pi-profile-switch 0.5.0 → 0.7.0

package/bin/pi-profile.ts

@@ -28,7 +28,7 @@ try {
 	const agentDir = getAgentDir();
 	// Fails before spawning when the profile is unknown or cannot activate.
 	// --approve/--no-approve are consumed here as a one-run trust input.
-	const { plan, discovery, projectSettings, projectDir, warnings } = await resolveInitialProfile(args.profile, {
+	const { plan, discovery, projectDir, warnings } = await resolveInitialProfile(args.profile, {
 		agentDir,
 		cwd: process.cwd(),
 		trustOverride: args.trustOverride,
@@ -37,19 +37,26 @@ try {
 		console.error(`pi-profile: warning: ${warning}`);
 	}
 	// Stale per-launch instance dirs (dead pid, or no pid past the grace
-	// window) are swept before this launch materializes its own. Directories
-	// holding state pi-profile did not generate are kept and reported instead of
-	// deleted (ADR-0010). Best-effort: sweep errors never block the launch.
-	for (const warning of await sweepStaleInstances()) {
+	// window) are swept before this launch materializes its own. Unrecognized
+	// entries are dispositioned per content scan: kept + reported when they
+	// reference the instance path or cannot be cleared, adopted into the real
+	// agent dir, or deleted on a name conflict (real wins) — all with a stderr
+	// notice (ADR-0012). Best-effort: sweep errors never block the launch.
+	const sweep = await sweepStaleInstances(agentDir);
+	for (const notice of sweep.notices) {
+		console.error(`pi-profile: notice: ${notice}`);
+	}
+	for (const warning of sweep.warnings) {
 		console.error(`pi-profile: warning: ${warning}`);
 	}
-	const generated = await generateRuntimeDir(plan, { agentDir, discovery, projectSettings, projectDir });
+	const generated = await generateRuntimeDir(plan, { agentDir, discovery, projectDir });
 	process.exitCode = await spawnPi({
 		generated,
 		piArgs: args.piArgs,
-		// Only the default profile keeps trust behavior native (flag re-applied);
-		// named profiles never forward it — the resolver is the trust gatekeeper.
-		trustOverride: plan.filter === "none" ? args.trustOverride : undefined,
+		// Re-applied for every profile: the one-run trust input must decide both
+		// the resolver's project reads and Pi's project-scope visibility — two
+		// different answers in one launch would be a divergence, not a policy.
+		trustOverride: args.trustOverride,
 	});
 } catch (error) {
 	// Launcher input/selection failures (unknown profile, unresolvable

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-profile-switch",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Named profiles for Pi: reference skills, extensions, MCP servers, and tools per workflow, switched without restarting. Install: npm install -g pi-profile-switch (not pi install).",
   "type": "module",
   "keywords": [

package/src/launcher/initial-profile.ts

@@ -53,9 +53,6 @@ export interface InitialProfile {
 	/** Full discovery results for the settings generator. Undefined for the
 	 *  default profile (which applies no filtering). */
 	discovery?: LauncherDiscovery;
-	/** The trusted project's `.pi/settings.json` content, when trusted and
-	 *  present. The generator merges it into the base for selection plans. */
-	projectSettings?: Record<string, unknown>;
 	/** The trusted project directory, when trusted. */
 	projectDir?: string;
 	/** Non-fatal notices for the user (e.g. a dangling restored profile that
@@ -63,13 +60,12 @@ export interface InitialProfile {
 	warnings: string[];
 }
 
-/** Reads the real global `defaultProjectTrust` setting (a trust input) and,
- *  when trusted, the project's `.pi/settings.json`. Exported for the
- *  session-side surfaces (selector/list/status) that need the same trust
- *  gate the launcher uses. */
+/** Reads the real global `defaultProjectTrust` setting (a trust input) and
+ *  resolves the project trust decision from Pi's own trust store. Exported
+ *  for the session-side surfaces (selector/list/status) that need the same
+ *  trust gate the launcher uses. */
 export async function readTrustInputs(context: LauncherContext): Promise<{
 	projectTrusted: boolean;
-	projectSettings?: Record<string, unknown>;
 }> {
 	const globalSettingsPath = path.join(context.agentDir, "settings.json");
 	const globalSettings = await readJsonFile(globalSettingsPath);
@@ -86,10 +82,9 @@ export async function readTrustInputs(context: LauncherContext): Promise<{
 	if (!projectTrusted) {
 		return { projectTrusted };
 	}
-	const projectSettingsResult = await readJsonFile(path.join(context.cwd, ".pi", "settings.json"));
-	const projectSettings =
-		projectSettingsResult.ok && isRecord(projectSettingsResult.value) ? projectSettingsResult.value : undefined;
-	return { projectTrusted, projectSettings };
+	// The project's own `.pi/settings.json` is Pi's to read (natively, for the
+	// same trust decision): pi-profile neither merges nor narrows it.
+	return { projectTrusted };
 }
 
 export async function resolveInitialProfile(
@@ -97,7 +92,7 @@ export async function resolveInitialProfile(
 	context: LauncherContext,
 	options?: { overlay?: RuntimeOverlay },
 ): Promise<InitialProfile> {
-	const { projectTrusted, projectSettings } = await readTrustInputs(context);
+	const { projectTrusted } = await readTrustInputs(context);
 	const projectDir = projectTrusted ? context.cwd : undefined;
 	const catalog = await ProfileCatalog.load(context.agentDir, { projectDir });
 
