@ymy88/pi-subagents 0.0.0-stage → 0.24.0

package/dist/custom-agents.js

@@ -0,0 +1,396 @@
+/**
+ * custom-agents.ts — Load user-defined agents from project (.pi/agents/, plus the shared .agents/agents/ workspace) and global ($PI_CODING_AGENT_DIR/agents/, default ~/.pi/agent/agents/) locations, plus any installed pi package that declares them (see package-resources.ts).
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, join } from "node:path";
+import { getAgentDir, parseFrontmatter } from "@earendil-works/pi-coding-agent";
+import { BUILTIN_TOOL_NAMES } from "./agent-types.js";
+import { isPackageResourceExcluded, MAX_PACKAGE_RESOURCE_BYTES, packageAgentDirs, packageAgentFiles, } from "./package-resources.js";
+/**
+ * The one thing a declared `name:` may not contain, matching Claude Code
+ * exactly: it reserves `:` for plugin-scoped identifiers (`my-plugin:reviewer`)
+ * and refuses to load a file whose name uses one.
+ *
+ * Nothing else is rejected. Claude Code's docs describe names as "lowercase
+ * letters and hyphens", but that is guidance — the only stated load failure is
+ * the colon, so `name: Code Reviewer` must work here too. (The stricter
+ * letters/digits/underscore/hyphen regex in Claude Code applies to the Agent
+ * tool's spawn-time `name` parameter, which is a different field.) Mixed case
+ * has to be allowed regardless: the built-in types `Explore` and `Plan` use it,
+ * and a file must be able to override one.
+ */
+const RESERVED_IN_TYPE = ":";
+/**
+ * Scan for custom agent .md files from multiple locations.
+ * Discovery hierarchy (higher priority wins):
+ *   1. Project:   <cwd>/.pi/agents/*.md (authoritative — also where /agents writes)
+ *   2. Workspace: <cwd>/.agents/agents/*.md (shared cross-tool .agents workspace, read-only)
+ *   3. Global:    $PI_CODING_AGENT_DIR/agents/*.md (default: ~/.pi/agent/agents/*.md)
+ *   4. Package:   paths declared by an installed pi package (read-only)
+ *
+ * Project-level agents override global ones with the same name. On a name clash
+ * between the two project locations, .pi/agents wins — .pi stays the project
+ * authority; .agents/agents is an additional read location.
+ * Any name is allowed — names matching defaults (e.g. "Explore") override them.
+ *
+ * Package agents load *first*, so everything the user or project wrote outranks
+ * them. That is what makes them safe to adopt: a package can offer a `reviewer`,
+ * and a `.pi/agents/reviewer.md` silently takes it back. It mirrors pi's own
+ * resource precedence, where package-provided skills rank below every user and
+ * project one, and Claude Code's, where a plugin agent is the lowest tier.
+ *
+ * An agent's type comes from its frontmatter `name:`, falling back to the
+ * filename — Claude Code's rule, where "the filename doesn't have to match".
+ * Because the type is now declared rather than derived from a unique path, two
+ * files can claim the same one; the later load wins, as it always has for a
+ * filename clash, and `warnSkippedOverride` reports the substitution.
+ */
+export function loadCustomAgents(cwd, strict = false, opts = {}) {
+    const globalDir = join(getAgentDir(), "agents");
+    const workspaceProjectDir = join(cwd, ".agents", "agents");
+    const projectDir = join(cwd, ".pi", "agents");
+    const pkgDirs = opts.packageDirs ?? packageAgentDirs(cwd);
+    const pkgFiles = opts.packageFiles ?? packageAgentFiles(cwd);
+    // `!./agents/wip.md` alongside `./agents` excludes one file out of a directory
+    // that is only enumerated here, so the check has to run per file.
