await readSubagentJson(join15(directory, "request.json")));
+    const resultPath = join15(directory, "result.json");
+    const failurePath = join15(directory, "failure.json");
     const resultBytes = await subagentFileBytes(resultPath);
     const failureBytes = await subagentFileBytes(failurePath);
     const resultValue = await readSubagentJson(resultPath, true, DEFAULT_MAX_BYTES2);
@@ -11619,19 +11897,20 @@ async function loadTrajectorySubagent(directory, cwd, sessionId, includeTranscri
       ...progress === void 0 ? {} : { progress },
       ...attempt === void 0 ? {} : { attempt },
       ...result === void 0 ? {} : { result },
-      ...failure === void 0 ? {} : { failure }
+      ...failure === void 0 ? {} : { failure },
+      output: subagentOutput({ state: status.state, statusError: status.error, attempt, result: resultValue === void 0 ? void 0 : boundedSubagentJson(resultValue), resultTruncated, resultPath, resultBytes, failure: failureValue === void 0 ? void 0 : subagentErrorValue(failureValue), failureTruncated, failurePath, failureBytes })
     };
   } catch {
     return void 0;
   }
 }
 async function subagentCacheEntryChanged(directory, entry) {
-  for (const file of TRAJECTORY_SUBAGENT_FILES) if (await fileMtime(join14(directory, file)) !== entry.fileMtimes.get(file)) return true;
+  for (const file of TRAJECTORY_SUBAGENT_FILES) if (await fileMtime(join15(directory, file)) !== entry.fileMtimes.get(file)) return true;
   const transcriptPath = sessionFile(entry.value.attempt?.session);
   return transcriptPath !== void 0 && await fileMtime(transcriptPath) !== entry.transcriptMtime;
 }
 function createTrajectorySubagentLoader(cwd, sessionId, agentDir, overlay, includeTranscript = true) {
-  const root = join14(agentDir, "subagents");
+  const root = join15(agentDir, "subagents");
   const cache = /* @__PURE__ */ new Map();
   const negativeCache = /* @__PURE__ */ new Map();
   return async () => {
@@ -11648,8 +11927,8 @@ function createTrajectorySubagentLoader(cwd, sessionId, agentDir, overlay, inclu
     for (const id of negativeCache.keys()) if (!current.has(id)) negativeCache.delete(id);
     const loaded = [];
     for (const id of ids) {
-      const directory = join14(root, id);
-      const statusPath = join14(directory, "status.json");
+      const directory = join15(root, id);
+      const statusPath = join15(directory, "status.json");
       try {
         const statusMtime = await fileMtime(statusPath);
         if (negativeCache.has(id) && negativeCache.get(id) === statusMtime) continue;
@@ -11667,7 +11946,7 @@ function createTrajectorySubagentLoader(cwd, sessionId, agentDir, overlay, inclu
             continue;
           }
           const fileMtimes = /* @__PURE__ */ new Map();
-          for (const file of TRAJECTORY_SUBAGENT_FILES) fileMtimes.set(file, await fileMtime(join14(directory, file)));
+          for (const file of TRAJECTORY_SUBAGENT_FILES) fileMtimes.set(file, await fileMtime(join15(directory, file)));
           const transcriptPath = sessionFile(value.attempt?.session);
           entry = { value, fileMtimes, transcriptMtime: transcriptPath === void 0 ? void 0 : await fileMtime(transcriptPath) };
           cache.set(id, entry);
@@ -11784,7 +12063,8 @@ var WORKFLOW_TOOL_PARAMETERS = Type3.Object({
 var WORKFLOW_STATUS_PARAMETERS = Type3.Object({ runId: Type3.String({ description: "Workflow run ID visible in the current project" }) }, { additionalProperties: false });
 var WORKFLOW_RETRY_PARAMETERS = Type3.Object({ runId: Type3.String({ description: "Explicit failed workflow run ID" }), expectedState: Type3.Optional(Type3.String({ description: "Persisted source state observed before recovery" })), foreground: Type3.Optional(Type3.Boolean({ description: "Override the source launch mode for this recovery" })) });
 function workflowToolUpdate(run) {
