@piewf/cli 5.3.0 → 5.5.0-rc.1

package/dist/src/bundles.js

@@ -366,8 +366,10 @@ function roleMarkdown(role) {
         metadata.push(`overrideSystemPrompt: ${String(role.overrideSystemPrompt)}`);
     if (role.contextFiles !== undefined)
         metadata.push(`contextFiles: ${JSON.stringify(role.contextFiles)}`);
-    if (role.disabledAgentResources !== undefined)
-        metadata.push(`disabledAgentResources: ${JSON.stringify(role.disabledAgentResources)}`);
+    if (role.skills !== undefined)
+        metadata.push(`skills: ${JSON.stringify(role.skills)}`);
+    if (role.extensions !== undefined)
+        metadata.push(`extensions: ${JSON.stringify(role.extensions)}`);
     metadata.push("---");
     return `${metadata.join("\n")}\n${role.prompt ?? ""}\n`;
 }

package/dist/src/cli.d.ts

@@ -18,6 +18,7 @@ export declare function parseWorkflowCliArgs(schema: JsonSchema, rawArgs: readon
 export declare function parseDoctorArgs(rawArgs: readonly string[]): {
     role?: string;
     prompt?: string;
+    json?: boolean;
 };
 export declare function parseDoctorCleanupArgs(rawArgs: readonly string[]): Required<Pick<DoctorCleanupOptions, "olderThanDays" | "yes">>;
 export declare function runCli(args: readonly string[], options?: CliOptions, write?: (text: string) => void): Promise<number>;

package/dist/src/cli.js

@@ -241,10 +241,15 @@ function parseInspectArgs(rawArgs) {
 export function parseDoctorArgs(rawArgs) {
     let role;
     let prompt;
+    let json = false;
     for (let index = 0; index < rawArgs.length; index += 1) {
         const token = requiredArg(rawArgs, index);
         const equals = token.indexOf("=");
         const option = equals >= 0 ? token.slice(0, equals) : token;
+        if (option === "--json" && equals < 0) {
+            json = true;
+            continue;
+        }
         if (option === "--role" || option === "--prompt") {
             const value = equals >= 0 ? token.slice(equals + 1) : rawArgs[++index];
             if (!value)
@@ -271,7 +276,7 @@ export function parseDoctorArgs(rawArgs) {
     }
     if (prompt !== undefined && role === undefined)
         throw new Error("--prompt requires --role");
-    return { ...(role === undefined ? {} : { role }), ...(prompt === undefined ? {} : { prompt }) };
+    return { ...(role === undefined ? {} : { role }), ...(prompt === undefined ? {} : { prompt }), ...(json ? { json: true } : {}) };
 }
 export function parseDoctorCleanupArgs(rawArgs) {
     let olderThanDays = 90;
@@ -737,13 +742,13 @@ export async function runCli(args, options = {}, write = (text) => { process.std
     const stderr = options.stderr ?? ((text) => { process.stderr.write(text); });
     if (args[0] === "doctor" && args[1] !== "cleanup") {
         if (args.slice(1).some((arg) => arg === "--help" || arg === "-h")) {
-            write("Usage: piewf doctor [role] [--role <role>] [--prompt <text>]\n");
+            write("Usage: piewf doctor [role] [--role <role>] [--prompt <text>] [--json]\n");
             return 0;
         }
         try {
-            const parsed = parseDoctorArgs(args.slice(1));
+            const { json, ...parsed } = parseDoctorArgs(args.slice(1));
             const report = await doctor({ ...options, ...parsed });
-            write(formatDoctorReport(report));
+            write(json ? `${JSON.stringify(report)}\n` : formatDoctorReport(report));
             return doctorExitCode(report);
         }
         catch (error) {
@@ -808,7 +813,7 @@ export async function runCli(args, options = {}, write = (text) => { process.std
             return 1;
         }
     }
-    write("Usage: piewf doctor [role] [--role <role>] [--prompt <text>] | inspect [session-id] [--json|--summary] [--failed] | transcript <session-file> | bundle <workflow-name> [--name <command>] [--output <path>] [--force] | run <workflow-name> [workflow arguments] | export <workflow-name> [--name <command>] [--output <path>] [--force] [--bundle]\n");
+    write("Usage: piewf doctor [role] [--role <role>] [--prompt <text>] [--json] | inspect [session-id] [--json|--summary] [--failed] | transcript <session-file> | bundle <workflow-name> [--name <command>] [--output <path>] [--force] | run <workflow-name> [workflow arguments] | export <workflow-name> [--name <command>] [--output <path>] [--force] [--bundle]\n");
     return 1;
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {

package/dist/src/doctor-cleanup.js

@@ -48,15 +48,18 @@ function model(value, label) { if (!object(value) || typeof value.provider !== "
 function accounting(value, label) { if (!object(value))
     throw new Error(`${label} is invalid`); for (const key of ["input", "output", "cacheRead", "cacheWrite", "cost"])
     finiteNumber(value[key], `${label}.${key}`); }
-function resourceExclusions(value, label) { if (value === undefined)
+function resourceSelectors(value, label) { if (value === undefined)
     return; if (!object(value))
     throw new Error(`${label} is invalid`); if (value.skills !== undefined)
     stringList(value.skills, `${label}.skills`); if (value.extensions !== undefined)
-    stringList(value.extensions, `${label}.extensions`); }
+    stringList(value.extensions, `${label}.extensions`); if (value.tools !== undefined)
