pi-feats 0.1.2 → 0.1.4

package/README.md

@@ -4,6 +4,8 @@
 
 `pi-feats` turns the lightweight, extensible Pi Coding Agent into an operational workspace without replacing Pi's native configuration model. It adds persistent profiles, a policy-controlled sandbox, HTTP and browser interfaces, application runtimes, scheduled work, Git-backed Skill discovery, and command-line administration.
 
+![Pi Feats: production features for Pi Coding Agent](assets/pi-feats-preview.png)
+
 ## Contents
 
 - [Glossary](#glossary)
@@ -291,9 +293,18 @@ Refreshing synchronizes the source and atomically replaces the complete installe
 
 ### Sequential Workflow
 
-- Create persistent workflows made of strictly ordered **Action**, **Collect**, and **Evaluate** tasks.
+- Create persistent workflows made of strictly ordered **Action**, **Collect**, **Evaluate**, and subworkflow tasks.
+- Run multiple workflows per profile, independently or in parent/child hierarchies, with execution ownership and persisted focus isolated by Pi session ID.
+- Enforce current-task IDs, ownership, phase gates, and one tool call per model turn in the harness. External tools are allowed only during running Action tasks. Collect requires a subsequent user message. These controls enforce ordering, not the semantic truth of agent-reported results.
+- Restore focus on same-session resume/reload, never automatically on new/forked sessions. `/workflow-suspend`, `/workflow-focus <id>`, and `/workflow-adopt <rootId>` provide explicit user control; adoption transfers the entire tree and revokes the former owner's access. Legacy executions remain unowned until adopted.
+- Cancel any active workflow in the current profile with `sequential_workflow_cancel`, including one created by another session; cancellation does not require adoption and does not cascade to descendants. A cancelled child is returned to its parent for evaluation. `/workflow-cancel <id>` remains available for direct user control.
+- Resolve `ative o sequential workflow basic` to `sequential_workflow_templates/basic.json` without inventing a new definition. Each activation creates a new execution. Missing templates fail closed.
+- Refresh task context before every model request and request at most two automatic continuations per unchanged unfinished phase. Failure to progress leaves the task pending with a warning; it never auto-accepts a task.
+- Let a subworkflow task wait for its linked child while unrelated workflows continue independently.
 - Prevent advancement until the current task result has been recorded and accepted.
 - Persist workflow state in SQLite for auditable retries and continuation.
+- Validate reusable JSON definitions against [`schemas/sequential-workflow-template.schema.json`](schemas/sequential-workflow-template.schema.json), then create and start a workflow directly from the template.
+- Include separate Skills for executing named Sequential Workflows and authoring their JSON templates. Templates created without an explicitly requested output path default to `<PI_CODING_AGENT_DIR>/sequential_workflow_templates/` (or `~/.pi/agent/sequential_workflow_templates/`); template tools resolve relative paths in that same directory.
 
 ## Command cookbook
 
@@ -410,6 +421,7 @@ The `remote:<name>` form forwards the rest of the command to the selected remote
 | Extension | Responsibility |
 | --- | --- |
 | API Server | HTTP API, Applications, profile administration, sessions, logs, and terminal tickets. |
+| Browser Harness | Steel Profile-scoped CDP browser automation for active Pi Profiles. |
 | CLI Resources | Resource, package, session, and profile commands. |
 | Guardrails | Input, tool, and output policy stages. |
 | Pi Console WebUI | Browser-based operations console and terminal client. |
@@ -418,6 +430,17 @@ The `remote:<name>` form forwards the rest of the command to the selected remote
 | Sequential Workflow | Ordered Action, Collect, and Evaluate workflows. |
 | Skill Sources | Git-backed Skill source catalog and explicit imports. |
 
+### Steel Browser Harness
+
+The Browser Harness maps each Pi Profile to a persisted Steel SessionContext. The Steel API creates and releases live browser sessions; the profile-local context restores cookies and storage for the next session. Configure the Steel endpoint and credential in each profile's `.env`:
+
+```dotenv
+STEEL_API_URL=http://127.0.0.1:3000
+STEEL_API_KEY=...
+```
+
+On first browser use, the harness creates a Steel Session through the API. `browser_setup` and `/browser-setup` return Steel's interactive live viewer URL, so a person can observe and interact with the same browser and tabs while the agent works through CDP. When the session is released, the harness stores the SessionContext in `steel.json` inside that Pi Profile directory. Steel Session identifiers are never persisted. Use `/browser-viewer` to show the current viewer URL, `/browser-status` to inspect the active session, and `/browser-release` to release it.
+
 ## Installation
 
 Install the latest published package:

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,12 @@
+# Third-party notices
+
+## pi-browser-harness
+
+`extensions/browser-harness` contains adapted source code from
+[pi-browser-harness](https://github.com/amankumarsingh77/pi-browser-harness),
+version 0.11.1 (commit `8d7a067`). The original project is licensed under the
+MIT License. The adaptation replaces desktop-browser discovery and local
+profile management with Pi Profile-scoped Steel SessionContext and Steel Session
+management.
+
+See the original project's `LICENSE` for the full license text.

