@oh-my-pi/pi-coding-agent 11.8.2 → 11.9.0

package/src/discovery/builtin.ts

@@ -5,6 +5,7 @@
  * .pi is an alias for backwards compatibility.
  */
 import * as path from "node:path";
+import { logger } from "@oh-my-pi/pi-utils";
 import { registerProvider } from "../capability";
 import { type ContextFile, contextFileCapability } from "../capability/context-file";
 import { type Extension, type ExtensionManifest, extensionCapability } from "../capability/extension";
@@ -79,13 +80,60 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 		const expanded = expandEnvVarsDeep(data.mcpServers);
 		for (const [serverName, config] of Object.entries(expanded)) {
 			const serverConfig = config as Record<string, unknown>;
+
+			// Validate enabled: coerce string "true"/"false", warn on other types
+			let enabled: boolean | undefined;
+			if (serverConfig.enabled === undefined || serverConfig.enabled === null) {
+				enabled = undefined;
+			} else if (typeof serverConfig.enabled === "boolean") {
+				enabled = serverConfig.enabled;
+			} else if (typeof serverConfig.enabled === "string") {
+				const lower = serverConfig.enabled.toLowerCase();
+				if (lower === "false" || lower === "0") enabled = false;
+				else if (lower === "true" || lower === "1") enabled = true;
+				else {
+					logger.warn(`MCP server "${serverName}": invalid enabled value "${serverConfig.enabled}", ignoring`);
+					enabled = undefined;
+				}
+			} else {
+				logger.warn(`MCP server "${serverName}": invalid enabled type ${typeof serverConfig.enabled}, ignoring`);
+				enabled = undefined;
+			}
+
+			// Validate timeout: coerce numeric strings, warn on invalid
+			let timeout: number | undefined;
+			if (serverConfig.timeout === undefined || serverConfig.timeout === null) {
+				timeout = undefined;
+			} else if (typeof serverConfig.timeout === "number") {
+				if (Number.isFinite(serverConfig.timeout) && serverConfig.timeout > 0) {
+					timeout = serverConfig.timeout;
+				} else {
+					logger.warn(`MCP server "${serverName}": invalid timeout ${serverConfig.timeout}, ignoring`);
+					timeout = undefined;
+				}
+			} else if (typeof serverConfig.timeout === "string") {
+				const parsed = Number(serverConfig.timeout);
+				if (Number.isFinite(parsed) && parsed > 0) {
+					timeout = parsed;
+				} else {
+					logger.warn(`MCP server "${serverName}": invalid timeout "${serverConfig.timeout}", ignoring`);
+					timeout = undefined;
+				}
+			} else {
+				logger.warn(`MCP server "${serverName}": invalid timeout type ${typeof serverConfig.timeout}, ignoring`);
+				timeout = undefined;
+			}
+
 			result.push({
 				name: serverName,
+				enabled,
+				timeout,
 				command: serverConfig.command as string | undefined,
 				args: serverConfig.args as string[] | undefined,
 				env: serverConfig.env as Record<string, string> | undefined,
 				url: serverConfig.url as string | undefined,
 				headers: serverConfig.headers as Record<string, string> | undefined,
+				auth: serverConfig.auth as { type: "oauth" | "apikey"; credentialId?: string } | undefined,
 				transport: serverConfig.type as "stdio" | "sse" | "http" | undefined,
 				_source: createSourceMeta(PROVIDER_ID, path, level),
 			});

package/src/discovery/codex.ts

@@ -28,7 +28,7 @@ import type { SlashCommand } from "../capability/slash-command";
 import { slashCommandCapability } from "../capability/slash-command";
 import type { CustomTool } from "../capability/tool";
 import { toolCapability } from "../capability/tool";
-import type { LoadContext, LoadResult } from "../capability/types";
+import type { LoadContext, LoadResult, SourceMeta } from "../capability/types";
 import { parseFrontmatter } from "../utils/frontmatter";
 import {
 	createSourceMeta,
@@ -276,8 +276,7 @@ async function loadSlashCommands(ctx: LoadContext): Promise<LoadResult<SlashComm
 	const projectCommandsDir = path.join(codexDir, "commands");
 
