@danypops/pi-packed 0.5.3 → 0.6.0

package/README.md

@@ -1,128 +1,20 @@
 # pi-packed
 
-Package service for the [Pi](https://github.com/earendil-works/pi) agent —
-DNF-style package management that both **you** and the **agent** can use.
-
-The agent gets native tools (`pkg_search`, `pkg_info`, `pkg_install`, `pkg_update`, and `pkg_remove`); you get
-the `packed` CLI and an interactive `/packages` TUI. The extension is a thin,
-Node-compatible client. Registry access, SQLite, and package execution remain
-inside the supervised Bun daemon.
-
-```text
-┌─ Pi extension (Node-compatible) ──────────────┐
-│ pkg_search · pkg_info · pkg_install/update/remove│
-│ /packages · /packed permission settings         │
-│ operation-aware approval · no Bun/SQLite access │
-└──────────────────┬────────────────────────────┘
-                   │ authenticated loopback HTTP
-┌─ packed.service (Bun) ────────────────────────┐
-│ typed package client API · watcher · mirror   │
-│ npm registry · SQLite WAL · pi install/remove │
-└───────────────────────────────────────────────┘
-```
-
-## Quickstart
+Pi integration for `@danypops/packed`: package tools, `/packages`, `/packed`, setup apply/reload, and named profiles.
 
 ```bash
-bun test
-packed service > ~/.config/systemd/user/packed.service
-systemctl --user daemon-reload
-systemctl --user enable --now packed.service
-
-packed search lsp
-packed install npm:pi-lsp
-packed installed --json
-
-# In Pi after installing the package:
-/packages
-```
-
-Packages execute arbitrary code and mutate Pi settings/install roots. One daemon-owned operation policy classifies every public package operation. Install, update, remove, and security-setting changes require explicit approval by default (`mutationApproval: always`); search, info, installed, catalog, and update-status reads are bounded reads, while mirror refresh is classified maintenance. Open `/packed` to retain the recommended approval policy or deliberately choose the unsafe **Never require mutation approval** opt-out. `/packages` uses the same policy for updates and removals.
-
-## CLI
-
-| Command | What |
-|---|---|
-| `packed search <q> [--offline] [--limit N] [--json]` | Search npm or the local mirror, scoped to `keywords:pi-package` |
-| `packed info <name> [--json]` | Show version, repository, Pi manifest, size, and license |
-| `packed updates [--json]` | Show drift from the local mirror |
-| `packed update <source> [--approve] [--json]` | Update one configured source through `pi update --extension` |
-| `packed mirror [--json]` | Refresh the SQLite package index |
-| `packed installed [--json]` | Read Pi's installed package declarations |
-| `packed catalog [--json]` | Inspect the local package index |
-| `packed install <source> [--approve] [--json]` | Authenticated daemon install for `npm:`, `git:`, or `https://` sources |
-| `packed remove <name> [--approve] [--json]` | Authenticated daemon removal by bare npm name |
-| `packed security [always\|never] [--approve] [--json]` | Read or set the package mutation approval policy |
-| `packed serve` | Run the loopback daemon |
-| `packed service` | Print the systemd user unit |
-| `packed version` | Print the package/service version |
-
-Guarded CLI mutations require `--approve` under the secure default. This is pi-packed mutation authorization, distinct from Pi's project-trust `--approve` semantics. Install/remove JSON results are stable objects:
-
-```json
-{"ok":true,"source":"npm:pi-lsp","output":"Installed npm:pi-lsp"}
+pi install npm:@danypops/pi-packed
 ```
 
-Failures use exit code 1 and `{ "ok": false, ... , "error": "..." }` with
-credential-safe diagnostics. Usage errors use exit code 2.
+The extension connects to Packed's authenticated user daemon and starts the package-local `packed serve` process when no healthy daemon is available. It contains no SQLite, registry, package execution, or daemon implementation code.
 
