@piagent/platform 1.2.0 → 1.2.2

package/packages/piagent-core/mcp/mcp-approval-store.js

@@ -68,22 +68,53 @@ export function projectKey(projectPath) {
   }
 }
 
-/** @param {{home?: string}} [options] @returns {Record<string, Record<string, {digest?: string, decision?: string, decidedAt?: string}>>} */
-export function readApprovalStore(options = {}) {
+/**
+ * The store, and whether the empty case means "nothing decided" or "nobody could
+ * read it". Both read as pending, which is the right answer for a gate and the
+ * wrong one for a write: overwriting a store this process could not parse throws
+ * away every decision recorded in it, and the operator's only clue would be that
+ * their other projects silently returned to pending.
+ *
+ * @param {{home?: string}} [options]
+ * @returns {{projects: Record<string, Record<string, {digest?: string, decision?: string, decidedAt?: string}>>, readable: boolean, detail?: string}}
+ */
+export function loadApprovalStore(options = {}) {
   const file = approvalStorePath(options);
-  if (!file) return {};
+  if (!file) return { projects: {}, readable: false, detail: "no home directory to read an approval store from" };
+  let raw;
   try {
     // A store larger than this is not something this code wrote.
-    if (fs.statSync(file).size > MAX_STORE_BYTES) return {};
-    const document = JSON.parse(fs.readFileSync(file, "utf8"));
-    const projects = document?.projects;
-    if (!projects || typeof projects !== "object" || Array.isArray(projects)) return {};
-    return projects;
-  } catch {
-    // An unreadable store denies rather than permits: every server reads as
-    // undecided, which is the state that blocks.
-    return {};
+    if (fs.statSync(file).size > MAX_STORE_BYTES) {
+      return { projects: {}, readable: false, detail: `${file} is larger than ${MAX_STORE_BYTES} bytes` };
+    }
+    raw = fs.readFileSync(file, "utf8");
+  } catch (error) {
+    // Absent is the ordinary state before the first decision.
+    if (error && typeof error === "object" && error.code === "ENOENT") return { projects: {}, readable: true };
+    return { projects: {}, readable: false, detail: `cannot read ${file}` };
   }
+  let document;
+  try {
+    document = JSON.parse(raw);
+  } catch (error) {
+    return { projects: {}, readable: false, detail: `cannot parse ${file}: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const projects = document?.projects;
+  if (projects === undefined && document && typeof document === "object" && !Array.isArray(document)) {
+    // A document with no `projects` key is a store this code did not write.
+    return { projects: {}, readable: false, detail: `${file} has no projects object` };
+  }
+  if (!projects || typeof projects !== "object" || Array.isArray(projects)) {
+    return { projects: {}, readable: false, detail: `${file} has no projects object` };
+  }
+  return { projects, readable: true };
+}
+
+/** @param {{home?: string}} [options] @returns {Record<string, Record<string, {digest?: string, decision?: string, decidedAt?: string}>>} */
+export function readApprovalStore(options = {}) {
+  // An unreadable store denies rather than permits: every server reads as
+  // undecided, which is the state that blocks.
+  return loadApprovalStore(options).projects;
 }
 
 /**
@@ -139,7 +170,12 @@ export function approvalState(options) {
  * @returns {boolean}
  */
 export function recordApproval(options) {
-  const store = readApprovalStore({ home: options.home });
+  const loaded = loadApprovalStore({ home: options.home });
+  // Writing on top of a store nobody could parse would drop every decision it
+  // holds -- including the ones for other projects, which the operator would
+  // find out about only by watching them go back to pending one at a time.
+  if (!loaded.readable) return false;
+  const store = loaded.projects;
   const key = projectKey(options.projectPath);
   const project = { ...(store[key] ?? {}) };
   project[options.name] = {
@@ -159,9 +195,14 @@ export function recordApproval(options) {
  * @returns {boolean}
  */
 export function clearApproval(options) {
-  const store = readApprovalStore({ home: options.home });
+  const loaded = loadApprovalStore({ home: options.home });
+  if (!loaded.readable) return false;
+  const store = loaded.projects;
   const key = projectKey(options.projectPath);
-  if (!store[key]) return false;
+  // Nothing recorded is the state this function exists to reach, so it succeeds.
+  // Returning false here would be indistinguishable from a failed write, and the
+  // caller has to be able to tell those apart.
+  if (!store[key]) return true;
   if (!options.name) {
     const { [key]: _removed, ...rest } = store;
     return writeApprovalStore(rest, { home: options.home });

