openmausbot 0.1.92 → 0.1.94

package/dist-server/drivers/pi-mcp-extension.ts

@@ -1,137 +1,118 @@
-// pi-mcp-extension — the Pi-side half of "hands" for the pi engine.
-//
-// Pi core deliberately ships no MCP client (see pi's docs: "does not include
-// built-in MCP"). This extension is that client: loaded into the per-turn
-// `pi --mode rpc --no-session` process via `-e`, it reads a JSON file whose
-// path is handed in through OMB_MCP_CONFIG and mounts every server described
-// there as first-class pi tools (pi.registerTool). OpenMausBot ships this file
-// and the pi driver spawns it — the pi repo itself is never touched.
-//
-// Protocol: the OpenMausBot proxies speak raw JSON-RPC 2.0 over stdio, one
-// frame per line (no MCP SDK, no Content-Length framing) — see
-// server/mcp-bridge.ts and server/drivers/agents-proxy.ts. This client matches
-// that exactly.
-import { Type, type TObjectOptions, type TSchema, type TSchemaOptions } from "typebox";
-import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
-import { readFileSync } from "node:fs";
-
-interface McpServerDef {
-  command: string;
-  args?: string[];
-  env?: Record<string, string>;
-  /** "local-computer" marks the user's real host desktop: every tool on such
-   * a server is gated behind a permission card before it executes. */
-  scope?: string;
-}
-
-interface McpConfig {
-  mcpServers?: Record<string, McpServerDef>;
+// server/drivers/pi-mcp-extension.ts
+import { Type } from "typebox";
+import { spawn } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+
+// shared/tool-scope.ts
+var SERVER_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+var CONTROL_CHARACTER = /[\x00-\x1f\x7f]/;
+var MAX_SELECTORS = 256;
+var MAX_SELECTOR_LENGTH = 1024;
+function validName(name) {
+  return typeof name === "string" && name.trim().length > 0 && name.length <= MAX_SELECTOR_LENGTH && !CONTROL_CHARACTER.test(name) && !name.includes("*");
 }
-
-interface McpTool {
-  name: string;
-  description?: string;
-  inputSchema?: unknown;
+function selectorIdentity(selector) {
+  if (selector.length > MAX_SELECTOR_LENGTH || CONTROL_CHARACTER.test(selector)) return;
+  if (selector.startsWith("native:")) {
+    const name = selector.slice(7);
+    if (name === "*" || validName(name)) return { kind: "native", name };
+  } else if (selector.startsWith("mcp:")) {
+    const separator = selector.indexOf(":", 4);
+    if (separator < 0) return;
+    const server = selector.slice(4, separator);
+    const name = selector.slice(separator + 1);
+    if (SERVER_NAME.test(server) && (name === "*" || validName(name))) {
+      return { kind: "mcp", server, name };
+    }
+  }
 }
-
-interface McpTextContent {
-  type: "text";
-  text: unknown;
+function parseToolScope(value) {
+  if (value === void 0) return { ok: true, scope: void 0 };
+  const invalid = { ok: false, error: "Tool selection must contain only valid allow and deny lists." };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return invalid;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return invalid;
+  const scope = {};
+  for (const key of Reflect.ownKeys(value)) {
+    if (key !== "allow" && key !== "deny") return invalid;
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor)) return invalid;
+    const list = descriptor.value;
+    if (!Array.isArray(list) || list.length > MAX_SELECTORS) return invalid;
+    if (!Array.from(list).every((entry) => typeof entry === "string" && selectorIdentity(entry))) return invalid;
+    scope[key] = [...new Set(list)];
+  }
+  return { ok: true, scope };
 }
-
-interface McpImageContent {
-  type: "image";
-  data: unknown;
-  mimeType: unknown;
+function matches(selector, tool) {
+  const selected = selectorIdentity(selector);
+  return selected?.kind === tool.kind && (selected.kind !== "mcp" || tool.kind === "mcp" && selected.server === tool.server) && (selected.name === "*" || selected.name === tool.name);
 }
-
-type PiToolContent = { type: "text"; text: string } | { type: "image"; data: string; mimeType: string };
-
-interface PiToolContext {
-  ui: {
-    confirm(title: string, message: string): Promise<boolean>;
-  };
+function permits(scope, tool) {
+  if (!validName(tool.name) || tool.kind === "mcp" && !SERVER_NAME.test(tool.server)) return false;
+  return (scope?.allow === void 0 || scope.allow.some((selector) => matches(selector, tool))) && !scope?.deny?.some((selector) => matches(selector, tool));
 }
-
-interface PiToolDefinition {
-  name: string;
-  label: string;
-  description: string;
-  parameters: TSchema;
-  execute(
-    toolCallId: string,
-    params: unknown,
-    signal: AbortSignal | undefined,
-    onUpdate: unknown,
-    context: PiToolContext,
-  ): Promise<{ content: PiToolContent[]; details: Record<string, never> }>;
+function allowsTool(scope, tool) {
+  const parsed = parseToolScope(scope);
+  return parsed.ok && permits(parsed.scope, tool);
 }
-
-/** Structural slice of Pi 0.84's ExtensionAPI used by this standalone file.
