pi-profile-switch 0.3.1 → 0.4.2

package/src/profile-resolver.ts

@@ -1,280 +1,274 @@
 /**
- * ProfileResolver: turns one profile definition plus an optional runtime
- * overlay into an immutable selection, resolved against Pi's LIVE resources.
+ * ProfileResolver: a pure function from profile + registries to an immutable
+ * ActivationPlan.
  *
- * ADR-0007 semantics:
- * - `skills` resolves to a visibility filter (see skill-selection.ts), not
- *   to loaded resources: every skill stays loaded and user-invocable.
- * - `mcps` resolves to a runtime server allowlist; a declared MCP intent that
- *   cannot be satisfied (adapter absent, literal server unknown) fails the
- *   activation before anything is applied.
- * - `tools` resolves to an active tool set; literals the live registry does
- *   not provide yet become `pendingTools` and are retried, because MCP and
- *   extension tools register after session start.
- * - `model` and `instructions` pass through unchanged; applying them is the
- *   caller's job.
- *
- * The resolver is a pure function: same inputs, same selection, no I/O.
+ * Rules:
+ * - Glob references (`*`, `?`) expand against the full registry at every
+ *   resolution; zero matches is fine (new matches join on the next start) and
+ *   is reported in the plan's `unmatched` list so typos are visible.
+ * - Literal references must exist; a missing literal fails activation.
+ *   Extension references resolve through ResourceRegistry.select (ADR-0006):
+ *   registry ID, installed package name/alias, loose-file stem, or an
+ *   on-disk path — no pre-registration required.
+ * - `alwaysOn` resources and the recursive `dependsOn` closure join every
+ *   plan; cycles and missing entries fail loudly (via ResourceRegistry).
+ * - Undeclared model/thinking/instructions never enter the plan, so Pi's
+ *   current state stays untouched.
+ * - MCP references (`mcp`) expand against the server names the launcher
+ *   discovered from pi-mcp-adapter's pi-native config files: literal misses
+ *   fail loudly; globs expand to zero or more matches (consistent with
+ *   skills/extensions). Adapter presence is checked separately by the
+ *   launcher/extension (ADR-0002).
+ * - Tool globs expand against Pi's built-in tool names only: extension- and
+ *   MCP-provided tool names are unknowable before spawn (extension code must
+ *   not execute here), so literal tool names pass through unvalidated and
+ *   glob matching for contributed tools happens when the extension applies
+ *   the plan against Pi's actual registrations (tickets 05+).
  */
 
-import { isGlob, matchesReference, suggestNames } from "./name-matching.ts";
-import type { ProfileModel, ProfileSource, ResolvedProfile } from "./profile-catalog.ts";
-import type { RuntimeOverlay } from "./runtime-state-store.ts";
-
-/** The live resource view a resolution runs against. */
-export interface LiveResources {
-	/** Pi's loaded skills. `undefined` when the caller cannot read them yet:
-	 *  Pi exposes the list on command contexts and on the `before_agent_start`
-	 *  event, not in `session_start`'s event context. An unknown set leaves the
-	 *  visibility filter intact and reports nothing (see `skillWarnings`). */
-	skills?: Array<{ name: string; filePath: string }>;
-	toolNames: string[];
-	/** MCP adapter state: presence plus discovered server names. */
-	mcp: { adapterPresent: boolean; servers: string[] };
-}
+import { minimatch } from "minimatch";
 
-/** The skill references of a visibility filter: literals/globs, or `"all"`
- *  when the profile declares none and only the overlay narrows (nothing is
- *  hidden by omission). An empty array means "no skill is visible". */
-export type SkillRefs = string[] | "all";
+import type { DiscoveredExtensions } from "./extension-discovery.ts";
+import type { ProfileDefinition, ProfileModel, ProfileSource, ResolvedProfile } from "./profile-catalog.ts";
 
