pi-inspect 0.3.0 → 0.5.0

package/README.md

@@ -31,6 +31,14 @@ Then use `/inspect start | stop | restart | status | open | list | snapshot` fro
 
 State is driven entirely through the `?session=` URL param — share or refresh URLs to pin views. The in-page picker also writes to the URL.
 
+## Sharing a snapshot
+
+Click **Share** in the topbar to copy a self-contained link of the current snapshot. The snapshot is `deflate-raw` compressed and base64url-encoded into the URL hash (`#s=…`) — no server, no upload, no account.
+
+Recipients open the link on the hosted static dashboard at **https://nikiforovall.blog/pi-inspect/** and see the exact same tools / commands / skills / system prompt. The page makes no network requests; everything is in the URL.
+
+Heads up: the link includes the system prompt and `cwd`. Don't share secrets you wouldn't paste in chat.
+
 ## What it captures
 
 - **Tools** — name, description, parameter schema, source

package/extensions/inspect.ts

@@ -1,10 +1,31 @@
 import { spawn, spawnSync, type ChildProcess } from "node:child_process";
-import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import {
+	mkdirSync,
+	readdirSync,
+	readFileSync,
+	renameSync,
+	statSync,
+	unlinkSync,
+	watch as fsWatch,
+	writeFileSync,
+	type FSWatcher,
+} from "node:fs";
 import { createConnection } from "node:net";
 import { homedir } from "node:os";
-import { join as joinPath, resolve as resolvePath } from "node:path";
+import {
+	dirname,
+	join as joinPath,
+	relative as relativePath,
+	resolve as resolvePath,
+} from "node:path";
 import { fileURLToPath } from "node:url";
-import { type ExtensionAPI, parseFrontmatter } from "@earendil-works/pi-coding-agent";
+import {
+	DefaultPackageManager,
+	type ExtensionAPI,
+	parseFrontmatter,
+	type ResolvedResource,
+	SettingsManager,
+} from "@earendil-works/pi-coding-agent";
 
 const extDir = fileURLToPath(new URL(".", import.meta.url));
 const port = 5462;
@@ -13,6 +34,8 @@ const url = `http://localhost:${port}`;
 const INSPECT_DIR = joinPath(homedir(), ".pi", "agent", "inspect");
 const SNAP_DIR = joinPath(INSPECT_DIR, "snapshots");
 const INDEX_PATH = joinPath(SNAP_DIR, "index.json");
+const REQ_DIR = joinPath(INSPECT_DIR, "requests");
+const REQ_STALE_MS = 60 * 60 * 1000; // 1 hour
 
 let child: ChildProcess | null = null;
 let lastStderr = "";
@@ -100,7 +123,7 @@ function writeSnapshot(id: string, snapshot: unknown): void {
 	writeFileSync(joinPath(SNAP_DIR, `${sanitize(id)}.json`), JSON.stringify(snapshot, null, 2), "utf8");
 }
 
-type DisabledKind = "command" | "skill" | "extension" | "theme";
+type DisabledKind = "command" | "prompt" | "skill" | "extension" | "theme";
 type DisabledScope = "user" | "project";
 type DisabledItem = {
 	kind: DisabledKind;
@@ -112,29 +135,23 @@ type DisabledItem = {
 	settingsPath: string;
 	path: string;
 	reason: string;
+	resourceKind: ResourceKind;
+	baseDir: string;
 };
 
 const AGENT_DIR = joinPath(homedir(), ".pi", "agent");
 const SETTINGS_PATH = joinPath(AGENT_DIR, "settings.json");
-const NPM_ROOT = joinPath(AGENT_DIR, "npm", "node_modules");
 
-type FilterKind = "prompts" | "skills" | "extensions" | "themes";
-const FILTER_KINDS: readonly FilterKind[] = ["prompts", "skills", "extensions", "themes"];
+type ResourceKind = "skills" | "prompts" | "extensions" | "themes";
+const RESOURCE_KINDS: readonly ResourceKind[] = ["skills", "prompts", "extensions", "themes"];
 
-const KIND_CFG: Record<FilterKind, { kind: DisabledKind; stripExt: RegExp; display: (n: string) => string }> = {
-	prompts:    { kind: "command",   stripExt: /\.md$/i,                  display: (n) => `/${n}` },
-	skills:     { kind: "skill",     stripExt: /\.md$/i,                  display: (n) => `/skill:${n}` },
-	extensions: { kind: "extension", stripExt: /\.(ts|js|mjs|cjs)$/i,     display: (n) => n },
-	themes:     { kind: "theme",     stripExt: /\.(json|toml|ya?ml)$/i,   display: (n) => n },
+const KIND_MAP: Record<ResourceKind, { kind: DisabledKind; display: (n: string) => string }> = {
+	prompts:    { kind: "prompt",    display: (n) => `/${n}` },
+	skills:     { kind: "skill",     display: (n) => `/skill:${n}` },
+	extensions: { kind: "extension", display: (n) => n },
+	themes:     { kind: "theme",     display: (n) => n },
 };
 
-function resolvePackageRoot(source: string): string | null {
-	if (source.startsWith("npm:")) return joinPath(NPM_ROOT, source.slice(4));
-	let s = source.replace(/\\/g, "/");
-	if (s.startsWith("~/")) s = joinPath(homedir(), s.slice(2));
-	try { return statSync(s).isDirectory() ? s : null; } catch { return null; }
-}
-
 function sourceLabel(source: string): string {
 	if (source.startsWith("npm:")) return source.slice(4);
 	const norm = source.replace(/\\/g, "/").replace(/\/$/, "");
@@ -143,8 +160,7 @@ function sourceLabel(source: string): string {
 
 const describeCache = new Map<string, { mtimeMs: number; desc: string }>();
 
