@piagent/platform 1.2.0 → 1.2.2

package/packages/piagent-core/mcp/mcp-server-entry.js

@@ -202,6 +202,24 @@ export function parseRemoteUrl(value) {
   } catch {
     throw new McpEntryError(`--url is not a valid URL: ${value}`);
   }
+  // The same rule the rest of this file applies to `--env` and `--header`. An
+  // address is not a safer place to keep a token than a header is: it goes into
+  // the same committed file, and it additionally tends to reach request logs and
+  // shell history. The refusal is masked so the error itself does not repeat it.
+  if (url.username || url.password) {
+    throw new McpEntryError(
+      "--url must not carry credentials in the address. Use --bearer-token-env-var, " +
+      `or --header with a \${VAR} reference. Received: ${maskUrlCredentials(url.href)}`
+    );
+  }
+  for (const [name, item] of url.searchParams) {
+    if (credentialLikeName(name) && !ENV_REFERENCE.test(item)) {
+      throw new McpEntryError(
+        `--url query parameter ${name} looks like a credential. Use --bearer-token-env-var, ` +
+        `or give it a \${VAR} reference.`
+      );
+    }
+  }
   if (url.protocol === "https:") return url;
   if (url.protocol === "http:" && isLoopbackHost(url.hostname)) return url;
   throw new McpEntryError(
@@ -209,6 +227,35 @@ export function parseRemoteUrl(value) {
   );
 }
 
+/**
+ * A URL with anything credential-shaped in it replaced. `add` refuses to write
+ * such a URL, but a config written by hand or by an older version can still hold
+ * one, and display is exactly where it would leak: `list` and `get` output is
+ * meant to be pasteable into an issue.
+ *
+ * A value that does not parse as a URL is returned untouched. Guessing at the
+ * structure of something that is not a URL would be a way to mangle a value
+ * without protecting anything.
+ *
+ * @param {unknown} value
+ * @returns {unknown}
+ */
+export function maskUrlCredentials(value) {
+  if (typeof value !== "string") return value;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return value;
+  }
+  if (url.password) url.password = "*****";
+  if (url.username) url.username = "*****";
+  for (const [name, item] of [...url.searchParams]) {
+    if (credentialLikeName(name) && !ENV_REFERENCE.test(item)) url.searchParams.set(name, "*****");
+  }
+  return url.href;
+}
+
 /** @param {string} hostname @returns {boolean} */
 function isLoopbackHost(hostname) {
   const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
@@ -236,6 +283,10 @@ export function maskServerEntry(entry) {
       );
       continue;
     }
+    if (key === "url") {
+      out[key] = maskUrlCredentials(value);
+      continue;
+    }
     out[key] = value;
   }
   return out;

package/packages/piagent-core/mcp/mcp-session-view.js

@@ -1,6 +1,12 @@
-import { REPOSITORY_SCOPES, SCOPES, collectServers } from "./mcp-config-layers.js";
+import {
+  SCOPES,
+  collectServers,
+  repositoryImportDeclarations,
+  unreadableLayers,
+  unverifiableMcpConfig
+} from "./mcp-config-layers.js";
 import { approvalState } from "./mcp-approval-store.js";
-import { maskServerEntry } from "./mcp-server-entry.js";
+import { maskServerEntry, maskUrlCredentials } from "./mcp-server-entry.js";
 import { evaluateServerReadiness } from "./mcp-auth-readiness.js";
 import { CATALOG_PREREQUISITES } from "./mcp-server-catalog.js";
 
@@ -24,7 +30,9 @@ export class McpViewError extends Error {}
  * @returns {string}
  */
 export function describeTarget(entry, limit = 56) {
-  if (typeof entry.url === "string") return entry.url;
+  // Masked here as well as in the detail view. This is the string that goes in
+  // the `list` table, which is the output most likely to be screenshotted.
+  if (typeof entry.url === "string") return String(maskUrlCredentials(entry.url));
   const argv = [entry.command, ...(Array.isArray(entry.args) ? entry.args : [])].filter((item) => typeof item === "string");
   const text = argv.join(" ");
   return text.length > limit ? `${text.slice(0, limit - 3)}...` : text;
@@ -58,6 +66,39 @@ export function blockedRows(rows) {
   return rows.filter((row) => row.readiness.state !== "ready" && row.readiness.state !== "oauth");
 }
 