-/** The skill visibility filter handed to the prompt builder each turn. */
-export interface SkillsFilter {
-	refs: SkillRefs;
-	/** Skill name references removed from the visible set. */
-	disabled: string[];
+/** Extracts a ProfileModel from flat definition keys, if declared. */
+function extractModel(definition: ProfileDefinition): ProfileModel | undefined {
+	if (definition.defaultProvider === undefined || definition.defaultModel === undefined) return undefined;
+	return {
+		provider: definition.defaultProvider,
+		id: definition.defaultModel,
+		...(definition.defaultThinkingLevel !== undefined ? { thinkingLevel: definition.defaultThinkingLevel } : {}),
+	};
 }
+import type { RuntimeOverlay } from "./runtime-state-store.ts";
+import type { SkillEntry } from "./skill-registry.ts";
 
-/** A literal reference no live resource provides, with near-name hints. */
-export interface UnresolvedRef {
-	reference: string;
-	suggestions: string[];
+export class ActivationError extends Error {
+	constructor(message: string) {
+		super(message);
+		this.name = "ActivationError";
+	}
 }
 
-export interface SelectionWarnings {
-	skillsUnresolved: UnresolvedRef[];
-	skillsUnmatched: string[];
-	mcpUnmatched: string[];
-	toolsUnmatched: string[];
-}
+/** Pi's built-in tool names (pi 0.85.1 `allToolNames`; not exported by the
+ *  SDK). The integration suite guards drift. Literal tool names pass through
+ *  regardless — extension-provided tools are unknowable before spawn. */
+export const BUILTIN_TOOL_NAMES = ["read", "bash", "powershell", "edit", "write", "grep", "find", "ls"] as const;
 
-export interface ResolvedSelection {
-	name: string;
+const VALID_THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+
+/** Immutable, fully resolved activation set. */
+export interface ActivationPlan {
+	profile: string;
 	source: ProfileSource;
-	instructions?: string;
-	model?: ProfileModel;
-	/** Undefined means no visibility filtering (the whole loaded set). */
-	skills?: SkillsFilter;
-	/** Runtime MCP allowlist; undefined means publish nothing. */
-	mcp?: string[];
-	/** Active tool names; undefined means leave Pi's active set untouched. */
+	/** "none" exposes everything Pi can discover (the default profile). */
+	filter: "none" | "selection";
+	/** Selected skills with their resolved SKILL.md paths. Empty for default. */
+	skills: SkillEntry[];
+	/** Selected extensions. Empty for default. */
+	extensions: Array<{ id: string; entry: string; origin?: "package" | "local" | "path" }>;
+	/** Expanded tool allowlist; undefined when the profile declares no tools. */
 	tools?: string[];
-	/** Tool literals the live registry does not provide yet. */
-	pendingTools: string[];
-	warnings: SelectionWarnings;
-}
-
-export class SelectionError extends Error {
-	constructor(message: string) {
-		super(message);
-		this.name = "SelectionError";
-	}
+	/** The raw tool references (globs included) for extension-side expansion
+	 *  against Pi's live tool registry, which includes extension-provided
+	 *  tools the pre-spawn expansion cannot know. Set iff `tools` is set. */
+	toolReferences?: string[];
+	/** Declared model; undefined leaves Pi's current model untouched. */
+	model?: ProfileModel;
+	/** Declared instructions; appended to Pi's system prompt by the extension. */
+	instructions?: string;
+	/** Expanded MCP server allowlist for pi-mcp-adapter coordination;
+	 *  undefined when the profile declares no `mcps` (no coordination). */
+	mcps?: string[];
+	/** Glob references (skills/extensions/MCP) that matched nothing this
+	 *  resolution — surfaced as warnings so zero-match typos are never silent.
+	 *  Tool globs are excluded: extension-contributed tools are unknowable
+	 *  before spawn, so a pre-spawn zero-match proves nothing. */
+	unmatched?: string[];
 }
 
