@nklisch/pi-enhanced 0.1.0

package/node_modules/pi-web-access/skills/librarian/SKILL.md

@@ -0,0 +1,195 @@
+---
+name: librarian
+description: Research open-source libraries with evidence-backed answers and GitHub permalinks. Use when the user asks about library internals, needs implementation details with source code references, wants to understand why something was changed, or needs authoritative answers backed by actual code. Excels at navigating large open-source repos and providing citations to exact lines of code.
+---
+
+# Librarian
+
+Answer questions about open-source libraries by finding evidence with GitHub permalinks. Every claim backed by actual code.
+
+## Execution Model
+
+Pi executes tool calls sequentially, even when you emit multiple calls in one turn. But batching independent calls in a single turn still saves LLM round-trips (~5-10s each). Use these patterns:
+
+| Pattern | When | Actually parallel? |
+|---------|------|-------------------|
+| Batch tool calls in one turn | Independent ops (web_search + fetch_content + read) | No, but saves round-trips |
+| `fetch_content({ urls: [...] })` | Multiple URLs to fetch | Yes (3 concurrent) |
+| Bash with `&` + `wait` | Multiple git/gh commands | Yes (OS-level) |
+
+## Step 1: Classify the Request
+
+Before doing anything, classify the request to pick the right research strategy.
+
+| Type | Trigger | Primary Approach |
+|------|---------|-----------------|
+| **Conceptual** | "How do I use X?", "Best practice for Y?" | web_search + fetch_content (README/docs) |
+| **Implementation** | "How does X implement Y?", "Show me the source" | fetch_content (clone) + code search |
+| **Context/History** | "Why was this changed?", "History of X?" | git log + git blame + issue/PR search |
+| **Comprehensive** | Complex or ambiguous requests, "deep dive" | All of the above |
+
+## Step 2: Research by Type
+
+### Conceptual Questions
+
+Batch these in one turn:
+
+1. **web_search**: `"library-name topic"` via Perplexity for recent articles and discussions
+2. **fetch_content**: the library's GitHub repo URL to clone and check README, docs, or examples
+
+Synthesize web results + repo docs. Cite official documentation and link to relevant source files.
+
+### Implementation Questions
+
+The core workflow -- clone, find, permalink:
+
+1. **fetch_content** the GitHub repo URL -- this clones it locally and returns the file tree
+2. Use **bash** to search the cloned repo: `grep -rn "function_name"`, `find . -name "*.ts"`
+3. Use **read** to examine specific files once you've located them
+4. Get the commit SHA: `cd /tmp/pi-github-repos/owner/repo && git rev-parse HEAD`
+5. Construct permalink: `https://github.com/owner/repo/blob/<sha>/path/to/file#L10-L20`
+
+Batch the initial calls: fetch_content (clone) + web_search (recent discussions) in one turn. Then dig into the clone with grep/read once it's available.
+
+### Context/History Questions
+
+Use git operations on the cloned repo:
+
+```bash
+cd /tmp/pi-github-repos/owner/repo
+
+# Recent changes to a specific file
+git log --oneline -n 20 -- path/to/file.ts
+
+# Who changed what and when
+git blame -L 10,30 path/to/file.ts
+
+# Full diff for a specific commit
+git show <sha> -- path/to/file.ts
+
+# Search commit messages
+git log --oneline --grep="keyword" -n 10
+```
+
+For issues and PRs, use bash:
+
+```bash
+# Search issues
+gh search issues "keyword" --repo owner/repo --state all --limit 10
+
+# Search merged PRs
+gh search prs "keyword" --repo owner/repo --state merged --limit 10
+
+# View specific issue/PR with comments
+gh issue view <number> --repo owner/repo --comments
+gh pr view <number> --repo owner/repo --comments
+
+# Release notes
+gh api repos/owner/repo/releases --jq '.[0:5] | .[].tag_name'
+```
+
+### Comprehensive Research
+
+Combine everything. Batch these in one turn:
+
+1. **web_search**: recent articles and discussions
+2. **fetch_content**: clone the repo (or multiple repos if comparing)
+3. **bash**: `gh search issues "keyword" --repo owner/repo --limit 10 & gh search prs "keyword" --repo owner/repo --state merged --limit 10 & wait`
+
+Then dig into the clone with grep, read, git blame, git log as needed.