package/extensions/api-server/application-log-store.ts

@@ -2,6 +2,7 @@ import { EventEmitter } from "node:events";
 import { mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
+import type { ContextMemoryExecutionLog } from "../lib/application-context.ts";
 export type CallStage = { id: string; type: string; label: string; startedAt: string; finishedAt?: string; input?: unknown; output?: unknown; payload?: unknown; stdout: string[]; stderr: string[]; error?: string };
 export type ApplicationCall = { id: string; application: string; origin: string; receivedAt: string; finishedAt?: string; status: "running" | "success" | "error"; headers: Record<string, unknown>; stages: CallStage[]; error?: string };
 export class ApplicationLogStore {
@@ -12,9 +13,39 @@ export class ApplicationLogStore {
   start(payload: unknown, headers: Record<string, unknown>) { const call: ApplicationCall = { id: randomUUID(), application: this.application, origin: String(headers["x-forwarded-for"] ?? headers.origin ?? headers.host ?? "unknown"), receivedAt: new Date().toISOString(), status: "running", headers, stages: [{ id: randomUUID(), type: "request", label: "Request", startedAt: new Date().toISOString(), finishedAt: new Date().toISOString(), payload, stdout: [], stderr: [] }] }; this.calls.set(call.id, call); void this.save(call); return call; }
   stage(call: ApplicationCall, type: string, label: string, input: unknown) { const stage: CallStage = { id: randomUUID(), type, label, startedAt: new Date().toISOString(), input, stdout: [], stderr: [] }; call.stages.push(stage); void this.save(call); return stage; }
   complete(call: ApplicationCall, stage: CallStage, output: unknown) { stage.output = output; stage.finishedAt = new Date().toISOString(); void this.save(call); }
+  annotate(call: ApplicationCall, stage: CallStage, output: unknown) { stage.output = output; void this.save(call); }
   fail(call: ApplicationCall, stage: CallStage | undefined, error: unknown) { const message = error instanceof Error ? `${error.message}\n${error.stack ?? ""}` : String(error); if (stage) { stage.error = message; stage.finishedAt = new Date().toISOString(); } call.error = message; call.status = "error"; call.finishedAt = new Date().toISOString(); void this.save(call); }
   finish(call: ApplicationCall, output: unknown) { call.status = "success"; call.finishedAt = new Date().toISOString(); const stage = this.stage(call, "final-response", "Final response", output); this.complete(call, stage, output); }
+  recordContextMemory(input: { profile: string; identityKey: string; sessionId: string; execution: ContextMemoryExecutionLog }) {
+    const { execution } = input;
+    const stage: CallStage = {
+      id: randomUUID(),
+      type: "context-memory",
+      label: `Context Memory: ${execution.handler}`,
+      startedAt: execution.startedAt,
+      finishedAt: new Date(new Date(execution.startedAt).getTime() + execution.durationMs).toISOString(),
+      input: { profile: input.profile, identityKey: input.identityKey, sessionId: input.sessionId, handler: execution.handler },
+      output: { injected: execution.status === "success" && execution.outputCharacters > 0, outputCharacters: execution.outputCharacters },
+      stdout: execution.stdout,
+      stderr: execution.stderr,
+      ...(execution.error ? { error: execution.error } : {}),
+    };
+    const call: ApplicationCall = {
+      id: randomUUID(), application: this.application, origin: "Pi Console session", receivedAt: execution.startedAt,
+      finishedAt: stage.finishedAt, status: execution.status === "success" ? "success" : "error", headers: {}, stages: [stage], ...(execution.error ? { error: execution.error } : {}),
+    };
+    this.calls.set(call.id, call); void this.save(call);
+  }
   list() { return [...this.calls.values()].sort((a, b) => b.receivedAt.localeCompare(a.receivedAt)); }
+  listSummaries(limit = 100, start?: Date, end?: Date) {
+    return this.list().filter((call) => {
+      const receivedAt = new Date(call.receivedAt);
+      return (!start || receivedAt >= start) && (!end || receivedAt <= end);
+    }).slice(0, limit).map((call) => ({
+      id: call.id, application: call.application, origin: call.origin, receivedAt: call.receivedAt, finishedAt: call.finishedAt, status: call.status, error: call.error,
+      stages: call.stages.map((stage) => ({ id: stage.id, type: stage.type, label: stage.label, startedAt: stage.startedAt, finishedAt: stage.finishedAt, error: stage.error, completed: Boolean(stage.finishedAt) })),
+    }));
+  }
   get(id: string) { return this.calls.get(id); }
   async clear() { this.calls.clear(); await rm(this.directory, { recursive: true, force: true }); await mkdir(this.directory, { recursive: true }); this.events.emit("event", { type: "logs.cleared" }); }
   on(listener: (event: unknown) => void) { this.events.on("event", listener); return () => this.events.off("event", listener); }

package/extensions/api-server/application-runtime.ts

@@ -10,9 +10,11 @@ import { ApplicationLogStore } from "./application-log-store.ts";
 type RecordValue = Record<string, any>;
 export type Settings = { responseMode: "ack" | "result"; transformHandlers?: string[]; inboundHandler: string; outboundHandler?: string; defaultProfile?: string | null; messageCoalescing?: { enabled?: boolean; silenceDebounceSeconds?: number } };
 type Handler = (payload: RecordValue, headers?: RecordValue | null, query?: RecordValue | null, context?: RecordValue | null, state?: RecordValue | null, env?: Record<string, string | undefined>) => Promise<any> | any;
-type ApplicationApi = { agentSettings(): Promise<Record<string, unknown>>; listSessions(profile: string): Promise<Array<Record<string, unknown>>>; createSession(profile: string, input: unknown): Promise<Record<string, unknown>>; getSessionConversation(profile: string, sessionId: string): Promise<Record<string, unknown>>; complete(profile: string, prompt: string): Promise<string>; prompt(profile: string, sessionId: string, message: string, handoff?: string): Promise<{ profile: string; sessionId: string; response: string }>; getIdentityMapping(application: string, identityKey: string): Promise<{ profile: string; sessionMode: "fixed" | "automatic"; sessionPrefix: string | null } | undefined>; automaticApplicationSessionPrefix(application: string, identityKey: string): Promise<string>;  getApplicationSession(application: string, profile: string, prefix: string): Promise<{ sessionId: string } | undefined>; getActiveApplicationSession(application: string, profile: string, prefix: string): Promise<{ sessionId: string } | undefined>; nextApplicationSessionId(application: string, profile: string, prefix: string): Promise<string>; recordApplicationSession(application: string, profile: string, prefix: string, sessionId: string, rollover: boolean): Promise<void>; touchApplicationSession(application: string, profile: string, prefix: string, sessionId: string, from?: string): Promise<void>;  retargetPulseThreadSessions(profile: string, fromSessionId: string, toSessionId: string): Promise<void>; handlerEnvironment(profile: string): Promise<Record<string, string | undefined>> };
+type ApplicationApi = { agentSettings(): Promise<Record<string, unknown>>; listSessions(profile: string): Promise<Array<Record<string, unknown>>>; createSession(profile: string, input: unknown): Promise<Record<string, unknown>>; getSessionConversation(profile: string, sessionId: string): Promise<Record<string, unknown>>; complete(profile: string, prompt: string): Promise<string>; prompt(profile: string, sessionId: string, message: string, handoff?: string, applicationContext?: { application: string; identityKey: string }): Promise<{ profile: string; sessionId: string; response: string }>; getIdentityMapping(application: string, identityKey: string): Promise<{ profile: string; sessionMode: "fixed" | "automatic"; sessionPrefix: string | null } | undefined>; automaticApplicationSessionPrefix(application: string, identityKey: string): Promise<string>;  getApplicationSession(application: string, profile: string, prefix: string): Promise<{ sessionId: string } | undefined>; getActiveApplicationSession(application: string, profile: string, prefix: string): Promise<{ sessionId: string } | undefined>; nextApplicationSessionId(application: string, profile: string, prefix: string): Promise<string>; recordApplicationSession(application: string, profile: string, prefix: string, sessionId: string, rollover: boolean): Promise<void>; touchApplicationSession(application: string, profile: string, prefix: string, sessionId: string, from?: string): Promise<void>;  retargetPulseThreadSessions(profile: string, fromSessionId: string, toSessionId: string): Promise<void>; handlerEnvironment(profile: string): Promise<Record<string, string | undefined>> };
 type Handoff = { sourceSessionId: string | null; summary: string; createdAt: string; targetCreatedAt: string };
 type WorkingSession = { sessionId: string; updatedAt: string; reason: "message" | "rollover" };
+type CoalescedEntry = { call: ReturnType<ApplicationLogStore["start"]>; stage: ReturnType<ApplicationLogStore["stage"]>; message: string; state: RecordValue; version: number; dispatch: (message: string, state: RecordValue) => Promise<unknown>; resolve: (output: unknown) => void; reject: (error: unknown) => void };
+type CoalescingBuffer = { version: number; entries: CoalescedEntry[] };
 export type ApplicationIdentity = { id: string; name: string; slug: string; enabled: boolean; responseMode: "ack" | "result"; defaultProfile: string | null; routingPolicy: "default_as_fallback" | "drop"; settings: Record<string, unknown> }; 
 