-/** Existence warnings for skill references against one live skill set.
- *  `undefined` means "not known yet" — Pi's skill list is only readable from
- *  a command context or from the `before_agent_start` event, so a startup
- *  activation reports nothing instead of every reference as unloaded. The
- *  same function re-checks the references on the first turn, when the list
- *  (including skills contributed through `resources_discover`) is complete. */
-export function skillWarnings(
-	refs: readonly string[],
-	live: LiveResources["skills"],
-): Pick<SelectionWarnings, "skillsUnresolved" | "skillsUnmatched"> {
-	const warning: Pick<SelectionWarnings, "skillsUnresolved" | "skillsUnmatched"> = {
-		skillsUnresolved: [],
-		skillsUnmatched: [],
-	};
-	if (live === undefined) return warning;
-	for (const ref of refs) {
-		const hits = live.filter((skill) => matchesReference(ref, skill.name));
-		if (hits.length === 0) {
-			if (isGlob(ref)) warning.skillsUnmatched.push(ref);
-			else warning.skillsUnresolved.push({ reference: ref, suggestions: suggestNames(ref, live.map((s) => s.name)) });
-		}
-	}
-	return warning;
+export interface ResolveInput {
+	profile: ResolvedProfile;
+	/** The full SkillRegistry result (not just selected skills). */
+	skills: SkillEntry[];
+	extensions: DiscoveredExtensions;
+	/**
+	 * Validates a declared model (exists and is authenticated) against the
+	 * user's real model/auth state. Returns an error message or undefined.
+	 * The launcher always provides this; a declared model without a validator
+	 * fails activation rather than silently skipping the check.
+	 */
+	validateModel?: (model: ProfileModel) => Promise<string | undefined>;
+	/**
+	 * Server names discovered from pi-mcp-adapter's pi-native config files
+	 * (see mcp-config.ts). Required when the profile declares `mcp`: without
+	 * the discovered names a reference cannot be validated, so activation
+	 * fails rather than passing references through unchecked.
+	 */
+	discoveredMcpServers?: string[];
+	/**
+	 * The runtime overlay (ticket 06): temporary narrowing applied on top of
+	 * the profile definition at every resolution. Overlay references must
+	 * name resources the profile actually resolves (typos fail loudly), and
+	 * `alwaysOn` extensions and their dependency chains cannot be disabled.
+	 */
+	overlay?: RuntimeOverlay;
 }
 
-function resolveSkills(
-	declared: string[] | undefined,
-	disabled: string[],
-	live: LiveResources["skills"],
-): { filter?: SkillsFilter; warning: Pick<SelectionWarnings, "skillsUnresolved" | "skillsUnmatched"> } {
-	if (declared === undefined) {
-		// The profile declares nothing; an overlay may still hide skills.
-		return {
-			...(disabled.length > 0 ? { filter: { refs: "all" as const, disabled } } : {}),
-			warning: skillWarnings([], live),
-		};
-	}
-	return { filter: { refs: declared, disabled }, warning: skillWarnings(declared, live) };
+function isGlob(reference: string): boolean {
+	return reference.includes("*") || reference.includes("?");
 }
 