- * Keeping it local avoids bundling Pi into OpenMausBot; the extension is
- * loaded by the user's installed Pi, which supplies the real implementation. */
-interface PiExtensionApi {
-  registerTool(definition: PiToolDefinition): void;
-  on(event: "session_shutdown", handler: () => void): void;
+function canUseMcpServer(scope, server, names) {
+  const parsed = parseToolScope(scope);
+  if (!parsed.ok || !SERVER_NAME.test(server)) return false;
+  if (names !== void 0) {
+    return names.some((name) => permits(parsed.scope, { kind: "mcp", server, name }));
+  }
+  if (parsed.scope?.deny?.includes(`mcp:${server}:*`)) return false;
+  if (parsed.scope?.allow === void 0) return true;
+  return parsed.scope.allow.some((selector) => {
+    const selected = selectorIdentity(selector);
+    return selected?.kind === "mcp" && selected.server === server && (selected.name === "*" || permits(parsed.scope, selected));
+  });
 }
 
-const MCP_STARTUP_TIMEOUT_MS = 8_000;
-const MCP_TOOL_TIMEOUT_MS = 10 * 60_000;
-const MCP_MAX_LIST_PAGES = 100;
-const MCP_MAX_FRAME_BYTES = 32 * 1024 * 1024;
-const TOOL_OUTPUT_MAX_BYTES = 50 * 1024;
-const TOOL_OUTPUT_MAX_LINES = 2_000;
-const TOOL_NAME_MAX_LENGTH = 64;
-
-/** A minimal stdio JSON-RPC 2.0 MCP client, matched to OpenMausBot's
- * newline-delimited house protocol. */
-export class StdioMcp {
-  private child: ChildProcessWithoutNullStreams;
-  private buf = "";
-  private nextId = 1;
-  private disposed = false;
-  private pending = new Map<number, { resolve: (v: unknown) => void; reject: (e: Error) => void }>();
-
-  constructor(def: McpServerDef) {
+// server/drivers/pi-mcp-extension.ts
+var MCP_STARTUP_TIMEOUT_MS = 8e3;
+var MCP_TOOL_TIMEOUT_MS = 10 * 6e4;
+var MCP_MAX_LIST_PAGES = 100;
+var MCP_MAX_FRAME_BYTES = 32 * 1024 * 1024;
+var TOOL_OUTPUT_MAX_BYTES = 50 * 1024;
+var TOOL_OUTPUT_MAX_LINES = 2e3;
+var TOOL_NAME_MAX_LENGTH = 64;
+var StdioMcp = class {
+  child;
+  buf = "";
+  nextId = 1;
+  disposed = false;
+  pending = /* @__PURE__ */ new Map();
+  constructor(def) {
     this.child = spawn(def.command, def.args ?? [], {
       stdio: ["pipe", "pipe", "pipe"],
-      env: { ...process.env, ...def.env },
+      env: { ...process.env, ...def.env }
     });
     this.child.stderr.on("data", () => {
-      /* best-effort drain so a chatty server never blocks */
     });
     this.child.stdout.setEncoding("utf8");
-    this.child.stdout.on("data", (chunk: string) => this.onData(chunk));
+    this.child.stdout.on("data", (chunk) => this.onData(chunk));
     this.child.on("error", (err) => this.closeWithError(err));
-    // A server that starts and then dies emits `exit`, never `error`; without
-    // settling on it, an in-flight init/listTools would hang the extension
-    // load for the whole turn.
     this.child.on("exit", (code) => this.closeWithError(new Error(`MCP server exited (code ${code ?? "?"})`)));
-    // A write to a dead child errors asynchronously on the stream; an
-    // unhandled stream error would kill the pi process (the same hazard
-    // spawnCli documents for driver-spawned children in procs.ts).
