npm - @herbertgao/pi-extensions - Versions diffs - 2026.8.1 → 2026.8.3 - Mend

@herbertgao/pi-extensions 2026.8.1 → 2026.8.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (403) hide show

package/node_modules/pi-mcp-adapter/mcp-callback-server.ts CHANGED Viewed

@@ -6,6 +6,7 @@
  */
 import { createServer, type Server, type IncomingMessage, type ServerResponse } from "http"
+import { getAppName } from "./agent-dir.ts"
 import {
   DEFAULT_OAUTH_CALLBACK_PATH,
   getConfiguredOAuthCallbackPort,
@@ -15,45 +16,106 @@ import {
   setOAuthCallbackPort,
 } from "./mcp-oauth-provider.ts"
-// HTML templates for callback responses
-const HTML_SUCCESS = `<!DOCTYPE html>
-<html>
-<head>
-  <title>Pi - Authorization Successful</title>
-  <style>
-    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
-    .container { text-align: center; padding: 2rem; }
-    h1 { color: #4ade80; margin-bottom: 1rem; }
-    p { color: #aaa; }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <h1>Authorization Successful</h1>
-    <p>You can close this window and return to Pi.</p>
-  </div>
-  <script>setTimeout(() => window.close(), 2000);</script>
-</body>
-</html>`
-const HTML_MANUAL_SUCCESS = `<!DOCTYPE html>
-<html>
+// HTML templates for callback responses.
+//
+// These pages are served from localhost during OAuth and are the last thing a
+// user sees before returning to their terminal, so they are self-contained: no
+// webfonts, no external assets, nothing that needs the network. They also name
+// the host rather than hardcoding "Pi", so a distribution that rebrands pi
+// (arc, tau, …) does not send its users back to an app they are not running.
+/** Shared chrome: system fonts, a centred card, and light/dark support. */
+const PAGE_STYLE = `
+    :root { color-scheme: light dark; }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      font: 15px/1.55 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+      background: #0f1117;
+      color: #e6e8ee;
+    }
+    .card {
+      width: 100%;
+      max-width: 26rem;
+      padding: 2.5rem 2rem;
+      text-align: center;
+      background: #161922;
+      border: 1px solid #242938;
+      border-radius: 14px;
+      box-shadow: 0 1px 2px rgba(0,0,0,.3), 0 12px 32px rgba(0,0,0,.25);
+    }
+    .badge {
+      width: 3rem; height: 3rem;
+      margin: 0 auto 1.25rem;
+      display: grid; place-items: center;
+      border-radius: 50%;
+    }
+    .badge svg { width: 1.5rem; height: 1.5rem; display: block; }
+    .ok   { background: rgba(74,222,128,.12); color: #4ade80; }
+    .bad  { background: rgba(248,113,113,.12); color: #f87171; }
+    h1 { margin: 0 0 .5rem; font-size: 1.15rem; font-weight: 600; letter-spacing: -0.01em; }
+    p  { margin: 0; color: #9aa1b1; }
+    .app { color: #e6e8ee; font-weight: 500; }
+    .hint { margin-top: 1.25rem; font-size: .8125rem; color: #6b7280; }
+    code {
+      display: block;
+      margin-top: 1.25rem;
+      padding: .75rem .875rem;
+      text-align: left;
+      font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;
+      color: #fca5a5;
+      background: rgba(248,113,113,.08);
+      border: 1px solid rgba(248,113,113,.2);
+      border-radius: 8px;
+      overflow-wrap: anywhere;
+    }
+    @media (prefers-color-scheme: light) {
+      body { background: #f6f7f9; color: #121620; }
+      .card { background: #fff; border-color: #e4e7ee; }
+      p { color: #5b6474; }
+      .app { color: #121620; }
+      .hint { color: #8b93a3; }
+    }`
+const CHECK_ICON =
+  '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M20 6 9 17l-5-5"/></svg>'
+const CROSS_ICON =
+  '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>'
+function page(options: {
+  title: string
+  heading: string
+  body: string
+  icon: string
+  tone: "ok" | "bad"
+  extra?: string
+  autoClose?: boolean
+}): string {
+  return `<!DOCTYPE html>
+<html lang="en">
 <head>
-  <title>Pi - Authorization Received</title>
-  <style>
-    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
-    .container { text-align: center; padding: 2rem; }
-    h1 { color: #4ade80; margin-bottom: 1rem; }
