@herbertgao/pi-extensions 2026.8.1 → 2026.8.2

package/node_modules/pi-mcp-adapter/ui-server.ts

@@ -2,12 +2,12 @@ import http, { type IncomingMessage, type ServerResponse } from "node:http";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
-import { buildAllowAttribute } from "@modelcontextprotocol/ext-apps/app-bridge";
+import { buildAllowAttribute } from "./ui-app-bridge-helpers.ts";
 import {
-  ContentBlockSchema,
   type CallToolRequest,
   type CallToolResult,
-} from "@modelcontextprotocol/sdk/types.js";
+} from "@modelcontextprotocol/client";
+import { ContentBlockSchema } from "@modelcontextprotocol/core";
 import type { ConsentManager } from "./consent-manager.ts";
 import { ServerError, wrapError } from "./errors.ts";
 import { formatAuthRequiredMessage } from "./utils.ts";
@@ -17,7 +17,7 @@ import type { McpServerManager } from "./server-manager.ts";
 import type { McpExtensionState } from "./state.ts";
 import { SessionRecoveryAuthRequiredError, withSessionRecovery, type SessionRecoveryDeps } from "./session-recovery.ts";
 import { ensureToolCallApproved, isToolCallApprovalRequired } from "./tool-approval.ts";
-import { extractUiToolVisibility, isUiToolCallableByApp } from "./ui-tool-visibility.ts";
+import { extractUiToolVisibility, isUiToolCallableByApp, isUiToolVisibleToModel } from "./ui-tool-visibility.ts";
 import {
   createUiModelContextUpdate,
   extractUiPromptText,
@@ -95,6 +95,7 @@ export interface UiServerHandle {
 
 export async function startUiServer(options: UiServerOptions): Promise<UiServerHandle> {
   const sessionToken = options.sessionToken ?? randomUUID();
+  const uiResourceToken = randomUUID();
   const log = logger.child({ 
     component: "UiServer",
     server: options.serverName,
@@ -144,6 +145,41 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
     }
   }
 
+  const isAppOnlyTool = (toolName: string): boolean => {
+    const toolDefinition = options.manager.getConnection(options.serverName)?.tools?.find((tool) => tool.name === toolName);
+    if (!toolDefinition) return false;
+    const visibility = extractUiToolVisibility(toolDefinition._meta);
+    return isUiToolCallableByApp(visibility) && !isUiToolVisibleToModel(visibility);
+  };
+
+  const recordUiMessage = async (msgParams: UiMessageParams): Promise<void> => {
+    const promptText = extractUiPromptText(msgParams);
+
+    // Track messages by type (order: prompt → intent → notify)
+    // Must match the order in index.ts onMessage handler
+    if (promptText) {
+      sessionMessages.prompts.push(promptText);
+      log.debug("UI prompt received", { prompt: promptText.slice(0, 100) });
+    } else if (msgParams.type === "intent" || msgParams.intent) {
+      const intentName = msgParams.intent ?? "";
+      if (intentName) {
+        sessionMessages.intents.push({
+          intent: intentName,
+          ...(msgParams.params !== undefined ? { params: msgParams.params } : {}),
+        });
+        log.debug("UI intent received", { intent: intentName });
+      }
+    } else if (msgParams.type === "notify" || msgParams.message) {
+      const notifyText = msgParams.message ?? "";
+      if (notifyText) {
+        sessionMessages.notifications.push(notifyText);
+        log.debug("UI notification", { message: notifyText.slice(0, 100) });
+      }
+    }
+
+    await options.onMessage?.(msgParams);
+  };
+
   const touchHeartbeat = () => {
     lastHeartbeatAt = Date.now();
   };
@@ -164,7 +200,8 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
       streamSummary.phases.push(envelope.phase);
     }
     streamSummary.finalStatus = envelope.status;
-    streamSummary.lastMessage = envelope.message;
+    if (envelope.message !== undefined) streamSummary.lastMessage = envelope.message;
+    else delete streamSummary.lastMessage;
   };
 
