@piagent/platform 1.46.2 → 1.47.0

package/packages/piagent-core/runtime/mcp-repository-gate.mjs

@@ -0,0 +1,150 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  REPOSITORY_SCOPES,
+  collectServers,
+  configPathForScope,
+  mcpDecisionInputs,
+  unverifiableMcpConfig
+} from "../mcp/mcp-config-layers.js";
+import { approvalState } from "../mcp/mcp-approval-store.js";
+import { attributeDirectTool } from "../mcp/mcp-tool-naming.js";
+
+// Servers a repository defines are not usable until somebody on this machine has
+// approved them. This is the enforcement point, shared by personal Piagent
+// (piagent-guard) and company sessions (managed/member-mcp.mjs): the adapter
+// owns the connection and neither can prevent one being opened, but no tool
+// call reaches an unapproved server. The residual exposure is the connection
+// itself, which is worth stating plainly rather than describing this as a full
+// block.
+
+// The same token form the guard's action policy uses: `MCP`, `mcp` and `Mcp`
+// all name the adapter's proxy tool.
+const actionToken = (value) => String(value)
+  .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
+  .toLowerCase()
+  .replace(/[^a-z0-9]+/g, "-")
+  .replace(/^-+|-+$/g, "");
+
+// Which MCP server a tool call is addressed to. The adapter exposes one proxy
+// tool named `mcp` that carries the server in `input.server`, and, under
+// directTools, one tool per server tool named `<prefix>_<tool>` where the prefix
+// is derived from the server name. Direct names are matched against the servers
+// this gate is holding rather than against a fixed pattern, because the prefix
+// is the server's own name and there is nothing constant to anchor on.
+export function mcpServerFromToolCall(toolName, input, candidates) {
+  if (actionToken(toolName) === "mcp") {
+    return typeof input?.server === "string" && input.server.trim() ? input.server.trim() : undefined;
+  }
+  return attributeDirectTool(toolName, candidates);
+}
+
+// Recomputed only when one of the files behind the decision changes, because
+// this runs on every tool call. Approving or rejecting a server clears the
+// project's entry.
+export const mcpApprovalCache = new Map();
+
+function fileSignature(file) {
+  try {
+    const stat = fs.statSync(file);
+    return `${stat.mtimeMs}:${stat.size}`;
+  } catch {
+    return "absent";
+  }
+}
+
+// `blocked`: the servers a call must not reach, with why. `unverifiable`:
+// conditions under which no tool call can be checked at all, each with the
+// sentence to show. Those are not "a server is unapproved" but "this
+// repository's config has put the gate in a state where it cannot tell which
+// server a call belongs to", and the only sound answer to that is to stop.
+export function repositoryMcpGate(cwd) {
+  // Repository scopes plus anything an `imports` key drags in from a file the
+  // clone carries. Collecting those here is the whole point: a server the gate
+  // never enumerates is a server it silently permits.
+  const servers = collectServers({ projectPath: cwd, scopes: [...REPOSITORY_SCOPES] });
+  const repositoryFiles = [...REPOSITORY_SCOPES].map((scope) => ({
+    scope,
+    file: configPathForScope(scope, { projectPath: cwd })
+  }));
+  // Every file the decision reads, listed by the module that reads them rather
+  // than restated here. Building this by hand is what went wrong: the scan grew
+  // to read merged settings from all four scopes and to stat import targets
+  // outside the repository, the hand-written list did not, and an already-loaded
+  // guard went on permitting calls after a personal global config had put the
+  // session in the state this gate exists to refuse.
+  const signature = [
+    ...servers.map((server) => `${server.origin}:${server.name}:${fileSignature(server.file)}`),
