feat: Profiles v2 T5 — tray profile switcher (Go + Swift) + active_profile SSE (MCP-3244) (#767)

* feat(profiles): emit active_profile.changed SSE event on default switch (MCP-3244)

Backend half of the tray profile switcher (Profiles v2 T5). PUT
/api/v1/profiles/active now broadcasts an active_profile.changed runtime
event on an actual change, so UI surfaces (Web UI, tray) refetch and
reflect a default-profile switch made by another client.

Emitted via an optional capability assertion in the httpapi handler so
ServerController is not widened (no mock fan-out).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* feat(tray): Go tray profile switcher submenu (MCP-3244)

Profiles v2 T5 for the cross-platform Go systray tray (macOS/Windows/Linux).

- Adds a 'Profile' submenu listing 'All servers' + each configured profile
  with tool counts; the active profile is checkmarked. Clicking switches the
  server-level default active profile via PUT /api/v1/profiles/active.
- ServerInterface gains GetProfiles/GetActiveProfile/SetActiveProfile; the
  REST ServerAdapter forwards them to the api.Client (new GetProfiles,
  GetActiveProfile, SetActiveProfile; makeRequest is now body-capable for the
  PUT). ProfileInfo lives in a build-tag-free file for stub/linux builds.
- The submenu refreshes on the existing 3s sync loop, so an active-profile
  switch made by another client (Web UI, CLI) is reflected within one interval
  — consistent with how the REST-adapter tray already reflects server/quarantine
  changes (its EventsChannel is nil; it does not proxy runtime events). The
  Swift macOS tray gets the real-time active_profile.changed SSE wiring.
- Tests: profileMenuTitle/profileSetChanged helpers, performSync profile
  refresh, ServerAdapter profile delegation. Cross-builds darwin/windows/linux.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* feat(macos-tray): Swift profile switcher submenu via SSE (MCP-3244)

Profiles v2 T5 for the native macOS (AppKit) tray.

- AppKit rebuildMenu gains a 'Profile' submenu (shown when profiles are
  configured): 'All servers' (clears the profile) + each profile with tool
  count; the active selection is checkmarked. switchProfile sets the
  server-level default via PUT /api/v1/profiles/active.
- APIClient: profiles(), activeProfile(), setActiveProfile(); AppState gains
  profiles + activeProfile; new ProfileSummary/ProfilesListResponse/
  ActiveProfileResponse models match the Go REST wire shape.
- Real-time reflection: CoreProcessManager.refreshProfiles runs on connect,
  on the periodic refresh, and on the new active_profile.changed SSE event, so
  a switch from any client (Web UI, CLI, Go tray) repaints the macOS submenu.
- Tests: ProfileModelsTests (decode + Equatable). swift build + swift test green.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>

Author: Dumbris

cmd/mcpproxy-tray/internal/api/adapter.go

@@ -8,6 +8,7 @@ import (
 	"runtime"
 
 	internalRuntime "github.com/smart-mcp-proxy/mcpproxy-go/internal/runtime"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/tray"
 )
 
 // ClientInterface defines the methods required by ServerAdapter from the API client.
@@ -20,6 +21,9 @@ type ClientInterface interface {
 	UnquarantineServer(serverName string) error
 	TriggerOAuthLogin(serverName string) error
 	StatusChannel() <-chan StatusUpdate
+	GetProfiles() ([]tray.ProfileInfo, error)
+	GetActiveProfile() (string, error)
+	SetActiveProfile(name string) error
 }
 
 // isServerHealthy returns true if the server is considered healthy.
@@ -122,7 +126,7 @@ func (a *ServerAdapter) GetStatus() interface{} {
 
 	// Fallback to empty if we couldn't get it
 	if listenAddr == "" {
-		listenAddr = ""  // Empty means tray will show "Status: Running" without address
+		listenAddr = "" // Empty means tray will show "Status: Running" without address
 	}
 
 	servers, serverErr := a.client.GetServers()
@@ -186,6 +190,21 @@ func (a *ServerAdapter) EventsChannel() <-chan internalRuntime.Event {
 	return nil
 }
 