+
+## Step 3: Construct Permalinks
+
+Permalinks are the whole point. They make your answers citable and verifiable.
+
+```
+https://github.com/<owner>/<repo>/blob/<commit-sha>/<filepath>#L<start>-L<end>
+```
+
+Getting the SHA from a cloned repo:
+
+```bash
+cd /tmp/pi-github-repos/owner/repo && git rev-parse HEAD
+```
+
+Getting the SHA from a tag:
+
+```bash
+gh api repos/owner/repo/git/refs/tags/v1.0.0 --jq '.object.sha'
+```
+
+Always use full commit SHAs, not branch names. Branch links break when code changes. Permalinks don't.
+
+## Step 4: Cite Everything
+
+Every code-related claim needs a permalink. Format:
+
+```markdown
+The stale time check happens in [`notifyManager.ts`](https://github.com/TanStack/query/blob/abc123/packages/query-core/src/notifyManager.ts#L42-L50):
+
+\`\`\`typescript
+function isStale(query: Query, staleTime: number): boolean {
+  return query.state.dataUpdatedAt + staleTime < Date.now()
+}
+\`\`\`
+```
+
+For conceptual answers, link to official docs and relevant source files. For implementation answers, every function/class reference should have a permalink.
+
+## Video Analysis
+
+For questions about video tutorials, conference talks, or screen recordings:
+
+```typescript
+// Full extraction (transcript + visual descriptions)
+fetch_content({ url: "https://youtube.com/watch?v=abc" })
+
+// Ask a specific question about a video
+fetch_content({ url: "https://youtube.com/watch?v=abc", prompt: "What libraries are imported in this tutorial?" })
+
+// Single frame at a known moment
+fetch_content({ url: "https://youtube.com/watch?v=abc", timestamp: "23:41" })
+
+// Range scan for visual discovery
+fetch_content({ url: "https://youtube.com/watch?v=abc", timestamp: "23:41-25:00" })
+
+// Custom density across a range
+fetch_content({ url: "https://youtube.com/watch?v=abc", timestamp: "23:41-25:00", frames: 3 })
+
+// Whole-video sampling
+fetch_content({ url: "https://youtube.com/watch?v=abc", frames: 6 })
+
+// Analyze a local recording
+fetch_content({ url: "/path/to/demo.mp4", prompt: "What error message appears on screen?" })
+
+// Batch multiple videos with the same question
+fetch_content({
+  urls: ["https://youtube.com/watch?v=abc", "https://youtube.com/watch?v=def"],
+  prompt: "What packages are installed?"
+})
+```
+
+Use single timestamps for known moments, ranges for visual scanning, and frames-alone for a quick overview of the whole video.
+
+The `prompt` parameter only applies to video content (YouTube URLs and local video files). For non-video URLs, it's ignored.
+
+## Failure Recovery
+
+| Failure | Recovery |
+|---------|----------|
+| grep finds nothing | Broaden the query, try concept names instead of exact function names |
+| gh CLI rate limited | Use the already-cloned repo in /tmp/pi-github-repos/ for git operations |
+| Repo too large to clone | fetch_content returns an API-only view automatically; use that or add `forceClone: true` |
+| File not found in clone | Branch name with slashes may have misresolved; list the repo tree and navigate manually |
+| Uncertain about implementation | State your uncertainty explicitly, propose a hypothesis, show what evidence you did find |
+| Video extraction fails | Ensure Chrome is signed into gemini.google.com (free) or set GEMINI_API_KEY |
+| Page returns 403/bot block | Gemini fallback triggers automatically; no action needed if Gemini is configured |
+| web_search fails | Check provider config; try explicit `provider: "gemini"` if Perplexity key is missing |
+
+## Guidelines
+
+- Vary search queries when running multiple searches -- different angles, not the same pattern repeated
+- Prefer recent sources; filter out outdated results when they conflict with newer information
+- For version-specific questions, clone the tagged version: `fetch_content("https://github.com/owner/repo/tree/v1.0.0")`
+- When the repo is already cloned from a previous fetch_content call, reuse it -- check the path before cloning again
+- Answer directly. Skip preamble like "I'll help you with..." -- go straight to findings

package/node_modules/pi-web-access/ssrf-protection.ts

@@ -0,0 +1,280 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import net from "node:net";
+
+const DEFAULT_MAX_REDIRECTS = 5;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+export type LookupAddress = { address: string; family: number };
+export type Lookup = (hostname: string) => Promise<LookupAddress[]>;
+type Fetch = typeof fetch;
+
+interface ValidationOptions {
+	lookup?: Lookup;
+	/**
+	 * CIDR ranges (e.g. "198.18.0.0/15") to exempt from the SSRF guard.