-  return { content: [{ type: "text", text: formatWorkflowProgress(run) }], details: { runId: run.id, run } };
+  const done = run.agents.filter((agent) => SETTLED_AGENT_STATES.has(agent.state)).length;
+  return { content: [{ type: "text", text: `Workflow: ${run.workflowName} (${String(done)}/${String(run.agents.length)} done) [${run.state}]` }], details: { runId: run.id, run } };
 }
 function agentWithProgress(agent, progress) {
   const next = { ...agent, accounting: progress.accounting, toolCalls: progress.toolCalls };
@@ -11805,6 +12085,7 @@ function deliver(pi, content) {
   pi.sendMessage({ customType: "workflow", content, display: true }, { deliverAs: "followUp", triggerTurn: true });
 }
 var WORKFLOW_WARNING_ENTRY = "workflow-warning";
+var PROGRESS_COALESCE_MS = 100;
 function deliverWarning(pi, content) {
   pi.appendEntry(WORKFLOW_WARNING_ENTRY, { message: content });
 }
@@ -11882,7 +12163,7 @@ async function resolveLaunchAliases(registry, staticAliases, context, availableM
 function workflowExtension(pi, home, clipboard = copyToClipboard, transport = localAgentTransport, agentDir, additionalSkillPaths = []) {
   beginWorkflowExtensionLoading();
   const registry = loadingRegistry();
-  const extensionAgentDir = agentDir ?? getAgentDir4();
+  const extensionAgentDir = agentDir ?? getAgentDir5();
   const registerEntryRenderer = piHostCapabilities(pi).registerEntryRenderer;
   registerEntryRenderer?.(WORKFLOW_LOG_ENTRY, (entry) => {
     const data = entry.data;
@@ -11925,8 +12206,8 @@ function workflowExtension(pi, home, clipboard = copyToClipboard, transport = lo
   };
   pi.on("resources_discover", () => {
     if (!pi.getActiveTools().includes("workflow")) return;
-    const extensionDir = dirname7(fileURLToPath5(import.meta.url));
-    const skillPath = [join15(extensionDir, "../skills"), join15(extensionDir, "../../skills")].find((path) => existsSync2(path));
+    const extensionDir = dirname8(fileURLToPath5(import.meta.url));
+    const skillPath = [join16(extensionDir, "../skills"), join16(extensionDir, "../../skills")].find((path) => existsSync2(path));
     return skillPath ? { skillPaths: [skillPath] } : void 0;
   });
   const runs = /* @__PURE__ */ new Map();
@@ -12064,7 +12345,6 @@ Choose what to do`, ["Retry", "Change model", "Abort workflow"]);
     const trusted = projectTrusted(context);
     const settings = resolveWorkflowSettings(cwd, trusted, workflowSettingsPath(extensionAgentDir)).effective.extensionSettings?.trajectory;
     const port = settings?.port;
-    const themes = settings?.themes ?? false;
     const loadRuns = createTrajectoryRunLoader(cwd, sessionId, home, overlayLiveRun);
     const loadSubagents = createTrajectorySubagentLoader(cwd, sessionId, extensionAgentDir, overlayLiveSubagent);
     const loadRunsMetadata = createTrajectoryRunMetadataLoader(cwd, sessionId, home, overlayLiveRun);
@@ -12073,7 +12353,7 @@ Choose what to do`, ["Retry", "Change model", "Abort workflow"]);
       const live = liveSubagents.get(subagentId);
       return live?.status.sessionId === sessionId ? live.status.attemptDetails?.at(-1)?.session : void 0;
     });
-    return { cwd, sessionId, ...port === void 0 ? {} : { port }, themes, loadRuns, loadSubagents, loadMetadata: async () => ({ runs: await loadRunsMetadata(), subagents: await loadSubagentsMetadata() }), loadTranscript, handleAction: (request) => trajectoryAction(request, context) };
+    return { cwd, sessionId, ...port === void 0 ? {} : { port }, loadRuns, loadSubagents, loadMetadata: async () => ({ runs: await loadRunsMetadata(), subagents: await loadSubagentsMetadata() }), loadTranscript, handleAction: (request) => trajectoryAction(request, context) };
   };
   const withLiveActivities = (run) => liveAgents.overlay(run);
   const overlayLiveRun = (run) => {
@@ -12246,22 +12526,48 @@ Choose what to do`, ["Retry", "Change model", "Abort workflow"]);
