pi-code 1.0.25 → 1.0.27

package/extensions/internal/plugins.ts

@@ -180,7 +180,9 @@ function resolvePlugin(home: string, cacheDir: string, marketplace: string, plug
   const root = path.join(cacheDir, marketplace, pluginDir, version)
   const manifest = readJson(path.join(root, '.claude-plugin', 'plugin.json'))
   const name = typeof manifest.name === 'string' && manifest.name.length > 0 ? manifest.name : pluginDir
-  const id = qualified.replace(/[^A-Za-z0-9]+/g, '-')
+  // Claude: "{id} is the plugin identifier with characters outside a-z, A-Z, 0-9,
+  // _, and - replaced by -", one dash per character, underscores kept.
+  const id = qualified.replace(/[^A-Za-z0-9_-]/g, '-')
   const userConfig = configs[qualified] ?? configs[pluginDir] ?? configs[name]
   return { name, root, dataDir: path.join(claudeConfigDir(home), 'plugins', 'data', id), manifest, ...(userConfig ? { userConfig } : {}) }
 }

package/extensions/mcp/config.ts

@@ -20,6 +20,10 @@ export interface StdioServerConfig {
   timeout?: number
   /** Plugin servers alias their tools mcp__plugin_<plugin>_<server>__<tool>. */
   aliasPrefix?: string
+  /** Root of the plugin that supplied this server; exported as CLAUDE_PLUGIN_ROOT. */
+  pluginRoot?: string
+  /** Loaded from the project scope, whose helpers run credential-stripped. */
+  projectScope?: boolean
 }
 
 export interface HttpServerConfig {
@@ -35,6 +39,10 @@ export interface HttpServerConfig {
   timeout?: number
   /** Plugin servers alias their tools mcp__plugin_<plugin>_<server>__<tool>. */
   aliasPrefix?: string
+  /** Root of the plugin that supplied this server; exported as CLAUDE_PLUGIN_ROOT. */
+  pluginRoot?: string
+  /** Loaded from the project scope, whose helpers run credential-stripped. */
+  projectScope?: boolean
 }
 
 export type ServerConfig = StdioServerConfig | HttpServerConfig
@@ -99,13 +107,34 @@ export function loadConfigFrom(files: string[]): Record<string, ServerConfig> {
  */
 export function loadUserScope(home: string, cwd: string): Record<string, ServerConfig> {
   const servers = loadConfigFrom(userConfigPaths(home))
+  Object.assign(servers, projectRecord(home, cwd).mcpServers ?? {})
+  return servers
+}
+
+/** The per-project record for `cwd` in ~/.claude.json, or an empty one when the file
+ * is missing, invalid, or has no entry for this project. */
+function projectRecord(home: string, cwd: string): { mcpServers?: Record<string, ServerConfig>; disabledMcpServers?: unknown } {
   try {
     const claudeJson = JSON.parse(fs.readFileSync(claudeJsonPath(home), 'utf-8'))
-    Object.assign(servers, claudeJson.projects?.[cwd]?.mcpServers ?? {})
+    return claudeJson.projects?.[cwd] ?? {}
   } catch {
-    // missing or invalid ~/.claude.json: the top-level user servers already loaded
+    return {}
   }
-  return servers
+}
+
+/** Names the local scope defines for this project. Claude's precedence is local over
+ * project over user, so a local name must also outrank a project .mcp.json entry. */
+export function localScopeServerNames(home: string, cwd: string): Set<string> {
+  return new Set(Object.keys(projectRecord(home, cwd).mcpServers ?? {}))
+}
+
+/** The per-project `disabledMcpServers` toggle list from ~/.claude.json: Claude's /mcp
+ * panel records a server toggled off here (an opt-out list for user-configured and
+ * plugin servers) and does not connect to it. The `enabledMcpServers` opt-in list
+ * covers only default-off built-in servers, which pi-code has none of. */
+export function disabledServerNames(home: string, cwd: string): Set<string> {
+  const listed = projectRecord(home, cwd).disabledMcpServers
+  return new Set(Array.isArray(listed) ? listed.filter((entry): entry is string => typeof entry === 'string') : [])
 }
 
 /** The mcpServers one plugin declares, parsed WITHOUT substitution: an inline map on
@@ -115,18 +144,22 @@ export function loadUserScope(home: string, cwd: string): Record<string, ServerC
  * the parse and headersHelper can be shielded. */
 function rawPluginServerEntries(plugin: InstalledPlugin): Record<string, unknown> {
   const declared = plugin.manifest.mcpServers
-  // An inline map of name -> config; an array is not a valid mcpServers map (it
-  // would register a server named '0'), so it falls through to the path branch.
+  // An inline map of name -> config. The manifest field is string|array|object per
+  // Claude's plugin reference; an array lists config file paths, merged in order.
   if (declared !== null && typeof declared === 'object' && !Array.isArray(declared)) {
     return { ...(declared as Record<string, unknown>) }
   }
-  const file = path.resolve(plugin.root, typeof declared === 'string' ? declared : '.mcp.json')
-  try {
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
-    return parsed.mcpServers ?? {}
-  } catch {
-    return {}
+  const paths = Array.isArray(declared) ? declared.filter((entry): entry is string => typeof entry === 'string') : [typeof declared === 'string' ? declared : '.mcp.json']
+  const servers: Record<string, unknown> = {}
+  for (const entry of paths) {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(path.resolve(plugin.root, entry), 'utf-8'))
+      Object.assign(servers, parsed.mcpServers ?? {})
+    } catch {
+      // Malformed or missing JSON contributes no entries.
+    }
   }
+  return servers
 }
 
