@tiagojct/subsub 0.24.1 → 0.25.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Sub-Sub follows the version numbers of npm: a change in the second number (0.13) adds features or changes how you use it; a change in the third (0.13.1) only fixes.
 
+## 0.25.0 (2026-11-01)
+
+- Sub-Sub runs on pi 1.4.0 (was 1.0.4). Install pi 1.4 to use the package in plain pi.
+- The `subsub` command, `subsub web` and `subsub tui` turn off pi's MCP support (`--no-mcp`). A server in an `mcp.json` file would get your library content and could change the library without Sub-Sub's previews. To use other MCP servers with Sub-Sub, add the Sub-Sub package to plain pi.
+- Inside plain pi, Sub-Sub blocks its own Zotero servers when pi reaches them through MCP (for example zotero-local-mcp in your `mcp.json`, as `mcp__zotero__tag_items`). These calls skipped the mode check and the previews. The model is told to use the Sub-Sub tool (`zotero_tag_items`) instead.
+- The themes use pi's new schema address, `https://pi.dev/schemas/theme.schema.json`.
+- Tests: `--no-mcp` for Sub-Sub sessions and not for pi's own commands, the block of the MCP copies of Sub-Sub's tools, and the themes against pi's theme schema.
+
 ## 0.24.1 (2026-11-01)
 
 - In the terminal, the tool line of a library search with several queries (your words and their synonyms, 0.24.0) shows the words it searched. It showed nothing after the tool name.

package/dist/cli.js

@@ -62,6 +62,18 @@ function sourceOf(entry) {
  * Make sure settings.json in the agent folder declares the Sub-Sub package.
  * Other settings are kept. Returns what happened, for tests and messages.
  */
+/** pi's own commands (pi install, pi mcp list, ...): their arguments go to pi unchanged. */
+const PI_COMMANDS = new Set(["install", "remove", "uninstall", "update", "list", "config", "auth", "mcp"]);
+/**
+ * Arguments for a Sub-Sub session: pi's MCP support is off. A server from an mcp.json file would get
+ * the library content and could change the library without Sub-Sub's previews. To use other MCP
+ * servers with Sub-Sub, add the Sub-Sub package to plain pi.
+ */
+export function withoutMcp(args) {
+    if (PI_COMMANDS.has(args[0] ?? "") || args.includes("--no-mcp"))
+        return args;
+    return ["--no-mcp", ...args];
+}
 export function ensureSettings(agentDir, packageDir = PACKAGE_DIR) {
     mkdirSync(agentDir, { recursive: true });
     const file = join(agentDir, "settings.json");
@@ -264,7 +276,7 @@ export async function run(argv = process.argv.slice(2)) {
     env.PI_SKIP_VERSION_CHECK ??= "1";
     // pi reports a first install to pi.dev and names itself to some providers; Sub-Sub sends no usage data.
     env.PI_TELEMETRY ??= "0";
-    process.argv = [process.argv[0], process.argv[1], ...args];
+    process.argv = [process.argv[0], process.argv[1], ...withoutMcp(args)];
     const index = fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"));
     await import(__rewriteRelativeImportExtension(pathToFileURL(join(dirname(index), "bundle", "cli.js")).href));
 }

package/dist/roles.js

@@ -80,6 +80,35 @@ export function activeTools(current, next, standalone) {
     const kept = current.filter((n) => !SERVER_PREFIXES.some((p) => n.startsWith(p)));
     return [...new Set([...kept, ...next])];
 }
+/** Tool names of Sub-Sub's servers without the prefix, for when the servers are not running. */
+const KNOWN_SERVER_TOOLS = [...ZOTERO_READ, ...ZOTERO_CHECKS, ...PREVIEW_WRITES, ...CONFIRM_WRITES];
+/**
+ * The Sub-Sub name of a tool that pi's MCP support reaches on Sub-Sub's own servers (for example
+ * zotero-local-mcp in the user's mcp.json), or undefined. pi names these tools mcp__<server>__<tool>.
+ * Such a call skips the mode check and the preview, so the gate blocks it. A tool matches when its
+ * name and description are those of a Sub-Sub tool, or when the server name has "zotero" or
+ * "scholar" and the tool name is one of Sub-Sub's.
+ */
+export function duplicateServerTool(name, description, own) {
+    if (!name.startsWith("mcp__"))
+        return undefined;
+    const rest = name.slice("mcp__".length);
+    const cut = rest.indexOf("__");
+    if (cut < 0)
+        return undefined;
+    const server = rest.slice(0, cut).toLowerCase();
+    const tool = rest.slice(cut + 2);
+    const norm = (s) => s.replace(/-/g, "_");
+    const same = own.find((t) => norm(t.name) === tool && description !== undefined && t.description !== "" && description.trim() === t.description.trim());
+    if (same)
+        return same.fullName;
+    if (!/zotero|scholar/.test(server))
+        return undefined;
+    const byName = own.find((t) => norm(t.name) === tool);
+    if (byName)
+        return byName.fullName;
+    return KNOWN_SERVER_TOOLS.find((n) => n.slice(n.indexOf("_") + 1) === tool);
+}
 /** Why a Sub-Sub tool is not available now, or undefined when it is. */
 export function unavailableReason(name, mode, registered, opts = {}) {
     if (toolsFor(mode, registered, opts).includes(name))