   const scheduler = new FairAgentScheduler(async ({ id, runId, tuiIndex, parentId, prompt, options, signal, setSteer }) => {
     const run = runs.get(runId);
     if (!run) throw new WorkflowError("INTERNAL_ERROR", `Unknown production run: ${runId}`);
+    const applyProgress = async (progress) => {
+      let runState;
+      if (progress.persist) {
+        runState = await persistRunState(run.store, run.metadata, (current) => current.agents.some((agent) => agent.id === id) ? { ...current, ...run.budget.snapshot(), agents: current.agents.map((agent) => agent.id === id ? agentWithProgress(agent, progress) : agent) } : current);
+      } else {
+        const loaded = await run.store.loadStatus();
+        if (!loaded.agents.some((agent) => agent.id === id)) return;
+        runState = { ...loaded, ...run.budget.snapshot(), agents: loaded.agents.map((agent) => agent.id === id ? agentWithProgress(agent, progress) : agent) };
+      }
+      if (!runState.agents.some((agent) => agent.id === id)) return;
+      liveAgents.setActivity(runId, id, progress.activity);
+      liveAgents.setEventTime(runId, id, progress.lastEventAt);
+      run.update?.(workflowToolUpdate(withLiveActivities(runState)));
+    };
+    let deferred;
+    let deferredTimer;
+    let appliedAt = 0;
+    const cancelDeferredProgress = () => {
+      if (deferredTimer) clearTimeout(deferredTimer);
+      deferredTimer = void 0;
+      deferred = void 0;
+    };
+    const onProgress = async (progress) => {
+      const now = Date.now();
+      if (progress.persist || !deferredTimer && now - appliedAt >= PROGRESS_COALESCE_MS) {
+        cancelDeferredProgress();
+        appliedAt = now;
+        await applyProgress(progress);
+        return;
+      }
+      deferred = progress;
+      deferredTimer ??= setTimeout(() => {
+        deferredTimer = void 0;
+        const next = deferred;
+        deferred = void 0;
+        if (!next) return;
+        appliedAt = Date.now();
+        void applyProgress(next).catch(() => void 0);
+      }, Math.max(0, PROGRESS_COALESCE_MS - (now - appliedAt))).unref();
+    };
     try {
       const budget = run.budget.forAgent(id);
-      const onProgress = async (progress) => {
-        let runState;
-        if (progress.persist) {
-          runState = await persistRunState(run.store, run.metadata, (current) => current.agents.some((agent) => agent.id === id) ? { ...current, ...run.budget.snapshot(), agents: current.agents.map((agent) => agent.id === id ? agentWithProgress(agent, progress) : agent) } : current);
-        } else {
-          const loaded = await run.store.load();
-          if (!loaded.run.agents.some((agent) => agent.id === id)) return;
-          runState = { ...loaded.run, ...run.budget.snapshot(), agents: loaded.run.agents.map((agent) => agent.id === id ? agentWithProgress(agent, progress) : agent) };
-        }
-        if (!runState.agents.some((agent) => agent.id === id)) return;
-        liveAgents.setActivity(runId, id, progress.activity);
-        liveAgents.setEventTime(runId, id, progress.lastEventAt);
-        run.update?.(workflowToolUpdate(withLiveActivities(runState)));
-      };
       const onAttempt = async (attempt) => {
         liveAgents.setSession(runId, id, attempt.liveSession);
         liveAgents.setHandoff(runId, id, attempt);
@@ -12281,6 +12587,7 @@ Choose what to do`, ["Retry", "Change model", "Abort workflow"]);
         scheduler.cancelChildren(id);
         scheduler.retry(id);
       });
+      cancelDeferredProgress();
       const before = (await run.store.load()).run;
       await persistAgentAttempts(run.store, id, result.attempts);
       const completed = (await run.store.load()).run;
@@ -12291,6 +12598,7 @@ Choose what to do`, ["Retry", "Change model", "Abort workflow"]);
       run.update?.(workflowToolUpdate(withLiveActivities(persisted)));