+    stringList(value.tools, `${label}.tools`); }
 function agentDefinition(value, label) { if (!object(value))
     throw new Error(`${label} is invalid`); optionalString(value.prompt, `${label}.prompt`); optionalString(value.description, `${label}.description`); optionalString(value.model, `${label}.model`); if (value.thinking !== undefined && !isThinking(value.thinking))
     throw new Error(`${label}.thinking is invalid`); if (value.tools !== undefined)
-    stringList(value.tools, `${label}.tools`); resourceExclusions(value.disabledAgentResources, `${label}.disabledAgentResources`); }
+    stringList(value.tools, `${label}.tools`); if (value.skills !== undefined)
+    stringList(value.skills, `${label}.skills`); if (value.extensions !== undefined)
+    stringList(value.extensions, `${label}.extensions`); }
 function optionalRole(value, label) {
     if (value === undefined)
         return;
@@ -78,11 +81,15 @@ function optionalRole(value, label) {
         throw new Error(`${label}.overrideSystemPrompt is invalid`);
     if (value.contextFiles !== undefined && value.contextFiles !== null)
         stringList(value.contextFiles, `${label}.contextFiles`);
-    if (value.disabledAgentResources !== undefined && value.disabledAgentResources !== null)
-        resourceExclusions(value.disabledAgentResources, `${label}.disabledAgentResources`);
+    if (value.skills !== undefined && value.skills !== null)
+        stringList(value.skills, `${label}.skills`);
+    if (value.extensions !== undefined && value.extensions !== null)
+        stringList(value.extensions, `${label}.extensions`);
 }
 function validateScheduledOptions(value, label) { if (!object(value) || typeof value.label !== "string" || !value.label || typeof value.cwd !== "string" || !value.cwd)
-    throw new Error(`${label} is invalid`); optionalString(value.requestedLabel, `${label}.requestedLabel`); optionalString(value.parentBreadcrumb, `${label}.parentBreadcrumb`); stringList(value.tools, `${label}.tools`); optionalString(value.worktreeOwner, `${label}.worktreeOwner`); optionalString(value.model, `${label}.model`); if (value.thinking !== undefined && !isThinking(value.thinking))
+    throw new Error(`${label} is invalid`); optionalString(value.requestedLabel, `${label}.requestedLabel`); optionalString(value.parentBreadcrumb, `${label}.parentBreadcrumb`); stringList(value.tools, `${label}.tools`); if (value.skills !== undefined)
+    stringList(value.skills, `${label}.skills`); if (value.extensions !== undefined)
+    stringList(value.extensions, `${label}.extensions`); optionalString(value.worktreeOwner, `${label}.worktreeOwner`); optionalString(value.model, `${label}.model`); if (value.thinking !== undefined && !isThinking(value.thinking))
     throw new Error(`${label}.thinking is invalid`); optionalRole(value.role, `${label}.role`); if (value.schema !== undefined)
     validateSchema(value.schema, `${label}.schema`); if (value.retries !== undefined)
     nonNegativeInteger(value.retries, `${label}.retries`); if (value.timeoutMs !== undefined && value.timeoutMs !== null)
@@ -104,7 +111,8 @@ function validateAgentSetup(value, label) {
     stringList(value.tools, `${label}.tools`);
     if (typeof value.cwd !== "string" || !value.cwd)
         throw new Error(`${label}.cwd is invalid`);
-    resourceExclusions(value.disabledAgentResources, `${label}.disabledAgentResources`);
+    if (value.resourceSelectors !== undefined)
+        resourceSelectors(value.resourceSelectors, `${label}.resourceSelectors`);
 }
 function validateAgent(value, label) {
     if (!object(value) || typeof value.id !== "string" || !value.id || typeof value.name !== "string" || !value.name || typeof value.path !== "string" || !value.path || !isAgentState(value.state))
@@ -254,17 +262,18 @@ function validateSnapshot(snapshot) {
         positiveInteger(snapshot.identityVersion, "Persisted snapshot identity version");
     optionalString(snapshot.settingsPath, "Persisted snapshot settings path");
     if (snapshot.settingsSources !== undefined) {
-        if (!object(snapshot.settingsSources) || typeof snapshot.settingsSources.concurrency !== "string" || typeof snapshot.settingsSources.modelAliases !== "string" || typeof snapshot.settingsSources.disabledAgentResources !== "string")
+        if (!object(snapshot.settingsSources) || typeof snapshot.settingsSources.concurrency !== "string" || typeof snapshot.settingsSources.modelAliases !== "string" || snapshot.settingsSources.skills !== undefined && typeof snapshot.settingsSources.skills !== "string" || snapshot.settingsSources.extensions !== undefined && typeof snapshot.settingsSources.extensions !== "string" || snapshot.settingsSources.tools !== undefined && typeof snapshot.settingsSources.tools !== "string")
             throw new Error("Persisted snapshot settings sources are invalid");
     }
+    const settingsRecord = snapshot.settings;
+    resourceSelectors({ skills: settingsRecord.skills, extensions: settingsRecord.extensions, tools: settingsRecord.tools }, "Persisted snapshot selectors");
     validateBudget(snapshot.budget);
     if (snapshot.modelAliases !== undefined)
         validateModelAliases(snapshot.modelAliases);
-    if (snapshot.settings.modelAliases !== undefined)