-function describeFrom(filePath: string, isDir: boolean): string {
-	const path = isDir ? joinPath(filePath, "SKILL.md") : filePath;
+function describeFromPath(path: string): string {
 	let mtimeMs: number;
 	try { mtimeMs = statSync(path).mtimeMs; } catch { return ""; }
 	const cached = describeCache.get(path);
@@ -160,102 +176,235 @@ function describeFrom(filePath: string, isDir: boolean): string {
 	return desc;
 }
 
-function nameFromRel(filterKind: FilterKind, rel: string): string {
-	const base = rel.split("/").pop() ?? rel;
-	if (filterKind === "skills" && /SKILL\.md$/i.test(base)) {
-		const parent = rel.replace(/\/SKILL\.md$/i, "").split("/").pop();
-		return parent ?? base;
+function nameFromPath(kind: ResourceKind, path: string): string {
+	const norm = path.replace(/\\/g, "/");
+	const base = norm.split("/").pop() ?? norm;
+	if (kind === "skills" && /^SKILL\.md$/i.test(base)) {
+		const parts = norm.split("/");
+		return parts[parts.length - 2] ?? base;
 	}
-	return base.replace(KIND_CFG[filterKind].stripExt, "");
+	return base.replace(/\.(md|ts|js|mjs|cjs|json|toml|ya?ml)$/i, "");
 }
 
-type GroupCtx = {
-	root: string;
-	label: string;
-	scope: DisabledScope;
-	settingsPath: string;
-};
-
-function pushDisabled(
-	items: DisabledItem[],
-	filterKind: FilterKind,
-	raw: unknown,
-	ctx: GroupCtx,
-): void {
-	if (typeof raw !== "string" || !raw.startsWith("-")) return;
-	const rel = raw.slice(1).replace(/\\/g, "/");
-	const filePath = joinPath(ctx.root, rel);
-	let isDir = false;
-	try { isDir = statSync(filePath).isDirectory(); } catch { return; }
-	const cfg = KIND_CFG[filterKind];
-	const name = nameFromRel(filterKind, rel);
-	items.push({
+function buildItemFromResource(
+	kind: ResourceKind,
+	r: ResolvedResource,
+	sessionCwd: string,
+): DisabledItem {
+	const md = r.metadata;
+	const scope: DisabledScope = md.scope === "project" ? "project" : "user";
+	const label = md.origin === "package" ? sourceLabel(md.source) : scope;
+	const name = nameFromPath(kind, r.path);
+	const cfg = KIND_MAP[kind];
+	return {
 		kind: cfg.kind,
 		name,
 		displayName: cfg.display(name),
-		description: describeFrom(filePath, isDir),
-		source: ctx.label,
-		scope: ctx.scope,
-		settingsPath: ctx.settingsPath,
-		path: filePath,
-		reason: raw,
-	});
+		description: describeFromPath(r.path),
+		source: label,
+		scope,
+		settingsPath: scope === "project" ? joinPath(sessionCwd, ".pi", "settings.json") : SETTINGS_PATH,
+		path: r.path,
+		reason: md.source,
+		resourceKind: kind,
+		baseDir: md.baseDir ?? AGENT_DIR,
+	};
 }
 
-function collectGroup(items: DisabledItem[], group: any, ctx: GroupCtx): void {
-	for (const filterKind of FILTER_KINDS) {
-		const arr = group?.[filterKind];
-		if (!Array.isArray(arr)) continue;
-		for (const raw of arr) pushDisabled(items, filterKind, raw, ctx);
+type ResourceListing = { disabled: DisabledItem[]; pending: DisabledItem[] };
+
+async function discoverFromPackages(
+	cwd: string | null,
+	activePaths: Set<string>,
+): Promise<ResourceListing> {
+	const sessionCwd = cwd ?? process.cwd();
+	const sm = SettingsManager.create(sessionCwd, AGENT_DIR);
+	const pm = new DefaultPackageManager({ cwd: sessionCwd, agentDir: AGENT_DIR, settingsManager: sm });
+	let resolved;
+	try {
+		resolved = await pm.resolve(async () => "skip");
+	} catch (e: any) {
+		console.warn(`pi-inspect: package resolve failed: ${e?.message ?? e}`);
+		return { disabled: [], pending: [] };
+	}
+
+	const disabledByPath = new Map<string, DisabledItem>();
+	const pendingByPath = new Map<string, DisabledItem>();
+	// Pending detection only makes sense for resources with a 1:1 path→command mapping.
+	// Extensions register tools at different paths, themes don't appear as commands at all.
+	const PENDABLE: ReadonlySet<ResourceKind> = new Set(["skills", "prompts"]);
+	for (const kind of RESOURCE_KINDS) {
+		const list = resolved[kind] as ResolvedResource[];
+		for (const r of list) {
+			const item = buildItemFromResource(kind, r, sessionCwd);
+			if (!r.enabled) {
+				disabledByPath.set(r.path, item);
+			} else if (
+				PENDABLE.has(kind) &&
+				!activePaths.has(r.path.replace(/\\/g, "/").toLowerCase())
+			) {
+				// Resolved-enabled but pi's boot-frozen command map doesn't have it yet.
+				pendingByPath.set(r.path, item);
+			}
+		}
 	}
+	return { disabled: [...disabledByPath.values()], pending: [...pendingByPath.values()] };
 }
 
-const settingsCache = new Map<string, { mtimeMs: number; items: DisabledItem[] }>();
+type ToggleRequest = {
+	id: string;
+	ts: number;
+	action: "enable" | "disable";
+	resourceKind: ResourceKind;
+	path: string;
+	scope: DisabledScope;
+};
 
