pi-profile-switch 0.3.1 → 0.4.2

package/src/skill-selection.ts

@@ -1,81 +0,0 @@
-/**
- * SkillSelection: the skills visibility filter (ADR-0007).
- *
- * A profile's `skills` references do not load or unload anything. Pi loads
- * every installed skill; `/skill:name` stays available to the user for all
- * of them. What the profile controls is what the MODEL sees: the
- * `<available_skills>` section of the system prompt.
- *
- * The filter recomputes that section with Pi's own exported formatter over
- * the profile's selection and replaces it inside the chained system prompt.
- * Because the original section was produced by the same formatter from the
- * same skill array (`BuildSystemPromptOptions.skills`), the recomputation is
- * byte-identical; when it is not found the turn proceeds unfiltered and the
- * caller reports a warning.
- */
-
-import { formatSkillsForPrompt, type BuildSystemPromptOptions, type Skill } from "@earendil-works/pi-coding-agent";
-
-import { matchesReference } from "./name-matching.ts";
-import type { SkillsFilter } from "./profile-resolver.ts";
-
-export type SkillsFilterOutcome =
-	/** The prompt's skills section was replaced with the filtered one. */
-	| "filtered"
-	/** No filter applies (default profile without an overlay). */
-	| "no-filter"
-	/** Neither `read` nor `bash` is active, so Pi emitted no skills section. */
-	| "no-read-tool"
-	/** The expected section is absent from the prompt; left unfiltered. */
-	| "section-missing";
-
-/** The skills the model may see. `undefined` means "no filtering". */
-export function visibleSkills(skills: Skill[], filter: SkillsFilter | undefined): Skill[] | undefined {
-	if (filter === undefined) return undefined;
-	const visible = new Set(visibleSkillNames(skills, filter) ?? []);
-	return skills.filter((skill) => visible.has(skill.name));
-}
-
-/** The visible skill names, for status reporting and prompt filtering.
- *  `undefined` means "no filtering". */
-export function visibleSkillNames(
-	all: Array<{ name: string }>,
-	filter: SkillsFilter | undefined,
-): string[] | undefined {
-	if (filter === undefined) return undefined;
-	const refs = filter.refs;
-	const base = refs === "all" ? all : all.filter((skill) => refs.some((ref) => matchesReference(ref, skill.name)));
-	return base
-		.filter((skill) => !filter.disabled.some((ref) => matchesReference(ref, skill.name)))
-		.map((skill) => skill.name);
-}
-
-/** Replaces the system prompt's skills section with the filtered one. */
-export function applySkillsFilter(input: {
-	systemPrompt: string;
-	options: BuildSystemPromptOptions;
-	filter: SkillsFilter | undefined;
-}): { systemPrompt: string; outcome: SkillsFilterOutcome } {
-	const { systemPrompt, options, filter } = input;
-	if (filter === undefined) {
-		return { systemPrompt, outcome: "no-filter" };
-	}
-	// Pi emits the section only when a skill-reading tool is active; without
-	// one there is nothing to replace.
-	const fileReadTool = (["read", "bash"] as const).find((tool) => options.selectedTools?.includes(tool));
-	if (fileReadTool === undefined) {
-		return { systemPrompt, outcome: "no-read-tool" };
-	}
-	const all = options.skills ?? [];
-	const original = formatSkillsForPrompt(all, fileReadTool);
-	if (original.length === 0 || !systemPrompt.includes(original)) {
-		return { systemPrompt, outcome: "section-missing" };
-	}
-	const filtered = formatSkillsForPrompt(visibleSkills(all, filter) ?? [], fileReadTool);
-	return { systemPrompt: systemPrompt.replace(original, filtered), outcome: "filtered" };
-}
-
-/** The per-profile instructions block appended after the (filtered) prompt. */
-export function formatInstructionsBlock(profile: string, instructions: string): string {
-	return `\n\n<profile_instructions name="${profile}">\n${instructions}\n</profile_instructions>`;
-}

package/src/startup-mcp-scope.ts

@@ -1,271 +0,0 @@
-/**
- * StartupMcpScope: derives the profile-scoped MCP overlay at times when a
- * full activation has not (or may not yet) run.
