@bastani/atomic 0.9.26-alpha.2 → 0.9.26-alpha.4

package/dist/extensions/mcp/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/extensions/mcp/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAGN,YAAY,EACZ,uBAAuB,GACvB,MAAM,2BAA2B,CAAC;AASnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAqB/D,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAQD,SAAS,cAAc,CAAC,IAAY,EAAE,KAA2B,EAAE,KAAqB;IACvF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;QAClE,OAAO;IACR,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;QACvE,OAAO;IACR,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;SACpG,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;YAClC,SAAS;QACV,CAAC;QACD,iEAAiE;QACjE,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAChH,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,IAAI,qBAAqB,KAAK,GAAG,CAAC,CAAC;YACnE,SAAS;QACV,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,IAAI,gDAAgD,CAAC,CAAC;YACtF,SAAS;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAmE;IAChG,MAAM,KAAK,GAAmB,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,cAAc;QAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7G,OAAO;QACN,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACnG,MAAM,EAAE,KAAK,CAAC,MAAM;KACpB,CAAC;AACH,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAY,EAAE,KAA2B;IAC5F,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,IAAI,GAAG,CAAC,CAAC;QACvF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,OAAO,CAAC;;gBACpC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;gBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;;gBACrD,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY,EAAE,MAAuB;IACrF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,CAAC;QAC7B,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QACtB,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAY;IAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACtB,IAAY,EACZ,IAAgG;IAEhG,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAY,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO;IACnC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC","sourcesContent":["/**\n * MCP server configuration.\n *\n * Servers are read from `mcp.json` in the agent directory and, for trusted projects, from\n * `<project>/.pi/mcp.json`. Both use the `mcpServers` shape shared by other MCP clients, so\n * existing configurations can be copied over. Project entries replace global entries with the\n * same name.\n *\n * ```json\n * {\n *   \"mcpServers\": {\n *     \"filesystem\": { \"command\": \"npx\", \"args\": [\"-y\", \"@modelcontextprotocol/server-filesystem\", \".\"] },\n *     \"docs\": { \"url\": \"https://example.com/mcp\", \"headers\": { \"Authorization\": \"Bearer ${DOCS_TOKEN}\" } },\n *     \"sentry\": { \"url\": \"https://mcp.sentry.dev/mcp\" }\n *   }\n * }\n * ```\n *\n * HTTP servers without an `Authorization` header use OAuth when they answer 401 (sign in with `/mcp`).\n * `\"auth\": { \"provider\": \"<provider>\" }` sends the token of a `/login` provider instead. Project files\n * cannot use it, so a repository cannot pick where the credential goes.\n *\n * The top-level `autoEnableCodemode` (default true) activates the codemode tool when a server\n * with `codemode` exposure connects. A project value overrides the global one.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { CONFIG_DIR_NAME } from \"../../config.js\";\nimport {\n\ttype McpExposure,\n\ttype McpServerConfig,\n\tmcpNamespace,\n\tvalidateMcpServerConfig,\n} from \"../../core/mcp-servers.ts\";\n\nexport type {\n\tMcpExposure,\n\tMcpHttpServerConfig,\n\tMcpOAuthConfig,\n\tMcpServerConfig,\n\tMcpStdioServerConfig,\n} from \"../../core/mcp-servers.ts\";\nexport { getMcpToolExposure } from \"../../core/mcp-servers.ts\";\n\nexport interface McpServerEntry {\n\tname: string;\n\tconfig: McpServerConfig;\n\t/** Config file that defined the entry, or the path of the extension that registered it. */\n\tsource: string;\n\t/**\n\t * The global or the project `mcp.json`, or `extension` for servers registered with\n\t * `pi.registerMcpServer()`. Changes to extension servers are not saved.\n\t */\n\tscope?: \"global\" | \"project\" | \"extension\";\n}\n\nexport interface LoadedMcpConfig {\n\tservers: McpServerEntry[];\n\t/** Activate the codemode tool when `codemode` servers connect. Default: true. */\n\tautoEnableCodemode?: boolean;\n\terrors: string[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\ninterface McpConfigState {\n\tservers: Map<string, McpServerEntry>;\n\tautoEnableCodemode?: boolean;\n\terrors: string[];\n}\n\nfunction readConfigFile(path: string, scope: \"global\" | \"project\", state: McpConfigState): void {\n\tconst { servers, errors } = state;\n\tif (!existsSync(path)) return;\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(readFileSync(path, \"utf8\"));\n\t} catch {\n\t\terrors.push(`${path}: failed to read or parse MCP configuration`);\n\t\treturn;\n\t}\n\tif (!isRecord(parsed) || (parsed.mcpServers !