@@ -156,7 +151,7 @@ export async function resolveInitialProfile(
 			overlay,
 		});
 		warnings.push(...discovery.extensions.warnings(), ...unmatchedWarnings(plan));
-		return { plan, discovery, projectSettings, projectDir, warnings };
+		return { plan, discovery, projectDir, warnings };
 	}
 
 	const discovery = await discoverLauncherResources({ ...context, projectTrusted });
@@ -177,5 +172,5 @@ export async function resolveInitialProfile(
 		// silently do nothing or leak through unfiltered.
 		throw new MissingMcpAdapterError(plan.profile);
 	}
-	return { plan, discovery, projectSettings, projectDir, warnings };
+	return { plan, discovery, projectDir, warnings };
 }

package/src/launcher/runtime-cleanup.ts

@@ -21,19 +21,21 @@
  * PID reuse needs no /proc check: a wrong keep only delays cleanup and
  * self-heals once the reused pid dies.
  *
- * A candidate is deleted only when every entry in it is pi-profile's own: a
- * symlink (the mirror's link into the real agent dir) or a managed generated
- * file. Anything else is state an extension created at runtime, so the
- * directory is kept and reported — the sweep never destroys data it cannot
- * attribute. The check deliberately does NOT consult the real agent dir: a
- * same-named entry there (a seeded `missions`, say) must not turn an
- * instance-local real directory into a deletable one.
+ * A candidate is reclaimed only when every entry in it is pi-profile's own
+ * or has been dispositioned away. Unrecognized entries (state an extension
+ * created at runtime) get one of three dispositions per entry (ADR-0012):
+ * content that references the instance dir's own path, exceeds the scan
+ * budget, or is not a regular file/dir is kept and reported; position-
+ * independent content is renamed into the real agent dir (adopted), or
+ * deleted when the real agent dir already holds that name (real wins — the
+ * conflict window means the instance copy is never the authority). The sweep
+ * never destroys data it cannot attribute.
  *
  * Everything is best-effort: sweep errors never block a launch.
  */
 
 import type { Dirent } from "node:fs";
-import { lstat, readdir, readFile, rm, stat } from "node:fs/promises";
+import { lstat, readdir, readFile, rename, rm, stat } from "node:fs/promises";
 import path from "node:path";
 
 import { MANAGED_INSTANCE_FILES } from "../settings-generator.ts";
@@ -49,6 +51,29 @@ export const NO_PID_GRACE_MS = 10 * 60 * 1000;
  *  may write its own files inside them (e.g. an extension's own config). */
 const MANAGED_DIRS_WITH_RUNTIME_CONTENT = new Set(["extensions"]);
 
+/** Content-scan budget for deciding whether an unrecognized entry is safe to
+ *  adopt (ADR-0012). Over budget → undecidable → keep and warn. The values
+ *  are implementation constants: the contract only fixes "over budget means
+ *  keep". Exported for the tests that pin the over-budget behavior. */
+export const SCAN_MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+export const SCAN_MAX_FILES = 1024;
+
+/** What the sweep does with one unrecognized entry in a candidate dir. */
+type Disposition = "adopt" | "delete" | "keep-warn";
+
+interface EntryDecision {
+	/** Entry name relative to the instance dir. */
+	name: string;
+	disposition: Disposition;
+}
+
+export interface SweepResult {
+	/** Warnings for directories intentionally kept. */
+	warnings: string[];
+	/** One-line notices for entries adopted into or deleted from a candidate. */
+	notices: string[];
+}
+
 function isProcessAlive(pid: number): boolean {
 	try {
 		process.kill(pid, 0);
@@ -59,10 +84,98 @@ function isProcessAlive(pid: number): boolean {
 	}
 }
 