   const serializeEvent = (eventId: number, name: string, payload: unknown): string => {
@@ -174,6 +211,7 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
   const getLatestCheckpointIndex = () => {
     for (let index = eventLog.length - 1; index >= 0; index -= 1) {
       const entry = eventLog[index];
+      if (!entry) continue;
       const envelope = getVisualizationStreamEnvelope((entry.payload as { structuredContent?: unknown } | null)?.structuredContent);
       if (envelope?.frameType === "checkpoint" || envelope?.frameType === "final") {
         return index;
@@ -271,13 +309,11 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
       }
 
       if (method === "GET" && url.pathname === "/") {
-        if (!url.searchParams.has("session") && isLoopbackAddress(req.socket.remoteAddress)) {
-          const dest = `/?session=${encodeURIComponent(sessionToken)}`;
+        if (!url.searchParams.has("session")) {
           res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
           res.end(
-            `<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(`MCP UI - ${options.serverName} / ${options.toolName}`)}</title>` +
-              `<noscript><meta http-equiv="refresh" content="0;url=${dest}"></noscript></head>` +
-              `<body><script>location.replace(${JSON.stringify(dest)});</script></body></html>`,
+            "<!doctype html><html><head><meta charset=\"utf-8\"><title>MCP UI</title></head>" +
+              "<body><p>Open the authenticated MCP UI URL shown by Pi.</p></body></html>",
           );
           return;
         }
@@ -286,6 +322,7 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
 
         const html = buildHostHtmlTemplate({
           sessionToken,
+          uiResourceToken,
           serverName: options.serverName,
           toolName: options.toolName,
           toolArgs: options.toolArgs,
@@ -330,7 +367,7 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
       }
 
       if (method === "GET" && url.pathname === "/ui-app") {
-        if (!validateTokenQuery(url, sessionToken, res)) return;
+        if (!validateTokenQuery(url, uiResourceToken, res, "resource")) return;
         touchHeartbeat();
         // Enforce host metadata independently of where app HTML places its document head.
         const cspContent = buildCspMetaContent(options.resource.meta.csp);
@@ -411,8 +448,8 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
           name: callParams.name,
           originalName: callParams.name,
           description: toolDefinition?.description ?? "",
-          inputSchema: toolDefinition?.inputSchema,
-          uiVisibility,
+          ...(toolDefinition?.inputSchema !== undefined ? { inputSchema: toolDefinition.inputSchema } : {}),
+          ...(uiVisibility !== undefined ? { uiVisibility } : {}),
         };
         const approval = options.state
           ? await ensureToolCallApproved(
@@ -421,6 +458,7 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
               toolMeta,
               callArgs.arguments,
               options.state.owner?.signal,
+              "iframe",
             )
           : options.config && isToolCallApprovalRequired(options.config, options.serverName, toolMeta)
             ? { ok: false as const, reason: "approval_required_headless" as const }
@@ -449,11 +487,15 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
           options.manager.incrementInFlight(options.serverName);
           const result = options.config
             ? await withSessionRecovery(
-                { manager: options.manager, config: options.config, onNeedsAuth: options.onNeedsAuth },
+                {
+                  manager: options.manager,
+                  config: options.config,
+                  ...(options.onNeedsAuth ? { onNeedsAuth: options.onNeedsAuth } : {}),
+                },
                 options.serverName,
-                (conn) => conn.client.callTool(callArgs, undefined, options.manager.getRequestOptions?.(options.serverName)),
+                (conn) => conn.client.callTool(callArgs, options.manager.getRequestOptions?.(options.serverName)),
               )
-            : await connection.client.callTool(callArgs, undefined, options.manager.getRequestOptions?.(options.serverName));
+            : await connection.client.callTool(callArgs, options.manager.getRequestOptions?.(options.serverName));
           sendJson(res, 200, { ok: true, result });
         } finally {
           options.manager.decrementInFlight(options.serverName);
@@ -469,33 +511,27 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
         return;
       }
 