== undefined && !isRecord(parsed.mcpServers))) {\n\t\terrors.push(`${path}: expected an object with an \"mcpServers\" object`);\n\t\treturn;\n\t}\n\tif (typeof parsed.autoEnableCodemode === \"boolean\") state.autoEnableCodemode = parsed.autoEnableCodemode;\n\telse if (parsed.autoEnableCodemode !== undefined) errors.push(`${path}: autoEnableCodemode must be a boolean`);\n\tfor (const [name, value] of Object.entries(parsed.mcpServers ?? {})) {\n\t\tconst config = validateMcpServerConfig(name, value);\n\t\tif (typeof config === \"string\") {\n\t\t\terrors.push(`${path}: ${config}`);\n\t\t\tcontinue;\n\t\t}\n\t\t// Names that differ only in `-` and `_` would share a namespace.\n\t\tconst clash = [...servers.keys()].find((other) => other !== name && mcpNamespace(other) === mcpNamespace(name));\n\t\tif (clash) {\n\t\t\terrors.push(`${path}: server \"${name}\" conflicts with \"${clash}\"`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (scope === \"project\" && \"url\" in config && config.auth) {\n\t\t\terrors.push(`${path}: server \"${name}\": auth is only allowed in the global mcp.json`);\n\t\t\tcontinue;\n\t\t}\n\t\tservers.set(name, { name, config, source: path, scope });\n\t}\n}\n\n/**\n * Load global and (when trusted) project MCP configuration. Disabled servers are included with\n * `enabled: false`, so they can be enabled again.\n */\nexport function loadMcpConfig(options: { agentDir: string; cwd: string; projectTrusted: boolean }): LoadedMcpConfig {\n\tconst state: McpConfigState = { servers: new Map(), errors: [] };\n\treadConfigFile(join(options.agentDir, \"mcp.json\"), \"global\", state);\n\tif (options.projectTrusted) readConfigFile(join(options.cwd, CONFIG_DIR_NAME, \"mcp.json\"), \"project\", state);\n\treturn {\n\t\tservers: [...state.servers.values()],\n\t\t...(state.autoEnableCodemode === undefined ? {} : { autoEnableCodemode: state.autoEnableCodemode }),\n\t\terrors: state.errors,\n\t};\n}\n\n/** Settings `/mcp` changes. `enabled: true` and `exposure: \"codemode\"` are the defaults and remove the key. */\nexport interface McpServerConfigPatch {\n\tenabled?: boolean;\n\texposure?: McpExposure;\n}\n\n/**\n * Change one server's settings in the `mcp.json` that defines it. Other content is kept; the file is\n * rewritten with its indentation.\n */\nexport function updateMcpServerConfig(path: string, name: string, patch: McpServerConfigPatch): void {\n\teditMcpServers(path, (servers) => {\n\t\tconst server = servers?.[name];\n\t\tif (!isRecord(server)) throw new Error(`${path} does not define MCP server \"${name}\"`);\n\t\tif (patch.enabled !== undefined) {\n\t\t\tif (patch.enabled) delete server.enabled;\n\t\t\telse server.enabled = false;\n\t\t}\n\t\tif (patch.exposure !== undefined) {\n\t\t\tif (patch.exposure === \"codemode\") delete server.exposure;\n\t\t\telse server.exposure = patch.exposure;\n\t\t}\n\t\treturn true;\n\t});\n}\n\n/**\n * Add a server to an `mcp.json`, creating the file when missing. An existing entry with the same\n * name is replaced. Returns true when an entry was replaced.\n */\nexport function addMcpServerConfig(path: string, name: string, config: McpServerConfig): boolean {\n\tlet replaced = false;\n\teditMcpServers(path, (servers, parsed) => {\n\t\tconst target = servers ?? {};\n\t\treplaced = target[name] !== undefined;\n\t\ttarget[name] = config;\n\t\tparsed.mcpServers = target;\n\t\treturn true;\n\t});\n\treturn replaced;\n}\n\n/** Remove a server from an `mcp.json`. Returns false when the file does not define it. */\nexport function removeMcpServerConfig(path: string, name: string): boolean {\n\tif (!existsSync(path)) return false;\n\tlet removed = false;\n\teditMcpServers(path, (servers) => {\n\t\tif (!servers || servers[name] === undefined) return false;\n\t\tdelete servers[name];\n\t\tremoved = true;\n\t\treturn true;\n\t});\n\treturn removed;\n}\n\n/**\n * Read an `mcp.json` (an empty config when missing), let `edit` change its `mcpServers`, and write\n * it back with its indentation when `edit` returns true. Other content is kept.\n */\nfunction editMcpServers(\n\tpath: string,\n\tedit: (servers: Record<string, unknown> | undefined, parsed: Record<string, unknown>) => boolean,\n): void {\n\tconst text = existsSync(path) ? readFileSync(path, \"utf8\") : undefined;\n\tconst parsed: unknown = text === undefined ? {} : JSON.parse(text);\n\tif (!isRecord(parsed) || (parsed.mcpServers !