 const safeName = (name: string) => /^[A-Za-z][A-Za-z0-9_-]*$/.test(name);
@@ -37,6 +39,8 @@ export class ApplicationRuntime {
   readonly settings: Settings;
   private readonly jiti = createJiti(process.cwd(), { moduleCache: false, fsCache: false });
   private queues = new Map<string, Promise<void>>();
+  private coalescingBuffers = new Map<string, CoalescingBuffer>();
+  private coalescingTimers = new Set<ReturnType<typeof setTimeout>>();
 
   readonly logs: ApplicationLogStore;
   constructor(readonly directory: string, settings: Settings, private readonly api: ApplicationApi, private readonly persistSettings: (settings: Settings) => Promise<void>, private readonly application: ApplicationIdentity) { this.name = application.slug; this.settings = settings; this.logs = new ApplicationLogStore(directory, this.name); }
@@ -139,11 +143,17 @@ export class ApplicationRuntime {
         temporaryPath = join(dirname(path), `.pi-handler-test-${randomUUID()}.ts`);
         await writeFile(temporaryPath, content, "utf8");
       }
-      const loaded = this.jiti(temporaryPath ?? path) as { handle?: Handler };
-      if (typeof loaded.handle !== "function") throw new Error("Handler must export handle().");
-      const context = { application: this.application, settings: await this.api.agentSettings(), request: { id: randomUUID(), headers: {}, query: {} }, test: true, log: { info: (...values: unknown[]) => stdout.push(logValues(values)), error: (...values: unknown[]) => stderr.push(logValues(values)) } };
+      const loaded = this.jiti(temporaryPath ?? path) as { handle?: Handler; resolveContextMemory?: (context: { application: { slug: string }; identityKey?: string; profile: string; sessionId: string }, env: Record<string, string | undefined>) => Promise<unknown> | unknown };
       installConsoleCapture();
-      const output = await testConsoleLogs.run({ stdout, stderr }, async () => loaded.handle(payload, {}, {}, context, {}, await this.environmentFor(payload)));
+      let output: unknown;
+      if (typeof loaded.resolveContextMemory === "function") {
+        const profile = typeof payload.profile === "string" ? payload.profile : "default", identityKey = typeof payload.identityKey === "string" ? payload.identityKey : undefined, sessionId = typeof payload.sessionId === "string" ? payload.sessionId : "test-session";
+        output = await testConsoleLogs.run({ stdout, stderr }, async () => loaded.resolveContextMemory!({ application: { slug: this.application.slug }, identityKey, profile, sessionId }, await this.api.handlerEnvironment(profile)));
+      } else {
+        if (typeof loaded.handle !== "function") throw new Error("Handler must export handle() or resolveContextMemory().");
+        const context = { application: this.application, settings: await this.api.agentSettings(), request: { id: randomUUID(), headers: {}, query: {} }, test: true, log: { info: (...values: unknown[]) => stdout.push(logValues(values)), error: (...values: unknown[]) => stderr.push(logValues(values)) } };
+        output = await testConsoleLogs.run({ stdout, stderr }, async () => loaded.handle!(payload, {}, {}, context, {}, await this.environmentFor(payload)));
+      }
       return { ok: true, output, logs: { stdout, stderr }, durationMs: Math.round(performance.now() - started) };
     } catch (error) {
       const message = error instanceof Error ? error.stack ?? error.message : String(error);
@@ -177,6 +187,52 @@ export class ApplicationRuntime {
     });
   }
 