-      if (url.pathname === "/proxy/ui/message") {
-        const msgParams = params as UiMessageParams;
-        const promptText = extractUiPromptText(msgParams);
-        
-        // Track messages by type (order: prompt → intent → notify)
-        // Must match the order in index.ts onMessage handler
-        if (promptText) {
-          sessionMessages.prompts.push(promptText);
-          log.debug("UI prompt received", { prompt: promptText.slice(0, 100) });
-        } else if (msgParams.type === "intent" || msgParams.intent) {
-          const intentName = msgParams.intent ?? "";
-          if (intentName) {
-            sessionMessages.intents.push({ 
-              intent: intentName, 
-              params: msgParams.params 
-            });
-            log.debug("UI intent received", { intent: intentName });
-          }
-        } else if (msgParams.type === "notify" || msgParams.message) {
-          const notifyText = msgParams.message ?? "";
-          if (notifyText) {
-            sessionMessages.notifications.push(notifyText);
-            log.debug("UI notification", { message: notifyText.slice(0, 100) });
-          }
+      if (url.pathname === "/proxy/ui/generated-tool-call-intent") {
+        const tool = typeof params.tool === "string" ? params.tool : undefined;
+        if (tool && isAppOnlyTool(tool)) {
+          log.debug("Ignored generated app-only tool call intent", { tool });
+        } else {
+          await recordUiMessage({
+            type: "intent",
+            intent: "call_tool",
+            params: {
+              ...(tool !== undefined ? { tool } : {}),
+              ...(params.arguments !== undefined ? { arguments: params.arguments } : {}),
+              ...(params.isError !== undefined ? { isError: params.isError } : {}),
+            },
+          });
         }
-        
-        await options.onMessage?.(msgParams);
+        sendJson(res, 200, { ok: true, result: {} });
+        return;
+      }
+
+      if (url.pathname === "/proxy/ui/message") {
+        await recordUiMessage(params as UiMessageParams);
         sendJson(res, 200, { ok: true, result: {} });
         return;
       }
@@ -639,7 +675,11 @@ export async function startUiServer(options: UiServerOptions): Promise<UiServerH
         return;
       }
       log.error("Failed to start server", error);
-      reject(new ServerError(error.message, { port: candidates[candidateIndex], cause: error }));
+      const port = candidates[candidateIndex];
+      reject(new ServerError(error.message, {
+        ...(port !== undefined ? { port } : {}),
+        cause: error,
+      }));
     };
 
     const onListening = () => {
@@ -760,21 +800,13 @@ function isAllowedHost(hostname: string): boolean {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 }
 
-function isLoopbackAddress(address: string | undefined): boolean {
-  return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
-}
-
-function escapeHtml(value: string): string {
-  return value
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
-function validateTokenQuery(url: URL, expected: string, res: ServerResponse): boolean {
-  const token = url.searchParams.get("session");
+function validateTokenQuery(
+  url: URL,
+  expected: string,
+  res: ServerResponse,
+  parameter = "session",
+): boolean {
+  const token = url.searchParams.get(parameter);
   if (token !== expected) {
     sendJson(res, 403, { ok: false, error: "Invalid session" });
     return false;

package/node_modules/pi-mcp-adapter/ui-session.ts

@@ -1,7 +1,7 @@
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import net from "node:net";
-import { UrlElicitationRequiredError, type CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import { UrlElicitationRequiredError, type CallToolResult } from "@modelcontextprotocol/client";
 import type { McpExtensionState } from "./state.ts";
 import {
   createUiModelContextUpdate,
@@ -99,8 +99,10 @@ function withStreamEnvelope(
     return result;
   }
 
