pi-profile-switch 0.4.4 → 0.4.6

package/README.md

@@ -4,7 +4,7 @@
 
 Named profiles for [Pi](https://github.com/badlogic/pi-mono). A profile references a set of existing skills, extensions, MCP servers, and tools — switch between them in the same Pi process, without restarting.
 
-Use a lean read-only profile for code review, a full-powered one for implementation, a minimal one for a quick question — all against the same installed resources.
+Use a read-only profile for Q&A and code exploration, a full-powered one for implementation — all against the same installed resources.
 
 ## Install
 
@@ -20,33 +20,32 @@ Requires [Pi](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) (in
 # Launch with the built-in default profile (all resources, plain Pi behavior)
 pi-profile
 
-# Launch with a named profile
-pi-profile review
+# Launch with the seeded read-only ask profile
+pi-profile ask
 
 # Anything after -- is passed to pi verbatim
-pi-profile review -- --model openai/gpt-5.4
+pi-profile ask -- --model openai/gpt-5.4
 ```
 
-Define profiles in `~/.pi-profile-switch/profiles.json` (global, fallback to `~/.pi/agent/profiles.json` for migration; custom root via `PI_PROFILE_SWITCH_DIR`) or `<project>/.pi/profiles.json` (project, trusted projects only):
+On install, pi-profile-switch seeds `~/.pi-profile-switch/profiles.json` (global, fallback to `~/.pi/agent/profiles.json` for migration; custom root via `PI_PROFILE_SWITCH_DIR`) with a starter **`ask`** profile — read-only Q&A and code exploration. It assumes nothing about your setup; edit or delete it freely:
 
 ```json
 {
   "schemaVersion": 1,
   "profiles": {
-    "review": {
-      "label": "Code review",
-      "skills": ["code-review"],
-      "mcp": ["github"],
-      "tools": ["read", "grep", "find", "bash"],
-      "instructions": "Review only; do not modify files."
+    "ask": {
+      "label": "Ask & Discuss",
+      "description": "Read-only Q&A and code exploration; no file modifications or command execution",
+      "skills": [],
+      "extensions": [],
+      "tools": ["read", "grep", "find", "ls"],
+      "instructions": "You are in read-only discussion mode. Answer questions and explain code without modifying any files or running shell commands."
     }
   }
 }
 ```
 
-Profiles **reference** resources by name — they never copy them. Installed packages and files in standard locations are discovered automatically; no registration needed. Full schema with more examples: [`examples/profiles.json`](examples/profiles.json).
-
-On install, pi-profile-switch seeds `~/.pi-profile-switch/profiles.json` with a starter **`ask`** profile — read-only Q&A and code exploration (`read`/`grep`/`find`/`ls`, no skills, extensions, or MCP). It assumes nothing about your setup; edit or delete it freely.
+Project-level profiles live in `<project>/.pi/profiles.json` (trusted projects only). Profiles **reference** resources by name — they never copy them. Installed packages and files in standard locations are discovered automatically; no registration needed. Complete configuration examples live in [`examples/`](examples/): `profiles.json` is the seeded starter above, and `example.json` demonstrates every available field (skills, extensions, MCP servers, tools, model defaults, instructions).
 
 ## Commands
 

package/README.zh-CN.md

@@ -4,7 +4,7 @@
 
 [Pi](https://github.com/badlogic/pi-mono) 的命名 profile 扩展。一个 profile 引用一组已存在的 skills、extensions、MCP server 和 tools，并在同一 Pi 进程内切换，无需重启。
 
-代码评审用精简的只读 profile，实现需求用全量 profile，临时提问用最小 profile——全部基于同一套已安装的资源。
+问答与代码走读用只读 profile，实现需求用全量 profile——全部基于同一套已安装的资源。
 
 ## 安装
 
@@ -20,33 +20,32 @@ npm install -g pi-profile-switch
 # 使用内建 default profile 启动（全量资源，等同原生 Pi）
 pi-profile
 
-# 使用指定 profile 启动
-pi-profile review
+# 使用安装时播种的只读 ask profile 启动
+pi-profile ask
 
 # -- 后面的参数原样传给 pi
-pi-profile review -- --model openai/gpt-5.4
+pi-profile ask -- --model openai/gpt-5.4
 ```
 
-在 `~/.pi-profile-switch/profiles.json`（全局，支持 `PI_PROFILE_SWITCH_DIR` 环境变量自定义，向下兼容 `~/.pi/agent/profiles.json`）或 `<项目>/.pi/profiles.json`（项目级，仅限已信任项目）中定义 profile：
+安装时，pi-profile-switch 会向 `~/.pi-profile-switch/profiles.json`（全局，支持 `PI_PROFILE_SWITCH_DIR` 环境变量自定义，向下兼容 `~/.pi/agent/profiles.json`）写入一个初始 **`ask`** profile——只读的问答与代码走读模式。它不假设你安装过任何插件，可随意修改或删除：
 
 ```json
 {
   "schemaVersion": 1,
   "profiles": {
-    "review": {
-      "label": "Code review",
-      "skills": ["code-review"],
-      "mcp": ["github"],
-      "tools": ["read", "grep", "find", "bash"],
-      "instructions": "Review only; do not modify files."
+    "ask": {
+      "label": "Ask & Discuss",
+      "description": "Read-only Q&A and code exploration; no file modifications or command execution",
+      "skills": [],
+      "extensions": [],
+      "tools": ["read", "grep", "find", "ls"],
+      "instructions": "You are in read-only discussion mode. Answer questions and explain code without modifying any files or running shell commands."
     }
   }
 }
 ```
 
-Profile 只**引用**资源，从不复制资源。已安装的包和标准目录下的文件会被自动发现，无需注册。完整示例见 [`examples/profiles.json`](examples/profiles.json)。
-
-安装时，pi-profile-switch 会向 `~/.pi-profile-switch/profiles.json` 写入一个初始 **`ask`** profile——只读的问答与代码走读模式（仅 `read`/`grep`/`find`/`ls`，无 skill、extension 和 MCP）。它不假设你安装过任何插件，可随意修改或删除。
+项目级 profile 定义在 `<项目>/.pi/profiles.json`（仅限已信任项目）。Profile 只**引用**资源，从不复制资源。已安装的包和标准目录下的文件会被自动发现，无需注册。完整配置案例见 [`examples/`](examples/)：`profiles.json` 即上面的初始 profile，`example.json` 演示全部可用字段（skills、extensions、MCP server、tools、默认模型、instructions）。
 