-function readDisabledFrom(
-	settingsPath: string,
-	baseDir: string,
-	scope: DisabledScope,
-): DisabledItem[] {
-	let mtimeMs: number;
-	try { mtimeMs = statSync(settingsPath).mtimeMs; } catch { return []; }
-	const cached = settingsCache.get(settingsPath);
-	if (cached && cached.mtimeMs === mtimeMs) return cached.items;
-
-	let settings: any;
-	try { settings = JSON.parse(readFileSync(settingsPath, "utf8")); } catch { return []; }
-	const items: DisabledItem[] = [];
-
-	collectGroup(items, settings, { root: baseDir, label: scope, scope, settingsPath });
-
-	const packages = Array.isArray(settings?.packages) ? settings.packages : [];
-	for (const entry of packages) {
-		if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
-		const source = String(entry.source ?? "");
-		if (!source) continue;
-		const root = resolvePackageRoot(source);
-		if (!root) continue;
-		collectGroup(items, entry, { root, label: sourceLabel(source), scope, settingsPath });
+function normPath(p: string): string {
+	return resolvePath(p).replace(/\\/g, "/").toLowerCase();
+}
+
+function ensureReqDir(): void {
+	mkdirSync(REQ_DIR, { recursive: true });
+}
+
+function sweepStaleRequests(): void {
+	let entries: string[];
+	try { entries = readdirSync(REQ_DIR); } catch { return; }
+	const now = Date.now();
+	for (const f of entries) {
+		const full = joinPath(REQ_DIR, f);
+		try {
+			const st = statSync(full);
+			if (now - st.mtimeMs > REQ_STALE_MS) unlinkSync(full);
+		} catch {}
 	}
-	settingsCache.set(settingsPath, { mtimeMs, items });
-	return items;
 }
 
-function discoverDisabledFromPackages(cwd: string | null): DisabledItem[] {
-	const scopes: { settings: string; base: string; scope: DisabledScope }[] = [
-		{ settings: SETTINGS_PATH, base: AGENT_DIR, scope: "user" },
-	];
-	if (cwd) scopes.push({ settings: joinPath(cwd, ".pi", "settings.json"), base: joinPath(cwd, ".pi"), scope: "project" });
+// Mirrors the toggle logic in pi-coding-agent's ConfigSelectorComponent
+// (modes/interactive/components/config-selector.js). Strips any existing
+// `+`/`-`/`!` entries for the pattern, then appends the new one.
+function applyPattern(arr: string[], pattern: string, enabled: boolean): string[] {
+	const filtered = arr.filter((p) => {
+		const stripped = p.startsWith("!") || p.startsWith("+") || p.startsWith("-") ? p.slice(1) : p;
+		return stripped !== pattern;
+	});
+	filtered.push(enabled ? `+${pattern}` : `-${pattern}`);
+	return filtered;
+}
+
+async function processToggleRequest(req: ToggleRequest, sessionCwd: string): Promise<void> {
+	const sm = SettingsManager.create(sessionCwd, AGENT_DIR);
+	const pm = new DefaultPackageManager({ cwd: sessionCwd, agentDir: AGENT_DIR, settingsManager: sm });
+	const resolved = await pm.resolve(async () => "skip");
+	const list = resolved[req.resourceKind] as ResolvedResource[];
+	const target = list.find((r) => normPath(r.path) === normPath(req.path));
+	if (!target) throw new Error(`resource not in resolution: ${req.path}`);
+	const md = target.metadata;
+	const enabled = req.action === "enable";
+	const scope: DisabledScope = md.scope === "project" ? "project" : "user";
+
+	if (md.origin === "package") {
+		const baseDir = md.baseDir ?? dirname(target.path);
+		const pattern = relativePath(baseDir, target.path);
+		const settings = scope === "project" ? sm.getProjectSettings() : sm.getGlobalSettings();
+		const packages = [...(settings.packages ?? [])];
+		const idx = packages.findIndex((p) => (typeof p === "string" ? p : p.source) === md.source);
+		if (idx < 0) throw new Error(`package not found in settings: ${md.source}`);
+		let pkg = packages[idx];
+		if (typeof pkg === "string") {
+			pkg = { source: pkg };
+			packages[idx] = pkg;
+		}
+		const arrayKey = req.resourceKind as keyof typeof pkg & ("extensions" | "skills" | "prompts" | "themes");
+		const current = ((pkg as any)[arrayKey] as string[] | undefined) ?? [];
+		const updated = applyPattern(current, pattern, enabled);
+		(pkg as any)[arrayKey] = updated.length > 0 ? updated : undefined;
+		const hasFilters = (["extensions", "skills", "prompts", "themes"] as const).some(
+			(k) => (pkg as any)[k] !== undefined,
+		);
+		if (!hasFilters) packages[idx] = (pkg as any).source;
+		if (scope === "project") sm.setProjectPackages(packages);
+		else sm.setPackages(packages);
+		await sm.flush();
+		return;
+	}
+
+	// top-level
+	const baseDir = scope === "project" ? joinPath(sessionCwd, ".pi") : AGENT_DIR;
+	const pattern = relativePath(baseDir, target.path);
+	const settings = scope === "project" ? sm.getProjectSettings() : sm.getGlobalSettings();
+	const current = ((settings as any)[req.resourceKind] as string[] | undefined) ?? [];
+	const updated = applyPattern(current, pattern, enabled);
+	const setters: Record<ResourceKind, { user: string; project: string }> = {
+		skills:     { user: "setSkillPaths",          project: "setProjectSkillPaths" },
+		prompts:    { user: "setPromptTemplatePaths", project: "setProjectPromptTemplatePaths" },
+		extensions: { user: "setExtensionPaths",      project: "setProjectExtensionPaths" },
+		themes:     { user: "setThemePaths",          project: "setProjectThemePaths" },
+	};
+	(sm as any)[setters[req.resourceKind][scope]](updated);
+	await sm.flush();
+}
+
+let lastCtx: any = null;
+let reqWatcher: FSWatcher | null = null;
+const recentlyHandled = new Set<string>();
+
+async function handleRequestFile(full: string): Promise<void> {
+	if (recentlyHandled.has(full)) return;
+	recentlyHandled.add(full);
+	setTimeout(() => recentlyHandled.delete(full), 5000);
+
+	let raw: string;
+	try { raw = readFileSync(full, "utf8"); } catch { return; }
+	if (!raw.trim()) return;
+	let req: ToggleRequest;
+	try { req = JSON.parse(raw) as ToggleRequest; } catch (e: any) {
+		console.warn(`pi-inspect: bad request file ${full}: ${e?.message ?? e}`);
+		try { renameSync(full, `${full}.err.json`); } catch {}
+		return;
+	}
+
+	const cwd = lastCtx?.sessionManager?.getCwd?.() ?? process.cwd();
+	try {
+		await processToggleRequest(req, cwd);
+		try { unlinkSync(full); } catch {}
+		if (lastCtx) await captureSnapshot(lastCtx);
+	} catch (e: any) {
+		console.warn(`pi-inspect: toggle failed: ${e?.message ?? e}`);
+		try {
+			writeFileSync(`${full}.err.json`, JSON.stringify({ error: e?.message ?? String(e), req }, null, 2));
+			unlinkSync(full);
+		} catch {}
+	}
+}
 