== undefined && !isRecord(parsed.mcpServers))) {\n\t\tthrow new Error(`${path}: expected an object with an \"mcpServers\" object`);\n\t}\n\tconst servers = isRecord(parsed.mcpServers) ? parsed.mcpServers : undefined;\n\tif (!edit(servers, parsed)) return;\n\tconst indent = (text && /^([ \\t]+)\\S/m.exec(text)?.[1]) || \"  \";\n\tmkdirSync(dirname(path), { recursive: true });\n\twriteFileSync(path, `${JSON.stringify(parsed, null, indent)}\\n`);\n}\n"]}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/extensions/mcp/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAGN,YAAY,EACZ,uBAAuB,GACvB,MAAM,2BAA2B,CAAC;AASnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAyB/D,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AAE9D,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAEtG,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAA8B;IACjD,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAQD,SAAS,cAAc,CAAC,IAAY,EAAE,KAA2B,EAAE,KAAqB;IACvF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;QAClE,OAAO;IACR,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;QACvE,OAAO;IACR,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;SACpG,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,IAAI,4DAA4D,CAAC,CAAC;YACnG,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,IAAI,+BAA+B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChG,CAAC;iBAAM,CAAC;gBACP,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBAC3E,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;;oBAC7D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;YAClC,SAAS;QACV,CAAC;QACD,iEAAiE;QACjE,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAChH,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,IAAI,qBAAqB,KAAK,GAAG,CAAC,CAAC;YACnE,SAAS;QACV,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,IAAI,gDAAgD,CAAC,CAAC;YACtF,SAAS;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAmE;IAChG,MAAM,KAAK,GAAmB,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,aAAa;QAAE,cAAc,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO;QACN,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACnG,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACH,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACpC,IAAY,EACZ,IAAY,EACZ,KAA2B,EAC3B,OAAO,GAA2B,EAAE;IAEpC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,mDAAmD,CAAC,CAAC;IACtG,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,MAAM,GAAY,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,GAAG,EAAE,CAAC;YACZ,MAAM,CAAC,UAAU,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,IAAI,GAAG,CAAC,CAAC;QACvF,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,YAAY;gBAAE,OAAO,MAAM,CAAC,OAAO,CAAC;;gBACrD,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QACrC,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,YAAY;gBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;;gBACtE,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY,EAAE,MAAuB;IACrF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,CAAC;QAC7B,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QACtB,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAY;IAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,cAAc,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACtB,IAAY,EACZ,IAAgG;IAEhG,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAY,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO;IACnC,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC","sourcesContent":["/**\n * MCP server configuration.\n *\n * Servers are read from `mcp.json` in the agent directory and, for trusted projects, from\n * `<project>/.atomic/mcp.json`. Both use the `mcpServers` shape shared by other MCP clients, so\n * existing configurations can be copied over. Project entries replace global entries with the\n * same name.\n *\n * A project entry without `command`, `url`, or `type` overrides only `enabled`, `exposure`, and\n * `toolExposure` of the global server with the same name, for example to turn it off in one project:\n * `{ \"mcpServers\": { \"internal-tools\": { \"enabled\": false } } }`. The rest of the global entry is kept,\n * including credentials the project could not set itself.\n *\n * ```json\n * {\n *   \"mcpServers\": {\n *     \"filesystem\": { \"command\": \"npx\", \"args\": [\"-y\", \"@modelcontextprotocol/server-filesystem\", \".\"] },\n *     \"docs\": { \"url\": \"https://example.com/mcp\", \"headers\": { \"Authorization\": \"Bearer ${DOCS_TOKEN}\" } },\n *     \"sentry\": { \"url\": \"https://mcp.sentry.dev/mcp\" }\n *   }\n * }\n * ```\n *\n * HTTP servers without an `Authorization` header use OAuth when they answer 401 (sign in with `/mcp`).\n * `\"auth\": { \"provider\": \"<provider>\" }` sends the token of a `/login` provider instead. Project files\n * cannot use it, so a repository cannot pick where the credential goes.