 ## 命令
 

package/bin/pi-profile.ts

@@ -3,7 +3,7 @@
  * pi-profile launcher (ADR-0005).
  *
  * Resolves the initial profile, materializes it as a generated runtime
- * directory (settings + symlinks + env + flags), and spawns the real `pi`
+ * directory (settings + symlinks + env), and spawns the real `pi`
  * binary with user arguments passed through verbatim.
  *
  * Usage:
@@ -18,8 +18,7 @@ import { parseLauncherArgs } from "../src/launcher/args.ts";
 import { UnknownProfileError, resolveInitialProfile } from "../src/launcher/initial-profile.ts";
 import { sweepStaleRuntimeDirs } from "../src/launcher/runtime-cleanup.ts";
 import { spawnPi } from "../src/launcher/spawn.ts";
-import { McpConfigError } from "../src/mcp-config.ts";
-import { MissingMcpAdapterError } from "../src/mcp-coordination.ts";
+import { McpConfigError, MissingMcpAdapterError } from "../src/mcp-config.ts";
 import { CatalogError } from "../src/profile-catalog.ts";
 import { ActivationError } from "../src/profile-resolver.ts";
 import { generateRuntimeDir } from "../src/settings-generator.ts";

package/bin/postinstall.js

@@ -4,7 +4,8 @@
  *
  * Runs at package install time (`npm install pi-profile-switch` / `pi install`).
  * Idempotent and conservative:
- * - Writes `defaults/profiles.json` to the profile-switch dir ONLY when no
+ * - Writes the shipped `examples/profiles.json` starter catalog to the
+ *   profile-switch dir ONLY when no
  *   catalog exists there yet (COPYFILE_EXCL; an existing file — including
  *   one written concurrently — is never touched).
  * - Skips entirely when a legacy `~/.pi/agent/profiles.json` exists, because
@@ -22,7 +23,7 @@ import { homedir } from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
-const DEFAULT_TEMPLATE = fileURLToPath(new URL("../defaults/profiles.json", import.meta.url));
+const DEFAULT_TEMPLATE = fileURLToPath(new URL("../examples/profiles.json", import.meta.url));
 
 /** Mirrors getProfileSwitchDir() in src/workspace.ts.
  *  @param {NodeJS.ProcessEnv} env */

package/examples/example.json

@@ -0,0 +1,33 @@
+{
+  "schemaVersion": 1,
+  "profiles": {
+    "impl": {
+      "label": "Implementation",
+      "description": "Full-powered implementation profile: every available field, pinned model",
+      "skills": [
+        "tdd",
+        "internal-*"
+      ],
+      "extensions": [
+        "pi-mcp-adapter"
+      ],
+      "mcps": [
+        "github",
+        "linear"
+      ],
+      "tools": [
+        "read",
+        "grep",
+        "find",
+        "ls",
+        "bash",
+        "edit",
+        "write"
+      ],
+      "defaultProvider": "anthropic",
+      "defaultModel": "claude-sonnet-4-5",
+      "defaultThinkingLevel": "high",
+      "instructions": "Prefer small, verifiable changes. Run the test suite before claiming completion."
+    }
+  }
+}

package/examples/profiles.json

@@ -1,42 +1,18 @@
 {
   "schemaVersion": 1,
   "profiles": {
-    "review": {
-      "label": "Code review",
-      "description": "Read-heavy review workflow",
-      "skills": [
-        "code-review",
-        "diagnosing-bugs"
-      ],
-      "extensions": [
-        "pi-mcp-adapter"
-      ],
-      "mcps": [
-        "github"
-      ],
+    "ask": {
+      "label": "Ask & Discuss",
+      "description": "Read-only Q&A and code exploration; no file modifications or command execution",
+      "skills": [],
+      "extensions": [],
       "tools": [
         "read",
         "grep",
         "find",
-        "bash"
-      ],
-      "instructions": "Review only; do not modify files."
-    },
-    "impl": {
-      "label": "Implementation",
-      "skills": [
-        "tdd"
-      ],
-      "extensions": [
-        "pi-mcp-adapter"
-      ],
-      "mcps": [
-        "github",
-        "linear"
+        "ls"
       ],
-      "defaultProvider": "deepseek",
-      "defaultModel": "deepseek-v4-pro",
-      "defaultThinkingLevel": "high"
+      "instructions": "You are in read-only discussion mode. Answer questions and explain code without modifying any files or running shell commands."
     }
   }
 }

package/extensions/pi-profile/index.ts

@@ -29,14 +29,12 @@ import { getGlobalStateDir } from "../../src/workspace.ts";
  * pi-profile extension entry.
  *
  * Loaded into the spawned pi via `-e`. Responsibilities:
- * - Append the profile's declared instructions to Pi's fully built system
- *   prompt on every turn (`before_agent_start`), so the default prompt,
- *   AGENTS.md, and other extensions keep working.
  * - After every session start (startup/reload/new/resume/fork), apply the
- *   launch plan: re-expand tool references against Pi's live registry,
- *   set the declared model/thinking, publish the MCP allowlist, persist the
- *   selection + rollback anchor after switches, and produce the one-shot
- *   change summary injected into the next turn.
+ *   launch plan: re-expand tool references against Pi's live registry
+ *   (including extension- and MCP-provided tools) and call setActiveTools
+ *   for strict allowlisting, persist the selection after switches, and
+ *   produce the one-shot change summary injected into the next turn
+ *   via `before_agent_start`.
  * - `/profile use <name>` / `/profile reload`: in-session switching without
  *   restarting the Pi process (src/switching/switch-profile.ts).
  * - `/profile customize` / `/profile reset`: runtime overlay (ticket 06).
@@ -78,11 +76,6 @@ export default function piProfileExtension(pi: ExtensionAPI): void {
 			surface: {
 				getAllTools: () => pi.getAllTools(),
 				setActiveTools: (names) => pi.setActiveTools(names),
-				modelRegistry: ctx.modelRegistry,
-				setModel: (model) => pi.setModel(model as Parameters<ExtensionAPI["setModel"]>[0]),
-				setThinkingLevel: (level) =>
-					pi.setThinkingLevel(level as Parameters<ExtensionAPI["setThinkingLevel"]>[0]),
-				events: pi.events,
 				notify: (message, level) => ctx.ui?.notify(message, level),
 			},
 		});
@@ -90,12 +83,7 @@ export default function piProfileExtension(pi: ExtensionAPI): void {
 	});
 
