@alphacoder-v0/pi-loops 0.22.8 → 0.24.0

package/src/mcp-pool.ts

@@ -2,8 +2,8 @@
  * Project-level MCP servers for runs outside this process's own project.
  *
  * A pi process loads `<its cwd>/.pi/mcp.toml` once and shares those clients. But a loop belongs to
- * a project, not to whichever pi owns the clock: a job in project B run by a pi open in project A
- * used to get A's servers and never B's, and the headless host (no project at all) got none. A
+ * a project, not to the process that runs it: a job in project B run by a pi open in project A
+ * used to get A's servers and never B's, and the host (no project at all) gets none of its own. A
  * single-project process never has this problem — one process, one cwd, one project; this pool is
  * what gives a run its own project's servers when the two differ. It connects a project's servers
  * lazily, keyed by directory, and hands their tools to runs in that directory.
@@ -11,7 +11,8 @@
  * User-level servers are not pooled: those are shared and already connected by the process.
  */
 import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
-import { McpSource, loadProjectMcpConfig, mcpToolDefinitions } from "./mcp.ts";
+import { McpSource, loadProjectMcpConfig, mcpToolDefinitions, type McpNotification, type McpServerConfig } from "./mcp.ts";
+import { realpathish } from "./paths.ts";
 import { previewRedacted } from "./redact.ts";
 
 export interface McpPoolOptions {
@@ -20,6 +21,12 @@ export interface McpPoolOptions {
 	/** Where an untrusted project or a failed connection is reported (one line, not one per run). */
 	log?: (message: string) => void;
 	resolveToken?: (ref: string) => string | undefined;
+	/**
+	 * A push from a project's server. The host passes this: a project's rules are evaluated by the
+	 * host alone, so a project-level push server has to reach it (a window drops rule-evaluated
+	 * pushes). Without it the pool only lends tools.
+	 */
+	onNotification?: (cwd: string, cfg: McpServerConfig, notification: McpNotification, source: McpSource) => void;
 }
 
 interface Entry {
@@ -27,6 +34,10 @@ interface Entry {
 	defs: Array<{ name: string; def: ToolDefinition<any, any>; server: string }>;
 	ready: Promise<void>;
 	lastUsed: number;
+	/** Kept connected for its pushes by `watch`, not only lent to a run. */
+	watched?: boolean;
+	/** Connected for a held turn on its owner's trust, not on saved trust for this exact directory. */
+	byOwner?: boolean;
 }
 
 /** Projects kept connected at once; the least recently used is dropped past this. */
@@ -36,6 +47,7 @@ export class McpPool {
 	private readonly entries = new Map<string, Entry>();
 	/** Projects we already said were untrusted: say it once, not once per run. */
 	private readonly warned = new Set<string>();
+	private warnedOverCap = false;
 	private readonly opts: McpPoolOptions;
 	constructor(opts: McpPoolOptions) {
 		this.opts = opts;
@@ -46,13 +58,17 @@ export class McpPool {
 	 * `taken` is the tool names already in use for that run (built-ins, user-level MCP tools, the
 	 * automation tools), so a project's server cannot shadow one of them.
 	 */
-	async toolsFor(cwd: string, taken: Set<string>): Promise<ToolDefinition<any, any>[]> {
+	async toolsFor(cwd: string, taken: Set<string>, trusted?: boolean): Promise<ToolDefinition<any, any>[]> {
 		if (!cwd) return [];
 		// Trust is re-checked every time: a decision the user revoked must stop lending servers,
-		// not keep the ones an earlier run happened to connect.
-		if (!this.opts.isTrusted(cwd)) {
+		// not keep the ones an earlier run happened to connect. `trusted` is a held turn's: pi's own
+		// saved decision for its conversation's directory or a parent, which its caller read just now.
+		const exact = this.opts.isTrusted(cwd);
+		if (!trusted && !exact) {
 			const stale = this.entries.get(cwd);
-			if (stale) {
+			// A loop's run (no `trusted` at all) does not take away servers a held turn connected on its
+			// owner's trust; a held turn whose owner no longer trusts the directory (`false`) does.
+			if (stale && (!stale.byOwner || trusted === false)) {
 				this.entries.delete(cwd);
 				void Promise.all(stale.sources.map((s) => s.stop())).catch(() => undefined);
 			}
@@ -62,7 +78,8 @@ export class McpPool {
 			}
 			return [];
 		}
-		const entry = this.entries.get(cwd) ?? this.connect(cwd);
+		const entry = this.entries.get(cwd) ?? this.connect(cwd, !exact);
+		if (exact) entry.byOwner = false;
 		entry.lastUsed = Date.now();
 		await entry.ready;
 		// Names are settled per run: a project tool that collides with a built-in or a user-level
@@ -81,8 +98,8 @@ export class McpPool {
 		return out;
 	}
 