\n *\n * The top-level `autoEnableCodemode` (default true) activates the codemode tool when a server\n * with `codemode` exposure connects. A project value overrides the global one.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { CONFIG_DIR_NAME } from \"../../config.js\";\nimport {\n\ttype McpExposure,\n\ttype McpServerConfig,\n\tmcpNamespace,\n\tvalidateMcpServerConfig,\n} from \"../../core/mcp-servers.ts\";\n\nexport type {\n\tMcpExposure,\n\tMcpHttpServerConfig,\n\tMcpOAuthConfig,\n\tMcpServerConfig,\n\tMcpStdioServerConfig,\n} from \"../../core/mcp-servers.ts\";\nexport { getMcpToolExposure } from \"../../core/mcp-servers.ts\";\n\nexport interface McpServerEntry {\n\tname: string;\n\tconfig: McpServerConfig;\n\t/** Config file that defined the entry, or the path of the extension that registered it. */\n\tsource: string;\n\t/**\n\t * The global or the project `mcp.json`, or `extension` for servers registered with\n\t * `pi.registerMcpServer()`. Changes to extension servers are not saved.\n\t */\n\tscope?: \"global\" | \"project\" | \"extension\";\n\t/** Project `mcp.json` with an override of this global server's `enabled`, `exposure`, or `toolExposure`. */\n\toverride?: string;\n}\n\nexport interface LoadedMcpConfig {\n\tservers: McpServerEntry[];\n\t/** Activate the codemode tool when `codemode` servers connect. Default: true. */\n\tautoEnableCodemode?: boolean;\n\terrors: string[];\n\t/** The project `mcp.json` when the project is trusted, where `/mcp` saves project overrides. */\n\tprojectConfig?: string;\n}\n\nconst OVERRIDE_KEYS = [\"enabled\", \"exposure\", \"toolExposure\"];\n\nconst RESERVED_SERVER_NAMES: ReadonlySet<string> = new Set([\"__proto__\", \"constructor\", \"prototype\"]);\n\n/** Whether an entry overrides a server defined elsewhere instead of defining one. */\nfunction isOverride(value: Record<string, unknown>): boolean {\n\treturn value.command === undefined && value.url === undefined && value.type === undefined;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\ninterface McpConfigState {\n\tservers: Map<string, McpServerEntry>;\n\tautoEnableCodemode?: boolean;\n\terrors: string[];\n}\n\nfunction readConfigFile(path: string, scope: \"global\" | \"project\", state: McpConfigState): void {\n\tconst { servers, errors } = state;\n\tif (!existsSync(path)) return;\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(readFileSync(path, \"utf8\"));\n\t} catch {\n\t\terrors.push(`${path}: failed to read or parse MCP configuration`);\n\t\treturn;\n\t}\n\tif (!isRecord(parsed) || (parsed.mcpServers !== undefined && !isRecord(parsed.mcpServers))) {\n\t\terrors.push(`${path}: expected an object with an \"mcpServers\" object`);\n\t\treturn;\n\t}\n\tif (typeof parsed.autoEnableCodemode === \"boolean\") state.autoEnableCodemode = parsed.autoEnableCodemode;\n\telse if (parsed.autoEnableCodemode !== undefined) errors.push(`${path}: autoEnableCodemode must be a boolean`);\n\tfor (const [name, value] of Object.entries(parsed.mcpServers ?? {})) {\n\t\tif (scope === \"project\" && isRecord(value) && isOverride(value)) {\n\t\t\tconst base = servers.get(name);\n\t\t\tconst extra = Object.keys(value).filter((key) => !OVERRIDE_KEYS.includes(key));\n\t\t\tif (!base) {\n\t\t\t\terrors.push(`${path}: server \"${name}\" needs \"command\" or \"url\", or a global server to override`);\n\t\t\t} else if (extra.length > 0) {\n\t\t\t\terrors.push(`${path}: server \"${name}\": an override can only set ${OVERRIDE_KEYS.join(\", \")}`);\n\t\t\t} else {\n\t\t\t\tconst config = validateMcpServerConfig(name, { ...base.config, ...value });\n\t\t\t\tif (typeof config === \"string\") errors.push(`${path}: ${config}`);\n\t\t\t\telse servers.set(name, { ...base, config, override: path });\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tconst config = validateMcpServerConfig(name, value);\n\t\tif (typeof config === \"string\") {\n\t\t\terrors.push(`${path}: ${config}`);\n\t\t\tcontinue;\n\t\t}\n\t\t// Names that differ only in `-` and `_` would share a namespace.\n\t\tconst clash = [...servers.keys()].find((other) => other !== name && mcpNamespace(other) === mcpNamespace(name));\n\t\tif (clash) {\n\t\t\terrors.push(`${path}: server \"${name}\" conflicts with \"${clash}\"`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (scope === \"project\" && \"url\" in config && config.auth) {\n\t\t\terrors.push(`${path}: server \"${name}\": auth is only allowed in the global mcp.json`);\n\t\t\tcontinue;\n\t\t}\n\t\tservers.set(name, { name, config, source: path, scope });\n\t}\n}\n\n/**\n * Load global and (when trusted) project MCP configuration. Disabled servers are included with\n * `enabled: false`, so they can be enabled again.