+// GetProfiles returns the configured profiles for the tray switcher (Profiles v2 T5).
+func (a *ServerAdapter) GetProfiles() ([]tray.ProfileInfo, error) {
+	return a.client.GetProfiles()
+}
+
+// GetActiveProfile returns the server-level default active profile (empty = all servers).
+func (a *ServerAdapter) GetActiveProfile() (string, error) {
+	return a.client.GetActiveProfile()
+}
+
+// SetActiveProfile sets the server-level default active profile (empty clears it).
+func (a *ServerAdapter) SetActiveProfile(name string) error {
+	return a.client.SetActiveProfile(name)
+}
+
 // GetQuarantinedServers returns quarantined servers
 func (a *ServerAdapter) GetQuarantinedServers() ([]map[string]interface{}, error) {
 	servers, err := a.client.GetServers()

cmd/mcpproxy-tray/internal/api/adapter_test.go

@@ -6,6 +6,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/tray"
 )
 
 // =============================================================================
@@ -21,11 +23,13 @@ type MockClient struct {
 	enableErr            error
 	quarantineErr        error
 	oauthErr             error
-	enabledServers       map[string]bool   // tracks enable/disable calls
-	quarantinedServers   map[string]bool   // tracks quarantine calls
-	unquarantinedServers []string          // tracks unquarantine calls
-	oauthTriggered       []string          // tracks OAuth login calls
+	enabledServers       map[string]bool // tracks enable/disable calls
+	quarantinedServers   map[string]bool // tracks quarantine calls
+	unquarantinedServers []string        // tracks unquarantine calls
+	oauthTriggered       []string        // tracks OAuth login calls
 	statusCh             chan StatusUpdate
+	profiles             []tray.ProfileInfo // Profiles v2 T5
+	activeProfile        string             // Profiles v2 T5
 }
 
 func NewMockClient() *MockClient {
@@ -87,6 +91,46 @@ func (m *MockClient) StatusChannel() <-chan StatusUpdate {
 	return m.statusCh
 }
 
+func (m *MockClient) GetProfiles() ([]tray.ProfileInfo, error) {
+	return m.profiles, nil
+}
+
+func (m *MockClient) GetActiveProfile() (string, error) {
+	return m.activeProfile, nil
+}
+
+func (m *MockClient) SetActiveProfile(name string) error {
+	m.activeProfile = name
+	return nil
+}
+
+// TestServerAdapterProfileDelegation verifies the adapter forwards the profile
+// switcher calls (Profiles v2 T5) to the underlying client.
+func TestServerAdapterProfileDelegation(t *testing.T) {
+	mock := NewMockClient()
+	mock.profiles = []tray.ProfileInfo{
+		{Name: "research", ToolCount: 3},
+		{Name: "deploy", ToolCount: 2},
+	}
+	mock.activeProfile = "research"
+	adapter := NewServerAdapter(mock)
+
+	profiles, err := adapter.GetProfiles()
+	require.NoError(t, err)
+	require.Len(t, profiles, 2)
+	assert.Equal(t, "research", profiles[0].Name)
+	assert.Equal(t, 3, profiles[0].ToolCount)
+
+	active, err := adapter.GetActiveProfile()
+	require.NoError(t, err)
+	assert.Equal(t, "research", active)
+
+	require.NoError(t, adapter.SetActiveProfile("deploy"))
+	active, err = adapter.GetActiveProfile()
+	require.NoError(t, err)
+	assert.Equal(t, "deploy", active)
+}
+
 // =============================================================================
 // isServerHealthy Unit Tests
 // =============================================================================

cmd/mcpproxy-tray/internal/api/client.go

@@ -2,12 +2,14 @@ package api
 
 import (
 	"bufio"
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"net/url"
 	"os"
@@ -638,6 +640,63 @@ func (c *Client) TriggerOAuthLogin(serverName string) error {
 	return nil
 }
 
