pi-profile-switch 0.4.3 → 0.4.5

package/README.md

@@ -59,7 +59,6 @@ In the TUI, the `/profile` command family manages everything in-session:
 | `/profile use <name>` / `/profile reload` | Switch / reload without restarting (rollback on failure) |
 | `/profile create\|edit\|delete\|duplicate` | Guided profile CRUD (TUI only) |
 | `/profile customize` / `/profile reset` | Narrow the active profile for this session only |
-| `/mcp enable\|disable <server>` | Toggle MCP servers in the active profile |
 
 All commands work in non-interactive modes (`--mode rpc|print|json`); CRUD wizards are TUI-only.
 

package/README.zh-CN.md

@@ -59,7 +59,6 @@ Profile 只**引用**资源，从不复制资源。已安装的包和标准目
 | `/profile use <name>` / `/profile reload` | 会话内切换 / 重载（失败自动回滚） |
 | `/profile create\|edit\|delete\|duplicate` | 向导式 profile 增删改（仅 TUI） |
 | `/profile customize` / `/profile reset` | 仅本次会话收窄活动 profile |
-| `/mcp enable\|disable <server>` | 在活动 profile 中开关 MCP server |
 
 非交互模式（`--mode rpc|print|json`）下命令同样生效；CRUD 向导仅 TUI 可用。
 

package/bin/pi-profile.ts

@@ -3,7 +3,7 @@
  * pi-profile launcher (ADR-0005).
  *
  * Resolves the initial profile, materializes it as a generated runtime
- * directory (settings + symlinks + env + flags), and spawns the real `pi`
+ * directory (settings + symlinks + env), and spawns the real `pi`
  * binary with user arguments passed through verbatim.
  *
  * Usage:
@@ -18,8 +18,7 @@ import { parseLauncherArgs } from "../src/launcher/args.ts";
 import { UnknownProfileError, resolveInitialProfile } from "../src/launcher/initial-profile.ts";
 import { sweepStaleRuntimeDirs } from "../src/launcher/runtime-cleanup.ts";
 import { spawnPi } from "../src/launcher/spawn.ts";
-import { McpConfigError } from "../src/mcp-config.ts";
-import { MissingMcpAdapterError } from "../src/mcp-coordination.ts";
+import { McpConfigError, MissingMcpAdapterError } from "../src/mcp-config.ts";
 import { CatalogError } from "../src/profile-catalog.ts";
 import { ActivationError } from "../src/profile-resolver.ts";
 import { generateRuntimeDir } from "../src/settings-generator.ts";

package/extensions/pi-profile/index.ts

@@ -21,8 +21,6 @@ import {
 	runProfileDuplicateWizard,
 	runProfileEditWizard,
 } from "../../src/switching/profile-wizard.ts";
-import { probeAdapterPresence } from "../../src/mcp-coordination.ts";
-import { setMcpServerEnabled } from "../../src/switching/mcp-toggle.ts";
 import { buildStatusReport, formatStatusMarkdown } from "../../src/switching/status.ts";
 import { switchProfile, type SwitchDeps } from "../../src/switching/switch-profile.ts";
 import { getGlobalStateDir } from "../../src/workspace.ts";
@@ -31,14 +29,12 @@ import { getGlobalStateDir } from "../../src/workspace.ts";
  * pi-profile extension entry.
  *
  * Loaded into the spawned pi via `-e`. Responsibilities:
- * - Append the profile's declared instructions to Pi's fully built system
- *   prompt on every turn (`before_agent_start`), so the default prompt,
- *   AGENTS.md, and other extensions keep working.
  * - After every session start (startup/reload/new/resume/fork), apply the
- *   launch plan: re-expand tool references against Pi's live registry,
- *   set the declared model/thinking, publish the MCP allowlist, persist the
- *   selection + rollback anchor after switches, and produce the one-shot
- *   change summary injected into the next turn.
+ *   launch plan: re-expand tool references against Pi's live registry
+ *   (including extension- and MCP-provided tools) and call setActiveTools
+ *   for strict allowlisting, persist the selection after switches, and
+ *   produce the one-shot change summary injected into the next turn
+ *   via `before_agent_start`.
  * - `/profile use <name>` / `/profile reload`: in-session switching without
  *   restarting the Pi process (src/switching/switch-profile.ts).
  * - `/profile customize` / `/profile reset`: runtime overlay (ticket 06).
@@ -53,9 +49,6 @@ import { getGlobalStateDir } from "../../src/workspace.ts";
  *   is stale afterwards.
  * - list/status ship structured `details` payloads (`{kind, profiles}` /
  *   `{kind, report}`) for RPC consumers (ticket 11).
- * - `/mcp enable|disable <server>`: edit the active profile's mcp array in
- *   its owning catalog, then reload (ticket 10). Fails clearly with the
- *   adapter absent; notifies before the reload (stale context after).
  *
  * Pi re-executes this module on reload, so post-reload state is established
  * exclusively through `session_start` — nothing stale survives.
@@ -83,11 +76,6 @@ export default function piProfileExtension(pi: ExtensionAPI): void {
 			surface: {
 				getAllTools: () => pi.getAllTools(),
 				setActiveTools: (names) => pi.setActiveTools(names),
-				modelRegistry: ctx.modelRegistry,
-				setModel: (model) => pi.setModel(model as Parameters<ExtensionAPI["setModel"]>[0]),
-				setThinkingLevel: (level) =>
-					pi.setThinkingLevel(level as Parameters<ExtensionAPI["setThinkingLevel"]>[0]),
-				events: pi.events,
 				notify: (message, level) => ctx.ui?.notify(message, level),
 			},
 		});
@@ -95,12 +83,7 @@ export default function piProfileExtension(pi: ExtensionAPI): void {
 	});
 