-  const structuredContent = result.structuredContent && typeof result.structuredContent === "object" && !Array.isArray(result.structuredContent)
-    ? { ...result.structuredContent }
+  const structuredContent: Record<string, unknown> = result.structuredContent
+    && typeof result.structuredContent === "object"
+    && !Array.isArray(result.structuredContent)
+    ? { ...(result.structuredContent as Record<string, unknown>) }
     : {};
 
   const rawEnvelope = structuredContent[UI_STREAM_STRUCTURED_CONTENT_KEY];
@@ -239,10 +241,10 @@ export async function maybeStartUiSession(
         serverName: request.serverName,
         toolName: request.toolName,
         reused: true,
-        streamId,
-        streamToken,
-        streamMode,
-        requestMeta: streamToken ? { [UI_STREAM_REQUEST_META_KEY]: streamToken } : undefined,
+        ...(streamId !== undefined ? { streamId } : {}),
+        ...(streamToken !== undefined ? { streamToken } : {}),
+        ...(streamMode !== undefined ? { streamMode } : {}),
+        ...(streamToken ? { requestMeta: { [UI_STREAM_REQUEST_META_KEY]: streamToken } } : {}),
         url: existingHandle.url,
         viewer: existingHandle.viewer ?? "browser",
         windowOpen: existingHandle.windowOpen ?? true,
@@ -326,9 +328,9 @@ export async function maybeStartUiSession(
       manager: state.manager,
       config: state.config,
       state,
-      onNeedsAuth: request.onNeedsAuth,
+      ...(request.onNeedsAuth ? { onNeedsAuth: request.onNeedsAuth } : {}),
       consentManager: state.consentManager,
-      hostContext,
+      ...(hostContext !== undefined ? { hostContext } : {}),
 
       onMessage: (params: UiMessageParams) => {
         const prompt = extractUiPromptText(params);
@@ -410,7 +412,7 @@ export async function maybeStartUiSession(
               completedAt: new Date(),
               reason,
               messages,
-              stream,
+              ...(stream !== undefined ? { stream } : {}),
             });
 
             while (state.completedUiSessions.length > MAX_COMPLETED_SESSIONS) {
@@ -527,10 +529,10 @@ export async function maybeStartUiSession(
       serverName: request.serverName,
       toolName: request.toolName,
       reused: false,
-      streamId,
-      streamToken,
-      streamMode,
-      requestMeta: streamToken ? { [UI_STREAM_REQUEST_META_KEY]: streamToken } : undefined,
+      ...(streamId !== undefined ? { streamId } : {}),
+      ...(streamToken !== undefined ? { streamToken } : {}),
+      ...(streamMode !== undefined ? { streamMode } : {}),
+      ...(streamToken ? { requestMeta: { [UI_STREAM_REQUEST_META_KEY]: streamToken } } : {}),
       url: handle.url,
       viewer,
       windowOpen,

package/node_modules/pi-mcp-adapter/unix-socket-transport.ts

@@ -1,11 +1,11 @@
 import { createConnection, type Socket } from "node:net";
-import { ReadBuffer, serializeMessage } from "@modelcontextprotocol/sdk/shared/stdio.js";
-import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
-import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
+import { ReadBuffer, serializeMessage } from "@modelcontextprotocol/client";
+import type { Transport } from "@modelcontextprotocol/client";
+import type { JSONRPCMessage } from "@modelcontextprotocol/client";
 
 /** MCP JSONL transport for an explicitly configured Unix-domain socket. */
 export class UnixSocketClientTransport implements Transport {
-  private socket?: Socket;
+  private socket: Socket | undefined;
   private readonly readBuffer = new ReadBuffer();
 
   onclose?: () => void;

package/node_modules/pi-mcp-adapter/utils.ts

@@ -1,21 +1,30 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { spawnSync } from "node:child_process";
 import { homedir, platform } from "node:os";
-import { join } from "node:path";
+import { extname, isAbsolute, join } from "node:path";
 import type { McpConfig, ServerEntry } from "./types.ts";
 