package/packages/piagent-core/mcp/mcp-auth-readiness.js

@@ -40,6 +40,14 @@ export function referencedEnvVars(entry) {
   walk(entry, (text) => {
     for (const match of text.matchAll(ENV_REFERENCE)) names.add(match[1]);
   });
+  // `bearerTokenEnvVar` names its variable directly instead of through a
+  // `${VAR}` reference, which is the entire point of the field: the token must
+  // not appear in the config. The walk above only recognises the reference form,
+  // so without this the one server setting that guarantees a credential is
+  // needed was the one setting that never produced a needs-env.
+  if (typeof entry?.bearerTokenEnvVar === "string" && entry.bearerTokenEnvVar.trim()) {
+    names.add(entry.bearerTokenEnvVar.trim());
+  }
   return [...names].sort();
 }
 
@@ -96,7 +104,17 @@ function isExecutable(file) {
  */
 
 /**
- * @param {{name: string, scope: string, entry: Record<string, unknown>}} server
+ * The import kind a server arrived through, or undefined when the layer named
+ * it directly.
+ * @param {{origin?: string}} server
+ * @returns {string|undefined}
+ */
+function importedFrom(server) {
+  return server.origin?.startsWith("import:") ? server.origin.slice("import:".length) : undefined;
+}
+
+/**
+ * @param {{name: string, scope: string, entry: Record<string, unknown>, requiresApproval?: boolean, origin?: string}} server
  * @param {{projectPath: string, env?: Record<string, string|undefined>, home?: string, store?: Record<string, unknown>}} options
  * @returns {ServerReadiness}
  */
@@ -108,7 +126,12 @@ export function evaluateServerReadiness(server, options) {
     return { ...base, state: "disabled", detail: "disabled in config", remedy: `piagent-mcp enable ${server.name} --scope ${server.scope}` };
   }
 
-  if (REPOSITORY_SCOPES.has(server.scope)) {
+  // `collectServers` decides this, because the scope a server is listed under
+  // is not the same question as who put it there: a `global` config importing
+  // a repository-relative kind reads its definitions out of the clone. Falling
+  // back to scope keeps a caller that builds a server record by hand working.
+  const needsApproval = server.requiresApproval ?? REPOSITORY_SCOPES.has(server.scope);
+  if (needsApproval) {
     const approval = approvalState({
       projectPath: options.projectPath,
       name: server.name,
@@ -131,7 +154,12 @@ export function evaluateServerReadiness(server, options) {
       return {
         ...base,
         state: "pending-approval",
-        detail: `defined by this repository in ${server.scope} scope and not approved here`,
+        // Naming the scope alone reads as a lie for an imported server: the
+        // scope is where the `imports` key sits, and the definition is in a
+        // different file entirely. Say which of the two it was.
+        detail: importedFrom(server)
+          ? `imported from ${importedFrom(server)} config by the ${server.scope} layer, and not approved here`
+          : `defined by this repository in ${server.scope} scope and not approved here`,
         remedy: `piagent-mcp approve ${server.name}`
       };
     }

package/packages/piagent-core/mcp/mcp-command-actions.js

@@ -1,14 +1,21 @@
-import { REPOSITORY_SCOPES, collectServers, isRecord, readMcpConfig, writeMcpConfig } from "./mcp-config-layers.js";
-import { approvalState, clearApproval, recordApproval } from "./mcp-approval-store.js";
+import {
+  REPOSITORY_SCOPES,
+  collectServers,
+  isRecord,
+  mergedServerEntry,
+  readMcpConfig,
+  writeMcpConfig
+} from "./mcp-config-layers.js";
+import { approvalStorePath, approvalState, clearApproval, recordApproval } from "./mcp-approval-store.js";
 import { maskServerEntry } from "./mcp-server-entry.js";
 import {
   McpViewError,
-  blockedRows,
   collectServerRows,
   describeServer,
   formatDoctorReport,
   formatServerDetail,
-  formatServerTable
+  formatServerTable,
+  sessionMcpState
 } from "./mcp-session-view.js";
 
