@gotgenes/pi-permission-system 36.2.1 → 38.0.0

package/src/access-intent/tool-kind.ts

@@ -22,25 +22,57 @@ import { PATH_BEARING_TOOLS } from "./path-surfaces";
  * (`docs/decisions/0002-path-values-string-boundary.md`).
  *
  * - `bash` — its own token-based path gates; extraction product is the command.
- * - `mcp` — extraction product is the qualified target.
+ * - `mcp` — the `mcp` proxy tool (e.g. pi-mcp-adapter), whose input names the
+ *   MCP call (`{ tool, server, args }`); extraction product is the qualified
+ *   target.
+ * - `mcp-tool` — one MCP server tool registered under its own name,
+ *   `mcp__<server>__<tool>` (Pi's built-in MCP); its input is the MCP
+ *   arguments themselves, so it shares the extension tools' input shape while
+ *   resolving on the `mcp` surface.
  * - `skill` — a distinct surface `normalizeInput`/`deriveSource` treat specially.
  * - `path` — a path-bearing built-in (`read`/`write`/`edit`/`grep`/`find`/`ls`);
  *   extraction product is `input.path`.
  * - `extension` — every other tool, plus the `external_directory`/`path` special
  *   surfaces that reach `deriveSource` as normalized names.
  */
-export type ToolKind = "bash" | "mcp" | "skill" | "path" | "extension";
+export type ToolKind =
+  | "bash"
+  | "mcp"
+  | "mcp-tool"
+  | "skill"
+  | "path"
+  | "extension";
 
 /** Classify a tool name into its {@link ToolKind}. */
 export function classifyToolKind(toolName: string): ToolKind {
   const name = toolName.trim();
   if (name === "bash") return "bash";
   if (name === "mcp") return "mcp";
+  if (isPiMcpToolName(name)) return "mcp-tool";
   if (name === "skill") return "skill";
   if (PATH_BEARING_TOOLS.has(name)) return "path";
   return "extension";
 }
 
+/** The prefix Pi's built-in MCP gives every server tool it registers. */
+export const PI_MCP_TOOL_PREFIX = "mcp__";
+
+/**
+ * True when a tool name has the shape Pi's built-in MCP registers a server
+ * tool under: `mcp__<server>__<tool>`, with non-empty server and tool parts.
+ *
+ * Pi builds the name with every character outside `[A-Za-z0-9_]` replaced by
+ * `_`, and codemode scripts call the tool by the same identifier, so the name
+ * itself is the stable contract (`extensions/mcp/tools.ts`,
+ * `createMcpToolName`).
+ */
+export function isPiMcpToolName(toolName: string): boolean {
+  if (!toolName.startsWith(PI_MCP_TOOL_PREFIX)) return false;
+  const rest = toolName.slice(PI_MCP_TOOL_PREFIX.length);
+  const separator = rest.indexOf("__");
+  return separator > 0 && separator + 2 < rest.length;
+}
+
 /** A shell invocation's effective command and optional working directory. */
 export interface ShellInvocation {
   /** The shell command string to decompose and gate. */
@@ -101,12 +133,25 @@ interface McpKindFields {
 }
 
 /**
- * True when a resolved check concerns an MCP call — either the invoked tool is
- * `mcp`, or the winning rule matched on the `mcp` surface (`source`). The
- * `source` disjunct is why this cannot reduce to `classifyToolKind(toolName)`:
- * `deriveSource` can set `source` to `mcp` on a result whose `toolName` is a
- * server-qualified string.
+ * True when a resolved check concerns an MCP call — the invoked tool is the
+ * `mcp` proxy or a Pi MCP tool, or the winning rule matched on the `mcp`
+ * surface (`source`). The `source` disjunct is why this cannot reduce to
+ * `classifyToolKind(toolName)`: `deriveSource` can set `source` to `mcp` on a
+ * result whose `toolName` is a server-qualified string.
  */
 export function isMcpCheck(check: McpKindFields): boolean {
-  return check.source === "mcp" || classifyToolKind(check.toolName) === "mcp";
+  if (check.source === "mcp") return true;
+  const kind = classifyToolKind(check.toolName);
+  return kind === "mcp" || kind === "mcp-tool";
+}
+
+/**
+ * True when a check concerns an MCP call whose tool input is a request *about*
+ * the call (the proxy's `{ tool, server, args }`) rather than the MCP
+ * arguments themselves. Such input is not previewed — the target already
+ * names the call — while a Pi MCP tool's arguments are shown like any other
+ * tool's input.
+ */
+export function isProxyMcpCheck(check: McpKindFields): boolean {
+  return isMcpCheck(check) && classifyToolKind(check.toolName) !== "mcp-tool";
 }