 	const transformCommand =
-		(level: "user" | "project") =>
-		(name: string, content: string, path: string, source: ReturnType<typeof createSourceMeta>) => {
+		(level: "user" | "project") => (name: string, content: string, path: string, source: SourceMeta) => {
 			const { frontmatter, body } = parseFrontmatter(content, { source: path });
 			const commandName = frontmatter.name || name.replace(/\.md$/, "");
 			return {
@@ -315,12 +314,7 @@ async function loadPrompts(ctx: LoadContext): Promise<LoadResult<Prompt>> {
 	const codexDir = getProjectCodexDir(ctx);
 	const projectPromptsDir = path.join(codexDir, "prompts");
 
-	const transformPrompt = (
-		name: string,
-		content: string,
-		path: string,
-		source: ReturnType<typeof createSourceMeta>,
-	) => {
+	const transformPrompt = (name: string, content: string, path: string, source: SourceMeta) => {
 		const { frontmatter, body } = parseFrontmatter(content, { source: path });
 		const promptName = frontmatter.name || name.replace(/\.md$/, "");
 		return {
@@ -359,8 +353,7 @@ async function loadHooks(ctx: LoadContext): Promise<LoadResult<Hook>> {
 	const projectHooksDir = path.join(codexDir, "hooks");
 
 	const transformHook =
-		(level: "user" | "project") =>
-		(name: string, _content: string, path: string, source: ReturnType<typeof createSourceMeta>) => {
+		(level: "user" | "project") => (name: string, _content: string, path: string, source: SourceMeta) => {
 			const baseName = name.replace(/\.(ts|js)$/, "");
 			const match = baseName.match(/^(pre|post)-(.+)$/);
 			const hookType = (match?.[1] as "pre" | "post") || "pre";
@@ -402,8 +395,7 @@ async function loadTools(ctx: LoadContext): Promise<LoadResult<CustomTool>> {
 	const projectToolsDir = path.join(codexDir, "tools");
 
 	const transformTool =
-		(level: "user" | "project") =>
-		(name: string, _content: string, path: string, source: ReturnType<typeof createSourceMeta>) => {
+		(level: "user" | "project") => (name: string, _content: string, path: string, source: SourceMeta) => {
 			const toolName = name.replace(/\.(ts|js)$/, "");
 			return {
 				name: toolName,

package/src/discovery/cursor.ts

@@ -20,7 +20,7 @@ import type { Rule } from "../capability/rule";
 import { ruleCapability } from "../capability/rule";
 import type { Settings } from "../capability/settings";
 import { settingsCapability } from "../capability/settings";
-import type { LoadContext, LoadResult } from "../capability/types";
+import type { LoadContext, LoadResult, SourceMeta } from "../capability/types";
 import { parseFrontmatter } from "../utils/frontmatter";
 import {
 	createSourceMeta,
@@ -136,12 +136,7 @@ async function loadRules(ctx: LoadContext): Promise<LoadResult<Rule>> {
 	return { items, warnings };
 }
 
-function transformMDCRule(
-	name: string,
-	content: string,
-	path: string,
-	source: ReturnType<typeof createSourceMeta>,
-): Rule {
+function transformMDCRule(name: string, content: string, path: string, source: SourceMeta): Rule {
 	const { frontmatter, body } = parseFrontmatter(content, { source: path });
 