\n */\nexport function loadMcpConfig(options: { agentDir: string; cwd: string; projectTrusted: boolean }): LoadedMcpConfig {\n\tconst state: McpConfigState = { servers: new Map(), errors: [] };\n\treadConfigFile(join(options.agentDir, \"mcp.json\"), \"global\", state);\n\tconst projectConfig = options.projectTrusted ? join(options.cwd, CONFIG_DIR_NAME, \"mcp.json\") : undefined;\n\tif (projectConfig) readConfigFile(projectConfig, \"project\", state);\n\treturn {\n\t\tservers: [...state.servers.values()],\n\t\t...(state.autoEnableCodemode === undefined ? {} : { autoEnableCodemode: state.autoEnableCodemode }),\n\t\terrors: state.errors,\n\t\t...(projectConfig ? { projectConfig } : {}),\n\t};\n}\n\n/** Settings `/mcp` changes. `enabled: true` and `exposure: \"codemode\"` are the defaults and remove the key. */\nexport interface McpServerConfigPatch {\n\tenabled?: boolean;\n\texposure?: McpExposure;\n}\n\n/**\n * Change one server's settings in the `mcp.json` that defines or overrides it. With `override`, a\n * missing entry is added as an override. Overrides keep default values, since they replace the global\n * server's. Other content is kept; the file is rewritten with its indentation.\n */\nexport function updateMcpServerConfig(\n\tpath: string,\n\tname: string,\n\tpatch: McpServerConfigPatch,\n\toptions: { override?: boolean } = {},\n): void {\n\tif (RESERVED_SERVER_NAMES.has(name))\n\t\tthrow new Error(`Invalid MCP server name \"${name}\": reserved object property names are not allowed`);\n\teditMcpServers(path, (servers, parsed) => {\n\t\tlet server: unknown = servers && Object.hasOwn(servers, name) ? servers[name] : undefined;\n\t\tif (server === undefined && options.override) {\n\t\t\tserver = {};\n\t\t\tparsed.mcpServers = { ...servers, [name]: server };\n\t\t}\n\t\tif (!isRecord(server)) throw new Error(`${path} does not define MCP server \"${name}\"`);\n\t\tconst keepDefaults = isOverride(server);\n\t\tif (patch.enabled !== undefined) {\n\t\t\tif (patch.enabled && !keepDefaults) delete server.enabled;\n\t\t\telse server.enabled = patch.enabled;\n\t\t}\n\t\tif (patch.exposure !== undefined) {\n\t\t\tif (patch.exposure === \"codemode\" && !keepDefaults) delete server.exposure;\n\t\t\telse server.exposure = patch.exposure;\n\t\t}\n\t\treturn true;\n\t});\n}\n\n/**\n * Add a server to an `mcp.json`, creating the file when missing. An existing entry with the same\n * name is replaced. Returns true when an entry was replaced.\n */\nexport function addMcpServerConfig(path: string, name: string, config: McpServerConfig): boolean {\n\tlet replaced = false;\n\teditMcpServers(path, (servers, parsed) => {\n\t\tconst target = servers ?? {};\n\t\treplaced = target[name] !== undefined;\n\t\ttarget[name] = config;\n\t\tparsed.mcpServers = target;\n\t\treturn true;\n\t});\n\treturn replaced;\n}\n\n/** Remove a server from an `mcp.json`. Returns false when the file does not define it. */\nexport function removeMcpServerConfig(path: string, name: string): boolean {\n\tif (!existsSync(path)) return false;\n\tlet removed = false;\n\teditMcpServers(path, (servers) => {\n\t\tif (!servers || servers[name] === undefined) return false;\n\t\tdelete servers[name];\n\t\tremoved = true;\n\t\treturn true;\n\t});\n\treturn removed;\n}\n\n/**\n * Read an `mcp.json` (an empty config when missing), let `edit` change its `mcpServers`, and write\n * it back with its indentation when `edit` returns true. Other content is kept.\n */\nfunction editMcpServers(\n\tpath: string,\n\tedit: (servers: Record<string, unknown> | undefined, parsed: Record<string, unknown>) => boolean,\n): void {\n\tconst text = existsSync(path) ? readFileSync(path, \"utf8\") : undefined;\n\tconst parsed: unknown = text === undefined ? {} : JSON.parse(text);\n\tif (!isRecord(parsed) || (parsed.mcpServers !== undefined && !isRecord(parsed.mcpServers))) {\n\t\tthrow new Error(`${path}: expected an object with an \"mcpServers\" object`);\n\t}\n\tconst servers = isRecord(parsed.mcpServers) ? parsed.mcpServers : undefined;\n\tif (!edit(servers, parsed)) return;\n\tconst indent = (text && /^([ \\t]+)\\S/m.exec(text)?.[1]) || \"  \";\n\tmkdirSync(dirname(path), { recursive: true });\n\twriteFileSync(path, `${JSON.stringify(parsed, null, indent)}\\n`);\n}\n"]}

package/dist/extensions/mcp/index.d.ts

@@ -41,7 +41,10 @@ export interface McpExtensionOptions {
     logPath?: string;
     /** Opens the OAuth authorization URL. Defaults to the platform browser. */
     openUrl?: (url: string) => void;
-    /** Saves `/mcp` changes to the server's config file. Defaults to editing its `mcp.json`. */
+    /**
+     * Saves `/mcp` changes to the server's config file: its project `override` when set, else its
+     * `source`. Defaults to editing that `mcp.json`.
