@signalridge/pi-subagents 1.10.3 → 1.11.1

package/src/agent-types.ts

@@ -302,11 +302,15 @@ export function getConfig(type: string): {
   excludeExtensions?: string[];
   skills: true | string[] | false;
   promptMode: "replace" | "append";
+  source?: AgentConfig["source"];
+  sourcePath?: string;
 } {
   const key = resolveKey(type);
   const config = key ? agents.get(key) : undefined;
   if (config && config.enabled !== false) {
     return {
+      source: config.source,
+      sourcePath: config.sourcePath,
       displayName: config.displayName ?? config.name,
       color: config.color,
       description: config.description,
@@ -322,6 +326,8 @@ export function getConfig(type: string): {
   const gp = agents.get("general-purpose");
   if (gp && gp.enabled !== false) {
     return {
+      source: gp.source,
+      sourcePath: gp.sourcePath,
       displayName: gp.displayName ?? gp.name,
       color: gp.color,
       description: gp.description,

package/src/ask-tools.ts

@@ -4,7 +4,9 @@
  * `tools:` and `disallowed_tools:` are static: a tool is available for the whole
  * run or never. That forces a bad choice for the tools that are usually fine and
  * occasionally not — grant `bash` and hope, or withhold it and cripple the
- * agent. `ask_tools:` names the tools whose every call needs a person to agree.
+ * agent. `ask_tools:` names tools whose first call needs a person's approval
+ * for the current in-memory child, including resumed turns. A reopened child
+ * gets a new gate and must ask again.
  *
  * The approver is the HUMAN, deliberately. Upstream projects put an LLM in this
  * seat because their subagents run headless in another process and cannot reach
@@ -34,7 +36,7 @@ export interface AskGateContext {
 }
 
 /**
- * Build the per-call approval gate, or `undefined` when nothing needs asking.
+ * Build the session-scoped approval gate, or `undefined` when nothing needs asking.
  *
  * Returns a function that resolves to a block decision when the call must not
  * proceed, and `undefined` when it may.
@@ -45,8 +47,9 @@ export function createAskGate(
   const gated = new Set(context.askTools.map((name) => name.trim().toLowerCase()).filter(Boolean));
   if (gated.size === 0) return undefined;
 
-  /** Tools the user has approved for the rest of this run. */
+  /** Tools approved for this in-memory child; never persisted on disk. */
   const approvedForRun = new Set<string>();
+  const pendingApprovals = new Map<string, Promise<{ approved: boolean; failed: boolean }>>();
 
   return async (toolName, input) => {
     const key = toolName.toLowerCase();
@@ -66,28 +69,35 @@ export function createAskGate(
       };
     }
 
-    let approved: boolean;
-    try {
-      approved = await context.confirm(
-        `${context.agentLabel} wants to use ${toolName}`,
-        `${describeInput(input)}\n\nAllow this call?`,
-      );
-    } catch {
-      // A prompt that cannot be shown is not an approval.
-      return {
-        block: true,
-        reason: `Tool "${toolName}" requires approval (ask_tools) and the prompt could not be shown.`,
-      };
+    // Parallel first calls share one decision for this tool. Otherwise the
+    // second dialog can be declined after the first one granted the same
+    // session-wide permission, making the two answers contradictory.
+    let pending = pendingApprovals.get(key);
+    if (!pending) {
+      const confirm = context.confirm;
+      pending = Promise.resolve()
+        .then(() => confirm(
+          `${context.agentLabel} wants to use ${toolName}`,
+          `Current call: ${describeInput(input)}\n\nAllow ${toolName} for this in-memory agent session, including resumed turns? Later calls in this session will not ask again. Reopening the child from disk or restarting Pi will ask again.`,
+        ))
+        .then((approved) => ({ approved, failed: false }), () => ({ approved: false, failed: true }));
+      pendingApprovals.set(key, pending);
+      const decision = pending;
+      void decision.then(() => {
+        if (pendingApprovals.get(key) === decision) pendingApprovals.delete(key);
+      });
     }
 