     this.child.stdin.on("error", () => this.closeWithError(new Error("MCP server stdin closed")));
   }
-
-  private failAll(err: Error): void {
+  failAll(err) {
     for (const [, p] of this.pending) p.reject(err);
     this.pending.clear();
   }
-
-  private closeWithError(err: Error): void {
+  closeWithError(err) {
     if (this.disposed) return;
     this.disposed = true;
     this.failAll(err);
     try {
       this.child.kill();
     } catch {
-      /* already gone */
     }
   }
-
-  private onData(chunk: string): void {
+  onData(chunk) {
     this.buf += chunk;
-    let nl: number;
+    let nl;
     while ((nl = this.buf.indexOf("\n")) !== -1) {
       const line = this.buf.slice(0, nl).trim();
       this.buf = this.buf.slice(nl + 1);
@@ -140,22 +121,20 @@ export class StdioMcp {
         this.closeWithError(new Error(`MCP frame exceeded ${MCP_MAX_FRAME_BYTES} bytes`));
         return;
       }
-      let msg: { id?: unknown; method?: unknown; error?: { message?: string }; result?: unknown };
+      let msg;
       try {
         msg = JSON.parse(line);
       } catch {
         continue;
       }
       if (typeof msg.id === "number" && this.pending.has(msg.id)) {
-        const p = this.pending.get(msg.id)!;
+        const p = this.pending.get(msg.id);
         this.pending.delete(msg.id);
         if (msg.error) p.reject(new Error(msg.error.message ?? "MCP error"));
         else p.resolve(msg.result);
         continue;
       }
-      // This minimal client does not implement server→client requests. Reply
-      // explicitly instead of leaving a conforming server waiting forever.
-      if (msg.id !== undefined && typeof msg.method === "string") {
+      if (msg.id !== void 0 && typeof msg.method === "string") {
         try {
           this.write({ jsonrpc: "2.0", id: msg.id, error: { code: -32601, message: "Client method not supported" } });
         } catch (err) {
@@ -163,44 +142,38 @@ export class StdioMcp {
           return;
         }
       }
-      // Notifications (e.g. notifications/tools/list_changed) are intentionally
-      // ignored for this single-shot mount.
     }
     if (Buffer.byteLength(this.buf, "utf8") > MCP_MAX_FRAME_BYTES) {
       this.closeWithError(new Error(`MCP frame exceeded ${MCP_MAX_FRAME_BYTES} bytes without a newline`));
     }
   }
-
-  private write(frame: unknown): void {
+  write(frame) {
     if (this.disposed || this.child.stdin.destroyed || !this.child.stdin.writable) {
       throw new Error("MCP server stdin is closed");
     }
     this.child.stdin.write(JSON.stringify(frame) + "\n");
   }
-
-  private call(method: string, params: unknown, timeoutMs: number, signal?: AbortSignal): Promise<unknown> {
+  call(method, params, timeoutMs, signal) {
     if (this.disposed) return Promise.reject(new Error("MCP client is closed"));
     if (signal?.aborted) return Promise.reject(new Error(`MCP ${method} aborted`));
-
     const id = this.nextId++;
-    return new Promise<unknown>((resolve, reject) => {
+    return new Promise((resolve, reject) => {
       let settled = false;
       const cleanup = () => {
         clearTimeout(timer);
         signal?.removeEventListener("abort", onAbort);
       };
-      const settle = (fn: () => void) => {
+      const settle = (fn) => {
         if (settled) return;
         settled = true;
         cleanup();
         fn();
       };
-      const cancel = (reason: string) => {
+      const cancel = (reason) => {
         this.pending.delete(id);
         try {
           this.notify("notifications/cancelled", { requestId: id, reason });
         } catch {
-          /* the transport may already be gone */
         }
         settle(() => reject(new Error(reason)));
       };
@@ -210,7 +183,7 @@ export class StdioMcp {
       signal?.addEventListener("abort", onAbort, { once: true });
       this.pending.set(id, {
         resolve: (value) => settle(() => resolve(value)),
-        reject: (err) => settle(() => reject(err)),
+        reject: (err) => settle(() => reject(err))
       });
       try {
         this.write({ jsonrpc: "2.0", id, method, params });
@@ -220,38 +193,35 @@ export class StdioMcp {
       }
     });
   }
-
-  private notify(method: string, params?: unknown): void {
+  notify(method, params) {
     this.write({ jsonrpc: "2.0", method, params });
   }
-
-  async init(): Promise<void> {
+  async init() {
     await this.call(
       "initialize",
       {
         protocolVersion: "2024-11-05",
         capabilities: {},