+     */
     updateConfig?: (entry: McpServerEntry, patch: McpServerConfigPatch) => void;
     /**
      * How long the first prompt waits for servers with `direct` tools that are still connecting at

package/dist/extensions/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/extensions/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,OAAO,KAAK,EAGX,gBAAgB,EAChB,gBAAgB,EAGhB,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EAEN,KAAK,eAAe,EAGpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,uBAAuB,EAAmB,MAAM,YAAY,CAAC;AAS3E,OAAO,KAAK,EAAqC,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAY3F,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,WAAW,mBAAmB;IACnC,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,eAAe,CAAC;IACxD,qFAAqF;IACrF,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,0DAA0D;IAC1D,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,4FAA4F;IAC5F,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC5E;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAqED,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAGjD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAe9C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,cAAc,CAAC;IACtB,UAAU,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC;AAQD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,GAAG,SAAS,CA0B7F;AA2DD,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,gBAAgB,CA87BtF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/extensions/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,OAAO,KAAK,EAGX,gBAAgB,EAChB,gBAAgB,EAGhB,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EAEN,KAAK,eAAe,EAGpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,uBAAuB,EAAmB,MAAM,YAAY,CAAC;AAS3E,OAAO,KAAK,EAAqC,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAY3F,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,WAAW,mBAAmB;IACnC,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,eAAe,CAAC;IACxD,qFAAqF;IACrF,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,0DAA0D;IAC1D,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC5E;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAqED,6FAA6F;AAC7F,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAGjD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAe9C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,cAAc,CAAC;IACtB,UAAU,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC;AAQD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,GAAG,SAAS,CA0B7F;AA2DD,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,gBAAgB,CAo+BtF"}

package/dist/extensions/mcp/index.js

@@ -26,8 +26,7 @@
  * current session for registered servers.
  */
 import { join, resolve } from "node:path";
-import { hyperlink } from "@earendil-works/pi-tui";
-import { getAgentDir } from "../../config.js";
+import { CONFIG_DIR_NAME, getAgentDir } from "../../config.js";
 import { markNativeMcpToolDefinition, matchesMcpDirectToolSelection } from "../../core/mcp-child-policy.js";
 import { mcpNamespace } from "../../core/mcp-servers.js";
 import { openBrowser } from "../../utils/open-browser.js";
@@ -207,6 +206,8 @@ export function createMcpExtension(options = {}) {
         /** Servers from `mcp.json`, which take precedence over registered servers of the same name. */
         let configuredEntries = [];
         let configErrors = [];
+        /** The trusted project's `mcp.json`, where `/mcp` saves project overrides of global servers. */
+        let projectConfig;
         /** Registered servers that `mcp.json` overrides, shown in `/mcp`. */
         let overridden = [];
         let latestContext;
@@ -229,7 +230,10 @@ export function createMcpExtension(options = {}) {
         let modelRegistry;
         let serverLog;
         const openUrl = options.openUrl ?? openBrowser;
-        const updateConfig = options.updateConfig ?? ((entry, patch) => updateMcpServerConfig(entry.source, entry.name, patch));
+        const updateConfig = options.updateConfig ??
+            ((entry, patch) => updateMcpServerConfig(entry.override ?? entry.source, entry.name, patch, {
+                override: entry.override !== undefined,
+            }));
         const listeners = new Set();
         const emitChange = () => {
             for (const listener of listeners)
@@ -534,18 +538,20 @@ export function createMcpExtension(options = {}) {
         };
         /**
          * Save a config change; returns an error message when the file could not be updated. Changes to
-         * registered servers only apply to the current session.
+         * registered servers only apply to the current session. `inProject` adds a project override.