+    const excluded = opts.packageExcluded ?? (path => isPackageResourceExcluded(path, cwd, "agents"));
+    const agents = new Map();
+    for (const dir of pkgDirs)
+        loadFromDir(dir, agents, "package", strict, excluded); // lowest priority
+    for (const file of pkgFiles)
+        loadOneFile(file, agents, "package", strict);
+    loadFromDir(globalDir, agents, "global", strict);
+    loadFromDir(workspaceProjectDir, agents, "project", strict); // shared workspace
+    loadFromDir(projectDir, agents, "project", strict); // highest priority (overwrites)
+    warnedLastLoad = warnedThisLoad;
+    warnedThisLoad = new Set();
+    return agents;
+}
+/** Load agent configs from a directory into the map, skipping any `excluded` path. */
+function loadFromDir(dir, agents, source, strict, excluded) {
+    if (!existsSync(dir))
+        return;
+    let files;
+    try {
+        files = readdirSync(dir).filter(f => f.endsWith(".md"));
+    }
+    catch {
+        return;
+    }
+    for (const file of files) {
+        const path = join(dir, file);
+        if (excluded?.(path))
+            continue;
+        loadOneFile(path, agents, source, strict);
+    }
+}
+/**
+ * Load one agent file into the map.
+ *
+ * Split out of `loadFromDir` because a package manifest may name an individual
+ * `.md` rather than a directory, and because the size guard below has to apply
+ * to both paths.
+ */
+function loadOneFile(path, agents, source, strict) {
+    const filenameType = basename(path, ".md");
+    // Package files are third-party content read on every `Agent` call, so a
+    // pathological one is skipped rather than pulled into the session. Claude
+    // Code applies the same 1 MB ceiling to plugin-provided agents. Local files
+    // are the user's own and stay unbounded, as they always have been.
+    if (source === "package" && !withinSizeLimit(path)) {
+        warnIfNew(`Skipping package agent ${path}: not a regular file, or larger than ${MAX_PACKAGE_RESOURCE_BYTES} bytes.`);
+        return;
+    }
+    // `strict` is deliberately not passed for a package file. Failing activation
+    // over a broken agent file is right for a checked-in `.pi/agents/` — the point
+    // is that a repo's own file cannot silently fall through to a same-named one
+    // elsewhere. A file inside a third-party package is not the user's to fix, and
+    // one bad `.md` in any installed package would otherwise stop pi from
+    // starting at all. Warn and skip, as for a non-strict local file.
+    const parsed = readAgentFile(path, strict && source !== "package");
+    if (!parsed) {
+        warnSkippedOverride(filenameType, agents);
+        return;
+    }
+    const { frontmatter: fm, body } = parsed;
+    // Claude Code's rule: `name:` IS the agent type, and the filename need not
+    // match. Absent, the filename stands in — Claude Code requires the field,
+    // but most files here predate it and must keep loading.
+    const declared = str(fm.name)?.trim();
+    if (declared?.includes(RESERVED_IN_TYPE)) {
+        // Refusing beats silently substituting: the file would otherwise load
+        // under its filename, so `Agent({subagent_type})` would succeed against
+        // an agent whose declared identity nothing honoured.
+        warnIfNew(`Agent file ${path} declares name "${declared}", which contains "${RESERVED_IN_TYPE}" — reserved for `
+            + "plugin-scoped identifiers. Rename it, or move the label to `display_name:`. Skipping.");
+        // No `warnSkippedOverride`: this file would have registered under its
+        // *declared* name, which nothing else can hold (a colon keeps it out of
+        // the registry), so it shadowed nothing. Passing the filename instead
+        // would report a substitution of an unrelated agent that never happened.
+        return;
+    }
+    // `||`, not `??`: a quoted empty or all-whitespace `name:` would otherwise
+    // register the agent under the empty type — unspawnable, and it takes the
+    // filename-derived one down with it.
+    const name = declared || filenameType;
+    const { builtinToolNames, extSelectors, mcpToolPatterns } = parseToolsField(fm.tools);
+    agents.set(name, {
+        name,
+        // Only `display_name` now: `name` is the type, and `getConfig` already
+        // falls back to the type when no label is set — so a Claude Code file
+        // with `name: code-reviewer` still badges as "code-reviewer".
