pi-code 1.0.20 → 1.0.22

package/extensions/env-settings.ts

@@ -13,19 +13,21 @@
  * approval-gated on purpose: a checked-out repository's env can redirect providers
  * (ANTHROPIC_BASE_URL and friends), so an untrusted repo must not reach process.env.
  *
- * Precedence is per key, managed > user > project, matching Claude's merge: a scope
- * only supplies keys it names and never wipes another scope's keys. Values must be
- * strings; a number or boolean is coerced via String, anything else is skipped.
+ * Precedence is per key, managed > project (settings.local.json overlaying
+ * settings.json inside the project scope) > user, matching Claude's settings
+ * precedence: a scope only supplies keys it names and never wipes another scope's
+ * keys. Values must be strings; a number or boolean is coerced via String,
+ * anything else is skipped.
  *
- * A variable already present in the real environment that this module did not set is
- * left untouched for the user and project scopes: a shell `export` outranks them. The
- * managed scope is the exception: an org policy env must win over an ambient export, so
- * a managed key overwrites a preexisting shell value. The keys this module sets are
- * recorded so a later refresh can update them without clobbering unrelated env, and a
- * key an earlier apply set that the current merge no longer defines is unset (deleted
- * from process.env), so an approved project's env cannot leak into a later session or
- * project that does not define it. A managed overwrite of a shell var is owned like any
- * other set key; its original shell value cannot be restored, so on unset it is deleted.
+ * A settings value replaces a value inherited from the shell, as Claude documents
+ * ("Claude Code writes each env entry into the process environment, replacing the
+ * value inherited from the shell"), and an empty string is the documented way to
+ * override an export that cannot be unset. The original value of each key is
+ * recorded so a later apply that no longer defines the key restores the shell's
+ * value (or deletes a key the shell never had), so an approved project's env
+ * cannot leak into a later session or project that does not define it. The keys a
+ * repository must not control are dropped from the project scope before any of
+ * this (see sanitizeProjectEnv).
  *
  * Docs: https://code.claude.com/docs/en/settings.md
  */
@@ -57,35 +59,31 @@ export function envFromSettings(settings: unknown): Record<string, string> {
   return out
 }
 
-/** Merge the three env scopes with Claude's per-key precedence managed > user >
- * project: lower scopes are laid down first and higher ones overlay, so each key
- * takes its highest-precedence value and no scope wipes another's keys. */
+/** Merge the three env scopes with Claude's per-key settings precedence managed >
+ * project > user: lower scopes are laid down first and higher ones overlay, so each
+ * key takes its highest-precedence value and no scope wipes another's keys. */
 export function mergeEnvScopes(managed: Record<string, string>, user: Record<string, string>, project: Record<string, string>): Record<string, string> {
-  return { ...project, ...user, ...managed }
+  return { ...user, ...project, ...managed }
 }
 
-/** Assign the merged env into `env`, recording each key set into `owned`. A key already
- * present that this module did not set (a shell export) is left untouched for user and
- * project keys; a `managedKeys` entry overwrites it (an org policy outranks the shell).
- * A key this module set before is updated. A previously-owned key that the current
- * `merged` no longer defines is unset (deleted from `env` and `owned`), so an approved
- * project's env cannot leak into a later apply that does not define it. */
-export function applyEnvSettings(merged: Record<string, string>, env: NodeJS.ProcessEnv, owned: Set<string>, managedKeys: ReadonlySet<string> = new Set()): void {
-  // Unset any key an earlier apply set that the current merge dropped. Iterate a copy
-  // since `owned` is mutated. A shell export this module never owned is left in place.
-  for (const key of Array.from(owned)) {
-    if (!(key in merged)) {
-      delete env[key]
-      owned.delete(key)
-    }
+/** Assign the merged env into `env`. Every settings value applies, replacing a
+ * shell-inherited value, as Claude documents; an empty string is the documented
+ * override for an export that cannot be unset. `owned` records each key's original
+ * value at first ownership, so a later apply that drops the key restores the
+ * shell's value (or deletes a key the shell never had) rather than leaking a stale
+ * setting into the rest of the process. */
+export function applyEnvSettings(merged: Record<string, string>, env: NodeJS.ProcessEnv, owned: Map<string, string | undefined>): void {
+  // Restore any key an earlier apply set that the current merge dropped. Iterate a
+  // copy since `owned` is mutated.
+  for (const [key, original] of Array.from(owned.entries())) {
+    if (key in merged) continue
+    if (original === undefined) delete env[key]
+    else env[key] = original
+    owned.delete(key)
   }
   for (const [key, value] of Object.entries(merged)) {
-    // A shell export outranks user/project (skip), but a managed key outranks even the
-    // shell. Once owned, updates always apply. A managed overwrite is owned like any
-    // set key: its shell value is gone and cannot be restored, so on unset it is deleted.
-    if (key in env && !owned.has(key) && !managedKeys.has(key)) continue
+    if (!owned.has(key)) owned.set(key, env[key])
     env[key] = value
-    owned.add(key)
   }
 }
 
