pi-code 0.2.2 → 0.2.4

package/README.md

@@ -41,7 +41,8 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Hooks | `.claude/settings.json` hooks on pi lifecycle events | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`, `/output-style` switcher | `output-styles.ts` |
 | CLAUDE.md `@imports` | resolves `@path` imports pi's native loader skips | `context-imports.ts` |
-| MCP servers | `~/.claude.json`, `~/.pi/agent/mcp.json`, `.mcp.json`, `.pi/mcp.json` (later wins); stdio, HTTP, SSE | `mcp.ts` |
+| MCP servers | user `~/.claude.json`, `~/.pi/agent/mcp.json` (loaded on session start); project `.mcp.json`, `.pi/mcp.json` (only once the project is approved); stdio, HTTP, SSE | `mcp.ts` |
+| Project trust | prompts before loading project config (MCP servers, hooks, agents) that pi would otherwise trust silently | `project-approval.ts` |
 | Subagents / Task | `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents`; background runs | `subagent/` |
 | Plan mode | `plan_mode_complete` tool, exact tool snapshot/restore | `plan-mode/` |
 | Todo list | persistent overlay, status machine, compaction-safe | `todo.ts` |
@@ -54,6 +55,8 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 
 `CLAUDE.md` itself needs no extension: pi loads `CLAUDE.md` / `AGENTS.md` context files natively (global + walking cwd to root). `context-imports.ts` only adds the `@import` resolution pi's loader lacks, appending the imported files without re-injecting the base.
 
+`output-guard.ts` and `web-transport.ts` are shared internals (context-budget truncation, DNS-pinned fetch) with no feature of their own; the tools above use them.
+
 Vendored bases (`question`, `notify`, `status-line`) come from pi's MIT example extensions (see [LICENSE](LICENSE)).
 
 ## Development

package/extensions/mcp.ts

@@ -1,16 +1,20 @@
 /**
  * MCP Adapter Extension
  *
- * Connects MCP (Model Context Protocol) servers from mcp.json and registers
- * their tools in pi as `<server>_<tool>`. Async factory connects eagerly at
- * startup (per-server timeout, failures skip with a notice); stdio and HTTP
- * (streamable with SSE fallback) transports; /mcp shows status.
+ * Connects MCP (Model Context Protocol) servers and registers their tools in pi
+ * as `<server>_<tool>`. Connects on `session_start`, not from the factory (pi runs
+ * the factory for invocations that never start a session); per-server timeout,
+ * failures skip with a notice; stdio and HTTP (streamable with SSE fallback)
+ * transports; /mcp shows status.
  *
- * Reads Claude Code's MCP config too. Merge order (later wins): ~/.claude.json,
- * ~/.pi/agent/mcp.json, .mcp.json, then .pi/mcp.json. User config connects at
- * startup; project config (.mcp.json / .pi/mcp.json) can run arbitrary commands,
- * so it connects only once the project is trusted.
- * Values support ${VAR} environment interpolation.
+ * Reads Claude Code's MCP config too. User config (~/.claude.json,
+ * ~/.pi/agent/mcp.json) is the user's own and loads on the first session. Project
+ * config (.mcp.json, .pi/mcp.json) can run arbitrary commands on connect, so it
+ * loads only once the project is approved (see project-approval). The two scopes
+ * are loaded separately, not merged; user config connects first, so a project
+ * server cannot take the name of a user server that connected.
+ * Values support ${VAR} interpolation, and a stdio server receives only the SDK's
+ * default environment plus its own `env` block, not the whole process environment.
  */
 
 import * as fs from 'node:fs'
@@ -66,15 +70,6 @@ export function projectConfigPaths(cwd: string): string[] {
   return [path.join(cwd, '.mcp.json'), path.join(cwd, '.pi', 'mcp.json')]
 }
 
-/** All config files, later winning: user first, then project. */
-export function configPaths(cwd: string, home: string): string[] {
-  return [...userConfigPaths(home), ...projectConfigPaths(cwd)]
-}
-
-export function loadConfig(cwd: string): Record<string, ServerConfig> {
-  return loadConfigFrom(configPaths(cwd, os.homedir()))
-}
-
 export function loadConfigFrom(files: string[]): Record<string, ServerConfig> {
   const servers: Record<string, ServerConfig> = {}
   for (const file of files) {

package/extensions/subagent/agents.ts

@@ -159,13 +159,3 @@ export function discoverAgents(cwd: string, scope: AgentScope): AgentDiscoveryRe
   const agentMap = buildAgentMap(userAgents, projectAgents, scope)
   return { agents: Array.from(agentMap.values()), projectAgentsDir: projectPiDir }
 }
-
-export function formatAgentList(agents: AgentConfig[], maxItems: number): { text: string; remaining: number } {
-  if (agents.length === 0) return { text: 'none', remaining: 0 }
-  const listed = agents.slice(0, maxItems)
-  const remaining = agents.length - listed.length
-  return {
-    text: listed.map((a) => `${a.name} (${a.source}): ${a.description}`).join('; '),
-    remaining,
-  }
-}