+    ...repositoryFiles.map((layer) => `layer:${layer.scope}:${fileSignature(layer.file)}`),
+    ...mcpDecisionInputs({ projectPath: cwd }).map((file) => `input:${file}:${fileSignature(file)}`),
+    `store:${fileSignature(path.join(os.homedir(), ".pi", "piagent-mcp-approvals.json"))}`
+  ].join("|");
+  const cached = mcpApprovalCache.get(cwd);
+  if (cached?.signature === signature) return cached.gate;
+
+  const blocked = new Map();
+  for (const server of servers) {
+    const state = approvalState({ projectPath: cwd, name: server.name, entry: server.entry });
+    if (state.state === "approved") continue;
+    // A name defined more than once keeps its blocking entry: the approved copy
+    // does not vouch for the one nobody has looked at.
+    blocked.set(server.name, { state: state.state, origin: server.origin });
+  }
+
+  // Two things a repository-carried config can do that leave nothing to check.
+  //
+  // It can ask for tools with no prefix, so a direct tool arrives under a bare
+  // name carrying no evidence of its server. Refusing only the proxy there was
+  // not a fix: the proxy is the one form that names its server, so blocking it
+  // and allowing the bare names left the hole exactly where it was.
+  //
+  // It can also import a kind whose config this platform cannot enumerate, and
+  // then the set of servers reaching the session is simply unknown. Blocking the
+  // servers that could be listed says nothing about the ones that could not.
+  //
+  // Both stop every tool call. A repository can make a session refuse to run;
+  // it must not be able to make one run a server nobody approved.
+  // Read from the shared module rather than decided here, so `piagent-mcp
+  // doctor` reports exactly what this refuses. The two disagreeing is how an
+  // operator ends up reading "PASS" while every tool call is being stopped.
+  const unverifiable = unverifiableMcpConfig({ projectPath: cwd }).map((problem) => problem.detail);
+
+  const gate = { blocked, serverNames: new Set(servers.map((server) => server.name)), unverifiable };
+  mcpApprovalCache.set(cwd, { signature, gate });
+  return gate;
+}
+
+// Whether a tool call may go ahead in `cwd`: `{ block: false }`, or the
+// reason it may not, naming the commands that resolve it.
+export function evaluateMcpApproval(cwd, toolName, input) {
+  const gate = repositoryMcpGate(cwd);
+
+  // Every tool call, not only the ones that look like MCP. Under either of these
+  // conditions a call cannot be traced to a server, so there is no such thing as
+  // a call this gate can clear.
+  if (gate.unverifiable.length > 0) {
+    return { block: true, reason: `Blocked every tool call: ${gate.unverifiable.join(" ")}` };
+  }
+
+  const server = mcpServerFromToolCall(toolName, input, gate.blocked.keys());
+  if (!server) return { block: false };
+  const record = gate.blocked.get(server);
+  if (!record) return { block: false };
+  const explanation = record.state === "rejected"
+    ? "it was rejected for this project"
+    : record.state === "changed"
+      ? "its definition changed since it was approved"
+      : record.origin.startsWith("import:")
+        ? `this repository imports it from ${record.origin.slice("import:".length)} config and nobody on this machine has approved it here`
+        : "this repository defines it and nobody on this machine has approved it";
+  return {
+    block: true,
+    // Named as commands, because this is read inside a session: the reader can
+    // run these where they already are, without shelling out.
+    reason:
+      `Blocked MCP server ${server}: ${explanation}. ` +
+      `Review it with \`/piagent-mcp get ${server}\`, then \`/piagent-mcp approve ${server}\` to allow it ` +
+      `or \`/piagent-mcp reject ${server}\` to refuse it.`
+  };
+}