+    const { approved, failed } = await pending;
     if (!approved) {
       return {
         block: true,
-        reason: `The user declined the "${toolName}" call. Do not retry it; continue without that tool or explain what you cannot do.`,
+        reason: failed
+          ? `Tool "${toolName}" requires approval (ask_tools) and the prompt could not be shown.`
+          : `The user declined the "${toolName}" call. Do not retry it; continue without that tool or explain what you cannot do.`,
       };
     }
-    // Approved for the remainder of the run rather than for this call alone:
-    // re-asking on every call of a tool the user just allowed trains them to
+    // Re-asking on every call of a tool the user just allowed trains them to
     // approve without reading, which is how an approval prompt stops working.
     approvedForRun.add(key);
     return undefined;
@@ -97,9 +107,9 @@ export function createAskGate(
 /**
  * One-line, bounded, inert rendering of a tool call's arguments.
  *
- * The user is being asked to approve a specific call, so the arguments are the
- * whole point — but they are model-authored and about to be drawn into a
- * terminal, so they are sanitized before truncation, never after.
+ * The first call's arguments show what prompted the session-wide request.
+ * They are model-authored and about to be drawn into a terminal, so they are
+ * sanitized before truncation, never after.
  */
 function describeInput(input: unknown): string {
   if (input === undefined || input === null) return "(no arguments)";

package/src/context-boundary.ts

@@ -0,0 +1,54 @@
+import type { AgentSession } from "@earendil-works/pi-coding-agent";
+
+export const INHERIT_CONTEXT_UNAVAILABLE =
+  "Raw `inherit_context: true` is unavailable on this Pi host: the parent context hooks run after the session projection, " +
+  "and a child request cannot pin the same physical provider endpoint. Start a new Agent with `inherit_context: false` " +
+  "and put an explicitly sanitized summary in its task prompt, or persist a context_edit before starting it.";
+
+export const INHERITED_SESSION_UNSAFE =
+  "This child session contains previously inherited parent history and cannot be resumed safely. " +
+  "Start a new Agent session with `inherit_context: false` and an explicitly sanitized summary in its task prompt.";
+
+export function assertNoRawInheritance(inheritContext: boolean | undefined): void {
+  if (inheritContext === true) throw new Error(INHERIT_CONTEXT_UNAVAILABLE);
+}
+
+const PARENT_CONTEXT_MARKER = "# Parent Conversation Context\n";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function hasInheritedPrompt(value: unknown): boolean {
+  if (!isRecord(value)) return false;
+  if (value.inheritContext === true || value.inherit_context === true) return true;
+  if (value.role === "user") {
+    const content = value.content;
+    if (typeof content === "string") return content.includes(PARENT_CONTEXT_MARKER);
+    if (Array.isArray(content)) return content.some((block) =>
+      isRecord(block) && block.type === "text" &&
+      typeof block.text === "string" && block.text.includes(PARENT_CONTEXT_MARKER));
+  }
+  return false;
+}
+
+/** Guard both the live view and the un-compacted journal before any new prompt. */
+export function assertSafeChildSession(
+  session: Pick<AgentSession, "messages" | "sessionManager">,
+  inheritedMetadata = false,
+): void {
+  if (inheritedMetadata) throw new Error(INHERITED_SESSION_UNSAFE);
+  const manager = session.sessionManager;
+  const entries = manager?.getEntries?.() ?? manager?.getBranch?.() ?? [];
+  if (entries.some((entry: unknown) => isRecord(entry) &&
+    (hasInheritedPrompt(entry) || hasInheritedPrompt(entry.message) ||
+      hasInheritedPrompt(entry.data) ||
+      (isRecord(entry.data) && hasInheritedPrompt(entry.data.invocation)) ||
+      (isRecord(entry.message) && hasInheritedPrompt(entry.message.metadata))))) {
+    throw new Error(INHERITED_SESSION_UNSAFE);
+  }
+  if (session.messages?.some((message: unknown) => hasInheritedPrompt(message) ||
+    (isRecord(message) && hasInheritedPrompt(message.metadata)))) {
+    throw new Error(INHERITED_SESSION_UNSAFE);
+  }
+}