-## Native tool presentation
+## Installing the rest of the @danypops ecosystem
 
-Native tools keep three output contracts independent:
-
-- model-facing `content` is concise, credential-safe, and capped at 2,000 characters;
-- renderer-facing `details` uses a versioned bounded package DTO and never retains raw npm metadata or manifest values;
-- CLI human output and `--json` remain presenters over daemon DTOs and do not parse either native-tool channel.
-
-Calls and results have themed collapsed and expanded renderers. Missing or legacy details fall back to model content, while daemon and execution failures are thrown through Pi's native error channel. Package approval refusal remains a normal `cancelled` or `denied` outcome.
-
-## Service API
-
-Every route requires the bearer token stored in the private state directory.
-The daemon listens on loopback only.
-
-| Method | Route |
-|---|---|
-| `GET` | `/health` |
-| `GET` | `/search?q=&limit=&offline=1` |
-| `GET` | `/info?name=` |
-| `GET` | `/installed` |
-| `GET` | `/security` |
-| `POST` | `/security` with `{ "mutationApproval": "always" | "never", "approved": true }` |
-| `GET` | `/updates` |
-| `GET` | `/catalog` |
-| `POST` | `/install` with `{ "source": "...", "approved": true }` |
-| `POST` | `/update` with `{ "source": "...", "approved": true }` |
-| `POST` | `/remove` with `{ "name": "...", "approved": true }` |
-
-State defaults to `~/.cache/pi-packed/` and contains `token`, `port`,
-`updates.json`, `security.json`, and `packed.db`. Relevant environment variables:
-
-- `PI_PACKED_HOME`
-- `PI_PACKED_PI_HOME`
-- `PI_PACKED_WATCH_SECS`
-- `PI_PACKED_CATALOG_SECS`
-- `PI_PACKED_IDLE_SECS`
-- `PI_PACKED_PI_BIN` / `PI_BIN`
-
-## Architecture and safety
-
-- **Daemon-owned SQLite:** extensions never open the mirror directly.
-- **Runtime boundary:** extensions never call `Bun.spawn`; only the supervised
-  Bun daemon owns the `ExecInstaller` adapter.
-- **Authenticated typed client:** extension and mutation CLI paths call the same
-  loopback API and reconnect after daemon restarts.
-- **Ports and adapters:** registry and installer ports keep policy independent
-  from npm, SQLite, subprocess, HTTP, and UI adapters.
-- **Operation-aware authorization:** one policy matrix classifies reads, maintenance, code execution, settings mutation, and security mutation; guarded daemon routes reject missing approval with stable `approval_required` errors.
-- **Allowlisted mutation input:** package sources and names reject shell
-  metacharacters before reaching the installer.
-- **Bounded requests:** daemon calls use timeouts and return structured errors
-  without tokens or credentials.
-
-## Development
+Once Packed is in, install everything else in one reviewable step -- no shell installer, no separate download, no per-package hunting for install commands:
 
 ```bash
-bun test
-bunx tsc --noEmit
+packed setup plan --ecosystem       # preview what would change, no mutation
+packed setup apply --ecosystem --approve
 ```
+
+`--ecosystem` resolves to a curated manifest bundled inside this same npm package (`node_modules/@danypops/pi-packed/node_modules/@danypops/packed/setup/danypops-ecosystem.pi-setup.json`) -- every entry is a real, pinned, integrity-checked npm version, the same schema and approval gate every other `packed setup` manifest goes through. Nothing is fetched from the network to decide what to install; only the already-installed npm package is trusted.

package/extension/src/constants.ts

@@ -0,0 +1,8 @@
+export const TOOL_MODEL_CONTENT_MAX_CHARACTERS = 2_000;
+export const TOOL_DETAILS_MAX_SERIALIZED_CHARACTERS = 32_000;
+export const TOOL_DETAILS_MAX_PACKAGES = 50;
+export const TOOL_DETAILS_MAX_DESCRIPTION_CHARACTERS = 240;
+export const TOOL_DETAILS_MAX_OUTPUT_CHARACTERS = 1_000;
+export const TOOL_DETAILS_MAX_KEYWORDS = 20;
+export const TOOL_DETAILS_MAX_CAPABILITIES = 12;
+export const TOOL_COLLAPSED_PACKAGE_PREVIEW = 3;

package/extension/src/index.ts

@@ -14,16 +14,22 @@ import { showPackages } from "./tui.js";
 import { createNatives } from "./packed.js";
 import { formatUpdateNotice } from "./model.js";
 import { showPackedSettings } from "./security-tui.js";
+import { registerProfiles } from "./profile.js";
+import { handleSetupCommand } from "./setup-command.js";
+import { handleResourceConfigCommand } from "./resource-config.js";
 
