pi-profile-switch 0.9.2 → 0.11.0

package/src/profile-resolver.ts

@@ -67,6 +67,10 @@ export interface ActivationPlan {
 	extensions: Array<{ id: string; entry: string; origin?: "package" | "local" | "path" }>;
 	/** Expanded tool allowlist; undefined when the profile declares no tools. */
 	tools?: string[];
+	/** Overlay tool disable entries (names or globs, verbatim); undefined
+	 *  when the overlay disables no tools. The session-start application
+	 *  subtracts their live matches from the base expansion. */
+	disabledTools?: string[];
 	/** The raw tool references (globs included) for extension-side expansion
 	 *  against Pi's live tool registry, which includes extension-provided
 	 *  tools the pre-spawn expansion cannot know. Set iff `tools` is set. */
@@ -114,12 +118,54 @@ export interface ResolveInput {
 	 * any resolved reference may be narrowed or disabled.
 	 */
 	overlay?: RuntimeOverlay;
+	/**
+	 * Pi's live tool names (`pi.getAllTools()`), supplied by the in-session
+	 * switch path. Required when the overlay disables tools on a profile
+	 * without declared `tools` — the live registry is then the base set the
+	 * entries disable from. The launcher never passes an overlay, so it never
+	 * needs this.
+	 */
+	liveToolNames?: string[];
 }
 
 function isGlob(reference: string): boolean {
 	return reference.includes("*") || reference.includes("?");
 }
 
+/** Expands overlay disable entries against the names the profile resolved.
+ *  Entries are names or globs stored as written, re-expanded at every
+ *  resolution with the same matcher as profile references (ADR-0009 tiering):
+ *  an unmatched literal fails and identifies the entry; a zero-match glob is
+ *  reported through `onZeroMatch` instead of failing. Returns the resolved
+ *  names to disable. */
+function expandDisableEntries(
+	entries: string[],
+	activeNames: readonly string[],
+	kind: string,
+	profileName: string,
+	onZeroMatch: (entry: string) => void,
+): Set<string> {
+	const disabled = new Set<string>();
+	for (const entry of entries) {
+		if (isGlob(entry)) {
+			let matched = 0;
+			for (const name of activeNames) {
+				if (minimatch(name, entry)) {
+					disabled.add(name);
+					matched += 1;
+				}
+			}
+			if (matched === 0) onZeroMatch(entry);
+			continue;
+		}
+		if (!activeNames.includes(entry)) {
+			throw new ActivationError(`profile "${profileName}": overlay disables unknown ${kind} "${entry}"`);
+		}
+		disabled.add(entry);
+	}
+	return disabled;
+}
+
 /** Expands one reference list against a named universe. Literal misses fail
  *  when `literalMustExist`; globs expand to zero or more matches, and a
  *  zero-match glob is reported through `onZeroMatch`. */
@@ -195,42 +241,48 @@ export async function resolveProfile(input: ResolveInput): Promise<ActivationPla
 	);
 
 	// --- overlay narrowing (ticket 06) ---
-	// Overlay references must name resources the profile actually resolves
-	// (typos fail loudly). Overlays can disable any resolved extension.
-	let toolReferences = definition.tools;
+	// Overlay disable entries are names or globs stored as written and
+	// re-expanded at every resolution; unmatched literals fail and identify
+	// the entry, zero-match globs join `unmatched` with an `overlay ` prefix.
+	// Overlays can disable any resolved extension.
+	const toolReferences = definition.tools;
 	if (overlay !== undefined) {
 		if (overlay.disabledSkills !== undefined && overlay.disabledSkills.length > 0) {
-			const active = new Set(selectedSkills.map((skill) => skill.name));
-			for (const name of overlay.disabledSkills) {
-				if (!active.has(name)) {
-					throw new ActivationError(`profile "${profile.name}": overlay disables unknown skill "${name}"`);
-				}
-			}
-			const disabled = new Set(overlay.disabledSkills);
+			const disabled = expandDisableEntries(
+				overlay.disabledSkills,
+				selectedSkills.map((skill) => skill.name),
+				"skill",
+				profile.name,
+				(entry) => unmatched.push(`overlay skill:${entry}`),
+			);
 			selectedSkills = selectedSkills.filter((skill) => !disabled.has(skill.name));
 		}
 		if (overlay.disabledExtensions !== undefined && overlay.disabledExtensions.length > 0) {
-			const activeIds = new Set(planExtensions.map((entry) => entry.id));
-			for (const id of overlay.disabledExtensions) {
-				if (!activeIds.has(id)) {
-					throw new ActivationError(`profile "${profile.name}": overlay disables unknown extension "${id}"`);
-				}
-			}
-			const disabled = new Set(overlay.disabledExtensions);
+			const disabled = expandDisableEntries(
+				overlay.disabledExtensions,
+				planExtensions.map((entry) => entry.id),
+				"extension",
+				profile.name,
+				(entry) => unmatched.push(`overlay extension:${entry}`),
+			);
 			planExtensions = planExtensions.filter((entry) => !disabled.has(entry.id));
 		}
 		if (overlay.disabledMcps !== undefined && overlay.disabledMcps.length > 0) {
-			const active = new Set(mcps ?? []);
-			for (const name of overlay.disabledMcps) {
-				if (!active.has(name)) {
-					throw new ActivationError(`profile "${profile.name}": overlay disables unknown MCP server "${name}"`);
-				}
+			const active = mcps ?? [];
+			const disabled = expandDisableEntries(
+				overlay.disabledMcps,
+				active,
+				"MCP server",
+				profile.name,
+				(entry) => unmatched.push(`overlay mcp:${entry}`),
+			);
+			// A profile that declared no `mcps` has no MCP restriction; overlay
+			// narrowing must not turn that into an empty whitelist. Literals
+			// still fail and zero-match globs still warn — the expansion above
+			// runs either way — only the reassignment is guarded.
+			if (mcps !== undefined) {
+				mcps = active.filter((name) => !disabled.has(name));
 			}
-			const disabled = new Set(overlay.disabledMcps);
-			mcps = (mcps ?? []).filter((name) => !disabled.has(name));
-		}
-		if (overlay.tools !== undefined) {
-			toolReferences = overlay.tools;
 		}
 	}
 
