@ian-pascoe/pi-minimal-subagents 0.19.0 → 0.19.2

package/README.md

@@ -252,9 +252,17 @@ still apply; the saved grant is not silently rewritten. Toolsets configure names
 not tool operations: granting a multifunction tool grants that tool's available
 operations, regardless of preset name.
 
-Child Agents load Pi's built-in `llama.cpp`, `codemode`, `tool-search`, and `mcp`
-extensions unless settings disable them (`-builtin:<name>`); each child connects
-its own MCP servers. Pi does not export the llama.cpp factory, so children load it
+Child Agents load Pi's built-in `llama.cpp`, `codemode`, and `tool-search`
+extensions unless settings disable them (`-builtin:<name>`). They load the `mcp`
+extension, under the same setting, only when the Launch Contract grants an MCP tool
+(`mcp__<server>__<tool>`) or an MCP resource tool (`list_mcp_resources`,
+`list_mcp_resource_templates`, `read_mcp_resource`). Each such child connects
+its own copy of the `mcp.json` servers it can reach: the servers of its granted
+MCP tools, or every server when it is granted a resource tool. Servers that other
+extensions register with `pi.registerMcpServer()` still all connect. Pi does not
+export its `mcp.json` loader, so children load it from Pi's installed
+`dist/extensions/mcp/config.js`; when that file is absent, a child with an MCP
+grant connects every server. Pi does not export the llama.cpp factory, so children load it
 from Pi's installed `dist/extensions/llama/index.js`; when that file is absent, a
 llama.cpp launch model is reported as a missing dependency. Child `codemode`
 scripts get no `models` API, so they cannot call models outside the Launch
@@ -262,7 +270,8 @@ Contract. A tool's exposure still decides whether it is declared or reachable on
 through `codemode` or `tool_search`. Granted `codemode`- or `deferred`-exposed
 tools are callable but not declared, so a child that needs them also needs
 `codemode` or `tool_search` in its grant. Ungranted tools are unreachable in the
-child. MCP tools are checked at launch only by name, because children register
+child, including MCP tools: `codemode` and `tool_search` find and call only the
+MCP tools the Launch Contract names. MCP tools are checked at launch only by name, because children register
 them after connecting; a tool whose server disappeared fails when called. Closing
 a child runtime shuts its extensions down, closing its MCP connections. A reopened
 child re-declares the tools it last declared itself, including tools loaded

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ian-pascoe/pi-minimal-subagents",
-  "version": "0.19.0",
+  "version": "0.19.2",
   "private": false,
   "description": "Persistent nested subagents with bounded delegation for Pi",
   "keywords": [
@@ -31,7 +31,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@ian-pascoe/pi-utils": "^0.7.0",
+    "@ian-pascoe/pi-utils": "^0.7.1",
     "minimatch": "^10.2.6"
   },
   "peerDependencies": {
@@ -39,7 +39,7 @@
     "@earendil-works/pi-ai": ">=1.1.0",
     "@earendil-works/pi-coding-agent": ">=1.1.0",
     "@earendil-works/pi-tui": ">=1.1.0",
-    "typebox": "*"
+    "typebox": ">=1"
   },
   "engines": {
     "node": ">=22.19.0"

package/src/minimal-subagents-child-resources.ts

@@ -6,8 +6,10 @@ import {
   createMcpExtension,
   createToolSearchExtension,
   DefaultResourceLoader,
+  type ExtensionContext,
   type ExtensionFactory,
   getPackageDir,
+  type LoadedMcpConfig,
   SettingsManager,
 } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
@@ -22,6 +24,8 @@ export interface ChildResourceLoaderOptions {
   extensionEntrypoint: string;
   systemPromptBlock: string;
   settingsManager?: SettingsManager;
+  /** The Launch Contract's ordinary tools, which decide the MCP servers the child connects. */
+  grantedTools: readonly string[];
 }
 
 type InlineExtension = NonNullable<
@@ -61,8 +65,84 @@ export function childProviderAvailable(provider: string): boolean {
 /** Child scripts must not call models outside their Launch Contract. */
 export const CHILD_CODEMODE_MODELS = false;
 