 	pi.on("before_agent_start", async (event) => {
-		const plan = await readLaunchPlanFile(runtimeDir);
-		const instructions = plan?.instructions;
 		let systemPrompt = event.systemPrompt;
-		if (instructions !== undefined && instructions.length > 0 && !systemPrompt.includes(instructions)) {
-			systemPrompt = `${systemPrompt}\n\n${instructions}`;
-		}
 		if (pendingSummary !== undefined) {
 			systemPrompt = `${systemPrompt}\n\n[${pendingSummary}]`;
 			pendingSummary = undefined;
@@ -383,69 +366,4 @@ export default function piProfileExtension(pi: ExtensionAPI): void {
 			}
 		},
 	});
-
-	// Persistent profile-scoped MCP toggles (ticket 10): edit the active
-	// profile's mcp array in its owning catalog, then reload so the runtime
-	// and the republished allowlist match. The adapter's own configuration
-	// (mcp.json files) is never written.
-	pi.registerCommand("mcp", {
-		description: "pi-profile: /mcp enable <server> | /mcp disable <server>",
-		handler: async (args, ctx) => {
-			const notify = (message: string, level: "info" | "warning" | "error") => {
-				try {
-					ctx.ui?.notify(message, level);
-				} catch {
-					// stale context after reload — see /profile
-				}
-			};
-			const [action, server] = args.trim().split(/\s+/).filter(Boolean);
-			if (!["enable", "disable"].includes(action ?? "") || server === undefined) {
-				notify("usage: /mcp enable <server> | /mcp disable <server>", "error");
-				return;
-			}
-			try {
-				const plan = await readLaunchPlanFile(runtimeDir);
-				if (plan?.agentDir === undefined) {
-					notify("pi-profile: launch plan is missing agentDir — cannot toggle MCP servers", "error");
-					return;
-				}
-				if (!probeAdapterPresence(pi.events)) {
-					throw new Error(
-						"pi-mcp-adapter is not active in this session — /mcp enable|disable requires it " +
-							"(select the adapter in the profile's extensions).",
-					);
-				}
-				const result = await setMcpServerEnabled(
-					{ realAgentDir: plan.agentDir, cwd: ctx.cwd, profile: { name: plan.profile, source: plan.source } },
-					server,
-					action === "enable",
-				);
-				if (!result.changed) {
-					notify(`MCP server "${server}" is already ${action}d in profile "${plan.profile}"`, "info");
-					return;
-				}
-				// Notify BEFORE the reload: this context is stale afterwards.
-				notify(
-					`${action}d MCP server "${server}" in profile "${plan.profile}" (mcps: [${result.mcps.join(", ")}]); reloading`,
-					"info",
-				);
-				const switched = await switchProfile(plan.profile, {
-					runtimeDir,
-					realAgentDir: plan.agentDir,
-					cwd: ctx.cwd,
-					waitForIdle: () => ctx.waitForIdle(),
-					reload: () => ctx.reload(),
-					// Same staleness probe as /profile: interactive Pi
-					// swallows reload refusals; a live context afterwards
-					// means the reload never ran.
-					assertStale: () => {
-						void ctx.cwd;
-					},
-				}, { reloadCurrent: true });
-				for (const warning of switched.warnings) notify(warning, "warning");
-			} catch (error) {
-				notify(error instanceof Error ? error.message : String(error), "error");
-			}
-		},
-	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-profile-switch",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Named profiles for Pi: reference skills, extensions, MCP servers, and tools per workflow, switched without restarting.",
   "type": "module",
   "keywords": [

package/src/extension-discovery.ts

@@ -1,7 +1,7 @@
 /**
  * ExtensionDiscovery: implicit, read-only discovery of selectable extensions
- * (ADR-0006), so profiles can reference extensions without registering them
- * in resources.json first.
+ * (ADR-0006), so profiles can reference extensions without any
+ * registration step.
  *
  * Two implicit sources, both Pi-native and side-effect free:
  * - Configured user packages: each package's `package.json#pi.extensions`
@@ -13,9 +13,6 @@
  *
  * Discovery never executes extension code and never installs anything: a
  * package contributes entries only for declared files that exist on disk.
- * Explicit resources.json entries merge over this discovery result in
- * ResourceRegistry.load (registration remains the override, never the
- * prerequisite).
  */
 
 import { readdir, readFile, stat } from "node:fs/promises";
@@ -328,7 +325,7 @@ export async function discoverImplicitExtensions(options: {
 	const merged = new Map<string, DiscoveredLocalExtension>(globalLocal.map((entry) => [entry.id, entry]));
 	if (options.projectDir !== undefined) {
 		// Project loose files override same-ID global ones, mirroring the
-		// catalog/registry override convention.
+		// project-over-global catalog override convention.
 		for (const entry of await scanLooseDir(path.join(options.projectDir, ".pi", "extensions"), warnings)) {
 			merged.set(entry.id, entry);
 		}

package/src/json-file.ts

@@ -1,8 +1,8 @@
 /**
  * Shared JSON-file reading for pi-profile's file-backed stores (catalog,
- * resource registry, runtime state). Each store maps read failures to its
- * own error policy (loud CatalogError/RegistryError vs. quiet state
- * fallback); this helper only classifies the outcome.
+ * runtime state). Each store maps read failures to its own error policy
+ * (loud CatalogError vs. quiet state fallback); this helper only classifies
+ * the outcome.
  */
 
 import { readFile } from "node:fs/promises";

package/src/launcher/initial-profile.ts

@@ -3,10 +3,10 @@
  *
  * Flow: trust check (gatekeeper for everything project-scoped) → positional
  * name or saved state (project state wins when trusted) → catalog lookup →
- * skill discovery + resource registry → resolver (glob expansion, dependency
- * closure, alwaysOn, model validation) → ActivationPlan + full discovery
- * results for the settings generator. Unknown profiles, malformed
- * catalogs/registries, and unresolvable resources all fail before Pi spawns.
+ * discovery (skills, extensions, MCP server names) → resolver (glob
+ * expansion, overlay, model validation) → ActivationPlan + full discovery
+ * results for the settings generator. Unknown profiles, malformed catalogs,
+ * and unresolvable resources all fail before Pi spawns.
  *
  * The CLI's initial selection is transient: no runtime state is written here.
  */
@@ -15,7 +15,7 @@ import path from "node:path";
 