-    p { color: #aaa; }
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${options.title}</title>
+  <style>${PAGE_STYLE}
   </style>
 </head>
 <body>
-  <div class="container">
-    <h1>Authorization Received</h1>
-    <p>Copy the full callback URL from your browser address bar and paste it back into Pi with auth-complete.</p>
-  </div>
-</body>
+  <main class="card">
+    <div class="badge ${options.tone}">${options.icon}</div>
+    <h1>${options.heading}</h1>
+    <p>${options.body}</p>
+    ${options.extra ?? ""}
+  </main>
+${options.autoClose ? "  <script>setTimeout(() => window.close(), 2000);</script>\n" : ""}</body>
 </html>`
+}
 function escapeHtml(value: string): string {
   return value
@@ -64,26 +126,41 @@ function escapeHtml(value: string): string {
     .replace(/'/g, "&#39;")
 }
-const HTML_ERROR = (error: string) => `<!DOCTYPE html>
-<html>
-<head>
-  <title>Pi - Authorization Failed</title>
-  <style>
-    body { font-family: system-ui, -apple-system, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee; }
-    .container { text-align: center; padding: 2rem; }
-    h1 { color: #f87171; margin-bottom: 1rem; }
-    p { color: #aaa; }
-    .error { color: #fca5a5; font-family: monospace; margin-top: 1rem; padding: 1rem; background: rgba(248,113,113,0.1); border-radius: 0.5rem; }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <h1>Authorization Failed</h1>
-    <p>An error occurred during authorization.</p>
-    <div class="error">${escapeHtml(error)}</div>
-  </div>
-</body>
-</html>`
+/** Built per request so a host that sets PI_PACKAGE_DIR late is still named right. */
+function htmlSuccess(): string {
+  const app = escapeHtml(getAppName())
+  return page({
+    title: `${app} — Authorization Successful`,
+    heading: "Authorization Successful",
+    body: `You can close this window and return to <span class="app">${app}</span>.`,
+    icon: CHECK_ICON,
+    tone: "ok",
+    autoClose: true,
+  })
+}
+function htmlManualSuccess(): string {
+  const app = escapeHtml(getAppName())
+  return page({
+    title: `${app} — Authorization Received`,
+    heading: "Authorization Received",
+    body: `Copy the full callback URL from your browser address bar and paste it back into <span class="app">${app}</span> with auth-complete.`,
+    icon: CHECK_ICON,
+    tone: "ok",
+  })
+}
+function htmlError(error: string): string {
+  const app = escapeHtml(getAppName())
+  return page({
+    title: `${app} — Authorization Failed`,
+    heading: "Authorization Failed",
+    body: `Something went wrong during authorization. You can close this window and try again from <span class="app">${app}</span>.`,
+    icon: CROSS_ICON,
+    tone: "bad",
+    extra: `<code>${escapeHtml(error)}</code>`,
+  })
+}
 /** Result of a successful OAuth callback */
 export interface OAuthCallbackResult {
@@ -145,7 +222,7 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
   if (!state) {
     const errorMsg = "Missing required state parameter - potential CSRF attack"
     res.writeHead(400, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR(errorMsg))
+    res.end(htmlError(errorMsg))
     return
   }
@@ -157,14 +234,14 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
     if (!pending && !isReserved) {
       const errorMsg = "Invalid or expired state parameter - potential CSRF attack"
       res.writeHead(400, { "Content-Type": "text/html" })
-      res.end(HTML_ERROR(errorMsg))
+      res.end(htmlError(errorMsg))
       return
     }
     const errorMsg = errorDescription || error
     // Send HTTP response first before rejecting promise
     res.writeHead(200, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR(errorMsg))
+    res.end(htmlError(errorMsg))
     // Reject promise after response is sent (defer to allow test to attach handler)
     if (pending) {
       reservedAuthStates.delete(state)
@@ -179,20 +256,20 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
   if (!pending && !isReserved) {
     const errorMsg = "Invalid or expired state parameter - potential CSRF attack"