 	// Extract frontmatter fields

package/src/discovery/mcp-json.ts

@@ -7,6 +7,7 @@
  * Priority: 5 (low, as this is a fallback after tool-specific providers)
  */
 import * as path from "node:path";
+import { logger } from "@oh-my-pi/pi-utils";
 import { registerProvider } from "../capability";
 import { readFile } from "../capability/fs";
 import { type MCPServer, mcpCapability } from "../capability/mcp";
@@ -23,11 +24,17 @@ interface MCPConfigFile {
 	mcpServers?: Record<
 		string,
 		{
+			enabled?: boolean;
+			timeout?: number;
 			command?: string;
 			args?: string[];
 			env?: Record<string, string>;
 			url?: string;
 			headers?: Record<string, string>;
+			auth?: {
+				type: "oauth" | "apikey";
+				credentialId?: string;
+			};
 			type?: "stdio" | "sse" | "http";
 		}
 	>;
@@ -41,13 +48,39 @@ function transformMCPConfig(config: MCPConfigFile, source: SourceMeta): MCPServe
 
 	if (config.mcpServers) {
 		for (const [name, serverConfig] of Object.entries(config.mcpServers)) {
+			// Runtime type validation for user-controlled JSON values
+			let enabled: boolean | undefined;
+			if (serverConfig.enabled !== undefined) {
+				if (typeof serverConfig.enabled === "boolean") {
+					enabled = serverConfig.enabled;
+				} else {
+					logger.warn("MCP server has invalid 'enabled' value, ignoring", { name, value: serverConfig.enabled });
+				}
+			}
+
+			let timeout: number | undefined;
+			if (serverConfig.timeout !== undefined) {
+				if (
+					typeof serverConfig.timeout === "number" &&
+					Number.isFinite(serverConfig.timeout) &&
+					serverConfig.timeout > 0
+				) {
+					timeout = serverConfig.timeout;
+				} else {
+					logger.warn("MCP server has invalid 'timeout' value, ignoring", { name, value: serverConfig.timeout });
+				}
+			}
+
 			const server: MCPServer = {
 				name,
+				enabled,
+				timeout,
 				command: serverConfig.command,
 				args: serverConfig.args,
 				env: serverConfig.env,
 				url: serverConfig.url,
 				headers: serverConfig.headers,
+				auth: serverConfig.auth,
 				transport: serverConfig.type,
 				_source: source,
 			};

package/src/exa/mcp-client.ts

@@ -217,8 +217,8 @@ export async function fetchMCPToolSchema(
  * reducing drift when MCP servers add new parameters.
  */
 export class MCPWrappedTool implements CustomTool<TSchema, ExaRenderDetails> {
-	public readonly name: string;
-	public readonly label: string;
+	readonly name: string;
+	readonly label: string;
 
 	constructor(
 		private readonly config: MCPToolWrapperConfig,

package/src/exa/websets.ts

@@ -3,7 +3,7 @@
  *
  * CRUD operations for websets, items, searches, enrichments, and monitoring.
  */
-import { Type } from "@sinclair/typebox";
+import { type TObject, type TProperties, Type } from "@sinclair/typebox";
 import type { CustomTool } from "../extensibility/custom-tools/types";
 import { callWebsetsTool, findApiKey } from "./mcp-client";
 import type { ExaRenderDetails } from "./types";
@@ -13,7 +13,7 @@ function createWebsetTool(
 	name: string,
 	label: string,
 	description: string,
-	parameters: ReturnType<typeof Type.Object>,
+	parameters: TObject<TProperties>,
 	mcpToolName: string,
 ): CustomTool<any, ExaRenderDetails> {
 	return {

package/src/export/html/index.ts

@@ -3,7 +3,7 @@ import type { AgentState } from "@oh-my-pi/pi-agent-core";
 import { isEnoent } from "@oh-my-pi/pi-utils";
 import { APP_NAME } from "../../config";
 import { getResolvedThemeColors, getThemeExportColors } from "../../modes/theme/theme";
-import { SessionManager } from "../../session/session-manager";
+import { type SessionEntry, type SessionHeader, SessionManager } from "../../session/session-manager";
 // Pre-generated template (created by scripts/generate-template.ts at publish time)
 import { TEMPLATE } from "./template.generated";
 