 import { isRecord, readJsonFile } from "../json-file.ts";
 import { discoverAdapterServerNames } from "../mcp-config.ts";
-import { isAdapterExtension, MissingMcpAdapterError } from "../mcp-coordination.ts";
+import { isAdapterExtension, MissingMcpAdapterError } from "../mcp-config.ts";
 import { ProfileCatalog, type ResolvedProfile } from "../profile-catalog.ts";
 import { ActivationError, defaultPlan, resolveProfile, type ActivationPlan } from "../profile-resolver.ts";
 import { resolveProjectTrust } from "../project-trust.ts";

package/src/launcher/spawn.ts

@@ -1,8 +1,8 @@
 /**
  * Spawns the real `pi` binary as a subprocess (ADR-0005).
  *
- * The spawned pi gets: the pi-profile extension via `-e`, any generated
- * flags, and the user's arguments verbatim. stdio is inherited so interactive
+ * The spawned pi gets: the pi-profile extension via `-e` and the user's
+ * arguments verbatim. stdio is inherited so interactive
  * TUI, RPC, and print modes all behave natively; exit codes and signals
  * propagate.
  */
@@ -15,7 +15,7 @@ import { fileURLToPath } from "node:url";
 import type { GeneratedRuntime } from "../settings-generator.ts";
 
 export interface SpawnPiOptions {
-	/** Generated runtime dir + env + flags. */
+	/** Generated runtime dir + env. */
 	generated: GeneratedRuntime;
 	/** User arguments, forwarded verbatim. */
 	piArgs: string[];
@@ -25,10 +25,10 @@ export interface SpawnPiOptions {
 
 const EXTENSION_ENTRY = fileURLToPath(new URL("../../extensions/pi-profile/index.ts", import.meta.url));
 
-/** Pure argv construction for the spawned pi: extension entry, generated
- *  flags, trust re-application, then user args verbatim. */
+/** Pure argv construction for the spawned pi: extension entry,
+ *  trust re-application, then user args verbatim. */
 export function buildPiArgs(options: SpawnPiOptions): string[] {
-	const args = ["-e", EXTENSION_ENTRY, ...options.generated.flags];
+	const args = ["-e", EXTENSION_ENTRY];
 	// default profile keeps trust behavior native: re-apply the recorded flag.
 	if (options.trustOverride === true) args.push("--approve");
 	if (options.trustOverride === false) args.push("--no-approve");

package/src/mcp-config.ts

@@ -134,3 +134,22 @@ export async function discoverAdapterServerNames(
 	const { servers } = await loadMergedMcpServers(agentDir, projectDir, options);
 	return Object.keys(servers).sort();
 }
+
+export class MissingMcpAdapterError extends Error {
+	constructor(profile: string) {
+		super(
+			`profile "${profile}" declares MCP servers but pi-mcp-adapter is not active. ` +
+				`Select the adapter in the profile's extensions (e.g. via its npm package) or remove the "mcps" declaration.`,
+		);
+		this.name = "MissingMcpAdapterError";
+	}
+}
+
+/** Identifies the adapter among active extension entries by its install
+ *  path containing "pi-mcp-adapter" (npm package roots and local dirs both
+ *  match). Heuristic by design — activation-plan entries carry no package
+ *  source string. */
+export function isAdapterExtension(entry: { entry: string }): boolean {
+	return entry.entry.includes("pi-mcp-adapter");
+}
+

package/src/profile-resolver.ts

@@ -7,23 +7,21 @@
  *   resolution; zero matches is fine (new matches join on the next start) and
  *   is reported in the plan's `unmatched` list so typos are visible.
  * - Literal references must exist; a missing literal fails activation.
- *   Extension references resolve through ResourceRegistry.select (ADR-0006):
- *   registry ID, installed package name/alias, loose-file stem, or an
- *   on-disk path — no pre-registration required.
- * - `alwaysOn` resources and the recursive `dependsOn` closure join every
- *   plan; cycles and missing entries fail loudly (via ResourceRegistry).
+ *   Extension references resolve through ExtensionDiscovery.select (ADR-0007):
+ *   package name/alias, loose-file stem, or an on-disk path — no
+ *   pre-registration required.
  * - Undeclared model/thinking/instructions never enter the plan, so Pi's
  *   current state stays untouched.
  * - MCP references (`mcp`) expand against the server names the launcher
  *   discovered from pi-mcp-adapter's pi-native config files: literal misses
  *   fail loudly; globs expand to zero or more matches (consistent with
  *   skills/extensions). Adapter presence is checked separately by the
- *   launcher/extension (ADR-0002).
- * - Tool globs expand against Pi's built-in tool names only: extension- and
- *   MCP-provided tool names are unknowable before spawn (extension code must
- *   not execute here), so literal tool names pass through unvalidated and
- *   glob matching for contributed tools happens when the extension applies
- *   the plan against Pi's actual registrations (tickets 05+).
+ *   launcher (ADR-0002).
+ * - Tool globs expand against Pi's built-in tool names for settings
+ *   `defaultTools`; raw tool references are also carried into the launch
+ *   plan so the in-session extension can expand them against Pi's live
+ *   registry (including extension and MCP tools) via setActiveTools for
+ *   strict allowlisting.
  */
 