+	 * Useful when a host runs a TUN/fake-IP proxy (Surge, Clash, Mihomo, ...)
+	 * that resolves public domains into a reserved range. Entries are validated
+	 * strictly; an invalid entry throws so misconfiguration is not silent.
+	 */
+	allowRanges?: string[];
+}
+
+/** Parsed entry from `allowRanges`: a network address (4 or 16 bytes) + prefix length. */
+interface ParsedCidr {
+	bytes: Uint8Array;
+	prefix: number;
+}
+
+interface FetchRemoteOptions extends ValidationOptions {
+	fetch?: Fetch;
+	maxRedirects?: number;
+}
+
+async function defaultLookup(hostname: string): Promise<LookupAddress[]> {
+	return dnsLookup(hostname, { all: true, verbatim: true });
+}
+
+export async function validateRemoteUrl(rawUrl: string | URL, options: ValidationOptions = {}): Promise<URL> {
+	const url = rawUrl instanceof URL ? rawUrl : new URL(rawUrl);
+	if (url.protocol !== "http:" && url.protocol !== "https:") {
+		throw new Error("Only HTTP and HTTPS URLs can be fetched remotely");
+	}
+
+	const hostname = normalizeHostname(url.hostname);
+	if (!hostname) throw new Error("URL must include a hostname");
+	if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+		throw new Error(`Blocked internal hostname: ${hostname}`);
+	}
+
+	const allowRanges = parseAllowRanges(options.allowRanges);
+
+	if (net.isIP(hostname)) {
+		assertPublicAddress(hostname, hostname, allowRanges);
+		return url;
+	}
+
+	let addresses: LookupAddress[];
+	try {
+		addresses = await (options.lookup ?? defaultLookup)(hostname);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to resolve ${hostname}: ${message}`);
+	}
+
+	if (addresses.length === 0) throw new Error(`Failed to resolve ${hostname}: no addresses returned`);
+	for (const { address } of addresses) {
+		assertPublicAddress(address, hostname, allowRanges);
+	}
+	return url;
+}
+
+export async function fetchRemoteUrl(
+	url: string | URL,
+	init: RequestInit = {},
+	options: FetchRemoteOptions = {},
+): Promise<Response> {
+	const fetchImpl = options.fetch ?? fetch;
+	const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+	let current = await validateRemoteUrl(url, options);
+	let requestInit = init;
+
+	for (let redirects = 0; redirects <= maxRedirects; redirects++) {
+		const response = await fetchImpl(current, { ...requestInit, redirect: "manual" });
+		if (!REDIRECT_STATUSES.has(response.status)) return response;
+
+		const location = response.headers.get("location");
+		if (!location) return response;
+		if (redirects === maxRedirects) throw new Error(`Too many redirects fetching ${current.toString()}`);
+
+		current = await validateRemoteUrl(new URL(location, current), options);
+		if (response.status === 303 || ((response.status === 301 || response.status === 302) && requestInit.method?.toUpperCase() === "POST")) {
+			const { body: _body, ...nextInit } = requestInit;
+			requestInit = { ...nextInit, method: "GET" };
+		}
+	}
+
+	throw new Error(`Too many redirects fetching ${current.toString()}`);
+}
+
+function normalizeHostname(hostname: string): string {
+	return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+
+function assertPublicAddress(address: string, hostname: string, allowRanges: ParsedCidr[] = []): void {
+	const normalized = normalizeHostname(address);
+	const ipVersion = net.isIP(normalized);
+	if (ipVersion === 0) throw new Error(`Resolved non-IP address for ${hostname}: ${address}`);
+	// Explicitly-allowed ranges bypass the private/reserved checks below. This lets
+	// users exempt synthetic ranges produced by TUN/fake-IP proxies (e.g. 198.18/15).