-        validateModelAliases(snapshot.settings.modelAliases);
+    if (settingsRecord.modelAliases !== undefined)
+        validateModelAliases(settingsRecord.modelAliases);
     if (snapshot.phases !== undefined)
         stringList(snapshot.phases, "Persisted snapshot phases");
-    resourceExclusions(snapshot.settings.disabledAgentResources, "Persisted snapshot disabled resources");
     if (snapshot.roles !== undefined) {
         if (!object(snapshot.roles))
             throw new Error("Persisted snapshot roles are invalid");

package/dist/src/doctor.d.ts

@@ -38,12 +38,18 @@ export interface DoctorRoleInspection {
     };
     tools: readonly string[];
     resources: {
+        selectors: {
+            skills: readonly string[];
+            extensions: readonly string[];
+            tools: readonly string[];
+        };
         skills: readonly string[];
         extensions: readonly string[];
-        excludedSkills: readonly string[];
-        excludedExtensions: readonly string[];
+        tools: readonly string[];
         unmatchedSkills: readonly string[];
         unmatchedExtensions: readonly string[];
+        unmatchedTools: readonly string[];
+        selectorSources?: NonNullable<AgentResourcePolicy["selectorSources"]>;
     };
     systemPrompt: {
         probe: string;

package/dist/src/doctor.js

@@ -1,11 +1,30 @@
 import { readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, extname, join, resolve } from "node:path";
-import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
+import { InMemoryCredentialStore, InMemoryModelsStore } from "@earendil-works/pi-ai";
 import { ModelRuntime, createAgentSessionFromServices, createAgentSessionServices, getAgentDir, hasTrustRequiringProjectResources, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
-import { DEFAULT_SETTINGS, createLocalPiSession, errorText, isNodeError, isObject, loadSettings, prepareAgentSetupForInspection, resolveAgentResourcePolicy, resolveWorkflowSettings, resolveModelReference, parseThinking, parseRoleMarkdown, registeredWorkflowFunctions, registeredWorkflowRoleDirectoryRegistrations, workflowRoleDirectories, workflowProjectSettingsPath, workflowSettingsPath, } from "pi-extensible-workflows";
+import { DEFAULT_SETTINGS, createLocalPiSession, errorText, isNodeError, isObject, loadSettings, prepareAgentSetupForInspection, resolveAgentResourcePolicy, resolveWorkflowSettings, resolveModelReference, resourcePatternHasMagic, parseThinking, parseRoleMarkdown, registeredWorkflowFunctions, registeredWorkflowRoleDirectoryRegistrations, workflowRoleDirectories, workflowProjectSettingsPath, workflowSettingsPath, } from "pi-extensible-workflows";
 import { loadingRegistry } from "pi-extensible-workflows";
-import { disabledResources, unmatchedResourcePatterns } from "pi-extensible-workflows";
+import { selectResourcesByLayers, unmatchedResourcePatterns } from "pi-extensible-workflows";
 const THINKING_HINT = "Use off, minimal, low, medium, high, xhigh, or max.";
+const AGENT_RESOURCE_SELECTOR_MIGRATION_ISSUE = "https://github.com/vekexasia/pi-extensible-workflows/issues/205";
+const AGENT_RESOURCE_SELECTOR_MIGRATION_MESSAGE = `\`disabledAgentResources\` is no longer supported by #205. Migrate to direct \`skills\`, \`extensions\`, and \`tools\` selectors: legacy patterns exclude resources and \`!pattern\` re-enables them, while new selectors include matches and \`!pattern\` excludes them. See ${AGENT_RESOURCE_SELECTOR_MIGRATION_ISSUE}`;
+function usesLegacySettings(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return isObject(parsed) && Object.prototype.hasOwnProperty.call(parsed, "disabledAgentResources");
+    }
+    catch {
+        return false;
+    }
+}
+function usesLegacyRoleSelectors(path) {
+    try {
+        return /^\s*disabledAgentResources\s*:/m.test(readFileSync(path, "utf8"));
+    }
+    catch {
+        return false;
+    }
+}
 function canonical(path) {
     const absolute = resolve(path);
     try {
@@ -73,7 +92,7 @@ async function discoverPi(cwd, agentDir) {
     const previousOffline = process.env.PI_OFFLINE;
     process.env.PI_OFFLINE = "1";
     try {
-        const modelRuntime = await ModelRuntime.create({ credentials: await readCredentials(agentDir), modelsPath: join(agentDir, "models.json") });
+        const modelRuntime = await ModelRuntime.create({ credentials: await readCredentials(agentDir), modelsPath: join(agentDir, "models.json"), modelsStore: new InMemoryModelsStore() });
         const services = await createAgentSessionServices({
             cwd,
             agentDir,
@@ -170,9 +189,17 @@ function roleProvenance(source) {
 function diagnostic(severity, code, message, source, hint) {
     return { severity, code, message, ...(source ? { source } : {}), ...(hint ? { hint } : {}) };
 }
+function legacyAgentResourceSelectorDiagnostic(source) {
+    return diagnostic("error", "AGENT_RESOURCE_SELECTOR_MIGRATION", AGENT_RESOURCE_SELECTOR_MIGRATION_MESSAGE, source, "Replace disabledAgentResources with direct selectors and use !* before positive allow-list patterns.");
+}
+function positiveOnlyToolSelectorDiagnostic(source, selectors) {
+    if (!selectors?.length || selectors.some((selector) => selector.startsWith("!")))
