pi-profile-switch 0.3.0 → 0.4.0

package/src/startup-mcp-scope.ts

@@ -1,262 +0,0 @@
-/**
- * StartupMcpScope: derives the profile-scoped MCP overlay at times when a
- * full activation has not (or may not yet) run.
- *
- * Two callers:
- * - The extension-load pass: must be synchronous and must finish before
- *   pi-mcp-adapter reads its config at `session_start` (and, for eager
- *   servers, at its own load time). Pi applies CLI flag values only AFTER
- *   extension loading, so the `--profile` / `--mcp-config` values are read
- *   from argv here; trust is mirrored from Pi's own resolution order
- *   (`hasTrustRequiringProjectResources` → stored decision →
- *   `defaultProjectTrust`; an interactive first-time prompt is not yet
- *   answerable at load time and counts as untrusted).
- * - The switch pass: the caller already has the resolved allowlist, so the
- *   overlay is derived from it directly.
- *
- * The generated file IS the adapter's Pi-global slot (`<agentDir>/mcp.json`):
- * flag injection is impossible (Pi rejects two extensions registering the
- * same flag), so the mechanism works with the slot the adapter already reads.
- * The user's own Pi-global servers live in the sidecar `mcp.user.json`.
- *
- * Failure policy: a profile name that cannot be resolved (missing, malformed
- * catalog, unknown name) falls back to "no filtering" — the generated overlay
- * then changes nothing, and the real problem is reported loudly by the
- * activation that runs right after. A foreign `--mcp-config` disables
- * management entirely: the user's explicit file is never overwritten.
- */
-
-import { hasTrustRequiringProjectResources, ProjectTrustStore } from "@earendil-works/pi-coding-agent";
-import path from "node:path";
-
-import { isRecord, readJsonFileSync } from "./json-file.ts";
-import { readAdapterOtherServerNamesSync, readMcpDocumentSync } from "./mcp-config.ts";
-import {
-	buildMcpOverlay,
-	isDisabledStub,
-	isGeneratedOverlay,
-	MCP_GENERATED_MARKER,
-	mcpSlotPath,
-	mcpSourcePath,
-	resolveAllowedServers,
-	serializeMcpOverlay,
-} from "./mcp-overlay.ts";
-import { writeMcpOverlayIfChangedSync } from "./mcp-overlay-file.ts";
-import { DEFAULT_PROFILE_NAME, parseCatalogDocument, type ProfileDefinition } from "./profile-catalog.ts";
-
-/** Reads `--<name> <value>` / `--<name>=<value>` without Pi's parser (Pi
- *  applies extension flag values only after extension loading). Last wins. */
-export function readFlagFromArgv(argv: readonly string[], name: string): string | undefined {
-	const long = `--${name}`;
-	let value: string | undefined;
-	for (let index = 0; index < argv.length; index++) {
-		const token = argv[index] ?? "";
-		if (token === long) {
-			const next = argv[index + 1];
-			if (next !== undefined && !next.startsWith("--")) value = next;
-			continue;
-		}
-		if (token.startsWith(`${long}=`)) {
-			const inline = token.slice(long.length + 1);
-			if (inline.length > 0) value = inline;
-		}
-	}
-	return value;
-}
-
-/** True when Pi itself would consider `cwd` trusted right now. Mirrors
- *  `resolveProjectTrusted` minus extension votes and the interactive prompt. */
-export function resolveProjectTrustedSync(agentDir: string, cwd: string): boolean {
-	if (!hasTrustRequiringProjectResources(cwd)) return true;
-	const stored = new ProjectTrustStore(agentDir).get(cwd);
-	if (stored !== null) return stored;
-	return readDefaultProjectTrustSync(agentDir) === "always";
-}
-
-/** The saved selection for this run: project state wins over global state
- *  (project state only when trusted), then the built-in default. */
-export function resolveStartupProfileNameSync(input: {
-	agentDir: string;
-	cwd: string;
-	projectTrusted: boolean;
-	argv: readonly string[];
-}): string {