@@ -104,20 +102,54 @@ function userEnv(home: string): Record<string, string> {
   return envFromSettings(readSettingsFile(path.join(claudeConfigDir(home), 'settings.json')))
 }
 
+/** Keys a checked-out repository must not control even once trusted, per Claude's
+ * documented drop list: variables that choose where config and files are written
+ * (redirecting later home-scope reads and every subprocess), variables that export
+ * session content, and variables that change how the agent starts or syncs.
+ * PI_CODING_AGENT_DIR is pi's own config-dir analogue of CLAUDE_CONFIG_DIR. */
+const REPO_HOSTILE_ENV_KEYS = new Set([
+  'CLAUDE_CONFIG_DIR',
+  'CLAUDE_CODE_TMPDIR',
+  'HOME',
+  'TMPDIR',
+  'TMP',
+  'TEMP',
+  'OTEL_LOG_RAW_API_BODIES',
+  'ENABLE_BETA_TRACING_DETAILED',
+  'BETA_TRACING_ENDPOINT',
+  'CLAUDE_CODE_PROCESS_WRAPPER',
+  'CLAUDE_CODE_SYNC_SKILLS',
+  'CLAUDE_CODE_SYNC_PLUGINS',
+  'CLAUDE_CODE_PLUGIN_CACHE_DIR',
+  'CLAUDE_CODE_PLUGIN_SEED_DIR',
+  'PI_CODING_AGENT_DIR',
+])
+
+/** Drop the keys a repository's settings must not set, warning each, as Claude
+ * documents ("Claude Code drops each one and logs a warning"). Set them in the
+ * shell, user settings, or managed settings instead. */
+export function sanitizeProjectEnv(env: Record<string, string>, warn: (key: string) => void = (key) => console.warn(`pi-code-env: dropping ${key} from project settings env (a checked-out repository must not control it; set it in user or managed settings)`)): Record<string, string> {
+  const kept: Record<string, string> = {}
+  for (const [key, value] of Object.entries(env)) {
+    if (REPO_HOSTILE_ENV_KEYS.has(key) || key.startsWith('XDG_')) warn(key)
+    else kept[key] = value
+  }
+  return kept
+}
+
 /** The project scope's env: .claude/settings.json with settings.local.json overlaid,
  * each the nearest of its name at or above cwd (matching the hooks settings chain). */
 function projectEnv(cwd: string): Record<string, string> {
   const base = envFromSettings(readSettingsFile(findNearestFile(cwd, path.join('.claude', 'settings.json')) ?? path.join(cwd, '.claude', 'settings.json')))
   const local = envFromSettings(readSettingsFile(findNearestFile(cwd, path.join('.claude', 'settings.local.json')) ?? path.join(cwd, '.claude', 'settings.local.json')))
-  return { ...base, ...local }
+  return sanitizeProjectEnv({ ...base, ...local })
 }
 
 export default function envSettingsExtension(pi: ExtensionAPI) {
-  const owned = new Set<string>()
+  const owned = new Map<string, string | undefined>()
 
   const apply = (home: string, project: Record<string, string>): void => {
-    const managed = envFromSettings(readManagedSettings())
-    applyEnvSettings(mergeEnvScopes(managed, userEnv(home), project), process.env, owned, new Set(Object.keys(managed)))
+    applyEnvSettings(mergeEnvScopes(envFromSettings(readManagedSettings()), userEnv(home), project), process.env, owned)
   }
 
   // Factory time: managed + user only. Approval needs the session ctx, so the project

package/extensions/mcp/config.ts

@@ -7,7 +7,7 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import { claudeConfigDir } from '../internal/config-dir.js'
-import { type InstalledPlugin, substitutePluginVars } from '../internal/plugins.js'
+import type { InstalledPlugin } from '../internal/plugins.js'
 import { findNearestFile } from '../internal/project-root.js'
 
 export interface StdioServerConfig {
@@ -108,39 +108,73 @@ export function loadUserScope(home: string, cwd: string): Record<string, ServerC
   return servers
 }
 