+        return undefined;
+    return diagnostic("warning", "AGENT_RESOURCE_TOOL_SELECTOR_ALLOWLIST", "Positive-only tool selectors do not restrict the default-enabled candidate set.", `${source}.tools`, "Prepend !* before positive patterns to make this an allow-list.");
+}
 function emptyResourcePolicy(globalSettingsPath, cwd, projectTrusted) {
-    const empty = { skills: [], extensions: [] };
-    return { globalSettingsPath, projectSettingsPath: workflowProjectSettingsPath(cwd), projectTrusted, global: empty, project: empty, effective: empty, unmatchedSkills: [], unmatchedExtensions: [] };
+    const empty = { skills: [], extensions: [], tools: [] };
+    return { globalSettingsPath, projectSettingsPath: workflowProjectSettingsPath(cwd), projectTrusted, global: empty, project: empty, effective: empty, unmatchedSkills: [], unmatchedExtensions: [], unmatchedTools: [], selectorSources: { global: {}, project: {} } };
 }
 function validateModel(value, known, available, source, diagnostics, aliases, dynamicAliases, settingsPath) {
     if (isDynamicModelAlias(value, dynamicAliases))
@@ -194,10 +221,17 @@ function inspectRole(path, activeTools, knownModels, availableModels, diagnostic
         definition = parseRoleMarkdown(readFileSync(path, "utf8"), true, path);
     }
     catch (error) {
+        if (usesLegacyRoleSelectors(path)) {
+            diagnostics.push(legacyAgentResourceSelectorDiagnostic(path));
+            return undefined;
+        }
         const message = error instanceof Error ? error.message : String(error);
         diagnostics.push(diagnostic("error", "ROLE_FRONTMATTER", source ? `${roleProvenance(source)} contains invalid role at "${path}": ${message}` : message, path, "Fix the role YAML frontmatter."));
         return undefined;
     }
+    const toolSelectorDiagnostic = positiveOnlyToolSelectorDiagnostic(path, definition.tools);
+    if (toolSelectorDiagnostic)
+        diagnostics.push(toolSelectorDiagnostic);
     const body = definition.prompt ?? "";
     if (body.trim() === "")
         diagnostics.push(diagnostic("warning", "ROLE_BODY_EMPTY", "Role body is empty", path));
@@ -207,15 +241,22 @@ function inspectRole(path, activeTools, knownModels, availableModels, diagnostic
         diagnostics.push(diagnostic("warning", "ROLE_PLACEHOLDER", "Role body contains an unsupported placeholder-looking token", path));
     if (definition.model)
         validateModel(definition.model, knownModels, availableModels, path, diagnostics, aliases, dynamicAliases, settingsPath);
-    for (const tool of definition.tools ?? [])
-        if (!activeTools.has(tool))
+    for (const selector of definition.tools ?? []) {
+        const tool = selector.startsWith("!") ? selector.slice(1) : selector;
+        if (!selector.startsWith("!") && !resourcePatternHasMagic(selector) && !activeTools.has(tool))
             diagnostics.push(diagnostic("error", "ROLE_TOOL_INACTIVE", `Tool is unknown or inactive: ${tool}`, path, "Use a tool listed under Pi active tools or enable its Pi extension."));
+    }
     return definition;
 }
 function matchResourcePolicy(policy, pi) {
     const extensions = [...new Set((pi.extensions ?? []).map(canonical))];
     const skills = [...new Set(pi.skills ?? [])];
-    return { ...policy, excludedSkills: disabledResources(policy.effective.skills, skills), excludedExtensions: disabledResources(policy.effective.extensions, extensions), unmatchedSkills: unmatchedResourcePatterns(policy.effective.skills, skills), unmatchedExtensions: unmatchedResourcePatterns(policy.effective.extensions, extensions) };
+    const tools = [...new Set(pi.activeTools)];
+    const layers = policy.selectorSources;
+    const selectedSkills = selectResourcesByLayers([layers.global.skills, layers.project.skills], skills);
+    const selectedExtensions = selectResourcesByLayers([layers.global.extensions, layers.project.extensions], extensions);
+    const selectedTools = selectResourcesByLayers([layers.global.tools, layers.project.tools], tools);
+    return { ...policy, selectedSkills, selectedExtensions, selectedTools, unmatchedSkills: unmatchedResourcePatterns(policy.effective.skills, skills), unmatchedExtensions: unmatchedResourcePatterns(policy.effective.extensions, extensions), unmatchedTools: unmatchedResourcePatterns(policy.effective.tools ?? [], tools) };
 }
 async function inspectRoleSession(cwd, agentDir, roleName, definition, rolePath, basePolicy, rootModel, activeTools, aliases, knownModels, availableModels, settingsPath, prompt, hooks, diagnostics) {
     const setupDiagnostics = [];
@@ -260,7 +301,7 @@ async function inspectRoleSession(cwd, agentDir, roleName, definition, rolePath,
         const policy = prepared.setup.sessionInput.resourcePolicy ?? basePolicy;