 	pi.on("before_agent_start", async (event) => {
-		const plan = await readLaunchPlanFile(runtimeDir);
-		const instructions = plan?.instructions;
 		let systemPrompt = event.systemPrompt;
-		if (instructions !== undefined && instructions.length > 0 && !systemPrompt.includes(instructions)) {
-			systemPrompt = `${systemPrompt}\n\n${instructions}`;
-		}
 		if (pendingSummary !== undefined) {
 			systemPrompt = `${systemPrompt}\n\n[${pendingSummary}]`;
 			pendingSummary = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-profile-switch",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Named profiles for Pi: reference skills, extensions, MCP servers, and tools per workflow, switched without restarting.",
   "type": "module",
   "keywords": [
@@ -45,7 +45,6 @@
   },
   "files": [
     "bin",
-    "defaults",
     "extensions",
     "src",
     "schemas",

package/src/extension-discovery.ts

@@ -1,7 +1,7 @@
 /**
  * ExtensionDiscovery: implicit, read-only discovery of selectable extensions
- * (ADR-0006), so profiles can reference extensions without registering them
- * in resources.json first.
+ * (ADR-0006), so profiles can reference extensions without any
+ * registration step.
  *
  * Two implicit sources, both Pi-native and side-effect free:
  * - Configured user packages: each package's `package.json#pi.extensions`
@@ -13,9 +13,6 @@
  *
  * Discovery never executes extension code and never installs anything: a
  * package contributes entries only for declared files that exist on disk.
- * Explicit resources.json entries merge over this discovery result in
- * ResourceRegistry.load (registration remains the override, never the
- * prerequisite).
  */
 
 import { readdir, readFile, stat } from "node:fs/promises";
@@ -328,7 +325,7 @@ export async function discoverImplicitExtensions(options: {
 	const merged = new Map<string, DiscoveredLocalExtension>(globalLocal.map((entry) => [entry.id, entry]));
 	if (options.projectDir !== undefined) {
 		// Project loose files override same-ID global ones, mirroring the
-		// catalog/registry override convention.
+		// project-over-global catalog override convention.
 		for (const entry of await scanLooseDir(path.join(options.projectDir, ".pi", "extensions"), warnings)) {
 			merged.set(entry.id, entry);
 		}

package/src/json-file.ts

@@ -1,8 +1,8 @@
 /**
  * Shared JSON-file reading for pi-profile's file-backed stores (catalog,
- * resource registry, runtime state). Each store maps read failures to its
- * own error policy (loud CatalogError/RegistryError vs. quiet state
- * fallback); this helper only classifies the outcome.
+ * runtime state). Each store maps read failures to its own error policy
+ * (loud CatalogError vs. quiet state fallback); this helper only classifies
+ * the outcome.
  */
 
 import { readFile } from "node:fs/promises";

package/src/launcher/initial-profile.ts

@@ -3,10 +3,10 @@
  *
  * Flow: trust check (gatekeeper for everything project-scoped) → positional
  * name or saved state (project state wins when trusted) → catalog lookup →
- * skill discovery + resource registry → resolver (glob expansion, dependency
- * closure, alwaysOn, model validation) → ActivationPlan + full discovery
- * results for the settings generator. Unknown profiles, malformed
- * catalogs/registries, and unresolvable resources all fail before Pi spawns.
+ * discovery (skills, extensions, MCP server names) → resolver (glob
+ * expansion, overlay, model validation) → ActivationPlan + full discovery
+ * results for the settings generator. Unknown profiles, malformed catalogs,
+ * and unresolvable resources all fail before Pi spawns.
  *
  * The CLI's initial selection is transient: no runtime state is written here.
  */
@@ -15,7 +15,7 @@ import path from "node:path";
 
 import { isRecord, readJsonFile } from "../json-file.ts";
 import { discoverAdapterServerNames } from "../mcp-config.ts";
-import { isAdapterExtension, MissingMcpAdapterError } from "../mcp-coordination.ts";
+import { isAdapterExtension, MissingMcpAdapterError } from "../mcp-config.ts";
 import { ProfileCatalog, type ResolvedProfile } from "../profile-catalog.ts";
 import { ActivationError, defaultPlan, resolveProfile, type ActivationPlan } from "../profile-resolver.ts";
 import { resolveProjectTrust } from "../project-trust.ts";

package/src/launcher/spawn.ts

@@ -1,8 +1,8 @@
 /**
  * Spawns the real `pi` binary as a subprocess (ADR-0005).
  *
- * The spawned pi gets: the pi-profile extension via `-e`, any generated
- * flags, and the user's arguments verbatim. stdio is inherited so interactive
+ * The spawned pi gets: the pi-profile extension via `-e` and the user's
+ * arguments verbatim. stdio is inherited so interactive
  * TUI, RPC, and print modes all behave natively; exit codes and signals
  * propagate.
  */
@@ -15,7 +15,7 @@ import { fileURLToPath } from "node:url";
 import type { GeneratedRuntime } from "../settings-generator.ts";
 
 export interface SpawnPiOptions {
-	/** Generated runtime dir + env + flags. */
+	/** Generated runtime dir + env. */
 	generated: GeneratedRuntime;
 	/** User arguments, forwarded verbatim. */
 	piArgs: string[];
@@ -25,10 +25,10 @@ export interface SpawnPiOptions {
 
 const EXTENSION_ENTRY = fileURLToPath(new URL("../../extensions/pi-profile/index.ts", import.meta.url));
 