-	// Project overrides user when both disable the same path.
-	const byPath = new Map<string, DisabledItem>();
-	for (const { settings, base, scope } of scopes) {
-		for (const it of readDisabledFrom(settings, base, scope)) byPath.set(it.path, it);
+function setupRequestWatcher(): void {
+	ensureReqDir();
+	sweepStaleRequests();
+	// Drain orphans at startup
+	try {
+		for (const f of readdirSync(REQ_DIR)) {
+			if (f.endsWith(".err.json") || !f.endsWith(".json")) continue;
+			void handleRequestFile(joinPath(REQ_DIR, f));
+		}
+	} catch {}
+	if (reqWatcher) return;
+	try {
+		reqWatcher = fsWatch(REQ_DIR, (_event, filename) => {
+			if (!filename) return;
+			const name = String(filename);
+			if (!name.endsWith(".json") || name.endsWith(".err.json")) return;
+			const full = joinPath(REQ_DIR, name);
+			try { statSync(full); } catch { return; }
+			void handleRequestFile(full);
+		});
+	} catch (e: any) {
+		console.warn(`pi-inspect: request watcher failed: ${e?.message ?? e}`);
 	}
-	return [...byPath.values()];
 }
 
-function captureSnapshot(ctx: any): { id: string; entry: IndexEntry } | null {
+async function captureSnapshot(ctx: any): Promise<{ id: string; entry: IndexEntry } | null> {
 	const sm = ctx.sessionManager;
 	const id = sm?.getSessionId?.();
 	if (!id) return null;
@@ -267,9 +416,18 @@ function captureSnapshot(ctx: any): { id: string; entry: IndexEntry } | null {
 	const commands = typeof pi?.getCommands === "function" ? pi.getCommands() : [];
 	const tools = typeof pi?.getAllTools === "function" ? pi.getAllTools() : [];
 	const activeTools = typeof pi?.getActiveTools === "function" ? pi.getActiveTools() : [];
-	const disabledItems = discoverDisabledFromPackages(cwd);
+	const activePaths = new Set<string>();
+	for (const c of commands) {
+		const p = c?.sourceInfo?.path;
+		if (typeof p === "string") activePaths.add(p.replace(/\\/g, "/").toLowerCase());
+	}
+	for (const t of tools) {
+		const p = t?.sourceInfo?.path;
+		if (typeof p === "string") activePaths.add(p.replace(/\\/g, "/").toLowerCase());
+	}
+	const { disabled: disabledItems, pending: pendingItems } = await discoverFromPackages(cwd, activePaths);
 	const capturedAt = Date.now();
-	const snap = { sessionId: id, sessionName: name, cwd, model, systemPrompt, commands, tools, activeTools, disabledItems, capturedAt };
+	const snap = { sessionId: id, sessionName: name, cwd, model, systemPrompt, commands, tools, activeTools, disabledItems, pendingItems, capturedAt };
 	try {
 		writeSnapshot(id, snap);
 		upsertIndex({ id, cwd, name, model, capturedAt });
@@ -339,13 +497,16 @@ function showHelp(notify: (m: string, l?: "info" | "error") => void) {
 
 export default function inspectExtension(pi: ExtensionAPI) {
 	piRef = pi;
+	setupRequestWatcher();
 	pi.on("session_start", async (_event, ctx) => {
-		captureSnapshot(ctx);
+		lastCtx = ctx;
+		await captureSnapshot(ctx);
 	});
 	// session_start fires before all extensions register their tools/commands.
 	// before_agent_start fires after the user's first prompt with the fully assembled state — re-capture then.
 	pi.on("before_agent_start", async (_event, ctx) => {
-		captureSnapshot(ctx);
+		lastCtx = ctx;
+		await captureSnapshot(ctx);
 	});
 
 	pi.registerCommand("inspect", {
@@ -363,6 +524,7 @@ export default function inspectExtension(pi: ExtensionAPI) {
 			return SUBCOMMANDS.filter((s) => s.startsWith(prefix)).map((s) => ({ value: s, label: s }));
 		},
 		handler: async (args, ctx) => {
+			lastCtx = ctx;
 			const notify = (m: string, l: "info" | "error" = "info") => ctx.ui.notify(m, l);
 			const tokens = args.trim().split(/\s+/).filter(Boolean);
 			const first = tokens[0] as Sub | string | undefined;
@@ -382,7 +544,7 @@ export default function inspectExtension(pi: ExtensionAPI) {
 