-	const requested = readFlagFromArgv(input.argv, "profile");
-	if (requested !== undefined && requested.length > 0) return requested;
-	const project = input.projectTrusted
-		? readActiveProfile(path.join(input.cwd, ".pi", "pi-profile-state.json"))
-		: undefined;
-	return project ?? readActiveProfile(path.join(input.agentDir, "pi-profile-state.json")) ?? DEFAULT_PROFILE_NAME;
-}
-
-export interface McpOverlaySyncInput {
-	agentDir: string;
-	cwd: string;
-	/** Pi's trust decision. Omitted on the extension-load pass, where Pi has
-	 *  not resolved trust yet; the module mirrors Pi's own order then. */
-	projectTrusted?: boolean;
-	/** Effective `--mcp-config`; undefined means the managed overlay path. */
-	overridePath?: string;
-	/** The command line, for the load pass (Pi applies flag values only after
-	 *  extension loading, so `--profile` is read from here). */
-	argv?: readonly string[];
-	homeDir?: string;
-}
-
-export interface McpOverlaySyncResult {
-	overlayPath: string;
-	/** False when a foreign `--mcp-config` owns the adapter's slot. */
-	managed: boolean;
-	changed: boolean;
-	/** Set when nothing was written; the caller surfaces it as a warning. */
-	error?: string;
-}
-
-/** Load-time (and `session_start` re-check) pass. `profileName` short-circuits
- *  the state lookup when the caller already activated a profile. */
-export function syncStartupMcpOverlay(
-	input: McpOverlaySyncInput & { profileName?: string; mcpRefs?: readonly string[] | undefined },
-): McpOverlaySyncResult {
-	try {
-		const trust = input.projectTrusted;
-		const profileName =
-			input.profileName ??
-			resolveStartupProfileNameSync({
-				agentDir: input.agentDir,
-				cwd: input.cwd,
-				projectTrusted: trust ?? resolveProjectTrustedSync(input.agentDir, input.cwd),
-				argv: input.argv ?? [],
-			});
-		const refs = input.mcpRefs ?? readProfileMcpRefsSync({ ...input, name: profileName, trust });
-		return writeOverlayForRefs({ ...input, refs });
-	} catch (error) {
-		return {
-			overlayPath: mcpSlotPath(input.agentDir),
-			managed: true,
-			changed: false,
-			error: error instanceof Error ? error.message : String(error),
-		};
-	}
-}
-
-/** Switch pass: the caller already resolved the allowlist. */
-export function syncMcpOverlayForSelection(
-	input: McpOverlaySyncInput & { allowed: readonly string[] | "all" },
-): McpOverlaySyncResult {
-	try {
-		return writeOverlay({ ...input, refs: input.allowed });
-	} catch (error) {
-		return {
-			overlayPath: mcpSlotPath(input.agentDir),
-			managed: true,
-			changed: false,
-			error: error instanceof Error ? error.message : String(error),
-		};
-	}
-}
-
-function writeOverlayForRefs(input: McpOverlaySyncInput & { refs: readonly string[] | undefined | "unknown" }): McpOverlaySyncResult {
-	// An unresolvable profile is not an error here: the generated overlay
-	// then filters nothing and the activation reports the real problem.
-	const refs = input.refs === "unknown" ? undefined : input.refs;
-	return writeOverlay({ ...input, refs });
-}
-
-function writeOverlay(input: McpOverlaySyncInput & { refs: readonly string[] | undefined | "all" }): McpOverlaySyncResult {
-	const overlayPath = mcpSlotPath(input.agentDir);
-	if (input.overridePath !== undefined && path.resolve(input.overridePath) !== overlayPath) {
-		return { overlayPath, managed: false, changed: false };
-	}
-	const projectTrusted = input.projectTrusted ?? resolveProjectTrustedSync(input.agentDir, input.cwd);
-	const discovery = {
-		agentDir: input.agentDir,
-		cwd: input.cwd,
-		projectTrusted,
-		...(input.homeDir === undefined ? {} : { homeDir: input.homeDir }),
-	};
-	// The slot is ours; a slot written by hand is adopted into the sidecar
-	// before the first overwrite, so a user's Pi-global servers survive.