-/** Pure argv construction for the spawned pi: extension entry, generated
- *  flags, trust re-application, then user args verbatim. */
+/** Pure argv construction for the spawned pi: extension entry,
+ *  trust re-application, then user args verbatim. */
 export function buildPiArgs(options: SpawnPiOptions): string[] {
-	const args = ["-e", EXTENSION_ENTRY, ...options.generated.flags];
+	const args = ["-e", EXTENSION_ENTRY];
 	// default profile keeps trust behavior native: re-apply the recorded flag.
 	if (options.trustOverride === true) args.push("--approve");
 	if (options.trustOverride === false) args.push("--no-approve");

package/src/mcp-config.ts

@@ -134,3 +134,22 @@ export async function discoverAdapterServerNames(
 	const { servers } = await loadMergedMcpServers(agentDir, projectDir, options);
 	return Object.keys(servers).sort();
 }
+
+export class MissingMcpAdapterError extends Error {
+	constructor(profile: string) {
+		super(
+			`profile "${profile}" declares MCP servers but pi-mcp-adapter is not active. ` +
+				`Select the adapter in the profile's extensions (e.g. via its npm package) or remove the "mcps" declaration.`,
+		);
+		this.name = "MissingMcpAdapterError";
+	}
+}
+
+/** Identifies the adapter among active extension entries by its install
+ *  path containing "pi-mcp-adapter" (npm package roots and local dirs both
+ *  match). Heuristic by design — activation-plan entries carry no package
+ *  source string. */
+export function isAdapterExtension(entry: { entry: string }): boolean {
+	return entry.entry.includes("pi-mcp-adapter");
+}
+

package/src/profile-resolver.ts

@@ -7,23 +7,21 @@
  *   resolution; zero matches is fine (new matches join on the next start) and
  *   is reported in the plan's `unmatched` list so typos are visible.
  * - Literal references must exist; a missing literal fails activation.
- *   Extension references resolve through ResourceRegistry.select (ADR-0006):
- *   registry ID, installed package name/alias, loose-file stem, or an
- *   on-disk path — no pre-registration required.
- * - `alwaysOn` resources and the recursive `dependsOn` closure join every
- *   plan; cycles and missing entries fail loudly (via ResourceRegistry).
+ *   Extension references resolve through ExtensionDiscovery.select (ADR-0007):
+ *   package name/alias, loose-file stem, or an on-disk path — no
+ *   pre-registration required.
  * - Undeclared model/thinking/instructions never enter the plan, so Pi's
  *   current state stays untouched.
  * - MCP references (`mcp`) expand against the server names the launcher
  *   discovered from pi-mcp-adapter's pi-native config files: literal misses
  *   fail loudly; globs expand to zero or more matches (consistent with
  *   skills/extensions). Adapter presence is checked separately by the
- *   launcher/extension (ADR-0002).
- * - Tool globs expand against Pi's built-in tool names only: extension- and
- *   MCP-provided tool names are unknowable before spawn (extension code must
- *   not execute here), so literal tool names pass through unvalidated and
- *   glob matching for contributed tools happens when the extension applies
- *   the plan against Pi's actual registrations (tickets 05+).
+ *   launcher (ADR-0002).
+ * - Tool globs expand against Pi's built-in tool names for settings
+ *   `defaultTools`; raw tool references are also carried into the launch
+ *   plan so the in-session extension can expand them against Pi's live
+ *   registry (including extension and MCP tools) via setActiveTools for
+ *   strict allowlisting.
  */
 
 import { minimatch } from "minimatch";
@@ -75,10 +73,13 @@ export interface ActivationPlan {
 	toolReferences?: string[];
 	/** Declared model; undefined leaves Pi's current model untouched. */
 	model?: ProfileModel;
-	/** Declared instructions; appended to Pi's system prompt by the extension. */
+	/** Declared instructions; written to the generated APPEND_SYSTEM.md,
+	 *  which Pi natively appends to the system prompt. */
 	instructions?: string;
-	/** Expanded MCP server allowlist for pi-mcp-adapter coordination;
-	 *  undefined when the profile declares no `mcps` (no coordination). */
+	/** Expanded MCP server allowlist: written by SettingsGenerator into the
+	 *  filtered instance `mcp.json` (the adapter's runtime restriction) and
+	 *  surfaced in `/profile status`; undefined when the profile declares
+	 *  no `mcps` (no restriction). */
 	mcps?: string[];
 	/** Glob references (skills/extensions/MCP) that matched nothing this
 	 *  resolution — surfaced as warnings so zero-match typos are never silent.
@@ -110,7 +111,7 @@ export interface ResolveInput {
 	 * The runtime overlay (ticket 06): temporary narrowing applied on top of
 	 * the profile definition at every resolution. Overlay references must
 	 * name resources the profile actually resolves (typos fail loudly), and
-	 * `alwaysOn` extensions and their dependency chains cannot be disabled.
+	 * any resolved reference may be narrowed or disabled.
 	 */
 	overlay?: RuntimeOverlay;
 }

package/src/project-trust.ts

@@ -4,7 +4,7 @@
  * `defaultProjectTrust: "never"` and Pi therefore never auto-discovers them.
  *
  * Mirrors Pi's own trust decision order (`resolveProjectTrusted`), with
- * pi-profile's catalog/registry/state files added to the trust-requiring
+ * pi-profile's catalog/state files added to the trust-requiring
  * resource set (they are pi-profile's project attack surface; Pi doesn't
  * know about them):
  *   1. one-run `--approve` / `--no-approve` override (consumed by the

package/src/runtime-state-store.ts

@@ -6,17 +6,13 @@
  * for global state, the project's `.pi` dir for project state (project
  * state is only touched when the trust check passed). The launcher only
  * reads — the initial CLI selection is transient by design; `/profile use`
- * (ticket 05) writes both the selection and the rollback anchor.
+ * (ticket 05) writes the selection.
  *
- * `activeProfile` is the saved selection restored on launch;
- * `lastVerifiedProfile` is the rollback anchor: the last profile whose
- * activation completed successfully. They differ only between a failed
- * activation and its rollback.
+ * `activeProfile` is the saved selection restored on launch.
  *
  * A missing or malformed state file is not an error on read — it simply
  * means "fall back to the default profile". Unexpected I/O errors
- * propagate. Writes replace the file wholesale (both fields are always
- * written together by the switch path).
+ * propagate. Writes replace the file wholesale.
  */
 