 			if (first === "start") {
 				if (!(await startServer(notify))) return;
-				captureSnapshot(ctx);
+				await captureSnapshot(ctx);
 				notify(`pi-inspect started → ${url}`);
 				return;
 			}
@@ -407,7 +569,7 @@ export default function inspectExtension(pi: ExtensionAPI) {
 			}
 
 			if (first === "snapshot") {
-				const r = captureSnapshot(ctx);
+				const r = await captureSnapshot(ctx);
 				notify(r ? `snapshot captured: ${r.id}` : "no active session to snapshot", r ? "info" : "error");
 				return;
 			}
@@ -417,7 +579,7 @@ export default function inspectExtension(pi: ExtensionAPI) {
 			const openTarget = (isExplicitOpen ? (tokens[1] ?? "web") : "web") as "web" | "app";
 
 			if (!(await startServer(notify))) return;
-			captureSnapshot(ctx);
+			await captureSnapshot(ctx);
 
 			let openId: string | null = null;
 			if (!isExplicitOpen && first && !(SUBCOMMANDS as readonly string[]).includes(first)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-inspect",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Introspection dashboard for the pi coding agent — tools, slash commands, skills, and the system prompt injected on init.",
   "keywords": [
     "pi-package",

package/public/app.js

@@ -10,6 +10,7 @@ const state = {
   expandAll: true,
   highlight: -1,
   visibleRows: [],
+  staticMode: false,
 };
 const els = {};
 
@@ -122,12 +123,23 @@ function inferSource(x) {
 }
 
 //#region MODEL
+function normPath(p) {
+  if (!p || typeof p !== 'string') return null;
+  return p.replace(/\\/g, '/').toLowerCase();
+}
+
 function buildItems() {
   const s = state.snapshot;
   if (!s) return [];
   const items = [];
   const activeSet = new Set(s.activeTools ?? []);
   const activeIds = new Set();
+  // pi.getCommands() is frozen at session boot. After a toggle, the SDK-resolved
+  // disabledItems is the source of truth — drop any active command whose path
+  // matches a disabled resource so the UI reflects the post-toggle state.
+  const disabledPaths = new Set(
+    (s.disabledItems ?? []).map((d) => normPath(d.path)).filter(Boolean),
+  );
   for (const t of s.tools ?? []) {
     const description = (t.description ?? '').replace(/\s+/g, ' ').trim();
     const id = `tool:${t.name}`;
@@ -145,13 +157,16 @@ function buildItems() {
     });
   }
   for (const c of s.commands ?? []) {
+    const cp = normPath(c?.sourceInfo?.path);
+    if (cp && disabledPaths.has(cp)) continue;
     const name = c.name ?? c.command ?? '';
     const isSkill = name.startsWith('skill:');
     const src = inferSource(c);
     const isPrompt = !isSkill && c.source === 'prompt';
     const kind = isSkill ? 'skill' : isPrompt ? 'prompt' : 'command';
     const description = (c.description ?? '').replace(/\s+/g, ' ').trim();
-    const id = `${kind}:${name}`;
+    const idName = isSkill ? name.slice('skill:'.length) : name;
+    const id = `${kind}:${idName}`;
     activeIds.add(id);
     items.push({
       kind,
@@ -180,6 +195,22 @@ function buildItems() {
       raw: d,
     });
   }
+  for (const d of s.pendingItems ?? []) {
+    const id = `${d.kind}:${d.name}`;
+    if (activeIds.has(id)) continue;
+    const description = (d.description ?? '').replace(/\s+/g, ' ').trim();
+    items.push({
+      kind: d.kind,
+      id,
+      name: d.displayName ?? d.name,
+      source: d.source ?? '(package)',
+      description,
+      chars: (d.description ?? '').length,
+      pending: true,
+      path: d.path ?? null,
+      raw: d,
+    });
+  }
   if (s.systemPrompt) {
     for (const part of splitSystemPrompt(s.systemPrompt, s.cwd)) {
       items.push({
@@ -328,7 +359,9 @@ function renderTree() {
   const root = $('treeContainer');
   const items = filterItems(buildItems());
   if (!state.snapshot) {
-    root.innerHTML = `<div class="loading">No snapshot for this session. Run <code>/inspect snapshot</code> in a pi session.</div>`;
+    root.innerHTML = state.staticMode
+      ? `<div class="loading">No snapshot in this URL. Open a shared link, or run pi /inspect locally.</div>`
+      : `<div class="loading">No snapshot for this session. Run <code>/inspect snapshot</code> in a pi session.</div>`;
     return;
   }
   if (!items.length) {
@@ -338,7 +371,10 @@ function renderTree() {
 
   const groups = new Map();
   for (const k of KIND_ORDER) groups.set(k, []);
-  for (const it of items) groups.get(it.kind).push(it);
+  for (const it of items) {
+    const g = groups.get(it.kind);
+    if (g) g.push(it);
+  }
 
   const html = [];
   const rows = [];
@@ -398,11 +434,12 @@ function renderTree() {
             const descHtml = it.description
               ? `<span class="tree-desc">${esc(it.description)}</span><div class="spacer"></div>`
               : '<div class="spacer"></div>';
-            const disabledCls = it.disabled ? ' disabled' : '';
+            const stateCls = it.disabled ? ' disabled' : (it.pending ? ' pending' : '');
+            const stateBadge = it.pending ? `<span class="tree-badge pending" title="Enabled in settings but not yet active — restart pi">restart pi</span>` : '';
             html.push(`
-              <div class="tree-row ${selected}${disabledCls}" data-item="${esc(it.id)}" style="padding-left:${pad}px">
+              <div class="tree-row ${selected}${stateCls}" data-item="${esc(it.id)}" style="padding-left:${pad}px">
                 <div class="tree-icon">${iconFor(it.kind)}</div>
-                <div class="tree-label">${esc(it.name)}</div>
+                <div class="tree-label">${esc(it.name)}${stateBadge}</div>
                 ${descHtml}
                 <div class="tree-meta">${esc(it.source)}</div>
               </div>
@@ -507,11 +544,14 @@ function renderDetail() {
   }
 