- *
- * Two callers:
- * - The extension-load pass: must be synchronous and must finish before
- *   pi-mcp-adapter reads its config at `session_start` (and, for eager
- *   servers, at its own load time). Pi applies CLI flag values only AFTER
- *   extension loading, so the `--profile` / `--mcp-config` values are read
- *   from argv here; trust is mirrored from Pi's own resolution order
- *   (`hasTrustRequiringProjectResources` → stored decision →
- *   `defaultProjectTrust`; an interactive first-time prompt is not yet
- *   answerable at load time and counts as untrusted).
- * - The switch pass: the caller already has the resolved allowlist, so the
- *   overlay is derived from it directly.
- *
- * The generated file IS the adapter's Pi-global slot (`<agentDir>/mcp.json`):
- * flag injection is impossible (Pi rejects two extensions registering the
- * same flag), so the mechanism works with the slot the adapter already reads.
- * The user's own Pi-global servers live in the sidecar `mcp.user.json`.
- *
- * Failure policy: a profile name that cannot be resolved (missing, malformed
- * catalog, unknown name) falls back to "no filtering" — the generated overlay
- * then changes nothing, and the real problem is reported loudly by the
- * activation that runs right after. A foreign `--mcp-config` disables
- * management entirely: the user's explicit file is never overwritten.
- */
-
-import { hasTrustRequiringProjectResources, ProjectTrustStore } from "@earendil-works/pi-coding-agent";
-import path from "node:path";
-
-import { isRecord, readJsonFileSync } from "./json-file.ts";
-import { readAdapterOtherServerNamesSync, readMcpDocumentSync } from "./mcp-config.ts";
-import {
-	buildMcpOverlay,
-	isDisabledStub,
-	isGeneratedOverlay,
-	MCP_GENERATED_MARKER,
-	mcpSlotPath,
-	mcpSourcePath,
-	resolveAllowedServers,
-	serializeMcpOverlay,
-} from "./mcp-overlay.ts";
-import { writeMcpOverlayIfChangedSync } from "./mcp-overlay-file.ts";
-import { DEFAULT_PROFILE_NAME, parseCatalogDocument, type ProfileDefinition } from "./profile-catalog.ts";
-
-/** Reads `--<name> <value>` / `--<name>=<value>` without Pi's parser (Pi
- *  applies extension flag values only after extension loading). Last wins. */
-export function readFlagFromArgv(argv: readonly string[], name: string): string | undefined {
-	const long = `--${name}`;
-	let value: string | undefined;
-	for (let index = 0; index < argv.length; index++) {
-		const token = argv[index] ?? "";
-		if (token === long) {
-			const next = argv[index + 1];
-			if (next !== undefined && !next.startsWith("--")) value = next;
-			continue;
-		}
-		if (token.startsWith(`${long}=`)) {
-			const inline = token.slice(long.length + 1);
-			if (inline.length > 0) value = inline;
-		}
-	}
-	return value;
-}
-
-/** True when Pi itself would consider `cwd` trusted right now. Mirrors
- *  `resolveProjectTrusted` minus extension votes and the interactive prompt. */
-export function resolveProjectTrustedSync(agentDir: string, cwd: string): boolean {
-	if (!hasTrustRequiringProjectResources(cwd)) return true;
-	const stored = new ProjectTrustStore(agentDir).get(cwd);
-	if (stored !== null) return stored;
-	return readDefaultProjectTrustSync(agentDir) === "always";
-}
-
-/** The profile this pass generates the overlay for: this process's already
- *  applied selection (`continuation`) first — a reload must not regress to
- *  the `--profile` flag — then the flag, then the saved selection: project
- *  state wins over global state (project state only when trusted), then the
- *  built-in default. */
-export function resolveStartupProfileNameSync(input: {
-	agentDir: string;
-	cwd: string;
-	projectTrusted: boolean;
-	argv: readonly string[];
-	continuation?: string;
-}): string {
-	if (input.continuation !== undefined && input.continuation.length > 0) return input.continuation;
-	const requested = readFlagFromArgv(input.argv, "profile");