-/** Paths inside `dir` that pi-profile did not generate, relative to `dir`.
- *  `undefined` means the directory could not be inspected — the caller must
- *  treat that as unrecognized rather than as empty. */
-async function unrecognizedEntries(dir: string): Promise<string[] | undefined> {
+/** Scan budget shared across one entry's recursive content scan. */
+interface ScanBudget {
+	bytes: number;
+	files: number;
+	/** Set when a limit is hit or a member cannot be read: undecidable. */
+	exceeded: boolean;
+	/** Set when a member's bytes contain the instance dir's absolute path. */
+	found: boolean;
+}
+
+async function scanContent(entryPath: string, instanceDir: string, budget: ScanBudget): Promise<void> {
+	if (budget.exceeded || budget.found) return;
+	let info;
+	try {
+		info = await lstat(entryPath);
+	} catch {
+		budget.exceeded = true; // Vanished or unreadable mid-scan: undecidable.
+		return;
+	}
+	if (info.isDirectory()) {
+		let members: string[];
+		try {
+			members = await readdir(entryPath);
+		} catch {
+			budget.exceeded = true;
+			return;
+		}
+		for (const member of members) {
+			await scanContent(path.join(entryPath, member), instanceDir, budget);
+			if (budget.exceeded || budget.found) return;
+		}
+		return;
+	}
+	if (!info.isFile()) {
+		// A socket/fifo/device member cannot be read: undecidable.
+		budget.exceeded = true;
+		return;
+	}
+	budget.files += 1;
+	budget.bytes += info.size;
+	if (budget.files > SCAN_MAX_FILES || budget.bytes > SCAN_MAX_TOTAL_BYTES) {
+		budget.exceeded = true;
+		return;
+	}
+	let content: Buffer;
+	try {
+		content = await readFile(entryPath);
+	} catch {
+		budget.exceeded = true;
+		return;
+	}
+	if (content.includes(instanceDir)) budget.found = true;
+}
+
+/** Whether an unrecognized entry must be kept because its content scan says
+ *  so: the content references the instance dir's own path (records like
+ *  pi-subagents ledgers would break if moved), the scan could not finish
+ *  within the budget, or the entry is not a regular file/dir. Only a clean
+ *  negative scan makes the entry eligible for adoption (ADR-0012). */
+export async function mustKeepByContentScan(entryPath: string, instanceDir: string): Promise<boolean> {
+	let info;
+	try {
+		info = await lstat(entryPath);
+	} catch {
+		return true; // Vanished or unreadable: nothing to adopt.
+	}
+	if (!info.isFile() && !info.isDirectory()) return true; // socket/fifo etc.
+	const budget: ScanBudget = { bytes: 0, files: 0, exceeded: false, found: false };
+	await scanContent(entryPath, instanceDir, budget);
+	// Keep unless the scan finished within budget and never saw the path.
+	return budget.exceeded || budget.found;
+}
+
+/** Decides one top-level unrecognized entry: keep when the content scan is
+ *  not a clean negative; otherwise real-wins on a name conflict, adopt when
+ *  the real agent dir is free. A name lookup that fails for reasons other
+ *  than absence is undecidable → keep. */
+async function decideEntry(name: string, entryPath: string, instanceDir: string, agentDir: string): Promise<EntryDecision> {
+	if (await mustKeepByContentScan(entryPath, instanceDir)) return { name, disposition: "keep-warn" };
+	try {
+		await lstat(path.join(agentDir, name));
+		return { name, disposition: "delete" };
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return { name, disposition: "adopt" };
+		return { name, disposition: "keep-warn" };
+	}
+}
+
+/** Unrecognized entry names inside a managed runtime-content directory
+ *  (`extensions/`): reported at pi-profile's boundary, never adopted or
+ *  deleted. `undefined` means the directory could not be inspected. */
+async function unrecognizedNames(dir: string): Promise<string[] | undefined> {
 	let entries: Dirent<string>[];
 	try {
 		entries = await readdir(dir, { withFileTypes: true });
@@ -71,6 +184,41 @@ async function unrecognizedEntries(dir: string): Promise<string[] | undefined> {
 	}
 