       return result.value;
     } catch (error) {
+      cancelDeferredProgress();
       liveAgents.setSession(runId, id);
       const attempts = getAgentAttempts(error);
       if (attempts?.length) {
@@ -12426,8 +12734,8 @@ Respond with workflow_respond.`);
       const run = runs.get(runId);
       await run?.lifecycle.enterAwaitingInput();
       if (!alreadyAwaiting && (!isForeground() || !ui?.select)) deliverBackgroundCheckpoint(metadata.name, runId, { ...input, name: label, path });
-      const decision = new Promise((resolve7, reject) => {
-        run?.checkpointResolvers.set(path, resolve7);
+      const decision = new Promise((resolve9, reject) => {
+        run?.checkpointResolvers.set(path, resolve9);
         if (signal.aborted) reject(new WorkflowError("CANCELLED", "Workflow cancelled"));
         else signal.addEventListener("abort", () => {
           run?.checkpointResolvers.delete(path);
@@ -12745,7 +13053,7 @@ Respond with workflow_respond.`);
   const deliverStaleTerminal = async (store, run) => {
     if (!(run.delivery?.mode === "foreground" && run.delivery.state === "attached" || run.delivery?.mode === "background" && run.delivery.state === "pending")) return;
     if (run.state === "completed") {
-      const resultPath = join15(store.directory, "result.json");
+      const resultPath = join16(store.directory, "result.json");
       let resultBytes = 0;
       let hasResult = true;
       try {
@@ -12875,8 +13183,8 @@ ${content}` };
       let resolveDetached;
       let foregroundStore;
       let completionInstalled = false;
-      const detachedResult = params.foreground ? new Promise((resolve7) => {
-        resolveDetached = resolve7;
+      const detachedResult = params.foreground ? new Promise((resolve9) => {
+        resolveDetached = resolve9;
       }) : void 0;
       const detachedToolResult = (run) => {
         const detached = { runId: run.id, state: "running", detached: true };
@@ -13109,8 +13417,7 @@ ${content}` };
           state.workflowProgressComponent = workflowProgressBlock(currentProgress?.run ?? incoming, theme, currentProgress, async () => {
             const active = runs.get(incoming.id);
             const store = active?.store ?? new RunStore(incoming.cwd, incoming.sessionId, incoming.id, home);
-            const loaded = await store.load();
-            return withLiveActivities(loaded.run);
+            return withLiveActivities(await store.loadStatus());
           }, () => {
             if (state.workflowProgress === currentProgress) requestRender();
           }, void 0, state.workflowProgressFrozenAt);
@@ -13223,9 +13530,9 @@ async function handleTurnInput(store, handle, turn) {
   }
   if (!completed) return void 0;
   if (source === void 0) fail("AGENT_FAILED", `Agent handle ${handle} cannot continue from its previous turn: the completed turn recorded no session file`);
-  const target = join15(store.directory, "handles", encodeURIComponent(handle), `turn-${String(turn)}-input.jsonl`);
+  const target = join16(store.directory, "handles", encodeURIComponent(handle), `turn-${String(turn)}-input.jsonl`);
   try {
-    await mkdir4(dirname7(target), { recursive: true });
+    await mkdir4(dirname8(target), { recursive: true });
     await copyFile2(source, target);
   } catch (error) {
     fail("AGENT_FAILED", `Agent handle ${handle} cannot continue from its previous turn: ${errorText(error)}`);
@@ -13246,13 +13553,13 @@ function modelSpec(value, fallback) {
 
 // src/herdr.ts
 import { execFile as execFile3 } from "node:child_process";
-var herdrCommandRunner = (args) => new Promise((resolve7, reject) => {
+var herdrCommandRunner = (args) => new Promise((resolve9, reject) => {
   execFile3("herdr", [...args], { encoding: "utf8", maxBuffer: 1024 * 1024 }, (error, stdout) => {
     if (error) {
       reject(new Error(error.message));
