@skydiveai/pi-extensions 0.1.0-beta.2304 → 0.1.0-beta.2305

package/dist/index.mjs

@@ -12,6 +12,8 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
+import { Ajv } from "ajv";
+import addFormats from "ajv-formats";
 import { Check, Errors } from "typebox/value";
 import { hc } from "hono/client";
 import { ROOT_CONTEXT, SpanStatusCode, propagation, trace } from "@opentelemetry/api";
@@ -259,7 +261,7 @@ function createHealthHandler({ metadata }) {
 * read on the hot path before every LLM call), it falls back to the default
 * for that knob and logs once.
 */
-const log$15 = logger.child({ module: "context-management-config" });
+const log$16 = logger.child({ module: "context-management-config" });
 const DEFAULT_CONTEXT_MANAGEMENT_CONFIG = {
 	enabled: false,
 	perResultMaxBytes: 16 * 1024,
@@ -307,7 +309,7 @@ function resolveContextManagementConfig(env = process.env) {
 		maxModelCallsPerTurn: env.SKYDIVE_CTX_MAX_MODEL_CALLS
 	});
 	if (!parsed.success) {
-		log$15.warn({
+		log$16.warn({
 			event: "context_management_config_invalid",
 			err: parsed.error
 		}, "falling back to default context-management config");
@@ -419,7 +421,7 @@ function installIterationCap({ session, log }, configOverride = null) {
 const CAPABILITY_SOUL_NUDGE = "New capability gained — once the current task is done, if this changes what you can do for the user, record it in `soul.md` so it carries into future conversations rather than being rediscovered from scratch (then commit and push).";
 //#endregion
 //#region src/extensions/tool-call-summary.ts
-const log$14 = logger.child({ module: "tool-call-summary-extension" });
+const log$15 = logger.child({ module: "tool-call-summary-extension" });
 /**
 * The injected parameter name: a namespaced sentinel, so it can never collide
 * with a real tool argument and is unmistakable in transcripts and logs. The
@@ -627,7 +629,7 @@ function withSummaryStrippedBeforeValidation(tool) {
 		try {
 			stripped = withoutInjectedSummary(args);
 		} catch (err) {
-			log$14.error({
+			log$15.error({
 				err,
 				event: "tool_call_summary_prepare_strip_failed",
 				toolName: tool.name
@@ -657,7 +659,7 @@ function stripInjectedSummary(pi, toolName, input) {
 		if (toolDeclaresSummaryParam(pi, toolName)) return;
 		delete input[TOOL_CALL_SUMMARY_FIELD];
 	} catch (err) {
-		log$14.error({
+		log$15.error({
 			err,
 			event: "tool_call_summary_strip_failed",
 			toolName
@@ -673,7 +675,7 @@ function buildInjectedPayload(pi, payload) {
 	try {
 		return injectToolCallSummary(payload, getStrictToolNames(pi));
 	} catch (err) {
-		log$14.error({
+		log$15.error({
 			err,
 			event: "tool_call_summary_injection_failed"
 		}, "tool_call_summary injection failed; passing payload through unchanged");
@@ -710,7 +712,7 @@ const toolCallSummaryExtension = (pi) => {
 * or `ToolDefinition[]`. Files starting with `_` or `.` are skipped, so
 * `tools/_example.ts` documents the shape without registering.
 */
-const log$13 = logger.child({ module: "local-tools-extension" });
+const log$14 = logger.child({ module: "local-tools-extension" });
 const TOOLS_DIRNAME = "tools";
 const fileState = /* @__PURE__ */ new Map();
 let pendingLocalToolsUpdate = null;
@@ -854,7 +856,7 @@ async function reconcileAndQueue({ pi, dir, reason }) {
 		dir
 	});
 	if (reason !== "session_start" && summaryHasChanges$1(summary)) pendingLocalToolsUpdate = summary;
-	log$13.info({
+	log$14.info({
 		event: "local_tools_reconcile",
 		reason,
 		total_tools: summary.totalTools,
@@ -876,7 +878,7 @@ const localToolsExtension = (pi) => {
 				reason: "session_start"
 			});
 		} catch (err) {
-			log$13.error({
+			log$14.error({
 				err,
 				event: "local_tools_reconcile_failed"
 			}, "local tools reconcile failed");
@@ -888,7 +890,7 @@ const localToolsExtension = (pi) => {
 		try {
 			current = await listToolFiles(dir);
 		} catch (err) {
-			log$13.warn({
+			log$14.warn({
 				err,
 				event: "local_tools_listing_failed"
 			}, "tools/ listing failed");
@@ -910,7 +912,7 @@ const localToolsExtension = (pi) => {
 				reason: "auto_reload"
 			});
 		} catch (err) {
-			log$13.error({
+			log$14.error({
 				err,
 				event: "local_tools_auto_reload_failed"
 			}, "auto-reload after tools/ change failed");
@@ -941,6 +943,77 @@ function createStderrBuffer({ maxBytes }) {
 	};
 }
 //#endregion
+//#region src/extensions/mcp/schema-validator.ts
+/**
+* Lenient JSON-schema validator for MCP tool output schemas.