+  private async collect(key: string, call: ReturnType<ApplicationLogStore["start"]>, message: string, state: RecordValue, dispatch: (message: string, state: RecordValue) => Promise<unknown>): Promise<unknown> {
+    const seconds = this.settings.messageCoalescing?.silenceDebounceSeconds ?? 0;
+    if (!this.settings.messageCoalescing?.enabled || seconds <= 0) return dispatch(message, state);
+    const buffer = this.coalescingBuffers.get(key) ?? { version: 0, entries: [] };
+    this.coalescingBuffers.set(key, buffer);
+    const version = ++buffer.version;
+    const stage = this.logs.stage(call, "coalescing", "Message coalescing", { key, version, silenceDebounceSeconds: seconds, messageCharacters: message.length });
+    this.logs.complete(call, stage, { status: "collected", version });
+    return new Promise((resolve, reject) => {
+      const entry: CoalescedEntry = { call, stage, message, state, version, dispatch, resolve, reject };
+      buffer.entries.push(entry);
+      const timer = setTimeout(() => { this.coalescingTimers.delete(timer); void this.flushCoalesced(key, version); }, seconds * 1_000);
+      this.coalescingTimers.add(timer);
+    });
+  }
+
+  private async flushCoalesced(key: string, version: number): Promise<void> {
+    const buffer = this.coalescingBuffers.get(key);
+    if (!buffer) return;
+    if (buffer.version !== version) {
+      for (const entry of buffer.entries.filter((item) => item.version === version)) this.logs.annotate(entry.call, entry.stage, { status: "superseded", version, latestVersion: buffer.version });
+      return;
+    }
+    this.coalescingBuffers.delete(key);
+    const entries = buffer.entries, leader = entries.at(-1)!;
+    const message = entries.map((entry) => entry.message).join("\n");
+    for (const entry of entries) this.logs.annotate(entry.call, entry.stage, { status: entry === leader ? "dispatched" : "merged", version, leaderCallId: leader.call.id, messageCount: entries.length, messageCharacters: message.length });
+    try {
+      const output = await leader.dispatch(message, leader.state);
+      for (const entry of entries) {
+        if (entry !== leader) this.logs.finish(entry.call, { coalescing: { status: "merged", leaderCallId: leader.call.id, messageCount: entries.length } });
+        entry.resolve(output);
+      }
+    } catch (error) {
+      for (const entry of entries) { if (entry.call.status !== "error") this.logs.fail(entry.call, entry === leader ? undefined : entry.stage, error); entry.reject(error); }
+    }
+  }
+
+  dispose(): void {
+    for (const timer of this.coalescingTimers) clearTimeout(timer);
+    this.coalescingTimers.clear();
+    const error = new Error("Message coalescing was interrupted because the Application runtime was reloaded.");
+    for (const buffer of this.coalescingBuffers.values()) for (const entry of buffer.entries) { this.logs.fail(entry.call, entry.stage, error); entry.reject(error); }
+    this.coalescingBuffers.clear();
+  }
+
   async process(payload: unknown, headers: RecordValue, query: RecordValue): Promise<unknown> {
     const call = this.logs.start(payload, headers); let active: any; let current = asRecord(payload); let state: RecordValue = {};
     const context = { application: this.application, settings: await this.api.agentSettings(), request: { id: call.id, headers, query }, log: { info: (...values: unknown[]) => active?.stdout.push(values.map(String).join(" ")), error: (...values: unknown[]) => active?.stderr.push(values.map(String).join(" ")) } };
@@ -185,19 +241,23 @@ export class ApplicationRuntime {
       for (const name of this.settings.transformHandlers ?? []) { const result = await run("transform", `Transform: ${name}`, current, async () => this.handler("transform", name)(current, headers, query, context, state, await this.environmentFor(current, payload, query))); if (result && typeof result === "object" && "payload" in result) { current = asRecord(result.payload); state = { ...state, ...asRecord(result.state) }; } else current = asRecord(result); }
       const inbound = await run("inbound-handler", `Inbound handler: ${this.settings.inboundHandler}`, current, async () => this.handler("inbound", this.settings.inboundHandler)(current, headers, query, context, state, await this.environmentFor(current, payload, query)));
       const routed = asRecord(inbound); const hasIdentityKey = Object.prototype.hasOwnProperty.call(routed, "identityKey"); const identityKey = typeof routed.identityKey === "string" ? routed.identityKey.trim() : undefined; if (hasIdentityKey && !identityKey) throw Object.assign(new Error("identityKey must be a non-empty string when provided."), { status: 422 }); let profile: string | undefined, sessionPrefix: string | null | undefined; if (identityKey) { const mapped = await this.api.getIdentityMapping(this.application.slug, identityKey); if (!mapped) throw Object.assign(new Error("No Identity Key mapping was found for this Application."), { status: 422 }); profile = mapped.profile; sessionPrefix = mapped.sessionMode === "automatic" ? await this.api.automaticApplicationSessionPrefix(this.application.slug, identityKey) : mapped.sessionPrefix; if (!sessionPrefix) throw Object.assign(new Error("The Identity Key mapping has no session prefix."), { status: 422 }); } else { profile = typeof routed.profile === "string" && routed.profile.trim() ? routed.profile.trim() : undefined; sessionPrefix = typeof (routed.sessionPrefix ?? routed.session_prefix) === "string" ? String(routed.sessionPrefix ?? routed.session_prefix).trim() || undefined : undefined; if (!profile) throw Object.assign(new Error("Inbound must return profile when identityKey is not provided."), { status: 422 }); sessionPrefix ??= "default"; } if (!profile || !sessionPrefix) throw Object.assign(new Error("No Application route was resolved."), { status: 422 }); const message = asRecord(routed.payload).message; if (typeof message !== "string" || !message.trim()) throw Object.assign(new Error("The Application did not produce a text message."), { status: 422 }); state = { ...state, ...asRecord(routed.state) };
-      const sessionId = await this.resolveSession(profile, sessionPrefix);
-      let handoff: string | undefined;
-      try { handoff = await run("handoff-relevance", "Handoff relevance", { profile, sessionId, message }, () => this.relevantHandoff(profile, sessionId, sessionPrefix, message)); }
-      catch (error) { context.log.error("Handoff skipped:", error instanceof Error ? error.message : String(error)); }
-      const result = await run("pi-agent", "Pi agent", { profile, sessionId, message, handoff: Boolean(handoff) }, () => this.api.prompt(profile, sessionId, message, handoff));
-      await this.setWorkingSession(profile, sessionPrefix, sessionId, "message"); await this.api.touchApplicationSession(this.application.slug, profile, sessionPrefix, sessionId, identityKey);
-      let output: unknown = result;
-      if (this.settings.outboundHandler) {
-        const outboundInput = { profile, sessionId, message: { content: result.response } };
-        const handler = this.handler("outbound", this.settings.outboundHandler);
-        output = await run("outbound-handler", `Outbound handler: ${this.settings.outboundHandler}`, outboundInput, async () => handler(outboundInput, headers, query, context, state, await this.api.handlerEnvironment(profile)));
-      }
-      this.logs.finish(call, output); return output;
+      const dispatch = async (coalescedMessage: string, coalescedState: RecordValue): Promise<unknown> => {
+        const sessionId = await this.resolveSession(profile!, sessionPrefix!);
+        let handoff: string | undefined;
+        try { handoff = await run("handoff-relevance", "Handoff relevance", { profile, sessionId, message: coalescedMessage }, () => this.relevantHandoff(profile!, sessionId, sessionPrefix, coalescedMessage)); }
+        catch (error) { context.log.error("Handoff skipped:", error instanceof Error ? error.message : String(error)); }
+        const result = await run("pi-agent", "Pi agent", { profile, sessionId, message: coalescedMessage, handoff: Boolean(handoff) }, () => this.api.prompt(profile!, sessionId, coalescedMessage, handoff, identityKey ? { application: this.application.slug, identityKey } : undefined));
+        await this.setWorkingSession(profile!, sessionPrefix!, sessionId, "message"); await this.api.touchApplicationSession(this.application.slug, profile!, sessionPrefix!, sessionId, identityKey);
+        let output: unknown = result;
+        if (this.settings.outboundHandler) {
+          const outboundInput = { profile, sessionId, message: { content: result.response } };
+          const handler = this.handler("outbound", this.settings.outboundHandler);
+          output = await run("outbound-handler", `Outbound handler: ${this.settings.outboundHandler}`, outboundInput, async () => handler(outboundInput, headers, query, context, coalescedState, await this.api.handlerEnvironment(profile!)));
+        }
+        this.logs.finish(call, output); return output;
+      };
+      const key = `${this.application.slug}:${identityKey ? `identity:${identityKey}` : `route:${profile}:${sessionPrefix}`}`;
+      return await this.collect(key, call, message, state, dispatch);
     } catch (error) { if (call.status !== "error") this.logs.fail(call, undefined, error); throw error; }
   }
 }
@@ -208,5 +268,7 @@ export function validateApplicationSettings(raw: unknown): asserts raw is Settin
   if (!safeName(settings.inboundHandler)) throw Object.assign(new Error("Invalid inbound handler."), { status: 400 });
   if (settings.outboundHandler !== undefined && !safeName(settings.outboundHandler)) throw Object.assign(new Error("Invalid outbound handler."), { status: 400 });
   if (settings.transformHandlers !== undefined && (!Array.isArray(settings.transformHandlers) || settings.transformHandlers.some((name) => !safeName(name)))) throw Object.assign(new Error("Invalid transform handlers."), { status: 400 });
+  const coalescing = settings.messageCoalescing;
+  if (coalescing !== undefined && (!coalescing || typeof coalescing !== "object" || (coalescing.enabled !== undefined && typeof coalescing.enabled !== "boolean") || (coalescing.silenceDebounceSeconds !== undefined && (!Number.isInteger(coalescing.silenceDebounceSeconds) || coalescing.silenceDebounceSeconds < 1 || coalescing.silenceDebounceSeconds > 3600)))) throw Object.assign(new Error("Invalid message coalescing settings."), { status: 400 });
 }
 