package/src/config/policy-loader.ts

@@ -133,6 +133,12 @@ export interface PolicyLoaderOptions {
   projectGlobalConfigPath?: string;
   projectAgentsDir?: string;
   globalMcpConfigPath?: string;
+  /**
+   * The project's `.pi/mcp.json`, read beside the global file the way Pi's
+   * built-in MCP reads it. Set only for a trusted project: the manager derives
+   * it from a cwd, and an untrusted project's cwd is withheld.
+   */
+  projectMcpConfigPath?: string;
   mcpServerNames?: readonly string[];
 }
 
@@ -150,6 +156,7 @@ export class FilePolicyLoader implements PolicyLoader {
   private readonly projectGlobalConfigPath: string | null;
   private readonly projectAgentsDir: string | null;
   private readonly globalMcpConfigPath: string;
+  private readonly projectMcpConfigPath: string | null;
   private readonly configuredMcpServerNamesOverride: readonly string[] | null;
 
   private globalConfigCache: FileCacheEntry<ScopeConfig> | null = null;
@@ -175,6 +182,7 @@ export class FilePolicyLoader implements PolicyLoader {
     this.projectAgentsDir = options.projectAgentsDir ?? null;
     this.globalMcpConfigPath =
       options.globalMcpConfigPath ?? defaultGlobalMcpConfigPath();
+    this.projectMcpConfigPath = options.projectMcpConfigPath ?? null;
     this.configuredMcpServerNamesOverride = options.mcpServerNames
       ? [
           ...new Set(
@@ -316,7 +324,9 @@ export class FilePolicyLoader implements PolicyLoader {
       return this.configuredMcpServerNamesOverride;
     }
 
-    const paths = [this.globalMcpConfigPath];
+    const paths = this.projectMcpConfigPath
+      ? [this.globalMcpConfigPath, this.projectMcpConfigPath]
+      : [this.globalMcpConfigPath];
     const stamp = paths
       .map((path) => `${path}:${getFileStamp(path)}`)
       .join("|");

package/src/exposure/skill-prompt-sanitizer.ts

@@ -38,8 +38,6 @@ export type SkillPromptEntry = {
 };
 
 export type SkillPromptSection = {
-  start: number;
-  end: number;
   entries: ParsedSkillPromptEntry[];
 };
 
@@ -52,15 +50,6 @@ function decodeXml(value: string): string {
     .replace(/&/g, "&");
 }
 
-function encodeXml(value: string): string {
-  return value
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
-}
-
 function parseSkillEntries(sectionBody: string): ParsedSkillPromptEntry[] {
   const entries: ParsedSkillPromptEntry[] = [];
   const skillBlockRegex = new RegExp(SKILL_BLOCK_PATTERN, "g");
@@ -115,8 +104,6 @@ export function parseAllSkillPromptSections(
       closeStart,
     );
     sections.push({
-      start,
-      end,
       entries: parseSkillEntries(sectionBody),
     });
     searchStart = end;
@@ -160,95 +147,56 @@ function createResolvedSkillEntry(
   };
 }
 