-        clientInfo: { name: "openmausbot-pi", version: "1" },
+        clientInfo: { name: "openmausbot-pi", version: "1" }
       },
-      MCP_STARTUP_TIMEOUT_MS,
+      MCP_STARTUP_TIMEOUT_MS
     );
     this.notify("notifications/initialized");
   }
-
-  async listTools(): Promise<McpTool[]> {
-    const tools: McpTool[] = [];
-    const seenCursors = new Set<string>();
+  async listTools() {
+    const tools = [];
+    const seenCursors = /* @__PURE__ */ new Set();
     const deadline = Date.now() + MCP_STARTUP_TIMEOUT_MS;
-    let cursor: string | undefined;
+    let cursor;
     for (let page = 0; page < MCP_MAX_LIST_PAGES; page += 1) {
       const remainingMs = Math.max(1, deadline - Date.now());
-      const res = (await this.call(
+      const res = await this.call(
         "tools/list",
         cursor ? { cursor } : {},
-        remainingMs,
-      )) as { tools?: unknown; nextCursor?: unknown } | undefined;
+        remainingMs
+      );
       if (!Array.isArray(res?.tools)) throw new Error("MCP tools/list returned no tools array");
-      tools.push(...(res.tools as McpTool[]));
+      tools.push(...res.tools);
       if (typeof res.nextCursor !== "string" || !res.nextCursor) return tools;
       if (seenCursors.has(res.nextCursor)) throw new Error("MCP tools/list repeated a pagination cursor");
       seenCursors.add(res.nextCursor);
@@ -259,84 +229,39 @@ export class StdioMcp {
     }
     throw new Error(`MCP tools/list exceeded ${MCP_MAX_LIST_PAGES} pages`);
   }
-
   /** tools/call → Pi content, preserving screenshots and bounding text so a
    * remote server cannot flood the model context. */
-  async callTool(name: string, args: unknown, signal?: AbortSignal): Promise<{ content: PiToolContent[]; isError: boolean }> {
-    const res = (await this.call(
+  async callTool(name, args, signal) {
+    const res = await this.call(
       "tools/call",
       { name, arguments: args ?? {} },
       MCP_TOOL_TIMEOUT_MS,
-      signal,
-    )) as { content?: unknown; isError?: boolean } | undefined;
+      signal
+    );
     const rawContent = Array.isArray(res?.content) ? res.content : [];
-    const text = rawContent
-      .filter((c): c is McpTextContent => Boolean(c) && (c as { type?: unknown }).type === "text")
-      .map((c) => String(c.text ?? ""))
-      .join("\n");
-    const images = rawContent
-      .filter(
-        (c): c is McpImageContent =>
-          Boolean(c) &&
-          (c as { type?: unknown }).type === "image" &&
-          typeof (c as McpImageContent).data === "string" &&
-          typeof (c as McpImageContent).mimeType === "string",
-      )
-      .map((c) => ({ type: "image" as const, data: String(c.data), mimeType: String(c.mimeType) }));
-    const unsupported = rawContent.length - rawContent.filter((c) => (c as { type?: unknown })?.type === "text").length - images.length;
+    const text = rawContent.filter((c) => Boolean(c) && c.type === "text").map((c) => String(c.text ?? "")).join("\n");
+    const images = rawContent.filter(
+      (c) => Boolean(c) && c.type === "image" && typeof c.data === "string" && typeof c.mimeType === "string"
+    ).map((c) => ({ type: "image", data: String(c.data), mimeType: String(c.mimeType) }));
+    const unsupported = rawContent.length - rawContent.filter((c) => c?.type === "text").length - images.length;
     let boundedText = truncateToolText(text || (images.length ? "" : "(empty result)"));
     if (unsupported > 0) boundedText += `${boundedText ? "\n" : ""}[${unsupported} unsupported MCP content item(s) omitted]`;
     return {
-      content: [...(boundedText ? [{ type: "text" as const, text: boundedText }] : []), ...images],
-      isError: Boolean(res?.isError),
+      content: [...boundedText ? [{ type: "text", text: boundedText }] : [], ...images],
+      isError: Boolean(res?.isError)
     };
   }
-
-  dispose(): void {
+  dispose() {
     if (this.disposed) return;
     this.disposed = true;
     this.failAll(new Error("MCP client disposed"));
     try {
       this.child.kill();
     } catch {
-      /* already gone */
     }
   }
-}
-
-interface JsonSchema {
-  type?: string | string[];
-  title?: unknown;
-  description?: unknown;
-  default?: unknown;
-  const?: unknown;
-  enum?: unknown[];
-  nullable?: unknown;
-  anyOf?: unknown[];
-  oneOf?: unknown[];
-  allOf?: unknown[];
-  items?: unknown | unknown[];
-  prefixItems?: unknown[];
-  properties?: Record<string, unknown>;
-  required?: unknown;
-  additionalProperties?: unknown;
-  minimum?: unknown;