+        displayName: str(fm.display_name),
+        color: str(fm.color),
+        description: str(fm.description) ?? name,
+        builtinToolNames,
+        extSelectors,
+        mcpToolPatterns,
+        // `disallowedTools` is Claude Code's spelling of the key. Each entry denies the tool
+        // with exactly that name, as in Claude Code, and the pi built-in it maps to, so an
+        // extension tool named `glob` stays denied rather than becoming `find`.
+        disallowedTools: csvListOptional(fm.disallowed_tools ?? fm.disallowedTools)?.flatMap(n => [
+            ...new Set([n, normalizeToolName(n)]),
+        ]),
+        extensions: inheritField(fm.extensions ?? fm.inherit_extensions),
+        excludeExtensions: csvListOptional(fm.exclude_extensions),
+        skills: inheritField(fm.skills ?? fm.inherit_skills),
+        model: str(fm.model),
+        thinking: str(fm.thinking),
+        maxTurns: nonNegativeInt(fm.max_turns),
+        persistSession: fm.persist_session != null ? fm.persist_session === true : undefined,
+        outputTranscript: fm.output_transcript != null ? fm.output_transcript !== false : undefined,
+        sessionDir: str(fm.session_dir),
+        allowedSubagents: parseAllowedSubagents(fm.allowed_subagents),
+        systemPrompt: body.trim(),
+        promptMode: fm.prompt_mode === "append" ? "append" : "replace",
+        inheritContext: fm.inherit_context != null ? fm.inherit_context === true : undefined,
+        runInBackground: fm.run_in_background != null ? fm.run_in_background === true : undefined,
+        isolated: fm.isolated != null ? fm.isolated === true : undefined,
+        memory: parseMemory(fm.memory),
+        isolation: parseIsolation(fm.isolation),
+        enabled: fm.enabled !== false, // default true; explicitly false disables
+        source,
+        sourcePath: path,
+    });
+}
+/**
+ * True when `path` is a regular file within the package-resource size ceiling.
+ *
+ * Only applied to package-provided files: they arrive from a third party and are
+ * re-read on every `Agent` call, so a 500 MB `.md` — or a fifo that never ends —
+ * must not be reachable from a spawn. A stat failure counts as "not within",
+ * because the alternative is reading something we could not describe.
+ */
+function withinSizeLimit(path) {
+    try {
+        const stat = statSync(path);
+        return stat.isFile() && stat.size <= MAX_PACKAGE_RESOURCE_BYTES;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read and parse one agent file, or warn and return undefined for the caller to
+ * skip. One bad file must not take the whole extension down with it — an
+ * unparseable `.md` used to abort activation, so pi exited before the TUI.
+ *
+ * The path is as much of the fix as the recovery: a bare YAML error ("line 2,
+ * column 14") is unactionable when agents come from three directories at once,
+ * and the only other symptom is `Unknown agent type`, which reads like a typo.
+ *
+ * Under `strict` the same failure rethrows, still naming the path, so callers
+ * that opted into failing closed stop rather than run a substituted agent.
+ */
+/**
+ * Parse an agent file's frontmatter, tolerating a leading UTF-8 BOM.
+ *
+ * Editors across the Windows/CJK world write UTF-8 with a BOM by default, and
+ * pi's parser did not look past one before 0.84.3: the fence never matched, so
+ * the frontmatter came back empty and the *whole file* — YAML and all — became
+ * the body. An agent authored that way silently lost every field. `tools: none`
+ * going missing is the sharp edge: the agent registers with the default
+ * toolset rather than none, which is a wider grant than its author wrote.
+ *
+ * Stripped here rather than detected per pi version, because this is the only
+ * place agent files are read and the BOM is a file-encoding artifact, not
+ * content — normalising it at the boundary keeps one behaviour across the whole
+ * supported peer range instead of forking on what happens to be installed.