-	if (requested !== undefined && requested.length > 0) return requested;
-	const project = input.projectTrusted
-		? readActiveProfile(path.join(input.cwd, ".pi", "pi-profile-state.json"))
-		: undefined;
-	return project ?? readActiveProfile(path.join(input.agentDir, "pi-profile-state.json")) ?? DEFAULT_PROFILE_NAME;
-}
-
-export interface McpOverlaySyncInput {
-	agentDir: string;
-	cwd: string;
-	/** Pi's trust decision. Omitted on the extension-load pass, where Pi has
-	 *  not resolved trust yet; the module mirrors Pi's own order then. */
-	projectTrusted?: boolean;
-	/** Effective `--mcp-config`; undefined means the managed overlay path. */
-	overridePath?: string;
-	/** The selection this process already applied: a reload's overlay belongs
-	 *  to it, not to the `--profile` flag. */
-	continuation?: string;
-	/** The command line, for the load pass (Pi applies flag values only after
-	 *  extension loading, so `--profile` is read from here). */
-	argv?: readonly string[];
-	homeDir?: string;
-}
-
-export interface McpOverlaySyncResult {
-	overlayPath: string;
-	/** False when a foreign `--mcp-config` owns the adapter's slot. */
-	managed: boolean;
-	changed: boolean;
-	/** Set when nothing was written; the caller surfaces it as a warning. */
-	error?: string;
-}
-
-/** Load-time (and `session_start` re-check) pass. `profileName` short-circuits
- *  the state lookup when the caller already activated a profile. */
-export function syncStartupMcpOverlay(
-	input: McpOverlaySyncInput & { profileName?: string; mcpRefs?: readonly string[] | undefined },
-): McpOverlaySyncResult {
-	try {
-		const trust = input.projectTrusted;
-		const profileName =
-			input.profileName ??
-			resolveStartupProfileNameSync({
-				agentDir: input.agentDir,
-				cwd: input.cwd,
-				projectTrusted: trust ?? resolveProjectTrustedSync(input.agentDir, input.cwd),
-				argv: input.argv ?? [],
-				...(input.continuation === undefined ? {} : { continuation: input.continuation }),
-			});
-		const refs = input.mcpRefs ?? readProfileMcpRefsSync({ ...input, name: profileName, trust });
-		return writeOverlayForRefs({ ...input, refs });
-	} catch (error) {
-		return {
-			overlayPath: mcpSlotPath(input.agentDir),
-			managed: true,
-			changed: false,
-			error: error instanceof Error ? error.message : String(error),
-		};
-	}
-}
-
-/** Switch pass: the caller already resolved the allowlist. */
-export function syncMcpOverlayForSelection(
-	input: McpOverlaySyncInput & { allowed: readonly string[] | "all" },
-): McpOverlaySyncResult {
-	try {
-		return writeOverlay({ ...input, refs: input.allowed });
-	} catch (error) {
-		return {
-			overlayPath: mcpSlotPath(input.agentDir),
-			managed: true,
-			changed: false,
-			error: error instanceof Error ? error.message : String(error),
-		};
-	}
-}
-
-function writeOverlayForRefs(input: McpOverlaySyncInput & { refs: readonly string[] | undefined | "unknown" }): McpOverlaySyncResult {
-	// An unresolvable profile is not an error here: the generated overlay
-	// then filters nothing and the activation reports the real problem.
-	const refs = input.refs === "unknown" ? undefined : input.refs;
-	return writeOverlay({ ...input, refs });
-}
-
-function writeOverlay(input: McpOverlaySyncInput & { refs: readonly string[] | undefined | "all" }): McpOverlaySyncResult {
-	const overlayPath = mcpSlotPath(input.agentDir);
-	if (input.overridePath !== undefined && path.resolve(input.overridePath) !== overlayPath) {
-		return { overlayPath, managed: false, changed: false };
-	}
-	const projectTrusted = input.projectTrusted ?? resolveProjectTrustedSync(input.agentDir, input.cwd);
-	const discovery = {
-		agentDir: input.agentDir,
-		cwd: input.cwd,
-		projectTrusted,
-		...(input.homeDir === undefined ? {} : { homeDir: input.homeDir }),
-	};
-	// The slot is ours; a slot written by hand is adopted into the sidecar
-	// before the first overwrite, so a user's Pi-global servers survive.