-  maximum?: unknown;
-  exclusiveMinimum?: unknown;
-  exclusiveMaximum?: unknown;
-  multipleOf?: unknown;
-  minLength?: unknown;
-  maxLength?: unknown;
-  pattern?: unknown;
-  format?: unknown;
-  minItems?: unknown;
-  maxItems?: unknown;
-  uniqueItems?: unknown;
-  minProperties?: unknown;
-  maxProperties?: unknown;
-}
-
-const SCHEMA_OPTION_KEYS = [
+};
+var SCHEMA_OPTION_KEYS = [
   "title",
   "description",
   "default",
@@ -353,64 +278,54 @@ const SCHEMA_OPTION_KEYS = [
   "maxItems",
   "uniqueItems",
   "minProperties",
-  "maxProperties",
-] as const;
-
-function schemaOptions(schema: JsonSchema): TSchemaOptions {
-  const options: TSchemaOptions = {};
+  "maxProperties"
+];
+function schemaOptions(schema) {
+  const options = {};
   for (const key of SCHEMA_OPTION_KEYS) {
     const value = schema[key];
-    if (value !== undefined) Reflect.set(options, key, value);
+    if (value !== void 0) Reflect.set(options, key, value);
   }
   return options;
 }
-
-function isSchemaObject(value: unknown): value is JsonSchema {
+function isSchemaObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
-
-function primitiveLiteral(value: unknown): TSchema | null {
+function primitiveLiteral(value) {
   if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
     return Type.Literal(value);
   }
   if (value === null) return Type.Null();
   return null;
 }
-
-function withNullable(schema: TSchema, nullable: unknown): TSchema {
+function withNullable(schema, nullable) {
   return nullable === true ? Type.Union([schema, Type.Null()]) : schema;
 }
-
-function collectObjectShape(schema: JsonSchema): { properties: Record<string, unknown>; required: Set<string> } {
-  const properties: Record<string, unknown> = {};
-  const required = new Set<string>();
-
-  const visit = (candidate: unknown, mode: "root" | "all" | "choice") => {
+function collectObjectShape(schema) {
+  const properties = {};
+  const required = /* @__PURE__ */ new Set();
+  const visit = (candidate, mode) => {
     if (!isSchemaObject(candidate)) return;
     for (const branch of candidate.allOf ?? []) visit(branch, mode === "choice" ? "choice" : "all");
-    for (const branch of [...(candidate.anyOf ?? []), ...(candidate.oneOf ?? [])]) visit(branch, "choice");
+    for (const branch of [...candidate.anyOf ?? [], ...candidate.oneOf ?? []]) visit(branch, "choice");
     for (const [key, value] of Object.entries(candidate.properties ?? {})) {
-      // The root declaration is authoritative; branch-only properties are
-      // still retained so the model knows which arguments exist.
-      if (mode === "root" || properties[key] === undefined) properties[key] = value;
+      if (mode === "root" || properties[key] === void 0) properties[key] = value;
     }
     if (mode !== "choice" && Array.isArray(candidate.required)) {
       for (const key of candidate.required) if (typeof key === "string") required.add(key);
     }
   };
-
   visit(schema, "root");
   return { properties, required };
 }
-
-function objectSchema(schema: JsonSchema, root = false): TSchema {
+function objectSchema(schema, root = false) {
   const { properties, required } = collectObjectShape(schema);
-  const converted: Record<string, TSchema> = {};
+  const converted = {};
   for (const [key, value] of Object.entries(properties)) {
     const nested = nestedTypebox(value);
     converted[key] = required.has(key) ? nested : Type.Optional(nested);
   }
-  const options: TObjectOptions = schemaOptions(schema);
+  const options = schemaOptions(schema);
   if (typeof schema.additionalProperties === "boolean") {
     options.additionalProperties = schema.additionalProperties;
   } else if (isSchemaObject(schema.additionalProperties)) {
@@ -419,34 +334,26 @@ function objectSchema(schema: JsonSchema, root = false): TSchema {
   const object = Type.Object(converted, options);
   return root ? object : withNullable(object, schema.nullable);
 }
-
-function nestedTypebox(schema: unknown): TSchema {
+function nestedTypebox(schema) {
   if (!isSchemaObject(schema)) return Type.Any();
   const options = schemaOptions(schema);
-
   const literal = primitiveLiteral(schema.const);
   if (literal) return withNullable(literal, schema.nullable);
-
   if (Array.isArray(schema.enum) && schema.enum.length > 0) {
     if (schema.enum.every((value) => typeof value === "string")) {
-      // `{type:"string", enum:[...]}` works across Google/OpenAI/Anthropic;
-      // Type.Union(Type.Literal(...)) does not work with Google's tool API.