package/src/context.ts

@@ -4,6 +4,23 @@
 
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
+type ProjectedMessage = ReturnType<ExtensionContext["sessionManager"]["buildSessionProjection"]>["messages"][number];
+
+const HEADER = `# Parent Conversation Context
+The following is the conversation history from the parent session that spawned you.
+Use this context to understand what has been discussed and decided so far.
+
+`;
+const FOOTER = `
+
+---
+# Your Task (below)
+`;
+const MAX_CONTEXT_CHARS = 32_000;
+const MAX_MESSAGE_CHARS = 4_000;
+const MAX_TOOL_CHARS = 2_000;
+const CLIPPED = "...[truncated]...";
+
 /** Extract text from a message content block array. */
 export function extractText(content: unknown[]): string {
   return content
@@ -12,47 +29,115 @@ export function extractText(content: unknown[]): string {
     .join("\n");
 }
 
+/** Clip without first joining or copying arbitrarily large tool outputs. */
+function clipText(text: string, limit: number, preserveTail = false): string {
+  if (limit <= 0) return "";
+  if (text.length <= limit) return text;
+  if (limit <= CLIPPED.length) return text.slice(-limit);
+  const available = limit - CLIPPED.length;
+  if (preserveTail) {
+    const head = Math.min(300, Math.floor(available / 3));
+    return `${text.slice(0, head)}${CLIPPED}${text.slice(-(available - head))}`;
+  }
+  return `${text.slice(0, available)}${CLIPPED}`;
+}
+
+function boundedContent(content: string | unknown[], limit: number, preserveTail = false): string {
+  if (typeof content === "string") return clipText(content, limit, preserveTail).trim();
+  // Inspect each block only up to the remaining budget, never join a full tool
+  // result just to discard it. Reverse order retains failure/truncation tails.
+  const selected: string[] = [];
+  let remaining = limit;
+  for (let i = 0; i < content.length && remaining > 0; i++) {
+    const block = content[preserveTail ? content.length - 1 - i : i];
+    if (typeof block !== "object" || block === null || !("type" in block) || block.type !== "text" ||
+        !("text" in block) || typeof block.text !== "string") continue;
+    const text = clipText(block.text, remaining, preserveTail);
+    selected.push(text);
+    remaining -= text.length + 1;
+  }
+  const joined = (preserveTail ? selected.reverse() : selected).join("\n");
+  return clipText(joined, limit, preserveTail).trim();
+}
+
+/** Include shell commands shown to the model, with their outcome even on huge output. */
+function boundedBash(msg: Extract<ProjectedMessage, { role: "bashExecution" }>): string {
+  const command = clipText(msg.command, 200);
+  const outcome = msg.cancelled ? "\n\n(command cancelled)"
+    : msg.exitCode !== null && msg.exitCode !== undefined && msg.exitCode !== 0
+      ? `\n\nCommand exited with code ${msg.exitCode}` : "";
+  const truncation = msg.truncated && msg.fullOutputPath
+    ? `\n\n[Output truncated. Full output: ${clipText(msg.fullOutputPath, 200)}]` : "";
+  const prefix = `Ran \`${command}\`\n`;
+  const suffix = `${outcome}${truncation}`;
+  const remaining = Math.max(0, MAX_TOOL_CHARS - prefix.length - suffix.length - 8);
+  const output = msg.output
+    ? `\`\`\`\n${clipText(msg.output, remaining, msg.cancelled || msg.truncated || msg.exitCode !== 0)}\n\`\`\``
+    : "(no output)";
+  return `${prefix}${output}${suffix}`;
+}
+
 /**
- * Build a text representation of the parent conversation context.
- * Used when inherit_context is true to give the subagent visibility
- * into what has been discussed/done so far.
+ * Build a text representation of the parent conversation context. The child
+ * still needs room for its own prompt, tools and answer, so inherited context
+ * is at most one character per four context tokens (also capped for large
+ * models). This is conservative even for one-character-per-token content.
  */
-export function buildParentContext(ctx: ExtensionContext): string {
-  const entries = ctx.sessionManager.getBranch();
-  if (!entries || entries.length === 0) return "";
-
-  const parts: string[] = [];
-