-	const sourcePath = mcpSourcePath(input.agentDir);
-	adoptHandWrittenSlotSync(overlayPath, sourcePath);
-	const sourceDocument = readMcpDocumentSync(sourcePath);
-	const sourceNames = isRecord(sourceDocument?.mcpServers) ? Object.keys(sourceDocument.mcpServers) : [];
-	const otherNames = readAdapterOtherServerNamesSync(discovery);
-	const allowed =
-		input.refs === "all"
-			? "all"
-			: resolveAllowedServers(input.refs, [...new Set([...sourceNames, ...otherNames])].sort());
-	const content = serializeMcpOverlay(
-		buildMcpOverlay({
-			...(sourceDocument === undefined ? {} : { slotDocument: sourceDocument }),
-			otherServerNames: otherNames,
-			allowed,
-		}),
-	);
-	return { overlayPath, managed: true, changed: writeMcpOverlayIfChangedSync(overlayPath, content) };
-}
-
-/** A slot file without the generated marker holds the user's own Pi-global
- *  servers (from before this package managed the slot, or from a manual
- *  edit). Move them — plus the slot's non-server keys — into the sidecar
- *  before the slot is overwritten. Stub entries are skipped: they describe
- *  servers owned by the adapter's other sources. */
-function adoptHandWrittenSlotSync(slotPath: string, sourcePath: string): void {
-	const slot = readMcpDocumentSync(slotPath);
-	if (slot === undefined || isGeneratedOverlay(slot)) return;
-	const sidecar = readMcpDocumentSync(sourcePath) ?? {};
-	const sidecarServers = isRecord(sidecar.mcpServers) ? sidecar.mcpServers : {};
-	const servers: Record<string, unknown> = { ...sidecarServers };
-	const slotServers = isRecord(slot.mcpServers) ? slot.mcpServers : {};
-	for (const [name, definition] of Object.entries(slotServers)) {
-		if (isDisabledStub(definition)) continue;
-		servers[name] = definition;
-	}
-	const document: Record<string, unknown> = { ...sidecar };
-	delete document[MCP_GENERATED_MARKER];
-	for (const [key, value] of Object.entries(slot)) {
-		if (key === "mcpServers" || key === MCP_GENERATED_MARKER) continue;
-		document[key] = value;
-	}
-	document.mcpServers = Object.fromEntries(Object.entries(servers).sort(([left], [right]) => left.localeCompare(right)));
-	writeMcpOverlayIfChangedSync(sourcePath, `${JSON.stringify(document, null, 2)}\n`);
-}
-
-function readActiveProfile(statePath: string): string | undefined {
-	const result = readJsonFileSync(statePath);
-	if (!result.ok || !isRecord(result.value)) return undefined;
-	const name = result.value.activeProfile;
-	return typeof name === "string" && name.length > 0 ? name : undefined;
-}
-
-/** The profile's raw `mcp` references; `"unknown"` when the profile or its
- *  catalog cannot be read (caller falls back to "no filtering"). */
-function readProfileMcpRefsSync(
-	input: McpOverlaySyncInput & { name: string; trust: boolean | undefined },
-): readonly string[] | undefined | "unknown" {
-	if (input.name === DEFAULT_PROFILE_NAME) return undefined;
-	const trusted = input.trust ?? resolveProjectTrustedSync(input.agentDir, input.cwd);
-	const global = readCatalogSync(path.join(input.agentDir, "profiles.json"));
-	const project = trusted
-		? readCatalogSync(path.join(input.cwd, ".pi", "profiles.json"))
-		: new Map<string, ProfileDefinition>();
-	if (global === "error" || project === "error") return "unknown";
-	const definition = project.get(input.name) ?? global.get(input.name);
-	return definition === undefined ? "unknown" : definition.mcp;
-}
-
-function readCatalogSync(filePath: string): Map<string, ProfileDefinition> | "error" {
-	const result = readJsonFileSync(filePath);
-	if (!result.ok) return result.reason === "missing" ? new Map<string, ProfileDefinition>() : "error";
-	try {
-		return parseCatalogDocument(result.value, filePath);
-	} catch {
-		return "error";
-	}
-}
-
-function readDefaultProjectTrustSync(agentDir: string): string | undefined {
-	const result = readJsonFileSync(path.join(agentDir, "settings.json"));
-	if (!result.ok || !isRecord(result.value)) return undefined;
-	const value = result.value.defaultProjectTrust;
-	return typeof value === "string" ? value : undefined;
-}

package/src/startup-selection.ts

@@ -1,144 +0,0 @@
-/**
- * StartupSelection: how a session decides which profile to activate.