-/** The mcpServers one plugin declares: an inline map on the manifest, or the file it
- * points to (default .mcp.json at the plugin root), with ${CLAUDE_PLUGIN_*} substituted
- * before parsing. Malformed or missing JSON yields no entries. */
-function pluginServerEntries(plugin: InstalledPlugin): Record<string, ServerConfig> {
+/** The mcpServers one plugin declares, parsed WITHOUT substitution: an inline map on
+ * the manifest, or the file it points to (default .mcp.json at the plugin root).
+ * Malformed or missing JSON yields no entries. Substitution happens per field
+ * afterwards, so a user_config value with JSON-breaking characters cannot corrupt
+ * the parse and headersHelper can be shielded. */
+function rawPluginServerEntries(plugin: InstalledPlugin): Record<string, unknown> {
   const declared = plugin.manifest.mcpServers
   // An inline map of name -> config; an array is not a valid mcpServers map (it
   // would register a server named '0'), so it falls through to the path branch.
   if (declared !== null && typeof declared === 'object' && !Array.isArray(declared)) {
-    try {
-      return JSON.parse(substitutePluginVars(JSON.stringify(declared), plugin))
-    } catch {
-      return {}
-    }
+    return { ...(declared as Record<string, unknown>) }
   }
   const file = path.resolve(plugin.root, typeof declared === 'string' ? declared : '.mcp.json')
   try {
-    const parsed = JSON.parse(substitutePluginVars(fs.readFileSync(file, 'utf-8'), plugin))
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
     return parsed.mcpServers ?? {}
   } catch {
     return {}
   }
 }
 
+/** Every string in the value mapped through `substitute`, arrays and objects walked. */
+function mapStrings(value: unknown, substitute: (text: string) => string): unknown {
+  if (typeof value === 'string') return substitute(value)
+  if (Array.isArray(value)) return value.map((entry) => mapStrings(entry, substitute))
+  if (value !== null && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, mapStrings(entry, substitute)]))
+  return value
+}
+
+/** One plugin server with Claude's substitutions applied: the plugin path variables
+ * and ${CLAUDE_PROJECT_DIR} everywhere, ${user_config.*} everywhere EXCEPT
+ * headersHelper (the command runs through a shell, so Claude reports such a server
+ * as misconfigured rather than substituting a user-supplied value into it; pi-code
+ * skips it with a warning). */
+function substitutedPluginServer(plugin: InstalledPlugin, name: string, config: unknown, projectDir: string | undefined): ServerConfig | undefined {
+  if (config === null || typeof config !== 'object') return undefined
+  const helper = (config as { headersHelper?: unknown }).headersHelper
+  if (typeof helper === 'string' && /\$\{user_config\./.test(helper)) {
+    console.warn(`pi-code-mcp: plugin ${plugin.name} server ${name} is misconfigured: headersHelper references \${user_config.*}, which cannot be substituted into a shell command; the server was not loaded`)
+    return undefined
+  }
+  const pathVars = (text: string): string => {
+    const withPlugin = substitutePathPluginVars(text, plugin)
+    return projectDir === undefined ? withPlugin : withPlugin.replaceAll('${CLAUDE_PROJECT_DIR}', projectDir)
+  }
+  const full = (text: string): string => pathVars(text).replace(/\$\{user_config\.(\w+)\}/g, (_, key: string) => plugin.userConfig?.[key] ?? '')
+  const substituted = mapStrings(config, full) as ServerConfig
+  if (typeof helper === 'string') (substituted as { headersHelper?: string }).headersHelper = pathVars(helper)
+  return substituted
+}
+
+/** The plugin path variables only, without user_config. */
+function substitutePathPluginVars(text: string, plugin: InstalledPlugin): string {
+  return text.replaceAll('${CLAUDE_PLUGIN_ROOT}', plugin.root).replaceAll('${CLAUDE_PLUGIN_DATA}', plugin.dataDir)
+}
+
 /** Servers shipped by enabled plugins (.mcp.json or the manifest's `mcpServers`,
  * inline or by path), with ${CLAUDE_PLUGIN_*} substituted before parsing. Their
  * tools alias as mcp__plugin_<plugin>_<server>__<tool> for hook matchers, as
  * Claude scopes them. */
-export function loadPluginServers(plugins: InstalledPlugin[]): Record<string, ServerConfig> {
+export function loadPluginServers(plugins: InstalledPlugin[], projectDir?: string): Record<string, ServerConfig> {
   const fold = (name: string): string => name.replaceAll('-', '_')
   const servers: Record<string, ServerConfig> = {}
   for (const plugin of plugins) {
-    for (const [name, config] of Object.entries(pluginServerEntries(plugin))) {
-      servers[name] = { ...config, aliasPrefix: `mcp__plugin_${fold(plugin.name)}_${fold(name)}__` }
+    for (const [name, config] of Object.entries(rawPluginServerEntries(plugin))) {
+      const substituted = substitutedPluginServer(plugin, name, config, projectDir)
+      if (substituted) servers[name] = { ...substituted, aliasPrefix: `mcp__plugin_${fold(plugin.name)}_${fold(name)}__` }
     }
   }
   return servers