-function resolveMcp(
-	declared: string[] | undefined,
-	disabled: string[],
-	live: LiveResources["mcp"],
-	profileName: string,
-): { servers?: string[]; warning: Pick<SelectionWarnings, "mcpUnmatched"> } {
-	const warning = { mcpUnmatched: [] as string[] };
-	if (declared === undefined) {
-		// No declared intent: only an overlay narrowing publishes an allowlist.
-		if (disabled.length === 0 || !live.adapterPresent) return { warning };
-		return { servers: live.servers.filter((server) => !disabled.includes(server)), warning };
-	}
-	if (!live.adapterPresent) {
-		throw new SelectionError(
-			`profile "${profileName}" declares MCP servers but pi-mcp-adapter is not active in this session — ` +
-				`install the adapter or remove the "mcps" declaration`,
-		);
-	}
-	const selected: string[] = [];
-	const missing: string[] = [];
-	for (const ref of declared) {
-		const hits = live.servers.filter((server) => matchesReference(ref, server));
-		if (hits.length > 0) {
-			selected.push(...hits);
+/** Expands one reference list against a named universe. Literal misses fail
+ *  when `literalMustExist`; globs expand to zero or more matches, and a
+ *  zero-match glob is reported through `onZeroMatch`. */
+function expandReferences<T>(
+	references: string[],
+	universe: readonly T[],
+	nameOf: (item: T) => string,
+	kind: string,
+	options?: { literalMustExist?: boolean; onZeroMatch?: (reference: string) => void },
+): T[] {
+	const selected = new Map<string, T>();
+	for (const reference of references) {
+		if (isGlob(reference)) {
+			let matched = 0;
+			for (const item of universe) {
+				if (minimatch(nameOf(item), reference)) {
+					selected.set(nameOf(item), item);
+					matched += 1;
+				}
+			}
+			if (matched === 0) options?.onZeroMatch?.(reference);
 			continue;
 		}
-		if (isGlob(ref)) warning.mcpUnmatched.push(ref);
-		else missing.push(ref);
-	}
-	if (missing.length > 0) {
-		throw new SelectionError(
-			`profile "${profileName}": unknown MCP server ${missing.map((name) => JSON.stringify(name)).join(", ")} — ` +
-				`adapter discovered: [${live.servers.join(", ")}]`,
-		);
+		const item = universe.find((candidate) => nameOf(candidate) === reference);
+		if (item === undefined) {
+			if (options?.literalMustExist === false) {
+				// Pass-through (e.g. extension-provided tool names).
+				selected.set(reference, reference as T);
+				continue;
+			}
+			throw new ActivationError(`unknown ${kind}: "${reference}" does not match any discovered ${kind}`);
+		}
+		selected.set(reference, item);
 	}
-	const servers = [...new Set(selected)].filter((server) => !disabled.includes(server));
-	return { servers, warning };
+	return [...selected.values()];
 }
 
-function resolveTools(
-	refs: string[] | undefined,
-	live: LiveResources["toolNames"],
-): {
-	tools?: string[];
-	pendingTools: string[];
-	warning: Pick<SelectionWarnings, "toolsUnmatched">;
-} {
-	const warning = { toolsUnmatched: [] as string[] };
-	if (refs === undefined) return { pendingTools: [], warning };
-	const selected: string[] = [];
-	const pending: string[] = [];
-	for (const ref of refs) {
-		const hits = live.filter((name) => matchesReference(ref, name));
-		if (hits.length > 0) {
-			selected.push(...hits);
-			continue;
+/** The built-in default profile: everything Pi can discover, no filtering. */
+export function defaultPlan(): ActivationPlan {
+	return { profile: "default", source: "builtin", filter: "none", skills: [], extensions: [] };
+}
+
+export async function resolveProfile(input: ResolveInput): Promise<ActivationPlan> {
+	const { profile, skills, extensions, overlay } = input;
+	const definition: ProfileDefinition = profile.definition;
+	const unmatched: string[] = [];
+
+	let mcps: string[] | undefined;
+	if (definition.mcps !== undefined && definition.mcps.length > 0) {
+		if (input.discoveredMcpServers === undefined) {
+			throw new ActivationError(
+				`profile "${profile.name}" declares MCP servers but no adapter server discovery is available`,
+			);
 		}
-		if (isGlob(ref)) warning.toolsUnmatched.push(ref);
-		else pending.push(ref);
+		mcps = expandReferences(definition.mcps, input.discoveredMcpServers, (name) => name, "MCP server", {
+			onZeroMatch: (reference) => unmatched.push(`mcp:${reference}`),
+		});
 	}
-	return { tools: [...new Set([...selected, ...pending])], pendingTools: [...new Set(pending)], warning };
-}
 