     res.writeHead(400, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR(errorMsg))
+    res.end(htmlError(errorMsg))
     return
   }
   // Require authorization code
   if (!code) {
     res.writeHead(400, { "Content-Type": "text/html" })
-    res.end(HTML_ERROR("No authorization code provided"))
+    res.end(htmlError("No authorization code provided"))
     return
   }
   if (!pending) {
     res.writeHead(200, { "Content-Type": "text/html" })
-    res.end(HTML_MANUAL_SUCCESS)
+    res.end(htmlManualSuccess())
     return
   }
@@ -202,7 +279,7 @@ function handleRequest(req: IncomingMessage, res: ServerResponse): void {
   pending.resolve({ code, ...(iss !== null ? { iss } : {}) })
   res.writeHead(200, { "Content-Type": "text/html" })
-  res.end(HTML_SUCCESS)
+  res.end(htmlSuccess())
 }
 /**

package/node_modules/pi-mcp-adapter/mcp-code.ts CHANGED Viewed

@@ -6,7 +6,7 @@ import { executeCall } from "./proxy-modes.ts";
 import { combineAbortSignals } from "./runtime-owner.ts";
 import { paginate, rankSuggestions, rankToolMatches } from "./search-ranking.ts";
 import type { McpExtensionState } from "./state.ts";
-import { findToolByName } from "./tool-metadata.ts";
+import { findToolByName, formatSchema } from "./tool-metadata.ts";
 import { renderTsShape } from "./ts-shape.ts";
 import type { ContentBlock } from "./types.ts";
@@ -14,7 +14,7 @@ export const DEFAULT_MCP_SCRIPT_TIMEOUT_MS = 30_000;
 class McpScriptTimeoutError extends Error {
   constructor(timeoutMs: number) {
-    super(`mcp_script timed out after ${timeoutMs}ms`);
+    super(`mcpScript timed out after ${timeoutMs}ms`);
     this.name = "McpScriptTimeoutError";
   }
 }
@@ -139,7 +139,7 @@ export async function runMcpScript(
     // Record before dispatch so calls still in flight at timeout/abort appear in the trace.
     const startedAt = Date.now();
     const index = calls.push({ operation: "call", path, ok: false, error: "incomplete", durationMs: 0, startedAt }) - 1;
-    const result = await executeCall(state, path, args, undefined, getPiTools, callSignal);
+    const result = await executeCall(state, path, args, undefined, getPiTools, callSignal, "script");
     const details = result.details;
     if (details.error !== undefined) {
       const errorCode = String(details.error);
@@ -147,7 +147,7 @@ export async function runMcpScript(
         ? details.suggestions.filter((suggestion): suggestion is string => typeof suggestion === "string")
         : [];
       const message = errorCode === "tool_not_found"
-        ? `Tool "${path}" not found. Use await tools.search({ query: "..." }) inside mcp_script.${suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}` : ""}`
+        ? `Tool "${path}" not found. Use await tools.search({ query: "..." }) inside mcpScript.${suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}` : ""}`
         : typeof details.message === "string"
           ? details.message
           : textFromContent(result.content);
@@ -172,9 +172,9 @@ export async function runMcpScript(
       if (query.trim() === "") {
         return { items: [], total: 0, hasMore: false, nextOffset: null };
       }
-      const server = typeof input.server === "string" ? input.server : undefined;
-      const limit = typeof input.limit === "number" ? input.limit : 12;
-      const offset = typeof input.offset === "number" ? input.offset : 0;
+      const server = typeof input?.server === "string" ? input.server : undefined;
+      const limit = typeof input?.limit === "number" ? input.limit : 12;
+      const offset = typeof input?.offset === "number" ? input.offset : 0;
       const page = paginate(rankToolMatches(state, query, server), offset, limit);
       return {
         ...page,
@@ -204,7 +204,9 @@ export async function runMcpScript(
       for (const [server, metadata] of state.toolMetadata) {
         const tool = findToolByName(metadata, path);
         if (!tool) continue;
-        const inputTypeScript = tool.inputSchema ? renderTsShape(tool.inputSchema) : null;
+        const inputTypeScript = tool.inputSchema
+          ? renderTsShape(tool.inputSchema) ?? formatSchema(tool.inputSchema)