@@ -241,6 +293,40 @@ export async function resolveProfile(input: ResolveInput): Promise<ActivationPla
 		});
 	}
 
+	// Tool disable entries join the uniform grammar: the base set is the
+	// profile's resolved tool references when declared (expanded against the
+	// live registry, which the in-session switch path always supplies) and
+	// the live registry itself when the profile declares no tools. The
+	// plan carries the entries verbatim; session-start application subtracts
+	// their live matches from the base expansion at that moment.
+	let disabledTools: string[] | undefined;
+	if (overlay?.disabledTools !== undefined && overlay.disabledTools.length > 0) {
+		if (input.liveToolNames === undefined) {
+			throw new ActivationError(
+				`profile "${profile.name}": overlay disables tools but no live tool registry is available`,
+			);
+		}
+		const base =
+			toolReferences !== undefined
+				? expandReferences(toolReferences, input.liveToolNames, (name) => name, "tool", {
+						literalMustExist: false,
+					})
+				: input.liveToolNames;
+		const disabled = expandDisableEntries(
+			overlay.disabledTools,
+			base,
+			"tool",
+			profile.name,
+			(entry) => unmatched.push(`overlay tool:${entry}`),
+		);
+		disabledTools = [...overlay.disabledTools];
+		// The pre-computed boot baseline additionally subtracts the disabled
+		// matches (a no-op for tools only the live registry knows).
+		if (tools !== undefined) {
+			tools = tools.filter((name) => !disabled.has(name));
+		}
+	}
+
 	let model: ProfileModel | undefined;
 	const declaredModel = extractModel(definition);
 	if (declaredModel !== undefined) {
@@ -267,6 +353,7 @@ export async function resolveProfile(input: ResolveInput): Promise<ActivationPla
 		skills: selectedSkills,
 		extensions: planExtensions.map((entry) => ({ id: entry.id, entry: entry.entry })),
 		...(tools !== undefined && toolReferences !== undefined ? { tools, toolReferences: [...toolReferences] } : {}),
+		...(disabledTools !== undefined ? { disabledTools } : {}),
 		...(model !== undefined ? { model } : {}),
 		...(definition.instructions !== undefined ? { instructions: definition.instructions } : {}),
 		...(mcps !== undefined ? { mcps } : {}),

package/src/runtime-state-store.ts

@@ -32,14 +32,13 @@ export interface RuntimeOverlay {
 	disabledSkills?: string[];
 	disabledExtensions?: string[];
 	disabledMcps?: string[];
-	/** Replaces the profile's tool references when set. */
-	tools?: string[];
+	disabledTools?: string[];
 }
 
 function parseOverlay(value: unknown): RuntimeOverlay | undefined {
 	if (!isRecord(value)) return undefined;
 	const overlay: RuntimeOverlay = {};
-	for (const key of ["disabledSkills", "disabledExtensions", "disabledMcps", "tools"] as const) {
+	for (const key of ["disabledSkills", "disabledExtensions", "disabledMcps", "disabledTools"] as const) {
 		const list = value[key];
 		if (Array.isArray(list) && list.every((entry) => typeof entry === "string")) {
 			overlay[key] = list;
@@ -77,7 +76,7 @@ export class RuntimeStateStore {
 	}
 
 	/** Read-modify-write merge. A field set to `undefined` is deleted; absent
-	 *  fields keep their stored value. Used by the switch/customize paths so
+	 *  fields keep their stored value. Used by the switch/overlay paths so
 	 *  one concern (selection, anchor, overlay) never clobbers another. */
 	async update(patch: Partial<RuntimeState>): Promise<RuntimeState> {
 		const current = await this.read();

package/src/settings-generator.ts

@@ -401,6 +401,7 @@ export async function writeRuntimeFiles(
 				agentDir: options.agentDir,
 				...(plan.tools !== undefined ? { tools: plan.tools } : {}),
 				...(plan.toolReferences !== undefined ? { toolReferences: plan.toolReferences } : {}),
+				...(plan.disabledTools !== undefined ? { disabledTools: plan.disabledTools } : {}),
 				...(plan.mcps !== undefined ? { mcps: plan.mcps } : {}),
 				// The resolved sets feed /profile status (absolute paths) and the
 				// glob-delta diff against the previous activation.