 // Async factory (pi awaits it): the seam creates authenticated daemon
 // clients lazily. It never executes Bun-only adapters or opens SQLite.
 export default async function (pi: ExtensionAPI) {
+	registerProfiles(pi);
 	const natives = await createNatives();
 	registerTools(pi, natives);
 
 	pi.registerCommand("packed", {
-		description: "Configure pi-packed security settings",
-		handler: async (_args, ctx) => {
+		description: "Configure pi-packed security settings, run setup plan/apply, or manage resources with config",
+		handler: async (args, ctx) => {
+			if (await handleSetupCommand(args, ctx, natives)) return;
+			if (await handleResourceConfigCommand(args, ctx, natives)) return;
 			await showPackedSettings(ctx, natives);
 		},
 	});

package/extension/src/packed.ts

@@ -10,18 +10,20 @@
  * one connected client instead of reconnecting on every single operation.
  */
 import { createRetryingClient } from "@danypops/daemon-kit/pi-client";
-import type { PackageDaemonPort as ClientPackageDaemonPort } from "../../src/client.ts";
-import type { InstalledPkg, Pkg, PkgInfo, UpdateEntry, UpdateOutcome } from "../../src/ports.ts";
-import type { MutationApproval, SecuritySettings } from "../../src/security.ts";
+import { ensurePackedClient, InstallServiceError, type PackedExtensionClient } from "@danypops/packed/client";
+import type { InstalledPackage, PackageInfo, PackageResources, PackageSummary, ResourceField, SecuritySettings, ServiceSpecSummary, SetupApplyResult, SetupPlan, UpdateEntry, UpdateOutcome } from "@danypops/packed/protocol";
 
-export type { InstalledPkg, UpdateEntry, UpdateOutcome };
-export type PackageInfo = PkgInfo;
-export type PackageDaemonPort = ClientPackageDaemonPort;
+export { InstallServiceError };
+
+export type { PackageInfo, PackageResources, ResourceField, UpdateEntry, UpdateOutcome };
+export type InstalledPkg = InstalledPackage;
+export type PackageDaemonPort = PackedExtensionClient;
+type MutationApproval = SecuritySettings["mutationApproval"];
 
 export interface SearchResponse {
 	query: string;
 	total: number;
-	results: Pkg[];
+	results: PackageSummary[];
 }
 
 export interface Natives {
@@ -33,18 +35,20 @@ export interface Natives {
 	security(): Promise<SecuritySettings>;
 	setMutationApproval(value: MutationApproval, approved?: boolean): Promise<SecuritySettings>;
 	install(source: string, approved?: boolean): Promise<string>;
+	/** Throws InstallServiceError; check .notADaemon before surfacing a failure -- most packages aren't daemons at all. */
+	installService(source: string, approved?: boolean): Promise<{ output: string; spec?: ServiceSpecSummary }>;
 	remove(name: string, approved?: boolean): Promise<string>;
 	update(source: string, approved?: boolean): Promise<UpdateOutcome>;
+	setupPlan(manifestPath: string, prune?: boolean): Promise<SetupPlan>;
+	setupApply(manifestPath: string, approved?: boolean, prune?: boolean): Promise<SetupApplyResult>;
+	listResources(projectRoot?: string): Promise<{ global: PackageResources[]; project: PackageResources[] }>;
+	toggleResource(source: string, field: ResourceField, path: string, enabled: boolean, projectRoot?: string, approved?: boolean): Promise<string>;
 }
 
 export type PackageDaemonConnector = () => Promise<PackageDaemonPort>;
 
 async function connectDefaultDaemon(): Promise<PackageDaemonPort> {
-	const [client, state] = await Promise.all([
-		import("../../src/client.ts"),
-		import("../../src/state.ts"),
-	]);
-	return client.connectPackageDaemon(state.stateDir());
+	return ensurePackedClient();
 }
 