+          : null;
         return {
           path: tool.name,
           name: tool.originalName,
@@ -285,7 +287,7 @@ export async function runMcpScript(
       });
       activeWorker.once("error", reject);
       activeWorker.once("exit", (code) => {
-        if (!completed && code !== 0) reject(new Error(`mcp_script worker exited with code ${code}`));
+        if (!completed && code !== 0) reject(new Error(`mcpScript worker exited with code ${code}`));
       });
     });
     const timeoutError = new McpScriptTimeoutError(resolvedTimeoutMs);
@@ -313,7 +315,7 @@ export async function runMcpScript(
   } catch (error) {
     if (error instanceof McpScriptTimeoutError) {
       errorCode = "timeout";
-      errorMessage = `mcp_script timed out after ${resolvedTimeoutMs}ms`;
+      errorMessage = `mcpScript timed out after ${resolvedTimeoutMs}ms`;
     } else if (externalSignal?.aborted) {
       errorCode = "aborted";
       errorMessage = error instanceof Error ? error.message : String(error);
@@ -330,7 +332,7 @@ export async function runMcpScript(
     callsSnapshot ??= snapshotCalls();
     // A script may finish without awaiting every call; abort leftovers so
     // parent-side dispatches do not outlive the script.
-    timeoutController.abort(new Error("mcp_script finished"));
+    timeoutController.abort(new Error("mcpScript finished"));
     await worker?.terminate();
   }

package/node_modules/pi-mcp-adapter/mcp-oauth-provider.ts CHANGED Viewed

@@ -10,12 +10,12 @@ import {
   type AddClientAuthentication,
   type OAuthClientProvider,
   type OAuthDiscoveryState,
-} from "@modelcontextprotocol/sdk/client/auth.js"
+} from "@modelcontextprotocol/client"
 import type {
   OAuthClientInformationMixed,
   OAuthClientMetadata,
   OAuthTokens,
-} from "@modelcontextprotocol/sdk/shared/auth.js"
+} from "@modelcontextprotocol/client"
 import {
   getAuthForUrl,
   updateTokens,
@@ -30,6 +30,37 @@ import {
   type StoredClientInfo,
 } from "./mcp-auth.ts"
 import { resolveCommandSecret } from "./utils.ts"
+import { getAppClientUri, getAppName } from "./agent-dir.ts"
+/**
+ * Client name advertised during Dynamic Client Registration.
+ *
+ * A distribution that rebrands pi (arc, tau, …) should register under its own
+ * name — otherwise every consent screen its users see asks them to authorize
+ * an app they have never run. Stock pi keeps the long-standing
+ * "Pi Coding Agent" so existing registrations are unaffected.
+ */
+function defaultClientName(): string {
+  const app = getAppName()
+  return app === "pi" ? "Pi Coding Agent" : app
+}
+/**
+ * Client homepage advertised during Dynamic Client Registration.
+ *
+ * RFC 7591 defines client_uri as the home page *of the client*. Under a
+ * rebranded pi the client is that distribution, not this adapter, so pointing
+ * at the adapter's repository misidentifies it on the consent screen. There is
+ * no way to guess the right URL and a wrong one is worse than none, so the
+ * field is omitted unless a server config supplies oauth.clientUri.
+ *
+ * Stock pi keeps the historical value.
+ */
+function defaultClientUri(): string | undefined {
+  const declared = getAppClientUri()
+  if (declared) return declared
+  return getAppName() === "pi" ? "https://github.com/nicobailon/pi-mcp-adapter" : undefined
+}
 type IssuerBoundClientInformation = OAuthClientInformationMixed & { issuer?: string }
 type IssuerBoundTokens = OAuthTokens & { issuer?: string }
@@ -86,6 +117,8 @@ export interface McpOAuthConfig {
   redirectUri?: string
   clientName?: string
   clientUri?: string
+  logoUri?: string
+  skipIssuerMetadataValidation?: boolean
 }
 const reservedAuthorizationParams = new Set([
@@ -188,6 +221,11 @@ export class McpOAuthProvider implements OAuthClientProvider {
     return this.redirectUrlSnapshot
   }
+  /** Configured homepage, else the historical default on stock pi, else nothing. */
+  private get clientUri(): string | undefined {
+    return this.config.clientUri ?? defaultClientUri()
+  }
   /**
    * Client metadata for dynamic registration.