         for (const item of [...resources.diagnostics, ...promptResult.diagnostics])
             setupDiagnostics.push(diagnostic(item.type === "error" ? "error" : "warning", "ROLE_INSPECTION", item.message, item.source));
-        return { role: roleName, path: rolePath, model: actualModel, tools: state?.tools.map(({ name }) => name) ?? [...prepared.setup.sessionInput.tools], resources: { skills: resources.skills, extensions: resources.extensions, excludedSkills: policy.excludedSkills ?? [], excludedExtensions: policy.excludedExtensions ?? [], unmatchedSkills: policy.unmatchedSkills, unmatchedExtensions: policy.unmatchedExtensions }, systemPrompt: { probe: prompt, expandedProbe: promptResult.expandedPrompt, text: promptResult.systemPrompt, ...(resources.systemPromptSource ? { source: resources.systemPromptSource } : {}) }, setup: { hooks: prepared.summary.hookNames, diagnostics: setupDiagnostics } };
+        return { role: roleName, path: rolePath, model: actualModel, tools: state?.tools.map(({ name }) => name) ?? [...prepared.setup.sessionInput.tools], resources: { selectors: { skills: [...policy.effective.skills], extensions: [...policy.effective.extensions], tools: [...(policy.effective.tools ?? [])] }, skills: policy.selectedSkills ?? resources.skills, extensions: policy.selectedExtensions ?? resources.extensions, tools: policy.selectedTools ?? prepared.setup.sessionInput.tools, unmatchedSkills: policy.unmatchedSkills, unmatchedExtensions: policy.unmatchedExtensions, unmatchedTools: policy.unmatchedTools ?? [], selectorSources: policy.selectorSources }, systemPrompt: { probe: prompt, expandedProbe: promptResult.expandedPrompt, text: promptResult.systemPrompt, ...(resources.systemPromptSource ? { source: resources.systemPromptSource } : {}) }, setup: { hooks: prepared.summary.hookNames, diagnostics: setupDiagnostics } };
     }
     catch (error) {
         setupDiagnostics.push(diagnostic("error", "ROLE_INSPECTION", error instanceof Error ? error.message : String(error), rolePath));
@@ -276,6 +317,8 @@ export async function doctor(options = {}) {
     const cwd = canonical(options.cwd ?? process.cwd());
     const agentDir = canonical(options.agentDir ?? getAgentDir());
     const settingsPath = canonical(options.settingsPath ?? workflowSettingsPath(agentDir));
+    const projectSettingsPath = workflowProjectSettingsPath(cwd);
+    const legacyGlobalSettings = usesLegacySettings(settingsPath);
     const diagnostics = [];
     let settings = DEFAULT_SETTINGS;
     try {
@@ -284,8 +327,7 @@ export async function doctor(options = {}) {
     catch (error) {
         diagnostics.push(diagnostic("error", "SETTINGS_INVALID", errorText(error), settingsPath, "Fix or remove the invalid workflow settings file."));
     }
-    let settingsSources = { concurrency: settingsPath, modelAliases: settingsPath, disabledAgentResources: settingsPath };
-    const projectSettingsPath = workflowProjectSettingsPath(cwd);
+    let settingsSources = { concurrency: settingsPath, modelAliases: settingsPath, skills: settingsPath, extensions: settingsPath, tools: settingsPath };
     let pi;
     try {
         pi = await (options.discoverPi ?? discoverPi)(cwd, agentDir);
@@ -298,6 +340,11 @@ export async function doctor(options = {}) {
         pi = { ...pi, activeTools: options.activeTools.filter((tool) => tool !== "workflow" && tool !== "workflow_respond" && tool !== "workflow_catalog") };
     if (pi.trust.required && !pi.trust.trusted)
         diagnostics.push(diagnostic("warning", "PROJECT_UNTRUSTED", "Pi project resources are inactive because the project is not trusted", cwd, "Open this project in Pi, choose Trust, then rerun doctor."));
+    const legacyProjectSettings = pi.trust.trusted && usesLegacySettings(projectSettingsPath);
+    if (legacyGlobalSettings)
+        diagnostics.push(legacyAgentResourceSelectorDiagnostic(`${settingsPath}.disabledAgentResources`));
+    if (legacyProjectSettings)
+        diagnostics.push(legacyAgentResourceSelectorDiagnostic(`${projectSettingsPath}.disabledAgentResources`));
     for (const error of pi.extensionErrors)
         diagnostics.push(diagnostic("error", "EXTENSION_LOAD", error.message, error.path, "Fix or disable the failing Pi extension."));
     try {
@@ -322,10 +369,17 @@ export async function doctor(options = {}) {
             diagnostics.push(diagnostic("error", "SETTINGS_INVALID", message, source, "Fix or remove the invalid workflow settings file."));
         resourcePolicy = emptyResourcePolicy(settingsPath, cwd, pi.trust.trusted);
     }
+    for (const [source, selectors] of [[resourcePolicy.globalSettingsPath, resourcePolicy.selectorSources.global.tools], [resourcePolicy.projectSettingsPath, resourcePolicy.selectorSources.project.tools]]) {
+        const toolSelectorDiagnostic = positiveOnlyToolSelectorDiagnostic(source, selectors);