 import { minimatch } from "minimatch";
@@ -75,10 +73,13 @@ export interface ActivationPlan {
 	toolReferences?: string[];
 	/** Declared model; undefined leaves Pi's current model untouched. */
 	model?: ProfileModel;
-	/** Declared instructions; appended to Pi's system prompt by the extension. */
+	/** Declared instructions; written to the generated APPEND_SYSTEM.md,
+	 *  which Pi natively appends to the system prompt. */
 	instructions?: string;
-	/** Expanded MCP server allowlist for pi-mcp-adapter coordination;
-	 *  undefined when the profile declares no `mcps` (no coordination). */
+	/** Expanded MCP server allowlist: written by SettingsGenerator into the
+	 *  filtered instance `mcp.json` (the adapter's runtime restriction) and
+	 *  surfaced in `/profile status`; undefined when the profile declares
+	 *  no `mcps` (no restriction). */
 	mcps?: string[];
 	/** Glob references (skills/extensions/MCP) that matched nothing this
 	 *  resolution — surfaced as warnings so zero-match typos are never silent.
@@ -110,7 +111,7 @@ export interface ResolveInput {
 	 * The runtime overlay (ticket 06): temporary narrowing applied on top of
 	 * the profile definition at every resolution. Overlay references must
 	 * name resources the profile actually resolves (typos fail loudly), and
-	 * `alwaysOn` extensions and their dependency chains cannot be disabled.
+	 * any resolved reference may be narrowed or disabled.
 	 */
 	overlay?: RuntimeOverlay;
 }

package/src/project-trust.ts

@@ -4,7 +4,7 @@
  * `defaultProjectTrust: "never"` and Pi therefore never auto-discovers them.
  *
  * Mirrors Pi's own trust decision order (`resolveProjectTrusted`), with
- * pi-profile's catalog/registry/state files added to the trust-requiring
+ * pi-profile's catalog/state files added to the trust-requiring
  * resource set (they are pi-profile's project attack surface; Pi doesn't
  * know about them):
  *   1. one-run `--approve` / `--no-approve` override (consumed by the

package/src/runtime-state-store.ts

@@ -6,17 +6,13 @@
  * for global state, the project's `.pi` dir for project state (project
  * state is only touched when the trust check passed). The launcher only
  * reads — the initial CLI selection is transient by design; `/profile use`
- * (ticket 05) writes both the selection and the rollback anchor.
+ * (ticket 05) writes the selection.
  *
- * `activeProfile` is the saved selection restored on launch;
- * `lastVerifiedProfile` is the rollback anchor: the last profile whose
- * activation completed successfully. They differ only between a failed
- * activation and its rollback.
+ * `activeProfile` is the saved selection restored on launch.
  *
  * A missing or malformed state file is not an error on read — it simply
  * means "fall back to the default profile". Unexpected I/O errors
- * propagate. Writes replace the file wholesale (both fields are always
- * written together by the switch path).
+ * propagate. Writes replace the file wholesale.
  */
 
 import { mkdir, writeFile } from "node:fs/promises";
@@ -26,7 +22,6 @@ import { isRecord, readJsonFile } from "./json-file.ts";
 
 export interface RuntimeState {
 	activeProfile?: string;
-	lastVerifiedProfile?: string;
 	/** The runtime overlay: temporary narrowing of the active profile
 	 *  (ticket 06). Never written to catalogs, never applied at launch —
 	 *  only in-session switches/reloads read it. */
@@ -69,9 +64,6 @@ export class RuntimeStateStore {
 		if (typeof result.value.activeProfile === "string") {
 			state.activeProfile = result.value.activeProfile;
 		}
-		if (typeof result.value.lastVerifiedProfile === "string") {
-			state.lastVerifiedProfile = result.value.lastVerifiedProfile;
-		}
 		const overlay = parseOverlay(result.value.overlay);
 		if (overlay !== undefined) {
 			state.overlay = overlay;
@@ -94,10 +86,6 @@ export class RuntimeStateStore {
 			if (patch.activeProfile === undefined) delete next.activeProfile;
 			else next.activeProfile = patch.activeProfile;
 		}
-		if ("lastVerifiedProfile" in patch) {
-			if (patch.lastVerifiedProfile === undefined) delete next.lastVerifiedProfile;
-			else next.lastVerifiedProfile = patch.lastVerifiedProfile;
-		}
 		if ("overlay" in patch) {
 			if (patch.overlay === undefined) delete next.overlay;
 			else next.overlay = patch.overlay;

package/src/settings-generator.ts

@@ -5,7 +5,7 @@
  * Two entry points:
  * - `generateRuntimeDir` (launcher): mkdtemp a fresh runtime dir, write the
  *   files, link state (auth/models/mcp/npm/git/bin; trust.json only for
- *   default), derive env + flags.
+ *   default), derive env.
  * - `writeRuntimeFiles` (in-session switch, ticket 05): rewrite
  *   settings.json + pi-profile.json inside the EXISTING runtime dir (the
  *   running process's PI_CODING_AGENT_DIR cannot move), and transition the
@@ -31,8 +31,9 @@
  *   root as a launch side effect)
  * - unmanaged kinds (prompts, themes) pass through: the user's arrays are
  *   preserved and the real agent dir's prompts/themes dirs re-included
- * - tools/model become generated flags; the launch plan file feeds the
- *   in-pi extension (instructions injection, status)
+ * - tools/model are written to generated settings (defaultTools,
+ *   defaultProvider, defaultModel, defaultThinkingLevel); the launch plan
+ *   file feeds the in-pi extension (tools strict allowlist, status)
  *
  * User configuration files are never modified.
  */
@@ -85,8 +86,6 @@ export interface GeneratedRuntime {
 	runtimeDir: string;
 	/** Environment variables for the spawned pi process. */
 	env: Record<string, string>;
-	/** Extra pi flags derived from the plan (e.g. --tools, --model). Empty for default. */
-	flags: string[];
 }
 
 /** Files managed explicitly by pi-profile in runtimeDir; excluded from auto-symlinking. */
@@ -117,6 +116,18 @@ async function exists(filePath: string): Promise<boolean> {
 	}
 }
 