 	const found: string[] = [];
+	for (const entry of entries) {
+		const entryPath = path.join(dir, entry.name);
+		let linkStat;
+		try {
+			linkStat = await lstat(entryPath);
+		} catch {
+			continue; // Vanished under us: nothing to protect.
+		}
+		if (linkStat.isSymbolicLink()) continue;
+		if (MANAGED_DIRS_WITH_RUNTIME_CONTENT.has(entry.name) && linkStat.isDirectory()) {
+			const nested = await unrecognizedNames(entryPath);
+			if (nested === undefined) {
+				found.push(entry.name);
+				continue;
+			}
+			found.push(...nested.map((name) => path.join(entry.name, name)));
+			continue;
+		}
+		found.push(entry.name);
+	}
+	return found;
+}
+
+/** Decides every unrecognized entry in `dir`. `undefined` means the directory
+ *  could not be inspected — the caller must treat that as unrecognized rather
+ *  than as empty. */
+async function classifyUnrecognized(dir: string, agentDir: string): Promise<EntryDecision[] | undefined> {
+	let entries: Dirent<string>[];
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch {
+		return undefined;
+	}
+
+	const decisions: EntryDecision[] = [];
 	for (const entry of entries) {
 		const entryPath = path.join(dir, entry.name);
 		let linkStat;
@@ -82,24 +230,26 @@ async function unrecognizedEntries(dir: string): Promise<string[] | undefined> {
 		// Symlinks only point at the real agent dir and hold no data of their own.
 		if (linkStat.isSymbolicLink()) continue;
 		if (!MANAGED_INSTANCE_FILES.has(entry.name)) {
-			found.push(entry.name);
+			decisions.push(await decideEntry(entry.name, entryPath, dir, agentDir));
 			continue;
 		}
 		if (MANAGED_DIRS_WITH_RUNTIME_CONTENT.has(entry.name) && linkStat.isDirectory()) {
-			const nested = await unrecognizedEntries(entryPath);
+			const nested = await unrecognizedNames(entryPath);
 			if (nested === undefined) {
-				found.push(entry.name);
+				decisions.push({ name: entry.name, disposition: "keep-warn" });
 				continue;
 			}
-			found.push(...nested.map((name) => path.join(entry.name, name)));
+			for (const name of nested) decisions.push({ name: path.join(entry.name, name), disposition: "keep-warn" });
 		}
 	}
-	return found;
+	return decisions;
 }
 
-/** Reclaims `dir` if it is both dead and free of unrecognized entries.
- *  Returns the warnings for the cases where it was intentionally kept. */
-async function sweepEntry(dir: string): Promise<string[]> {
+/** Reclaims `dir` if it is both dead and free of unrecognized entries, after
+ *  dispositioning those entries (ADR-0012). Appends notices for adopted and
+ *  deleted entries to `notices`; returns the warnings for the cases where the
+ *  directory was intentionally kept. */
+async function sweepEntry(dir: string, agentDir: string, notices: string[]): Promise<string[]> {
 	let pid: number | undefined;
 	try {
 		const raw = await readFile(path.join(dir, "pid"), "utf8");
@@ -116,15 +266,43 @@ async function sweepEntry(dir: string): Promise<string[]> {
 		if (Date.now() - info.mtimeMs <= NO_PID_GRACE_MS) return [];
 	}
 
-	const unrecognized = await unrecognizedEntries(dir);
-	if (unrecognized === undefined) {
+	const decisions = await classifyUnrecognized(dir, agentDir);
+	if (decisions === undefined) {
 		return [
 			`${dir} was not reclaimed: it could not be inspected (permissions?). Check its contents and delete it manually.`,
 		];
 	}
-	if (unrecognized.length > 0) {
+
+	const kept: string[] = [];
+	for (const decision of decisions) {
+		if (decision.disposition === "keep-warn") {
+			kept.push(decision.name);
+			continue;
+		}
+		const entryPath = path.join(dir, decision.name);
+		if (decision.disposition === "adopt") {
+			try {
+				await rename(entryPath, path.join(agentDir, decision.name));
+				notices.push(`adopted ${decision.name} from ${dir} into the real agent dir (${agentDir}); it is mirrored on the next launch`);
+				continue;
+			} catch {
+				kept.push(decision.name); // Best-effort: keep rather than destroy.
+				continue;
+			}
+		}
+		// delete: the real agent dir already holds this name (real wins, no
+		// content comparison — ADR-0012).
+		try {
+			await rm(entryPath, { recursive: true, force: true });
+			notices.push(`deleted ${decision.name} from ${dir}: the real agent dir already holds that name`);
+		} catch {
+			kept.push(decision.name);
+		}
+	}
+
+	if (kept.length > 0) {
 		return [
-			`${dir} was not reclaimed: it holds state pi-profile did not generate (${unrecognized.join(", ")}). ` +
+			`${dir} was not reclaimed: it holds state pi-profile did not generate (${kept.join(", ")}). ` +
 				`Move that state into the real agent dir (it is mirrored on the next launch), or point the extension that ` +
 				`created it at a fixed path via that extension's own configuration, then delete ${dir}.`,
 		];
@@ -135,16 +313,19 @@ async function sweepEntry(dir: string): Promise<string[]> {
 }
 