    * Describes this client to the OAuth authorization server.
@@ -195,8 +233,9 @@ export class McpOAuthProvider implements OAuthClientProvider {
   get clientMetadata(): OAuthClientMetadata {
     if (this.usesClientCredentials) {
       return {
-        client_name: this.config.clientName ?? "Pi Coding Agent",
-        client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+        client_name: this.config.clientName ?? defaultClientName(),
+        ...(this.clientUri !== undefined ? { client_uri: this.clientUri } : {}),
+        ...(this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {}),
         redirect_uris: [],
         grant_types: ["client_credentials"],
         token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
@@ -210,8 +249,9 @@ export class McpOAuthProvider implements OAuthClientProvider {
     return {
       redirect_uris: [redirectUrl],
-      client_name: this.config.clientName ?? "Pi Coding Agent",
-      client_uri: this.config.clientUri ?? "https://github.com/nicobailon/pi-mcp-adapter",
+      client_name: this.config.clientName ?? defaultClientName(),
+      ...(this.clientUri !== undefined ? { client_uri: this.clientUri } : {}),
+      ...(this.config.logoUri !== undefined ? { logo_uri: this.config.logoUri } : {}),
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       token_endpoint_auth_method: this.config.clientSecret ? "client_secret_post" : "none",
@@ -288,7 +328,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
         updateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions)
       }
       // Return all registration metadata and the local issuer extension.
-      // This keeps the SDK v1 view and the stored issuer binding consistent.
+      // This keeps the SDK OAuth view and the stored issuer binding consistent.
       return {
         client_id: clientInfo.clientId,
         client_secret: clientInfo.clientSecret,
@@ -318,7 +358,11 @@ export class McpOAuthProvider implements OAuthClientProvider {
     if (this.config.clientId && info.client_id === this.config.clientId) {
       updateClientInfo(
         this.serverName,
-        { clientId: info.client_id, issuer, configPreRegistered: true },
+        {
+          clientId: info.client_id,
+          ...(issuer !== undefined ? { issuer } : {}),
+          configPreRegistered: true,
+        },
         this.serverUrl,
         this.storageOptions,
       )
@@ -329,11 +373,11 @@ export class McpOAuthProvider implements OAuthClientProvider {
       ?? (this.redirectUrl ? [this.redirectUrl] : undefined)
     const clientInfo: StoredClientInfo = {
       clientId: info.client_id,
-      clientSecret: info.client_secret,
-      clientIdIssuedAt: info.client_id_issued_at,
-      clientSecretExpiresAt: info.client_secret_expires_at,
-      redirectUris,
-      issuer,
+      ...(info.client_secret !== undefined ? { clientSecret: info.client_secret } : {}),
+      ...(info.client_id_issued_at !== undefined ? { clientIdIssuedAt: info.client_id_issued_at } : {}),
+      ...(info.client_secret_expires_at !== undefined ? { clientSecretExpiresAt: info.client_secret_expires_at } : {}),
+      ...(redirectUris !== undefined ? { redirectUris } : {}),
+      ...(issuer !== undefined ? { issuer } : {}),
     }
     this.flowClientInfo = clientInfo
     updateClientInfo(this.serverName, clientInfo, this.serverUrl, this.storageOptions)
@@ -370,15 +414,16 @@ export class McpOAuthProvider implements OAuthClientProvider {
    * Save OAuth tokens.
    */
   async saveTokens(tokens: OAuthTokens): Promise<void> {
+    const issuer = this.discoveredIssuer ?? (tokens as IssuerBoundTokens).issuer
     const storedTokens: StoredTokens = {
       accessToken: tokens.access_token,
-      refreshToken: tokens.refresh_token,
+      ...(tokens.refresh_token !== undefined ? { refreshToken: tokens.refresh_token } : {}),
       // Preserve expiry even when expires_in is 0 (e.g. the SDK re-saving an
       // already-expired token) so expired tokens stay expired instead of
       // being persisted as never-expiring.