+ */
+export function parseAgentFrontmatter(content) {
+    return parseFrontmatter(content.startsWith("\uFEFF") ? content.slice(1) : content);
+}
+function readAgentFile(path, strict) {
+    try {
+        return parseAgentFrontmatter(readFileSync(path, "utf-8"));
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        if (strict)
+            throw new Error(`${path}: ${reason}`);
+        warnIfNew(`Skipping agent file ${path}: ${reason}`);
+        return undefined;
+    }
+}
+/**
+ * A skipped file that was overriding an already-loaded agent leaves the name
+ * pointing at a *different* file — its own prompt, model and tools. Nothing
+ * downstream can flag that: unlike an unknown type, the `Agent` call succeeds.
+ */
+function warnSkippedOverride(name, agents) {
+    const surviving = agents.get(name);
+    // Nothing shadowed, or what it shadowed is disabled: dispatch refuses the type
+    // either way (see resolveEnabledTypeIn), so there is no substitution to report.
+    if (!surviving?.sourcePath || surviving.enabled === false)
+        return;
+    warnIfNew(`Agent "${name}" now loads from ${surviving.sourcePath} instead`);
+}
+let warnedLastLoad = new Set();
+let warnedThisLoad = new Set();
+/**
+ * Agents reload on activation and again on every `Agent` call, so an unchanged
+ * problem would re-warn all session — over a painted TUI, since pi does not
+ * redirect console output. Compare against the previous load rather than every
+ * load ever, so a file that is fixed and then broken again still reports.
+ */
+function warnIfNew(message) {
+    warnedThisLoad.add(message);
+    if (warnedLastLoad.has(message))
+        return;
+    console.warn(`[pi-subagents] ${message}`);
+}
+// ---- Field parsers ----
+// All follow the same convention: omitted → default, "none"/empty → nothing, value → exact.
+/** Extract a string or undefined. */
+function str(val) {
+    return typeof val === "string" ? val : undefined;
+}
+/** Extract a non-negative integer or undefined. 0 means unlimited for max_turns. */
+function nonNegativeInt(val) {
+    return typeof val === "number" && val >= 0 ? val : undefined;
+}
+/**
+ * Parse a raw CSV field value into items, or undefined if absent/empty/"none".
+ */
+function parseCsvField(val) {
+    if (val === undefined || val === null)
+        return undefined;
+    const s = String(val).trim();
+    if (!s || s === "none")
+        return undefined;
+    const items = s.split(",").map(t => t.trim()).filter(Boolean);
+    return items.length > 0 ? items : undefined;
+}
+/**
+ * Parse the nested-delegation allowlist. Single field, default-off:
+ * omitted/empty/"none"/`false` → undefined (no nested tools); "all"/"*"/`true`
+ * → "all" (any enabled agent); csv → only the listed types.
+ *
+ * Booleans are accepted because `extensions:`/`skills:` take them and users
+ * generalize: without this, YAML's `true` stringifies into an agent type
+ * literally named "true", so the tools appear and every spawn is refused.
+ */
+function parseAllowedSubagents(val) {
+    if (typeof val === "boolean")
+        return val ? "all" : undefined;
+    const items = parseCsvField(val);
+    if (!items)
+        return undefined;
+    return items.some(i => i === "*" || i.toLowerCase() === "all") ? "all" : items;
+}
+/**
+ * Parse a comma-separated list field with defaults.
+ * omitted → defaults; "none"/empty → []; csv → listed items.
+ */
+function csvList(val, defaults) {
+    if (val === undefined || val === null)
+        return defaults;
+    return parseCsvField(val) ?? [];
+}
+/** Claude Code tool names whose pi built-in is named differently. Keys are lowercase. */
+const CLAUDE_CODE_TOOL_ALIASES = { glob: "find", multiedit: "edit" };
+/**
+ * A tool name as pi spells it. Built-ins match case-insensitively, so Claude Code's
+ * `Read` and `LS` work, and a Claude Code name with a differently named pi built-in
+ * maps to it. Anything else comes back unchanged, so runAgent still warns about it.