-  for (const entry of entries) {
-    if (entry.type === "message") {
-      const msg = entry.message;
-      if (msg.role === "user") {
-        const text = typeof msg.content === "string"
-          ? msg.content
-          : extractText(msg.content);
-        if (text.trim()) parts.push(`[User]: ${text.trim()}`);
-      } else if (msg.role === "assistant") {
-        const text = extractText(msg.content);
-        if (text.trim()) parts.push(`[Assistant]: ${text.trim()}`);
+export function buildParentContext(ctx: ExtensionContext, childContextWindow = ctx.model?.contextWindow): string {
+  const window = childContextWindow && Number.isFinite(childContextWindow) && childContextWindow > 0
+    ? childContextWindow : 128_000;
+  const budget = Math.max(0, Math.min(MAX_CONTEXT_CHARS, Math.floor(window / 4)) - HEADER.length - FOOTER.length);
+  if (!budget) return "";
+  const entries: { position: number; order: number; text: string }[] = [];
+  let used = 0;
+  const add = (position: number, order: number, label: string, content: string | unknown[], limit: number, tail = false): void => {
+    const room = Math.min(limit, budget - used - label.length - (entries.length ? 2 : 0));
+    if (room <= 0) return;
+    const text = boundedContent(content, room, tail);
+    if (!text) return;
+    entries.push({ position, order, text: `${label}${text}` });
+    used += label.length + text.length + (entries.length > 1 ? 2 : 0);
+  };
+
+  const sessionManager = ctx.sessionManager;
+  // Older Pi has no provenance-preserving projection, but buildSessionContext
+  // still applies compaction and branch selection. Its messages are precisely
+  // what the host sends to the model; getBranch() includes summarized raw turns.
+  const legacyManager = sessionManager as typeof sessionManager & {
+    buildSessionContext(): { messages: ProjectedMessage[] };
+  };
+  const projected: ProjectedMessage[][] = typeof sessionManager.buildSessionProjection === "function"
+    ? sessionManager.buildSessionProjection().entries.map((entry) => entry.messages)
+    : legacyManager.buildSessionContext().messages.map((message) => [message]);
+  // Reserve up to a quarter for recent summaries before spending the rest on
+  // recent turns. A long tool result must not evict the only compaction summary.
+  const summaryLimit = Math.floor(budget / 4);
+  for (let i = projected.length - 1; i >= 0 && used < summaryLimit; i--) {
+    for (let j = projected[i].length - 1; j >= 0 && used < summaryLimit; j--) {
+      const msg = projected[i][j];
+      if (msg.role === "compactionSummary" || msg.role === "branchSummary") {
+        add(i, j, "[Summary]: ", msg.summary, summaryLimit - used, true);
       }
-      // Skip toolResult messages — too verbose for context
-    } else if (entry.type === "compaction") {
-      // Include compaction summaries — they're already condensed
-      if (entry.summary) {
-        parts.push(`[Summary]: ${entry.summary}`);
+    }
+  }
+  for (let i = projected.length - 1; i >= 0 && used < budget; i--) {
+    for (let j = projected[i].length - 1; j >= 0 && used < budget; j--) {
+      const msg = projected[i][j];
+      if (msg.role === "bashExecution") {
+        if (!msg.excludeFromContext) add(i, j, "[Bash Execution]: ", boundedBash(msg), MAX_TOOL_CHARS);
+      } else if (msg.role === "user" || msg.role === "assistant" || msg.role === "custom" || msg.role === "toolResult") {
+        // Provider transforms omit failed assistant attempts; a pure utility
+        // should not render them as successful model-visible context.
+        if (msg.role === "assistant" && (msg.stopReason === "error" || msg.stopReason === "aborted")) continue;
+        const label = msg.role === "toolResult" ? `[Tool Result (${msg.toolName})]: `
+          : msg.role === "custom" ? "[Context]: " : msg.role === "user" ? "[User]: " : "[Assistant]: ";
+        add(i, j, label, msg.content, msg.role === "toolResult" ? MAX_TOOL_CHARS : MAX_MESSAGE_CHARS, msg.role === "toolResult");
       }
+      // System messages are supplied by the child's own prompt policy.
     }
   }
 