+	if (isInAllowedRange(normalized, ipVersion, allowRanges)) return;
+	if (ipVersion === 4 && isBlockedIPv4(normalized)) {
+		throw new Error(`Blocked internal address for ${hostname}: ${normalized}`);
+	}
+	if (ipVersion === 6 && isBlockedIPv6(normalized)) {
+		throw new Error(`Blocked internal address for ${hostname}: ${normalized}`);
+	}
+}
+
+function isBlockedIPv4(address: string): boolean {
+	const parts = address.split(".").map(part => Number(part));
+	if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return true;
+	const [a, b] = parts;
+	return a === 0 ||
+		a === 10 ||
+		a === 127 ||
+		(a === 100 && b >= 64 && b <= 127) ||
+		(a === 169 && b === 254) ||
+		(a === 172 && b >= 16 && b <= 31) ||
+		(a === 192 && b === 168) ||
+		(a === 198 && (b === 18 || b === 19)) ||
+		a >= 224;
+}
+
+function isBlockedIPv6(address: string): boolean {
+	const groups = parseIPv6(address);
+	if (!groups) return true;
+
+	const first = groups[0];
+	if (groups.every(group => group === 0)) return true;
+	if (groups.slice(0, 7).every(group => group === 0) && groups[7] === 1) return true;
+	if ((first & 0xfe00) === 0xfc00) return true;
+	if ((first & 0xffc0) === 0xfe80) return true;
+
+	const isMappedIPv4 = groups.slice(0, 5).every(group => group === 0) && groups[5] === 0xffff;
+	if (isMappedIPv4) {
+		const ipv4 = [groups[6] >> 8, groups[6] & 0xff, groups[7] >> 8, groups[7] & 0xff].join(".");
+		return isBlockedIPv4(ipv4);
+	}
+
+	return false;
+}
+
+function parseIPv6(address: string): number[] | null {
+	if (address.includes(".")) {
+		const lastColon = address.lastIndexOf(":");
+		const ipv4 = address.slice(lastColon + 1);
+		if (net.isIP(ipv4) !== 4) return null;
+		const octets = ipv4.split(".").map(part => Number(part));
+		address = `${address.slice(0, lastColon)}:${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`;
+	}
+
+	const pieces = address.split("::");
+	if (pieces.length > 2) return null;
+
+	const left = pieces[0] ? pieces[0].split(":") : [];
+	const right = pieces.length === 2 && pieces[1] ? pieces[1].split(":") : [];
+	const missing = 8 - left.length - right.length;
+	if (pieces.length === 1 && missing !== 0) return null;
+	if (pieces.length === 2 && missing < 0) return null;
+
+	const groups = [...left, ...Array(missing).fill("0"), ...right].map(part => {
+		if (!/^[0-9a-f]{1,4}$/i.test(part)) return -1;
+		return parseInt(part, 16);
+	});
+	return groups.length === 8 && groups.every(group => group >= 0 && group <= 0xffff) ? groups : null;
+}
+
+/** Parse `allowRanges` config value into validated CIDR rules. Throws on malformed entries. */
+function parseAllowRanges(input: unknown): ParsedCidr[] {
+	if (input === undefined || input === null) return [];
+	if (!Array.isArray(input)) {
+		throw new Error("ssrf.allowRanges must be an array of CIDR strings");
+	}
+	const rules: ParsedCidr[] = [];
+	for (const entry of input) {
+		if (typeof entry !== "string") {
+			throw new Error(`ssrf.allowRanges entries must be strings, got ${typeof entry}`);
+		}
+		const rule = parseCidr(entry.trim());
+		if (!rule) {
+			throw new Error(`Invalid CIDR notation in ssrf.allowRanges: "${entry}"`);
+		}
+		rules.push(rule);
+	}
+	return rules;
+}
+
+/** Parse a single CIDR (e.g. "198.18.0.0/15", "fd00::/8") or bare host ("1.2.3.4"). Returns null if invalid. */
+function parseCidr(raw: string): ParsedCidr | null {
+	if (!raw) return null;
+	const slash = raw.lastIndexOf("/");
+	const addrPart = slash >= 0 ? raw.slice(0, slash) : raw;
+	const prefixPart = slash >= 0 ? raw.slice(slash + 1) : null;
+	// A slash must be followed by digits. Number("")/Number(" ") are 0, which
+	// would silently turn "198.18.0.0/" into /0 and exempt every address.