 import { mkdir, writeFile } from "node:fs/promises";
@@ -26,7 +22,6 @@ import { isRecord, readJsonFile } from "./json-file.ts";
 
 export interface RuntimeState {
 	activeProfile?: string;
-	lastVerifiedProfile?: string;
 	/** The runtime overlay: temporary narrowing of the active profile
 	 *  (ticket 06). Never written to catalogs, never applied at launch —
 	 *  only in-session switches/reloads read it. */
@@ -69,9 +64,6 @@ export class RuntimeStateStore {
 		if (typeof result.value.activeProfile === "string") {
 			state.activeProfile = result.value.activeProfile;
 		}
-		if (typeof result.value.lastVerifiedProfile === "string") {
-			state.lastVerifiedProfile = result.value.lastVerifiedProfile;
-		}
 		const overlay = parseOverlay(result.value.overlay);
 		if (overlay !== undefined) {
 			state.overlay = overlay;
@@ -94,10 +86,6 @@ export class RuntimeStateStore {
 			if (patch.activeProfile === undefined) delete next.activeProfile;
 			else next.activeProfile = patch.activeProfile;
 		}
-		if ("lastVerifiedProfile" in patch) {
-			if (patch.lastVerifiedProfile === undefined) delete next.lastVerifiedProfile;
-			else next.lastVerifiedProfile = patch.lastVerifiedProfile;
-		}
 		if ("overlay" in patch) {
 			if (patch.overlay === undefined) delete next.overlay;
 			else next.overlay = patch.overlay;

package/src/settings-generator.ts

@@ -5,7 +5,7 @@
  * Two entry points:
  * - `generateRuntimeDir` (launcher): mkdtemp a fresh runtime dir, write the
  *   files, link state (auth/models/mcp/npm/git/bin; trust.json only for
- *   default), derive env + flags.
+ *   default), derive env.
  * - `writeRuntimeFiles` (in-session switch, ticket 05): rewrite
  *   settings.json + pi-profile.json inside the EXISTING runtime dir (the
  *   running process's PI_CODING_AGENT_DIR cannot move), and transition the
@@ -31,8 +31,9 @@
  *   root as a launch side effect)
  * - unmanaged kinds (prompts, themes) pass through: the user's arrays are
  *   preserved and the real agent dir's prompts/themes dirs re-included
- * - tools/model become generated flags; the launch plan file feeds the
- *   in-pi extension (instructions injection, status)
+ * - tools/model are written to generated settings (defaultTools,
+ *   defaultProvider, defaultModel, defaultThinkingLevel); the launch plan
+ *   file feeds the in-pi extension (tools strict allowlist, status)
  *
  * User configuration files are never modified.
  */
@@ -85,8 +86,6 @@ export interface GeneratedRuntime {
 	runtimeDir: string;
 	/** Environment variables for the spawned pi process. */
 	env: Record<string, string>;
-	/** Extra pi flags derived from the plan (e.g. --tools, --model). Empty for default. */
-	flags: string[];
 }
 
 /** Files managed explicitly by pi-profile in runtimeDir; excluded from auto-symlinking. */
@@ -117,6 +116,18 @@ async function exists(filePath: string): Promise<boolean> {
 	}
 }
 
+/** Symlink-aware existence check (lstat): a dangling symlink still counts as
+ *  existing — a stat-based check misses it, which would skip its removal or
+ *  collide on symlink creation. Use this for paths pi-profile links itself. */
+async function existsLexical(filePath: string): Promise<boolean> {
+	try {
+		await lstat(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 function toPosix(filePath: string): string {
 	return filePath.split(path.sep).join("/");
 }
@@ -291,8 +302,8 @@ export interface RuntimeFileOptions {
 	projectSettings?: Record<string, unknown>;
 	/** Extra launch-plan fields written by the in-session switch path:
 	 *  `switchedFrom` triggers the one-shot change summary; `persistSelection`
-	 *  tells the post-reload extension instance to save the selection and
-	 *  record the rollback anchor; `clearOverlay` drops the stored overlay
+	 *  tells the post-reload extension instance to save the selection;
+	 *  `clearOverlay` drops the stored overlay
 	 *  (a profile switch discards the previous profile's overlay).
 	 *  `previousResolved` carries the pre-switch resolved name sets so
 	 *  `/profile status` can report glob deltas (ticket 07). */
@@ -372,10 +383,11 @@ export async function writeRuntimeFiles(
 	const settings = await computeSettings(plan, options, runtimeDir);
 	await writeFile(path.join(runtimeDir, "settings.json"), `${JSON.stringify(settings, null, 2)}\n`);
 
-	// The launch plan feeds the in-pi extension: instructions injection,
-	// tool/model re-application after reload, MCP coordination, switching.
+	// The launch plan feeds the in-pi extension: tool re-application after
+	// reload (the tools strict allowlist), in-session switching, status
+	// reporting, and post-reload state persistence.
 	// agentDir is the REAL agent dir — the extension needs it for trust
-	// checks, state files, and catalog/registry reads (its own
+	// checks, state files, and catalog reads (its own
 	// PI_CODING_AGENT_DIR points at this runtime dir).
 	await writeFile(
 		path.join(runtimeDir, "pi-profile.json"),
@@ -384,8 +396,6 @@ export async function writeRuntimeFiles(
 				profile: plan.profile,
 				source: plan.source,
 				agentDir: options.agentDir,
-				...(plan.instructions !== undefined ? { instructions: plan.instructions } : {}),
-				...(plan.model !== undefined ? { model: plan.model } : {}),
 				...(plan.tools !== undefined ? { tools: plan.tools } : {}),
 				...(plan.toolReferences !== undefined ? { toolReferences: plan.toolReferences } : {}),
 				...(plan.mcps !== undefined ? { mcps: plan.mcps } : {}),
@@ -408,10 +418,14 @@ export async function writeRuntimeFiles(
 	const trustLink = path.join(runtimeDir, "trust.json");
 	const trustTarget = path.join(options.agentDir, "trust.json");
 	if (plan.filter === "none") {
-		if ((await exists(trustTarget)) && !(await exists(trustLink))) {
+		if ((await exists(trustTarget)) && !(await existsLexical(trustLink))) {
 			await symlink(trustTarget, trustLink);
 		}
-	} else if (await exists(trustLink)) {
+	} else if (await existsLexical(trustLink)) {
+		// Lexical check: a dangling trust.json symlink (real trust.json deleted
+		// after the link was made) must still be removed — otherwise a later
+		// re-created real trust.json silently resurrects stored trust inside a
+		// named profile, defeating defaultProjectTrust: "never".
 		await rm(trustLink);
 	}
 