 async function execOpen(pi: ExtensionAPI, target: string, browser?: string, signal?: AbortSignal) {
   const os = platform();
 
   if (os === "darwin") {
-    return browser ? pi.exec("open", ["-a", browser, target], { signal }) : pi.exec("open", [target], { signal });
+    if (browser) {
+      // An absolute executable path (e.g. from $BROWSER) names a launcher
+      // binary. App bundles still go through `open -a`, which handles them.
+      return isAbsolute(browser) && extname(browser).toLowerCase() !== ".app"
+        ? pi.exec(browser, [target], signal ? { signal } : {})
+        : pi.exec("open", ["-a", browser, target], signal ? { signal } : {});
+    }
+    return pi.exec("open", [target], signal ? { signal } : {});
   }
   if (os === "win32") {
     return browser
-      ? pi.exec("cmd", ["/c", "start", "", browser, target], { signal })
-      : pi.exec("cmd", ["/c", "start", "", target], { signal });
+      ? pi.exec("cmd", ["/c", "start", "", browser, target], signal ? { signal } : {})
+      : pi.exec("cmd", ["/c", "start", "", target], signal ? { signal } : {});
   }
-  return browser ? pi.exec(browser, [target], { signal }) : pi.exec("xdg-open", [target], { signal });
+  return browser
+    ? pi.exec(browser, [target], signal ? { signal } : {})
+    : pi.exec("xdg-open", [target], signal ? { signal } : {});
 }
 
 export async function openUrl(pi: ExtensionAPI, url: string, browser?: string, signal?: AbortSignal): Promise<void> {
@@ -38,12 +47,14 @@ export async function parallelLimit<T, R>(
   fn: (item: T) => Promise<R>
 ): Promise<R[]> {
   const results: R[] = [];
-  let index = 0;
+  const iterator = items.entries();
 
   async function worker() {
-    while (index < items.length) {
-      const i = index++;
-      results[i] = await fn(items[i]);
+    while (true) {
+      const next = iterator.next();
+      if (next.done) return;
+      const [index, item] = next.value;
+      results[index] = await fn(item);
     }
   }
 
@@ -106,6 +117,9 @@ const COMMAND_SECRET_TIMEOUT_MS = 10_000;
 const COMMAND_SECRET_MAX_OUTPUT_BYTES = 1024 * 1024;
 