+	if (prefixPart !== null && !/^\d+$/.test(prefixPart)) return null;
+	const version = net.isIP(addrPart);
+
+	if (version === 4) {
+		const bytes = ipv4ToBytes(addrPart);
+		if (!bytes) return null;
+		const prefix = prefixPart === null ? 32 : Number(prefixPart);
+		if (!Number.isInteger(prefix) || prefix < 1 || prefix > 32) return null;
+		return { bytes, prefix };
+	}
+	if (version === 6) {
+		const groups = parseIPv6(addrPart);
+		if (!groups) return null;
+		const prefix = prefixPart === null ? 128 : Number(prefixPart);
+		if (!Number.isInteger(prefix) || prefix < 1 || prefix > 128) return null;
+		return { bytes: ipv6GroupsToBytes(groups), prefix };
+	}
+	return null;
+}
+
+function ipv4ToBytes(address: string): Uint8Array | null {
+	const parts = address.split(".");
+	if (parts.length !== 4) return null;
+	const bytes = new Uint8Array(4);
+	for (let i = 0; i < 4; i++) {
+		const octet = Number(parts[i]);
+		if (!Number.isInteger(octet) || octet < 0 || octet > 255) return null;
+		bytes[i] = octet;
+	}
+	return bytes;
+}
+
+function ipv6GroupsToBytes(groups: number[]): Uint8Array {
+	const bytes = new Uint8Array(16);
+	for (let i = 0; i < 8; i++) {
+		bytes[i * 2] = groups[i] >> 8;
+		bytes[i * 2 + 1] = groups[i] & 0xff;
+	}
+	return bytes;
+}
+
+function ipToBytes(address: string, version: number): Uint8Array | null {
+	if (version === 4) return ipv4ToBytes(address);
+	if (version === 6) {
+		const groups = parseIPv6(address);
+		return groups ? ipv6GroupsToBytes(groups) : null;
+	}
+	return null;
+}
+
+/** True if `address` (already validated as `ipVersion`) falls within any allowed CIDR. */
+function isInAllowedRange(address: string, ipVersion: number, allowRanges: ParsedCidr[]): boolean {
+	if (allowRanges.length === 0) return false;
+	const addrBytes = ipToBytes(address, ipVersion);
+	if (!addrBytes) return false;
+	for (const rule of allowRanges) {
+		// Only compare same-family rules (4-byte IPv4 vs 16-byte IPv6).
+		if (rule.bytes.length !== addrBytes.length) continue;
+		if (bytesMatchPrefix(addrBytes, rule.bytes, rule.prefix)) return true;
+	}
+	return false;
+}
+
+/** Compare the leading `prefix` bits of two equal-length byte arrays. */
+function bytesMatchPrefix(addr: Uint8Array, network: Uint8Array, prefix: number): boolean {
+	const fullBytes = prefix >> 3;
+	const remBits = prefix & 7;
+	for (let i = 0; i < fullBytes; i++) {
+		if (addr[i] !== network[i]) return false;
+	}
+	if (remBits > 0 && fullBytes < addr.length) {
+		const mask = (0xff << (8 - remBits)) & 0xff;
+		if ((addr[fullBytes] & mask) !== (network[fullBytes] & mask)) return false;
+	}
+	return true;
+}

package/node_modules/pi-web-access/storage.ts

@@ -0,0 +1,72 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ExtractedContent } from "./extract.ts";
+import type { SearchResult } from "./perplexity.ts";
+
+const CACHE_TTL_MS = 60 * 60 * 1000;
+
+export interface QueryResultData {
+	query: string;
+	answer: string;
+	results: SearchResult[];
+	error: string | null;
+	provider?: string;
+}
+
+export interface StoredSearchData {
+	id: string;
+	type: "search" | "fetch";
+	timestamp: number;
+	queries?: QueryResultData[];
+	urls?: ExtractedContent[];
+}
+
+const storedResults = new Map<string, StoredSearchData>();
+
+export function generateId(): string {
+	return Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
+}
+
+export function storeResult(id: string, data: StoredSearchData): void {
+	storedResults.set(id, data);
+}
+
+export function getResult(id: string): StoredSearchData | null {
+	return storedResults.get(id) ?? null;
+}
+
+export function getAllResults(): StoredSearchData[] {
+	return Array.from(storedResults.values());
+}
+
+export function deleteResult(id: string): boolean {