-	const sourcePath = mcpSourcePath(input.agentDir);
-	adoptHandWrittenSlotSync(overlayPath, sourcePath);
-	const sourceDocument = readMcpDocumentSync(sourcePath);
-	const sourceNames = isRecord(sourceDocument?.mcpServers) ? Object.keys(sourceDocument.mcpServers) : [];
-	const otherNames = readAdapterOtherServerNamesSync(discovery);
-	const allowed =
-		input.refs === "all"
-			? "all"
-			: resolveAllowedServers(input.refs, [...new Set([...sourceNames, ...otherNames])].sort());
-	const content = serializeMcpOverlay(
-		buildMcpOverlay({
-			...(sourceDocument === undefined ? {} : { slotDocument: sourceDocument }),
-			otherServerNames: otherNames,
-			allowed,
-		}),
-	);
-	return { overlayPath, managed: true, changed: writeMcpOverlayIfChangedSync(overlayPath, content) };
-}
-
-/** A slot file without the generated marker holds the user's own Pi-global
- *  servers (from before this package managed the slot, or from a manual
- *  edit). Move them — plus the slot's non-server keys — into the sidecar
- *  before the slot is overwritten. Stub entries are skipped: they describe
- *  servers owned by the adapter's other sources. */
-function adoptHandWrittenSlotSync(slotPath: string, sourcePath: string): void {
-	const slot = readMcpDocumentSync(slotPath);
-	if (slot === undefined || isGeneratedOverlay(slot)) return;
-	const sidecar = readMcpDocumentSync(sourcePath) ?? {};
-	const sidecarServers = isRecord(sidecar.mcpServers) ? sidecar.mcpServers : {};
-	const servers: Record<string, unknown> = { ...sidecarServers };
-	const slotServers = isRecord(slot.mcpServers) ? slot.mcpServers : {};
-	for (const [name, definition] of Object.entries(slotServers)) {
-		if (isDisabledStub(definition)) continue;
-		servers[name] = definition;
-	}
-	const document: Record<string, unknown> = { ...sidecar };
-	delete document[MCP_GENERATED_MARKER];
-	for (const [key, value] of Object.entries(slot)) {
-		if (key === "mcpServers" || key === MCP_GENERATED_MARKER) continue;
-		document[key] = value;
-	}
-	document.mcpServers = Object.fromEntries(Object.entries(servers).sort(([left], [right]) => left.localeCompare(right)));
-	writeMcpOverlayIfChangedSync(sourcePath, `${JSON.stringify(document, null, 2)}\n`);
-}
-
-function readActiveProfile(statePath: string): string | undefined {
-	const result = readJsonFileSync(statePath);
-	if (!result.ok || !isRecord(result.value)) return undefined;
-	const name = result.value.activeProfile;
-	return typeof name === "string" && name.length > 0 ? name : undefined;
-}
-
-/** The profile's raw `mcps` references; `"unknown"` when the profile or its
- *  catalog cannot be read (caller falls back to "no filtering"). */
-function readProfileMcpRefsSync(
-	input: McpOverlaySyncInput & { name: string; trust: boolean | undefined },
-): readonly string[] | undefined | "unknown" {
-	if (input.name === DEFAULT_PROFILE_NAME) return undefined;
-	const trusted = input.trust ?? resolveProjectTrustedSync(input.agentDir, input.cwd);
-	const global = readCatalogSync(path.join(input.agentDir, "profiles.json"));
-	const project = trusted
-		? readCatalogSync(path.join(input.cwd, ".pi", "profiles.json"))
-		: new Map<string, ProfileDefinition>();
-	if (global === "error" || project === "error") return "unknown";
-	const definition = project.get(input.name) ?? global.get(input.name);
-	return definition === undefined ? "unknown" : definition.mcps;
-}
-
-function readCatalogSync(filePath: string): Map<string, ProfileDefinition> | "error" {
-	const result = readJsonFileSync(filePath);
-	if (!result.ok) return result.reason === "missing" ? new Map<string, ProfileDefinition>() : "error";
-	try {
-		return parseCatalogDocument(result.value, filePath);
-	} catch {
-		return "error";
-	}
-}
-
-function readDefaultProjectTrustSync(agentDir: string): string | undefined {
-	const result = readJsonFileSync(path.join(agentDir, "settings.json"));
-	if (!result.ok || !isRecord(result.value)) return undefined;
-	const value = result.value.defaultProjectTrust;
-	return typeof value === "string" ? value : undefined;
-}

package/src/startup-selection.ts

@@ -1,201 +0,0 @@
-/**
- * StartupSelection: how a session decides which profile to activate.