 /** Deletes stale instance dirs under the instances root and returns the
- *  warnings for directories it deliberately kept. Never throws. */
-export async function sweepStaleInstances(): Promise<string[]> {
+ *  warnings for directories it deliberately kept plus the notices for entries
+ *  it adopted or deleted. `agentDir` is the real agent dir that adopted
+ *  entries move into and name conflicts resolve against. Never throws. */
+export async function sweepStaleInstances(agentDir: string): Promise<SweepResult> {
 	const warnings: string[] = [];
+	const notices: string[] = [];
 	const root = getInstancesRootDir();
 
 	let entries: string[];
 	try {
 		entries = await readdir(root);
 	} catch {
-		return warnings; // No instances root yet: nothing to sweep.
+		entries = []; // No instances root yet: nothing to sweep.
 	}
 
 	for (const entry of entries) {
@@ -155,11 +336,11 @@ export async function sweepStaleInstances(): Promise<string[]> {
 		const dir = path.join(root, entry);
 		try {
 			if (!(await stat(dir)).isDirectory()) continue;
-			warnings.push(...(await sweepEntry(dir)));
+			warnings.push(...(await sweepEntry(dir, agentDir, notices)));
 		} catch {
 			// Best-effort: one bad entry must not stop the sweep or the launch.
 		}
 	}
 
-	return warnings;
+	return { warnings, notices };
 }

package/src/launcher/spawn.ts

@@ -29,7 +29,8 @@ const EXTENSION_ENTRY = fileURLToPath(new URL("../../extensions/pi-profile/index
  *  trust re-application, then user args verbatim. */
 export function buildPiArgs(options: SpawnPiOptions): string[] {
 	const args = ["-e", EXTENSION_ENTRY];
-	// default profile keeps trust behavior native: re-apply the recorded flag.
+	// Re-apply the recorded one-run trust input for every profile: the same input
+	// decided the launcher's project reads, so Pi must decide the same way.
 	if (options.trustOverride === true) args.push("--approve");
 	if (options.trustOverride === false) args.push("--no-approve");
 	args.push(...options.piArgs);

package/src/mcp-config.ts

@@ -40,6 +40,9 @@ export interface McpDiscoveryOptions {
 export interface MergedMcpResult {
 	servers: Record<string, Record<string, unknown>>;
 	sharedServers: Set<string>;
+	/** Servers defined in a trusted project's own config (`.mcp.json`,
+	 *  `.pi/mcp.json`). They are not the profile's to narrow. */
+	projectServers: Set<string>;
 	baseConfig?: Record<string, unknown>;
 }
 
@@ -47,6 +50,9 @@ export interface McpConfigSource {
 	path: string;
 	isShared: boolean;
 	isAgentDir?: boolean;
+	/** Project-scope source: only read for a trusted project, and its servers
+	 *  stay enabled regardless of a profile's `mcps` declaration. */
+	isProject?: boolean;
 }
 
 /**
@@ -71,8 +77,8 @@ export function getStandardMcpConfigSources(
 		{ path: path.join(agentDir, "mcp.json"), isShared: false, isAgentDir: true },
 	];
 	if (projectDir !== undefined) {
-		sources.push({ path: path.join(projectDir, ".mcp.json"), isShared: true });
-		sources.push({ path: path.join(projectDir, ".pi", "mcp.json"), isShared: false });
+		sources.push({ path: path.join(projectDir, ".mcp.json"), isShared: true, isProject: true });
+		sources.push({ path: path.join(projectDir, ".pi", "mcp.json"), isShared: false, isProject: true });
 	}
 	return sources;
 }
@@ -86,6 +92,7 @@ export async function loadMergedMcpServers(
 	const seenPaths = new Set<string>();
 	const servers: Record<string, Record<string, unknown>> = {};
 	const sharedServers = new Set<string>();
+	const projectServers = new Set<string>();
 	let baseConfig: Record<string, unknown> | undefined;
 
 	for (const source of sources) {
@@ -112,6 +119,9 @@ export async function loadMergedMcpServers(
 			if (source.isShared) {
 				sharedServers.add(name);
 			}
+			if (source.isProject === true) {
+				projectServers.add(name);
+			}
 			if (isRecord(def)) {
 				servers[name] = { ...(servers[name] ?? {}), ...def };
 			} else {
@@ -120,7 +130,7 @@ export async function loadMergedMcpServers(
 		}
 	}
 
-	return { servers, sharedServers, baseConfig };
+	return { servers, sharedServers, projectServers, baseConfig };
 }
 