+/**
+ * Everything any surface needs to answer "what is MCP doing here right now".
+ *
+ * The three surfaces — the guard, `/piagent-mcp`, and the terminal CLI — used to
+ * assemble this themselves out of four separate calls, and each one picked a
+ * different subset. That is how `list` came to print "No MCP servers configured"
+ * and exit 0 in a session where the guard was refusing every tool call: the
+ * listing was reading rows, and the thing that made the answer wrong was not a
+ * row. Everything that decides whether MCP works is gathered here once.
+ *
+ * `blockingConfig` is the part that outranks per-server state. While any of it
+ * stands, no server is usable whatever its own readiness says, so a caller that
+ * reports readiness without reporting this is giving an answer that is locally
+ * true and globally wrong.
+ *
+ * @param {{projectPath: string, scopes?: string[]}} options
+ */
+export function sessionMcpState(options) {
+  const { projectPath, scopes } = options;
+  const rows = collectServerRows({ projectPath, scopes });
+  const blockingConfig = unverifiableMcpConfig({ projectPath });
+  return {
+    rows,
+    blocked: blockedRows(rows),
+    blockingConfig,
+    unreadable: unreadableLayers({ projectPath }),
+    imports: repositoryImportDeclarations({ projectPath }),
+    // One boolean rather than each caller re-deriving the rule. `list --json`
+    // read `servers: []` as success while this was true.
+    usable: blockingConfig.length === 0
+  };
+}
+
 /**
  * One named server, resolved to a single scope. `listHint` is the caller's own
  * way of listing servers, so the error names a command the reader can actually
@@ -81,7 +122,11 @@ export function describeServer(options) {
     );
   }
   const row = matches[0];
-  const approval = REPOSITORY_SCOPES.has(row.scope)
+  // `requiresApproval`, not the scope. A server imported into a `global` config
+  // from a repository-relative kind carries the scope of the file that declared
+  // the import and still needs a decision here, so keying off the scope showed
+  // no approval line for exactly the servers whose approval is least obvious.
+  const approval = row.requiresApproval
     ? approvalState({ projectPath, name, entry: row.entry })
     : undefined;
   return { ...row, masked: maskServerEntry(row.entry), approval };
@@ -134,6 +179,12 @@ export function formatServerDetail(detail, options = {}) {
     detail.name,
     `  scope: ${detail.scope}`,
     `  file: ${detail.file}`,
+    // Only for a server that came through `imports`. Without it the `scope` and
+    // `file` lines read as a config this tool can edit, and every write command
+    // suggested against them fails or edits the wrong file.
+    ...(detail.origin?.startsWith("import:")
+      ? [`  origin: ${detail.origin} (declared by the ${detail.scope} config; edit ${detail.file} directly)`]
+      : []),
     `  transport: ${detail.transport}`
   ];
   for (const key of DETAIL_FIELDS) {

package/packages/piagent-core/mcp/mcp-tool-naming.js

@@ -0,0 +1,90 @@
+// How the adapter names the tools it exposes, mirrored here so a tool call can
+// be traced back to the server behind it.
+//
+// The adapter builds a prefix from the server name and joins it to the tool name
+// with an underscore. With the default `toolPrefix: "server"` a server called
+// `github` exposes `github_create_issue`. There is no `mcp__` anywhere in that
+// scheme, which is why a gate written against `mcp__<server>__<tool>` never
+// fired: it was watching for a name shape nothing produces.
+//
+// `none` is the case with no answer. It strips the prefix entirely, so the tool
+// arrives under whatever name the server gave it and carries no evidence of
+// where it came from. Attribution is impossible by construction, which makes the
+// combination of that setting with `directTools` in a repository-carried config
+// something to refuse rather than something to parse.
+
+/** Prefix modes the adapter accepts. */
+export const TOOL_PREFIX_MODES = new Set(["server", "none", "short"]);
+
+/**
+ * The prefix a server's tools carry under one mode, matching the adapter's own
+ * derivation. An empty string means the mode erases the origin.
+ * @param {string} serverName
+ * @param {string} mode
+ * @returns {string}
+ */
+export function serverPrefix(serverName, mode) {
+  if (mode === "none") return "";
+  if (mode === "short") {
+    const short = serverName.replace(/-?mcp$/i, "").replace(/-/g, "_");
+    return short || "mcp";
+  }
+  return serverName.replace(/-/g, "_");
+}
+
+/**
+ * Every prefix a server's tools could arrive under. All prefixing modes are
+ * covered rather than just the configured one, because the setting lives in the
+ * same file as the servers: a repository that wants a different mode can simply
+ * declare it, so trusting the declared value to decide what to inspect would
+ * hand the choice back to the thing being gated.
+ * @param {string} serverName
+ * @returns {string[]}
+ */
+export function serverPrefixes(serverName) {
+  const prefixes = new Set();
+  for (const mode of ["server", "short"]) {
+    const prefix = serverPrefix(serverName, mode);
+    if (prefix) prefixes.add(prefix);
+  }
+  return [...prefixes];
+}
+
+/**
+ * Which of the given servers exposes this tool, or undefined when the name
+ * carries no prefix belonging to any of them.
+ *
+ * The longest match wins. Servers named `db` and `db_admin` both prefix
+ * `db_admin_query`, and answering `db` there would check the wrong server's
+ * approval — the more specific prefix is the one that actually produced it.
+ *
+ * @param {string} toolName
+ * @param {Iterable<string>} serverNames
+ * @returns {string|undefined}
+ */
+export function attributeDirectTool(toolName, serverNames) {
+  if (typeof toolName !== "string" || toolName.length === 0) return undefined;
+  let best;
+  let bestLength = 0;
+  for (const name of serverNames) {
+    for (const prefix of serverPrefixes(name)) {
+      if (prefix.length <= bestLength) continue;
+      if (!toolName.startsWith(`${prefix}_`)) continue;
+      best = name;
+      bestLength = prefix.length;
+    }
+  }
+  return best;
+}
+
+/**
+ * Whether a config's settings put tools on the model under names that cannot be
+ * traced to a server. Both halves are required: without `directTools` every call
+ * goes through the proxy, which names its server explicitly.
+ * @param {Record<string, unknown>} settings
+ * @returns {boolean}
+ */
+export function erasesToolOrigin(settings) {
+  if (!settings || typeof settings !== "object") return false;
+  return settings.directTools === true && settings.toolPrefix === "none";
+}

