@psnext/slingcli 3.5.20261007-2 → 3.5.20261019-1

package/bin/sling-startup-output.js

@@ -0,0 +1,47 @@
+// Startup output routing for the sling wrapper.
+//
+// pi reserves stdout for protocol data in RPC, JSON, and print modes and sends
+// diagnostics to stderr (packages/coding-agent/docs/rpc.md). pi applies that
+// routing itself once main() runs. The wrapper in sling_bin.js prints update
+// notices and package install progress before main(), so it needs the same
+// rule up front. Kept in its own module so it can be unit-tested without
+// importing sling_bin.js, which runs on import.
+
+/**
+ * Mirrors pi's resolveAppMode: stdout carries data for `--mode rpc`,
+ * `--mode json`, `--print`/`-p`, or whenever stdin or stdout is not a TTY.
+ */
+export function isProtocolStdout(argv, { stdinIsTTY, stdoutIsTTY }) {
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--mode") {
+      const mode = argv[i + 1];
+      if (mode === "rpc" || mode === "json") return true;
+    }
+    if (arg === "--print" || arg === "-p") return true;
+  }
+  return !stdinIsTTY || !stdoutIsTTY;
+}
+
+/**
+ * Routes every process.stdout.write (and therefore console.log) to stderr.
+ * Returns a function that restores the original writer.
+ */
+export function redirectStdoutToStderr() {
+  const originalWrite = process.stdout.write;
+  process.stdout.write = function redirectedStdoutWrite(chunk, encodingOrCallback, callback) {
+    return process.stderr.write(chunk, encodingOrCallback, callback);
+  };
+  return () => {
+    process.stdout.write = originalWrite;
+  };
+}
+
+/**
+ * stdio for child processes spawned by the wrapper. In protocol mode a child
+ * must neither consume protocol stdin nor write to protocol stdout, so its
+ * stdout and stderr are both attached to the parent's stderr (fd 2).
+ */
+export function childStdio(protocolStdout) {
+  return protocolStdout ? ["ignore", 2, 2] : "inherit";
+}

package/bin/sling.js

@@ -28,10 +28,14 @@ import { spawn } from "node:child_process";
 import readline from "node:readline/promises";
 import semver from "semver";
 import { getStartupPackageActions } from "./sling-default-package-policy.js";
+import { childStdio, isProtocolStdout, redirectStdoutToStderr } from "./sling-startup-output.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const IS_DEV = process.env.SLING_DEV !== undefined;
+// True when stdout is a data channel (RPC/JSON/print mode or a pipe). Wrapper
+// chatter and child-process output must then stay off stdout.
+let protocolStdout = false;
 
 const productionOnly = async (fn, ...args) => (IS_DEV ? undefined : fn(...args));
 const devOnly = async (fn, ...args) => (IS_DEV ? fn(...args) : undefined);
@@ -89,7 +93,7 @@ function applyNoEnv(args) {
 
 async function runCommand(command, args, options = {}) {
   return new Promise((resolve, reject) => {
-    const proc = spawn(command, args, { stdio: "inherit", shell: false, ...options });
+    const proc = spawn(command, args, { stdio: childStdio(protocolStdout), shell: false, ...options });
     proc.on("close", (code) => {
       if (code !== 0) reject(new Error(`Command failed with code ${code}`));
       else resolve();
@@ -341,8 +345,12 @@ async function installAndRestart(versionSpec, args, { required }) {
     // The restarted process must not run the update check again. If the global
     // install landed on a different npm prefix than the binary running now, it
     // would rediscover the same update and reinstall in a loop.
+    //
+    // The restarted sling is the real process from here on, so it must own the
+    // original stdin and stdout even in protocol mode.
     await runCommand(process.execPath, [__filename, ...restartArgs], {
       env: { ...process.env, SKIP_SLING_AUTO_UPDATE_CHECK: "1" },
+      stdio: "inherit",
     });
   } catch {
     console.error("✓ Updated, but failed to restart automatically.");
@@ -453,7 +461,7 @@ async function promptInstallScopeIfNeeded(args) {
   return next.filter((a) => a !== "-g" && a !== "--global");
 }
 
-function updateSettings() {
+export function updateSettings() {
   const configPath = path.resolve(homedir(), ".sling/agent/settings.json");
   mkdirSync(path.dirname(configPath), { recursive: true });
 
@@ -470,6 +478,16 @@ function updateSettings() {
   config.enableInstallTelemetry = false;
   config.collapseChangelog = true;
 
+  // pi's built-in mcp extension and the default pi-mcp-adapter package both
+  // register /mcp. pi drops the built-in with a startup warning; turn it off
+  // here instead so the warning never shows.
+  const extensions = Array.isArray(config.extensions) ? config.extensions : [];
+  const packages = Array.isArray(config.packages) ? config.packages : [];
+  const hasAdapter = packages.some((p) => (p?.source ?? p) === "npm:pi-mcp-adapter");
+  if (hasAdapter && !extensions.includes("-builtin:mcp")) {
+    config.extensions = [...extensions, "-builtin:mcp"];
+  }
+
   config.powerline ={...{
     "preset": "default",
     "customItems": [
@@ -658,6 +676,13 @@ async function run() {
     console.log(helptext);
     process.exit(0);
   }
+  protocolStdout = isProtocolStdout(rawArgs, {
+    stdinIsTTY: Boolean(process.stdin.isTTY),
+    stdoutIsTTY: Boolean(process.stdout.isTTY),
+  });
+  // Wrapper output goes to stderr while stdout is a data channel. pi applies
+  // its own routing inside main(), so the patch is lifted right before that.
+  const restoreStdout = protocolStdout ? redirectStdoutToStderr() : () => {};
   setGlobalDispatcher(new EnvHttpProxyAgent({ bodyTimeout: 0, headersTimeout: 0 }));
   await productionOnly(checkForUpdate, rawArgs);
   syncBundledSkills();
@@ -672,6 +697,7 @@ async function run() {
   const BUILTIN_SUBCOMMANDS = new Set(["install", "remove", "uninstall", "update", "list", "config"]);
   const firstPositional = args.find((a) => !a.startsWith("-"));
   if (firstPositional && BUILTIN_SUBCOMMANDS.has(firstPositional)) {
+    restoreStdout();
     await main(args);
   } else {
     updateSettings();
@@ -687,6 +713,7 @@ async function run() {
     // No --provider here: pi rejects --provider without --model, and the
     // slingshot extension is the only registered provider, so pi's default
     // model resolution (saved default, then first available) picks it.
+    restoreStdout();
     await main(["-e", extensionPath, ...args]);
   }
 }

package/node_modules/@aws-sdk/core/dist-cjs/submodules/httpAuthSchemes/index.js

@@ -3,6 +3,7 @@ const { setCredentialFeature } = require("@aws-sdk/core/client");
 const { normalizeProvider, memoizeIdentityProvider, isIdentityExpired, doesIdentityRequireRefresh } = require("@smithy/core");
 const { SignatureV4 } = require("@smithy/signature-v4");
 const { HttpResponse, HttpRequest } = require("@smithy/core/protocols");
+const { SMITHY_CONTEXT_KEY } = require("@smithy/types");
 
 const getDateHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.date ?? response.headers?.Date) : undefined;
 const getAgeHeader = (response) => HttpResponse.isInstance(response) ? (response.headers?.age ?? response.headers?.Age) : undefined;
@@ -30,6 +31,12 @@ const throwSigningPropertyError = (name, property) => {
     }
     return property;
 };
+const hasEventStreamOutput = (signingProperties) => {
+    const context = signingProperties.context;
+    const eventStream = context?.[SMITHY_CONTEXT_KEY]
+        ?.eventStream;
+    return eventStream?.output === true;
+};
 const validateSigningProperties = async (signingProperties) => {
     const context = throwSigningPropertyError("context", signingProperties.context);
     const config = throwSigningPropertyError("config", signingProperties.config);
@@ -65,7 +72,9 @@ class AwsSdkSigV4Signer {
         }
         const noSkewCorrection = (await config.disableClockSkewCorrection?.()) === true;
         signingProperties._disableClockSkewCorrection = noSkewCorrection;
-        if (!noSkewCorrection) {
+        const skipSkewSampling = noSkewCorrection || hasEventStreamOutput(signingProperties);
+        signingProperties._skipClockSkewSampling = skipSkewSampling;
+        if (!skipSkewSampling) {
             signingProperties._preRequestSystemClockOffset = config.systemClockOffset;
             signingProperties._requestSentAt = Date.now();
         }
@@ -79,7 +88,7 @@ class AwsSdkSigV4Signer {
     errorHandler(signingProperties) {
         return (error) => {
             const errorException = error;
-            if (!signingProperties._disableClockSkewCorrection) {
+            if (!signingProperties._skipClockSkewSampling && !signingProperties._disableClockSkewCorrection) {
                 const serverTime = errorException.ServerTime ?? getDateHeader(errorException.$response);
                 if (serverTime) {
                     const config = throwSigningPropertyError("config", signingProperties.config);
@@ -100,7 +109,7 @@ class AwsSdkSigV4Signer {
         };
     }
     successHandler(httpResponse, signingProperties) {
-        if (signingProperties._disableClockSkewCorrection) {
+        if (signingProperties._skipClockSkewSampling || signingProperties._disableClockSkewCorrection) {
             return;
         }
         const dateHeader = getDateHeader(httpResponse);