       return withNullable(Type.String({ ...options, enum: schema.enum }), schema.nullable);
     }
-    const literals = schema.enum.map(primitiveLiteral).filter((value): value is TSchema => value !== null);
+    const literals = schema.enum.map(primitiveLiteral).filter((value) => value !== null);
     if (literals.length === schema.enum.length) {
       const union = literals.length === 1 ? literals[0] : Type.Union(literals, options);
       return withNullable(union, schema.nullable);
     }
   }
-
   if (Array.isArray(schema.type)) {
     const variants = schema.type.map((type) => nestedTypebox({ ...schema, type, nullable: false }));
     return variants.length === 1 ? variants[0] : Type.Union(variants, options);
   }
-
   if (schema.type === "object" || schema.properties) return objectSchema(schema);
-
   const choice = schema.anyOf ?? schema.oneOf;
   if (Array.isArray(choice) && choice.length > 0) {
     const variants = choice.map(nestedTypebox);
@@ -456,7 +363,6 @@ function nestedTypebox(schema: unknown): TSchema {
     const variants = schema.allOf.map(nestedTypebox);
     return withNullable(variants.length === 1 ? variants[0] : Type.Intersect(variants, options), schema.nullable);
   }
-
   switch (schema.type) {
     case "string":
       return withNullable(Type.String(options), schema.nullable);
@@ -469,34 +375,22 @@ function nestedTypebox(schema: unknown): TSchema {
     case "null":
       return Type.Null();
     case "array": {
-      const tupleItems = schema.prefixItems ?? (Array.isArray(schema.items) ? schema.items : undefined);
-      const value = tupleItems
-        ? Type.Tuple(tupleItems.map(nestedTypebox), options)
-        : Type.Array(schema.items ? nestedTypebox(schema.items) : Type.Any(), options);
+      const tupleItems = schema.prefixItems ?? (Array.isArray(schema.items) ? schema.items : void 0);
+      const value = tupleItems ? Type.Tuple(tupleItems.map(nestedTypebox), options) : Type.Array(schema.items ? nestedTypebox(schema.items) : Type.Any(), options);
       return withNullable(value, schema.nullable);
     }
     default:
       return Type.Any();
   }
 }
-
-/** Best-effort JSON Schema → TypeBox. MCP tool parameters must always expose
- * an object at the root; Pi/provider tool serialization rejects a root schema
- * without `type: "object"`. Nested schemas retain unions, nullability and
- * constraints instead of being incorrectly rewritten as objects. */
-export function toTypebox(schema: unknown): TSchema {
+function toTypebox(schema) {
   return objectSchema(isSchemaObject(schema) ? schema : {}, true);
 }
-
-/** pi tool names are lowercase snake identifiers; MCP tool names are not
- * (COMPOSIO_SEARCH_TOOLS, browser_navigate, mcp__x…). Normalize and prefix
- * with the server so two servers can never collide. */
-function sanitizeToolName(server: string, tool: string): string {
+function sanitizeToolName(server, tool) {
   const raw = `${server}_${tool}`.toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/^_+|_+$/g, "");
   return raw.slice(0, TOOL_NAME_MAX_LENGTH) || "mcp_tool";
 }
-
-export function allocateToolName(server: string, tool: string, used: Set<string>): string {
+function allocateToolName(server, tool, used) {
   const base = sanitizeToolName(server, tool);
   let candidate = base;
   for (let suffixNumber = 2; used.has(candidate); suffixNumber += 1) {
@@ -505,28 +399,25 @@ export function allocateToolName(server: string, tool: string, used: Set<string>
   }
   return candidate;
 }
-
-export function truncateToolText(text: string): string {
+function truncateToolText(text) {
   const lines = text.split("\n");
   const lineLimited = lines.slice(0, TOOL_OUTPUT_MAX_LINES).join("\n");
   const bytes = Buffer.from(lineLimited, "utf8");
   let byteEnd = Math.min(bytes.length, TOOL_OUTPUT_MAX_BYTES);
-  // Avoid returning a replacement character when the byte limit lands in the
-  // middle of a UTF-8 code point.