 // What `/piagent-mcp` does, separated from how a session shows it.
@@ -58,9 +65,14 @@ export const HELP_LINES = [
  * @param {{projectPath: string}} options
  */
 export function menuOptions(options) {
-  const rows = collectServerRows({ projectPath: options.projectPath });
-  const stuck = blockedRows(rows);
-  const repositoryRows = rows.filter((row) => REPOSITORY_SCOPES.has(row.scope));
+  const state = sessionMcpState({ projectPath: options.projectPath });
+  const { rows, blocked: stuck } = state;
+  // Not `REPOSITORY_SCOPES.has(row.scope)`: a repository-relative import
+  // declared by a `global` config produces a row whose scope is `global` and
+  // whose definition came out of the clone. Those were the rows the menu never
+  // offered to approve, so the only route to a decision was knowing to type the
+  // subcommand -- for exactly the servers whose origin is hardest to see.
+  const repositoryRows = rows.filter((row) => row.requiresApproval);
   const decisions = repositoryRows.map((row) => ({
     row,
     state: approvalState({ projectPath: options.projectPath, name: row.name, entry: row.entry }).state
@@ -73,11 +85,24 @@ export function menuOptions(options) {
   const entries = [
     {
       value: "status",
-      label: rows.length === 0 ? "Servers — none configured" : `Servers — ${rows.length - stuck.length}/${rows.length} ready`,
-      description: "Every server visible from this project, with its scope and state"
+      label: state.usable
+        ? (rows.length === 0 ? "Servers — none configured" : `Servers — ${rows.length - stuck.length}/${rows.length} ready`)
+        : "Servers — every tool call blocked",
+      description: state.usable
+        ? "Every server visible from this project, with its scope and state"
+        : "Config here leaves nothing to check an approval against"
     }
   ];
-  if (stuck.length > 0) {
+  // Ahead of everything per-server: while this stands, no decision about an
+  // individual server changes whether anything runs.
+  if (!state.usable) {
+    entries.push({
+      value: "doctor",
+      label: `Doctor — ${state.blockingConfig.length} config problem${state.blockingConfig.length === 1 ? "" : "s"} blocking every call`,
+      description: "Which file to edit before any server can answer",
+      recommended: true
+    });
+  } else if (stuck.length > 0) {
     entries.push({
       value: "doctor",
       label: `Doctor — ${stuck.length} need attention`,
@@ -125,7 +150,13 @@ export function serverChoices(options) {
   const { projectPath, action } = options;
   const rows = collectServerRows({ projectPath });
   const filtered = rows.filter((row) => {
-    if (action === "approve" || action === "reject" || action === "reset") return REPOSITORY_SCOPES.has(row.scope);
+    if (action === "approve" || action === "reject" || action === "reset") return row.requiresApproval;
+    // A server reached through `imports` lives in a file this command does not
+    // own. Offering it here produced a write against the declaring layer that
+    // reported success and changed nothing the adapter reads.
+    if (action === "enable" || action === "disable") {
+      if (row.origin?.startsWith("import:")) return false;
+    }
     if (action === "enable") return row.readiness.state === "disabled";
     if (action === "disable") return row.readiness.state !== "disabled";
     return true;
@@ -139,19 +170,43 @@ export function serverChoices(options) {
 