+        if (toolSelectorDiagnostic)
+            diagnostics.push(toolSelectorDiagnostic);
+    }
     for (const skill of resourcePolicy.unmatchedSkills)
-        diagnostics.push(diagnostic("warning", "AGENT_RESOURCE_UNMATCHED", `Disabled skill selector currently matches no discovered skill: ${skill}`, `${resourcePolicySource(settingsSources.disabledAgentResources)}.disabledAgentResources.skills`));
+        diagnostics.push(diagnostic("warning", "AGENT_RESOURCE_UNMATCHED", `Skill selector currently matches no discovered skill: ${skill}`, `${resourcePolicySource(settingsSources.skills ?? settingsPath)}.skills`));
     for (const extension of resourcePolicy.unmatchedExtensions)
-        diagnostics.push(diagnostic("warning", "AGENT_RESOURCE_UNMATCHED", `Disabled extension selector currently matches no discovered extension source: ${extension}`, `${resourcePolicySource(settingsSources.disabledAgentResources)}.disabledAgentResources.extensions`));
+        diagnostics.push(diagnostic("warning", "AGENT_RESOURCE_UNMATCHED", `Extension selector currently matches no discovered extension source: ${extension}`, `${resourcePolicySource(settingsSources.extensions ?? settingsPath)}.extensions`));
+    for (const tool of resourcePolicy.unmatchedTools ?? [])
+        diagnostics.push(diagnostic("warning", "AGENT_RESOURCE_UNMATCHED", `Tool selector currently matches no root tool: ${tool}`, `${resourcePolicySource(settingsSources.tools ?? settingsPath)}.tools`));
     const activeTools = new Set(pi.activeTools);
     const knownModels = new Set(pi.knownModels);
     const availableModels = new Set(pi.availableModels);
@@ -414,6 +468,9 @@ export async function doctor(options = {}) {
         else
             definitions.delete(name);
     }
+    const rolePaths = new Set(roles.map(({ path }) => path));
+    if (diagnostics.some(({ code, source }) => source !== undefined && rolePaths.has(source) && (code === "ROLE_FRONTMATTER" || code === "AGENT_RESOURCE_SELECTOR_MIGRATION")))
+        diagnostics.push(diagnostic("error", "ROLE_LOAD_BLOCKED", "Workflow role loading is blocked because the runtime rejects the complete role set when any active role file is invalid.", undefined, "Fix the reported role file before launching workflows."));
     let roleInspection;
     if (options.role !== undefined) {
         const activeRole = roles.find(({ name, active }) => name === options.role && active);
@@ -459,24 +516,44 @@ export async function doctor(options = {}) {
 }
 function count(report, severity) { return report.diagnostics.filter((item) => item.severity === severity).length; }
 export function doctorExitCode(report) { return count(report, "error") > 0 ? 1 : 0; }
-function exposedValues(values, excluded) {
-    const disabled = new Set(excluded);
-    return values.filter((value) => !disabled.has(value));
-}
 function nestedValues(label, values) {
     return [`- ${label}:`, ...(values.length ? values.map((value) => `  - \`${value}\``) : ["  - (none)"])];
 }
+function roleSelectorSourceLines(sources) {
+    return [
+        ...nestedValues("Global skill selectors", sources.global.skills ?? []),
+        ...nestedValues("Global extension selectors", sources.global.extensions ?? []),
+        ...nestedValues("Global tool selectors", sources.global.tools ?? []),
+        ...nestedValues("Project skill selectors", sources.project.skills ?? []),
+        ...nestedValues("Project extension selectors", sources.project.extensions ?? []),
+        ...nestedValues("Project tool selectors", sources.project.tools ?? []),
+        ...(sources.role === undefined ? [] : [
+            ...nestedValues("Role skill selectors", sources.role.skills ?? []),
+            ...nestedValues("Role extension selectors", sources.role.extensions ?? []),
+            ...nestedValues("Role tool selectors", sources.role.tools ?? []),
+        ]),
+        ...(sources.call === undefined ? [] : [
+            ...nestedValues("Call skill selectors", sources.call.skills ?? []),
+            ...nestedValues("Call extension selectors", sources.call.extensions ?? []),
+            ...nestedValues("Call tool selectors", sources.call.tools ?? []),
+        ]),
+    ];
+}
 function roleInspectionLines(inspection) {
     return [
         `- Role: \`${inspection.role}\` - \`${inspection.path}\``,
         `- Model: \`${inspection.model.provider}/${inspection.model.model}\` (${inspection.model.inherited ? "inherited, " : ""}${inspection.model.thinking ?? "off"})`,
+        ...(inspection.resources.selectorSources ? roleSelectorSourceLines(inspection.resources.selectorSources) : []),
         ...nestedValues("Tools", inspection.tools),
+        ...nestedValues("Configured skill selectors", inspection.resources.selectors.skills),
         ...nestedValues("Effective skills", inspection.resources.skills),