          */
-        const saveConfig = (server, patch) => {
-            if (server.entry.scope !== "extension") {
+        const saveConfig = (server, patch, inProject = false) => {
+            const override = inProject ? projectConfig : server.entry.override;
+            const entry = override ? { ...server.entry, override } : server.entry;
+            if (entry.scope !== "extension") {
                 try {
-                    updateConfig(server.entry, patch);
+                    updateConfig(entry, patch);
                 }
                 catch (error) {
-                    return `Could not update ${server.entry.source}: ${errorMessage(error)}`;
+                    return `Could not update ${entry.override ?? entry.source}: ${errorMessage(error)}`;
                 }
             }
-            server.entry = { ...server.entry, config: { ...server.entry.config, ...patch } };
+            server.entry = { ...entry, config: { ...entry.config, ...patch } };
             return undefined;
         };
         const signIn = async (server, prompt) => {
@@ -600,8 +606,8 @@ export function createMcpExtension(options = {}) {
             }
         };
         /** Returns an error message when the config could not be saved; connection errors show in the state. */
-        const setEnabled = async (server, enabled) => {
-            const failed = saveConfig(server, { enabled });
+        const setEnabled = async (server, enabled, inProject = false) => {
+            const failed = saveConfig(server, { enabled }, inProject);
             if (failed)
                 return failed;
             if (!enabled) {
@@ -647,9 +653,9 @@ export function createMcpExtension(options = {}) {
                 .map((server) => ({
                 value: server.entry.name,
                 label: server.entry.name,
-                description: `${describeState(server)} · ${exposureOf(server.entry)} · ${server.entry.scope ?? server.entry.source}`,
+                description: `${describeState(server)} · ${exposureOf(server.entry)} · ${server.entry.override ? "global, project override" : (server.entry.scope ?? server.entry.source)}`,
             })),
-            empty: `No MCP servers configured. Add them to ${resolve(getAgentDir(), "mcp.json")} or .pi/mcp.json.`,
+            empty: `No MCP servers configured. Add them to ${resolve(getAgentDir(), "mcp.json")} or ${CONFIG_DIR_NAME}/mcp.json.`,
             confirmLabel: "manage",
             cancelLabel: "close",
         });
@@ -667,12 +673,20 @@ export function createMcpExtension(options = {}) {
             const { entry, connection } = server;
             const saved = entry.scope === "extension"
                 ? "for this session"
-                : entry.scope
-                    ? `saved to the ${entry.scope} mcp.json`
-                    : "saved to mcp.json";
+                : entry.override
+                    ? "saved to the project mcp.json"
+                    : entry.scope
+                        ? `saved to the ${entry.scope} mcp.json`
+                        : "saved to mcp.json";
+            // Global servers without an override can be turned on or off for the trusted project alone.
+            const inProject = entry.scope === "global" && !entry.override && projectConfig !== undefined;
+            const inProjectSaved = "saved to the project mcp.json";
             const items = [];
             if (!isEnabled(server)) {
                 items.push({ value: "enable", label: "Enable", description: saved });
+                if (inProject) {
+                    items.push({ value: "enable-project", label: "Enable in this project", description: inProjectSaved });
+                }
             }
             else {
                 const state = connection?.state;
@@ -689,10 +703,14 @@ export function createMcpExtension(options = {}) {
                 }
                 items.push({ value: "exposure", label: "Exposure", description: exposureOf(entry) });
                 items.push({ value: "disable", label: "Disable", description: saved });
+                if (inProject) {
+                    items.push({ value: "disable-project", label: "Disable in this project", description: inProjectSaved });
+                }
             }
             const details = [
                 describeTransport(entry),
                 `${entry.scope ?? "config"}: ${entry.source}`,
+                ...(entry.override ? [`project override: ${entry.override}`] : []),
                 `State: ${describeState(server, false)}`,
             ];
             const error = [server.message, connection?.state === "connected" ? undefined : connection?.error]
@@ -734,7 +752,7 @@ export function createMcpExtension(options = {}) {
                 title: `Exposure of ${server.entry.name}`,
                 details: server.entry.scope === "extension"
                     ? `Applies to this session; the server is registered by ${server.entry.source}.`
-                    : `Saved to ${server.entry.source}.`,
+                    : `Saved to ${server.entry.override ?? server.entry.source}.`,
                 items: Object.keys(EXPOSURE_DESCRIPTIONS).map((exposure) => ({
                     value: exposure,
                     label: `${exposure === current ? "✓ " : "  "}${exposure}`,
@@ -748,27 +766,29 @@ export function createMcpExtension(options = {}) {
                 return undefined;
             return setExposure(server, choice);
         };
+        const signInWithUi = (ui, server) => {
+            const title = `Sign in to ${server.entry.name}`;
+            let authorizationUrl = "";
+            ui.status(title, "Contacting the authorization server…");
+            return signIn(server, {
+                showAuthorizationUrl: (url) => {
+                    authorizationUrl = url.href;
+                    openUrl(url.href);
+                },
+                promptForRedirectUrl: async (signal) => {
+                    const value = await ui.redirectUrl(title, authorizationUrl, signal);
+                    ui.status(title, "Connecting…");
+                    return value;
+                },
+            });
+        };
         const runAction = async (ui, ctx, server, action) => {
             const { name } = server.entry;
             let message;
             switch (action) {
-                case "signin": {
-                    const title = `Sign in to ${name}`;
-                    let authorizationUrl = "";
-                    ui.status(title, "Contacting the authorization server…");
-                    message = await signIn(server, {
-                        showAuthorizationUrl: (url) => {
-                            authorizationUrl = url.href;
-                            openUrl(url.href);
-                        },
-                        promptForRedirectUrl: async (signal) => {
-                            const value = await ui.redirectUrl(title, authorizationUrl, signal);
-                            ui.status(title, "Connecting…");
-                            return value;
-                        },
-                    });
+                case "signin":
+                    message = await signInWithUi(ui, server);
                     break;
-                }
                 case "reconnect":
                     // A failure shows as the connection's state and error.