+const MCP_RESOURCE_TOOLS = new Set([
+  "list_mcp_resources",
+  "list_mcp_resource_templates",
+  "read_mcp_resource",
+]);
+
+/** Whether a tool comes from MCP: a server tool (`mcp__<server>__<tool>`) or a resource tool. */
+export function isMcpToolName(toolName: string): boolean {
+  return toolName.startsWith("mcp__") || MCP_RESOURCE_TOOLS.has(toolName);
+}
+
+/** Which `mcp.json` servers a grant reaches, by server name. */
+export type McpServerScope = "none" | "all" | ((server: string) => boolean);
+
+/**
+ * The servers a Child Agent's granted tools can reach. A resource tool or a pattern reaches every
+ * server; an `mcp__<namespace>__<tool>` name reaches its server, named as in Pi's `mcpNamespace`.
+ */
+export function childMcpServerScope(grantedTools: readonly string[]): McpServerScope {
+  const mcpTools = grantedTools.filter(isMcpToolName);
+  if (mcpTools.length === 0) return "none";
+  if (mcpTools.some((name) => MCP_RESOURCE_TOOLS.has(name) || name.includes("*"))) return "all";
+  return (server) => {
+    const prefix = `mcp__${server.replace(/-/g, "_")}__`;
+    return mcpTools.some((name) => name.startsWith(prefix));
+  };
+}
+
+type LoadMcpConfig = (options: {
+  agentDir: string;
+  cwd: string;
+  projectTrusted: boolean;
+}) => LoadedMcpConfig;
+
+const McpConfigModuleSchema = Type.Object({
+  loadMcpConfig: Type.Function([Type.Unknown()], Type.Unknown()),
+});
+
+/** Pi's `mcp.json` loader, which Pi does not export; undefined when its file is absent. */
+async function piLoadMcpConfig(): Promise<LoadMcpConfig | undefined> {
+  const path = join(getPackageDir(), "dist", "extensions", "mcp", "config.js");
+  if (!existsSync(path)) return undefined;
+  const module: unknown = await import(pathToFileURL(path).href);
+  if (!Value.Check(McpConfigModuleSchema, module)) return undefined;
+  // SAFETY: the installed Pi's own `loadMcpConfig`, which returns its `LoadedMcpConfig`.
+  return module.loadMcpConfig as LoadMcpConfig;
+}
+
+/**
+ * Pi's MCP extension limited to the servers in `scope`, so a child starts no server it cannot
+ * reach. Without Pi's loader it connects every server, as the root does.
+ */
+function mcpExtension(scope: McpServerScope, agentDir: string): InlineExtension[] {
+  if (scope === "none") return [];
+  const builtin = (factory: ExtensionFactory): InlineExtension[] => [
+    { name: "mcp", factory, builtin: true, replaceable: true },
+  ];
+  if (scope === "all") return builtin(createMcpExtension());
+  return builtin(async (pi) => {
+    const loadMcpConfig = await piLoadMcpConfig();
+    if (!loadMcpConfig) return createMcpExtension()(pi);
+    const loadConfig = (ctx: ExtensionContext) => {
+      const loaded = loadMcpConfig({
+        agentDir,
+        cwd: ctx.cwd,
+        projectTrusted: ctx.isProjectTrusted(),
+      });
+      return { ...loaded, servers: loaded.servers.filter(({ name }) => scope(name)) };
+    };
+    return createMcpExtension({ loadConfig })(pi);
+  });
+}
+
 /** Pi's built-in extensions in Pi's order, so children match the root's built-in surface. */
-export function childBuiltinExtensions(): InlineExtension[] {
+export function childBuiltinExtensions(
+  grantedTools: readonly string[],
+  agentDir: string,
+): InlineExtension[] {
   return [
     ...llamaExtension(),
     {
@@ -72,7 +152,7 @@ export function childBuiltinExtensions(): InlineExtension[] {
       replaceable: true,
     },
     { name: "tool-search", factory: createToolSearchExtension(), builtin: true, replaceable: true },
-    { name: "mcp", factory: createMcpExtension(), builtin: true, replaceable: true },
+    ...mcpExtension(childMcpServerScope(grantedTools), agentDir),
   ];
 }
 