+*
+* The MCP SDK's `Client.listTools()` eagerly compiles every tool's
+* `outputSchema` (`cacheToolMetadata`), and its default AJV instance
+* compiles `pattern` with the `u` (unicode) flag. Real vendor servers
+* ship legacy Annex-B escapes in their patterns — PayPal's hosted MCP
+* publishes `^https\:\/\/`, whose `\:` is a hard SyntaxError under `/u`
+* ("Invalid regular expression: /^https\:\/\//u: Invalid escape").
+* With the default validator that one schema throws inside `listTools`,
+* the whole server lands in `failed`, and zero tools bind even though
+* the credential is live.
+*
+* Two layers of leniency, both scoped to *output* validation (tool
+* results), never to anything security-relevant:
+*
+* 1. `unicodeRegExp: false` — compile `pattern` without the `u` flag,
+*    which restores Annex-B tolerance for escapes like `\:` and matches
+*    what most other MCP clients (and JSON Schema's own spec, which
+*    does not require unicode mode) accept.
+* 2. A compile failure on one tool's schema must not kill the server:
+*    `getValidator` catches the throw and degrades to a pass-through
+*    validator for that tool only, so its results are simply not
+*    output-validated while every other tool stays fully functional.
+*/
+const log$13 = logger.child({ module: "mcp-schema-validator" });
+function createLenientAjv() {
+	const ajv = new Ajv({
+		strict: false,
+		validateFormats: true,
+		validateSchema: false,
+		allErrors: true,
+		unicodeRegExp: false
+	});
+	addFormats(ajv);
+	return ajv;
+}
+var LenientJsonSchemaValidator = class {
+	ajv = createLenientAjv();
+	getValidator(schema) {
+		let compiled = null;
+		try {
+			compiled = this.ajv.compile(schema);
+		} catch (err) {
+			log$13.warn({
+				err,
+				event: "mcp_output_schema_compile_failed"
+			}, "tool outputSchema failed to compile; skipping output validation for this tool");
+			return (input) => ({
+				valid: true,
+				data: input,
+				errorMessage: void 0
+			});
+		}
+		const validate = compiled;
+		return (input) => {
+			if (validate(input)) return {
+				valid: true,
+				data: input,
+				errorMessage: void 0
+			};
+			return {
+				valid: false,
+				data: void 0,
+				errorMessage: this.ajv.errorsText(validate.errors)
+			};
+		};
+	}
+};
+//#endregion
 //#region src/extensions/mcp/connect-client.ts
 /**
 * Spawns an MCP server's transport and races the initialize handshake
@@ -1091,7 +1164,10 @@ async function connectClient(id, config, opts = {}) {
 	const client = new Client({
 		name: "skydive-harness",
 		version: "0.1.0"
-	}, { capabilities: {} });
+	}, {
+		capabilities: {},
+		jsonSchemaValidator: new LenientJsonSchemaValidator()
+	});
 	if (config.transport === "http") return connectHttp(id, config, client);
 	const params = {
 		command: config.command,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skydiveai/pi-extensions",
-  "version": "0.1.0-beta.2304",
+  "version": "0.1.0-beta.2305",
   "homepage": "https://skydive.com",
   "license": "MIT",
   "author": "Create, Inc.",
@@ -36,6 +36,8 @@
     "@opentelemetry/sdk-trace-node": "^1.30.1",
     "@opentelemetry/semantic-conventions": "^1.28.0",
     "@skydiveai/pi-server": "^0.1.0",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
     "hono": "^4.6.14",
     "pino": "^9.6.0",
     "shell-quote": "^1.8.4",