@henryqw/pi-subagent 27.4.1 → 27.4.3

package/README.md

@@ -178,7 +178,7 @@ Role Markdown files in `~/.pi/agent/config/pi-subagent/` require frontmatter and
 | `tools` | Required base or internal tool-name array; `[]` selects none. Name `codemode` or `git_read` to activate it. |
 | `extensions` | Required array of trusted absolute paths, supported package sources, or Pi built-ins such as `builtin:codemode` |
 | `skills` | Required array of effective Pi Skill names |
-| `mcps` | Optional exact global server names from `~/.pi/agent/mcp.json`, using native `mcpServers` format. Omitted or `[]` denies MCP access. |
+| `mcps` | Optional exact global server names from `~/.pi/agent/mcp.json`, using native `mcpServers` format. Omitted or `[]` denies access to `mcp.json` servers. Servers that Role extensions register always connect. |
 | body | Required system instructions |
 
 The package ships `implementer`, `reviewer`, and `scout`; same-name user Roles override built-ins. Roles define capabilities, not access or isolation. Unknown frontmatter keys invalidate that file and report its path and key. Other valid Roles load; duplicate names become unavailable. Delegation to an invalid file's claimed Role fails with that file's error. Inspect `/subagent roles`.

package/dist/index.js

@@ -471,7 +471,8 @@ function prepareRoleLaunchFromSkills(ctx, input, skills) {
     const extensions = [
         ...selectedExtensions,
         ...(CODEX_ALIAS.test(input.route.model.provider) ? [MULTI_CODEX_EXTENSION] : []),
-        ...(mcps.length ? [ROLE_MCP_EXTENSION] : []),
+        // Always loaded: it connects the servers that Role extensions register; `mcps` gates only mcp.json.
+        ROLE_MCP_EXTENSION,
         ...(role.tools.includes("git_read") ? [GIT_READ_EXTENSION] : []),
         ROLE_TOOLS_EXTENSION,
     ];
@@ -483,8 +484,7 @@ function prepareRoleLaunchFromSkills(ctx, input, skills) {
         return [key, value];
     }));
     const args = ["--no-session", "--no-extensions", "--no-skills", "--exclude-tools", CHILD_EXCLUDED_TOOL_NAMES.join(",")];
-    if (mcps.length)
-        args.push(`--${ROLE_MCP_POLICY_FLAG}`, JSON.stringify(mcps));
+    args.push(`--${ROLE_MCP_POLICY_FLAG}`, JSON.stringify(mcps));
     for (const extension of new Set(extensions))
         args.push("--extension", extension);
     for (const skill of skills.paths)

package/dist/integration-git.js

@@ -469,6 +469,9 @@ export class IntegrationGit {
                     return { outcome: "blocked", failure: "Worktree registration/path/branch do not match approved tip." };
                 if (!sameIdentity(await current(root, info, signal), expected))
                     return { outcome: "blocked", failure: "Worktree differs from approved clean candidate." };
+                const dirty = await inspectWorktreeDirty(info.path, (args, cwd) => git(args, cwd, signal));
+                if (dirty.failure || dirty.dirty)
+                    return { outcome: "blocked", failure: "Owned checkout has ignored, untracked or tracked changes; cleanup preserves them." };
                 const args = ["worktree", "remove", info.path];
                 const removed = await git(args, root, signal);
                 if (removed.code !== 0)

package/dist/mcp-role.js

@@ -120,6 +120,9 @@ function validateRoleMcpServer(path, name, value, codemode) {
  * never activated by MCP configuration: the Role tool policy owns the active set.
  */
 export function loadRoleMcpConfig(agentDir, allowlist, options = { codemode: false }) {
+    // A Role without mcps must not depend on mcp.json being readable.
+    if (!allowlist.length)
+        return { servers: [], autoEnableCodemode: false, errors: [] };
     const path = join(agentDir, "mcp.json");
     let parsed = {};
     try {

package/docs/orchestration.md

@@ -410,6 +410,8 @@ To let a Role run `codemode` scripts, list `builtin:codemode` in `extensions`. A
 
 Pi's `codemode.mode` and `codemode.inlineBudget` settings apply in the child without change. So the Role never forces codemode-only operation. MCP configuration never activates `codemode` in a child. Scripts can call only the active tools of the Role, plus `codemode` and `deferred` extension and MCP tools. Inactive base tools such as `bash` stay unreachable.
 
+Every child loads the Role MCP adapter. It also connects the servers that Role extensions register with `pi.registerMcpServer()`, for example the CodeGraph watcher of `pi-codegraph`. These servers keep the exposure that the extension sets, and `mcps` does not gate them, because the Role already trusts the extension.
+
 The servers named in `mcps` come only from the global `~/.pi/agent/mcp.json`. In a Role that activates `codemode`, each selected server keeps its configured `exposure` and `toolExposure`. Pi's default `codemode` exposure makes tools callable from scripts without declarations. `direct` declares them. `deferred` tools stay reachable from scripts, and `hidden` tools stay unreachable. An invalid exposure value fails the launch.
 
 In every other Role, the extension forces selected servers to `direct` exposure. It ignores `toolExposure`, because that child cannot reach undeclared tools. Declared tools show to the model as `mcp__<server>__<tool>` after the server connects. Pi replaces `-` in server and tool names with `_`. Pi appends a hash suffix when two tool names collide or a name is longer than 64 characters.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@henryqw/pi-subagent",
-  "version": "27.4.1",
+  "version": "27.4.3",
   "description": "Delegate bounded direct work or durable checked isolated task graphs to Pi roles.",
   "keywords": [
     "pi-package",