@@ -543,13 +557,10 @@ export async function generateRuntimeDir(
 
 	await writeRuntimeFiles(runtimeDir, plan, options);
 
-	const flags: string[] = [];
-
 	return {
 		runtimeDir,
 		env: {
 			PI_CODING_AGENT_DIR: runtimeDir,
 		},
-		flags,
 	};
 }

package/src/switching/apply-plan.ts

@@ -9,17 +9,16 @@
  *
  * Steps:
  *   1. tools: re-expand the profile's raw tool references against Pi's LIVE
- *      tool registry (includes extension-provided tools the pre-spawn
- *      expansion cannot know) and setActiveTools. Literals that no tool
- *      provides are dropped with a warning — Pi silently ignores unknown
- *      names, so the warning is the only signal.
- *   2. model: setModel + setThinkingLevel when declared.
- *   3. mcp: probe the adapter and publish the runtime allowlist (ticket 04).
- *   4. persistence: when the plan is marked `persistSelection` and this is a
- *      reload, save the selection and the rollback anchor
- *      (activeProfile = lastVerifiedProfile = plan.profile) to the
+ *      tool registry (including extension- and MCP-provided tools) and
+ *      call setActiveTools. This is the CURRENT strict-allowlist enforcement
+ *      ensuring non-builtin tools obey profile restrictions; settings
+ *      `defaultTools` provides only the boot baseline for built-ins.
+ *      Literals that no tool provides are dropped with a warning — Pi
+ *      silently ignores unknown names, so the warning is the only signal.
+ *   2. persistence: when the plan is marked `persistSelection` and this is a
+ *      reload, save the selection (activeProfile = plan.profile) to the
  *      profile's scope state file. Launch-transient selections never write.
- *   5. change summary: a `switchedFrom` marker produces a one-shot summary
+ *   3. change summary: a `switchedFrom` marker produces a one-shot summary
  *      for the next agent turn and is cleared from the plan file.
  *
  * Pi's reload re-executes extension modules, so no stale handler or command
@@ -31,12 +30,6 @@ import { writeFile } from "node:fs/promises";
 import path from "node:path";
 
 import { isRecord, readJsonFile } from "../json-file.ts";
-import {
-	MCP_ALLOWLIST_EVENT,
-	MCP_ALLOWLIST_VERSION,
-	MissingMcpAdapterError,
-	probeAdapterPresence,
-} from "../mcp-coordination.ts";
 import { RuntimeStateStore } from "../runtime-state-store.ts";
 import { getGlobalStateDir } from "../workspace.ts";
 import { expandToolReferences } from "./tool-references.ts";
@@ -45,8 +38,6 @@ export interface LaunchPlanFile {
 	profile: string;
 	source: string;
 	agentDir?: string;
-	instructions?: string;
-	model?: { provider: string; id: string; thinkingLevel?: string };
 	tools?: string[];
 	toolReferences?: string[];
 	mcps?: string[];
@@ -71,10 +62,6 @@ export interface LaunchPlanFile {
 export interface PlanApplicationSurface {
 	getAllTools(): Array<{ name: string }>;
 	setActiveTools(names: string[]): void;
-	modelRegistry: { find(provider: string, id: string): unknown | undefined };
-	setModel(model: unknown): Promise<boolean>;
-	setThinkingLevel(level: unknown): void;
-	events: { emit(channel: string, data: unknown): void };
 	notify?(message: string, level: "info" | "warning" | "error"): void;
 }
 
@@ -119,46 +106,13 @@ export async function applyLaunchPlan(input: {
 		surface.setActiveTools(expanded);
 	}
 
-	// --- model ---
-	if (plan.model !== undefined) {
-		const found = surface.modelRegistry.find(plan.model.provider, plan.model.id);
-		if (found === undefined) {
-			warnings.push(`profile "${plan.profile}": declared model ${plan.model.provider}/${plan.model.id} not found`);
-		} else {
-			const applied = await surface.setModel(found);
-			if (!applied) {
-				warnings.push(
-					`profile "${plan.profile}": model ${plan.model.provider}/${plan.model.id} has no configured auth`,
-				);
-			}
-		}
-		if (plan.model.thinkingLevel !== undefined) {
-			surface.setThinkingLevel(plan.model.thinkingLevel);
-		}
-	}
-
-	// --- mcp coordination (ticket 04 contract) ---
-	if (plan.mcps !== undefined && plan.mcps.length > 0) {
-		if (!probeAdapterPresence(surface.events)) {
-			const error = new MissingMcpAdapterError(plan.profile);
-			surface.notify?.(error.message, "error");
-			throw error;
-		}
-		surface.events.emit(MCP_ALLOWLIST_EVENT, {
-			version: MCP_ALLOWLIST_VERSION,
-			profile: plan.profile,
-			servers: plan.mcps,
-		});
-	}
-
-	// --- persistence + rollback anchor (post-reload only) ---
+	// --- persistence (post-reload only) ---
 	if (plan.persistSelection === true && input.reason === "reload" && plan.agentDir !== undefined) {
 		const stateDir = plan.source === "project" ? path.join(input.cwd, ".pi") : getGlobalStateDir(plan.agentDir);
 		// Merge: the overlay belongs to customize/reset, not to this write.
 		// A switch (clearOverlay) explicitly drops it.
 		await new RuntimeStateStore(stateDir).update({
 			activeProfile: plan.profile,
-			lastVerifiedProfile: plan.profile,
 			...(plan.clearOverlay === true ? { overlay: undefined } : {}),
 		});
 	}
@@ -182,7 +136,6 @@ function buildSwitchSummary(plan: LaunchPlanFile): string {
 		`profile switched: ${plan.switchedFrom} → ${plan.profile}`,
 		plan.tools !== undefined ? `tools: [${plan.tools.join(", ")}]` : undefined,
 		plan.mcps !== undefined && plan.mcps.length > 0 ? `mcp: [${plan.mcps.join(", ")}]` : undefined,
-		plan.model !== undefined ? `model: ${plan.model.provider}/${plan.model.id}` : undefined,
 	].filter((part): part is string => part !== undefined);
 	return parts.join("; ");
 }