 /** @param {{projectPath: string, scope?: string}} options */
 export function status(options) {
-  const rows = collectServerRows({ projectPath: options.projectPath, scopes: options.scope ? [options.scope] : undefined });
-  const stuck = blockedRows(rows);
+  const state = sessionMcpState({
+    projectPath: options.projectPath,
+    scopes: options.scope ? [options.scope] : undefined
+  });
+  const { rows, blocked: stuck } = state;
+  // Reported before the per-server table, and it decides the headline. A status
+  // that says "0 servers configured" in a session where every tool call is being
+  // refused is not a smaller version of the truth, it points at the wrong file.
+  const blocking = state.blockingConfig.map((problem) => `BLOCKED every tool call: ${problem.detail}`);
+  const summary = !state.usable
+    ? "MCP: every tool call blocked by config"
+    : rows.length === 0
+      ? "MCP: no servers configured"
+      : `MCP: ${rows.length - stuck.length}/${rows.length} ready`;
   return {
-    notify: {
-      message: rows.length === 0 ? "MCP: no servers configured" : `MCP: ${rows.length - stuck.length}/${rows.length} ready`,
-      level: stuck.length > 0 ? "warning" : "info"
-    },
-    lines: rows.length === 0
-      ? ["No MCP servers configured.", "Seed the pinned baseline in a terminal: piagent-mcp --preset core --scope global"]
-      : [formatServerTable(rows), ...(stuck.length > 0 ? ["", `${stuck.length} not usable yet. Run /piagent-mcp doctor.`] : [])],
+    notify: { message: summary, level: state.usable && stuck.length === 0 ? "info" : "warning" },
+    lines: [
+      ...blocking,
+      ...(blocking.length > 0 ? [""] : []),
+      ...(rows.length === 0
+        ? (state.usable
+          ? ["No MCP servers configured.", "Seed the pinned baseline in a terminal: piagent-mcp --preset core --scope global"]
+          : [])
+        : [formatServerTable(rows), ...(stuck.length > 0 ? ["", `${stuck.length} not usable yet. Run /piagent-mcp doctor.`] : [])])
+    ],
     details: {
       project: options.projectPath,
-      servers: rows.map((row) => ({ name: row.name, scope: row.scope, state: row.readiness.state, detail: row.readiness.detail }))
+      usable: state.usable,
+      blockingConfig: state.blockingConfig,
+      servers: rows.map((row) => ({
+        name: row.name,
+        scope: row.scope,
+        origin: row.origin,
+        requiresApproval: row.requiresApproval,
+        state: row.readiness.state,
+        detail: row.readiness.detail
+      }))
     }
   };
 }
@@ -179,18 +234,38 @@ export function detail(options) {
  * @param {{projectPath: string}} options
  */
 export function doctor(options) {
-  const rows = collectServerRows({ projectPath: options.projectPath });
-  const report = formatDoctorReport(rows, { rerun: "/piagent-mcp doctor", inSession: true });
+  const state = sessionMcpState({ projectPath: options.projectPath });
+  const report = formatDoctorReport(state.rows, { rerun: "/piagent-mcp doctor", inSession: true });
+  // A layer nobody can parse counts as a problem: it is hiding whatever it
+  // defines. An import declaration does not — the servers it brings in are in
+  // the table above with their own approval state — but it is named, because
+  // reading the repository's config alone would not reveal where they came from.
+  const problems = report.problems + state.unreadable.length + state.blockingConfig.length;
   return {
     notify: {
-      message: report.problems === 0 ? "MCP: every server can be reached" : `MCP: ${report.problems} need attention`,
-      level: report.problems === 0 ? "info" : "warning"
+      message: problems === 0 ? "MCP: every server can be reached" : `MCP: ${problems} need attention`,
+      level: problems === 0 ? "info" : "warning"
     },
     lines: [
+      // First. No per-server remedy below is worth acting on while one of these
+      // stands, because none of them makes a tool call succeed.
+      ...state.blockingConfig.map((problem) => `BLOCKED every tool call: ${problem.detail}`),
+      ...(state.blockingConfig.length > 0 ? [""] : []),
       ...report.lines,
-      ...(report.problems === 0 ? [] : ["", "The Docker daemon check is terminal-only: piagent-mcp doctor"])
+      ...state.unreadable.map((layer) => `Unreadable ${layer.scope} config: ${layer.detail}`),
+      ...state.imports.map((layer) =>
+        `${layer.file} imports servers from ${layer.kinds.join(", ")} config; ` +
+        "they need approval here like any server the repository defines."),
+      ...(problems === 0 ? [] : ["", "The Docker daemon check is terminal-only: piagent-mcp doctor"])
     ],
-    details: { project: options.projectPath, problems: report.problems }
+    details: {
+      project: options.projectPath,
+      problems,
+      usable: state.usable,
+      blockingConfig: state.blockingConfig,
+      unreadableLayers: state.unreadable.map((layer) => layer.scope),
+      repositoryImports: state.imports.map((layer) => ({ scope: layer.scope, kinds: layer.kinds }))
+    }
   };
 }
 