 /** Resolve a secret value, executing only a single leading `!` command marker. */
+export function resolveCommandSecret(value: string, context: string): string;
+export function resolveCommandSecret(value: undefined, context: string): undefined;
+export function resolveCommandSecret(value: string | undefined, context: string): string | undefined;
 export function resolveCommandSecret(value: string | undefined, context: string): string | undefined {
   if (value === undefined) return undefined;
   if (value.startsWith("!!")) return interpolateEnvVars(value.slice(1));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@herbertgao/pi-extensions",
-  "version": "2026.8.1",
+  "version": "2026.8.2",
   "description": "Aggregate installer for HerbertGao-maintained Pi extensions.",
   "keywords": [
     "extensions",
@@ -35,9 +35,12 @@
   "dependencies": {
     "@ast-grep/cli": "^0.45.0",
     "@ast-grep/napi": "^0.45.0",
-    "@czottmann/pi-automode": "1.9.0",
+    "@czottmann/pi-automode": "1.11.0",
+    "@dietrichgebert/ponytail": "4.9.0",
     "@earendil-works/pi-tui": "^0.82.1",
-    "@herbertgao/pi-cc-extensions": "0.8.51",
+    "@effect/platform-node": "4.0.0-beta.103",
+    "@effect/platform-node-shared": "4.0.0-beta.103",
+    "@herbertgao/pi-cc-extensions": "0.8.52",
     "@herbertgao/pi-copy-response": "0.2.6",
     "@herbertgao/pi-handoff": "1.1.2",
     "@herbertgao/pi-inline-skills": "1.0.5",
@@ -45,21 +48,26 @@
     "@herbertgao/pi-preferred-thinking": "0.3.0",
     "@herbertgao/pi-recap": "0.4.4",
     "@herbertgao/pi-rename": "0.4.2",
-    "@herbertgao/pi-stash": "0.1.0",
-    "@herbertgao/pi-subagents": "0.15.1",
+    "@herbertgao/pi-stash": "0.1.1",
+    "@herbertgao/pi-subagents": "0.15.2",
     "@herbertgao/pi-titlebar-spinner": "0.1.3",
     "@juicesharp/rpiv-ask-user-question": "2.4.0",
     "@juicesharp/rpiv-config": "^2.4.0",
+    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/core": "2.0.0",
     "@modelcontextprotocol/ext-apps": "^1.2.2",
-    "@modelcontextprotocol/sdk": "^1.30.0",
     "@mozilla/readability": "^0.6.0",
     "@napi-rs/keyring": "^1.3.0",
+    "@narumitw/pi-btw": "0.50.0",
+    "@narumitw/pi-tui-kit": "^0.49.1",
+    "@pi-plugins/fast-mode": "0.1.9",
     "@shikijs/cli": "^4.0.2",
     "@sinclair/typebox": "^0.34.49",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "croner": "^10.0.1",
     "cross-spawn": "^7.0.6",
+    "effect": "4.0.0-beta.103",
     "grok-mermaid": "^0.2.2",
     "jiti": "^2.7.0",
     "js-yaml": "^5.2.2",
@@ -69,7 +77,7 @@
     "open": "^10.2.0",
     "p-limit": "^6.1.0",
     "pi-lens": "3.8.74",
-    "pi-mcp-adapter": "2.19.0",
+    "pi-mcp-adapter": "2.21.2",
     "pi-web-access": "0.18.0",
     "pidusage": "^4.0.1",
     "promise.try": "^2.0.1",
@@ -87,6 +95,7 @@
   },
   "bundledDependencies": [
     "@czottmann/pi-automode",
+    "@dietrichgebert/ponytail",
     "@herbertgao/pi-cc-extensions",
     "@herbertgao/pi-copy-response",
     "@herbertgao/pi-handoff",
@@ -99,6 +108,8 @@
     "@herbertgao/pi-subagents",
     "@herbertgao/pi-titlebar-spinner",
     "@juicesharp/rpiv-ask-user-question",
+    "@narumitw/pi-btw",
+    "@pi-plugins/fast-mode",
     "pi-lens",
     "pi-mcp-adapter",
     "pi-web-access"
@@ -108,6 +119,7 @@
   },
   "pi": {
     "extensions": [
+      "./node_modules/@dietrichgebert/ponytail/pi-extension/index.js",
       "./node_modules/@herbertgao/pi-cc-extensions/extensions/index.ts",
       "./node_modules/@herbertgao/pi-copy-response/src/index.ts",
       "./node_modules/@herbertgao/pi-handoff/src/index.ts",
@@ -121,6 +133,8 @@
       "./node_modules/@herbertgao/pi-subagents/src/index.ts",
       "./node_modules/@herbertgao/pi-titlebar-spinner/src/index.ts",
       "./node_modules/@juicesharp/rpiv-ask-user-question/index.ts",
+      "./node_modules/@narumitw/pi-btw/src/index.ts",
+      "./node_modules/@pi-plugins/fast-mode/dist/index.mjs",
       "./node_modules/pi-mcp-adapter/index.ts",
       "./node_modules/pi-lens/dist/index.js",
       "./node_modules/pi-web-access/index.ts",
@@ -131,6 +145,7 @@
       "./node_modules/@herbertgao/pi-cc-extensions/themes/cc-light.json"
     ],
     "skills": [
+      "./node_modules/@dietrichgebert/ponytail/skills",
       "./node_modules/pi-mcp-adapter/skills",
       "./node_modules/pi-lens/skills"
     ]