   const ghUrl = githubUrlFor(it);
+  const toggleInfo = toggleInfoFor(it);
+  const allowEditor = !state.staticMode && it.path;
   panel.innerHTML = `
     <div class="detail-header">
       <h3>${iconFor(it.kind)} ${esc(it.name)} <span class="version">${esc(it.kind)}</span></h3>
       <div class="detail-header-actions">
-        ${it.path ? `<button class="detail-action" id="openEditorBtn" title="Open in $EDITOR"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 01-2 2H5a2 2 0 01-2-2V8a2 2 0 012-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></button>` : ''}
+        ${toggleInfo ? `<button class="detail-action" id="toggleBtn" title="${toggleInfo.enable ? 'Enable' : 'Disable'} (${toggleInfo.scope})">${toggleInfo.enable ? 'Enable' : 'Disable'}</button>` : ''}
+        ${allowEditor ? `<button class="detail-action" id="openEditorBtn" title="Open in $EDITOR"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M18 13v6a2 2 0 01-2 2H5a2 2 0 01-2-2V8a2 2 0 012-2h6"/><polyline points="15 3 21 3 21 9"/><line x1="10" y1="14" x2="21" y2="3"/></svg></button>` : ''}
         ${it.path ? `<button class="detail-action" id="copyPathBtn" title="Copy path"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="9" y="9" width="13" height="13" rx="2" ry="2"/><path d="M5 15H4a2 2 0 01-2-2V4a2 2 0 012-2h9a2 2 0 012 2v1"/></svg></button>` : ''}
         ${ghUrl ? `<button class="detail-action" id="openGithubBtn" title="Open on GitHub"><svg width="14" height="14" viewBox="0 0 24 24" fill="currentColor"><path d="M12 .5C5.65.5.5 5.65.5 12c0 5.08 3.29 9.39 7.86 10.91.58.11.79-.25.79-.56v-2c-3.2.7-3.88-1.37-3.88-1.37-.52-1.33-1.27-1.68-1.27-1.68-1.04-.71.08-.7.08-.7 1.15.08 1.76 1.18 1.76 1.18 1.03 1.76 2.7 1.25 3.36.96.1-.75.4-1.25.73-1.54-2.55-.29-5.24-1.28-5.24-5.69 0-1.26.45-2.29 1.18-3.1-.12-.29-.51-1.46.11-3.05 0 0 .96-.31 3.15 1.18a10.96 10.96 0 015.74 0c2.18-1.49 3.14-1.18 3.14-1.18.63 1.59.23 2.76.11 3.05.74.81 1.18 1.84 1.18 3.1 0 4.42-2.69 5.39-5.25 5.68.41.36.78 1.06.78 2.14v3.17c0 .31.21.68.8.56C20.21 21.38 23.5 17.07 23.5 12 23.5 5.65 18.35.5 12 .5z"/></svg></button>` : ''}
         <button class="detail-close" id="detailCloseBtn" title="Close">&#10005;</button>
@@ -550,6 +590,42 @@ function renderDetail() {
   if (ghBtn && ghUrl) ghBtn.addEventListener('click', () => {
     window.open(ghUrl, '_blank', 'noopener');
   });
+  const toggleBtn = $('toggleBtn');
+  if (toggleBtn && toggleInfo) toggleBtn.addEventListener('click', async () => {
+    if (state.staticMode) { toast('shared view is read-only — run pi-inspect locally to toggle'); return; }
+    toggleBtn.disabled = true;
+    try {
+      const r = await fetch('/api/toggle', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          action: toggleInfo.enable ? 'enable' : 'disable',
+          resourceKind: toggleInfo.resourceKind,
+          path: toggleInfo.path,
+          scope: toggleInfo.scope,
+        }),
+      });
+      const j = await r.json();
+      if (!r.ok || j.ok === false) throw new Error(j.error || `HTTP ${r.status}`);
+      toast(`${toggleInfo.enable ? 'Enabled' : 'Disabled'} ${it.name} — restart pi to apply fully`);
+    } catch (e) {
+      toast(`Toggle failed: ${e.message}`);
+      toggleBtn.disabled = false;
+    }
+  });
+}
+
+function toggleInfoFor(it) {
+  if (it.kind !== 'skill' && it.kind !== 'prompt') return null;
+  if (!it.path) return null;
+  const resourceKind = it.kind === 'skill' ? 'skills' : 'prompts';
+  if (it.disabled) {
+    const scope = it.raw?.scope === 'project' ? 'project' : 'user';
+    return { enable: true, resourceKind, path: it.path, scope };
+  }
+  const si = it.raw?.sourceInfo;
+  const scope = si?.scope === 'project' ? 'project' : 'user';
+  return { enable: false, resourceKind, path: it.path, scope };
 }
 //#endregion
 
@@ -606,6 +682,24 @@ function bindEvents() {
     renderTree();
   });
 
+  $('shareBtn').addEventListener('click', async () => {
+    if (!state.snapshot) { toast('no snapshot to share'); return; }
+    if (!window.piShare) { toast('share module not loaded'); return; }
+    const btn = $('shareBtn');
+    btn.classList.add('loading');
+    try {
+      const encoded = await window.piShare.encodeSnapshot(state.snapshot);
+      const url = window.piShare.buildShareUrl(encoded);
+      await navigator.clipboard.writeText(url);
+      const kb = Math.max(1, Math.round(url.length / 1024));
+      toast(`Share link copied — ${kb} KB. Paths redacted to <home>.`);
+    } catch (e) {
+      toast(`Share failed: ${e.message}`);
+    } finally {
+      btn.classList.remove('loading');
+    }
+  });
+
   $('refreshBtn').addEventListener('click', async () => {
     const btn = $('refreshBtn');
     btn.classList.add('loading');
@@ -816,6 +910,34 @@ function bindSse() {
 //#endregion
 