package/extensions/api-server/application-store.ts

@@ -6,13 +6,13 @@ export type ApplicationRecord = { id: string; name: string; slug: string; enable
 type Row = Record<string, unknown>; const now = () => new Date().toISOString();
 export class ApplicationStore {
   private db: DatabaseSync;
-  constructor(path: string) { mkdirSync(dirname(path), { recursive: true }); this.db = new DatabaseSync(path); this.db.exec(`CREATE TABLE IF NOT EXISTS applications (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, enabled INTEGER NOT NULL DEFAULT 1, response_mode TEXT NOT NULL CHECK(response_mode IN ('ack','result')), default_profile TEXT, routing_policy TEXT NOT NULL CHECK(routing_policy IN ('default_as_fallback','drop')), settings_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL); CREATE TABLE IF NOT EXISTS application_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL); CREATE TABLE IF NOT EXISTS application_sessions (id TEXT PRIMARY KEY, application_slug TEXT NOT NULL, profile TEXT NOT NULL, session_prefix TEXT NOT NULL, session_id TEXT NOT NULL UNIQUE, session_date TEXT NOT NULL, sequence INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, last_message_at TEXT, message_count INTEGER NOT NULL DEFAULT 0, created_from_rollover INTEGER NOT NULL DEFAULT 0, last_identity_key TEXT, UNIQUE(application_slug, profile, session_prefix, session_date, sequence)); CREATE TABLE IF NOT EXISTS application_session_state (application_slug TEXT NOT NULL, profile TEXT NOT NULL, session_prefix TEXT NOT NULL, current_session_id TEXT NOT NULL, updated_at TEXT NOT NULL, reason TEXT NOT NULL, PRIMARY KEY(application_slug, profile, session_prefix)); CREATE TABLE IF NOT EXISTS application_identity_mappings (id TEXT PRIMARY KEY, application_slug TEXT NOT NULL, identity_key TEXT NOT NULL, profile TEXT NOT NULL, session_mode TEXT NOT NULL DEFAULT 'fixed', session_prefix TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(application_slug, identity_key)); CREATE TABLE IF NOT EXISTS application_automatic_prefixes (application_slug TEXT NOT NULL, identity_key TEXT NOT NULL, session_prefix TEXT NOT NULL, created_at TEXT NOT NULL, PRIMARY KEY(application_slug, identity_key), UNIQUE(application_slug, session_prefix));`); this.migrate(); }
+  constructor(path: string) { mkdirSync(dirname(path), { recursive: true }); this.db = new DatabaseSync(path); this.db.exec(`CREATE TABLE IF NOT EXISTS applications (id TEXT PRIMARY KEY, name TEXT NOT NULL, slug TEXT NOT NULL UNIQUE, enabled INTEGER NOT NULL DEFAULT 1, response_mode TEXT NOT NULL CHECK(response_mode IN ('ack','result')), default_profile TEXT, routing_policy TEXT NOT NULL CHECK(routing_policy IN ('default_as_fallback','drop')), settings_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL); CREATE TABLE IF NOT EXISTS application_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL); CREATE TABLE IF NOT EXISTS application_sessions (id TEXT PRIMARY KEY, application_slug TEXT NOT NULL, profile TEXT NOT NULL, session_prefix TEXT NOT NULL, session_id TEXT NOT NULL UNIQUE, session_date TEXT NOT NULL, sequence INTEGER NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, last_message_at TEXT, message_count INTEGER NOT NULL DEFAULT 0, created_from_rollover INTEGER NOT NULL DEFAULT 0, last_identity_key TEXT, UNIQUE(application_slug, profile, session_prefix, session_date, sequence)); CREATE TABLE IF NOT EXISTS application_session_state (application_slug TEXT NOT NULL, profile TEXT NOT NULL, session_prefix TEXT NOT NULL, current_session_id TEXT NOT NULL, updated_at TEXT NOT NULL, reason TEXT NOT NULL, PRIMARY KEY(application_slug, profile, session_prefix)); CREATE TABLE IF NOT EXISTS application_identity_mappings (id TEXT PRIMARY KEY, application_slug TEXT NOT NULL, identity_key TEXT NOT NULL, profile TEXT NOT NULL, session_mode TEXT NOT NULL DEFAULT 'fixed', session_prefix TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, UNIQUE(application_slug, identity_key)); CREATE TABLE IF NOT EXISTS application_automatic_prefixes (application_slug TEXT NOT NULL, identity_key TEXT NOT NULL, session_prefix TEXT NOT NULL, created_at TEXT NOT NULL, PRIMARY KEY(application_slug, identity_key), UNIQUE(application_slug, session_prefix)); CREATE TABLE IF NOT EXISTS application_console_sessions (session_id TEXT PRIMARY KEY, application_slug TEXT NOT NULL, profile TEXT NOT NULL, identity_key TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);`); this.migrate(); }
   private migrate() { const tables = new Set((this.db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all() as Row[]).map((row) => String(row.name))); if (tables.has("application_from_mappings")) { if (!tables.has("application_identity_mappings")) this.db.exec("ALTER TABLE application_from_mappings RENAME TO application_identity_mappings; ALTER TABLE application_identity_mappings RENAME COLUMN from_identifier TO identity_key;"); else this.db.exec("INSERT OR IGNORE INTO application_identity_mappings (id,application_slug,identity_key,profile,session_mode,session_prefix,created_at,updated_at) SELECT id,application_slug,from_identifier,profile,'fixed',session_prefix,created_at,updated_at FROM application_from_mappings; DROP TABLE application_from_mappings;"); } const columns = (table: string) => new Set((this.db.prepare(`PRAGMA table_info(${table})`).all() as Row[]).map((row) => String(row.name))); const mapping = columns("application_identity_mappings"); if (!mapping.has("session_mode")) this.db.exec("ALTER TABLE application_identity_mappings ADD COLUMN session_mode TEXT NOT NULL DEFAULT 'fixed';"); const sessions = columns("application_sessions"); if (sessions.has("last_from") && !sessions.has("last_identity_key")) this.db.exec("ALTER TABLE application_sessions RENAME COLUMN last_from TO last_identity_key;"); }
   private value(row: Row): ApplicationRecord { return { id: String(row.id), name: String(row.name), slug: String(row.slug), enabled: Boolean(row.enabled), responseMode: row.response_mode as "ack" | "result", defaultProfile: row.default_profile == null ? null : String(row.default_profile), routingPolicy: row.routing_policy as "default_as_fallback" | "drop", settings: JSON.parse(String(row.settings_json)), createdAt: String(row.created_at), updatedAt: String(row.updated_at) }; }
   list() { return (this.db.prepare("SELECT * FROM applications ORDER BY name").all() as Row[]).map((row) => this.value(row)); } get(slug: string) { const row = this.db.prepare("SELECT * FROM applications WHERE slug=?").get(slug) as Row | undefined; return row ? this.value(row) : undefined; }
   create(input: Pick<ApplicationRecord, "name" | "slug" | "enabled" | "responseMode" | "defaultProfile" | "routingPolicy" | "settings">) { const timestamp = now(), record = { ...input, id: randomUUID(), createdAt: timestamp, updatedAt: timestamp }; this.db.prepare("INSERT INTO applications VALUES (?,?,?,?,?,?,?,?,?,?)").run(record.id, record.name, record.slug, record.enabled ? 1 : 0, record.responseMode, record.defaultProfile, record.routingPolicy, JSON.stringify(record.settings), timestamp, timestamp); return this.get(record.slug)!; }