package/extensions/mcp/index.ts

@@ -41,6 +41,7 @@ import { setMcpToolCaller } from '../internal/mcp-call.js'
 import { capForContext } from '../internal/output-guard.js'
 import { installedPlugins } from '../internal/plugins.js'
 import { isProjectApproved, isProjectApprovedSilently } from '../internal/project-approval.js'
+import { repoRoot } from '../internal/project-root.js'
 import { claudeSettingsChain } from '../internal/settings-chain.js'
 import { loadConfigFrom, loadPluginServers, loadUserScope, projectConfigPaths, type ServerConfig, warnOnTypelessUrl } from './config.js'
 import { collectServerResourceEntries, listAllPrompts, listAllTools, type McpToolInfo, resourceServerFilter } from './listing.js'
@@ -424,7 +425,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   async function connectNormalScopes(ctx: ExtensionContext, policy: McpPolicy, authUi?: AuthUi): Promise<void> {
     // Plugin servers merge under the user scope (plugins are user-installed);
     // the user's own entry wins a name clash with a plugin's.
-    const pluginServers = loadPluginServers(installedPlugins(os.homedir()))
+    const pluginServers = loadPluginServers(installedPlugins(os.homedir()), repoRoot(ctx.cwd) ?? ctx.cwd)
     const scoped = applyServerPolicy({ ...pluginServers, ...loadUserScope(os.homedir(), ctx.cwd) }, policy)
     // Claude's precedence is project over user for a duplicate name. A project .mcp.json
     // server only outranks the user's own when it will actually connect (the user already

package/extensions/subagent/agents.ts

@@ -213,6 +213,30 @@ function parseIsolationField(raw: unknown): 'worktree' | undefined | null {
   return null
 }
 
+/** Claude's MCP server-level patterns in agent `tools`/`disallowedTools`:
+ * `mcp__<server>` or `mcp__<server>__*` covers every tool of that server, and
+ * `mcp__*` every MCP tool from any server. pi registers MCP tools under its own
+ * `<server>_<tool>` names, so the parent's alias list is the translation table;
+ * matching folds case and dashes like hook matchers do. A pattern that matches
+ * nothing is kept verbatim (harmless to pi's exact-name filter), so a server that
+ * failed to connect is not silently dropped from a deny list. */
+export function expandMcpToolPatterns(entries: string[], aliases: ReadonlyArray<{ pi: string; claude: string }>): string[] {
+  const fold = (name: string): string => name.toLowerCase().replaceAll('-', '_')
+  const expanded: string[] = []
+  for (const entry of entries) {
+    const folded = fold(entry)
+    if (!folded.startsWith('mcp__')) {
+      expanded.push(entry)
+      continue
+    }
+    const server = folded === 'mcp__*' ? undefined : folded.replace(/__\*$/, '')
+    const matches = aliases.filter((alias) => (server === undefined ? true : fold(alias.claude).startsWith(`${server}__`))).map((alias) => alias.pi)
+    if (matches.length === 0) expanded.push(entry)
+    else expanded.push(...matches)
+  }
+  return [...new Set(expanded)]
+}
+
 /** Claude's `maxTurns`: a positive integer cap on the subagent's agentic turns.
  * Anything else (0, negative, non-number) is ignored, so the run is uncapped. */
 function parseMaxTurns(raw: unknown): number | undefined {