+// GetProfiles fetches the configured profiles (Profiles v2 T5) from
+// GET /api/v1/profiles for the tray profile switcher.
+func (c *Client) GetProfiles() ([]tray.ProfileInfo, error) {
+	resp, err := c.makeRequest("GET", "/api/v1/profiles", nil)
+	if err != nil {
+		return nil, err
+	}
+	if !resp.Success {
+		return nil, fmt.Errorf("API error: %s", resp.Error)
+	}
+
+	raw, ok := resp.Data["profiles"].([]interface{})
+	if !ok {
+		// No profiles configured is a valid, empty result.
+		return nil, nil
+	}
+
+	var result []tray.ProfileInfo
+	for _, p := range raw {
+		pm, ok := p.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		result = append(result, tray.ProfileInfo{
+			Name:      getString(pm, "name"),
+			ToolCount: getInt(pm, "tool_count"),
+		})
+	}
+	return result, nil
+}
+
+// GetActiveProfile fetches the server-level default active profile from
+// GET /api/v1/profiles/active. An empty string means "all servers".
+func (c *Client) GetActiveProfile() (string, error) {
+	resp, err := c.makeRequest("GET", "/api/v1/profiles/active", nil)
+	if err != nil {
+		return "", err
+	}
+	if !resp.Success {
+		return "", fmt.Errorf("API error: %s", resp.Error)
+	}
+	return getString(resp.Data, "active_profile"), nil
+}
+
+// SetActiveProfile sets the server-level default active profile via
+// PUT /api/v1/profiles/active. An empty name clears the selection (all servers).
+func (c *Client) SetActiveProfile(name string) error {
+	resp, err := c.makeRequest("PUT", "/api/v1/profiles/active", map[string]string{"profile": name})
+	if err != nil {
+		return err
+	}
+	if !resp.Success {
+		return fmt.Errorf("API error: %s", resp.Error)
+	}
+	return nil
+}
+
 // GetServerTools gets tools for a specific server
 func (c *Client) GetServerTools(serverName string) ([]Tool, error) {
 	endpoint := fmt.Sprintf("/api/v1/servers/%s/tools", serverName)
@@ -887,17 +946,32 @@ func (c *Client) OpenWebUI() error {
 	}
 }
 
-// makeRequest makes an HTTP request to the API with enhanced error handling and retry logic
-func (c *Client) makeRequest(method, path string, _ interface{}) (*Response, error) {
+// makeRequest makes an HTTP request to the API with enhanced error handling and retry logic.
+// When body is non-nil it is JSON-encoded and sent as the request payload (e.g. PUT bodies);
+// nil yields a bodyless request, preserving every existing call site.
+func (c *Client) makeRequest(method, path string, body interface{}) (*Response, error) {
 	url, err := c.buildURL(path)
 	if err != nil {
 		return nil, err
 	}
 	maxRetries := 3
 	baseDelay := 1 * time.Second
 
+	var bodyBytes []byte
+	if body != nil {
+		bodyBytes, err = json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal request body: %w", err)
+		}
+	}
+
 	for attempt := 1; attempt <= maxRetries; attempt++ {
-		req, err := http.NewRequest(method, url, http.NoBody)
+		// Recreate the reader each attempt so retries resend the full body.
+		var bodyReader io.Reader = http.NoBody
+		if bodyBytes != nil {
+			bodyReader = bytes.NewReader(bodyBytes)
+		}
+		req, err := http.NewRequest(method, url, bodyReader)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create request: %w", err)
 		}

internal/httpapi/profiles.go

@@ -147,9 +147,19 @@ func (s *Server) handleSetActiveProfile(w http.ResponseWriter, r *http.Request)
 	}
 
 	s.activeProfileMu.Lock()
+	changed := s.activeProfile != slug
 	s.activeProfile = slug
 	s.activeProfileMu.Unlock()
 
+	// Notify other clients (Web UI, tray) via SSE only on an actual change, so a
+	// switch made here is reflected everywhere (Profiles v2 T5). Emitted through
+	// an optional capability assertion to avoid widening ServerController.
+	if changed {
+		if emitter, ok := s.controller.(interface{ EmitActiveProfileChanged(string) }); ok {
+			emitter.EmitActiveProfileChanged(slug)
+		}
+	}
+
 	s.getRequestLogger(r).Infow("default active profile updated", "profile", slug)
 	s.writeSuccess(w, map[string]interface{}{"active_profile": slug})
 }