+ */
+function normalizeToolName(name) {
+    const lower = name.toLowerCase();
+    return BUILTIN_TOOL_NAMES.find(b => b === lower) ?? CLAUDE_CODE_TOOL_ALIASES[lower] ?? name;
+}
+/**
+ * Partition the `tools:` CSV into the built-in tool allowlist, raw `ext:` selectors
+ * and bare `mcp__` entries. `*` (and the case-insensitive alias `all`, for
+ * `tools: all`) expands to all built-ins; plain entries are built-in names, in pi's
+ * or Claude Code's spelling; `ext:` entries are extension-tool selectors parsed
+ * later by the runner; `mcp__<server>__<tool>` entries (exact or `*` patterns)
+ * narrow MCP tools, as pi's `--tools` does. omitted → all built-ins, no selectors.
+ * `tools:` present with only `ext:` or `mcp__` entries → zero built-ins (use `*`).
+ */
+function parseToolsField(val) {
+    const entries = csvList(val, BUILTIN_TOOL_NAMES);
+    const isWildcard = (e) => e === "*" || e.toLowerCase() === "all";
+    const isMcp = (e) => e.startsWith("mcp__");
+    const hasWildcard = entries.some(isWildcard);
+    const plain = [
+        ...new Set(entries.filter(e => !isWildcard(e) && !e.startsWith("ext:") && !isMcp(e)).map(normalizeToolName)),
+    ];
+    const extEntries = entries.filter(e => e.startsWith("ext:"));
+    // A server-level `mcp__<server>` means every tool of that server, as in Claude Code.
+    const mcpEntries = entries.filter(isMcp).map(e => {
+        const server = e.slice("mcp__".length);
+        return server && !server.includes("__") ? `${e}__*` : e;
+    });
+    return {
+        builtinToolNames: hasWildcard ? [...new Set([...BUILTIN_TOOL_NAMES, ...plain])] : plain,
+        extSelectors: extEntries.length > 0 ? extEntries : undefined,
+        mcpToolPatterns: mcpEntries.length > 0 ? mcpEntries : undefined,
+    };
+}
+/**
+ * Parse an optional comma-separated list field.
+ * omitted → undefined; "none"/empty → undefined; csv → listed items.
+ */
+function csvListOptional(val) {
+    return parseCsvField(val);
+}
+/**
+ * Parse a memory scope field.
+ * omitted → undefined; "user"/"project"/"local" → MemoryScope.
+ */
+function parseMemory(val) {
+    if (val === "user" || val === "project" || val === "local")
+        return val;
+    return undefined;
+}
+/**
+ * Parse the `isolation` frontmatter field.
+ *
+ * `off` is kept as a value rather than folded into `undefined` because the two
+ * do not mean the same thing here: agent config outranks tool-call params, so
+ * `off` vetoes a caller's `worktree` while an absent field lets it through.
+ *
+ * pi's frontmatter parser is not YAML 1.1 — bare `off` and `no` arrive as
+ * strings and only `false` becomes a boolean — so all three spellings are
+ * accepted rather than leaving an author's intent silently dropped. Anything
+ * else stays `undefined`, as before.
+ */
+function parseIsolation(val) {
+    if (val === "worktree")
+        return "worktree";
+    if (val === "off" || val === "none" || val === "no" || val === false)
+        return "off";
+    return undefined;
+}
+/**
+ * Parse an inherit field (extensions, skills).
+ * omitted/true → true (inherit all); false/"none"/empty → false; csv → listed names.
+ */
+function inheritField(val) {
+    if (val === undefined || val === null || val === true)
+        return true;
+    if (val === false || val === "none")
+        return false;
+    const items = csvList(val, []);
+    return items.length > 0 ? items : false;
+}

package/dist/default-agents.d.ts

@@ -0,0 +1,7 @@
+/**
+ * default-agents.ts — Embedded default agent configurations.
+ *
+ * These are always available but can be overridden by user .md files with the same name.