- *
- * - `--profile <name>` (a flag this extension registers) is an explicit,
- *   one-run selection: it is never written back to runtime state.
- * - Without the flag the saved selection applies: the trusted project's
- *   state wins over the global state, then the built-in `default`.
- * - A saved selection that no longer resolves falls back to `default` with
- *   a warning — restore is a convenience, not a commitment. An explicit
- *   flag value never falls back: an unknown name is a loud error.
- *
- * Explicit CLI declarations (`--model`, `--thinking`, `--tools`,
- * `--exclude-tools`) outrank the profile's matching declaration. They are
- * detected by re-parsing this process's argv with Pi's own exported parser,
- * so the aliases and value forms stay Pi's rather than a hand-rolled copy.
- */
-
-import { parseArgs } from "@earendil-works/pi-coding-agent";
-import { stat } from "node:fs/promises";
-import path from "node:path";
-
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-
-import { DEFAULT_PROFILE_NAME, ProfileCatalog } from "./profile-catalog.ts";
-import { RuntimeStateStore } from "./runtime-state-store.ts";
-
-/** Which settings the user stated on the command line this run. */
-export interface ExplicitDeclarations {
-	model: boolean;
-	thinking: boolean;
-	tools: boolean;
-}
-
-export const PROFILE_FLAG = "profile";
-
-/** Registers the `--profile <name>` CLI flag. Pi has no flag of that name;
- *  unknown flags are collected by its parser and validated against flags
- *  registered by loaded extensions. */
-export function registerProfileFlag(pi: ExtensionAPI): void {
-	pi.registerFlag(PROFILE_FLAG, {
-		type: "string",
-		description: "pi-profile-switch: activate a profile for this run (not saved)",
-	});
-}
-
-/** The `--profile` value, when the user passed one. */
-export function readProfileFlag(pi: ExtensionAPI): string | undefined {
-	const value = pi.getFlag(PROFILE_FLAG);
-	return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-
-/** Detects explicit CLI declarations by re-parsing argv with Pi's parser. */
-export function detectExplicitDeclarations(argv: string[]): ExplicitDeclarations {
-	const parsed = parseArgs(argv);
-	return {
-		model: parsed.model !== undefined,
-		thinking: parsed.thinking !== undefined,
-		tools: parsed.tools !== undefined || parsed.excludeTools !== undefined,
-	};
-}
-
-export interface StartupProfile {
-	name: string;
-	/** Non-fatal notices (e.g. a saved profile that no longer exists). */
-	warnings: string[];
-}
-
-async function exists(filePath: string): Promise<boolean> {
-	try {
-		await stat(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-/** Files the retired extension registry lived in; they are no longer read
- *  (ADR-0007), and a leftover file is called out once per startup. */
-async function legacyRegistryWarnings(input: {
-	agentDir: string;
-	cwd: string;
-	projectTrusted: boolean;
-}): Promise<string[]> {
-	const candidates = [path.join(input.agentDir, "resources.json")];
-	if (input.projectTrusted) candidates.push(path.join(input.cwd, ".pi", "resources.json"));
-	const warnings: string[] = [];
-	for (const filePath of candidates) {
-		if (await exists(filePath)) {
-			warnings.push(
-				`${filePath} is no longer read (ADR-0007): extensions load natively in every profile — manage them with pi install`,
-			);
-		}
-	}
-	return warnings;
-}
-
-/** Resolves the profile name for this session: explicit flag → trusted
- *  project state → global state → default. Never writes state. */
-export async function resolveStartupProfile(input: {
-	agentDir: string;
-	cwd: string;
-	projectTrusted: boolean;
-	requested?: string;
-}): Promise<StartupProfile> {
-	const catalog = await ProfileCatalog.load(input.agentDir, {
-		projectDir: input.projectTrusted ? input.cwd : undefined,
-	});
-	const warnings: string[] = await legacyRegistryWarnings(input);
-
-	if (input.requested !== undefined) {
-		if (catalog.resolve(input.requested) === undefined) {