-  if (parts.length === 0) return "";
-
-  return `# Parent Conversation Context
-The following is the conversation history from the parent session that spawned you.
-Use this context to understand what has been discussed and decided so far.
-
-${parts.join("\n\n")}
-
----
-# Your Task (below)
-`;
+  if (entries.length === 0) return "";
+  entries.sort((a, b) => a.position - b.position || a.order - b.order);
+  return `${HEADER}${entries.map((entry) => entry.text).join("\n\n")}${FOOTER}`;
 }

package/src/custom-agents.ts

@@ -8,6 +8,7 @@ import { getAgentDir, parseFrontmatter } from "@earendil-works/pi-coding-agent";
 import { isValidAgentTierKey } from "./agent-tiers.js";
 import { BUILTIN_TOOL_NAMES } from "./agent-types.js";
 import { DEFAULT_AGENTS } from "./default-agents.js";
+import { isProjectResource } from "./project-trust.js";
 import type { AgentConfig, MemoryScope } from "./types.js";
 import { sanitizeDisplayText } from "./ui/safe-text.js";
 
@@ -129,7 +130,8 @@ function createWarningSink(root: string): WarningSink {
   };
 }
 
-export function loadCustomAgents(cwd: string, strict = false): Map<string, AgentConfig> {
+/** Standalone callers retain discovery defaults; runtime callers must pass captured trust. */
+export function loadCustomAgents(cwd: string, strict = false, projectTrusted = true, deniedRoots: readonly string[] = []): Map<string, AgentConfig> {
   const discoveryRoot = normalizeDiscoveryRoot(cwd);
   const warningRoot = warningIdentity(cwd);
   const globalDir = join(getAgentDir(), "agents");
@@ -140,9 +142,12 @@ export function loadCustomAgents(cwd: string, strict = false): Map<string, Agent
   const agents = new Map<string, AgentConfig>();
   const priorities = new Map<string, number>();
   const skipped: SkippedAgent[] = [];
-  loadFromDir(globalDir, agents, "global", strict, warn, 0, priorities, skipped);            // lowest priority
-  loadFromDir(workspaceProjectDir, agents, "project", strict, warn, 1, priorities, skipped); // shared workspace
-  loadFromDir(projectDir, agents, "project", strict, warn, 2, priorities, skipped);          // highest priority (overwrites)
+  const denied = projectTrusted ? deniedRoots : [...deniedRoots, discoveryRoot];
+  loadFromDir(globalDir, agents, "global", strict, warn, 0, priorities, skipped, denied);
+  if (projectTrusted) {
+    loadFromDir(workspaceProjectDir, agents, "project", strict, warn, 1, priorities, skipped, denied);
+    loadFromDir(projectDir, agents, "project", strict, warn, 2, priorities, skipped, denied);
+  }
 