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/prompts/be-to-fe.md

@@ -63,6 +63,7 @@ Mandatory flow:
 16. Run the exact FE verify command from the profile/task through Pi bash and record the observed result with `piagent_verify_record`. Ad-hoc commands are advisory only and will not satisfy the passing gate.
 17. Record handoff with `piagent_trace_record`.
 18. Call `piagent_task_gate_check`; if it fails, report blocked/partial instead of done.
+19. Do not paste full test/build/tool logs into chat or final output. Summarize the signal, quote only relevant failing lines, and use `/piagent-logs` or a narrower command when oversized output has been compacted.
 
 For generic projects, use profile `be-readonly-fe` when the repo policy is “BE scout only, FE write allowed”.
 

package/packages/piagent-core/prompts/piagent-commands.md

@@ -34,6 +34,7 @@ Mandatory flow:
 9. Explain context overflow prevention when relevant:
    - `/task-preflight` checks whether to proceed, compact, or fresh-session.
    - `/fresh-task`, `/fresh-scout`, and `/fresh-be-to-fe` open a new governed session and replay the compact workflow prompt.
+   - `/piagent-logs` shows compact-log policy and recent oversized tool-output captures without a model follow-up.
    - `/scout` is the read-only audit/scout workflow.
    - `/context-index` shows the compact advisory project context graph without a model follow-up.
    - `/context-index search <keyword>` searches profile/project/tech/task pointers before broad re-scouting.

package/packages/piagent-core/prompts/platform-improve.md

@@ -42,6 +42,7 @@ Mandatory flow:
 12. Implement only the bounded target behavior.
 13. If runtime behavior changes, update README/docs and add/adjust a decision note when appropriate.
 14. For source-changing tasks, run the exact verify command from `task.verifyCommands` through Pi bash, record observed verify evidence, trace, then call `piagent_task_gate_check` before final.
+15. Do not paste full test/build/tool logs into chat or final output. Summarize the signal, quote only relevant failing lines, and use `/piagent-logs` or a narrower command when oversized output has been compacted.
 
 Default verification:
 

package/packages/piagent-core/prompts/review.md

@@ -26,6 +26,7 @@ Rules:
    - security/high-risk only when relevant.
    If the user asks for a loop, use `/review-loop` semantics or equivalent parent-controlled max-round loop. Continue single-agent for tiny diffs or unavailable subagent tooling.
 9. Report findings by severity.
+10. Do not paste full diff/test/tool logs into chat or final output. Summarize the signal, quote only relevant lines, and use `/piagent-logs` or narrower commands when oversized output has been compacted.
 
 Output:
 

package/packages/piagent-core/prompts/scout.md

@@ -34,6 +34,7 @@ Preflight first:
 12. Run the exact verify command from the task contract and record with `piagent_verify_record`.
 13. Record handoff with `piagent_trace_record`.
 14. Call `piagent_task_gate_check`. If the gate fails, report partial/blocked.
+15. Do not paste full tool/test logs into chat or final output. Summarize the signal, quote only relevant lines, and use `/piagent-logs` or a narrower command when oversized output has been compacted.
 