 export async function createNatives(connect: PackageDaemonConnector = connectDefaultDaemon): Promise<Natives> {
@@ -59,7 +63,12 @@ export async function createNatives(connect: PackageDaemonConnector = connectDef
 		security: () => client.call((daemon) => daemon.security()),
 		setMutationApproval: (value, approved) => client.call((daemon) => daemon.setMutationApproval(value, approved)),
 		install: (source, approved) => client.call((daemon) => daemon.install(source, approved)),
+		installService: (source, approved) => client.call((daemon) => daemon.installService(source, approved)),
 		remove: (name, approved) => client.call((daemon) => daemon.remove(name, approved)),
 		update: (source, approved) => client.call((daemon) => daemon.update(source, approved)),
+		setupPlan: (manifestPath, prune) => client.call((daemon) => daemon.setupPlan(manifestPath, prune)),
+		setupApply: (manifestPath, approved, prune) => client.call((daemon) => daemon.setupApply(manifestPath, approved, prune)),
+		listResources: (projectRoot) => client.call((daemon) => daemon.listResources(projectRoot)),
+		toggleResource: (source, field, path, enabled, projectRoot, approved) => client.call((daemon) => daemon.toggleResource(source, field, path, enabled, projectRoot, approved)),
 	};
 }

package/extension/src/permission.ts

@@ -0,0 +1,9 @@
+import type { SecuritySettings } from "@danypops/packed/protocol";
+
+export type PackageOperation = "install" | "update" | "remove" | "toggle";
+
+const GUARDED: readonly PackageOperation[] = ["install", "update", "remove", "toggle"];
+
+export function packagePermissionDecision(settings: SecuritySettings, operation: PackageOperation): { approvalRequired: boolean } {
+	return { approvalRequired: settings.mutationApproval === "always" && GUARDED.includes(operation) };
+}