-  while (byteEnd > 0 && byteEnd < bytes.length && (bytes[byteEnd] & 0xc0) === 0x80) byteEnd -= 1;
+  while (byteEnd > 0 && byteEnd < bytes.length && (bytes[byteEnd] & 192) === 128) byteEnd -= 1;
   const content = bytes.subarray(0, byteEnd).toString("utf8");
   const truncatedByLines = lines.length > TOOL_OUTPUT_MAX_LINES;
   const truncatedByBytes = bytes.length > TOOL_OUTPUT_MAX_BYTES;
   if (!truncatedByLines && !truncatedByBytes) return content;
   const reasons = [
-    ...(truncatedByLines ? [`${TOOL_OUTPUT_MAX_LINES}-line limit`] : []),
-    ...(truncatedByBytes ? [`${TOOL_OUTPUT_MAX_BYTES / 1024}KB limit`] : []),
+    ...truncatedByLines ? [`${TOOL_OUTPUT_MAX_LINES}-line limit`] : [],
+    ...truncatedByBytes ? [`${TOOL_OUTPUT_MAX_BYTES / 1024}KB limit`] : []
   ];
-  return `${content}\n\n[MCP output truncated: ${reasons.join(" and ")}. Refine the request for less output.]`;
-}
+  return `${content}
 
-/** A short human-readable line for the permission card's detail. */
-function summarizeParams(params: unknown): string {
+[MCP output truncated: ${reasons.join(" and ")}. Refine the request for less output.]`;
+}
+function summarizeParams(params) {
   try {
     const s = JSON.stringify(params ?? {});
     return s === "{}" ? "" : s.slice(0, 300);
@@ -534,54 +425,111 @@ function summarizeParams(params: unknown): string {
     return "";
   }
 }
-
-export default async function (pi: PiExtensionApi): Promise<void> {
+async function pi_mcp_extension_default(pi) {
   const configPath = process.env.OMB_MCP_CONFIG;
   if (!configPath) return;
-
-  let config: McpConfig;
+  let config;
   try {
-    config = JSON.parse(readFileSync(configPath, "utf8")) as McpConfig;
+    config = JSON.parse(readFileSync(configPath, "utf8"));
   } catch {
-    return;
+    throw new Error("OpenMausBot Pi MCP configuration could not be read");
+  }
+  if (!config || typeof config !== "object" || Array.isArray(config)) throw new Error("OpenMausBot Pi MCP configuration is invalid");
+  const parsed = parseToolScope(config.toolScope);
+  if (!parsed.ok) throw new Error(parsed.error);
+  const scope = parsed.scope;
+  if (scope !== void 0 && (typeof pi.getActiveTools !== "function" || typeof pi.setActiveTools !== "function")) throw new Error("Pi tool selection enforcement APIs are unavailable");
+  const used = /* @__PURE__ */ new Set();
+  const identities = /* @__PURE__ */ new Map();
+  let enforcementFailed = false;
+  const clients = [];
+  const serverEntries = Object.entries(config.mcpServers ?? {}).filter(([name]) => scope === void 0 || canUseMcpServer(scope, name));
+  if (scope !== void 0) {
+    const allowed = (name) => allowsTool(scope, identities.get(name) ?? { kind: "native", name });
+    const intersect = () => {
+      if (enforcementFailed) throw new Error("Pi tool selection enforcement is unavailable");
+      try {
+        const active = pi.getActiveTools();
+        if (!Array.isArray(active) || active.some((name) => typeof name !== "string")) throw new Error("Pi tool selection enforcement returned an invalid catalog");
+        const requested = new Set(active.filter(allowed));
+        pi.setActiveTools([...requested]);
+        const selected = pi.getActiveTools();
+        if (!Array.isArray(selected) || selected.some((name) => !requested.has(name))) throw new Error("Pi tool selection enforcement did not apply the active-tool restriction");
+        if (config.scopeReadyPath) writeFileSync(config.scopeReadyPath, JSON.stringify({ ok: true, toolScope: scope }), { mode: 384 });
+        return selected;
+      } catch (error) {
+        enforcementFailed = true;
+        if (config.scopeReadyPath) {
+          try {
+            writeFileSync(config.scopeReadyPath, JSON.stringify({ ok: false }), { mode: 384 });
+          } catch {
+          }
+        }
+        throw error;
+      }
+    };
+    for (const event of ["session_start", "session_switch", "model_select", "before_agent_start", "context"]) pi.on(event, () => {
+      intersect();
+    });
+    pi.on("tool_call", (event) => !enforcementFailed && typeof event?.toolName === "string" && allowed(event.toolName) ? void 0 : { block: true, reason: "Tool selection excludes this tool" });
+    pi.on("before_provider_request", (event, context) => {
+      let selected = /* @__PURE__ */ new Set();
+      try {
+        selected = new Set(intersect());
+      } catch {
+        try {
+          context?.abort?.();
+        } catch {
+        }
+      }
+      const declared = (name) => selected.has(name) && allowed(name);
+      const payload = event?.payload;
+      if (!payload || typeof payload !== "object") return payload;
+      const body = payload;
+      if (Array.isArray(body.tools)) body.tools = body.tools.flatMap((value) => {
+        if (!value || typeof value !== "object") return [];
+        const tool = value;
+        if (Array.isArray(tool.functionDeclarations)) {
+          const functionDeclarations = tool.functionDeclarations.filter((declaration) => typeof declaration.name === "string" && declared(declaration.name));
+          return functionDeclarations.length ? [{ ...tool, functionDeclarations }] : [];
+        }
+        const name = tool.function?.name ?? tool.name;
+        return typeof name === "string" && declared(name) ? [tool] : [];
+      });
+      return payload;
+    });
   }
-
-  const used = new Set<string>();
-  const clients: StdioMcp[] = [];
-  const serverEntries = Object.entries(config.mcpServers ?? {});
-
-  // Mount independent servers concurrently so one slow integration cannot
-  // consume the startup timeout once per server. Registration remains in
-  // config order below for deterministic tool names and collision suffixes.