+        ...nestedValues("Configured extension selectors", inspection.resources.selectors.extensions),
         ...nestedValues("Effective extensions", inspection.resources.extensions),
-        ...nestedValues("Excluded skills", inspection.resources.excludedSkills),
-        ...nestedValues("Excluded extensions", inspection.resources.excludedExtensions),
+        ...nestedValues("Configured tool selectors", inspection.resources.selectors.tools),
+        ...nestedValues("Effective tools", inspection.resources.tools),
         ...nestedValues("Unmatched skills", inspection.resources.unmatchedSkills),
         ...nestedValues("Unmatched extensions", inspection.resources.unmatchedExtensions),
+        ...nestedValues("Unmatched tools", inspection.resources.unmatchedTools),
         `- Prompt probe: ${inspection.systemPrompt.probe ? JSON.stringify(inspection.systemPrompt.probe) : "empty"}`,
         `- Expanded probe: ${JSON.stringify(inspection.systemPrompt.expandedProbe)}`,
         `- System prompt source: ${inspection.systemPrompt.source ?? "(none)"}`,
@@ -504,6 +581,7 @@ export function formatDoctorReport(report) {
         ];
         return `${lines.join("\n")}\n`;
     }
+    const roleLoadingFailed = report.diagnostics.some(({ code }) => code === "ROLE_LOAD_BLOCKED");
     const lines = [
         "# pi-extensible-workflows doctor",
         "",
@@ -512,7 +590,7 @@ export function formatDoctorReport(report) {
         `- Agent dir: \`${report.agentDir}\``,
         `- Global workflow settings: \`${report.settingsPath}\``,
         `- Project workflow settings: \`${report.resourcePolicy.projectSettingsPath}\` (${report.resourcePolicy.projectTrusted ? "trusted" : "ignored: project untrusted"})`,
-        `- Effective setting sources: concurrency=\`${report.settingsSources.concurrency}\`, modelAliases=\`${report.settingsSources.modelAliases}\`, disabledAgentResources=\`${report.settingsSources.disabledAgentResources}\``,
+        `- Effective setting sources: concurrency=\`${report.settingsSources.concurrency}\`, modelAliases=\`${report.settingsSources.modelAliases}\`, skills=\`${report.settingsSources.skills ?? "(none)"}\`, extensions=\`${report.settingsSources.extensions ?? "(none)"}\`, tools=\`${report.settingsSources.tools ?? "(none)"}\``,
         `- Limits: concurrency=${String(report.settings.concurrency)}`,
         "",
         "## Trust/resources",
@@ -527,24 +605,24 @@ export function formatDoctorReport(report) {
         "## Pi active skills",
         ...(report.piSkills.length ? report.piSkills.map((skill) => `- \`${skill}\``) : ["- None resolved"]),
         "",
-        "## Workflow agent resources (after disabledAgentResources)",
+        "## Workflow agent resource selectors",
         `- Global settings: \`${report.resourcePolicy.globalSettingsPath}\``,
         `- Global skills: ${report.resourcePolicy.global.skills.join(", ") || "(none)"}`,
         `- Global extensions: ${report.resourcePolicy.global.extensions.join(", ") || "(none)"}`,
+        `- Global tools: ${(report.resourcePolicy.global.tools ?? []).join(", ") || "(none)"}`,
         `- Project settings: \`${report.resourcePolicy.projectSettingsPath}\` (${report.resourcePolicy.projectTrusted ? "trusted" : "ignored: project untrusted"})`,
         `- Project skills: ${report.resourcePolicy.project.skills.join(", ") || "(none)"}`,
         `- Project extensions: ${report.resourcePolicy.project.extensions.join(", ") || "(none)"}`,
-        `- Effective skills: ${report.resourcePolicy.effective.skills.join(", ") || "(none)"}`,
-        `- Effective extensions: ${report.resourcePolicy.effective.extensions.join(", ") || "(none)"}`,
-        ...nestedValues("Exposed skills", exposedValues(report.piSkills, report.resourcePolicy.excludedSkills ?? [])),
-        ...nestedValues("Exposed extensions", exposedValues(report.piExtensions, report.resourcePolicy.excludedExtensions ?? [])),
-        ...nestedValues("Disabled skills", report.resourcePolicy.excludedSkills ?? []),
-        ...nestedValues("Disabled extensions", report.resourcePolicy.excludedExtensions ?? []),
+        `- Project tools: ${(report.resourcePolicy.project.tools ?? []).join(", ") || "(none)"}`,
+        `- Effective skills: ${(report.resourcePolicy.selectedSkills ?? []).join(", ") || "(none)"}`,
+        `- Effective extensions: ${(report.resourcePolicy.selectedExtensions ?? []).join(", ") || "(none)"}`,
+        `- Effective tools: ${(report.resourcePolicy.selectedTools ?? []).join(", ") || "(none)"}`,
         `- Unmatched skills: ${report.resourcePolicy.unmatchedSkills.join(", ") || "(none)"}`,
         `- Unmatched extensions: ${report.resourcePolicy.unmatchedExtensions.join(", ") || "(none)"}`,
+        `- Unmatched tools: ${(report.resourcePolicy.unmatchedTools ?? []).join(", ") || "(none)"}`,