package/src/switching/customize.ts

@@ -9,7 +9,7 @@
  *
  * Ordering invariants:
  * - customize: re-resolve with the candidate overlay FIRST (validation:
- *   unknown references and alwaysOn protection fail here, before anything
+ *   unknown references fail here, before anything
  *   is written), then switch+reload, then persist the overlay to state. A
  *   failed switch leaves the stored overlay untouched, consistent with the
  *   rolled-back runtime.
@@ -50,7 +50,7 @@ export async function customizeOverlay(
 	const candidate = mutate(state.overlay ?? {});
 
 	// switchProfile re-resolves with the candidate overlay; resolution-time
-	// validation (unknown references, alwaysOn protection) fails before any
+	// validation (unknown references) fails before any
 	// write. persistSelection is preserved by the reload-current path.
 	const result = await switchProfile(profile, deps, { reloadCurrent: true, overlay: candidate });
 

package/src/switching/switch-profile.ts

@@ -7,14 +7,16 @@
  * Flow (`/profile use <name>`):
  *   1. wait for the agent to be idle (Pi's native `ctx.waitForIdle()`) — a
  *      running turn is never torn down
- *   2. snapshot the runtime dir's settings.json + pi-profile.json in memory
+ *   2. snapshot ALL pi-profile-managed runtime files in memory
+ *      (settings.json, pi-profile.json, mcp.json, APPEND_SYSTEM.md, and the
+ *      trust.json link state — each as absent | symlink | file)
  *   3. re-resolve through the full launcher path (trust check, catalogs,
- *      discovery, registry, model/MCP validation) against the REAL agent
+ *      discovery, model/MCP validation) against the REAL agent
  *      dir — any failure here leaves the runtime untouched
  *   4. rewrite the runtime files in place (the running process's
  *      PI_CODING_AGENT_DIR cannot move) and mark the plan
  *      `persistSelection` so the post-reload extension instance saves the
- *      selection + rollback anchor
+ *      selection
  *   5. `ctx.reload()` — Pi re-reads settings from disk, re-executes
  *      extensions, preserves the session
  *   6. VERIFY the reload ran: interactive Pi swallows reload refusals and
@@ -29,7 +31,7 @@
  * (transient launch selections stay transient).
  */
 
-import { readFile, writeFile } from "node:fs/promises";
+import { chmod, lstat, readFile, readlink, rm, symlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 
 import { resolveInitialProfile } from "../launcher/initial-profile.ts";
@@ -70,38 +72,74 @@ export interface SwitchResult {
 	warnings: string[];
 }
 
+/** The pre-switch state of one pi-profile-managed runtime file. Absence is
+ *  a real state (the switch may create the file); a symlink keeps its raw
+ *  target so restore can rebuild it exactly; a file keeps content AND
+ *  permission bits so restore doesn't widen a user-tightened mode. */
+type FileSnapshot =
+	| { kind: "absent" }
+	| { kind: "symlink"; target: string }
+	| { kind: "file"; content: string; mode: number };
+
 interface RuntimeSnapshot {
-	settings?: string;
-	plan?: string;
+	settings: FileSnapshot;
+	plan: FileSnapshot;
+	mcp: FileSnapshot;
+	appendSystem: FileSnapshot;
+	trust: FileSnapshot;
 }
 
-async function readIfExists(filePath: string): Promise<string | undefined> {
-	try {
-		return await readFile(filePath, "utf8");
-	} catch (error) {
-		// Absence is expected (first launch); anything else (permissions,
-		// unreadable dir) must not silently disable rollback protection.
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+/** Snapshots one managed runtime file. lstat (never stat) detects symlinks
+ *  without following them; ENOENT is the only tolerated error — absence is
+ *  expected (first launch), while anything else (permissions, unreadable
+ *  dir) must not silently disable rollback protection. */
+async function snapshotFile(filePath: string): Promise<FileSnapshot> {
+	const info = await lstat(filePath).catch((error: NodeJS.ErrnoException) => {
+		// ENOENT is the only tolerated error — absence is expected (first
+		// launch); anything else (permissions, unreadable dir) must not
+		// silently disable rollback protection.
+		if (error.code === "ENOENT") return null;
 		throw error;
+	});
+	if (info === null) return { kind: "absent" };
+	if (info.isSymbolicLink()) {
+		return { kind: "symlink", target: await readlink(filePath) };
 	}
+	return { kind: "file", content: await readFile(filePath, "utf8"), mode: info.mode & 0o777 };
 }
 
 async function snapshotRuntimeFiles(runtimeDir: string): Promise<RuntimeSnapshot> {
 	return {
-		settings: await readIfExists(path.join(runtimeDir, "settings.json")),
-		plan: await readIfExists(path.join(runtimeDir, "pi-profile.json")),
+		settings: await snapshotFile(path.join(runtimeDir, "settings.json")),
+		plan: await snapshotFile(path.join(runtimeDir, "pi-profile.json")),
+		mcp: await snapshotFile(path.join(runtimeDir, "mcp.json")),
+		appendSystem: await snapshotFile(path.join(runtimeDir, "APPEND_SYSTEM.md")),
+		trust: await snapshotFile(path.join(runtimeDir, "trust.json")),
 	};
 }
 