package/scripts/claude-model-additions.mjs

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { parsePiModelsJson } from "./pi-models-json.mjs";
 
 const additions = JSON.parse(fs.readFileSync(new URL("../catalog/claude-model-additions.json", import.meta.url), "utf8"));
 const object = value => value !== null && typeof value === "object" && !Array.isArray(value);
@@ -9,7 +10,11 @@ const object = value => value !== null && typeof value === "object" && !Array.is
 export function prepareClaudeModelAdditions(file) {
   if (fs.existsSync(file) && (!fs.lstatSync(file).isFile() || fs.lstatSync(file).isSymbolicLink())) throw new Error("Unsafe model configuration path");
   const before = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null;
-  const data = before === null ? {} : JSON.parse(before);
+  let data = {}, strict = true;
+  if (before !== null) {
+    try { ({ data, strict } = parsePiModelsJson(before)); }
+    catch (error) { throw new Error(`Cannot read model configuration ${file}: ${error.message}`); }
+  }
   if (!object(data) || (data.providers !== undefined && !object(data.providers))) throw new Error("Unsupported model configuration");
   data.providers ??= {};
   const provider = data.providers.anthropic ?? {};
@@ -19,6 +24,8 @@ export function prepareClaudeModelAdditions(file) {
   const models = provider.models ?? [];
   const missing = additions.models.filter(model => !models.some(existing => existing.id === model.id));
   if (missing.length === 0) return null;
+  // Rewriting would drop the member's comments; leave the file to them.
+  if (!strict) return { skipped: `${file} has comments; not adding ${missing.map(model => model.id).join(", ")} (add them by hand if wanted)`, apply() {} };
   data.providers.anthropic = { ...provider, models: [...models, ...missing] };
   return { apply() {
     const current = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : null;

package/scripts/configure-model-scope.sh

@@ -168,7 +168,11 @@ function parseDefaultModel(input) {
 
 const parsedDefault = parseDefaultModel(defaultModelInput);
 const settingsBefore = fs.existsSync(settingsPath) ? fs.readFileSync(settingsPath, "utf8") : null;
-const settings = settingsBefore === null ? {} : JSON.parse(settingsBefore);
+let settings = {};
+if (settingsBefore !== null) {
+  try { settings = JSON.parse(settingsBefore); }
+  catch (error) { console.error(`FAIL: cannot read Pi settings ${settingsPath}: ${error.message}`); process.exit(1); }
+}
 
 // What Piagent last offered, so an update adds only models new to this
 // release and never puts back one the member removed.
@@ -213,6 +217,7 @@ if (dryRun) {
   console.log(`  preset: ${preset}`);
   console.log(`  default: ${settings.defaultProvider}/${settings.defaultModel}:${settings.defaultThinkingLevel}`);
   console.log(`  enabledModels: ${settings.enabledModels.length}`);
+  if (catalogEdit?.skipped) console.log(`  note: ${catalogEdit.skipped}`);
   for (const note of notes) console.log(`  ${note}`);
 }
 NODE

package/scripts/install-global.sh

@@ -881,10 +881,16 @@ fi
 
 if [[ "$CONFIGURE_MODEL_SCOPE" == true ]]; then
   echo "Configuring Pi model selector scope:"
-  if [[ "$RESET_MODEL_SCOPE" == true ]]; then
-    run_cmd bash "$PLATFORM_ROOT/scripts/configure-model-scope.sh" --preset "$MODEL_SCOPE_PRESET" --default-model "$DEFAULT_MODEL"
-  else
-    run_cmd bash "$PLATFORM_ROOT/scripts/configure-model-scope.sh" --preset "$MODEL_SCOPE_PRESET" --default-model "$DEFAULT_MODEL" --keep-member-choices
+  MODEL_SCOPE_ARGS=(--preset "$MODEL_SCOPE_PRESET" --default-model "$DEFAULT_MODEL")
+  if [[ "$RESET_MODEL_SCOPE" != true ]]; then
+    MODEL_SCOPE_ARGS+=(--keep-member-choices)
+  fi
+  # The model list is a convenience: a member's settings or models.json that the
+  # script cannot read must not stop the install (Pi and the package are already
+  # in place). The script restores settings.json when it fails part way.
+  if ! run_cmd bash "$PLATFORM_ROOT/scripts/configure-model-scope.sh" "${MODEL_SCOPE_ARGS[@]}"; then
+    echo "WARN: the Pi model selector scope was not changed; the install continues." >&2
+    echo "      Fix the file named above, then run: piagent-model-scope ${MODEL_SCOPE_ARGS[*]}" >&2
   fi
 fi
 