internal/httpapi/profiles_test.go

@@ -131,3 +131,50 @@ func TestHandleSetActiveProfileBadBody(t *testing.T) {
 	w, _ := doJSON(t, srv, http.MethodPut, "/api/v1/profiles/active", []byte(`not json`))
 	require.Equal(t, http.StatusBadRequest, w.Code)
 }
+
+// profileEventRecorder records EmitActiveProfileChanged calls so we can assert
+// the handler notifies other clients (via SSE) only on an actual change.
+type profileEventRecorder struct {
+	mockProfilesController
+	emitted []string
+}
+
+func (m *profileEventRecorder) EmitActiveProfileChanged(profile string) {
+	m.emitted = append(m.emitted, profile)
+}
+
+func TestSetActiveProfileEmitsChangeEvent(t *testing.T) {
+	cfg := &config.Config{
+		APIKey: "test-key",
+		Servers: []*config.ServerConfig{
+			{Name: "research-srv"},
+			{Name: "deploy-srv"},
+		},
+		Profiles: []config.ProfileConfig{
+			{Name: "research", Servers: []string{"research-srv"}},
+			{Name: "deploy", Servers: []string{"deploy-srv"}},
+		},
+	}
+	rec := &profileEventRecorder{mockProfilesController: mockProfilesController{apiKey: "test-key", cfg: cfg}}
+	srv := NewServer(rec, zap.NewNop().Sugar(), nil)
+
+	// Setting a new profile emits one change event.
+	w, _ := doJSON(t, srv, http.MethodPut, "/api/v1/profiles/active", []byte(`{"profile":"research"}`))
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, []string{"research"}, rec.emitted)
+
+	// Setting the same profile again is a no-op — no duplicate event.
+	w, _ = doJSON(t, srv, http.MethodPut, "/api/v1/profiles/active", []byte(`{"profile":"research"}`))
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, []string{"research"}, rec.emitted)
+
+	// Clearing emits an empty-string change event.
+	w, _ = doJSON(t, srv, http.MethodPut, "/api/v1/profiles/active", []byte(`{"profile":""}`))
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Equal(t, []string{"research", ""}, rec.emitted)
+
+	// A rejected (unknown) profile emits nothing.
+	w, _ = doJSON(t, srv, http.MethodPut, "/api/v1/profiles/active", []byte(`{"profile":"ghost"}`))
+	require.Equal(t, http.StatusNotFound, w.Code)
+	require.Equal(t, []string{"research", ""}, rec.emitted)
+}

internal/runtime/event_bus.go

@@ -353,6 +353,15 @@ func (r *Runtime) emitSecretsChanged(operation string, secretName string, extra
 	r.publishEvent(newEvent(EventTypeSecretsChanged, payload))
 }
 
+// EmitActiveProfileChanged emits an event when the server-level default active
+// profile changes (Profiles v2). UI surfaces subscribe and refetch
+// GET /api/v1/profiles/active so a switch made by one client (Web UI, tray, CLI)
+// is reflected everywhere. An empty profile means "all servers".
+func (r *Runtime) EmitActiveProfileChanged(profile string) {
+	payload := map[string]any{"active_profile": profile}
+	r.publishEvent(newEvent(EventTypeActiveProfileChanged, payload))
+}
+
 // EmitOAuthTokenRefreshed emits an event when proactive token refresh succeeds.
 // This is used by the RefreshManager to notify subscribers of successful token refresh.
 func (r *Runtime) EmitOAuthTokenRefreshed(serverName string, expiresAt time.Time) {

internal/runtime/events.go

@@ -14,6 +14,10 @@ const (
 	EventTypeConfigSaved EventType = "config.saved"
 	// EventTypeSecretsChanged is emitted when secrets are added, updated, or deleted.
 	EventTypeSecretsChanged EventType = "secrets.changed"
+	// EventTypeActiveProfileChanged is emitted when the server-level default
+	// active profile changes (Profiles v2). UI surfaces (Web UI, tray) refetch
+	// GET /api/v1/profiles/active to reflect a switch made by another client.
+	EventTypeActiveProfileChanged EventType = "active_profile.changed"
 	// EventTypeOAuthTokenRefreshed is emitted when proactive token refresh succeeds.
 	EventTypeOAuthTokenRefreshed EventType = "oauth.token_refreshed"
 	// EventTypeOAuthRefreshFailed is emitted when proactive token refresh fails after retries.

internal/server/server.go

@@ -2593,6 +2593,15 @@ func (s *Server) NotifySecretsChanged(ctx context.Context, operation, secretName
 	return s.runtime.NotifySecretsChanged(ctx, operation, secretName)
 }
 
+// EmitActiveProfileChanged broadcasts an active_profile.changed event so UI
+// surfaces (Web UI, tray) reflect a default-profile switch made by another
+// client (Profiles v2 T2/T5). The REST handler invokes this via an optional
+// capability assertion, so adding it here does not widen the httpapi
+// ServerController interface.
+func (s *Server) EmitActiveProfileChanged(profile string) {
+	s.runtime.EmitActiveProfileChanged(profile)
+}
+
 // GetCurrentConfig returns the current configuration
 func (s *Server) GetCurrentConfig() interface{} {
 	return s.runtime.GetCurrentConfig()