package/dist/subsub.js

@@ -38,7 +38,7 @@ import { glyphs, paintFromTheme, workingFrames } from "./skin.js";
 import { loadWords, toolWord } from "./words.js";
 import { systemAddition } from "./prompt.js";
 import { logUsage } from "./usage.js";
-import { activeTools, gateKind, SERVER_PREFIXES, toolsFor, unavailableReason, outboundProblem } from "./roles.js";
+import { activeTools, duplicateServerTool, gateKind, SERVER_PREFIXES, toolsFor, unavailableReason, outboundProblem } from "./roles.js";
 const MODE_ENTRY = "subsub-mode";
 const PACKAGE_DIR = join(dirname(fileURLToPath(import.meta.url)), "..");
 const BENCH_ENTRY = "subsub-bench";
@@ -596,6 +596,12 @@ export async function createSubsub(pi, deps = {}) {
         if (schema)
             coerceArgs(schema, input);
         resolvePathArgs(name, input, (p) => normalizeToolPath(p, ctx.cwd));
+        const twin = duplicateServerTool(name, pi.getAllTools().find((t) => t.name === name)?.description, bridge?.tools ?? []);
+        if (twin) {
+            if (benchOut)
+                record({ kind: "duplicate_server_blocked", tool: name });
+            return { block: true, reason: `${name} reaches Sub-Sub's server outside Sub-Sub, without the mode check and the previews. Use ${twin} instead.` };
+        }
         if (SERVER_PREFIXES.some((p) => name.startsWith(p))) {
             const why = unavailableReason(name, mode, registered(), toolOpts());
             if (why) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiagojct/subsub",
-  "version": "0.24.1",
+  "version": "0.25.0",
   "description": "Sub-Sub: a research assistant that works from your own Zotero library, in the browser or the terminal, built on pi",
   "type": "module",
   "license": "MIT",
@@ -29,7 +29,7 @@
     "@modelcontextprotocol/sdk": "^1.30.1"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "~1.0.4"
+    "@earendil-works/pi-coding-agent": "~1.4.0"
   },
   "engines": {
     "node": ">=22.19.0"
@@ -61,7 +61,7 @@
     "THIRD_PARTY_NOTICES"
   ],
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "1.0.4",
+    "@earendil-works/pi-coding-agent": "1.4.0",
     "@types/node": "^24.19.0",
     "typescript": "^5.9.3"
   },

package/scripts/make-themes.mjs

@@ -10,7 +10,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
-const SCHEMA = "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json";
+const SCHEMA = "https://pi.dev/schemas/theme.schema.json";
 
 /** The `colors:` block of the DESIGN.md front matter as {token: "#rrggbb"}. */
 export function designColors(markdown) {

package/src/cli.ts

@@ -58,6 +58,19 @@ function sourceOf(entry: unknown): string | undefined {
  * Make sure settings.json in the agent folder declares the Sub-Sub package.
  * Other settings are kept. Returns what happened, for tests and messages.
  */
+/** pi's own commands (pi install, pi mcp list, ...): their arguments go to pi unchanged. */
+const PI_COMMANDS = new Set(["install", "remove", "uninstall", "update", "list", "config", "auth", "mcp"]);
+
+/**
+ * Arguments for a Sub-Sub session: pi's MCP support is off. A server from an mcp.json file would get
+ * the library content and could change the library without Sub-Sub's previews. To use other MCP
+ * servers with Sub-Sub, add the Sub-Sub package to plain pi.
+ */
+export function withoutMcp(args: string[]): string[] {
+	if (PI_COMMANDS.has(args[0] ?? "") || args.includes("--no-mcp")) return args;
+	return ["--no-mcp", ...args];
+}
+
 export function ensureSettings(agentDir: string, packageDir: string = PACKAGE_DIR): "created" | "added" | "present" | "unreadable" {
 	mkdirSync(agentDir, { recursive: true });
 	const file = join(agentDir, "settings.json");
@@ -255,7 +268,7 @@ export async function run(argv: string[] = process.argv.slice(2)): Promise<void>
 	// pi reports a first install to pi.dev and names itself to some providers; Sub-Sub sends no usage data.
 	env.PI_TELEMETRY ??= "0";
 
-	process.argv = [process.argv[0], process.argv[1], ...args];
+	process.argv = [process.argv[0], process.argv[1], ...withoutMcp(args)];
 	const index = fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"));
 	await import(pathToFileURL(join(dirname(index), "bundle", "cli.js")).href);
 }

package/src/roles.ts

@@ -98,6 +98,32 @@ export function activeTools(current: string[], next: string[], standalone: boole
 	return [...new Set([...kept, ...next])];
 }
 