- *
- * - `--profile <name>` (a flag this extension registers) is an explicit,
- *   one-run selection: it is never written back to runtime state.
- * - Without the flag the saved selection applies: the trusted project's
- *   state wins over the global state, then the built-in `default`.
- * - Every session start after the first continues THIS process's selection
- *   (`continuation`): the flag is a startup directive, and re-reading it
- *   after an in-session switch would resurrect the profile the user just
- *   left. A continuation that no longer resolves falls back like a saved
- *   selection, with a warning, because a deleted profile must not strand the
- *   runtime.
- * - A saved selection that no longer resolves falls back to `default` with
- *   a warning — restore is a convenience, not a commitment. An explicit
- *   flag value never falls back: an unknown name is a loud error.
- *
- * Explicit CLI declarations (`--model`, `--thinking`, `--tools`,
- * `--exclude-tools`) outrank the profile's matching declaration. They are
- * detected by re-parsing this process's argv with Pi's own exported parser,
- * so the aliases and value forms stay Pi's rather than a hand-rolled copy.
- */
-
-import { parseArgs } from "@earendil-works/pi-coding-agent";
-import { stat } from "node:fs/promises";
-import path from "node:path";
-
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-
-import { DEFAULT_PROFILE_NAME, ProfileCatalog } from "./profile-catalog.ts";
-import { RuntimeStateStore } from "./runtime-state-store.ts";
-
-/** Which settings the user stated on the command line this run. */
-export interface ExplicitDeclarations {
-	model: boolean;
-	thinking: boolean;
-	tools: boolean;
-}
-
-export const PROFILE_FLAG = "profile";
-
-/** Registers the `--profile <name>` CLI flag. Pi has no flag of that name;
- *  unknown flags are collected by its parser and validated against flags
- *  registered by loaded extensions. */
-export function registerProfileFlag(pi: ExtensionAPI): void {
-	pi.registerFlag(PROFILE_FLAG, {
-		type: "string",
-		description: "pi-profile-switch: activate a profile for this run (not saved)",
-	});
-}
-
-/** The `--profile` value, when the user passed one. */
-export function readProfileFlag(pi: ExtensionAPI): string | undefined {
-	const value = pi.getFlag(PROFILE_FLAG);
-	return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-
-/** Detects explicit CLI declarations by re-parsing argv with Pi's parser. */
-export function detectExplicitDeclarations(argv: string[]): ExplicitDeclarations {
-	const parsed = parseArgs(argv);
-	return {
-		model: parsed.model !== undefined,
-		thinking: parsed.thinking !== undefined,
-		tools: parsed.tools !== undefined || parsed.excludeTools !== undefined,
-	};
-}
-
-export interface StartupProfile {
-	name: string;
-	/** Non-fatal notices (e.g. a saved profile that no longer exists). */
-	warnings: string[];
-}
-
-async function exists(filePath: string): Promise<boolean> {
-	try {
-		await stat(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-/** Files the retired extension registry lived in; they are no longer read
- *  (ADR-0007), and a leftover file is called out once per startup. */
-async function legacyRegistryWarnings(input: {
-	agentDir: string;
-	cwd: string;
-	projectTrusted: boolean;
-}): Promise<string[]> {
-	const candidates = [path.join(input.agentDir, "resources.json")];
-	if (input.projectTrusted) candidates.push(path.join(input.cwd, ".pi", "resources.json"));
-	const warnings: string[] = [];
-	for (const filePath of candidates) {
-		if (await exists(filePath)) {
-			warnings.push(
-				`${filePath} is no longer read (ADR-0007): extensions load natively in every profile — manage them with pi install`,
-			);
-		}
-	}
-	return warnings;
-}
-
-/**
- * The profile this process last applied. Kept on `globalThis` because Pi
- * re-imports extension modules on every reload (jiti) — module state resets
- * exactly when it is needed. It is a run-scoped fact, not saved state: the
- * `--profile` flag must not resurrect itself over an in-session switch when
- * the MCP overlay change rebuilds the runtime.