@@ -92,8 +92,8 @@ async function generateThemeVars(themeName?: string): Promise<string> {
 }
 
 interface SessionData {
-	header: ReturnType<SessionManager["getHeader"]>;
-	entries: ReturnType<SessionManager["getEntries"]>;
+	header: SessionHeader | null;
+	entries: SessionEntry[];
 	leafId: string | null;
 	systemPrompt?: string;
 	tools?: { name: string; description: string }[];

package/src/export/ttsr.ts

@@ -28,29 +28,29 @@ const DEFAULT_SETTINGS: Required<TtsrSettings> = {
 };
 
 export class TtsrManager {
-	private readonly settings: Required<TtsrSettings>;
-	private readonly rules = new Map<string, TtsrEntry>();
-	private readonly injectionRecords = new Map<string, InjectionRecord>();
-	private buffer = "";
-	private messageCount = 0;
+	readonly #settings: Required<TtsrSettings>;
+	readonly #rules = new Map<string, TtsrEntry>();
+	readonly #injectionRecords = new Map<string, InjectionRecord>();
+	#buffer = "";
+	#messageCount = 0;
 
 	constructor(settings?: TtsrSettings) {
-		this.settings = { ...DEFAULT_SETTINGS, ...settings };
+		this.#settings = { ...DEFAULT_SETTINGS, ...settings };
 	}
 
 	/** Check if a rule can be triggered based on repeat settings */
-	private canTrigger(ruleName: string): boolean {
-		const record = this.injectionRecords.get(ruleName);
+	#canTrigger(ruleName: string): boolean {
+		const record = this.#injectionRecords.get(ruleName);
 		if (!record) {
 			return true;
 		}
 
-		if (this.settings.repeatMode === "once") {
+		if (this.#settings.repeatMode === "once") {
 			return false;
 		}
 
-		const gap = this.messageCount - record.lastInjectedAt;
-		return gap >= this.settings.repeatGap;
+		const gap = this.#messageCount - record.lastInjectedAt;
+		return gap >= this.#settings.repeatGap;
 	}
 
 	/** Add a TTSR rule to be monitored */
@@ -59,13 +59,13 @@ export class TtsrManager {
 			return;
 		}
 
-		if (this.rules.has(rule.name)) {
+		if (this.#rules.has(rule.name)) {
 			return;
 		}
 
 		try {
 			const regex = new RegExp(rule.ttsrTrigger);
-			this.rules.set(rule.name, { rule, regex });
+			this.#rules.set(rule.name, { rule, regex });
 			logger.debug("TTSR rule registered", {
 				ruleName: rule.name,
 				pattern: rule.ttsrTrigger,
@@ -83,8 +83,8 @@ export class TtsrManager {
 	check(streamBuffer: string): Rule[] {
 		const matches: Rule[] = [];
 
-		for (const [name, entry] of this.rules) {
-			if (!this.canTrigger(name)) {
+		for (const [name, entry] of this.#rules) {
+			if (!this.#canTrigger(name)) {
 				continue;
 			}
 
@@ -103,24 +103,24 @@ export class TtsrManager {
 	/** Mark rules as injected (won't trigger again until conditions allow) */
 	markInjected(rulesToMark: Rule[]): void {
 		for (const rule of rulesToMark) {
-			this.injectionRecords.set(rule.name, { lastInjectedAt: this.messageCount });
+			this.#injectionRecords.set(rule.name, { lastInjectedAt: this.#messageCount });
 			logger.debug("TTSR rule marked as injected", {
 				ruleName: rule.name,
-				messageCount: this.messageCount,
-				repeatMode: this.settings.repeatMode,
+				messageCount: this.#messageCount,
+				repeatMode: this.#settings.repeatMode,
 			});
 		}
 	}
 
 	/** Get names of all injected rules (for persistence) */
 	getInjectedRuleNames(): string[] {
-		return Array.from(this.injectionRecords.keys());
+		return Array.from(this.#injectionRecords.keys());
 	}
 