   update(slug: string, input: Omit<ApplicationRecord, "id" | "slug" | "createdAt" | "updatedAt">) { const result = this.db.prepare("UPDATE applications SET name=?,enabled=?,response_mode=?,default_profile=?,routing_policy=?,settings_json=?,updated_at=? WHERE slug=?").run(input.name, input.enabled ? 1 : 0, input.responseMode, input.defaultProfile, input.routingPolicy, JSON.stringify(input.settings), now(), slug); if (!result.changes) throw new Error("Application not found."); return this.get(slug)!; }
-  delete(slug: string) { if (!this.db.prepare("DELETE FROM applications WHERE slug=?").run(slug).changes) throw new Error("Application not found."); for (const table of ["application_sessions", "application_session_state", "application_identity_mappings", "application_automatic_prefixes"]) this.db.prepare(`DELETE FROM ${table} WHERE application_slug=?`).run(slug); }
+  delete(slug: string) { if (!this.db.prepare("DELETE FROM applications WHERE slug=?").run(slug).changes) throw new Error("Application not found."); for (const table of ["application_sessions", "application_session_state", "application_identity_mappings", "application_automatic_prefixes", "application_console_sessions"]) this.db.prepare(`DELETE FROM ${table} WHERE application_slug=?`).run(slug); }
   identityMapping(slug: string, identityKey: string) { const row = this.db.prepare("SELECT profile, session_mode, session_prefix FROM application_identity_mappings WHERE application_slug=? AND identity_key IN (?, '*') ORDER BY CASE identity_key WHEN '*' THEN 1 ELSE 0 END LIMIT 1").get(slug, identityKey) as Row | undefined; return row ? { profile: String(row.profile), sessionMode: String(row.session_mode) as "fixed" | "automatic", sessionPrefix: row.session_prefix == null ? null : String(row.session_prefix) } : undefined; }
   identityMappings(slug: string) { return (this.db.prepare("SELECT id, identity_key, profile, session_mode, session_prefix, created_at, updated_at FROM application_identity_mappings WHERE application_slug=? ORDER BY identity_key='*', identity_key").all(slug) as Row[]).map((row) => ({ id: String(row.id), identityKey: String(row.identity_key), profile: String(row.profile), sessionMode: String(row.session_mode), sessionPrefix: row.session_prefix == null ? null : String(row.session_prefix), createdAt: String(row.created_at), updatedAt: String(row.updated_at) })); }
   saveIdentityMapping(slug: string, identityKey: string, profile: string, sessionMode: "fixed" | "automatic", sessionPrefix: string | null) { const timestamp = now(), current = this.db.prepare("SELECT id FROM application_identity_mappings WHERE application_slug=? AND identity_key=?").get(slug, identityKey) as Row | undefined; if (current) this.db.prepare("UPDATE application_identity_mappings SET profile=?,session_mode=?,session_prefix=?,updated_at=? WHERE id=?").run(profile, sessionMode, sessionPrefix, timestamp, current.id); else this.db.prepare("INSERT INTO application_identity_mappings VALUES (?,?,?,?,?,?,?,?)").run(randomUUID(), slug, identityKey, profile, sessionMode, sessionPrefix, timestamp, timestamp); return this.identityMapping(slug, identityKey)!; }
@@ -26,5 +26,9 @@ export class ApplicationStore {
   touchSession(slug: string, profile: string, prefix: string, sessionId: string, identityKey?: string) { const timestamp = now(); this.db.prepare("UPDATE application_sessions SET updated_at=?,last_message_at=?,message_count=message_count+1,last_identity_key=COALESCE(?,last_identity_key) WHERE application_slug=? AND profile=? AND session_prefix=? AND session_id=?").run(timestamp, timestamp, identityKey ?? null, slug, profile, prefix, sessionId); this.db.prepare("UPDATE application_session_state SET updated_at=?,reason='message' WHERE application_slug=? AND profile=? AND session_prefix=?").run(timestamp, slug, profile, prefix); }
   activeSession(slug: string, profile: string, prefix: string) { return this.session(slug, profile, prefix); }
   removeActiveSession(slug: string, profile: string, sessionId: string) { const session = this.db.prepare("SELECT session_prefix FROM application_sessions WHERE application_slug=? AND profile=? AND session_id=?").get(slug, profile, sessionId) as Row | undefined; if (!session) throw Object.assign(new Error("Application session not found."), { status: 404 }); if (!this.db.prepare("DELETE FROM application_session_state WHERE application_slug=? AND profile=? AND session_prefix=? AND current_session_id=?").run(slug, profile, String(session.session_prefix), sessionId).changes) throw Object.assign(new Error("Application session is no longer active."), { status: 409 }); }
+  nextConsoleSessionId(application: string, identityKey: string) { const date = new Date().toISOString().slice(0, 10), hash = createHash("sha256").update(identityKey).digest("hex").slice(0, 12); const base = `console__app__${application}__${hash}__${date}`; const count = Number((this.db.prepare("SELECT COUNT(*) AS count FROM application_console_sessions WHERE application_slug=? AND identity_key=? AND created_at LIKE ?").get(application, identityKey, `${date}%`) as Row).count) + 1; return `${base}-${String(count).padStart(2, "0")}`; }
+  createConsoleSession(sessionId: string, application: string, profile: string, identityKey: string) { const timestamp = now(); this.db.prepare("INSERT INTO application_console_sessions VALUES (?,?,?,?,?,?)").run(sessionId, application, profile, identityKey, timestamp, timestamp); return this.consoleSession(profile, sessionId)!; }
+  consoleSession(profile: string, sessionId: string) { const row = this.db.prepare("SELECT * FROM application_console_sessions WHERE profile=? AND session_id=?").get(profile, sessionId) as Row | undefined; return row ? { sessionId: String(row.session_id), application: String(row.application_slug), profile: String(row.profile), identityKey: String(row.identity_key), createdAt: String(row.created_at), updatedAt: String(row.updated_at) } : undefined; }
+  deleteConsoleSession(profile: string, sessionId: string) { this.db.prepare("DELETE FROM application_console_sessions WHERE profile=? AND session_id=?").run(profile, sessionId); }
   activeSessions(filters: { profile?: string; application?: string; identityKey?: string; prefix?: string; session?: string } = {}) { const clauses: string[] = [], values: string[] = []; const like = (column: string, value?: string) => { if (value?.trim()) { clauses.push(`${column} LIKE ?`); values.push(`%${value.trim()}%`); } }; like("st.profile", filters.profile); like("s.application_slug", filters.application); like("COALESCE(s.last_identity_key,'')", filters.identityKey); like("s.session_prefix", filters.prefix); like("s.session_id", filters.session); const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : ""; return (this.db.prepare(`SELECT s.*,st.reason FROM application_session_state st JOIN application_sessions s ON s.session_id=st.current_session_id ${where} ORDER BY st.updated_at DESC`).all(...values) as Row[]).map((row) => ({ ...this.sessionValue(row), reason: String(row.reason) })); }
 }