package/extension/src/profile.ts

@@ -0,0 +1,280 @@
+import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { CONFIG_DIR_NAME, getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { Key } from "@earendil-works/pi-tui";
+export interface Profile {
+	provider?: string;
+	model?: string;
+	thinkingLevel?: "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
+	tools?: string[];
+	instructions?: string;
+	theme?: string;
+	allowedModels?: string[];
+}
+export type ProfilesConfig = Record<string, Profile>;
+type ThinkingLevel = NonNullable<Profile["thinkingLevel"]>;
+const PROFILE_FILE = "profiles.json";
+const LAST_PROFILE_FILE = "profiles-last.json";
+const MAX_PROFILE_BYTES = 256 * 1024;
+const MAX_PROFILES = 100;
+const PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function boundedString(value: unknown, maximum: number): string | undefined {
+	return typeof value === "string" && value.length > 0 && value.length <= maximum ? value : undefined;
+}
+
+function secretLike(value: string): boolean {
+	return /-----BEGIN [A-Z ]*PRIVATE KEY-----/i.test(value)
+		|| /\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|password|passwd|secret)\s*[:=]\s*["']?[A-Za-z0-9_\-./+=]{12,}/i.test(value)
+		|| /\b(?:authorization\s*:\s*)?bearer\s+[A-Za-z0-9_\-./+=]{12,}/i.test(value);
+}
+
+function stringArray(value: unknown, maximum: number): string[] | undefined {
+	if (value === undefined) return undefined;
+	if (!Array.isArray(value) || value.length > maximum || !value.every((item) => typeof item === "string" && item.length > 0 && item.length <= 256)) throw new Error("array must contain bounded strings");
+	return [...new Set(value)];
+}
+
+export function decodeProfiles(text: string): ProfilesConfig {
+	if (Buffer.byteLength(text) > MAX_PROFILE_BYTES) throw new Error("profile file exceeds 256 KiB");
+	const value = JSON.parse(text) as unknown;
+	if (!isRecord(value) || Object.keys(value).length > MAX_PROFILES) throw new Error("profile file must contain at most 100 named profiles");
+	const profiles: ProfilesConfig = {};
+	for (const [name, raw] of Object.entries(value)) {
+		if (!PROFILE_NAME.test(name) || !isRecord(raw)) throw new Error(`invalid profile: ${name}`);
+		const allowed = new Set(["provider", "model", "thinkingLevel", "tools", "instructions", "theme", "allowedModels"]);
+		if (Object.keys(raw).some((key) => !allowed.has(key))) throw new Error(`profile ${name} contains an unknown field`);
+		const profile: Profile = {};
+		for (const field of ["provider", "model", "theme"] as const) {
+			if (raw[field] !== undefined && !boundedString(raw[field], field === "model" ? 256 : 128)) throw new Error(`profile ${name}.${field} is invalid`);
+			const fieldValue = boundedString(raw[field], field === "model" ? 256 : 128);
+			if (fieldValue) profile[field] = fieldValue;
+		}
+		if (raw.instructions !== undefined && !boundedString(raw.instructions, 16_384)) throw new Error(`profile ${name}.instructions is invalid`);
+		if (typeof raw.instructions === "string") {
+			if (secretLike(raw.instructions)) throw new Error(`profile ${name}.instructions contains secret-like material`);
+			profile.instructions = raw.instructions;
+		}
+		if (raw.thinkingLevel !== undefined && (typeof raw.thinkingLevel !== "string" || !THINKING_LEVELS.has(raw.thinkingLevel))) throw new Error(`profile ${name}.thinkingLevel is invalid`);
+		if (raw.thinkingLevel) profile.thinkingLevel = raw.thinkingLevel as ThinkingLevel;
+		profile.tools = stringArray(raw.tools, 100);
+		profile.allowedModels = stringArray(raw.allowedModels, 100);
+		if (!profile.tools) delete profile.tools;
+		if (!profile.allowedModels) delete profile.allowedModels;
+		profiles[name] = profile;
+	}
+	return profiles;
+}
+
+function readProfileFile(path: string): ProfilesConfig {
+	if (!existsSync(path)) return {};
+	const stat = lstatSync(path);
+	if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_PROFILE_BYTES) throw new Error(`${path} is not a safe bounded profile file`);
+	return decodeProfiles(readFileSync(path, "utf8"));
+}
+
+export function loadProfiles(agentDir: string, cwd: string, projectTrusted: boolean): ProfilesConfig {
+	const globalProfiles = readProfileFile(join(agentDir, PROFILE_FILE));
+	if (!projectTrusted) return globalProfiles;
+	return { ...globalProfiles, ...readProfileFile(join(cwd, CONFIG_DIR_NAME, PROFILE_FILE)) };
+}
+
+function loadDefaultProfile(cwd: string, projectTrusted: boolean): string | undefined {
+	if (!projectTrusted) return undefined;
+	try {
+		const path = join(cwd, "pi-setup.json");
+		if (!existsSync(path)) return undefined;
+		const stat = lstatSync(path);
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024) return undefined;
+		const value = JSON.parse(readFileSync(path, "utf8")) as { schemaVersion?: unknown; defaultProfile?: unknown };
+		return value.schemaVersion === 1 && typeof value.defaultProfile === "string" && PROFILE_NAME.test(value.defaultProfile) ? value.defaultProfile : undefined;