-	private connect(cwd: string): Entry {
-		const entry: Entry = { sources: [], defs: [], ready: Promise.resolve(), lastUsed: Date.now() };
+	private connect(cwd: string, byOwner = false): Entry {
+		const entry: Entry = { sources: [], defs: [], ready: Promise.resolve(), lastUsed: Date.now(), byOwner };
 		this.warned.delete(cwd);
 		this.evictIfFull();
 		this.entries.set(cwd, entry);
@@ -106,9 +123,9 @@ export class McpPool {
 						settle();
 					}
 				},
-				// A project server's pushes belong to the process that owns that project's rules;
-				// the pool exists to lend tools to a run, not to open a second notification path.
-				onNotification: () => undefined,
+				onNotification: (n) => {
+					if (this.accepts(cwd)) this.opts.onNotification?.(cwd, cfg, n, source);
+				},
 				resolveToken: this.opts.resolveToken,
 				log: (msg) => this.opts.log?.(`mcp ${cfg.name} (${cwd}): ${previewRedacted(msg, 200)}`),
 			});
@@ -122,10 +139,45 @@ export class McpPool {
 		return entry;
 	}
 
+	/**
+	 * Keep these projects' servers connected for their pushes: the projects with enabled rules. Each
+	 * one is re-checked against trust here, the way a run's lookup is; one already connected is only
+	 * marked as recently used, and the pool's bound still applies.
+	 */
+	watch(cwds: readonly string[]): void {
+		if (!this.opts.onNotification) return;
+		// One spelling per project (a trailing slash, a symlink): otherwise each got its own servers.
+		const wanted = [...new Set(cwds.filter(Boolean).map((cwd) => realpathish(cwd)))].filter((cwd) => this.opts.isTrusted(cwd)).sort();
+		if (wanted.length > MAX_POOLED_PROJECTS && !this.warnedOverCap) {
+			this.warnedOverCap = true;
+			this.opts.log?.(`${wanted.length} projects have rules and push servers; only the first ${MAX_POOLED_PROJECTS} are kept connected`);
+		}
+		const keep = new Set(wanted.slice(0, MAX_POOLED_PROJECTS));
+		// What `watch` opened and is no longer wanted (trust revoked, rules removed) is stopped: a
+		// project's server must not keep running in the host, pushing into rule checks, once nothing asks for it.
+		for (const [cwd, entry] of [...this.entries]) {
+			if (!entry.watched || keep.has(cwd)) continue;
+			this.entries.delete(cwd);
+			void Promise.all(entry.sources.map((s) => s.stop())).catch(() => undefined);
+		}
+		for (const cwd of keep) {
+			const entry = this.entries.get(cwd) ?? this.connect(cwd);
+			entry.watched = true;
+			entry.lastUsed = Date.now();
+		}
+	}
+
+	/** Whether a push from `cwd`'s servers should still be acted on: trust is checked again at arrival. */
+	accepts(cwd: string): boolean {
+		return this.opts.isTrusted(cwd);
+	}
+
 	/** Keep the pool bounded: one loop per project on a busy machine must not pin every project. */
 	private evictIfFull(): void {
 		while (this.entries.size >= MAX_POOLED_PROJECTS) {
-			const oldest = [...this.entries.entries()].sort((a, b) => a[1].lastUsed - b[1].lastUsed)[0];
+			// Lent-only connections go first: dropping a watched one only for `watch` to reconnect it a
+			// minute later churned every project's servers once the pool was full.
+			const oldest = [...this.entries.entries()].sort((a, b) => Number(!!a[1].watched) - Number(!!b[1].watched) || a[1].lastUsed - b[1].lastUsed)[0];
 			if (!oldest) return;
 			this.entries.delete(oldest[0]);
 			this.opts.log?.(`disconnected ${oldest[0]}'s MCP servers (pool limit ${MAX_POOLED_PROJECTS})`);