+	return storedResults.delete(id);
+}
+
+export function clearResults(): void {
+	storedResults.clear();
+}
+
+function isValidStoredData(data: unknown): data is StoredSearchData {
+	if (!data || typeof data !== "object") return false;
+	const d = data as Record<string, unknown>;
+	if (typeof d.id !== "string" || !d.id) return false;
+	if (d.type !== "search" && d.type !== "fetch") return false;
+	if (typeof d.timestamp !== "number") return false;
+	if (d.type === "search" && !Array.isArray(d.queries)) return false;
+	if (d.type === "fetch" && !Array.isArray(d.urls)) return false;
+	return true;
+}
+
+export function restoreFromSession(ctx: ExtensionContext): void {
+	storedResults.clear();
+	const now = Date.now();
+
+	for (const entry of ctx.sessionManager.getBranch()) {
+		if (entry.type === "custom" && entry.customType === "web-search-results") {
+			const data = entry.data;
+			if (isValidStoredData(data) && now - data.timestamp < CACHE_TTL_MS) {
+				storedResults.set(data.id, data);
+			}
+		}
+	}
+}

package/node_modules/pi-web-access/summary-model-scope.ts

@@ -0,0 +1,88 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh"]);
+
+interface SummaryModelScopeContext {
+	cwd: string;
+	isProjectTrusted(): boolean;
+}
+
+interface ModelLike {
+	provider: string;
+	id: string;
+}
+
+function getAgentDir(): string {
+	return process.env.PI_CODING_AGENT_DIR || join(homedir(), ".pi", "agent");
+}
+
+function readSettings(path: string): Record<string, unknown> {
+	if (!existsSync(path)) return {};
+	const raw = readFileSync(path, "utf8");
+	try {
+		return JSON.parse(raw) as Record<string, unknown>;
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse ${path}: ${message}`);
+	}
+}
+
+export function loadEnabledModelPatterns(ctx: SummaryModelScopeContext): string[] | null {
+	const globalSettings = readSettings(join(getAgentDir(), "settings.json"));
+	const projectSettings = ctx.isProjectTrusted()
+		? readSettings(join(ctx.cwd, ".pi", "settings.json"))
+		: {};
+	const value = Object.hasOwn(projectSettings, "enabledModels")
+		? projectSettings.enabledModels
+		: globalSettings.enabledModels;
+	if (value === undefined) return null;
+	if (!Array.isArray(value)) throw new Error("enabledModels must be an array");
+	return value
+		.filter((item): item is string => typeof item === "string")
+		.map(item => item.trim())
+		.filter(Boolean);
+}
+
+export function summaryModelValue(model: ModelLike): string {
+	return `${model.provider}/${model.id}`;
+}
+
+function stripThinkingSuffix(pattern: string): string {
+	const index = pattern.lastIndexOf(":");
+	if (index < 0) return pattern;
+	const suffix = pattern.slice(index + 1);
+	return THINKING_LEVELS.has(suffix) ? pattern.slice(0, index) : pattern;
+}
+
+function globToRegExp(pattern: string): RegExp {
+	let source = "^";
+	for (const char of pattern) {
+		if (char === "*") {
+			source += ".*";
+		} else if (char === "?") {
+			source += ".";
+		} else {
+			source += char.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+		}
+	}
+	return new RegExp(`${source}$`, "i");
+}
+
+export function modelMatchesEnabledPatterns(model: ModelLike, patterns: string[] | null): boolean {
+	if (patterns === null) return true;
+	const value = summaryModelValue(model).toLowerCase();
+	const id = model.id.toLowerCase();
+	for (const rawPattern of patterns) {
+		const pattern = stripThinkingSuffix(rawPattern.trim()).toLowerCase();
+		if (!pattern) continue;
+		if (pattern.includes("*") || pattern.includes("?")) {
+			const regex = globToRegExp(pattern);
+			if (regex.test(value) || regex.test(id)) return true;
+			continue;
+		}
+		if (pattern === value || pattern === id) return true;
+	}
+	return false;
+}