-function renderAvailableSkillsSection(
-  entries: readonly SkillPromptEntry[],
-): string {
-  return [
-    AVAILABLE_SKILLS_OPEN_TAG,
-    ...entries.flatMap((entry) => [
-      "  <skill>",
-      `    <name>${encodeXml(entry.name)}</name>`,
-      `    <description>${encodeXml(entry.description)}</description>`,
-      `    <location>${encodeXml(entry.location)}</location>`,
-      "  </skill>",
-    ]),
-    AVAILABLE_SKILLS_CLOSE_TAG,
-  ].join("\n");
-}
-
-function removePromptRange(prompt: string, start: number, end: number): string {
-  const beforeSection = prompt.slice(0, start).replace(/\n+$/, "");
-  const afterSection = prompt.slice(end);
-  return `${beforeSection}${afterSection}`;
-}
-
-export function resolveSkillPromptEntries(
+/**
+ * The skills listed in the prompt's `<available_skills>` catalogues that
+ * policy does not deny, in catalogue order: what skill path matching may
+ * treat as a skill's files. Edits no prompt text.
+ */
+export function visibleSkillPromptEntries(
   prompt: string,
   permissionManager: SkillPermissionChecker,
   agentName: string | null,
   normalizer: PathNormalizer,
-): { prompt: string; entries: SkillPromptEntry[] } {
-  const sections = parseAllSkillPromptSections(prompt);
-  if (sections.length === 0) {
-    return { prompt, entries: [] };
-  }
-
+): SkillPromptEntry[] {
   const permissionCache = new Map<string, PermissionState>();
-  const visibleEntries: SkillPromptEntry[] = [];
-  const replacements: Array<{ start: number; end: number; content: string }> =
-    [];
+  return parseAllSkillPromptSections(prompt)
+    .flatMap((section) => section.entries)
+    .map((entry) =>
+      createResolvedSkillEntry(
+        entry,
+        resolvePermissionState(
+          entry.name,
+          permissionManager,
+          agentName,
+          permissionCache,
+        ),
+        normalizer,
+      ),
+    )
+    .filter((entry) => entry.state !== "deny");
+}
 
-  for (const section of sections) {
-    const resolvedEntries = section.entries.map((entry) => {
-      const state = resolvePermissionState(
-        entry.name,
+/**
+ * The skills policy does not deny, judged by name, in their original order.
+ *
+ * Judging the skill list itself, rather than a catalogue rendered from it,
+ * keeps the answer independent of whether that catalogue has been rendered yet.
+ */
+export function withoutDeniedSkills<T extends { readonly name: string }>(
+  skills: readonly T[],
+  permissionManager: SkillPermissionChecker,
+  agentName: string | null,
+): T[] {
+  const permissionCache = new Map<string, PermissionState>();
+  return skills.filter(
+    (skill) =>
+      resolvePermissionState(
+        skill.name,
         permissionManager,
         agentName,
         permissionCache,
-      );
-      return createResolvedSkillEntry(entry, state, normalizer);
-    });
-
-    const visibleSectionEntries = resolvedEntries.filter(
-      (entry) => entry.state !== "deny",
-    );
-    visibleEntries.push(...visibleSectionEntries);
-
-    if (visibleSectionEntries.length === resolvedEntries.length) {
-      continue;
-    }
-
-    replacements.push({
-      start: section.start,
-      end: section.end,
-      content:
-        visibleSectionEntries.length > 0
-          ? renderAvailableSkillsSection(visibleSectionEntries)
-          : "",
-    });
-  }
-
-  if (replacements.length === 0) {
-    return { prompt, entries: visibleEntries };
-  }
-
-  let sanitizedPrompt = prompt;
-  for (let i = replacements.length - 1; i >= 0; i--) {
-    const replacement = replacements[i];
-    sanitizedPrompt =
-      replacement.content.length > 0
-        ? `${sanitizedPrompt.slice(0, replacement.start)}${replacement.content}${sanitizedPrompt.slice(replacement.end)}`
-        : removePromptRange(
-            sanitizedPrompt,
-            replacement.start,
-            replacement.end,
-          );
-  }
-
-  return {
-    prompt: sanitizedPrompt,
-    entries: visibleEntries,
-  };
+      ) !== "deny",
+  );
 }
 
 export function findSkillPathMatch(