+/** Symlink-aware existence check (lstat): a dangling symlink still counts as
+ *  existing — a stat-based check misses it, which would skip its removal or
+ *  collide on symlink creation. Use this for paths pi-profile links itself. */
+async function existsLexical(filePath: string): Promise<boolean> {
+	try {
+		await lstat(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 function toPosix(filePath: string): string {
 	return filePath.split(path.sep).join("/");
 }
@@ -291,8 +302,8 @@ export interface RuntimeFileOptions {
 	projectSettings?: Record<string, unknown>;
 	/** Extra launch-plan fields written by the in-session switch path:
 	 *  `switchedFrom` triggers the one-shot change summary; `persistSelection`
-	 *  tells the post-reload extension instance to save the selection and
-	 *  record the rollback anchor; `clearOverlay` drops the stored overlay
+	 *  tells the post-reload extension instance to save the selection;
+	 *  `clearOverlay` drops the stored overlay
 	 *  (a profile switch discards the previous profile's overlay).
 	 *  `previousResolved` carries the pre-switch resolved name sets so
 	 *  `/profile status` can report glob deltas (ticket 07). */
@@ -372,10 +383,11 @@ export async function writeRuntimeFiles(
 	const settings = await computeSettings(plan, options, runtimeDir);
 	await writeFile(path.join(runtimeDir, "settings.json"), `${JSON.stringify(settings, null, 2)}\n`);
 
-	// The launch plan feeds the in-pi extension: instructions injection,
-	// tool/model re-application after reload, MCP coordination, switching.
+	// The launch plan feeds the in-pi extension: tool re-application after
+	// reload (the tools strict allowlist), in-session switching, status
+	// reporting, and post-reload state persistence.
 	// agentDir is the REAL agent dir — the extension needs it for trust
-	// checks, state files, and catalog/registry reads (its own
+	// checks, state files, and catalog reads (its own
 	// PI_CODING_AGENT_DIR points at this runtime dir).
 	await writeFile(
 		path.join(runtimeDir, "pi-profile.json"),
@@ -384,8 +396,6 @@ export async function writeRuntimeFiles(
 				profile: plan.profile,
 				source: plan.source,
 				agentDir: options.agentDir,
-				...(plan.instructions !== undefined ? { instructions: plan.instructions } : {}),
-				...(plan.model !== undefined ? { model: plan.model } : {}),
 				...(plan.tools !== undefined ? { tools: plan.tools } : {}),
 				...(plan.toolReferences !== undefined ? { toolReferences: plan.toolReferences } : {}),
 				...(plan.mcps !== undefined ? { mcps: plan.mcps } : {}),
@@ -408,10 +418,14 @@ export async function writeRuntimeFiles(
 	const trustLink = path.join(runtimeDir, "trust.json");
 	const trustTarget = path.join(options.agentDir, "trust.json");
 	if (plan.filter === "none") {
-		if ((await exists(trustTarget)) && !(await exists(trustLink))) {
+		if ((await exists(trustTarget)) && !(await existsLexical(trustLink))) {
 			await symlink(trustTarget, trustLink);
 		}
-	} else if (await exists(trustLink)) {
+	} else if (await existsLexical(trustLink)) {
+		// Lexical check: a dangling trust.json symlink (real trust.json deleted
+		// after the link was made) must still be removed — otherwise a later
+		// re-created real trust.json silently resurrects stored trust inside a
+		// named profile, defeating defaultProjectTrust: "never".
 		await rm(trustLink);
 	}
 
@@ -543,13 +557,10 @@ export async function generateRuntimeDir(
 
 	await writeRuntimeFiles(runtimeDir, plan, options);
 
-	const flags: string[] = [];
-
 	return {
 		runtimeDir,
 		env: {
 			PI_CODING_AGENT_DIR: runtimeDir,
 		},
-		flags,
 	};
 }

package/src/switching/apply-plan.ts

@@ -9,17 +9,16 @@
  *
  * Steps:
  *   1. tools: re-expand the profile's raw tool references against Pi's LIVE
- *      tool registry (includes extension-provided tools the pre-spawn
- *      expansion cannot know) and setActiveTools. Literals that no tool
- *      provides are dropped with a warning — Pi silently ignores unknown
- *      names, so the warning is the only signal.
- *   2. model: setModel + setThinkingLevel when declared.
- *   3. mcp: probe the adapter and publish the runtime allowlist (ticket 04).
- *   4. persistence: when the plan is marked `persistSelection` and this is a
- *      reload, save the selection and the rollback anchor
- *      (activeProfile = lastVerifiedProfile = plan.profile) to the
+ *      tool registry (including extension- and MCP-provided tools) and
+ *      call setActiveTools. This is the CURRENT strict-allowlist enforcement
+ *      ensuring non-builtin tools obey profile restrictions; settings
+ *      `defaultTools` provides only the boot baseline for built-ins.
+ *      Literals that no tool provides are dropped with a warning — Pi
+ *      silently ignores unknown names, so the warning is the only signal.
+ *   2. persistence: when the plan is marked `persistSelection` and this is a
+ *      reload, save the selection (activeProfile = plan.profile) to the
  *      profile's scope state file. Launch-transient selections never write.
- *   5. change summary: a `switchedFrom` marker produces a one-shot summary
+ *   3. change summary: a `switchedFrom` marker produces a one-shot summary
  *      for the next agent turn and is cleared from the plan file.
  *
  * Pi's reload re-executes extension modules, so no stale handler or command
@@ -31,12 +30,6 @@ import { writeFile } from "node:fs/promises";
 import path from "node:path";
 
 import { isRecord, readJsonFile } from "../json-file.ts";
-import {
-	MCP_ALLOWLIST_EVENT,
-	MCP_ALLOWLIST_VERSION,
-	MissingMcpAdapterError,
-	probeAdapterPresence,
-} from "../mcp-coordination.ts";
 import { RuntimeStateStore } from "../runtime-state-store.ts";
 import { getGlobalStateDir } from "../workspace.ts";
 import { expandToolReferences } from "./tool-references.ts";
@@ -45,8 +38,6 @@ export interface LaunchPlanFile {
 	profile: string;
 	source: string;
 	agentDir?: string;
-	instructions?: string;
-	model?: { provider: string; id: string; thinkingLevel?: string };
 	tools?: string[];
 	toolReferences?: string[];
 	mcps?: string[];
@@ -71,10 +62,6 @@ export interface LaunchPlanFile {
 export interface PlanApplicationSurface {
 	getAllTools(): Array<{ name: string }>;
 	setActiveTools(names: string[]): void;
-	modelRegistry: { find(provider: string, id: string): unknown | undefined };
-	setModel(model: unknown): Promise<boolean>;
-	setThinkingLevel(level: unknown): void;
-	events: { emit(channel: string, data: unknown): void };
 	notify?(message: string, level: "info" | "warning" | "error"): void;
 }
 