package/extensions/web-transport.ts

@@ -0,0 +1,51 @@
+/**
+ * Web transport
+ *
+ * A single HTTP(S) request pinned to a caller-supplied DNS resolution. Global `fetch`
+ * resolves the hostname itself, independently of any prior guard, so a validate-then-fetch
+ * SSRF check has a time-of-check/time-of-use gap: a zero-TTL record can answer public to
+ * the guard and private to fetch's own lookup. `node:http`/`node:https` accept a `lookup`
+ * option, which is the seam that closes the gap: the socket connects to exactly the address
+ * the guard validated, while `servername` (SNI, certificate validation) and the `Host`
+ * header stay the real hostname, so virtual hosts and TLS still work.
+ */
+
+import { request as httpRequest } from 'node:http'
+import { request as httpsRequest } from 'node:https'
+import type { LookupFunction } from 'node:net'
+import { Readable } from 'node:stream'
+
+export interface TransportOptions {
+  signal: AbortSignal
+  lookup: LookupFunction
+  userAgent: string
+}
+
+/** One request, no redirect following (the caller re-validates and re-pins per hop). */
+export function httpFetch(url: URL, opts: TransportOptions): Promise<Response> {
+  const request = url.protocol === 'https:' ? httpsRequest : httpRequest
+  return new Promise((resolve, reject) => {
+    const req = request(
+      url,
+      {
+        method: 'GET',
+        headers: { 'User-Agent': opts.userAgent },
+        signal: opts.signal,
+        lookup: opts.lookup,
+        // servername is left to default to url.hostname, so SNI and certificate
+        // validation use the real host even though the socket connects to the pinned IP.
+      },
+      (res) => {
+        const headers = new Headers()
+        for (const [key, value] of Object.entries(res.headers)) {
+          if (typeof value === 'string') headers.set(key, value)
+          else if (Array.isArray(value)) headers.set(key, value.join(', '))
+        }
+        const body = Readable.toWeb(res) as ReadableStream<Uint8Array>
+        resolve(new Response(body, { status: res.statusCode ?? 0, headers }))
+      },
+    )
+    req.on('error', reject)
+    req.end()
+  })
+}

package/extensions/web.ts

@@ -6,10 +6,14 @@
  * Honors the local-only setup: no cloud accounts, plain HTTPS to public web.
  */
 
+import type { LookupAddress } from 'node:dns'
 import { lookup } from 'node:dns/promises'
+import type { LookupFunction } from 'node:net'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
 
+import { httpFetch } from './web-transport.js'
+
 const SEARCH_ENDPOINT = 'https://html.duckduckgo.com/html/?q='
 const USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) pi-code-web/0.1'
 const MAX_FETCH_CHARS = 30_000
@@ -128,15 +132,32 @@ export function isPrivateAddress(ip: string): boolean {
   return addr.includes(':') ? isPrivateIpv6(addr) : isPrivateIpv4(addr)
 }
 
-async function assertPublicHost(url: URL): Promise<void> {
+/** A lookup that always yields `addresses`, so the socket cannot resolve the host again. */
+export function pinnedLookup(addresses: LookupAddress[]): LookupFunction {
+  return (_hostname, options, callback) => {
+    const cb = (typeof options === 'function' ? options : callback) as (err: Error | null, address: unknown, family?: number) => void
+    if (typeof options !== 'function' && options.all) return cb(null, addresses)
+    const [first] = addresses
+    cb(null, first.address, first.family)
+  }
+}
+
+/**
+ * Resolve a host once, reject any private address, and return a lookup pinned to exactly
+ * those addresses. Passing that lookup to the transport is what closes the SSRF
+ * time-of-check/time-of-use gap: the connection reuses the validated resolution rather
+ * than issuing a second, unchecked DNS query that a rebinding record could answer privately.
+ */
+async function resolveAndPin(url: URL): Promise<LookupFunction> {
   const host = url.hostname.replace(/^\[|\]$/g, '')
   const addresses = await lookup(host, { all: true, verbatim: true })
-  // An empty list would leave nothing for the loop to reject, so the guard would pass
-  // vacuously. Schemes without a host (data:, file:) reach here the same way.
+  // An empty list would leave nothing to reject, so the guard would pass vacuously.
+  // Schemes without a host (data:, file:) reach here the same way.
   if (addresses.length === 0) throw new Error(`${url.hostname || url.protocol} did not resolve to any address`)
   for (const { address } of addresses) {
     if (isPrivateAddress(address)) throw new Error(`refusing to fetch private/internal address for ${url.hostname} (${address})`)
   }
+  return pinnedLookup(addresses)
 }
 
 const MAX_REDIRECTS = 5
@@ -156,14 +177,15 @@ async function readCapped(response: Response): Promise<string> {
   return text.slice(0, MAX_RAW_CHARS)
 }
 
-async function fetchText(rawUrl: string): Promise<{ text: string; contentType: string }> {
+async function fetchText(rawUrl: string, transport = httpFetch): Promise<{ text: string; contentType: string }> {
   let url = new URL(rawUrl)
   for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-    await assertPublicHost(url)
-    const response = await fetch(url, {
-      headers: { 'User-Agent': USER_AGENT },
+    // Resolve, validate and pin per hop: a redirect target gets the same guarantee.
+    const lookup = await resolveAndPin(url)
+    const response = await transport(url, {
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      redirect: 'manual',
+      lookup,
+      userAgent: USER_AGENT,
     })
     if (response.status >= 300 && response.status < 400) {
       const location = response.headers.get('location')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi-package"