- */
-const RUN_SELECTION_KEY = "pi-profile-switch:applied-profile";
-
-interface RunSelection {
-	appliedProfile?: string;
-}
-
-function runSelection(): RunSelection {
-	const holder = globalThis as unknown as Record<string, RunSelection | undefined>;
-	const current = holder[RUN_SELECTION_KEY] ?? {};
-	holder[RUN_SELECTION_KEY] = current;
-	return current;
-}
-
-/** Records the profile this process applied (startup or in-session).
- *  `undefined` clears the record; a fresh process starts empty. */
-export function recordAppliedProfile(name: string | undefined): void {
-	runSelection().appliedProfile = name;
-}
-
-/** The profile this process is running, or undefined before the first
- *  activation. */
-export function appliedProfile(): string | undefined {
-	return runSelection().appliedProfile;
-}
-
-/** Resolves the profile name for this session: the run's current selection
- *  (`continuation`) → explicit flag → trusted project state → global state →
- *  default. Never writes state.
- *
- *  `requested` is the CLI flag: an unknown name is a loud error.
- *  `continuation` is what this process already applied, passed on every
- *  session start after the first: it keeps the in-session switch, and falls
- *  back (with a warning) when the name no longer resolves. */
-export async function resolveStartupProfile(input: {
-	agentDir: string;
-	cwd: string;
-	projectTrusted: boolean;
-	requested?: string;
-	continuation?: string;
-}): Promise<StartupProfile> {
-	const catalog = await ProfileCatalog.load(input.agentDir, {
-		projectDir: input.projectTrusted ? input.cwd : undefined,
-	});
-	const warnings: string[] = await legacyRegistryWarnings(input);
-
-	// The continuation first: this process already applied it, so the flag
-	// (a startup directive) has had its say.
-	if (input.continuation !== undefined) {
-		if (catalog.resolve(input.continuation) !== undefined) {
-			return { name: input.continuation, warnings };
-		}
-		warnings.push(
-			`profile ${JSON.stringify(input.continuation)} no longer exists — restoring the saved selection; ` +
-				`available: [${catalog.list().map((profile) => profile.name).join(", ")}]`,
-		);
-	}
-
-	if (input.requested !== undefined) {
-		if (catalog.resolve(input.requested) === undefined) {
-			throw new UnknownProfileError(input.requested, catalog.list().map((profile) => profile.name));
-		}
-		return { name: input.requested, warnings };
-	}
-
-	let saved: string | undefined;
-	if (input.projectTrusted) {
-		saved = (await new RuntimeStateStore(path.join(input.cwd, ".pi")).read()).activeProfile;
-	}
-	saved ??= (await new RuntimeStateStore(input.agentDir).read()).activeProfile;
-
-	if (saved === undefined || saved === DEFAULT_PROFILE_NAME) {
-		return { name: DEFAULT_PROFILE_NAME, warnings };
-	}
-	if (catalog.resolve(saved) === undefined) {
-		warnings.push(
-			`saved profile ${JSON.stringify(saved)} no longer exists — starting with "${DEFAULT_PROFILE_NAME}"; ` +
-				`available: [${catalog.list().map((profile) => profile.name).join(", ")}]`,
-		);
-		return { name: DEFAULT_PROFILE_NAME, warnings };
-	}
-	return { name: saved, warnings };
-}
-
-export class UnknownProfileError extends Error {
-	readonly requested: string;
-
-	constructor(requested: string, available: string[]) {
-		super(`unknown profile ${JSON.stringify(requested)} — available: [${available.join(", ")}]`);
-		this.name = "UnknownProfileError";
-		this.requested = requested;
-	}
-}