@@ -119,46 +106,13 @@ export async function applyLaunchPlan(input: {
 		surface.setActiveTools(expanded);
 	}
 
-	// --- model ---
-	if (plan.model !== undefined) {
-		const found = surface.modelRegistry.find(plan.model.provider, plan.model.id);
-		if (found === undefined) {
-			warnings.push(`profile "${plan.profile}": declared model ${plan.model.provider}/${plan.model.id} not found`);
-		} else {
-			const applied = await surface.setModel(found);
-			if (!applied) {
-				warnings.push(
-					`profile "${plan.profile}": model ${plan.model.provider}/${plan.model.id} has no configured auth`,
-				);
-			}
-		}
-		if (plan.model.thinkingLevel !== undefined) {
-			surface.setThinkingLevel(plan.model.thinkingLevel);
-		}
-	}
-
-	// --- mcp coordination (ticket 04 contract) ---
-	if (plan.mcps !== undefined && plan.mcps.length > 0) {
-		if (!probeAdapterPresence(surface.events)) {
-			const error = new MissingMcpAdapterError(plan.profile);
-			surface.notify?.(error.message, "error");
-			throw error;
-		}
-		surface.events.emit(MCP_ALLOWLIST_EVENT, {
-			version: MCP_ALLOWLIST_VERSION,
-			profile: plan.profile,
-			servers: plan.mcps,
-		});
-	}
-
-	// --- persistence + rollback anchor (post-reload only) ---
+	// --- persistence (post-reload only) ---
 	if (plan.persistSelection === true && input.reason === "reload" && plan.agentDir !== undefined) {
 		const stateDir = plan.source === "project" ? path.join(input.cwd, ".pi") : getGlobalStateDir(plan.agentDir);
 		// Merge: the overlay belongs to customize/reset, not to this write.
 		// A switch (clearOverlay) explicitly drops it.
 		await new RuntimeStateStore(stateDir).update({
 			activeProfile: plan.profile,
-			lastVerifiedProfile: plan.profile,
 			...(plan.clearOverlay === true ? { overlay: undefined } : {}),
 		});
 	}
@@ -182,7 +136,6 @@ function buildSwitchSummary(plan: LaunchPlanFile): string {
 		`profile switched: ${plan.switchedFrom} → ${plan.profile}`,
 		plan.tools !== undefined ? `tools: [${plan.tools.join(", ")}]` : undefined,
 		plan.mcps !== undefined && plan.mcps.length > 0 ? `mcp: [${plan.mcps.join(", ")}]` : undefined,
-		plan.model !== undefined ? `model: ${plan.model.provider}/${plan.model.id}` : undefined,
 	].filter((part): part is string => part !== undefined);
 	return parts.join("; ");
 }

package/src/switching/customize.ts

@@ -9,7 +9,7 @@
  *
  * Ordering invariants:
  * - customize: re-resolve with the candidate overlay FIRST (validation:
- *   unknown references and alwaysOn protection fail here, before anything
+ *   unknown references fail here, before anything
  *   is written), then switch+reload, then persist the overlay to state. A
  *   failed switch leaves the stored overlay untouched, consistent with the
  *   rolled-back runtime.
@@ -50,7 +50,7 @@ export async function customizeOverlay(
 	const candidate = mutate(state.overlay ?? {});
 
 	// switchProfile re-resolves with the candidate overlay; resolution-time
-	// validation (unknown references, alwaysOn protection) fails before any
+	// validation (unknown references) fails before any
 	// write. persistSelection is preserved by the reload-current path.
 	const result = await switchProfile(profile, deps, { reloadCurrent: true, overlay: candidate });
 

package/src/switching/switch-profile.ts

@@ -7,14 +7,16 @@
  * Flow (`/profile use <name>`):
  *   1. wait for the agent to be idle (Pi's native `ctx.waitForIdle()`) — a
  *      running turn is never torn down
- *   2. snapshot the runtime dir's settings.json + pi-profile.json in memory
+ *   2. snapshot ALL pi-profile-managed runtime files in memory
+ *      (settings.json, pi-profile.json, mcp.json, APPEND_SYSTEM.md, and the
+ *      trust.json link state — each as absent | symlink | file)
  *   3. re-resolve through the full launcher path (trust check, catalogs,
- *      discovery, registry, model/MCP validation) against the REAL agent
+ *      discovery, model/MCP validation) against the REAL agent
  *      dir — any failure here leaves the runtime untouched
  *   4. rewrite the runtime files in place (the running process's
  *      PI_CODING_AGENT_DIR cannot move) and mark the plan
  *      `persistSelection` so the post-reload extension instance saves the
- *      selection + rollback anchor
+ *      selection
  *   5. `ctx.reload()` — Pi re-reads settings from disk, re-executes
  *      extensions, preserves the session
  *   6. VERIFY the reload ran: interactive Pi swallows reload refusals and
@@ -29,7 +31,7 @@
  * (transient launch selections stay transient).
  */
 
-import { readFile, writeFile } from "node:fs/promises";
+import { chmod, lstat, readFile, readlink, rm, symlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 
 import { resolveInitialProfile } from "../launcher/initial-profile.ts";
@@ -70,38 +72,74 @@ export interface SwitchResult {
 	warnings: string[];
 }
 