+ */
+import type { AgentConfig } from "./types.js";
+export declare const DEFAULT_AGENTS: Map<string, AgentConfig>;

package/dist/default-agents.js

@@ -0,0 +1,121 @@
+/**
+ * default-agents.ts — Embedded default agent configurations.
+ *
+ * These are always available but can be overridden by user .md files with the same name.
+ */
+const READ_ONLY_TOOLS = ["read", "bash", "grep", "find", "ls"];
+export const DEFAULT_AGENTS = new Map([
+    [
+        "general-purpose",
+        {
+            name: "general-purpose",
+            displayName: "Agent",
+            description: "General-purpose agent for researching complex questions, searching for code, and executing multi-step tasks. When you are searching for a keyword or file and are not confident that you will find the right match in the first few tries use this agent to perform the search for you.",
+            // builtinToolNames omitted — means "all available tools" (resolved at lookup time)
+            // inheritContext / runInBackground / isolated omitted — strategy fields, callers decide per-call.
+            // Setting them to false would lock callsite intent (see resolveAgentInvocationConfig in invocation-config.ts).
+            extensions: true,
+            skills: true,
+            systemPrompt: "",
+            promptMode: "append",
+            isDefault: true,
+        },
+    ],
+    [
+        "Explore",
+        {
+            name: "Explore",
+            displayName: "Explore",
+            description: "Fast read-only search agent for locating code. Use it to find files by pattern (eg. \"src/components/**/*.tsx\"), grep for symbols or keywords (eg. \"API endpoints\"), or answer \"where is X defined / which files reference Y.\" Do NOT use it for code review, design-doc auditing, cross-file consistency checks, or open-ended analysis — it reads excerpts rather than whole files and will miss content past its read window. When calling, specify search breadth: \"quick\" for a single targeted lookup, \"medium\" for moderate exploration, or \"very thorough\" to search across multiple locations and naming conventions.",
+            builtinToolNames: READ_ONLY_TOOLS,
+            extensions: true,
+            skills: true,
+            // No model: Explore inherits the session's, as in Claude Code. A pin here
+            // outranked the caller and resolved through any provider with a key
+            // (#175, #350); a same-named agent file can still pin one.
+            systemPrompt: `# CRITICAL: READ-ONLY MODE - NO FILE MODIFICATIONS
+You are a file search specialist. You excel at thoroughly navigating and exploring codebases.
+Your role is EXCLUSIVELY to search and analyze existing code. You do NOT have access to file editing tools.
+
+You are STRICTLY PROHIBITED from:
+- Creating new files
+- Modifying existing files
+- Deleting files
+- Moving or copying files
+- Creating temporary files anywhere, including /tmp
+- Using redirect operators (>, >>, |) or heredocs to write to files
+- Running ANY commands that change system state
+
+Use Bash ONLY for read-only operations: ls, git status, git log, git diff, find, cat, head, tail.
+
+# Tool Usage
+- Use the find tool for file pattern matching (NOT the bash find command)
+- Use the grep tool for content search (NOT bash grep/rg command)
+- Use the read tool for reading files (NOT bash cat/head/tail)
+- Use Bash ONLY for read-only operations
+- Make independent tool calls in parallel for efficiency
+- Adapt search approach based on thoroughness level specified
+
+# Output
+- Use absolute file paths in all references
+- Report findings as regular messages
+- Do not use emojis
+- Be thorough and precise`,
+            promptMode: "replace",
+            isDefault: true,
+        },
+    ],
+    [
+        "Plan",
+        {
+            name: "Plan",
+            displayName: "Plan",
+            description: "Software architect agent for designing implementation plans. Use this when you need to plan the implementation strategy for a task. Returns step-by-step plans, identifies critical files, and considers architectural trade-offs.",
+            builtinToolNames: READ_ONLY_TOOLS,
+            extensions: true,
+            skills: true,
+            systemPrompt: `# CRITICAL: READ-ONLY MODE - NO FILE MODIFICATIONS
+You are a software architect and planning specialist.
+Your role is EXCLUSIVELY to explore the codebase and design implementation plans.