package/src/mcp.ts

@@ -828,7 +828,7 @@ export function loadMcpConfigFiles(opts: { dir: string; cwd?: string; projectTru
 		const projectFile = findProjectMcpConfig(opts.cwd);
 		if (projectFile) {
 			if (opts.projectTrusted) project = read(projectFile, "project");
-			else diagnostics.push(`project MCP config ignored at ${projectFile}: project is not trusted (pi --approve, or trust it when prompted)`);
+			else diagnostics.push(`project MCP config ignored at ${projectFile}: project is not trusted (run /trust and restart pi, or start pi with --approve)`);
 		}
 	}
 	return { servers: mergeMcpConfigs(user, project), diagnostics };

package/src/open-file.ts

@@ -0,0 +1,54 @@
+/**
+ * The file `pi-loops` opens the browser on. A one-shot open key in a URL on the opener's command
+ * line is readable by every user on the machine (`/proc/<pid>/cmdline`), and whoever loads it first
+ * gets the page with the token. So the key goes into a file only this user can read, the browser is
+ * opened on that file's path, and the file sends it on to the keyed address. The background process
+ * writes the file, because it is the one that sees the key spent: it removes the file then, or after
+ * a minute, whichever comes first, and removes any left over when it starts.
+ */
+
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+/** Where the files are: a directory of their own, mode 0700, under `pages/`. */
+export function openFileDir(loopsDir: string): string {
+	return path.join(loopsDir, "pages", "open");
+}
+
+/** The page that sends a browser on to `url`, with nothing else in it. */
+export function openFileHtml(url: string): string {
+	// One navigation, never two: the key opens one load, so a refresh racing the script would meet
+	// a spent key. The refresh is for a browser that runs no script.
+	const attr = url.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+	// JSON.stringify leaves "</script>" alone; escaping "<" keeps the address from ending the script.
+	const js = JSON.stringify(url).replace(/</g, "\\u003c");
+	return `<!doctype html>
+<html><head><meta charset="utf-8"><meta name="referrer" content="no-referrer">
+<noscript><meta http-equiv="refresh" content="0;url=${attr}"></noscript>
+<title>pi-loops</title></head>
+<body><script>location.replace(${js})</script><a href="${attr}">Open pi-loops</a></body></html>
+`;
+}
+
+/** Write a file that sends the browser to `url`, mode 0600 in a 0700 directory, and answer its path. */
+export function writeOpenFile(loopsDir: string, url: string): string {
+	const dir = openFileDir(loopsDir);
+	fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+	// mkdir leaves an existing directory's mode as it was.
+	fs.chmodSync(dir, 0o700);
+	const file = path.join(dir, `${randomBytes(16).toString("hex")}.html`);
+	// `wx`: a name that exists is not ours to write into.
+	fs.writeFileSync(file, openFileHtml(url), { mode: 0o600, flag: "wx" });
+	return file;
+}
+
+/** Remove one file; one already gone is what was wanted. */
+export function removeOpenFile(file: string): void {
+	fs.rmSync(file, { force: true });
+}
+
+/** Remove every file a process before this one left: their keys died with it. */
+export function sweepOpenFiles(loopsDir: string): void {
+	fs.rmSync(openFileDir(loopsDir), { recursive: true, force: true });
+}