-			throw new UnknownProfileError(input.requested, catalog.list().map((profile) => profile.name));
-		}
-		return { name: input.requested, warnings };
-	}
-
-	let saved: string | undefined;
-	if (input.projectTrusted) {
-		saved = (await new RuntimeStateStore(path.join(input.cwd, ".pi")).read()).activeProfile;
-	}
-	saved ??= (await new RuntimeStateStore(input.agentDir).read()).activeProfile;
-
-	if (saved === undefined || saved === DEFAULT_PROFILE_NAME) {
-		return { name: DEFAULT_PROFILE_NAME, warnings };
-	}
-	if (catalog.resolve(saved) === undefined) {
-		warnings.push(
-			`saved profile ${JSON.stringify(saved)} no longer exists — starting with "${DEFAULT_PROFILE_NAME}"; ` +
-				`available: [${catalog.list().map((profile) => profile.name).join(", ")}]`,
-		);
-		return { name: DEFAULT_PROFILE_NAME, warnings };
-	}
-	return { name: saved, warnings };
-}
-
-export class UnknownProfileError extends Error {
-	readonly requested: string;
-
-	constructor(requested: string, available: string[]) {
-		super(`unknown profile ${JSON.stringify(requested)} — available: [${available.join(", ")}]`);
-		this.name = "UnknownProfileError";
-		this.requested = requested;
-	}
-}

package/src/switching/activate-profile.ts

@@ -1,115 +0,0 @@
-/**
- * SwitchProfile: the in-session activation orchestrator (ADR-0007).
- *
- * There is no reload and no generated-settings rewrite. Activating a profile
- * means: resolve it against Pi's live resources, apply the runtime parts
- * (model, tools, MCP allowlist), and remember the choice. Skills and
- * instructions need no action here — they are applied by the next
- * `before_agent_start` from the returned selection.
- *
- * Flow:
- *   1. load the catalog (project entries only when Pi reports the project
- *      trusted) and resolve the name — unknown names fail with candidates
- *   2. resolve the selection against the live resources; a declared MCP
- *      intent that cannot be satisfied fails here
- *   3. validate the model preset (exists, has auth) — still nothing applied
- *   4. persist the choice to the target profile's scope state file
- *   5. apply model/thinking/tools/MCP; a failure reports loudly
- *
- * Startup activation passes `persist: false` (the flag selection must not
- * overwrite the saved one) and `overlay: null` (a stored overlay never
- * outlives its runtime).
- */
-
-import { ProfileCatalog } from "../profile-catalog.ts";
-import { decidePreset, type SessionChoices } from "../model-selection.ts";
-import { resolveSelection, type LiveResources, type ResolvedSelection } from "../profile-resolver.ts";
-import type { ExplicitDeclarations } from "../startup-selection.ts";
-import { RuntimeStateStore, stateDirFor, type RuntimeOverlay } from "../runtime-state-store.ts";
-import { applySelection, validateSelection, type ApplySurface } from "./apply-profile.ts";
-
-export class ActivationError extends Error {
-	constructor(message: string) {
-		super(message);
-		this.name = "ActivationError";
-	}
-}
-
-export interface ActivationDeps {
-	/** The user's real agent dir (e.g. ~/.pi/agent). */
-	agentDir: string;
-	/** The project working directory. */
-	cwd: string;
-	/** Pi's trust decision for `cwd` (`ctx.isProjectTrusted()`). */
-	projectTrusted: boolean;
-	/** The live resource view loaded by the caller. */
-	live: LiveResources;
-	/** The narrow Pi surface the selection is applied to. */
-	surface: ApplySurface;
-	/** Inputs for the model-preset precedence decision (decided after the
-	 *  profile resolves, since it depends on the declared model). */
-	presetInputs: { explicit: ExplicitDeclarations; session: SessionChoices; force: boolean };
-}
-
-export interface ActivationResult {
-	selection: ResolvedSelection;
-	/** The overlay this activation applied; absent when the runtime runs the
-	 *  profile exactly as it is declared. Callers surface it (the footer badge)
-	 *  instead of re-reading the state file. */
-	overlay?: RuntimeOverlay;
-}
-
-/** Resolves a profile against the live resources without applying it.