-async function restoreRuntimeFiles(runtimeDir: string, snapshot: RuntimeSnapshot): Promise<void> {
-	if (snapshot.settings !== undefined) {
-		await writeFile(path.join(runtimeDir, "settings.json"), snapshot.settings);
-	}
-	if (snapshot.plan !== undefined) {
-		await writeFile(path.join(runtimeDir, "pi-profile.json"), snapshot.plan);
+async function restoreFile(filePath: string, snapshot: FileSnapshot): Promise<void> {
+	// rm first, always: restoring a snapshotted FILE must never writeFile
+	// through a symlink the failed switch left on disk — that would write
+	// THROUGH to the link target (the user's real ~/.pi/agent/mcp.json)
+	// instead of replacing the link.
+	await rm(filePath, { force: true });
+	if (snapshot.kind === "symlink") {
+		await symlink(snapshot.target, filePath);
+	} else if (snapshot.kind === "file") {
+		await writeFile(filePath, snapshot.content);
+		await chmod(filePath, snapshot.mode);
 	}
 }
 
+async function restoreRuntimeFiles(runtimeDir: string, snapshot: RuntimeSnapshot): Promise<void> {
+	await restoreFile(path.join(runtimeDir, "settings.json"), snapshot.settings);
+	await restoreFile(path.join(runtimeDir, "pi-profile.json"), snapshot.plan);
+	await restoreFile(path.join(runtimeDir, "mcp.json"), snapshot.mcp);
+	await restoreFile(path.join(runtimeDir, "APPEND_SYSTEM.md"), snapshot.appendSystem);
+	await restoreFile(path.join(runtimeDir, "trust.json"), snapshot.trust);
+}
+
 /** Waits are delegated to Pi's native `ctx.waitForIdle()` (see SwitchDeps);
  *  no polling loop lives here. */
 
@@ -141,8 +179,8 @@ export async function switchProfile(
 	// Snapshot before resolving so the rollback target always exists.
 	const snapshot = await snapshotRuntimeFiles(deps.runtimeDir);
 
-	// Full launcher resolution: trust gate, catalogs, discovery, dependency
-	// closure, model + MCP validation. Failures here leave the runtime
+	// Full launcher resolution: trust gate, catalogs, discovery, model +
+	// MCP validation. Failures here leave the runtime
 	// untouched — nothing was written yet.
 	const resolved = await resolveInitialProfile(
 		target,

package/defaults/profiles.json

@@ -1,18 +0,0 @@
-{
-  "schemaVersion": 1,
-  "profiles": {
-    "ask": {
-      "label": "Ask & Discuss",
-      "description": "Read-only Q&A and code exploration; no file modifications or command execution",
-      "skills": [],
-      "extensions": [],
-      "tools": [
-        "read",
-        "grep",
-        "find",
-        "ls"
-      ],
-      "instructions": "You are in read-only discussion mode. Answer questions and explain code without modifying any files or running shell commands."
-    }
-  }
-}

package/src/mcp-coordination.ts

@@ -1,65 +0,0 @@
-/**
- * McpCoordination: the pi-profile ↔ pi-mcp-adapter contract (ADR-0002).
- *
- * The adapter's released versions (≤2.33) offer no in-memory server
- * allowlist, so pi-profile defines the coordination channel the locked
- * adapter implements:
- *
- * - pi-profile publishes the active profile's runtime server allowlist on
- *   `pi-profile:mcp-allowlist:v1` at session start (and after every profile
- *   switch reload, ticket 05). The allowlist is memory-only: pi-profile
- *   never writes the adapter's `.pi/mcp.json` overlay.
- * - Adapter presence is probed via the adapter's documented
- *   request/result event pattern: emit a snapshot request for a bogus
- *   server name; an installed adapter fills `request.result` synchronously
- *   (with `{ok: false}` — the name is bogus), an absent adapter leaves it
- *   undefined.
- *
- * Launch-time, the launcher additionally refuses to spawn when a profile
- * declares `mcp` but no active extension identifies as the adapter
- * (`isAdapterExtension`) — failing before spawn beats failing in-session.
- */
-
-/** pi-profile's allowlist channel (the locked adapter subscribes). */
-export const MCP_ALLOWLIST_EVENT = "pi-profile:mcp-allowlist:v1";
-export const MCP_ALLOWLIST_VERSION = 1 as const;
-
-export interface McpAllowlistMessage {
-	version: typeof MCP_ALLOWLIST_VERSION;
-	profile: string;
-	servers: string[];
-}
-
-/** The adapter's snapshot channel, used here purely as a presence probe
- *  (see the module docblock). Kept as a literal so pi-profile doesn't
- *  import adapter internals. */
-export const MCP_ADAPTER_SNAPSHOT_EVENT = "pi-mcp-adapter:runtime-snapshot:v1";
-
-export class MissingMcpAdapterError extends Error {
-	constructor(profile: string) {
-		super(
-			`profile "${profile}" declares MCP servers but pi-mcp-adapter is not active. ` +
-				`Select the adapter in the profile's extensions (e.g. via its npm package) or remove the "mcps" declaration.`,
-		);
-		this.name = "MissingMcpAdapterError";
-	}
-}
-
-/** Identifies the adapter among active extension entries by its install
- *  path containing "pi-mcp-adapter" (npm package roots and local dirs both
- *  match). Heuristic by design — activation-plan entries carry no package
- *  source string, and the in-session probe is the authoritative check. */
-export function isAdapterExtension(entry: { entry: string }): boolean {
-	return entry.entry.includes("pi-mcp-adapter");
-}
-
-/** True when the adapter answered the probe (filled `result` on the
- *  request object), regardless of the answer — presence, not health. */
-export function probeAdapterPresence(events: { emit(channel: string, data: unknown): void }): boolean {
-	const request: { version: 1; name: string; result?: unknown } = {
-		version: 1,
-		name: "pi-profile:presence-probe",
-	};
-	events.emit(MCP_ADAPTER_SNAPSHOT_EVENT, request);
-	return request.result !== undefined;
-}