 /** Server names the adapter would discover: standard global MCP configs,

package/src/project-trust.ts

@@ -1,27 +1,31 @@
 /**
- * Project trust resolution for the launcher — pi-profile is the sole
- * gatekeeper for project resources, because generated settings carry
- * `defaultProjectTrust: "never"` and Pi therefore never auto-discovers them.
+ * Project trust resolution for the launcher — pi-profile's gate for the
+ * project-scope content it reads itself: the project catalog, the project
+ * runtime state, and the project MCP config. Project-level resources
+ * (skills, extensions, prompts, themes, settings) are Pi's own business: its
+ * trust store decision, exposed through the linked `trust.json`, decides
+ * their visibility (see ADR-0011).
  *
  * Mirrors Pi's own trust decision order (`resolveProjectTrusted`), with
  * pi-profile's catalog/state files added to the trust-requiring
  * resource set (they are pi-profile's project attack surface; Pi doesn't
  * know about them):
  *   1. one-run `--approve` / `--no-approve` override (consumed by the
- *      launcher, never forwarded for named profiles)
+ *      launcher and re-applied to the spawned pi for every profile)
  *   2. a project with no trust-requiring resources at all is trusted —
  *      there is nothing project-scoped to gate
  *   3. the stored decision in the real `trust.json` (nearest ancestor wins)
  *   4. the user's `defaultProjectTrust` setting — but only "always" grants;
  *      "ask" cannot prompt here (the launcher has no trust UI), so it falls
  *      through to untrusted
- *   5. otherwise untrusted: project catalogs, registries, resources, and
- *      state files are not read at all
+ *   5. otherwise untrusted: project catalogs, project state, and project MCP
+ *      config are not read at all
  *
  * Known divergence from Pi: extension `project_trust` event handlers are not
  * consulted — that would require executing extension code in the launcher,
- * which pi-profile never does. In named-profile sessions the event is moot
- * anyway (generated settings carry `defaultProjectTrust: "never"`).
+ * which pi-profile never does. A spawned Pi still runs those handlers with
+ * its own settings, so an extension that answers yes/no can decide the
+ * project scope of that session.
  */
 
 import { existsSync, readFileSync } from "node:fs";

package/src/settings-generator.ts

@@ -17,18 +17,20 @@
  * the spawned pi behaves exactly like native `pi`.
  *
  * For named profiles the generated settings encode the profile's selection
- * per the filtering model (see docs/architecture/overview.md):
+ * over user-scope resources only (see docs/architecture/overview.md):
  * - agentDir-scope resources: additive allowlist paths (the discovery root
  *   moved, so nothing auto-discovered from the real agent dir)
  * - `~/.agents` skills: always auto-discovered, so unselected ones are
  *   force-excluded with `-<path>` entries
  * - packages: user-configured package entries rewritten to object form with
  *   per-type allowlists (unmanaged types keep the user's key or Pi's default)
- * - `defaultProjectTrust: "never"` suppresses all project auto-discovery
- *   (project resources enter only through the trust-gated resolver)
- * - project `packages` are stripped from the settings merge (project
- *   packages are unsupported — the key would install into the global npm
- *   root as a launch side effect)
+ * - project-scope resources (project `.pi/skills`, project `.pi/extensions`,
+ *   ancestor `.agents/skills`) are never encoded: Pi discovers them natively
+ *   whenever the project is trusted, and the profile neither adds nor
+ *   excludes them
+ * - `defaultProjectTrust: "never"` only suppresses Pi's interactive trust
+ *   prompt (a stored decision in the real trust.json still applies); the
+ *   project's `.pi/settings.json` is not merged here — Pi reads it natively
  * - unmanaged kinds (prompts, themes) pass through: the user's arrays are
  *   preserved and the real agent dir's prompts/themes dirs re-included
  * - tools/model are written to generated settings (defaultTools,
@@ -74,11 +76,6 @@ export interface GenerateOptions {
 	projectDir?: string;
 	/** Required for selection plans; unused for the default profile. */
 	discovery?: DiscoveryContext;
-	/** The trusted project's `.pi/settings.json` content (already parsed).
-	 *  Only pass when the resolver's trust check passed; merged into the
-	 *  generated base per Pi's merge rules for selection plans. Ignored for
-	 *  the default profile (Pi reads project settings natively there). */
-	projectSettings?: Record<string, unknown>;
 }
 
 export interface GeneratedRuntime {
@@ -150,21 +147,6 @@ function toPosix(filePath: string): string {
 	return filePath.split(path.sep).join("/");
 }
 
-/** Mirrors Pi's own deepMergeSettings: plain objects merge recursively,
- *  everything else (arrays, primitives) is replaced by the override. */
-function deepMergeSettings(base: Record<string, unknown>, overrides: Record<string, unknown>): Record<string, unknown> {
-	const result: Record<string, unknown> = { ...base };
-	for (const [key, overrideValue] of Object.entries(overrides)) {
-		if (overrideValue === undefined) continue;
-		const baseValue = result[key];
-		result[key] =
-			isRecord(baseValue) && isRecord(overrideValue)
-				? deepMergeSettings(baseValue, overrideValue)
-				: overrideValue;
-	}
-	return result;
-}
-
 function tryRealpath(p: string): string {
 	try {
 		return realpathSync(p);
@@ -194,27 +176,28 @@ function buildSelectionSettings(
 	agentDir: string,
 	discovery: DiscoveryContext,
 	runtimeDir: string,
+	projectDir?: string,
 ): Record<string, unknown> {
 	const settings = { ...userSettings };
 