- *  Throws ActivationError for unknown names and SelectionError for declared
- *  MCP intents that cannot be satisfied. A CLI-declared
- *  `--tools`/`--exclude-tools` suppresses the profile's tool selection
- *  unless the user made an explicit `/profile use` choice. */
-export async function resolveProfileSelection(
-	name: string,
-	deps: Pick<ActivationDeps, "agentDir" | "cwd" | "projectTrusted" | "live" | "presetInputs">,
-	overlay?: RuntimeOverlay,
-): Promise<ResolvedSelection> {
-	const catalog = await ProfileCatalog.load(deps.agentDir, {
-		projectDir: deps.projectTrusted ? deps.cwd : undefined,
-	});
-	const profile = catalog.resolve(name);
-	if (profile === undefined) {
-		throw new ActivationError(
-			`unknown profile ${JSON.stringify(name)} — available: [${catalog.list().map((entry) => entry.name).join(", ")}]`,
-		);
-	}
-	const suppressTools = !deps.presetInputs.force && deps.presetInputs.explicit.tools;
-	return resolveSelection({ profile, overlay, live: deps.live, suppressTools });
-}
-
-/** Activates a profile: resolve, validate, optionally persist, apply. */
-export async function activateProfile(
-	name: string,
-	deps: ActivationDeps,
-	options?: { overlay?: RuntimeOverlay | null; persist?: boolean },
-): Promise<ActivationResult> {
-	const overlay = options?.overlay ?? undefined;
-	const selection = await resolveProfileSelection(name, deps, overlay);
-	const preset = decidePreset({ model: selection.model, ...deps.presetInputs });
-
-	// Validate before touching anything: the model preset is the only
-	// fallible runtime step.
-	const validationError = validateSelection(selection, deps.surface, preset);
-	if (validationError !== undefined) {
-		throw new ActivationError(validationError);
-	}
-
-	if (options?.persist !== false) {
-		await new RuntimeStateStore(stateDirFor(selection.source, deps)).update({
-			activeProfile: selection.name,
-			overlay: overlay ?? undefined,
-		});
-	}
-
-	const result = await applySelection({ selection, surface: deps.surface, preset });
-	if (!result.applied) {
-		throw new ActivationError(result.error ?? `profile "${name}" could not be applied`);
-	}
-
-	return { selection, ...(overlay === undefined ? {} : { overlay }) };
-}

package/src/switching/apply-profile.ts

@@ -1,131 +0,0 @@
-/**
- * ApplyProfile: applies a resolved selection to the running Pi.
- *
- * Replaces the launch-plan application of the host architecture: there is no
- * plan file and no reload. Application is ordered so that the only
- * fallible step — the model preset — runs first; a failure leaves the
- * runtime untouched and the caller keeps the previous state.
- *
- * Steps:
- *   1. validate: the declared model exists and has configured auth.
- *   2. model: `setModel` + `setThinkingLevel` (when the preset applies).
- *   3. tools: `setActiveTools` with the resolved active set. Literals the
- *      live registry does not provide yet stay in `pendingTools` and are
- *      retried by the caller each turn (MCP and extension tools register
- *      after session start).
- *   4. mcp: publish the runtime server allowlist to pi-mcp-adapter.
- *
- * Dependency-injected against a narrow surface so unit tests never need a
- * real Pi.