   // Only report a fallback when the skipped file was higher priority than the
   // definition that survived the complete discovery pass. A valid higher
@@ -164,7 +169,9 @@ function loadFromDir(
   priority: number,
   priorities: Map<string, number>,
   skipped: SkippedAgent[],
+  deniedRoots: readonly string[],
 ): void {
+  if (deniedRoots.some(root => isProjectResource(dir, root))) return;
   if (!existsSync(dir)) return;
 
   let files: string[];
@@ -184,6 +191,7 @@ function loadFromDir(
     const filenameType = basename(file, ".md");
 
     const path = join(dir, file);
+    if (deniedRoots.some(root => isProjectResource(path, root))) continue;
 
     const parsed = readAgentFile(path, strict, warn);
     if (!parsed) {
@@ -225,6 +233,13 @@ function loadFromDir(
 
     const { builtinToolNames, extSelectors } = parseToolsField(fm.tools);
     warnLegacyModelFields(fm, path, warn);
+    if (fm.inherit_context === true) {
+      warn(
+        `Agent file ${path} sets inherit_context: true, which is unavailable on current Pi hosts; ` +
+          "spawns will be refused. Remove it and pass an explicitly sanitized summary in the Agent task.",
+        `inherit-context:${warningIdentity(path)}`,
+      );
+    }
 
     agents.set(name, {
       name,

package/src/enabled-models.ts

@@ -3,33 +3,29 @@
  * + project-local `<cwd>/.pi/settings.json`, project wins) and resolves
  * entries to concrete `provider/modelId` keys for scope validation.
  *
- * **Project overrides global**, mirroring pi's own `SettingsManager`
+ * **Admitted project settings override global**, mirroring pi's own `SettingsManager`
  * deep-merge behavior and matching the precedence we use for our own
  * `subagents.json` settings (see `src/settings.ts:loadSettings`). If
  * project file has `enabledModels` set, it wholly replaces global's
  * (array fields are replaced, not concatenated).
  *
- * **Limited subset of upstream's resolveModelScope.** We support exact
- * `provider/modelId` matching only. Upstream (pi-coding-agent's
- * `core/model-resolver.ts`) additionally supports glob patterns
- * (`*sonnet*`, `anthropic/*`), bare model IDs without provider, and
- * thinking-level suffixes (`provider/*:high`). Those forms are silently
- * ignored here.
- *
- * In practice, pi's `/scoped-models` picker writes exact `provider/modelId`
- * entries, so the limitation is invisible for users who configure scope
- * through pi's UI. Hand-edited settings using globs or bare IDs will
- * produce an empty allowed set (scope check becomes a no-op).
+ * Resolve exact `provider/modelId` entries, unambiguous bare IDs, and Pi's
+ * glob patterns (`*sonnet*`, `anthropic/*`) with optional thinking suffixes.
+ * The suffix selects a thinking level in Pi; this guard checks only model
+ * membership. A configured pattern with no available match must not disable
+ * the opt-in scope check.
  *
  * Example:
  *   enabledModels = ["anthropic/claude-sonnet-4-6", "anthropic/claude-opus-4-6"]
  *   → resolves to { "anthropic/claude-sonnet-4-6", "anthropic/claude-opus-4-6" }
  */
 
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import { minimatch } from "minimatch";
 import type { ModelEntry } from "./model-resolver.js";
+import { isProjectResource, type ProjectTrust } from "./project-trust.js";
 