 Output:
 

package/packages/piagent-core/prompts/task.md

@@ -52,6 +52,7 @@ Mandatory flow:
 16. Call `piagent_task_gate_check`. If gate fails, final outcome is blocked/partial, not done.
 17. If the user asks about token/context/cost usage, call `piagent_usage_snapshot`; for exact token/cost totals, tell the user to run `/session` or `piagent-usage <project-path>`.
 18. If verify cannot run, stop and report the exact blocker. Do not call it done.
+19. Do not paste full test/build/tool logs into chat or final output. Summarize the signal, quote only the relevant failing lines, and use `/piagent-logs` or a narrower command when oversized output has been compacted.
 
 Do not ask the user to paste this mandatory flow. The platform prompt already contains it. If the user pasted the full flow, treat it as boilerplate and extract only the task request.
 

package/scripts/configure-model-scope.sh

@@ -34,18 +34,34 @@ DEFAULT_MODEL="openai-codex/gpt-5.5:xhigh"
 SETTINGS_PATH="${PI_CODING_AGENT_DIR:-"${HOME}/.pi/agent"}/settings.json"
 DRY_RUN=false
 
+# A flag whose value is missing swallows the next flag instead. `--settings
+# --dry-run` used to set the settings path to the string "--dry-run", leave
+# DRY_RUN false, then write a file by that name and report success — a run that
+# both skipped the dry run it was asked for and never touched the real settings.
+require_value() {
+  local option="$1"
+  local value="${2:-}"
+  if [[ -z "$value" || "$value" == --* ]]; then
+    echo "Missing value for $option" >&2
+    exit 2
+  fi
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --preset)
-      PRESET="${2:-}"
+      require_value "$1" "${2:-}"
+      PRESET="$2"
       shift 2
       ;;
     --default-model)
-      DEFAULT_MODEL="${2:-}"
+      require_value "$1" "${2:-}"
+      DEFAULT_MODEL="$2"
       shift 2
       ;;
     --settings)
-      SETTINGS_PATH="${2:-}"
+      require_value "$1" "${2:-}"
+      SETTINGS_PATH="$2"
       shift 2
       ;;
     --dry-run)

package/scripts/configure-subagents.sh

@@ -38,22 +38,35 @@ MODEL_SCOPE="none"
 DRY_RUN=false
 LIST=false
 
+require_value() {
+  local option="$1"
+  local value="${2:-}"
+  if [[ -z "$value" || "$value" == --* ]]; then
+    echo "Missing value for $option" >&2
+    exit 2
+  fi
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --preset)
-      PRESET="${2:-}"
+      require_value "$1" "${2:-}"
+      PRESET="$2"
       shift 2
       ;;
     --config)
-      CONFIG_PATH="${2:-}"
+      require_value "$1" "${2:-}"
+      CONFIG_PATH="$2"
       shift 2
       ;;
     --settings)
-      SETTINGS_PATH="${2:-}"
+      require_value "$1" "${2:-}"
+      SETTINGS_PATH="$2"
       shift 2
       ;;
     --model-scope)
-      MODEL_SCOPE="${2:-}"
+      require_value "$1" "${2:-}"
+      MODEL_SCOPE="$2"
       shift 2
       ;;
     --dry-run)

package/scripts/init-project.sh

@@ -49,21 +49,28 @@ FORCE_SETTINGS=false
 SKIP_AGENTS=false
 SKIP_REVIEW=false
 
+# Checking only that a value is present lets the next flag serve as the value.
+# `--profile --force-profile` used to name a profile "--force-profile" and leave
+# the force off, so init failed on an unknown profile while the flag the operator
+# actually typed went nowhere.
+require_value() {
+  local option="$1"
+  local value="${2:-}"
+  if [[ -z "$value" || "$value" == --* ]]; then
+    echo "Missing value for $option" >&2
+    exit 2
+  fi
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --profile)
-      if [[ $# -lt 2 ]]; then
-        echo "Missing value for --profile" >&2
-        exit 2
-      fi
+      require_value "$1" "${2:-}"
       PROFILE_INPUT="$2"
       shift 2
       ;;
     --package-source)
-      if [[ $# -lt 2 ]]; then
-        echo "Missing value for --package-source" >&2
-        exit 2
-      fi
+      require_value "$1" "${2:-}"
       PACKAGE_SOURCE="$2"
       shift 2
       ;;