   const mounts = await Promise.all(
     serverEntries.map(async ([serverName, def]) => {
       if (!def || typeof def.command !== "string" || !def.command.trim()) return { serverName };
-      let client: StdioMcp | undefined;
+      let client;
       try {
         client = new StdioMcp(def);
         await client.init();
         return { serverName, def, client, tools: await client.listTools() };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`[openmausbot-pi-mcp] ${serverName}: ${message}\n`);
+        process.stderr.write(`[openmausbot-pi-mcp] ${serverName}: ${message}
+`);
         client?.dispose();
         return { serverName };
       }
-    }),
+    })
   );
-
   for (const mount of mounts) {
     if (!mount.client || !mount.def || !mount.tools) continue;
     const { serverName, def, client, tools } = mount;
-    const gated = def.scope === "local-computer";
+    const gated = def.scope === "local-computer" || def.scope === "custom" && config.approvalMode !== "full";
     let registered = 0;
-
     for (const tool of tools) {
       if (!tool || typeof tool.name !== "string" || !tool.name.trim()) {
-        process.stderr.write(`[openmausbot-pi-mcp] ${serverName}: skipped a tool with no valid name\n`);
+        process.stderr.write(`[openmausbot-pi-mcp] ${serverName}: skipped a tool with no valid name
+`);
         continue;
       }
       const toolName = tool.name;
+      const identity = { kind: "mcp", server: serverName, name: toolName };
+      if (scope !== void 0 && !allowsTool(scope, identity)) continue;
       const name = allocateToolName(serverName, toolName, used);
       try {
         const parameters = toTypebox(tool.inputSchema);
@@ -591,14 +539,12 @@ export default async function (pi: PiExtensionApi): Promise<void> {
           description: typeof tool.description === "string" ? tool.description : `${toolName} (MCP tool from ${serverName})`,
           parameters,
           async execute(_toolCallId, params, signal, _onUpdate, ctx) {
-            // Host tools ask first, using pi's native permission card
-            // (ctx.ui.confirm → extension_ui_request → Allow/Deny card). This
-            // mirrors ACP's session/request_permission and Codex's elicitation.
+            if (scope !== void 0 && (enforcementFailed || !allowsTool(scope, identity))) throw new Error("Tool selection excludes this tool");
             if (gated) {
               const detail = summarizeParams(params);
               const allowed = await ctx.ui.confirm(
-                `Allow ${toolName} on your computer?`,
-                detail || `Run ${serverName}:${toolName}`,
+                def.scope === "local-computer" ? `Allow ${toolName} on your computer?` : `Allow ${serverName}:${toolName}?`,
+                detail || `Run ${serverName}:${toolName}`
               );
               if (!allowed) {
                 return { content: [{ type: "text", text: "Blocked by the user." }], details: {} };
@@ -606,33 +552,33 @@ export default async function (pi: PiExtensionApi): Promise<void> {
             }
             const res = await client.callTool(toolName, params, signal);
             if (res.isError) {
-              const message = res.content
-                .filter((item): item is { type: "text"; text: string } => item.type === "text")
-                .map((item) => item.text)
-                .join("\n");
-              // Pi marks a custom tool as failed only when execute throws;
-              // returning error-looking text incorrectly produces isError=false.
+              const message = res.content.filter((item) => item.type === "text").map((item) => item.text).join("\n");
               throw new Error(message || `MCP tool ${serverName}:${toolName} returned an error`);
             }
             return { content: res.content, details: {} };
-          },
+          }
         });
         used.add(name);
+        identities.set(name, identity);
         registered += 1;
       } catch (err) {
-        // One malformed tool must not dispose the client behind tools that
-        // were already registered from the same server.
         const message = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`[openmausbot-pi-mcp] ${serverName}:${toolName}: ${message}\n`);
+        process.stderr.write(`[openmausbot-pi-mcp] ${serverName}:${toolName}: ${message}
+`);
       }
     }
-
     if (registered > 0) clients.push(client);
     else client.dispose();
   }
-
   pi.on("session_shutdown", () => {
     for (const c of clients) c.dispose();
     clients.length = 0;
   });
 }
+export {
+  StdioMcp,
+  allocateToolName,
+  pi_mcp_extension_default as default,
+  toTypebox,
+  truncateToolText
+};