 /** Minimal registry shape — only the methods resolveEnabledModels actually calls. */
 export interface ModelRegistryRef {
@@ -50,7 +46,12 @@ function readField(path: string): string[] | undefined {
   if (!existsSync(path)) return undefined;
   try {
     const raw = JSON.parse(readFileSync(path, "utf-8"));
-    if (Array.isArray(raw?.enabledModels)) return raw.enabledModels as string[];
+    if (Array.isArray(raw?.enabledModels)) {
+      // Keep the configured list present even if every item is malformed: an
+      // invalid project allowlist must not fall back to a broader global list
+      // or silently disable the opt-in scope check.
+      return raw.enabledModels.map((pattern: unknown) => typeof pattern === "string" ? pattern : "");
+    }
   } catch {
     /* corrupt file — silent */
   }
@@ -61,64 +62,41 @@ function readField(path: string): string[] | undefined {
  * Read enabledModels from pi's settings — project-local overrides global.
  * Mirrors pi's SettingsManager deep-merge for the `enabledModels` field
  * (and matches our own loadSettings precedence in src/settings.ts).
- * Returns undefined when neither file has the field.
+ * Runtime callers pass captured configuration authority to exclude denied
+ * project sources and global aliases; standalone callers keep project defaults.
+ * Returns undefined when neither admitted file has the field.
  */
-export function readEnabledModels(cwd: string): string[] | undefined {
-  const [project, global] = settingsPaths(cwd);
-  return readField(project) ?? readField(global);
+export function readEnabledModels(cwd: string, authority?: ProjectTrust): string[] | undefined {
+  const [project, global] = settingsPaths(authority?.cwd ?? cwd);
+  // Standalone readers retain project precedence. Runtime readers must pass
+  // captured configuration authority, never infer it from execution cwd.
+  const denied = (path: string): boolean => authority?.deniedRoots.some(root => isProjectResource(path, root)) ?? false;
+  return (authority?.trusted !== false && !denied(project) ? readField(project) : undefined)
+    ?? (!denied(global) ? readField(global) : undefined);
 }
 
 /**
  * Resolve enabledModels patterns → Set<"provider/modelId"> (lowercase keys).
  *
- * Only exact `provider/modelId` patterns are matched (case-insensitive).
- * Patterns without a slash, with glob characters, or with a `:thinking`
- * suffix are silently dropped. See module-level docstring for rationale.
+ * Matches exact references, unambiguous bare IDs, and case-insensitive glob
+ * patterns against the full `provider/modelId` or bare ID. A recognized
+ * `:thinking` suffix is ignored for this model-only policy.
  *
- * Cache: keyed on JSON.stringify(patterns) + mtime/size of *both*
- * project and global settings.json files. Re-resolves when either file
- * changes or the patterns argument differs.
+ * Resolves against the current registry on every call. Availability can
+ * change without a settings-file edit (or even a new registry instance).
+ * The optional cwd is retained for callers that pass it alongside patterns
+ * read from that project's settings.
  *
- * Returns undefined when no patterns are provided or no patterns match
- * (scope check becomes a no-op at the call site).
+ * Returns undefined only when there is no configured allowlist. A configured
+ * list with no available exact matches returns an empty set so caller-supplied
+ * models cannot bypass the scope check.
  */
-
-// Module-level cache — invalidated when either settings.json changes or patterns differ.
-let cachedAllowed: Set<string> | undefined;
-let cachedHash = "";
-let cachedPatternsKey = "";
-
-/** mtime+size hash of one file, or "missing" if absent. */
-function hashOf(path: string): string {
-  try {
-    const s = statSync(path);
-    return `${s.mtimeMs}-${s.size}`;
-  } catch {
-    return "missing";
-  }
-}
-
 export function resolveEnabledModels(
   patterns: string[] | undefined,
   registry: ModelRegistryRef,
-  cwd: string = process.cwd(),
+  _cwd: string = process.cwd(),
 ): Set<string> | undefined {
-  // Fast path: check cache (stat both project and global settings.json files)
-  const patternsKey = JSON.stringify(patterns);
-  const [project, global] = settingsPaths(cwd);
-  const fileHash = `${hashOf(project)};${hashOf(global)}`;
-
-  if (fileHash === cachedHash && patternsKey === cachedPatternsKey) {
-    return cachedAllowed;
-  }
-
-  // Cache miss — resolve
-  if (!patterns || patterns.length === 0) {
-    cachedHash = fileHash;
-    cachedPatternsKey = patternsKey;
-    cachedAllowed = undefined;
-    return undefined;
-  }
+  if (!patterns || patterns.length === 0) return undefined;
 
   const available = (registry.getAvailable?.() ?? registry.getAll()) as ModelEntry[];
   const allowed = new Set<string>();
@@ -126,14 +104,10 @@ export function resolveEnabledModels(
   for (const pattern of patterns) {
     const trimmed = pattern.trim();
     if (!trimmed) continue;  // skip empty/whitespace
-    resolveExact(trimmed, available, allowed);
+    resolvePattern(trimmed, available, allowed);
   }
 