@@ -88,7 +168,7 @@ function createDefaultChildResourceLoaderOptions(
     noContextFiles: false,
     noSkills: false,
     noPromptTemplates: false,
-    extensionFactories: childBuiltinExtensions(),
+    extensionFactories: childBuiltinExtensions(input.grantedTools, input.agentDir),
     extensionsOverride: (base) => ({
       ...base,
       extensions: base.extensions.filter(

package/src/minimal-subagents-sessions.ts

@@ -44,6 +44,7 @@ import {
   CHILD_CODEMODE_MODELS,
   childProviderAvailable,
   createChildResourceLoader,
+  isMcpToolName,
 } from "./minimal-subagents-child-resources.js";
 import {
   CHILD_IDENTITY_ENTRY_TYPE,
@@ -108,17 +109,12 @@ export interface RuntimeToolAdapter {
   readonly replacements: readonly RuntimeToolReplacement[];
 }
 
-const MCP_RESOURCE_TOOL_NAMES = new Set([
-  "list_mcp_resources",
-  "list_mcp_resource_templates",
-  "read_mcp_resource",
-]);
-
-// ponytail: Pi's built-in MCP registers tools only after connecting, so launch checks accept its
-// tool names unverified; a vanished server's tools fail when called instead of at launch.
-function isMcpToolName(toolName: string): boolean {
-  return toolName.startsWith("mcp__") || MCP_RESOURCE_TOOL_NAMES.has(toolName);
-}
+/**
+ * Pi filters MCP tools by a `tools` allowlist only when it names one (`mcp__` prefix); otherwise
+ * every MCP tool stays callable from codemode and tool_search. This entry makes the child's
+ * allowlist always filter them, and matches no tool: MCP tools are `mcp__<server>__<tool>`.
+ */
+const MCP_ALLOWLIST_SENTINEL = "mcp__";
 
 /** Resolve the exact active tools permitted by one Child Agent Launch Contract. */
 export function resolveChildActiveToolNames(
@@ -1205,10 +1201,13 @@ export class PiAgentSessionFactory implements AgentSessionFactory {
         extensionEntrypoint: this.options.extensionEntrypoint,
         systemPromptBlock: this.buildChildSystemPrompt(agent),
         settingsManager,
+        grantedTools: agent.launch_contract.ordinary_tools,
       });
       await resourceLoader.reload();
       for (const extension of resourceLoader.getExtensions().extensions) {
         for (const toolName of extension.tools.keys()) names.add(toolName);
+        // ponytail: Pi's built-in MCP registers tools only after connecting, so launch checks
+        // accept its tool names unverified; a vanished server's tools fail when called instead.
         if (extension.path === "builtin:mcp") {
           for (const toolName of agent.launch_contract.ordinary_tools) {
             if (isMcpToolName(toolName)) names.add(toolName);
@@ -1241,6 +1240,7 @@ export class PiAgentSessionFactory implements AgentSessionFactory {
       extensionEntrypoint: this.options.extensionEntrypoint,
       systemPromptBlock: this.buildChildSystemPrompt(agent),
       settingsManager,
+      grantedTools: agent.launch_contract.ordinary_tools,
     });
     await resourceLoader.reload();
     const modelRuntime = await ModelRuntime.create({
@@ -1266,7 +1266,7 @@ export class PiAgentSessionFactory implements AgentSessionFactory {
       agentDir: this.options.agentDir,
       model,
       thinkingLevel: agent.launch_contract.thinking_level,
-      tools: [...allowedToolNames, ...adapterToolNames],
+      tools: [...allowedToolNames, ...adapterToolNames, MCP_ALLOWLIST_SENTINEL],
       customTools: coordinatorTools,
       resourceLoader,
       sessionManager,