package/scripts/personal-pi-config.mjs

@@ -15,11 +15,14 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { parsePiModelsJson } from "./pi-models-json.mjs";
 
 const COMPANY_PROVIDER = /^agent_watch_/;
 const SESSION_HEADER_EXTENSION = "agentwatch-studio-session.mjs";
 
 const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return null; } };
+// models.json may carry comments, as Pi allows; a strict read would miss company providers in it.
+const readModels = (file) => { try { return parsePiModelsJson(fs.readFileSync(file, "utf8")).data; } catch { return null; } };
 const real = (file) => { try { return fs.realpathSync(file); } catch { return null; } };
 
 // The Piagent package a path belongs to (its root), or null.
@@ -47,7 +50,7 @@ export function packageVersion(agentDir, source) {
 
 export function inspect(agentDir) {
   const settingsFile = path.join(agentDir, "settings.json"), modelsFile = path.join(agentDir, "models.json");
-  const settings = readJson(settingsFile) ?? {}, models = readJson(modelsFile) ?? {};
+  const settings = readJson(settingsFile) ?? {}, models = readModels(modelsFile) ?? {};
   const managed = fs.existsSync(path.join(agentDir, "agent-watch-managed.json"));
   const packages = Array.isArray(settings.packages) ? settings.packages : [];
   const piagentPackages = packages.filter(isPiagentSource);
@@ -109,7 +112,7 @@ export function repair(agentDir, now = new Date()) {
     backups.push(backup(settingsFile, stamp)); writeJson(settingsFile, settings); changed.push(settingsFile);
   }
   if (kinds.has("company-providers")) {
-    const models = readJson(modelsFile);
+    const models = readModels(modelsFile);
     for (const name of Object.keys(models.providers ?? {})) if (COMPANY_PROVIDER.test(name)) delete models.providers[name];
     backups.push(backup(modelsFile, stamp)); writeJson(modelsFile, models); changed.push(modelsFile);
   }

package/scripts/pi-models-json.mjs

@@ -0,0 +1,13 @@
+// Pi reads models.json leniently: a BOM, `//` line comments and trailing
+// commas are allowed (Pi's stripJsonComments). Piagent reads it the same way,
+// and says whether the text was plain JSON, so a writer knows it would drop
+// the member's comments.
+const stripComments = text => text
+  .replace(/"(?:\\.|[^"\\])*"|\/\/[^\n]*/g, m => (m[0] === '"' ? m : ""))
+  .replace(/"(?:\\.|[^"\\])*"|,(\s*[}\]])/g, (m, tail) => tail ?? (m[0] === '"' ? m : ""));
+
+export function parsePiModelsJson(text) {
+  const body = text.replace(/^\uFEFF/, "");
+  try { return { data: JSON.parse(body), strict: true }; }
+  catch { return { data: JSON.parse(stripComments(body)), strict: false }; }
+}

package/scripts/setup.sh

@@ -22,7 +22,7 @@ Options:
   --project-only, --no-global    Only initialize project, skip global install
   --no-project                   Skip project initialization
   --with-mcp / --no-mcp          Install/skip Pi MCP adapter during global install (default: install)
-  --mcp-preset <minimal|core|popular|all|docs|browser|github|design|design-local|web|documents|google|google-mail|google-all>
+  --mcp-preset <minimal|core|popular|all|docs|browser|github|design|design-local|web|documents|google|google-mail|google-all|atlassian>
                                   Configure shared global MCP baseline when --with-mcp is enabled (default: core)
   --with-subagents / --no-subagents
                                   Install/skip pi-subagents during global install (default: install)