 //#region INIT
+async function loadSharedSnapshot() {
+  const param = window.piShare?.getSharedSnapshotParam();
+  if (!param) return false;
+  try {
+    state.snapshot = await window.piShare.decodeSnapshot(param);
+    state.currentSessionId = state.snapshot?.sessionId ?? null;
+    state.sessions = state.currentSessionId
+      ? [{ id: state.currentSessionId, name: state.snapshot.sessionName, cwd: state.snapshot.cwd }]
+      : [];
+    state.staticMode = true;
+    return true;
+  } catch (e) {
+    console.warn('Failed to decode shared snapshot:', e);
+    toast(`shared link decode failed: ${e.message}`, 'error');
+    return false;
+  }
+}
+
+function applyStaticModeUi() {
+  document.body.classList.add('static-mode');
+  for (const id of ['sessionSelect', 'cleanupSessionsBtn', 'refreshBtn']) {
+    const el = $(id);
+    if (el) el.style.display = 'none';
+  }
+  const share = $('shareBtn');
+  if (share) share.title = 'Re-copy this shared snapshot link';
+}
+
 (async function init() {
   try {
     if (localStorage.getItem('inspect.theme') === 'light') document.body.classList.add('light');
@@ -824,10 +946,20 @@ function bindSse() {
   bindResize();
   bindEvents();
 
-  await loadSessions();
-  const requested = getUrlSession();
-  await loadSnapshot(requested);
-  if (state.currentSessionId && !requested) setUrlSession(state.currentSessionId, true);
+  const sharedLoaded = await loadSharedSnapshot();
+  if (!sharedLoaded) {
+    try {
+      await loadSessions();
+      const requested = getUrlSession();
+      await loadSnapshot(requested);
+      if (state.currentSessionId && !requested) setUrlSession(state.currentSessionId, true);
+    } catch {
+      state.staticMode = true;
+      state.snapshot = null;
+    }
+  }
+
+  if (state.staticMode) applyStaticModeUi();
 
   if (state.snapshot?.systemPrompt) {
     const firstCtx = buildItems().find((x) => x.kind === 'context');
@@ -837,6 +969,6 @@ function bindSse() {
   renderTopbar();
   renderTree();
   renderDetail();
-  bindSse();
+  if (!state.staticMode) bindSse();
 })();
 //#endregion

package/public/index.html

@@ -42,6 +42,10 @@
       <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M22 19a2 2 0 01-2 2H4a2 2 0 01-2-2V5a2 2 0 012-2h5l2 3h9a2 2 0 012 2z"/></svg>
       <span id="projectPath">—</span>
     </div>
+    <button class="topbar-btn" id="shareBtn" title="Copy a shareable link for the current snapshot">
+      <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="18" cy="5" r="3"/><circle cx="6" cy="12" r="3"/><circle cx="18" cy="19" r="3"/><line x1="8.59" y1="13.51" x2="15.42" y2="17.49"/><line x1="15.41" y1="6.51" x2="8.59" y2="10.49"/></svg>
+      Share
+    </button>
     <button class="topbar-btn" id="refreshBtn" title="Refresh data">
       <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 11-2.12-9.36L23 10"/></svg>
       Refresh
@@ -111,11 +115,12 @@
     </div>
   </div>
 
+  <script src="share.js"></script>
   <script src="app.js"></script>
   <script>
     if ('serviceWorker' in navigator) {
       window.addEventListener('load', () => {
-        navigator.serviceWorker.register('/sw.js').catch((e) => console.warn('sw register failed:', e));
+        navigator.serviceWorker.register('./sw.js').catch((e) => console.warn('sw register failed:', e));
       });
     }
   </script>