 	/** Restore injected state from a list of rule names */
 	restoreInjected(ruleNames: string[]): void {
 		for (const name of ruleNames) {
-			this.injectionRecords.set(name, { lastInjectedAt: 0 });
+			this.#injectionRecords.set(name, { lastInjectedAt: 0 });
 		}
 		if (ruleNames.length > 0) {
 			logger.debug("TTSR injected state restored", { ruleNames });
@@ -129,36 +129,36 @@ export class TtsrManager {
 
 	/** Reset stream buffer (called on new turn) */
 	resetBuffer(): void {
-		this.buffer = "";
+		this.#buffer = "";
 	}
 
 	/** Get current stream buffer */
 	getBuffer(): string {
-		return this.buffer;
+		return this.#buffer;
 	}
 
 	/** Append to stream buffer */
 	appendToBuffer(text: string): void {
-		this.buffer += text;
+		this.#buffer += text;
 	}
 
 	/** Check if any TTSRs are registered */
 	hasRules(): boolean {
-		return this.rules.size > 0;
+		return this.#rules.size > 0;
 	}
 
 	/** Increment message counter (call after each turn) */
 	incrementMessageCount(): void {
-		this.messageCount++;
+		this.#messageCount++;
 	}
 
 	/** Get current message count */
 	getMessageCount(): number {
-		return this.messageCount;
+		return this.#messageCount;
 	}
 
 	/** Get settings */
 	getSettings(): Required<TtsrSettings> {
-		return this.settings;
+		return this.#settings;
 	}
 }

package/src/extensibility/custom-tools/loader.ts

@@ -119,11 +119,11 @@ interface ToolPathWithSource {
 export class CustomToolLoader {
 	tools: LoadedCustomTool[] = [];
 	errors: ToolLoadError[] = [];
-	private sharedApi: CustomToolAPI;
-	private seenNames: Set<string>;
+	#sharedApi: CustomToolAPI;
+	#seenNames: Set<string>;
 
 	constructor(cwd: string, builtInToolNames: string[]) {
-		this.sharedApi = {
+		this.#sharedApi = {
 			cwd,
 			exec: (command: string, args: string[], options?: ExecOptions) =>
 				execCommand(command, args, options?.cwd ?? cwd, options),
@@ -133,12 +133,12 @@ export class CustomToolLoader {
 			typebox,
 			pi: piCodingAgent,
 		};
-		this.seenNames = new Set<string>(builtInToolNames);
+		this.#seenNames = new Set<string>(builtInToolNames);
 	}
 
 	async load(pathsWithSources: ToolPathWithSource[]): Promise<void> {
 		for (const { path: toolPath, source } of pathsWithSources) {
-			const { tools: loadedTools, error } = await loadTool(toolPath, this.sharedApi.cwd, this.sharedApi, source);
+			const { tools: loadedTools, error } = await loadTool(toolPath, this.#sharedApi.cwd, this.#sharedApi, source);
 
 			if (error) {
 				this.errors.push(error);
@@ -148,7 +148,7 @@ export class CustomToolLoader {
 			if (loadedTools) {
 				for (const loadedTool of loadedTools) {
 					// Check for name conflicts
-					if (this.seenNames.has(loadedTool.tool.name)) {
+					if (this.#seenNames.has(loadedTool.tool.name)) {
 						this.errors.push({
 							path: toolPath,
 							error: `Tool name "${loadedTool.tool.name}" conflicts with existing tool`,
@@ -157,7 +157,7 @@ export class CustomToolLoader {
 						continue;
 					}
 
-					this.seenNames.add(loadedTool.tool.name);
+					this.#seenNames.add(loadedTool.tool.name);
 					this.tools.push(loadedTool);
 				}
 			}
@@ -165,8 +165,8 @@ export class CustomToolLoader {
 	}
 
 	setUIContext(uiContext: HookUIContext, hasUI: boolean): void {
-		this.sharedApi.ui = uiContext;
-		this.sharedApi.hasUI = hasUI;
+		this.#sharedApi.ui = uiContext;
+		this.#sharedApi.hasUI = hasUI;
 	}
 }