@fitchmultz/pi-mcp-adapter 5.0.0 → 7.0.0

package/CHANGELOG.md

@@ -7,6 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.0.0] - 2026-09-26
+
+### Breaking changes
+
+- Node.js 24 or later is required. The development baseline is Pi 0.87.1.
+- Package `exports` now resolve to the compiled `dist/` modules and declarations. The npm tarball no longer ships TypeScript sources, build scripts, or tsconfig files; standalone Node consumers import the package directly without a TypeScript loader.
+- `zod` is a regular dependency only, no longer a required peer.
+
+### Changed
+
+- Update the MCP client and core SDK to 2.1.0, `@napi-rs/keyring` to 2.1.0 (credential-store failures now surface as errors instead of empty reads), `open` to 11.0.4, and `smol-toml` to 1.9.0. Pin all runtime dependencies to exact versions.
+- MCP clients report the adapter's package version instead of a stale `4.3.1`.
+- Build with TypeScript 7 and test with Vitest 5. OAuth tests, conformance, and fixtures run on Node's native type stripping; `tsx` is removed. `npm test` now also runs the OAuth suite.
+- Git installs copy the committed MCP Apps bridge bundle instead of rebuilding it, so they no longer need esbuild. `npm run build:bridge` regenerates it, and a test fails when it drifts.
+- The MCP conformance runner is fetched on demand instead of installing a second MCP SDK into every source install.
+- CI qualifies official Pi and the maintained fork with the shared Pi compatibility automation, and rejects lockfile URLs outside the public npm registry.
+
+### Fixed
+
+- Prevent project stdio overrides, including OpenCode working-directory and environment changes, from inheriting another config source's environment secrets.
+- Refuse MCP setup writes when an existing config cannot be read, preserving the file and showing the error in the setup preview.
+- Keep a shared initial MCP connection alive when one caller cancels, so other callers can continue without a false failure backoff.
+- Let npm resolve explicit version ranges and tags for MCP server commands instead of launching an arbitrary cached version. Exact versions retain the direct-launch optimization.
+
+## [6.0.0] - 2026-09-22
+
+### Breaking changes
+
+- New gateway calls require an explicit `action` (`status`, `search`, `list`, `describe`, `call`, `connect`, `instructions`, `resources`, `read-resource`, `read-result`, `auth-start`, `auth-complete`, or `ui-messages`) and object arguments. Stored v5 optional-mode calls and JSON-string arguments are normalized only at ingress.
+- `mcp_search` discovers and loads full typed tool schemas for the next request, without executing a hit. `directTools` pins the initial active set; other eligible tools remain available for later discovery. Host tool allowlists and `MCP_DIRECT_TOOLS=__none__` remain binding.
+- Resources are listed and read explicitly by server and URI, not registered as synthetic functions. The panel shows separate resource counts and only real-tool pin choices. Legacy resource aliases remain gateway/script-callable; old resource pins keep the gateway available even with `disableProxyTool` enabled.
+- Script `tools.describe` preserves complete JSON Schema and raw descriptor fields rather than returning `inputTypeScript`. Update consumers to use `inputSchema` and optional `outputSchema`.
+- Cold caches no longer trigger connections to every lazy server. Global search reports partial catalog coverage; selected server discovery, configured pins, and eager/keep-alive startup remain intentional connection paths.
+- Metadata cache format 2 preserves raw tool/resource descriptors and reads legacy format 1. Downgrading to v5 ignores format 2 and requires rediscovery. Config paths and the OAuth namespace are unchanged from v5; see [migration](README.md#upgrading-from-v5).
+
+### Added
+
+- Branch-scoped typed-tool selection in native Pi session entries, restored on resume, reload, tree navigation, and working-directory changes. Optional native tool-search hosts use exact namespaced lazy references; official Pi 0.87.0 uses the ordinary loader with the same discover-then-call workflow. Existing pins keep flat names.
+- Conditional native asynchronous execution for typed tools when the host and selected model route both support it, excluding configured approval, MCP App UI, and sequential checkpoint flows.
+- Gateway `resources`, `read-resource`, and `read-result` actions; script `tools.resources`, `tools.readResource`, and `tools.readResult` methods. Resource access retains exposure, filtering, authentication, and approval policy.
+- Model-visible references to retained raw results for structured, media, resource, oversized, and extra-field payloads. Saved-result readback selects JSON Pointers/fields before bounded character paging and never repeats a server call. Artifacts respect the SDK host's `outputDirectory`.
+
+### Changed
+
+- Search uses MiniSearch over tool names, descriptions, and parameter guidance. Discovery and descriptions retain canonical descriptors, including output schemas, annotations, and `_meta`; app-only tools stay hidden from the model and panel.
+- Typed, gateway, and script calls share dispatch, authentication, approvals, and call capture. Scripts receive raw MCP results, including error-result data, without rendering unused text artifacts. Tiny plain-text results remain inline.
+- Render `structuredContent` alongside content blocks instead of suppressing it when text or images are present. Existing output byte/line limits still bound model-facing text.
+- MCP Apps uses 2.0.0 alongside the split MCP SDK 2.0.0 runtime, removing the runtime SDK 1 dependency.
+- Panel and command status distinguish real tools, resources, startup pins, and undiscovered catalogs while retaining authentication, reconnect, and error controls.
+
 ## [5.0.0] - 2026-09-19
 
 ### Changed

package/OAUTH.md

@@ -231,7 +231,7 @@ mcp({
 })
 ```
 
-You can also pass only the `code` query parameter with `args: { code: "..." }`. JSON-string args remain supported. Redirect URL completion validates the saved OAuth state; raw code completion is available for providers that display a code directly.
+You can also pass only the `code` query parameter with `args: { code: "..." }`. Use object arguments; JSON-string arguments are accepted only by the stored-v5-call ingress compatibility path. Redirect URL completion validates the saved OAuth state; raw code completion is available for providers that display a code directly.
 
 ### Newly required permissions
 
@@ -248,8 +248,8 @@ Auth-only connection replacement lets accepted native operations finish on the o
 Once authenticated, use the server normally:
 
 ```
-mcp({ server: "my-oauth-server" })
-mcp({ tool: "my-tool", args: { key: "value" } })
+mcp({ action: "list", server: "my-oauth-server" })
+mcp({ action: "call", server: "my-oauth-server", tool: "my-tool", args: { key: "value" } })
 ```
 
 The SDK automatically: