@piagent/platform 1.46.4 → 1.47.0

package/packages/piagent-core/managed/simulator-commands.mjs

@@ -0,0 +1,117 @@
+import path from 'node:path';
+
+// What run_on_simulator runs on the member's machine: the iOS Simulator and
+// Android emulator, and the builds that install an app on them (the sandbox
+// reaches neither CoreSimulator nor adb). Only these programs, joined by &&,
+// || or a pipe into an output filter; output may go to a file in the project
+// (a screenshot), nothing else leaves it. Anything wider is run_on_host.
+
+const XCRUN = new Set(['simctl', 'xcodebuild', 'devicectl', 'xcresulttool', 'xctrace']);
+// `simctl spawn` starts a program of the simulator's runtime as the member:
+// only `log` (the app's logs).
+const simctl = words => words[1] !== 'simctl' || words[2] !== 'spawn' || words.slice(3).filter(word => !word.startsWith('-'))[1] === 'log';
+const NPX = /^(expo|react-native|@react-native-community\/cli|cap|@capacitor\/cli)(@[\w.-]+)?$/;
+// Program → whether its arguments are allowed (`words` without assignments,
+// `inProject` a path check against the project folder).
+const PROGRAMS = {
+  xcrun: words => XCRUN.has(words[1]) && simctl(words),
+  xcodebuild: () => true,
+  open: words => words.length === 3 && words[1] === '-a' && words[2] === 'Simulator',
+  adb: () => true, emulator: () => true, avdmanager: () => true, sdkmanager: () => true,
+  gradlew: (words, inProject) => inProject(words[0]),
+  // Taps, typing and the screen's accessibility tree; `axe init` writes into other tools' settings.
+  axe: words => !!words[1] && words[1] !== 'init',
+  xcodegen: words => words[1] === 'generate',
+  flutter: () => true,
+  pod: words => words[1] === 'install',
+  npx: words => NPX.test(words[1] === '--yes' || words[1] === '-y' ? words[2] ?? '' : words[1] ?? ''),
+  // Waiting for a boot, and reading what a build printed.
+  sleep: words => words.length === 2 && /^\d{1,3}$/.test(words[1]),
+  xcbeautify: () => true, xcpretty: () => true,
+  grep: () => true, head: () => true, tail: () => true, wc: () => true, sort: () => true, uniq: () => true, jq: () => true,
+  cd: (words, inProject) => words.length === 2 && inProject(words[1]),
+  mkdir: (words, inProject) => { const paths = words.slice(1).filter(word => word !== '-p'); return paths.length > 0 && paths.every(inProject); },
+};
+// Variables a command may set for itself; never what changes how programs load.
+const ASSIGNMENT = /^([A-Z][A-Z0-9_]*)=/;
+const UNSAFE_VARIABLE = /^(PATH|DYLD_\w*|LD_\w*|NODE_OPTIONS|BASH_ENV|ENV|ZDOTDIR|SHELL|HOME)$/;
+
+// A path in the project folder: relative without climbing out of it, or
+// absolute inside it (agents name files by their full path). Without the
+// folder, only a relative one.
+function insideProject(cwd) {
+  return target => {
+    if (typeof target !== 'string' || !target || target.startsWith('~') || target.includes('$') || target.split('/').includes('..')) return false;
+    if (!target.startsWith('/')) return true;
+    if (!cwd) return false;
+    const relative = path.relative(path.resolve(cwd), path.resolve(target));
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+  };
+}
+
+// Shell words with their quotes resolved, and the operators between them.
+// null for what this reader does not follow (an unclosed quote).
+function tokens(command) {
+  const out = []; let word = null, quote = null;
+  const push = () => { if (word !== null) { out.push({ word }); word = null; } };
+  for (let i = 0; i < command.length; i += 1) {
+    const c = command[i];
+    if (quote) { if (c === quote) quote = null; else if (c === '\\' && quote === '"' && i + 1 < command.length) word += command[++i]; else word += c; continue; }
+    if (c === "'" || c === '"') { quote = c; word ??= ''; continue; }
+    if (c === '\\' && i + 1 < command.length) { word = (word ?? '') + command[++i]; continue; }
+    if (/\s/.test(c)) { push(); continue; }
+    const two = command.slice(i, i + 2);
+    if (['&&', '||', '>>', '2>'].includes(two)) {
+      push();
+      if (two === '2>' && command[i + 2] === '&' && command[i + 3] === '1') { out.push({ op: '2>&1' }); i += 3; continue; }
+      out.push({ op: two }); i += 1; continue;
+    }
+    if (c === '|' || c === '>') { push(); out.push({ op: c }); continue; }
+    word = (word ?? '') + c;
+  }
+  if (quote) return null;
+  push();
+  return out;
+}
+
+// Why the command is not a simulator command, or null when it is. `cwd`:
+// the project folder, where output files and `cd` may go.
+export function simulatorCommandReason(command, cwd = null) {
+  const text = String(command ?? ''), inProject = insideProject(cwd);
+  if (!text.trim()) return 'the command is empty';
+  if (/[`;\n]|\$\(|<\(|>\(|</.test(text) || text.replaceAll('&&', '').replaceAll('2>&1', '').includes('&')) return 'only commands joined by &&, || or | are run (no ;, &, $( ), backticks or subshells)';
+  const list = tokens(text);
+  if (!list) return 'an unclosed quote';
+  let words = [];
+  const close = () => {
+    if (!words.length) return 'an empty part between operators';
+    while (words.length && ASSIGNMENT.test(words[0])) {
+      const name = ASSIGNMENT.exec(words[0])[1];
+      if (UNSAFE_VARIABLE.test(name)) return `${name} cannot be set here`;
+      words = words.slice(1);
+    }
+    const name = words[0]?.split('/').pop();
+    const allowed = Object.hasOwn(PROGRAMS, name) && PROGRAMS[name](words, inProject);
+    words = [];
+    return allowed ? null : `${name ?? 'this part'} is not a simulator or app build command (use run_on_host for other commands)`;
+  };
+  for (let i = 0; i < list.length; i += 1) {
+    const { word, op } = list[i];
+    if (word !== undefined) { words.push(word); continue; }
+    if (op === '2>&1') continue;
+    if (op === '>' || op === '>>' || op === '2>') {
+      const target = list[i + 1]?.word;
+      if (!(target === '/dev/null' || inProject(target))) return 'output may go only to a file inside the project or /dev/null';
+      i += 1; continue;
+    }
+    const reason = close(); if (reason) return reason;
+  }
+  return close();
+}
+
+// A lone `emulator …` keeps running while the virtual device is up: it is
+// started detached and the tool returns once it is launched.
+export function detachedEmulator(command) {
+  const list = tokens(String(command ?? ''));
+  return !!list && list.length > 0 && list.every(token => token.word !== undefined) && list[0].word.split('/').pop() === 'emulator';
+}

package/packages/piagent-core/mcp/mcp-server-catalog.js

@@ -151,6 +151,18 @@ export const CATALOG_SERVERS = {
       directTools: false
     }
   },
+  // Atlassian's own remote server (Jira and Confluence Cloud). It registers its
+  // OAuth client itself (the metadata sits at the origin, not at the protected
+  // resource), so the member signs in with /mcp-auth and their own Jira access.
+  atlassian: {
+    description: "Atlassian Rovo MCP server: Jira and Confluence Cloud, with the member's own Atlassian login (OAuth).",
+    config: {
+      url: "https://mcp.atlassian.com/v1/mcp",
+      auth: "oauth",
+      lifecycle: "lazy",
+      directTools: false
+    }
+  },
   // Converts .docx, .xlsx, .pptx and .pdf to Markdown locally. Local matters:
   // the alternative to this is uploading a document somewhere to read it, and a
   // document worth converting is usually one worth not uploading.
@@ -202,6 +214,10 @@ export const CATALOG_PREREQUISITES = {
     "Developer Preview: no Pi OAuth end-to-end release proof exists yet",
     "Google's supported client guides use an OAuth client id and secret; Pi's public-client/PKCE compatibility is unverified"
   ],
+  atlassian: [
+    "a Jira or Confluence Cloud site (Server and Data Center are not served by this endpoint)",
+    "sign in once with /mcp-auth atlassian; a site admin may have to allow the Atlassian MCP connection"
+  ],
   markitdown: [
     "uv on PATH (https://docs.astral.sh/uv); the first run downloads a Python runtime and roughly 120 MB of dependencies",
     "note: markitdown-mcp is published as an alpha, so pin changes deliberately"
@@ -244,11 +260,12 @@ export const CATALOG_PRESETS = {
   "google-mail": ["gmail"],
   google: ["google-drive", "google-docs", "google-sheets"],
   "google-all": ["google-drive", "gmail", "google-docs", "google-sheets"],
+  atlassian: ["atlassian"],
   core: ["context7", "chrome-devtools", "github"],
   popular: ["context7", "chrome-devtools", "playwright", "github", "figma-desktop"],
   all: [
     "context7", "chrome-devtools", "playwright", "github", "figma-desktop", "figma",
-    "markitdown", "google-drive", "gmail", "google-docs", "google-sheets"
+    "markitdown", "atlassian", "google-drive", "gmail", "google-docs", "google-sheets"
   ]
 };
 

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.46.4",
+  "version": "1.47.0",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/mcp-repository-gate.d.mts

@@ -0,0 +1,10 @@
+export interface RepositoryMcpGate {
+  blocked: Map<string, { state: string; origin: string }>;
+  serverNames: Set<string>;
+  unverifiable: string[];
+}
+
+export const mcpApprovalCache: Map<string, { signature: string; gate: RepositoryMcpGate }>;
+export function mcpServerFromToolCall(toolName: string, input: Record<string, unknown>, candidates: Iterable<string>): string | undefined;
+export function repositoryMcpGate(cwd: string): RepositoryMcpGate;
+export function evaluateMcpApproval(cwd: string, toolName: string, input: Record<string, unknown>): { block: boolean; reason?: string };

package/packages/piagent-core/runtime/mcp-repository-gate.mjs

@@ -0,0 +1,150 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  REPOSITORY_SCOPES,
+  collectServers,
+  configPathForScope,
+  mcpDecisionInputs,
+  unverifiableMcpConfig
+} from "../mcp/mcp-config-layers.js";
+import { approvalState } from "../mcp/mcp-approval-store.js";
+import { attributeDirectTool } from "../mcp/mcp-tool-naming.js";
+
+// Servers a repository defines are not usable until somebody on this machine has
+// approved them. This is the enforcement point, shared by personal Piagent
+// (piagent-guard) and company sessions (managed/member-mcp.mjs): the adapter
+// owns the connection and neither can prevent one being opened, but no tool
+// call reaches an unapproved server. The residual exposure is the connection
+// itself, which is worth stating plainly rather than describing this as a full
+// block.
+
+// The same token form the guard's action policy uses: `MCP`, `mcp` and `Mcp`
+// all name the adapter's proxy tool.
+const actionToken = (value) => String(value)
+  .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
+  .toLowerCase()
+  .replace(/[^a-z0-9]+/g, "-")
+  .replace(/^-+|-+$/g, "");
+
+// Which MCP server a tool call is addressed to. The adapter exposes one proxy
+// tool named `mcp` that carries the server in `input.server`, and, under
+// directTools, one tool per server tool named `<prefix>_<tool>` where the prefix
+// is derived from the server name. Direct names are matched against the servers
+// this gate is holding rather than against a fixed pattern, because the prefix
+// is the server's own name and there is nothing constant to anchor on.
+export function mcpServerFromToolCall(toolName, input, candidates) {
+  if (actionToken(toolName) === "mcp") {
+    return typeof input?.server === "string" && input.server.trim() ? input.server.trim() : undefined;
+  }
+  return attributeDirectTool(toolName, candidates);
+}
+
+// Recomputed only when one of the files behind the decision changes, because
+// this runs on every tool call. Approving or rejecting a server clears the
+// project's entry.
+export const mcpApprovalCache = new Map();
+
+function fileSignature(file) {
+  try {
+    const stat = fs.statSync(file);
+    return `${stat.mtimeMs}:${stat.size}`;
+  } catch {
+    return "absent";
+  }
+}
+
+// `blocked`: the servers a call must not reach, with why. `unverifiable`:
+// conditions under which no tool call can be checked at all, each with the
+// sentence to show. Those are not "a server is unapproved" but "this
+// repository's config has put the gate in a state where it cannot tell which
+// server a call belongs to", and the only sound answer to that is to stop.
+export function repositoryMcpGate(cwd) {
+  // Repository scopes plus anything an `imports` key drags in from a file the
+  // clone carries. Collecting those here is the whole point: a server the gate
+  // never enumerates is a server it silently permits.
+  const servers = collectServers({ projectPath: cwd, scopes: [...REPOSITORY_SCOPES] });
+  const repositoryFiles = [...REPOSITORY_SCOPES].map((scope) => ({
+    scope,
+    file: configPathForScope(scope, { projectPath: cwd })
+  }));
+  // Every file the decision reads, listed by the module that reads them rather
+  // than restated here. Building this by hand is what went wrong: the scan grew
+  // to read merged settings from all four scopes and to stat import targets
+  // outside the repository, the hand-written list did not, and an already-loaded
+  // guard went on permitting calls after a personal global config had put the
+  // session in the state this gate exists to refuse.
+  const signature = [
+    ...servers.map((server) => `${server.origin}:${server.name}:${fileSignature(server.file)}`),
+    ...repositoryFiles.map((layer) => `layer:${layer.scope}:${fileSignature(layer.file)}`),
+    ...mcpDecisionInputs({ projectPath: cwd }).map((file) => `input:${file}:${fileSignature(file)}`),
+    `store:${fileSignature(path.join(os.homedir(), ".pi", "piagent-mcp-approvals.json"))}`
+  ].join("|");
+  const cached = mcpApprovalCache.get(cwd);
+  if (cached?.signature === signature) return cached.gate;
+
+  const blocked = new Map();
+  for (const server of servers) {
+    const state = approvalState({ projectPath: cwd, name: server.name, entry: server.entry });
+    if (state.state === "approved") continue;
+    // A name defined more than once keeps its blocking entry: the approved copy
+    // does not vouch for the one nobody has looked at.
+    blocked.set(server.name, { state: state.state, origin: server.origin });
+  }
+
+  // Two things a repository-carried config can do that leave nothing to check.
+  //
+  // It can ask for tools with no prefix, so a direct tool arrives under a bare
+  // name carrying no evidence of its server. Refusing only the proxy there was
+  // not a fix: the proxy is the one form that names its server, so blocking it
+  // and allowing the bare names left the hole exactly where it was.
+  //
+  // It can also import a kind whose config this platform cannot enumerate, and
+  // then the set of servers reaching the session is simply unknown. Blocking the
+  // servers that could be listed says nothing about the ones that could not.
+  //
+  // Both stop every tool call. A repository can make a session refuse to run;
+  // it must not be able to make one run a server nobody approved.
+  // Read from the shared module rather than decided here, so `piagent-mcp
+  // doctor` reports exactly what this refuses. The two disagreeing is how an
+  // operator ends up reading "PASS" while every tool call is being stopped.
+  const unverifiable = unverifiableMcpConfig({ projectPath: cwd }).map((problem) => problem.detail);
+
+  const gate = { blocked, serverNames: new Set(servers.map((server) => server.name)), unverifiable };
+  mcpApprovalCache.set(cwd, { signature, gate });
+  return gate;
+}
+
+// Whether a tool call may go ahead in `cwd`: `{ block: false }`, or the
+// reason it may not, naming the commands that resolve it.
+export function evaluateMcpApproval(cwd, toolName, input) {
+  const gate = repositoryMcpGate(cwd);
+
+  // Every tool call, not only the ones that look like MCP. Under either of these
+  // conditions a call cannot be traced to a server, so there is no such thing as
+  // a call this gate can clear.
+  if (gate.unverifiable.length > 0) {
+    return { block: true, reason: `Blocked every tool call: ${gate.unverifiable.join(" ")}` };
+  }
+
+  const server = mcpServerFromToolCall(toolName, input, gate.blocked.keys());
+  if (!server) return { block: false };
+  const record = gate.blocked.get(server);
+  if (!record) return { block: false };
+  const explanation = record.state === "rejected"
+    ? "it was rejected for this project"
+    : record.state === "changed"
+      ? "its definition changed since it was approved"
+      : record.origin.startsWith("import:")
+        ? `this repository imports it from ${record.origin.slice("import:".length)} config and nobody on this machine has approved it here`
+        : "this repository defines it and nobody on this machine has approved it";
+  return {
+    block: true,
+    // Named as commands, because this is read inside a session: the reader can
+    // run these where they already are, without shelling out.
+    reason:
+      `Blocked MCP server ${server}: ${explanation}. ` +
+      `Review it with \`/piagent-mcp get ${server}\`, then \`/piagent-mcp approve ${server}\` to allow it ` +
+      `or \`/piagent-mcp reject ${server}\` to refuse it.`
+  };
+}

package/scripts/setup.sh

@@ -22,7 +22,7 @@ Options:
   --project-only, --no-global    Only initialize project, skip global install
   --no-project                   Skip project initialization
   --with-mcp / --no-mcp          Install/skip Pi MCP adapter during global install (default: install)
-  --mcp-preset <minimal|core|popular|all|docs|browser|github|design|design-local|web|documents|google|google-mail|google-all>
+  --mcp-preset <minimal|core|popular|all|docs|browser|github|design|design-local|web|documents|google|google-mail|google-all|atlassian>
                                   Configure shared global MCP baseline when --with-mcp is enabled (default: core)
   --with-subagents / --no-subagents
                                   Install/skip pi-subagents during global install (default: install)