package/extensions/api-server/profile-store.ts

@@ -8,7 +8,8 @@ export const RESOURCE_KINDS = ["tools", "skills", "extensions"] as const;
 export type ResourceKind = typeof RESOURCE_KINDS[number];
 type PolicyKey = "enabledTools" | "enabledSkills" | "enabledProfileSkills" | "enabledExtensions";
 type SkillSources = { shared?: boolean; profile?: boolean };
-type ProfilePolicy = Partial<Record<PolicyKey, string[]>> & { skillSources?: SkillSources };
+type SkillResourceSource = "shared" | "profile" | "package";
+type ProfilePolicy = Partial<Record<PolicyKey, string[]>> & { skillSources?: SkillSources; contextMemory?: { mode: "file"; target: "profile" | "identity" } | { mode: "handler"; handler: string } };
 export type ProfileSettings = Record<string, unknown> & { profile?: ProfilePolicy; sandbox?: boolean };
 export type Resource = { name: string; kind: ResourceKind; path?: string; source: "builtin" | "shared" | "profile" | "extension" | "package"; package?: string; enabled: boolean; protected?: boolean };
 export type Package = { name: string; version?: string; description?: string; enabled: boolean; installed: boolean };
@@ -22,12 +23,23 @@ const policyKey: Record<ResourceKind, PolicyKey> = {
 const protectedExtensions = new Set(["profiles", "api-server"]);
 
 export class ProfileStore {
-  private readonly extensionTools = new Set<string>();
+  private readonly extensionTools = new Map<string, Set<string>>();
 
   constructor(readonly agentDir: string) {}
 
-  registerExtensionTools(names: Iterable<string>): void {
-    for (const name of names) if (name && !BUILTIN_TOOLS.includes(name)) this.extensionTools.add(name);
+  registerExtensionTools(profile: string, names: Iterable<string>): void {
+    const tools = this.extensionTools.get(profile) ?? new Set<string>();
+    for (const name of names) if (name && !BUILTIN_TOOLS.includes(name)) tools.add(name);
+    this.extensionTools.set(profile, tools);
+  }
+
+  extensionToolNames(profile: string): Iterable<string> {
+    return this.extensionTools.get(profile) ?? [];
+  }
+
+  clearExtensionTools(profile?: string): void {
+    if (profile) this.extensionTools.delete(profile);
+    else this.extensionTools.clear();
   }
 
   private profilesDir(): string { return join(this.agentDir, "profiles"); }
@@ -99,14 +111,26 @@ export class ProfileStore {
     return !path || !exclusions.includes(`!${path}`);
   }
 
-  private async skillResources(profile: string, settings: ProfileSettings): Promise<Resource[]> {
+  private async packageSkillResources(settings: ProfileSettings): Promise<Resource[]> {
+    const resources: Resource[] = [];
+    for (const pkg of await this.configuredPackages(settings)) {
+      for (const entry of Array.isArray(pkg.manifest?.pi?.skills) ? pkg.manifest.pi.skills : []) {
+        if (typeof entry !== "string") continue;
+        for (const skill of await this.skillNames(join(pkg.base, entry))) resources.push({ name: skill.name, kind: "skills", path: skill.path, source: "package", package: pkg.name, enabled: this.skillEnabled(settings, "package", skill.name) });
+      }
+    }
+    return resources;
+  }
+
+  private async skillResources(profile: string, settings: ProfileSettings, runtimeSettings: ProfileSettings = settings): Promise<Resource[]> {
     const sources = this.skillSources(profile, settings);
     const entries = await Promise.all((["profile", "shared"] as const).filter((source) => sources[source]).map(async (source) => ({ source, entries: await this.skillNames(this.skillBase(profile, source)) })));
-    return entries.flatMap(({ source, entries }) => entries.map(({ name, path }) => ({ name, kind: "skills" as const, path, source, enabled: this.skillEnabled(settings, source, name) })));
+    const local = entries.flatMap(({ source, entries }) => entries.map(({ name, path }) => ({ name, kind: "skills" as const, path, source, enabled: this.skillEnabled(settings, source, name) })));
+    return [...local, ...(sources.shared ? await this.packageSkillResources(runtimeSettings) : [])];
   }
 
-  private skillEnabled(settings: ProfileSettings, source: "shared" | "profile", name: string): boolean {
-    const values = settings.profile?.[source === "shared" ? "enabledSkills" : "enabledProfileSkills"];
+  private skillEnabled(settings: ProfileSettings, source: SkillResourceSource, name: string): boolean {
+    const values = settings.profile?.[source === "profile" ? "enabledProfileSkills" : "enabledSkills"];
     return !values || values.includes("*") || values.includes(name);
   }
 
@@ -120,12 +144,12 @@ export class ProfileStore {
     return join(this.agentDir, "git", remote);
   }
 