+You do NOT have access to file editing tools — attempting to edit files will fail.
+
+You are STRICTLY PROHIBITED from:
+- Creating new files
+- Modifying existing files
+- Deleting files
+- Moving or copying files
+- Creating temporary files anywhere, including /tmp
+- Using redirect operators (>, >>, |) or heredocs to write to files
+- Running ANY commands that change system state
+
+# Planning Process
+1. Understand requirements
+2. Explore thoroughly (read files, find patterns, understand architecture)
+3. Design solution based on your assigned perspective
+4. Detail the plan with step-by-step implementation strategy
+
+# Requirements
+- Consider trade-offs and architectural decisions
+- Identify dependencies and sequencing
+- Anticipate potential challenges
+- Follow existing patterns where appropriate
+
+# Tool Usage
+- Use the find tool for file pattern matching (NOT the bash find command)
+- Use the grep tool for content search (NOT bash grep/rg command)
+- Use the read tool for reading files (NOT bash cat/head/tail)
+- Use Bash ONLY for read-only operations
+
+# Output Format
+- Use absolute file paths
+- Do not use emojis
+- End your response with:
+
+### Critical Files for Implementation
+List 3-5 files most critical for implementing this plan:
+- /absolute/path/to/file.ts - [Brief reason]`,
+            promptMode: "replace",
+            isDefault: true,
+        },
+    ],
+]);

package/dist/enabled-models.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Reads `enabledModels` from pi's settings (global `<agentDir>/settings.json`
+ * + project-local `<cwd>/.pi/settings.json`, project wins) and resolves
+ * entries to concrete `provider/modelId` keys for scope validation.
+ *
+ * **Project overrides global**, mirroring pi's own `SettingsManager`
+ * deep-merge behavior and matching the precedence we use for our own
+ * `subagents.json` settings (see `src/settings.ts:loadSettings`). If
+ * project file has `enabledModels` set, it wholly replaces global's
+ * (array fields are replaced, not concatenated).
+ *
+ * **Limited subset of upstream's resolveModelScope.** We support exact
+ * `provider/modelId` matching only. Upstream (pi-coding-agent's
+ * `core/model-resolver.ts`) additionally supports glob patterns
+ * (`*sonnet*`, `anthropic/*`), bare model IDs without provider, and
+ * thinking-level suffixes (`provider/*:high`). Those forms are silently
+ * ignored here.
+ *
+ * In practice, pi's `/scoped-models` picker writes exact `provider/modelId`
+ * entries, so the limitation is invisible for users who configure scope
+ * through pi's UI. Hand-edited settings using globs or bare IDs will
+ * produce an empty allowed set (scope check becomes a no-op).
+ *
+ * Example:
+ *   enabledModels = ["anthropic/claude-sonnet-4-6", "anthropic/claude-opus-4-6"]
+ *   → resolves to { "anthropic/claude-sonnet-4-6", "anthropic/claude-opus-4-6" }
+ */
+/** Minimal registry shape — only the methods resolveEnabledModels actually calls. */
+export interface ModelRegistryRef {
+    getAll(): unknown[];
+    getAvailable?(): unknown[];
+}
+/**
+ * Read enabledModels from pi's settings — project-local overrides global.
+ * Mirrors pi's SettingsManager deep-merge for the `enabledModels` field
+ * (and matches our own loadSettings precedence in src/settings.ts).
+ * Returns undefined when neither file has the field.
+ */
+export declare function readEnabledModels(cwd: string): string[] | undefined;
+export declare function resolveEnabledModels(patterns: string[] | undefined, registry: ModelRegistryRef, cwd?: string): Set<string> | undefined;
+/**
+ * True when `model` is in the allowed set. Centralizes the key format
+ * (`provider/id` lowercase) so callers don't have to reproduce it —
+ * both set-building (resolveExact) and lookup go through `modelKey`.
+ */
+export declare function isModelInScope(model: {
+    provider: string;
+    id: string;
+}, allowed: Set<string>): boolean;