package/public/share.js

@@ -0,0 +1,119 @@
+// Shareable snapshot encoding: JSON → deflate-raw → base64url.
+// URL shape mirrors plannotator.ai: `#s=<base64url>`.
+
+const HASH_PREFIX = '#s=';
+
+function bytesToBase64Url(bytes) {
+  let bin = '';
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function base64UrlToBytes(str) {
+  const pad = str.length % 4 === 0 ? '' : '='.repeat(4 - (str.length % 4));
+  const b64 = str.replace(/-/g, '+').replace(/_/g, '/') + pad;
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+async function streamThrough(transformer, bytes) {
+  const stream = new Blob([bytes]).stream().pipeThrough(transformer);
+  const buf = await new Response(stream).arrayBuffer();
+  return new Uint8Array(buf);
+}
+
+// Path-redaction: strip the sender's HOME prefix from every string and key,
+// in both slash flavors. Preserves project basename + relative tail so the
+// shared view still has useful structure ("<home>/dev/pi-inspect").
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function deriveHome(cwd) {
+  if (!cwd || typeof cwd !== 'string') return null;
+  const patterns = [
+    /^([a-zA-Z]:[\\/]Users[\\/][^\\/]+)/,   // Windows: C:\Users\<user>
+    /^(\/Users\/[^/]+)/,                    // macOS:   /Users/<user>
+    /^(\/home\/[^/]+)/,                     // Linux:   /home/<user>
+    /^(\/[a-zA-Z]\/Users\/[^/]+)/,          // Git Bash: /c/Users/<user>
+  ];
+  for (const re of patterns) {
+    const m = cwd.match(re);
+    if (m) return m[1];
+  }
+  return null;
+}
+
+function buildHomeReplacers(cwd) {
+  const home = deriveHome(cwd);
+  if (!home) return [];
+  const alt = home.includes('\\') ? home.replace(/\\/g, '/') : home.replace(/\//g, '\\');
+  const variants = new Set([home, alt]);
+  return [...variants].map((v) => [new RegExp(escapeRegex(v), 'g'), '<home>']);
+}
+
+function redactString(s, reps) {
+  if (typeof s !== 'string') return s;
+  let out = s;
+  for (const [re, rep] of reps) out = out.replace(re, rep);
+  return out;
+}
+
+// Keys whose values are home-path-keyed maps — redact keys here too.
+const PATH_KEYED_MAPS = new Set(['githubSources']);
+
+function redactDeep(value, reps, redactKeys) {
+  if (value == null) return value;
+  if (typeof value === 'string') return redactString(value, reps);
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, reps, false));
+  if (typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const newKey = redactKeys ? redactString(k, reps) : k;
+      out[newKey] = redactDeep(v, reps, PATH_KEYED_MAPS.has(k));
+    }
+    return out;
+  }
+  return value;
+}
+
+function redactSnapshot(snapshot) {
+  if (!snapshot) return snapshot;
+  const reps = buildHomeReplacers(snapshot.cwd || '');
+  if (!reps.length) return snapshot;
+  return redactDeep(snapshot, reps, false);
+}
+
+async function encodeSnapshot(snapshot) {
+  const json = JSON.stringify(redactSnapshot(snapshot));
+  const raw = new TextEncoder().encode(json);
+  const compressed = await streamThrough(new CompressionStream('deflate-raw'), raw);
+  return bytesToBase64Url(compressed);
+}
+
+async function decodeSnapshot(encoded) {
+  const compressed = base64UrlToBytes(encoded);
+  const raw = await streamThrough(new DecompressionStream('deflate-raw'), compressed);
+  return JSON.parse(new TextDecoder().decode(raw));
+}
+
+function getSharedSnapshotParam() {
+  const h = location.hash || '';
+  return h.startsWith(HASH_PREFIX) ? h.slice(HASH_PREFIX.length) : null;
+}
+
+const PUBLIC_BASE_URL = 'https://nikiforovall.blog/pi-inspect/';
+
+function buildShareUrl(encoded) {
+  // Local pi-inspect runs on localhost — recipients can't open that. Always
+  // anchor share links on the hosted static dashboard. When the current page
+  // is already a non-localhost origin (e.g. the hosted site itself), reuse it.
+  const host = location.hostname;
+  const isLocal = !host || host === 'localhost' || host === '127.0.0.1' || host === '::1';
+  const base = isLocal ? PUBLIC_BASE_URL : `${location.origin}${location.pathname}`;
+  return `${base}${HASH_PREFIX}${encoded}`;
+}
+
+window.piShare = { encodeSnapshot, decodeSnapshot, getSharedSnapshotParam, buildShareUrl, redactSnapshot };

package/public/style.css

@@ -383,6 +383,23 @@ body {
   font-style: italic;
   opacity: 0.8;
 }
+.tree-badge.pending {
+  display: inline-block;
+  margin-left: 8px;
+  padding: 1px 6px;
+  border-radius: 4px;
+  font-size: 10px;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.4px;
+  background: rgba(255, 170, 60, 0.18);
+  color: #c97a00;
+  border: 1px solid rgba(201, 122, 0, 0.35);
+  vertical-align: middle;
+}
+.tree-row.pending .tree-icon {
+  opacity: 0.7;
+}
 
 .tree-indent {
   flex-shrink: 0;

package/public/sw.js

@@ -1,6 +1,8 @@
 // pi-inspect service worker — network-first for dynamic data, cache-first for static shell.
-const VERSION = 'pi-inspect-v1';
-const SHELL = ['/', '/index.html', '/style.css', '/app.js', '/manifest.webmanifest', '/icon.svg'];
+const VERSION = 'pi-inspect-v6';
+// Resolve relative to the SW scope so this works under any subpath (e.g. GitHub Pages).
+const BASE = new URL('./', self.registration?.scope || self.location.href).pathname;
+const SHELL = ['', 'index.html', 'style.css', 'app.js', 'share.js', 'manifest.webmanifest', 'icon.svg'].map((p) => BASE + p);
 
 self.addEventListener('install', (event) => {
   event.waitUntil(caches.open(VERSION).then((c) => c.addAll(SHELL)).catch(() => {}));

package/server.js

@@ -135,6 +135,28 @@ app.post('/api/open', (req, res) => {
   }
 });
 
+const REQ_DIR = path.join(os.homedir(), '.pi', 'agent', 'inspect', 'requests');
+
+app.post('/api/toggle', async (req, res) => {
+  try {
+    const { action, resourceKind, path: target, scope } = req.body || {};
+    if (action !== 'enable' && action !== 'disable') return res.status(400).json({ ok: false, error: 'action must be enable|disable' });
+    if (!['skills', 'prompts', 'extensions', 'themes'].includes(resourceKind)) return res.status(400).json({ ok: false, error: 'invalid resourceKind' });
+    if (!target || typeof target !== 'string') return res.status(400).json({ ok: false, error: 'missing path' });
+    const useScope = scope === 'project' ? 'project' : 'user';
+    await fsp.mkdir(REQ_DIR, { recursive: true });
+    const id = `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+    const file = path.join(REQ_DIR, `${id}.json`);
+    const tmp = `${file}.tmp`;
+    const body = JSON.stringify({ id, ts: Date.now(), action, resourceKind, path: target, scope: useScope });
+    await fsp.writeFile(tmp, body, 'utf8');
+    await fsp.rename(tmp, file);
+    res.json({ ok: true, id });
+  } catch (e) {
+    res.status(500).json({ ok: false, error: e.message });
+  }
+});
+
 app.post('/api/focus', (req, res) => {
   const sid = (req.body && req.body.session) || req.query.session || null;
   const count = sseClients.size;