- */
-
-import {
-	MCP_ALLOWLIST_EVENT,
-	MCP_ALLOWLIST_VERSION,
-} from "../mcp-coordination.ts";
-import type { PresetDecisions } from "../model-selection.ts";
-import type { ResolvedSelection } from "../profile-resolver.ts";
-
-/** The narrow slice of ExtensionAPI/Context the application needs. */
-export interface ApplySurface {
-	getAllTools(): Array<{ name: string }>;
-	setActiveTools(names: string[]): void;
-	modelRegistry: {
-		find(provider: string, id: string): unknown | undefined;
-		hasConfiguredAuth(model: unknown): boolean;
-	};
-	setModel(model: unknown): Promise<boolean>;
-	setThinkingLevel(level: string): void;
-	events: { emit(channel: string, data: unknown): void };
-}
-
-export interface ApplyResult {
-	applied: boolean;
-	/** Present when nothing was applied. */
-	error?: string;
-	warnings: string[];
-	/** Tool literals still missing from the live registry. */
-	pendingTools: string[];
-}
-
-/** Checks everything that can be checked before mutating the runtime. */
-export function validateSelection(
-	selection: ResolvedSelection,
-	surface: ApplySurface,
-	preset: PresetDecisions,
-): string | undefined {
-	if (selection.model === undefined || !preset.model) return undefined;
-	const model = surface.modelRegistry.find(selection.model.provider, selection.model.id);
-	if (model === undefined) {
-		return `profile "${selection.name}": declared model ${selection.model.provider}/${selection.model.id} not found`;
-	}
-	if (!surface.modelRegistry.hasConfiguredAuth(model)) {
-		return `profile "${selection.name}": model ${selection.model.provider}/${selection.model.id} has no configured auth`;
-	}
-	return undefined;
-}
-
-/** Applies the selection. Validation runs first; on failure nothing is
- *  applied and the runtime keeps its previous state. */
-export async function applySelection(input: {
-	selection: ResolvedSelection;
-	surface: ApplySurface;
-	preset: PresetDecisions;
-}): Promise<ApplyResult> {
-	const { selection, surface, preset } = input;
-	const error = validateSelection(selection, surface, preset);
-	if (error !== undefined) {
-		return { applied: false, error, warnings: [], pendingTools: [] };
-	}
-
-	if (selection.model !== undefined && preset.model) {
-		const model = surface.modelRegistry.find(selection.model.provider, selection.model.id);
-		const applied = await surface.setModel(model);
-		if (!applied) {
-			return {
-				applied: false,
-				error: `profile "${selection.name}": model ${selection.model.provider}/${selection.model.id} could not be activated`,
-				warnings: [],
-				pendingTools: [],
-			};
-		}
-		if (selection.model.thinkingLevel !== undefined && preset.thinking) {
-			surface.setThinkingLevel(selection.model.thinkingLevel);
-		}
-	}
-
-	if (selection.tools !== undefined) {
-		surface.setActiveTools(selection.tools);
-	}
-
-	if (selection.mcp !== undefined) {
-		surface.events.emit(MCP_ALLOWLIST_EVENT, {
-			version: MCP_ALLOWLIST_VERSION,
-			profile: selection.name,
-			servers: selection.mcp,
-		});
-	}
-
-	return { applied: true, warnings: [], pendingTools: selection.pendingTools };
-}
-
-/** Retries pending tool literals against the live registry. Once every
- *  literal resolves the caller stops retrying, so a user's later native tool
- *  toggle is never clobbered. */
-export function retryPendingTools(input: {
-	selection: ResolvedSelection;
-	surface: ApplySurface;
-}): { pendingTools: string[]; active?: string[]; applied: boolean } {
-	const { selection, surface } = input;
-	if (selection.pendingTools.length === 0) {
-		return { pendingTools: [], applied: false };
-	}
-	const live = new Set(surface.getAllTools().map((tool) => tool.name));
-	const resolved = selection.pendingTools.filter((name) => live.has(name));
-	if (resolved.length === 0) {
-		return { pendingTools: selection.pendingTools, applied: false };
-	}
-	const active = [...new Set([...(selection.tools ?? []), ...resolved])];
-	surface.setActiveTools(active);
-	return { pendingTools: selection.pendingTools.filter((name) => !live.has(name)), active, applied: true };
-}