-/** Resolves one profile (plus overlay) against the live resources. Throws
- *  SelectionError when the profile's declared MCP intent cannot be
- *  satisfied; the caller applies nothing in that case.
- *
- *  `suppressTools` drops the profile's tool selection entirely, so a
- *  CLI-declared `--tools`/`--exclude-tools` keeps owning the active set
- *  (the preference table in docs/product/prd.md). */
-export function resolveSelection(input: {
-	profile: ResolvedProfile;
-	overlay?: RuntimeOverlay;
-	live: LiveResources;
-	suppressTools?: boolean;
-}): ResolvedSelection {
-	const { profile, overlay, live } = input;
-	const definition = profile.definition;
+	let selectedSkills = expandReferences(definition.skills ?? [], skills, (skill) => skill.name, "skill", {
+		onZeroMatch: (reference) => unmatched.push(`skill:${reference}`),
+	});
 
-	const skills = resolveSkills(definition.skills, overlay?.disabledSkills ?? [], live.skills);
-	const mcp = resolveMcp(definition.mcps, overlay?.disabledMcp ?? [], live.mcp, profile.name);
-	const tools = input.suppressTools === true
-		? { pendingTools: [], warning: { toolsUnmatched: [] } }
-		: resolveTools(overlay?.tools ?? definition.tools, live.toolNames);
+	// Extension references resolve directly against discovered extensions.
+	const selection = await extensions.select(definition.extensions ?? []);
+	for (const reference of selection.unmatched) unmatched.push(`extension:${reference}`);
+	let planExtensions: Array<{ id: string; entry: string; origin?: "package" | "local" | "path" }> = selection.entries.map(
+		(entry) => ({
+			id: entry.id,
+			entry: entry.entry,
+			...(entry.origin ? { origin: entry.origin } : {}),
+		}),
+	);
 
-	const selection: ResolvedSelection = {
-		name: profile.name,
-		source: profile.source,
-		pendingTools: tools.pendingTools,
-		warnings: {
-			...skills.warning,
-			...mcp.warning,
-			...tools.warning,
-		},
-	};
-	if (definition.instructions !== undefined && definition.instructions.length > 0) {
-		selection.instructions = definition.instructions;
-	}
-	if (definition.model !== undefined) {
-		selection.model = definition.model;
-	}
-	if (skills.filter !== undefined) {
-		selection.skills = skills.filter;
-	}
-	if (mcp.servers !== undefined) {
-		selection.mcp = mcp.servers;
-	}
-	if (tools.tools !== undefined) {
-		selection.tools = tools.tools;
+	// --- overlay narrowing (ticket 06) ---
+	// Overlay references must name resources the profile actually resolves
+	// (typos fail loudly). Overlays can disable any resolved extension.
+	let toolReferences = definition.tools;
+	if (overlay !== undefined) {
+		if (overlay.disabledSkills !== undefined && overlay.disabledSkills.length > 0) {
+			const active = new Set(selectedSkills.map((skill) => skill.name));
+			for (const name of overlay.disabledSkills) {
+				if (!active.has(name)) {
+					throw new ActivationError(`profile "${profile.name}": overlay disables unknown skill "${name}"`);
+				}
+			}
+			const disabled = new Set(overlay.disabledSkills);
+			selectedSkills = selectedSkills.filter((skill) => !disabled.has(skill.name));
+		}
+		if (overlay.disabledExtensions !== undefined && overlay.disabledExtensions.length > 0) {
+			const activeIds = new Set(planExtensions.map((entry) => entry.id));
+			for (const id of overlay.disabledExtensions) {
+				if (!activeIds.has(id)) {
+					throw new ActivationError(`profile "${profile.name}": overlay disables unknown extension "${id}"`);
+				}
+			}
+			const disabled = new Set(overlay.disabledExtensions);
+			planExtensions = planExtensions.filter((entry) => !disabled.has(entry.id));
+		}
+		if (overlay.disabledMcps !== undefined && overlay.disabledMcps.length > 0) {
+			const active = new Set(mcps ?? []);
+			for (const name of overlay.disabledMcps) {
+				if (!active.has(name)) {
+					throw new ActivationError(`profile "${profile.name}": overlay disables unknown MCP server "${name}"`);
+				}
+			}
+			const disabled = new Set(overlay.disabledMcps);
+			mcps = (mcps ?? []).filter((name) => !disabled.has(name));
+		}
+		if (overlay.tools !== undefined) {
+			toolReferences = overlay.tools;
+		}
 	}
-	return selection;
-}
 