+	} catch { return undefined; }
+}
+
+function loadLastProfile(agentDir: string): string | undefined {
+	try {
+		const path = join(agentDir, LAST_PROFILE_FILE);
+		if (!existsSync(path)) return undefined;
+		const stat = lstatSync(path);
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4_096) return undefined;
+		const value = JSON.parse(readFileSync(path, "utf8")) as { name?: unknown };
+		return typeof value.name === "string" && PROFILE_NAME.test(value.name) ? value.name : undefined;
+	} catch { return undefined; }
+}
+
+function saveLastProfile(agentDir: string, name: string | undefined): void {
+	mkdirSync(agentDir, { recursive: true, mode: 0o700 });
+	const path = join(agentDir, LAST_PROFILE_FILE);
+	if (!name) { rmSync(path, { force: true }); return; }
+	if (existsSync(path) && lstatSync(path).isSymbolicLink()) throw new Error("last-profile state is a symlink");
+	const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+	try { writeFileSync(temporary, `${JSON.stringify({ name })}\n`, { flag: "wx", mode: 0o600 }); renameSync(temporary, path); }
+	finally { rmSync(temporary, { force: true }); }
+}
+
+function matchesPattern(value: string, pattern: string): boolean {
+	const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+	try { return new RegExp(`^${escaped}$`).test(value); } catch { return false; }
+}
+
+interface OriginalState {
+	model: ExtensionContext["model"];
+	thinkingLevel: ThinkingLevel;
+	tools: string[];
+	themeName?: string;
+}
+
+export function registerProfiles(pi: ExtensionAPI): void {
+	const agentDir = getAgentDir();
+	let profiles: ProfilesConfig = {};
+	let activeName: string | undefined;
+	let activeProfile: Profile | undefined;
+	let original: OriginalState | undefined;
+	let applyingModel = false;
+
+	function setStatus(ctx: ExtensionContext): void {
+		ctx.ui.setStatus("packed-profile", activeName ? ctx.ui.theme.fg("accent", `profile:${activeName}`) : undefined);
+	}
+
+	function persistState(name: string | undefined): void {
+		pi.appendEntry("profile-state", name ? { name } : { name: null });
+	}
+
+	async function apply(name: string, profile: Profile, ctx: ExtensionContext, persist = true): Promise<void> {
+		if (!original) original = { model: ctx.model, thinkingLevel: pi.getThinkingLevel(), tools: pi.getActiveTools(), themeName: ctx.ui.theme.name };
+		applyingModel = true;
+		try {
+			if (profile.provider && profile.model) {
+				const model = ctx.modelRegistry.find(profile.provider, profile.model);
+				if (!model) ctx.ui.notify(`Profile "${name}": model ${profile.provider}/${profile.model} not found`, "warning");
+				else if (!await pi.setModel(model)) ctx.ui.notify(`Profile "${name}": credentials unavailable for ${profile.provider}/${profile.model}`, "warning");
+			}
+		} finally { applyingModel = false; }
+		if (profile.thinkingLevel) pi.setThinkingLevel(profile.thinkingLevel);
+		if (profile.tools?.length) {
+			const available = new Set(pi.getAllTools().map((tool) => tool.name));
+			const valid = profile.tools.filter((tool) => available.has(tool));
+			const missing = profile.tools.filter((tool) => !available.has(tool));
+			if (missing.length) ctx.ui.notify(`Profile "${name}": unknown tools: ${missing.join(", ")}`, "warning");
+			if (valid.length) pi.setActiveTools(valid);
+		}
+		if (profile.theme) {
+			const result = ctx.ui.setTheme(profile.theme);
+			if (!result.success) ctx.ui.notify(`Profile "${name}": ${result.error}`, "warning");
+		}
+		activeName = name;
+		activeProfile = profile;
+		if (persist) {
+			try { saveLastProfile(agentDir, name); } catch (error) { ctx.ui.notify(error instanceof Error ? error.message : String(error), "warning"); }
+			persistState(name);
+		}
+		setStatus(ctx);
+	}
+
+	async function clear(ctx: ExtensionContext): Promise<void> {
+		activeName = undefined;
+		activeProfile = undefined;
+		if (original?.model) await pi.setModel(original.model);
+		if (original) {
+			pi.setThinkingLevel(original.thinkingLevel);
+			pi.setActiveTools(original.tools);
+			if (original.themeName) {
+				const result = ctx.ui.setTheme(original.themeName);
+				if (!result.success) ctx.ui.notify(result.error ?? "theme restore failed", "warning");
+			}
+		}
+		original = undefined;
+		try { saveLastProfile(agentDir, undefined); } catch (error) { ctx.ui.notify(error instanceof Error ? error.message : String(error), "warning"); }
+		persistState(undefined);
+		setStatus(ctx);
+	}
+
+	async function choose(ctx: ExtensionContext): Promise<void> {
+		const names = Object.keys(profiles).sort();
+		if (names.length === 0) { ctx.ui.notify("No profiles defined", "warning"); return; }
+		const none = "(none)";
+		const selected = await ctx.ui.select("Select profile", [none, ...names]);
+		if (!selected) return;
+		if (selected === none) { await clear(ctx); ctx.ui.notify("Profile cleared", "info"); return; }