-      expiresAt: tokens.expires_in !== undefined ? Date.now() / 1000 + tokens.expires_in : undefined,
-      scope: tokens.scope,
-      issuer: this.discoveredIssuer ?? (tokens as IssuerBoundTokens).issuer,
+      ...(tokens.expires_in !== undefined ? { expiresAt: Date.now() / 1000 + tokens.expires_in } : {}),
+      ...(tokens.scope !== undefined ? { scope: tokens.scope } : {}),
+      ...(issuer !== undefined ? { issuer } : {}),
     }
     this.throwIfInactive()
     updateTokens(this.serverName, storedTokens, this.serverUrl, this.storageOptions)

package/node_modules/pi-mcp-adapter/mcp-output-guard.ts CHANGED Viewed

@@ -107,7 +107,7 @@ export async function guardMcpOutput(
   if (options.enabled === false) {
     return {
       content: addAffixes(normalizedContent, prefix, suffix),
-      mcpResult: options.rawMcpResult,
+      ...(options.rawMcpResult !== undefined ? { mcpResult: options.rawMcpResult } : {}),
     };
   }
@@ -138,8 +138,8 @@ export async function guardMcpOutput(
       originalLines: stats.lines,
       returnedLines: finalStats.lines,
       ...(imageBlocks.length > 0 ? { imageBlocksPassedThrough: imageBlocks.length } : {}),
-      fullOutputPath,
-      writeError,
+      ...(fullOutputPath !== undefined ? { fullOutputPath } : {}),
+      ...(writeError !== undefined ? { writeError } : {}),
     };
   }
@@ -147,7 +147,11 @@ export async function guardMcpOutput(
     ? undefined
     : await boundMcpResult(options.rawMcpResult, detailsMaxBytes);
-  return { content: guardedContent, outputGuard, mcpResult };
+  return {
+    content: guardedContent,
+    ...(outputGuard ? { outputGuard } : {}),
+    ...(mcpResult !== undefined ? { mcpResult } : {}),
+  };
 }
 function sanitizeContent(content: ContentBlock[]): ContentBlock[] {
@@ -177,7 +181,7 @@ function addAffixes(content: ContentBlock[], prefix: string, suffix: string): Co
   if (prefix) {
     const index = next.findIndex((block) => block.type === "text");
     const block = next[index];
-    if (index >= 0 && block.type === "text") {
+    if (block?.type === "text") {
       next[index] = { ...block, text: `${prefix}${block.text}` };
     } else {
       next.unshift({ type: "text", text: prefix });
@@ -187,13 +191,13 @@ function addAffixes(content: ContentBlock[], prefix: string, suffix: string): Co
   if (suffix) {
     let index = -1;
     for (let i = next.length - 1; i >= 0; i--) {
-      if (next[i].type === "text") {
+      if (next[i]?.type === "text") {
         index = i;
         break;
       }
     }
     const block = next[index];
-    if (index >= 0 && block.type === "text") {
+    if (block?.type === "text") {
       next[index] = { ...block, text: `${block.text}${suffix}` };
     } else {
       next.push({ type: "text", text: suffix });
@@ -239,8 +243,8 @@ function truncateHead(text: string, maxBytes: number, maxLines: number): { conte
 function truncateStringToBytes(value: string, maxBytes: number): string {
   if (byteLength(value) <= maxBytes) return value;
   const buffer = Buffer.from(value, "utf8");
-  let end = Math.max(0, maxBytes);
-  while (end > 0 && (buffer[end] & 0xc0) === 0x80) end--;
+  let end = Number.isFinite(maxBytes) ? Math.max(0, Math.floor(maxBytes)) : 0;
+  while (end > 0 && (buffer.readUInt8(end) & 0xc0) === 0x80) end--;
   return buffer.subarray(0, end).toString("utf8");
 }
@@ -280,8 +284,8 @@ async function summarizeMcpResult(result: unknown, raw: string, rawBytes: number
     contentBlocks: content.length,
     contentSummary: summarizeContent(content),
     rawResultBytes: rawBytes,
-    fullResultPath,
-    resultWriteError,
+    ...(fullResultPath !== undefined ? { fullResultPath } : {}),
+    ...(resultWriteError !== undefined ? { resultWriteError } : {}),
   };
   if (record && "structuredContent" in record) {