         "",
         "## Roles",
-        ...(report.roles.length ? report.roles.map((role) => `- \`${role.name}\` (${role.scope}, ${role.active ? "active" : role.overriddenBy ? `overridden by ${role.overriddenBy}` : "inactive: project untrusted"}) - \`${role.path}\`${role.extension ? `; ${extensionLabel(role.extension)} role directory "${dirname(role.path)}"` : ""}${role.overrides ? `; overrides \`${role.overrides}\`` : ""}`) : ["- None found"]),
+        ...(report.roles.length ? report.roles.map((role) => `- \`${role.name}\` (${role.scope}, ${role.active ? roleLoadingFailed ? "unavailable: role loading failed" : "active" : role.overriddenBy ? `overridden by ${role.overriddenBy}` : "inactive: project untrusted"}) - \`${role.path}\`${role.extension ? `; ${extensionLabel(role.extension)} role directory "${dirname(role.path)}"` : ""}${role.overrides ? `; overrides \`${role.overrides}\`` : ""}`) : ["- None found"]),
         "",
         "## Model aliases",
         ...(report.modelAliases.length ? report.modelAliases.map((alias) => `- [${alias.kind}] \`${alias.name}\`${alias.kind === "static" ? ` -> ${report.settings.modelAliases?.[alias.name] ?? "(unresolved)"}` : ""} (${alias.provenance})`) : ["- None registered"]),

package/dist/src/session-inspector.js

@@ -304,13 +304,17 @@ function detailLines(workflow) {
             lines.push(`Attempt ${String(attempt.attempt)} · ${attempt.model}${attempt.thinking !== undefined ? `:${attempt.thinking}` : ""} · ${money(attempt.cost)}${attempt.error ? ` · ${attempt.error}` : ""}`, `Prompt: ${attempt.prompt}`, ...(attempt.setup ? [
                 `Hooks: ${attempt.setup.hookNames.join(", ") || "(none)"}`,
                 `Effective: model=${attempt.setup.model.provider}/${attempt.setup.model.model}${attempt.setup.model.thinking ? `:${attempt.setup.model.thinking}` : ""} tools=${attempt.setup.tools.join(",") || "(none)"} cwd=${attempt.setup.cwd}`,
-                ...(attempt.setup.disabledAgentResources ? [
-                    `Configured skill patterns: ${attempt.setup.disabledAgentResources.skills.join(", ") || "(none)"}`,
-                    `Excluded skills: ${attempt.setup.disabledAgentResources.excludedSkills?.join(", ") || "(none)"}`,
-                    `Configured extension patterns: ${attempt.setup.disabledAgentResources.extensions.join(", ") || "(none)"}`,
-                    `Excluded extensions: ${attempt.setup.disabledAgentResources.excludedExtensions?.join(", ") || "(none)"}`,
-                    `Unmatched skills: ${attempt.setup.disabledAgentResources.unmatchedSkills.join(", ") || "(none)"}`,
-                    `Unmatched extensions: ${attempt.setup.disabledAgentResources.unmatchedExtensions.join(", ") || "(none)"}`,
+                ...(attempt.setup.resourceSelectors ? [
+                    `Selector sources: global/project/role/call are persisted with the attempt`,
+                    `Configured skill patterns: ${attempt.setup.resourceSelectors.selectors.skills.join(", ") || "(none)"}`,
+                    `Effective skills: ${attempt.setup.resourceSelectors.skills.join(", ") || "(none)"}`,
+                    `Configured extension patterns: ${attempt.setup.resourceSelectors.selectors.extensions.join(", ") || "(none)"}`,
+                    `Effective extensions: ${attempt.setup.resourceSelectors.extensions.join(", ") || "(none)"}`,
+                    `Configured tool patterns: ${(attempt.setup.resourceSelectors.selectors.tools ?? []).join(", ") || "(none)"}`,
+                    `Effective tools: ${attempt.setup.resourceSelectors.tools.join(", ") || "(none)"}`,
+                    `Unmatched skills: ${attempt.setup.resourceSelectors.unmatchedSkills.join(", ") || "(none)"}`,
+                    `Unmatched extensions: ${attempt.setup.resourceSelectors.unmatchedExtensions.join(", ") || "(none)"}`,
+                    `Unmatched tools: ${attempt.setup.resourceSelectors.unmatchedTools.join(", ") || "(none)"}`,
                 ] : []),
             ] : []));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piewf/cli",
-  "version": "5.3.0",
+  "version": "5.5.0-rc.1",
   "description": "CLI for pi-extensible-workflows",
   "homepage": "https://vekexasia.github.io/pi-extensible-workflows/",
   "repository": {
@@ -33,8 +33,8 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.82.1",
-    "@earendil-works/pi-coding-agent": "0.82.1",
+    "@earendil-works/pi-ai": "0.84.1",
+    "@earendil-works/pi-coding-agent": "0.84.1",
     "@eslint/js": "10.0.1",
     "@types/node": "24.12.4",
     "eslint": "10.0.3",
@@ -46,7 +46,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "pi-extensible-workflows": "5.3.0"
+    "pi-extensible-workflows": "5.5.0-rc.1"
   },
   "publishConfig": {
     "access": "public"