+/** The pre-switch state of one pi-profile-managed runtime file. Absence is
+ *  a real state (the switch may create the file); a symlink keeps its raw
+ *  target so restore can rebuild it exactly; a file keeps content AND
+ *  permission bits so restore doesn't widen a user-tightened mode. */
+type FileSnapshot =
+	| { kind: "absent" }
+	| { kind: "symlink"; target: string }
+	| { kind: "file"; content: string; mode: number };
+
 interface RuntimeSnapshot {
-	settings?: string;
-	plan?: string;
+	settings: FileSnapshot;
+	plan: FileSnapshot;
+	mcp: FileSnapshot;
+	appendSystem: FileSnapshot;
+	trust: FileSnapshot;
 }
 
-async function readIfExists(filePath: string): Promise<string | undefined> {
-	try {
-		return await readFile(filePath, "utf8");
-	} catch (error) {
-		// Absence is expected (first launch); anything else (permissions,
-		// unreadable dir) must not silently disable rollback protection.
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+/** Snapshots one managed runtime file. lstat (never stat) detects symlinks
+ *  without following them; ENOENT is the only tolerated error — absence is
+ *  expected (first launch), while anything else (permissions, unreadable
+ *  dir) must not silently disable rollback protection. */
+async function snapshotFile(filePath: string): Promise<FileSnapshot> {
+	const info = await lstat(filePath).catch((error: NodeJS.ErrnoException) => {
+		// ENOENT is the only tolerated error — absence is expected (first
+		// launch); anything else (permissions, unreadable dir) must not
+		// silently disable rollback protection.
+		if (error.code === "ENOENT") return null;
 		throw error;
+	});
+	if (info === null) return { kind: "absent" };
+	if (info.isSymbolicLink()) {
+		return { kind: "symlink", target: await readlink(filePath) };
 	}
+	return { kind: "file", content: await readFile(filePath, "utf8"), mode: info.mode & 0o777 };
 }
 
 async function snapshotRuntimeFiles(runtimeDir: string): Promise<RuntimeSnapshot> {
 	return {
-		settings: await readIfExists(path.join(runtimeDir, "settings.json")),
-		plan: await readIfExists(path.join(runtimeDir, "pi-profile.json")),
+		settings: await snapshotFile(path.join(runtimeDir, "settings.json")),
+		plan: await snapshotFile(path.join(runtimeDir, "pi-profile.json")),
+		mcp: await snapshotFile(path.join(runtimeDir, "mcp.json")),
+		appendSystem: await snapshotFile(path.join(runtimeDir, "APPEND_SYSTEM.md")),
+		trust: await snapshotFile(path.join(runtimeDir, "trust.json")),
 	};
 }
 
-async function restoreRuntimeFiles(runtimeDir: string, snapshot: RuntimeSnapshot): Promise<void> {
-	if (snapshot.settings !== undefined) {
-		await writeFile(path.join(runtimeDir, "settings.json"), snapshot.settings);
-	}
-	if (snapshot.plan !== undefined) {
-		await writeFile(path.join(runtimeDir, "pi-profile.json"), snapshot.plan);
+async function restoreFile(filePath: string, snapshot: FileSnapshot): Promise<void> {
+	// rm first, always: restoring a snapshotted FILE must never writeFile
+	// through a symlink the failed switch left on disk — that would write
+	// THROUGH to the link target (the user's real ~/.pi/agent/mcp.json)
+	// instead of replacing the link.
+	await rm(filePath, { force: true });
+	if (snapshot.kind === "symlink") {
+		await symlink(snapshot.target, filePath);
+	} else if (snapshot.kind === "file") {
+		await writeFile(filePath, snapshot.content);
+		await chmod(filePath, snapshot.mode);
 	}
 }
 
+async function restoreRuntimeFiles(runtimeDir: string, snapshot: RuntimeSnapshot): Promise<void> {
+	await restoreFile(path.join(runtimeDir, "settings.json"), snapshot.settings);
+	await restoreFile(path.join(runtimeDir, "pi-profile.json"), snapshot.plan);
+	await restoreFile(path.join(runtimeDir, "mcp.json"), snapshot.mcp);
+	await restoreFile(path.join(runtimeDir, "APPEND_SYSTEM.md"), snapshot.appendSystem);
+	await restoreFile(path.join(runtimeDir, "trust.json"), snapshot.trust);
+}
+
 /** Waits are delegated to Pi's native `ctx.waitForIdle()` (see SwitchDeps);
  *  no polling loop lives here. */
 
@@ -141,8 +179,8 @@ export async function switchProfile(
 	// Snapshot before resolving so the rollback target always exists.
 	const snapshot = await snapshotRuntimeFiles(deps.runtimeDir);
 
-	// Full launcher resolution: trust gate, catalogs, discovery, dependency
-	// closure, model + MCP validation. Failures here leave the runtime
+	// Full launcher resolution: trust gate, catalogs, discovery, model +
+	// MCP validation. Failures here leave the runtime
 	// untouched — nothing was written yet.
 	const resolved = await resolveInitialProfile(
 		target,