-  private async configuredPackages(settings: ProfileSettings): Promise<Array<{ source: string; base: string; name: string; manifest?: { version?: string; description?: string; pi?: { extensions?: unknown } } }>> {
+  private async configuredPackages(settings: ProfileSettings): Promise<Array<{ source: string; base: string; name: string; manifest?: { version?: string; description?: string; pi?: { extensions?: unknown; skills?: unknown } } }>> {
     const sources = Array.isArray(settings.packages) ? settings.packages.filter((value): value is string => typeof value === "string") : [];
-    const packages: Array<{ source: string; base: string; name: string; manifest?: { version?: string; description?: string; pi?: { extensions?: unknown } } }> = [];
+    const packages: Array<{ source: string; base: string; name: string; manifest?: { version?: string; description?: string; pi?: { extensions?: unknown; skills?: unknown } } }> = [];
     for (const source of sources) {
       const base = this.packageBase(source); if (!base) continue;
-      try { const manifest = JSON.parse(await readFile(join(base, "package.json"), "utf8")) as { name?: string; version?: string; description?: string; pi?: { extensions?: unknown } }; packages.push({ source, base, name: manifest.name ?? source, manifest }); }
+      try { const manifest = JSON.parse(await readFile(join(base, "package.json"), "utf8")) as { name?: string; version?: string; description?: string; pi?: { extensions?: unknown; skills?: unknown } }; packages.push({ source, base, name: manifest.name ?? source, manifest }); }
       catch { packages.push({ source, base, name: source.replace(/^npm:/, "") }); }
     }
     return packages;
@@ -168,23 +192,25 @@ export class ProfileStore {
   async resources(profile: string, kind: ResourceKind): Promise<Resource[]> {
     const settings = await this.readSettings(profile);
     const runtimeSettings = profile === "default" ? settings : await this.readSettings("default");
-    if (kind === "skills") return this.skillResources(profile, settings);
+    if (kind === "skills") return this.skillResources(profile, settings, runtimeSettings);
     if (kind === "tools") {
-      const sources = await this.packageToolSources(runtimeSettings, this.extensionTools);
-      const names = new Set([...this.extensionTools, ...sources.keys()]);
+      const extensionTools = this.extensionToolNames(profile);
+      const sources = await this.packageToolSources(runtimeSettings, extensionTools);
+      const names = new Set([...extensionTools, ...sources.keys()]);
       return [...BUILTIN_TOOLS.map((name) => ({ name, kind, source: "builtin" as const, enabled: this.enabled(settings, kind, name) })), ...[...names].sort().map((name) => sources.has(name) ? ({ name, kind, source: "package" as const, package: sources.get(name), enabled: this.enabled(settings, kind, name) }) : ({ name, kind, source: "extension" as const, enabled: this.enabled(settings, kind, name) }))];
     }
-    return [...(await this.names("extensions")).map(({ name, path }) => ({ name, kind, path, source: "shared" as const, enabled: protectedExtensions.has(name) ? true : this.enabled(runtimeSettings, kind, name, path), protected: protectedExtensions.has(name) || undefined })), ...(await this.packageExtensions(runtimeSettings)).map(({ name, path, package: packageName }) => ({ name, kind, path, source: "package" as const, package: packageName, enabled: true }))];
+    return [...(await this.names("extensions")).map(({ name, path }) => ({ name, kind, path, source: "shared" as const, enabled: protectedExtensions.has(name) ? true : this.enabled(runtimeSettings, kind, name, path), protected: protectedExtensions.has(name) || undefined })), ...(await this.packageExtensions(runtimeSettings)).map(({ name, path, package: packageName }) => ({ name, kind, path, source: "package" as const, package: packageName, enabled: protectedExtensions.has(name) ? true : this.enabled(runtimeSettings, kind, name, path), protected: protectedExtensions.has(name) || undefined }))];
   }
 
-  async resource(profile: string, kind: ResourceKind, name: string, source?: "shared" | "profile"): Promise<Resource> {
+  async resource(profile: string, kind: ResourceKind, name: string, source?: SkillResourceSource): Promise<Resource> {
     const resource = (await this.resources(profile, kind)).find((item) => item.name === name && (!source || item.source === source));
     if (!resource) throw Object.assign(new Error("Resource not found"), { status: 404 });
     return resource;
   }
 
   private async skillPaths(name: string, settings: ProfileSettings): Promise<string[]> {
-    return (await this.skillResources(name, settings)).filter((skill) => skill.enabled).map((skill) => skill.path!).filter(Boolean);
+    const runtimeSettings = name === "default" ? settings : await this.readSettings("default");
+    return (await this.skillResources(name, settings, runtimeSettings)).filter((skill) => skill.enabled).map((skill) => skill.path!).filter(Boolean);
   }
 
   private async materializeResources(name: string, settings: ProfileSettings): Promise<ProfileSettings> {
@@ -232,7 +258,7 @@ export class ProfileStore {
     return this.skillSources(profile, settings);
   }
 
-  async readSkillDocument(profile: string, name: string, source?: "shared" | "profile"): Promise<{ name: string; frontmatter: Record<string, string>; content: string }> {
+  async readSkillDocument(profile: string, name: string, source?: SkillResourceSource): Promise<{ name: string; frontmatter: Record<string, string>; content: string }> {
     const skill = await this.resource(profile, "skills", name, source);
     if (!skill.path) throw Object.assign(new Error("Skill document not found"), { status: 404 });
     const document = await readFile(join(skill.path, "SKILL.md"), "utf8");
@@ -247,7 +273,7 @@ export class ProfileStore {
     return { name, frontmatter, content: match ? document.slice(match[0].length) : document };
   }
 
-  async setResource(profile: string, kind: ResourceKind, name: string, enabled: boolean, source?: "shared" | "profile"): Promise<Resource> {
+  async setResource(profile: string, kind: ResourceKind, name: string, enabled: boolean, source?: SkillResourceSource): Promise<Resource> {
     const current = await this.resource(profile, kind, name, source);
     if (current.protected && !enabled) throw Object.assign(new Error("This extension is required and cannot be disabled."), { status: 422 });
     // Extensions are shared runtime resources, so toggling one always updates
@@ -264,8 +290,9 @@ export class ProfileStore {
     return this.resource(profile, kind, name, source);
   }
 
-  async deleteSkill(profile: string, name: string, source?: "shared" | "profile"): Promise<void> {
+  async deleteSkill(profile: string, name: string, source?: SkillResourceSource): Promise<void> {
     const current = await this.resource(profile, "skills", name, source);
+    if (current.source === "package") throw Object.assign(new Error("Package Skills cannot be deleted here."), { status: 403 });
     if (current.source === "shared" && profile !== "default") { await this.setResource(profile, "skills", name, false, "shared"); return; }
     if (!current.path) throw Object.assign(new Error("Skill path not found."), { status: 404 });
     await rm(current.path, { recursive: true, force: false });