 	// --- skills ---
-	// Project-scope selections are emitted before user-scope ones: Pi's
-	// same-name collision rule is first-wins, and project resources must keep
-	// their native priority (ticket 03).
-	const orderedSelectedSkills = [...plan.skills].sort((a, b) => {
-		const aProject = a.scope === "project" ? 0 : 1;
-		const bProject = b.scope === "project" ? 0 : 1;
-		return aProject - bProject;
-	});
+	// Only user-scope entries are encoded. Project-scope selections are
+	// skipped below: their visibility is Pi's, so the order they would have
+	// been emitted in carries no meaning.
 	const selectedPaths = new Set(plan.skills.map((skill) => skill.filePath));
 	const skillEntries: string[] = [];
-	for (const skill of orderedSelectedSkills) {
+	for (const skill of plan.skills) {
 		if (skill.origin === "package") continue; // encoded in the packages allowlist
+		// Project scope belongs to Pi: a trusted project's skills are discovered
+		// natively, so selecting one here would duplicate it and excluding one
+		// would contradict the profile's boundary.
+		if (skill.scope === "project") continue;
 		if (isUnderPath(skill.filePath, homeAgentsSkillsDir())) continue; // auto-discovered anyway
 		skillEntries.push(skill.filePath);
 	}
 	for (const skill of discovery.skills) {
 		if (skill.origin === "package") continue;
+		if (skill.scope === "project") continue;
 		if (selectedPaths.has(skill.filePath)) continue;
 		
 		// If the skill is in the real agentDir, Pi will discover it via the symlink.
@@ -240,7 +223,13 @@ function buildSelectionSettings(
 		.map((pkg) => ({ ...pkg, root: pkg.root }));
 	const packageExtensions = new Map<string, string[]>();
 	const extensionEntries: string[] = [];
+	const projectExtensionsDir =
+		projectDir !== undefined ? path.join(projectDir, ".pi", "extensions") : undefined;
 	for (const extension of plan.extensions) {
+		// Loose project extensions are discovered natively by Pi; an explicit
+		// path reference inside the project (outside `.pi/extensions`) is the
+		// profile's own selection and stays.
+		if (projectExtensionsDir !== undefined && isUnderPath(extension.entry, projectExtensionsDir)) continue;
 		const owner = packageRoots.find((pkg) => isUnderPath(extension.entry, pkg.root));
 		if (owner === undefined) {
 			extensionEntries.push(extension.entry);
@@ -316,8 +305,6 @@ export interface RuntimeFileOptions {
 	projectDir?: string;
 	/** Required for selection plans; unused for the default profile. */
 	discovery?: DiscoveryContext;
-	/** The trusted project's `.pi/settings.json` content (already parsed). */
-	projectSettings?: Record<string, unknown>;
 	/** Extra launch-plan fields written by the in-session switch path:
 	 *  `switchedFrom` triggers the one-shot change summary; `persistSelection`
 	 *  tells the post-reload extension instance to save the selection;
@@ -363,21 +350,20 @@ async function computeSettings(
 		return settings;
 	}
 
-	// Selection plans: the trusted project's settings merge into the base
-	// per Pi's merge rules (project wins, nested objects merge), then the
-	// filtering encoding replaces the managed keys on top. With
-	// defaultProjectTrust: "never", Pi itself never reads project settings.
-	//
-	// The project's `packages` key is stripped: project packages install
-	// under the project's .pi/npm and are unreferenceable in generated
-	// global-scope settings — merging the key would make Pi install them
-	// into the (symlinked) global npm root as a launch side effect.
-	let base = { ...userSettings };
-	if (options.projectSettings !== undefined) {
-		const { packages: _stripped, ...mergeable } = options.projectSettings;
-		base = deepMergeSettings(base, mergeable);
-	}
-	return buildSelectionSettings(plan, base, agentDir, options.discovery ?? { skills: [], packages: [] }, runtimeDir);
+	// Selection plans: only user-scope encoding is layered onto the user's own
+	// settings. The trusted project's `.pi/settings.json` is deliberately NOT
+	// merged here — Pi reads it natively for the same trust decision this
+	// process's Pi applies, and merging it would turn the project's `packages`
+	// into global-scope packages (installing them into the real agent dir's npm
+	// root as a launch side effect).
+	return buildSelectionSettings(
+		plan,
+		{ ...userSettings },
+		agentDir,
+		options.discovery ?? { skills: [], packages: [] },
+		runtimeDir,
+		options.projectDir,
+	);
 }
 
 /** Resolved name sets, carried in the launch plan for glob-delta reporting. */
@@ -389,10 +375,9 @@ export interface ResolvedNames {
 }
 