                     ui.status(`MCP server ${name}`, "Reconnecting…");
@@ -785,9 +805,13 @@ export function createMcpExtension(options = {}) {
                     break;
                 case "enable":
                 case "disable":
-                    ui.status(`MCP server ${name}`, action === "enable" ? "Connecting…" : "Disconnecting…");
-                    message = await setEnabled(server, action === "enable");
+                case "enable-project":
+                case "disable-project": {
+                    const enable = action.startsWith("enable");
+                    ui.status(`MCP server ${name}`, enable ? "Connecting…" : "Disconnecting…");
+                    message = await setEnabled(server, enable, action.endsWith("-project"));
                     break;
+                }
             }
             server.message = message;
             ensureDiscoveryActive(ctx);
@@ -812,7 +836,7 @@ export function createMcpExtension(options = {}) {
         // ---------------------------------------------------------------------------------------
         const formatStatus = () => {
             if (servers.length === 0 && configErrors.length === 0 && overridden.length === 0) {
-                return `No MCP servers configured. Add them to ${resolve(getAgentDir(), "mcp.json")} or .pi/mcp.json.`;
+                return `No MCP servers configured. Add them to ${resolve(getAgentDir(), "mcp.json")} or ${CONFIG_DIR_NAME}/mcp.json.`;
             }
             const lines = servers.map((server) => {
                 const { name } = server.entry;
@@ -872,16 +896,25 @@ export function createMcpExtension(options = {}) {
                 ctx.ui.notify(`Signing in to MCP server "${name}" requires interactive mode.`, "error");
                 return;
             }
-            const failure = await signIn(server, {
-                showAuthorizationUrl: (url) => {
-                    const lines = ctx.mode === "tui"
-                        ? `${hyperlink(url.href, url.href)}\n${hyperlink(process.platform === "darwin" ? "Cmd+click to open" : "Ctrl+click to open", url.href)}`
-                        : url.href;
-                    ctx.ui.notify(`Sign in to MCP server "${name}" in your browser:\n${lines}`, "info");
-                    openUrl(url.href);
-                },
-                promptForRedirectUrl: (signal) => ctx.ui.input(`Waiting for sign-in to "${name}". If the browser cannot reach this machine, paste the URL it was redirected to.`, "http://127.0.0.1:.../callback?code=...", { signal }),
-            });
+            let failure;
+            if (ctx.mode === "tui") {
+                let completed = false;
+                await showMcpManager(ctx, async (ui) => {
+                    failure = await signInWithUi(ui, server);
+                    completed = true;
+                });
+                if (!completed)
+                    return;
+            }
+            else {
+                failure = await signIn(server, {
+                    showAuthorizationUrl: (url) => {
+                        ctx.ui.notify(`Sign in to MCP server "${name}" in your browser:\n${url.href}`, "info");
+                        openUrl(url.href);
+                    },
+                    promptForRedirectUrl: (signal) => ctx.ui.input(`Waiting for sign-in to "${name}". If the browser cannot reach this machine, paste the URL it was redirected to.`, "http://127.0.0.1:.../callback?code=...", { signal }),
+                });
+            }
             if (failure) {
                 ctx.ui.notify(failure, failure === "Sign-in cancelled." ? "info" : "error");
                 return;
@@ -894,6 +927,7 @@ export function createMcpExtension(options = {}) {
             subagentMcpDirectTools = ctx.subagentPolicy?.mcpDirectTools;
             const loaded = (options.loadConfig ?? defaultLoadConfig)(ctx);
             configErrors = loaded.errors;
+            projectConfig = loaded.projectConfig;
             autoEnableCodemode = (ctx.subagentPolicy ? false : loaded.autoEnableCodemode) ?? true;
             warnedUnreachable = false;
             waitedForStartup = false;