+		await apply(selected, profiles[selected]!, ctx);
+		ctx.ui.notify(`Profile "${selected}" activated`, "info");
+	}
+
+	async function cycle(ctx: ExtensionContext): Promise<void> {
+		if (Object.keys(profiles).length === 0) { ctx.ui.notify("No profiles defined", "warning"); return; }
+		const values = [undefined, ...Object.keys(profiles).sort()];
+		const index = values.indexOf(activeName);
+		const next = values[(index + 1) % values.length];
+		if (!next) { await clear(ctx); ctx.ui.notify("Profile cleared", "info"); return; }
+		await apply(next, profiles[next]!, ctx);
+		ctx.ui.notify(`Profile "${next}" activated`, "info");
+	}
+
+	pi.registerFlag("profile", { description: "Packed profile to activate", type: "string" });
+	pi.registerCommand("profile", {
+		description: "Switch Packed profile",
+		getArgumentCompletions(prefix) {
+			const matches = Object.keys(profiles).sort().filter((name) => name.startsWith(prefix)).map((name) => ({ value: name, label: name }));
+			return matches.length ? matches : null;
+		},
+		async handler(args, ctx) {
+			const name = args.trim();
+			if (!name) { await choose(ctx); return; }
+			const profile = profiles[name];
+			if (!profile) { ctx.ui.notify(`Unknown profile "${name}"`, "error"); return; }
+			await apply(name, profile, ctx);
+			ctx.ui.notify(`Profile "${name}" activated`, "info");
+		},
+	});
+	pi.registerShortcut(Key.ctrlShift("u"), { description: "Cycle Packed profiles", handler: cycle });
+
+	pi.on("model_select", (event, ctx) => {
+		if (applyingModel || event.source === "restore" || !activeProfile?.allowedModels?.length) return;
+		const selected = `${event.model.provider}/${event.model.id}`;
+		if (!activeProfile.allowedModels.some((pattern) => matchesPattern(selected, pattern))) ctx.ui.notify(`${selected} is outside profile "${activeName}" allowedModels`, "warning");
+	});
+	pi.on("before_agent_start", (event) => activeProfile?.instructions ? { systemPrompt: `${event.systemPrompt}\n\n${activeProfile.instructions}` } : undefined);
+	pi.on("session_start", async (event, ctx) => {
+		try { profiles = loadProfiles(agentDir, ctx.cwd, ctx.isProjectTrusted()); }
+		catch (error) { profiles = {}; ctx.ui.notify(`Profile configuration rejected: ${error instanceof Error ? error.message : String(error)}`, "error"); }
+		const flag = pi.getFlag("profile");
+		if (typeof flag === "string" && flag) {
+			if (!profiles[flag]) { ctx.ui.notify(`Unknown profile "${flag}"`, "warning"); setStatus(ctx); return; }
+			await apply(flag, profiles[flag]!, ctx);
+			ctx.ui.notify(`Profile "${flag}" activated`, "info");
+			return;
+		}
+		const defaultProfile = loadDefaultProfile(ctx.cwd, ctx.isProjectTrusted());
+		if ((event.reason === "reload" || event.reason === "new") && defaultProfile) {
+			if (profiles[defaultProfile]) await apply(defaultProfile, profiles[defaultProfile]!, ctx, false);
+			else { ctx.ui.notify(`Default profile "${defaultProfile}" is not defined`, "warning"); setStatus(ctx); }
+			return;
+		}
+		const state = [...ctx.sessionManager.getEntries()].reverse().find((entry: { type: string; customType?: string }) => entry.type === "custom" && (entry.customType === "profile-state" || entry.customType === "packed-profile-state")) as { data?: { name?: unknown } } | undefined;
+		if (state) {
+			if (typeof state.data?.name === "string" && profiles[state.data.name]) {
+				activeName = state.data.name;
+				activeProfile = profiles[state.data.name];
+			}
+			setStatus(ctx);
+			return;
+		}
+		if (defaultProfile) {
+			if (profiles[defaultProfile]) await apply(defaultProfile, profiles[defaultProfile]!, ctx, false);
+			else { ctx.ui.notify(`Default profile "${defaultProfile}" is not defined`, "warning"); setStatus(ctx); }
+			return;
+		}
+		const last = loadLastProfile(agentDir);
+		if (last && profiles[last]) { await apply(last, profiles[last]!, ctx, false); ctx.ui.notify(`Profile "${last}" restored`, "info"); }
+		else {
+			if (last) ctx.ui.notify(`Last active profile "${last}" no longer exists`, "warning");
+			setStatus(ctx);
+		}
+	});
+}

package/extension/src/reload.ts

@@ -0,0 +1,16 @@
+/**
+ * reload.ts — one shared decision for whether a Pi package mutation needs a
+ * reload to take effect, and the exact wording every mutation surface
+ * (native tools, the /packages panel, and the resource overlay) uses to
+ * warn about it. Keeps three independent implementations from drifting
+ * apart on when and how they say a reload is coming.
+ */
+import type { PackageOperation } from "./permission.js";
+
+/** Inline warning appended to a mutation's pre-confirmation dialog, before
+ * the operation runs -- the moment the user is actually deciding. */
+export function reloadWarning(operation: PackageOperation): string {
+	return operation === "remove"
+		? "This will require a Pi reload (/reload) to deactivate it."
+		: "This will likely require a Pi reload (/reload) to activate its resources.";
+}