       return;
     }
-    resolve7(stdout);
+    resolve9(stdout);
   });
 });
 function herdrPaneId(env = process.env) {
@@ -13384,9 +13691,9 @@ async function waitForHerdrPane(paneId, runner = herdrCommandRunner, options = {
   const isAborted = () => monitorController.signal.aborted;
   let markAborted = () => {
   };
-  const aborted = new Promise((resolve7) => {
+  const aborted = new Promise((resolve9) => {
     markAborted = () => {
-      resolve7("aborted");
+      resolve9("aborted");
     };
   });
   const abortMonitor = () => {
@@ -13395,16 +13702,16 @@ async function waitForHerdrPane(paneId, runner = herdrCommandRunner, options = {
   };
   if (options.signal?.aborted) abortMonitor();
   else options.signal?.addEventListener("abort", abortMonitor, { once: true });
-  const delay = () => new Promise((resolve7) => {
+  const delay = () => new Promise((resolve9) => {
     if (isAborted()) {
-      resolve7();
+      resolve9();
       return;
     }
     const timer = setTimeout(finish, intervalMs);
     function finish() {
       clearTimeout(timer);
       monitorController.signal.removeEventListener("abort", finish);
-      resolve7();
+      resolve9();
     }
     monitorController.signal.addEventListener("abort", finish, { once: true });
   });
@@ -13516,6 +13823,7 @@ export {
   HEARTBEAT_TIMEOUT_MS,
   LAUNCH_SNAPSHOT_IDENTITY_VERSION,
   MODEL_ALIAS_NAME,
+  PLAIN_WORKFLOW_PROGRESS_STYLES,
   PiRuntimeAgentRunner,
   RPC_LIMIT_BYTES,
   RUN_STATES,
@@ -13569,9 +13877,11 @@ export {
   buildWorkflowPhaseModel,
   buildWorkflowPhaseTree,
   byPriorityThenName,
+  canonicalExtensionSelector,
   canonicalPath,
   coerceWorkflowError,
   createHerdrAgentReporter,
+  createInlineConfirm,
   createLaunchSnapshot,
   createLiveSessionHandoff,
   createLocalPiSession,
@@ -13583,6 +13893,7 @@ export {
   deepFreeze,
   workflowExtension as default,
   defineWorkflowFunction,
+  discoverRoles,
   encoded,
   errorCode,
   errorText,
@@ -13591,8 +13902,10 @@ export {
   fail,
   finiteNumber,
   formatAgentDetail,
+  formatAgentError,
   formatBudgetStatus,
   formatCost,
+  formatNavigatorColumns,
   formatNavigatorDashboard,
   formatNavigatorRun,
   formatStalledDuration,
@@ -13602,6 +13915,7 @@ export {
   formatWorkflowPhaseDashboard,
   formatWorkflowPreview,
   formatWorkflowProgress,
+  formatWorkflowRuntime,
   hasLiveSessionLease,
   herdrAvailable,
   herdrCommandRunner,
@@ -13628,6 +13942,7 @@ export {
   loadAgentDefinitions,
   loadLaunchSnapshot,
   loadProjectAgentDefinitions,
+  loadRole,
   loadSettings,
   loadSettingsOverrides,
   loadingRegistry,
@@ -13659,6 +13974,7 @@ export {
   prepareAgentSetupForInspection,
   preserveWorkflowPhaseSelection,
   preserveWorkflowPhaseTreeSelection,
+  progressStyleForState,
   projectSessionsDirectory,
   projectStorageKey,
   readShellResult,
@@ -13671,6 +13987,7 @@ export {
   resetWorkflowRegistryIfIdle,
   resolveAgentResourcePolicy,
   resolveModelReference,
+  resolveRole,
   resolveWorkflowSettings,
   resourcePatternHasMagic,
   resourcePatternMatches,
@@ -13678,6 +13995,7 @@ export {
   retainTerminalRuns,
   retainWorkflowRegistry,
   roleNameOf,
+  runStateGlyph,
   runWorkflow,
   runsDirectory,
   runtimeProgressToAgentProgress,
@@ -13697,10 +14015,12 @@ export {
   validateBudget,
   validateBudgetPatch,
   validateCheckpoint,
+  validateContextFileScopes,
   validateModelAliasAvailability,
   validateModelAliases,
   validateResourcePattern,
   validateSchema,
+  validateSelectorList,
   validateShellCommand,
   validateShellOptions,
   validateWorkflowExtensionSettings,
@@ -13711,6 +14031,8 @@ export {
   workflowCatalog,
   workflowCatalogDetail,
   workflowCatalogIndex,
+  workflowKeyLabel,
+  workflowKeyMatches,
   workflowPhaseTreeInitialExpanded,
   workflowPhaseTreeVisibleNodes,
   workflowProjectSettingsPath,