-  const result = allowed.size > 0 ? allowed : undefined;
-  cachedHash = fileHash;
-  cachedPatternsKey = patternsKey;
-  cachedAllowed = result;
-  return result;
+  return allowed;
 }
 
 
@@ -155,26 +129,53 @@ function modelKey(model: { provider: string; id: string }): string {
   return `${model.provider}/${model.id}`.toLowerCase();
 }
 
-/**
- * Resolve exact model pattern. Example: "google/gemma-4-31b-it".
- */
-function resolveExact(
-  pattern: string,
-  available: ModelEntry[],
-  allowed: Set<string>,
-): void {
-  // "provider/modelId" — exact (colon is part of id, not split)
-  const slashIdx = pattern.indexOf("/");
-  if (slashIdx === -1) return; // bare modelId not supported
-
-  const provider = pattern.slice(0, slashIdx).toLowerCase();
-  const modelId = pattern.slice(slashIdx + 1).toLowerCase();
-  const exact = available.find(
-    m => m.provider.toLowerCase() === provider && m.id.toLowerCase() === modelId,
-  );
+const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+
+function resolvePattern(pattern: string, available: ModelEntry[], allowed: Set<string>): void {
+  const colon = pattern.lastIndexOf(":");
+  if (/[*?[]/.test(pattern)) {
+    // Pi strips a recognized thinking level from globs before matching. Trying
+    // the full glob first would select only colon-suffixed model IDs and miss
+    // their base models (e.g. custom/*:high).
+    const reference = colon >= 0 && THINKING_LEVELS.has(pattern.slice(colon + 1))
+      ? pattern.slice(0, colon) : pattern;
+    for (const model of available) {
+      if (minimatch(modelKey(model), reference, { nocase: true }) || minimatch(model.id, reference, { nocase: true })) {
+        allowed.add(modelKey(model));
+      }
+    }
+    return;
+  }
+
+  // Pi tries the complete reference before treating a colon as a thinking
+  // suffix: a model ID itself may contain ":high" or ":high-speed".
+  if (matchReference(pattern, available, allowed)) return;
+  // Invalid thinking suffixes on non-globs fall back to the prefix in scope
+  // mode, just as Pi does (though it reports a warning to its own UI).
+  if (colon >= 0) matchReference(pattern.slice(0, colon), available, allowed);
+}
+
+function matchReference(reference: string, available: ModelEntry[], allowed: Set<string>): boolean {
+  const exact = available.find((model) => modelKey(model) === reference.toLowerCase());
   if (exact) {
     allowed.add(modelKey(exact));
+    return true;
+  }
+  const bare = available.filter((model) => model.id.toLowerCase() === reference.toLowerCase());
+  if (bare.length === 1) {
+    allowed.add(modelKey(bare[0]));
+    return true;
   }
-}
 
+  // Pi's non-glob partial picker searches model IDs and names, not canonical
+  // provider/model keys. A provider-qualified partial is not an exact reference.
+  const query = reference.toLowerCase();
+  const matches = available.filter((model) =>
+    model.id.toLowerCase().includes(query) || model.name?.toLowerCase().includes(query)
+  );
+  const aliases = matches.filter((model) => model.id.endsWith("-latest") || !/-\d{8}$/.test(model.id));
+  const selected = (aliases.length > 0 ? aliases : matches).sort((a, b) => b.id.localeCompare(a.id))[0];
+  if (selected) allowed.add(modelKey(selected));
+  return selected !== undefined;
+}