+/** Tool names of Sub-Sub's servers without the prefix, for when the servers are not running. */
+const KNOWN_SERVER_TOOLS = [...ZOTERO_READ, ...ZOTERO_CHECKS, ...PREVIEW_WRITES, ...CONFIRM_WRITES];
+
+/**
+ * The Sub-Sub name of a tool that pi's MCP support reaches on Sub-Sub's own servers (for example
+ * zotero-local-mcp in the user's mcp.json), or undefined. pi names these tools mcp__<server>__<tool>.
+ * Such a call skips the mode check and the preview, so the gate blocks it. A tool matches when its
+ * name and description are those of a Sub-Sub tool, or when the server name has "zotero" or
+ * "scholar" and the tool name is one of Sub-Sub's.
+ */
+export function duplicateServerTool(name: string, description: string | undefined, own: Array<{ name: string; fullName: string; description: string }>): string | undefined {
+	if (!name.startsWith("mcp__")) return undefined;
+	const rest = name.slice("mcp__".length);
+	const cut = rest.indexOf("__");
+	if (cut < 0) return undefined;
+	const server = rest.slice(0, cut).toLowerCase();
+	const tool = rest.slice(cut + 2);
+	const norm = (s: string) => s.replace(/-/g, "_");
+	const same = own.find((t) => norm(t.name) === tool && description !== undefined && t.description !== "" && description.trim() === t.description.trim());
+	if (same) return same.fullName;
+	if (!/zotero|scholar/.test(server)) return undefined;
+	const byName = own.find((t) => norm(t.name) === tool);
+	if (byName) return byName.fullName;
+	return KNOWN_SERVER_TOOLS.find((n) => n.slice(n.indexOf("_") + 1) === tool);
+}
+
 /** Why a Sub-Sub tool is not available now, or undefined when it is. */
 export function unavailableReason(name: string, mode: Mode, registered: string[], opts: ToolOptions = {}): string | undefined {
 	if (toolsFor(mode, registered, opts).includes(name)) return undefined;

package/src/subsub.ts

@@ -53,7 +53,7 @@ import { glyphs, paintFromTheme, workingFrames } from "./skin.ts";
 import { loadWords, toolWord, type Words } from "./words.ts";
 import { systemAddition } from "./prompt.ts";
 import { logUsage } from "./usage.ts";
-import { activeTools, gateKind, SERVER_PREFIXES, toolsFor, unavailableReason, outboundProblem } from "./roles.ts";
+import { activeTools, duplicateServerTool, gateKind, SERVER_PREFIXES, toolsFor, unavailableReason, outboundProblem } from "./roles.ts";
 
 const MODE_ENTRY = "subsub-mode";
 
@@ -647,6 +647,11 @@ export async function createSubsub(pi: ExtensionAPI, deps: SubsubDeps = {}): Pro
 		const schema = schemas.get(name);
 		if (schema) coerceArgs(schema, input);
 		resolvePathArgs(name, input, (p) => normalizeToolPath(p, ctx.cwd));
+		const twin = duplicateServerTool(name, pi.getAllTools().find((t) => t.name === name)?.description, bridge?.tools ?? []);
+		if (twin) {
+			if (benchOut) record({ kind: "duplicate_server_blocked", tool: name });
+			return { block: true, reason: `${name} reaches Sub-Sub's server outside Sub-Sub, without the mode check and the previews. Use ${twin} instead.` };
+		}
 		if (SERVER_PREFIXES.some((p) => name.startsWith(p))) {
 			const why = unavailableReason(name, mode, registered(), toolOpts());
 			if (why) {

package/themes/subsub-glauca-dark-256.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
 	"name": "subsub-glauca-dark-256",
 	"vars": {
 		"ink": 254,

package/themes/subsub-glauca-dark.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
 	"name": "subsub-glauca-dark",
 	"vars": {
 		"sheet": "#12171c",

package/themes/subsub-glauca-light-256.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
 	"name": "subsub-glauca-light-256",
 	"vars": {
 		"ink": 234,

package/themes/subsub-glauca-light.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
 	"name": "subsub-glauca-light",
 	"vars": {
 		"sheet": "#e9ece6",

package/themes/subsub-try-works-dark-256.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
 	"name": "subsub-try-works-dark-256",
 	"vars": {
 		"ink": 254,

package/themes/subsub-try-works-dark.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
 	"name": "subsub-try-works-dark",
 	"vars": {
 		"sheet": "#12171c",

package/themes/subsub-try-works-light-256.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
 	"name": "subsub-try-works-light-256",
 	"vars": {
 		"ink": 234,

package/themes/subsub-try-works-light.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"$schema": "https://pi.dev/schemas/theme.schema.json",
 	"name": "subsub-try-works-light",
 	"vars": {
 		"sheet": "#e9ece6",