@@ -211,10 +286,23 @@ export function decide(options) {
   const before = approvalState({ projectPath, name, entry: server.entry });
   // Approving without reading it is the failure this gate exists to prevent, so
   // the definition is put in front of the operator alongside the decision.
+  //
+  // What is shown is the merged entry, not this layer's fragment. The adapter
+  // merges a same-named server key by key across layers, so a repository that
+  // declares only `{"args": ["--evil"]}` gets the command from a lower layer --
+  // and a preview of the fragment showed the operator an argument list with no
+  // command attached while consenting to a full command line.
   const preview = decision === "approved" && before.state !== "approved"
-    ? [JSON.stringify(maskServerEntry(server.entry), null, 2), ""]
+    ? [JSON.stringify(maskServerEntry(mergedServerEntry({ projectPath, name, entry: server.entry })), null, 2), ""]
     : [];
-  recordApproval({ projectPath, name, entry: server.entry, decision });
+  // A decision that was not written is not a decision. Reporting success here
+  // would leave the operator believing a server is approved while the gate keeps
+  // blocking it, or worse, believing one is rejected while nothing recorded it.
+  if (!recordApproval({ projectPath, name, entry: server.entry, decision })) {
+    throw new McpViewError(
+      `could not write ${approvalStorePath() ?? "the approval store"}; ${name} is still ${before.state}`
+    );
+  }
   const after = approvalState({ projectPath, name, entry: server.entry });
   return {
     notify: { message: `MCP ${name}: ${decision}`, level: "info" },
@@ -231,7 +319,9 @@ export function decide(options) {
 /** @param {{projectPath: string, name?: string}} options */
 export function reset(options) {
   const { projectPath, name } = options;
-  clearApproval({ projectPath, name });
+  if (!clearApproval({ projectPath, name })) {
+    throw new McpViewError(`could not write ${approvalStorePath() ?? "the approval store"}; nothing was forgotten`);
+  }
   return {
     notify: { message: name ? `MCP ${name}: decision forgotten` : "MCP: all decisions forgotten", level: "info" },
     lines: [name
@@ -241,10 +331,29 @@ export function reset(options) {
   };
 }
 
+/**
+ * A server this command has no file of its own to edit: it was read out of
+ * another tool's config through `imports`. The write used to land in whichever
+ * layer declared the import, where the adapter never looks for it, so the
+ * command reported the server disabled and the next tool call still reached it.
+ *
+ * @param {{name: string, origin?: string, scope: string, file: string}} found
+ * @param {string} action
+ */
+function assertOwnedByThisTool(found, action) {
+  if (!found.origin?.startsWith("import:")) return;
+  const kind = found.origin.slice("import:".length);
+  throw new McpViewError(
+    `${found.name} is not defined by any config this command owns. The ${found.scope} config imports ${kind}, ` +
+    `and the definition lives in ${found.file}. Edit that file to ${action} it, or drop "${kind}" from the imports list.`
+  );
+}
+
 /** @param {{projectPath: string, name: string, scope?: string, enabled: boolean}} options */
 export function toggle(options) {
   const { projectPath, name, scope, enabled } = options;
   const found = describeServer({ projectPath, name, scope, listHint: "/piagent-mcp", scopeHint: "--scope" });
+  assertOwnedByThisTool(found, enabled ? "enable" : "disable");
   const config = readMcpConfig(found.file);
   const entry = { ...(isRecord(config.mcpServers[name]) ? config.mcpServers[name] : {}) };
   if (enabled) delete entry.enabled;