@piagent/platform 1.2.8 → 1.2.10

package/packages/piagent-core/mcp/mcp-config-layers.js

@@ -8,7 +8,7 @@ import {
   importedServers,
   unreadableImportTargets
 } from "./mcp-import-kinds.js";
-import { erasesToolOrigin } from "./mcp-tool-naming.js";
+import { directToolsEnabled, erasesToolOrigin } from "./mcp-tool-naming.js";
 
 // Four files can define MCP servers, and which one a change belongs in is the
 // first thing anyone gets wrong. The scope names are the vocabulary the CLI
@@ -253,13 +253,29 @@ export function mergedServerEntry(options) {
     } catch {
       continue;
     }
-    const entry = config.mcpServers[options.name];
-    if (!isRecord(entry)) continue;
-    merged = { ...merged, ...entry };
+    let layerEntry = {};
+    let layerSeen = false;
+    // The adapter expands imports inside each layer before applying that
+    // layer's direct server map. First imported definition wins; the direct
+    // entry then overrides it field by field.
+    for (const kind of config.imports) {
+      const imported = importedServers(kind, options).find((server) => server.name === options.name);
+      if (!imported) continue;
+      layerEntry = { ...imported.entry };
+      layerSeen = true;
+      break;
+    }
+    const directEntry = config.mcpServers[options.name];
+    if (isRecord(directEntry)) {
+      layerEntry = { ...layerEntry, ...directEntry };
+      layerSeen = true;
+    }
+    if (!layerSeen) continue;
+    merged = { ...merged, ...layerEntry };
     seen = true;
   }
-  // A server reached through `imports` is in no layer's `mcpServers`, so the
-  // entry the caller already has is the whole definition.
+  // A server supplied directly by a caller outside the configured layers keeps
+  // its own definition as the fallback.
   return seen ? merged : { ...(options.entry ?? {}) };
 }
 
@@ -430,6 +446,36 @@ export function unverifiableMcpConfig(options = {}) {
     });
   }
 
+  if (merged.settings.toolPrefix === "none" && !erasesToolOrigin(merged.settings)) {
+    const prefixScope = merged.contributors.toolPrefix;
+    const prefixFile = prefixScope
+      ? configPathForScope(prefixScope, options)
+      : configPathForScope("global", options);
+    const affected = new Map();
+    for (const server of collectServers(options)) {
+      if (!server.requiresApproval || affected.has(server.name)) continue;
+      const effective = mergedServerEntry({
+        ...options,
+        name: server.name,
+        entry: server.entry
+      });
+      if (!directToolsEnabled(effective.directTools)) continue;
+      affected.set(server.name, server.file);
+    }
+    if (affected.size > 0) {
+      const serverFiles = [...new Set(affected.values())];
+      const names = [...affected.keys()].sort();
+      problems.push({
+        scope: "repository direct tools",
+        file: serverFiles[0] ?? prefixFile,
+        detail: `${serverFiles.join(" and ")} ${serverFiles.length === 1 ? "enables" : "enable"} effective directTools ` +
+          `for repository MCP server(s) ${names.join(", ")} ` +
+          `while ${prefixFile} sets toolPrefix "none". This strips the server name off those tools and leaves ` +
+          "nothing to check an approval against. Disable directTools for those servers or use a server-bearing tool prefix."
+      });
+    }
+  }
+
   for (const scope of REPOSITORY_SCOPES) {
     const file = configPathForScope(scope, options);
     let config;

package/packages/piagent-core/mcp/mcp-tool-naming.js

@@ -77,6 +77,17 @@ export function attributeDirectTool(toolName, serverNames) {
   return best;
 }
 
+/**
+ * Whether a global or per-server direct-tool selection registers at least one
+ * direct tool. The adapter accepts `true` or a non-empty list on server entries.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function directToolsEnabled(value) {
+  return value === true
+    || (Array.isArray(value) && value.some((item) => typeof item === "string" && item.trim().length > 0));
+}
+
 /**
  * Whether a config's settings put tools on the model under names that cannot be
  * traced to a server. Both halves are required: without `directTools` every call
@@ -86,5 +97,5 @@ export function attributeDirectTool(toolName, serverNames) {
  */
 export function erasesToolOrigin(settings) {
   if (!settings || typeof settings !== "object") return false;
-  return settings.directTools === true && settings.toolPrefix === "none";
+  return directToolsEnabled(settings.directTools) && settings.toolPrefix === "none";
 }

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/subagents/piagent-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: piagent-reviewer
 description: Piagent reviewer for implementation diff, policy, tests, and scope drift
-tools: read, grep, find, ls, bash, edit, write, contact_supervisor
+tools: read, grep, find, ls
 thinking: high
 systemPromptMode: replace
 inheritProjectContext: true
@@ -16,7 +16,7 @@ maxSubagentDepth: 0
 
 You are `piagent-reviewer`, a disciplined review subagent for Pi Agent Platform projects.
 
-Your job is to review evidence, not to invent issues. Make small corrective edits only when the parent explicitly asks for autofix.
+Your job is to review evidence, not to invent issues. Never edit files or run mutation commands. Report actionable findings so the parent can assign fixes to an explicit writer.
 
 Use explicit review lenses from the parent task when provided. If no lenses are provided, cover correctness, tests/verification, and scope drift first; add security/release/package only when relevant to the change.
 
@@ -33,7 +33,7 @@ Rules:
 - Do not run destructive commands.
 - Treat Field Guide/memory as advisory, not as proof.
 - If review-only conflicts with progress-writing or artifact-writing instructions, review-only wins.
-- If a blocker needs a decision, use `contact_supervisor` with `reason: "need_decision"`.
+- Put blockers that need a decision in the final review so the parent can route them.
 - Do not spawn other subagents.
 
