pi-code 0.2.3 → 0.2.4

package/README.md

@@ -41,7 +41,8 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Hooks | `.claude/settings.json` hooks on pi lifecycle events | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`, `/output-style` switcher | `output-styles.ts` |
 | CLAUDE.md `@imports` | resolves `@path` imports pi's native loader skips | `context-imports.ts` |
-| MCP servers | `~/.claude.json`, `~/.pi/agent/mcp.json`, `.mcp.json`, `.pi/mcp.json` (later wins); stdio, HTTP, SSE | `mcp.ts` |
+| MCP servers | user `~/.claude.json`, `~/.pi/agent/mcp.json` (loaded on session start); project `.mcp.json`, `.pi/mcp.json` (only once the project is approved); stdio, HTTP, SSE | `mcp.ts` |
+| Project trust | prompts before loading project config (MCP servers, hooks, agents) that pi would otherwise trust silently | `project-approval.ts` |
 | Subagents / Task | `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents`; background runs | `subagent/` |
 | Plan mode | `plan_mode_complete` tool, exact tool snapshot/restore | `plan-mode/` |
 | Todo list | persistent overlay, status machine, compaction-safe | `todo.ts` |
@@ -54,6 +55,8 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 
 `CLAUDE.md` itself needs no extension: pi loads `CLAUDE.md` / `AGENTS.md` context files natively (global + walking cwd to root). `context-imports.ts` only adds the `@import` resolution pi's loader lacks, appending the imported files without re-injecting the base.
 
+`output-guard.ts` and `web-transport.ts` are shared internals (context-budget truncation, DNS-pinned fetch) with no feature of their own; the tools above use them.
+
 Vendored bases (`question`, `notify`, `status-line`) come from pi's MIT example extensions (see [LICENSE](LICENSE)).
 
 ## Development

package/extensions/mcp.ts

@@ -1,16 +1,20 @@
 /**
  * MCP Adapter Extension
  *
- * Connects MCP (Model Context Protocol) servers from mcp.json and registers
- * their tools in pi as `<server>_<tool>`. Async factory connects eagerly at
- * startup (per-server timeout, failures skip with a notice); stdio and HTTP
- * (streamable with SSE fallback) transports; /mcp shows status.
+ * Connects MCP (Model Context Protocol) servers and registers their tools in pi
+ * as `<server>_<tool>`. Connects on `session_start`, not from the factory (pi runs
+ * the factory for invocations that never start a session); per-server timeout,
+ * failures skip with a notice; stdio and HTTP (streamable with SSE fallback)
+ * transports; /mcp shows status.
  *
- * Reads Claude Code's MCP config too. Merge order (later wins): ~/.claude.json,
- * ~/.pi/agent/mcp.json, .mcp.json, then .pi/mcp.json. User config connects at
- * startup; project config (.mcp.json / .pi/mcp.json) can run arbitrary commands,
- * so it connects only once the project is trusted.
- * Values support ${VAR} environment interpolation.
+ * Reads Claude Code's MCP config too. User config (~/.claude.json,
+ * ~/.pi/agent/mcp.json) is the user's own and loads on the first session. Project
+ * config (.mcp.json, .pi/mcp.json) can run arbitrary commands on connect, so it
+ * loads only once the project is approved (see project-approval). The two scopes
+ * are loaded separately, not merged; user config connects first, so a project
+ * server cannot take the name of a user server that connected.
+ * Values support ${VAR} interpolation, and a stdio server receives only the SDK's
+ * default environment plus its own `env` block, not the whole process environment.
  */
 
 import * as fs from 'node:fs'
@@ -66,15 +70,6 @@ export function projectConfigPaths(cwd: string): string[] {
   return [path.join(cwd, '.mcp.json'), path.join(cwd, '.pi', 'mcp.json')]
 }
 
-/** All config files, later winning: user first, then project. */
-export function configPaths(cwd: string, home: string): string[] {
-  return [...userConfigPaths(home), ...projectConfigPaths(cwd)]
-}
-
-export function loadConfig(cwd: string): Record<string, ServerConfig> {
-  return loadConfigFrom(configPaths(cwd, os.homedir()))
-}
-
 export function loadConfigFrom(files: string[]): Record<string, ServerConfig> {
   const servers: Record<string, ServerConfig> = {}
   for (const file of files) {

package/extensions/subagent/agents.ts

@@ -159,13 +159,3 @@ export function discoverAgents(cwd: string, scope: AgentScope): AgentDiscoveryRe
   const agentMap = buildAgentMap(userAgents, projectAgents, scope)
   return { agents: Array.from(agentMap.values()), projectAgentsDir: projectPiDir }
 }
-
-export function formatAgentList(agents: AgentConfig[], maxItems: number): { text: string; remaining: number } {
-  if (agents.length === 0) return { text: 'none', remaining: 0 }
-  const listed = agents.slice(0, maxItems)
-  const remaining = agents.length - listed.length
-  return {
-    text: listed.map((a) => `${a.name} (${a.source}): ${a.description}`).join('; '),
-    remaining,
-  }
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi-package"