package/extensions/subagent/index.ts

@@ -25,13 +25,14 @@ import { Container, Markdown, Spacer, Text } from '@earendil-works/pi-tui'
 import { type Static, Type } from 'typebox'
 import { type AgentRunRequest, setAgentRunner } from '../internal/agent-run.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
+import { isMcpToolAliases, MCP_TOOLS_CHANNEL } from '../internal/mcp-alias.js'
 import { capForContext } from '../internal/output-guard.js'
 import { isProjectApproved, isProjectApprovedSilently } from '../internal/project-approval.js'
 import { repoRoot } from '../internal/project-root.js'
 import { SUBAGENT_CHANNEL } from '../internal/subagent-events.js'
 import { autoMemoryEnabled, capIndexForPrompt, INDEX_MAX_BYTES, INDEX_MAX_LINES, memorySettingsFiles, readMemorySettings } from '../memory.js'
 import { skillDirs } from '../skills.js'
-import { type AgentConfig, type AgentMemoryScope, type AgentScope, type AgentSource, discoverAgents, resolveModelAlias, withPreloadedSkills } from './agents.js'
+import { type AgentConfig, type AgentMemoryScope, type AgentScope, type AgentSource, discoverAgents, expandMcpToolPatterns, resolveModelAlias, withPreloadedSkills } from './agents.js'
 import { activeBackgroundRuns, type BackgroundRun, backgroundRun, backgroundStatusText, cancelAllBackgroundRuns, cancelBackgroundRun, MAX_BACKGROUND_RUNS, resumeBackgroundRun, startBackgroundRun } from './background.js'
 import { type DisplayItem, formatToolCall, formatUsageStats, getDisplayItems, getFinalOutput } from './render.js'
 import { type AgentWorktree, cleanupAgentWorktree, createAgentWorktree } from './worktree.js'
@@ -680,6 +681,15 @@ function childPromptBody(agent: AgentConfig, skillRoots: string[], memorySection
   return [prompt, memorySection].filter((part) => part.trim()).join('\n\n')
 }
 
+/** The parent's MCP tool aliases, published by the mcp extension on the shared bus;
+ * the module-level seam matches setMcpToolCaller's. Children read the same MCP config
+ * files, so the parent's roster is the translation table for server-level patterns. */
+let knownMcpAliases: ReadonlyArray<{ pi: string; claude: string }> = []
+
+export function setKnownMcpAliases(aliases: ReadonlyArray<{ pi: string; claude: string }>): void {
+  knownMcpAliases = aliases
+}
+
 /** CLI args shared by foreground and background children, from the agent's config. */
 function agentInvocationArgs(agent: AgentConfig, aliasModel?: string): string[] {
   const args: string[] = ['--mode', 'json', '-p', '--no-session']
@@ -689,8 +699,11 @@ function agentInvocationArgs(agent: AgentConfig, aliasModel?: string): string[]
   const model = agent.model ?? aliasModel
   if (model) args.push('--model', agent.effort ? `${model}:${agent.effort}` : model)
   else if (agent.effort) args.push('--thinking', agent.effort)
-  if (agent.tools && agent.tools.length > 0) args.push('--tools', agent.tools.join(','))
-  if (agent.disallowedTools && agent.disallowedTools.length > 0) args.push('--exclude-tools', agent.disallowedTools.join(','))
+  // Claude's mcp__<server> / mcp__* patterns expand against the parent's MCP roster;
+  // without this a server-level deny removed nothing (fail open) and a server-level
+  // grant granted nothing.
+  if (agent.tools && agent.tools.length > 0) args.push('--tools', expandMcpToolPatterns(agent.tools, knownMcpAliases).join(','))
+  if (agent.disallowedTools && agent.disallowedTools.length > 0) args.push('--exclude-tools', expandMcpToolPatterns(agent.disallowedTools, knownMcpAliases).join(','))
   return args
 }
 
@@ -1280,6 +1293,13 @@ function renderParallelResult(results: SingleResult[], expanded: boolean, theme:
 }
 
 export default function subagentExtension(pi: ExtensionAPI) {
+  // Claude's mcp__<server> tool patterns translate against the parent's MCP roster,
+  // published by the mcp extension on the shared bus. Optional-chained so a minimal
+  // test stub without an event bus can still register the extension.
+  pi.events?.on(MCP_TOOLS_CHANNEL, (data) => {
+    if (isMcpToolAliases(data)) setKnownMcpAliases(data)
+  })
+
   // /tasks resolves these against the registry at print time. background.ts owns the
   // run records but does not enumerate them, so the ids started here are remembered;
   // a run the registry has since evicted simply drops out of the listing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",