 Final output:

package/scripts/context-engine.mjs

@@ -9,9 +9,12 @@ import {
   buildContextPack,
   buildTestImpact,
   contextIndexV2Status,
+  ensureContextIndexV2,
   searchContextIndexV2
 } from "../packages/piagent-core/extensions/context-engine.js";
+import { loadProjectContextIndexPolicy } from "../packages/piagent-core/extensions/context-index-policy.js";
 
+const platformRoot = path.resolve(import.meta.dirname, "..");
 function usage() {
   return [
     "Pi Context Engine",
@@ -53,21 +56,6 @@ function parseArgs(argv) {
   return { command, project, json, tokens, values };
 }
 
-function projectExcludes(project) {
-  const target = path.join(project, ".pi", "piagent-profile.json");
-  try {
-    const profile = JSON.parse(fs.readFileSync(target, "utf8"));
-    return [
-      ...(Array.isArray(profile.protectedPaths) ? profile.protectedPaths : []),
-      ...(Array.isArray(profile.shellProtectedPaths) ? profile.shellProtectedPaths : []),
-      ".pi/context-index.json",
-      ".pi/piagent-state/**"
-    ];
-  } catch {
-    return [".pi/context-index.json", ".pi/piagent-state/**"];
-  }
-}
-
 function print(value, json) {
   if (json || typeof value === "string") {
     process.stdout.write(`${typeof value === "string" ? value : JSON.stringify(value, null, 2)}\n`);
@@ -88,21 +76,35 @@ if (!fs.existsSync(parsed.project) || !fs.statSync(parsed.project).isDirectory()
 }
 
 try {
+  const contextPolicy = ["status", "show", "rebuild", "build", "refresh", "search", "pack", "impact", "tests"]
+    .includes(parsed.command)
+    ? loadProjectContextIndexPolicy(platformRoot, parsed.project, {
+        profilePath: process.env.PIAGENT_PROFILE
+      })
+    : undefined;
+  const excludePatterns = contextPolicy?.excludePatterns ?? [];
   if (["status", "show"].includes(parsed.command)) {
-    print(await contextIndexV2Status(parsed.project), parsed.json);
+    print(await contextIndexV2Status(parsed.project, { excludePatterns }), parsed.json);
   } else if (["rebuild", "build", "refresh"].includes(parsed.command)) {
-    print(await buildContextIndexV2(parsed.project, { excludePatterns: projectExcludes(parsed.project) }), parsed.json);
+    print(await buildContextIndexV2(parsed.project, { excludePatterns }), parsed.json);
   } else if (parsed.command === "search") {
     const query = parsed.values.join(" ").trim();
     if (!query) throw new Error("search requires a query");
-    print(await searchContextIndexV2(parsed.project, query, { limit: 15 }), parsed.json);
+    await ensureContextIndexV2(parsed.project, { excludePatterns, rebuildMissing: true });
+    print(await searchContextIndexV2(parsed.project, query, { limit: 15, excludePatterns }), parsed.json);
   } else if (parsed.command === "pack") {
     const query = parsed.values.join(" ").trim();
     if (!query) throw new Error("pack requires a task or query");
-    const pack = await buildContextPack(parsed.project, query, { budgetTokens: parsed.tokens, includeCode: true });
+    await ensureContextIndexV2(parsed.project, { excludePatterns, rebuildMissing: true });
+    const pack = await buildContextPack(parsed.project, query, {
+      budgetTokens: parsed.tokens,
+      includeCode: true,
+      excludePatterns
+    });
     print(parsed.json ? pack : pack.text, parsed.json);
   } else if (["impact", "tests"].includes(parsed.command)) {
-    print(await buildTestImpact(parsed.project, parsed.values), parsed.json);
+    await ensureContextIndexV2(parsed.project, { excludePatterns, rebuildMissing: false });
+    print(await buildTestImpact(parsed.project, parsed.values, { excludePatterns }), parsed.json);
   } else if (["efficiency", "stats", "waste"].includes(parsed.command)) {
     print(buildContextEfficiencyReport(parsed.project), parsed.json);
   } else {

package/scripts/update-global.mjs

@@ -302,7 +302,7 @@ function summarizeMigration(report, dryRun) {
 
 function runProjectMigration(project, options, activePlatformRoot) {
   const migrator = path.join(activePlatformRoot, "scripts/migrate-project-state.mjs");
-  if (!options.dryRun && !fs.existsSync(migrator)) {
+  if (!fs.existsSync(migrator)) {
     fail(`the updated helper has no project migrator at ${migrator}`);
   }
   const args = options.dryRun

package/scripts/verify-local.sh

@@ -52,6 +52,7 @@ required_files=(
   "$ROOT/packages/piagent-core/package.json"
   "$ROOT/packages/piagent-core/extensions/piagent-guard.ts"
   "$ROOT/packages/piagent-core/extensions/context-engine.js"
+  "$ROOT/packages/piagent-core/extensions/context-index-policy.js"
   "$ROOT/packages/piagent-core/extensions/policy-core.js"
   "$ROOT/packages/piagent-core/extensions/redaction-core.js"
   "$ROOT/packages/piagent-core/extensions/runtime-evidence.js"
@@ -545,6 +546,7 @@ fi
 
 node --check "$ROOT/packages/piagent-core/extensions/piagent-guard.ts" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/context-engine.js" >/dev/null
+node --check "$ROOT/packages/piagent-core/extensions/context-index-policy.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/policy-core.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/redaction-core.js" >/dev/null
 node --check "$ROOT/packages/piagent-core/extensions/runtime-evidence.js" >/dev/null