 /** Writes settings.json + pi-profile.json into an existing runtime dir and
- *  transitions the trust.json link to the plan's filter mode: linked for
- *  `default` (native trust behavior), absent for named profiles (a stored
- *  trust decision would beat the generated `defaultProjectTrust: "never"`
- *  inside Pi and re-enable unfiltered project auto-discovery). */
+ *  keeps the trust.json link in place for every profile: Pi reads its
+ *  project-scope decision from that path, and project-level resources belong
+ *  to Pi's trust gate rather than to the profile. */
 export async function writeRuntimeFiles(
 	runtimeDir: string,
 	plan: ActivationPlan,
@@ -433,18 +418,14 @@ export async function writeRuntimeFiles(
 		)}\n`,
 	);
 
+	// Every profile gets the link, dangling allowed: Pi's stored trust decision
+	// is what makes a trusted project's resources visible, and a decision Pi
+	// writes through the link must land in the real agent dir (same shape as the
+	// auth.json seed in ADR-0010). An entry that already exists is left alone —
+	// a real file Pi wrote during this session carries its own decision.
 	const trustLink = path.join(runtimeDir, "trust.json");
-	const trustTarget = path.join(options.agentDir, "trust.json");
-	if (plan.filter === "none") {
-		if ((await exists(trustTarget)) && !(await existsLexical(trustLink))) {
-			await symlink(trustTarget, trustLink);
-		}
-	} else if (await existsLexical(trustLink)) {
-		// Lexical check: a dangling trust.json symlink (real trust.json deleted
-		// after the link was made) must still be removed — otherwise a later
-		// re-created real trust.json silently resurrects stored trust inside a
-		// named profile, defeating defaultProjectTrust: "never".
-		await rm(trustLink);
+	if (!(await existsLexical(trustLink))) {
+		await symlink(path.join(options.agentDir, "trust.json"), trustLink);
 	}
 
 	// MCP Servers generation (Ticket 04)
@@ -459,7 +440,7 @@ export async function writeRuntimeFiles(
 	} else {
 		// Filter MCP servers
 		try { await rm(mcpInstancePath); } catch {}
-		const { servers, sharedServers, baseConfig } = await loadMergedMcpServers(
+		const { servers, sharedServers, projectServers, baseConfig } = await loadMergedMcpServers(
 			options.agentDir,
 			options.projectDir,
 			options.homeDir !== undefined ? { homeDir: options.homeDir } : undefined,
@@ -478,6 +459,9 @@ export async function writeRuntimeFiles(
 
 		for (const sharedName of sharedServers) {
 			if (!allowedSet.has(sharedName)) {
+				// Project-level servers are not the profile's to narrow (the same
+				// boundary as project skills and extensions).
+				if (projectServers.has(sharedName)) continue;
 				filteredServers[sharedName] = { disabled: true };
 			}
 		}

package/src/skill-registry.ts

@@ -44,9 +44,9 @@ export interface DiscoverSkillsOptions {
 }
 
 export async function discoverSkills(options: DiscoverSkillsOptions): Promise<SkillEntry[]> {
-	// Project trust comes from the caller's trust check; generated settings
-	// carry defaultProjectTrust: "never", so discovery is the only place
-	// project resources can enter a plan.
+	// Project trust comes from the caller's trust check: discovery is the only
+	// place project resources enter a plan's reference vocabulary (their
+	// visibility in the session is Pi's, not the plan's).
 	const settingsManager = SettingsManager.create(options.cwd, options.agentDir, {
 		projectTrusted: options.projectTrusted ?? false,
 	});
@@ -73,10 +73,10 @@ export async function discoverSkills(options: DiscoverSkillsOptions): Promise<Sk
 		else process.env.PI_OFFLINE = savedOffline;
 	}
 	return loader.getSkills().skills.flatMap((skill) => {
-		// Project-scoped package skills are excluded: their packages install
-		// under the project's .pi/npm, which generated global-scope settings
-		// cannot reference. Project .pi/skills and ancestor .agents/skills are
-		// unaffected. (Limitation documented in ticket 03's comments.)
+		// Project-scoped package skills stay out of the reference vocabulary:
+		// their packages live under the project's .pi/npm and Pi discovers their
+		// skills natively, so a profile reference would add nothing. Project
+		// .pi/skills and ancestor .agents/skills are referenceable.
 		if (skill.sourceInfo.origin === "package" && skill.sourceInfo.scope === "project") {
 			return [];
 		}

package/src/switching/switch-profile.ts

@@ -204,7 +204,6 @@ export async function switchProfile(
 		agentDir: deps.realAgentDir,
 		projectDir: resolved.projectDir,
 		discovery: resolved.discovery,
-		projectSettings: resolved.projectSettings,
 		planExtras: {
 			...(isSwitch && current.profile !== undefined ? { switchedFrom: current.profile } : {}),
 			// `/profile use` persists; `/profile reload` keeps the current