-/** User-facing lines for one set of skill warnings. Shared by the startup
- *  report and the first-turn re-check, so both read identically. */
-export function formatSkillWarnings(
-	profile: string,
-	warning: Pick<SelectionWarnings, "skillsUnresolved" | "skillsUnmatched">,
-): string[] {
-	const lines: string[] = [];
-	for (const unresolved of warning.skillsUnresolved) {
-		const hint =
-			unresolved.suggestions.length > 0
-				? ` — did you mean: ${unresolved.suggestions.map((name) => JSON.stringify(name)).join(", ")}?`
-				: "";
-		lines.push(
-			`profile "${profile}": skill ${JSON.stringify(unresolved.reference)} is not loaded in this session${hint}`,
-		);
-	}
-	if (warning.skillsUnmatched.length > 0) {
-		lines.push(
-			`profile "${profile}": skill glob(s) ${warning.skillsUnmatched.map((ref) => JSON.stringify(ref)).join(", ")} matched nothing`,
-		);
+	let tools: string[] | undefined;
+	if (toolReferences !== undefined) {
+		tools = expandReferences(toolReferences, BUILTIN_TOOL_NAMES, (name) => name, "tool", {
+			literalMustExist: false,
+		});
 	}
-	return lines;
-}
 
-/** User-facing warning lines for one resolved selection. */
-export function formatSelectionWarnings(selection: ResolvedSelection): string[] {
-	const lines: string[] = formatSkillWarnings(selection.name, selection.warnings);
-	if (selection.warnings.mcpUnmatched.length > 0) {
-		lines.push(
-			`profile "${selection.name}": MCP glob(s) ${selection.warnings.mcpUnmatched.map((ref) => JSON.stringify(ref)).join(", ")} matched nothing`,
-		);
-	}
-	if (selection.warnings.toolsUnmatched.length > 0) {
-		lines.push(
-			`profile "${selection.name}": tool glob(s) ${selection.warnings.toolsUnmatched.map((ref) => JSON.stringify(ref)).join(", ")} matched nothing`,
-		);
-	}
-	if (selection.pendingTools.length > 0) {
-		lines.push(
-			`profile "${selection.name}": tool(s) ${selection.pendingTools.map((name) => JSON.stringify(name)).join(", ")} are not registered yet — applied when they appear`,
-		);
+	let model: ProfileModel | undefined;
+	const declaredModel = extractModel(definition);
+	if (declaredModel !== undefined) {
+		const declared = declaredModel;
+		if (declared.thinkingLevel !== undefined && !VALID_THINKING_LEVELS.has(declared.thinkingLevel)) {
+			throw new ActivationError(
+				`profile "${profile.name}": invalid thinkingLevel ${JSON.stringify(declared.thinkingLevel)}`,
+			);
+		}
+		if (input.validateModel === undefined) {
+			throw new ActivationError(`profile "${profile.name}" declares a model but no model validator is available`);
+		}
+		const error = await input.validateModel(declared);
+		if (error !== undefined) {
+			throw new ActivationError(`profile "${profile.name}": model ${declared.provider}/${declared.id}: ${error}`);
+		}
+		model = declared;
 	}
-	return lines;
+
+	return {
+		profile: profile.name,
+		source: profile.source,
+		filter: "selection",
+		skills: selectedSkills,
+		extensions: planExtensions.map((entry) => ({ id: entry.id, entry: entry.entry })),
+		...(tools !== undefined && toolReferences !== undefined ? { tools, toolReferences: [...toolReferences] } : {}),
+		...(model !== undefined ? { model } : {}),
+		...(definition.instructions !== undefined ? { instructions: definition.instructions } : {}),
+		...(mcps !== undefined ? { mcps } : {}),
+		...(unmatched.length > 0 ? { unmatched } : {}),
+	};
 }