package/src/mcp-coordination.ts

@@ -1,65 +0,0 @@
-/**
- * McpCoordination: the pi-profile ↔ pi-mcp-adapter contract (ADR-0002).
- *
- * The adapter's released versions (≤2.33) offer no in-memory server
- * allowlist, so pi-profile defines the coordination channel the locked
- * adapter implements:
- *
- * - pi-profile publishes the active profile's runtime server allowlist on
- *   `pi-profile:mcp-allowlist:v1` at session start (and after every profile
- *   switch reload, ticket 05). The allowlist is memory-only: pi-profile
- *   never writes the adapter's `.pi/mcp.json` overlay.
- * - Adapter presence is probed via the adapter's documented
- *   request/result event pattern: emit a snapshot request for a bogus
- *   server name; an installed adapter fills `request.result` synchronously
- *   (with `{ok: false}` — the name is bogus), an absent adapter leaves it
- *   undefined.
- *
- * Launch-time, the launcher additionally refuses to spawn when a profile
- * declares `mcp` but no active extension identifies as the adapter
- * (`isAdapterExtension`) — failing before spawn beats failing in-session.
- */
-
-/** pi-profile's allowlist channel (the locked adapter subscribes). */
-export const MCP_ALLOWLIST_EVENT = "pi-profile:mcp-allowlist:v1";
-export const MCP_ALLOWLIST_VERSION = 1 as const;
-
-export interface McpAllowlistMessage {
-	version: typeof MCP_ALLOWLIST_VERSION;
-	profile: string;
-	servers: string[];
-}
-
-/** The adapter's snapshot channel, used here purely as a presence probe
- *  (see the module docblock). Kept as a literal so pi-profile doesn't
- *  import adapter internals. */
-export const MCP_ADAPTER_SNAPSHOT_EVENT = "pi-mcp-adapter:runtime-snapshot:v1";
-
-export class MissingMcpAdapterError extends Error {
-	constructor(profile: string) {
-		super(
-			`profile "${profile}" declares MCP servers but pi-mcp-adapter is not active. ` +
-				`Select the adapter in the profile's extensions (e.g. via its npm package) or remove the "mcps" declaration.`,
-		);
-		this.name = "MissingMcpAdapterError";
-	}
-}
-
-/** Identifies the adapter among active extension entries by its install
- *  path containing "pi-mcp-adapter" (npm package roots and local dirs both
- *  match). Heuristic by design — activation-plan entries carry no package
- *  source string, and the in-session probe is the authoritative check. */
-export function isAdapterExtension(entry: { entry: string }): boolean {
-	return entry.entry.includes("pi-mcp-adapter");
-}
-
-/** True when the adapter answered the probe (filled `result` on the
- *  request object), regardless of the answer — presence, not health. */
-export function probeAdapterPresence(events: { emit(channel: string, data: unknown): void }): boolean {
-	const request: { version: 1; name: string; result?: unknown } = {
-		version: 1,
-		name: "pi-profile:presence-probe",
-	};
-	events.emit(MCP_ADAPTER_SNAPSHOT_EVENT, request);
-	return request.result !== undefined;
-}

package/src/switching/mcp-toggle.ts

@@ -1,71 +0,0 @@
-/**
- * McpToggle: persistent, profile-scoped `/mcp enable|disable` (ticket 10).
- *
- * The profile's `mcps` array in its OWNING catalog is the profile-scoped
- * state store (ticket 04 established that pi-mcp-adapter@2.33.0 has no
- * allowlist/profile-state API — ADR-0002's assumed store does not exist;
- * pi-profile owns the contract). Runtime effect flows through the standard
- * rewrite-settings-and-reload path: the post-reload session_start
- * republishes the allowlist over the coordination channel.
- *
- * Invariants:
- * - Enable accepts only adapter-discovered names (fail fast on typos);
- *   disable also removes names the adapter no longer reports (stale
- *   cleanup).
- * - The built-in default profile has no catalog entry — toggling it is a
- *   clear error, not a synthetic write.
- * - Only the ACTIVE profile's array changes; other profiles and the
- *   adapter's own configuration (global mcp.json, project .pi/mcp.json)
- *   are never modified.
- */
-
-import { discoverAdapterServerNames } from "../mcp-config.ts";
-import { CatalogError, DEFAULT_PROFILE_NAME, type ProfileDefinition } from "../profile-catalog.ts";
-import { readTrustInputs as readTrust } from "../launcher/initial-profile.ts";
-import { catalogStore, readCatalogScope, type CatalogScope } from "./profile-crud.ts";
-
-export async function setMcpServerEnabled(
-	input: { realAgentDir: string; cwd: string; profile: { name: string; source: string } },
-	server: string,
-	enabled: boolean,
-): Promise<{ mcps: string[]; changed: boolean }> {
-	if (input.profile.name === DEFAULT_PROFILE_NAME || input.profile.source === "builtin") {
-		throw new CatalogError(
-			`the built-in default profile has no catalog entry — create a named profile (/profile create) to toggle MCP servers`,
-		);
-	}
-	const scope = input.profile.source as CatalogScope;
-	if (scope !== "global" && scope !== "project") {
-		throw new CatalogError(`profile "${input.profile.name}" has no writable owning catalog (source: ${input.profile.source})`);
-	}
-
-	const { projectTrusted } = await readTrust({ agentDir: input.realAgentDir, cwd: input.cwd });
-	if (scope === "project" && !projectTrusted) {
-		throw new CatalogError(`project catalog is unavailable: ${input.cwd} is not trusted`);
-	}
-	const discovered = await discoverAdapterServerNames(input.realAgentDir, projectTrusted ? input.cwd : undefined);
-	if (enabled && !discovered.includes(server)) {
-		throw new CatalogError(
-			`unknown MCP server "${server}" — adapter discovered: [${discovered.join(", ") || "(none)"}]`,
-		);
-	}
-
-	const definitions = await readCatalogScope(input, scope);
-	const definition = definitions.get(input.profile.name);
-	if (definition === undefined) {
-		throw new CatalogError(`profile "${input.profile.name}" not found in the ${scope} catalog`);
-	}
-
-	const current = definition.mcps ?? [];
-	if (enabled === current.includes(server)) {
-		return { mcps: current, changed: false }; // already in the requested state
-	}
-	const next = enabled ? [...current, server] : current.filter((name) => name !== server);
-	// Drop the key entirely when empty (exactOptionalPropertyTypes; a
-	// written `mcps: undefined` would also misrepresent the definition).
-	const rest = { ...definition };
-	delete rest.mcps;
-	const updated: ProfileDefinition = next.length > 0 ? { ...rest, mcps: next } : rest;
-	await catalogStore(input, scope).upsert(input.profile.name, updated);
-	return { mcps: next, changed: true };
-}