package/src/project-trust.ts

@@ -0,0 +1,82 @@
+/**
+ * Project trust resolution for the launcher — pi-profile is the sole
+ * gatekeeper for project resources, because generated settings carry
+ * `defaultProjectTrust: "never"` and Pi therefore never auto-discovers them.
+ *
+ * Mirrors Pi's own trust decision order (`resolveProjectTrusted`), with
+ * pi-profile's catalog/registry/state files added to the trust-requiring
+ * resource set (they are pi-profile's project attack surface; Pi doesn't
+ * know about them):
+ *   1. one-run `--approve` / `--no-approve` override (consumed by the
+ *      launcher, never forwarded for named profiles)
+ *   2. a project with no trust-requiring resources at all is trusted —
+ *      there is nothing project-scoped to gate
+ *   3. the stored decision in the real `trust.json` (nearest ancestor wins)
+ *   4. the user's `defaultProjectTrust` setting — but only "always" grants;
+ *      "ask" cannot prompt here (the launcher has no trust UI), so it falls
+ *      through to untrusted
+ *   5. otherwise untrusted: project catalogs, registries, resources, and
+ *      state files are not read at all
+ *
+ * Known divergence from Pi: extension `project_trust` event handlers are not
+ * consulted — that would require executing extension code in the launcher,
+ * which pi-profile never does. In named-profile sessions the event is moot
+ * anyway (generated settings carry `defaultProjectTrust: "never"`).
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+import { hasTrustRequiringProjectResources, ProjectTrustStore } from "@earendil-works/pi-coding-agent";
+
+export interface ProjectTrustInput {
+	cwd: string;
+	agentDir: string;
+	/** One-run override from --approve (true) / --no-approve (false). */
+	trustOverride?: boolean;
+	/** The user's real global `defaultProjectTrust` setting. */
+	userDefaultProjectTrust?: string;
+}
+
+export function resolveProjectTrust(input: ProjectTrustInput): boolean {
+	if (input.trustOverride !== undefined) {
+		return input.trustOverride;
+	}
+	if (!hasTrustRequiringProjectResources(input.cwd) && !hasPiProfileProjectFiles(input.cwd)) {
+		return true;
+	}
+	let stored = new ProjectTrustStore(input.agentDir).get(input.cwd);
+	if (stored === null) {
+		// Defensive fallback for raw/symlinked entries in trust.json
+		// that ProjectTrustStore's canonicalizePath missed.
+		try {
+			const trustFile = path.join(input.agentDir, "trust.json");
+			if (existsSync(trustFile)) {
+				const content = JSON.parse(readFileSync(trustFile, "utf8"));
+				if (typeof content === "object" && content !== null) {
+					let curr: string | undefined = path.resolve(input.cwd);
+					while (curr && curr !== path.dirname(curr)) {
+						if (content[curr] === true || content[curr] === false) {
+							stored = content[curr];
+							break;
+						}
+						curr = path.dirname(curr);
+					}
+				}
+			}
+		} catch {}
+	}
+	if (stored !== null) {
+		return stored;
+	}
+	return input.userDefaultProjectTrust === "always";
+}
+
+/** pi-profile's own project files are trust-requiring even though Pi's
+ *  native list doesn't know them: a committed catalog/state file would
+ *  otherwise inject profile definitions (and instructions) unguarded. */
+function hasPiProfileProjectFiles(cwd: string): boolean {
+	return ["profiles.json", "pi-profile-state.json"].some((name) =>
+		existsSync(path.join(cwd, ".pi", name)),
+	);
+}