 /** Every string in the value mapped through `substitute`, arrays and objects walked. */
@@ -169,12 +202,13 @@ function substitutePathPluginVars(text: string, plugin: InstalledPlugin): string
  * tools alias as mcp__plugin_<plugin>_<server>__<tool> for hook matchers, as
  * Claude scopes them. */
 export function loadPluginServers(plugins: InstalledPlugin[], projectDir?: string): Record<string, ServerConfig> {
-  const fold = (name: string): string => name.replaceAll('-', '_')
+  // Claude keeps hyphens in the alias; only characters outside A-Za-z0-9_- fold to _.
+  const fold = (name: string): string => name.replace(/[^A-Za-z0-9_-]/g, '_')
   const servers: Record<string, ServerConfig> = {}
   for (const plugin of plugins) {
     for (const [name, config] of Object.entries(rawPluginServerEntries(plugin))) {
       const substituted = substitutedPluginServer(plugin, name, config, projectDir)
-      if (substituted) servers[name] = { ...substituted, aliasPrefix: `mcp__plugin_${fold(plugin.name)}_${fold(name)}__` }
+      if (substituted) servers[name] = { ...substituted, aliasPrefix: `mcp__plugin_${fold(plugin.name)}_${fold(name)}__`, pluginRoot: plugin.root }
     }
   }
   return servers

package/extensions/mcp/index.ts

@@ -20,8 +20,9 @@
  * environment plus its own `env` block, not the whole process environment.
  *
  * Servers advertising the `prompts` capability get their prompts registered as Claude's
- * /mcp__<server>__<prompt> slash commands (names normalized dashes/spaces to underscores,
- * args space-separated and mapped positionally); the prompt result drives a turn via
+ * /mcp__<server>__<prompt> slash commands (server-name characters outside A-Za-z0-9_-
+ * fold to underscores, args split on whitespace and mapped positionally, one token
+ * per declared argument); the prompt result drives a turn via
  * sendUserMessage, exactly how custom slash commands do. Servers advertising `resources`
  * make the global list_mcp_resources / read_mcp_resource tools available, mirroring
  * Claude's automatic resource tools. Resource and prompt output rides the same
@@ -43,11 +44,11 @@ import { installedPlugins } from '../internal/plugins.js'
 import { isProjectApproved, isProjectApprovedSilently } from '../internal/project-approval.js'
 import { repoRoot } from '../internal/project-root.js'
 import { claudeSettingsChain } from '../internal/settings-chain.js'
-import { loadConfigFrom, loadPluginServers, loadUserScope, projectConfigPaths, type ServerConfig, warnOnTypelessUrl } from './config.js'
+import { disabledServerNames, loadConfigFrom, loadPluginServers, loadUserScope, localScopeServerNames, projectConfigPaths, type ServerConfig, warnOnTypelessUrl } from './config.js'
 import { collectServerResourceEntries, listAllPrompts, listAllTools, type McpToolInfo, resourceServerFilter } from './listing.js'
 import { formatPromptCommandName, formatToolName, type McpContentBlock, type McpPromptInfo, mapContent, mapPromptArguments, normalizeSchema, promptMessageContent } from './mapping.js'
 import { applyServerPolicy, loadManagedMcpServers, type McpPolicy, mcpAllowDeny, projectServerPolicy, splitByPolicy } from './policy.js'
-import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, withTimeout } from './transport.js'
+import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, type ServerCallTuning, type SessionDirs, serverCallTuning, withTimeout } from './transport.js'
 
 export { managedSettingsPath, setManagedSettingsPath } from '../internal/managed-settings.js'
 // Re-exports for consumers: the module split keeps the extension's public surface
@@ -84,11 +85,22 @@ function authUiFor(ctx: ExtensionContext): AuthUi | undefined {
 export default async function mcpExtension(pi: ExtensionAPI) {
   const clients = new Map<string, Client>()
   const status = new Map<string, { state: string; tools: number }>()
+  // Config per server name, kept for call-time timeout tuning: the idle tier follows
+  // the transport kind, and a declared per-server timeout governs the wall budget.
+  const serverConfigs = new Map<string, ServerConfig>()
+  // The session's directories, set at session_start before any connect: the launch
+  // directory answers roots/list, the project root feeds CLAUDE_PROJECT_DIR.
+  let sessionDirs: SessionDirs | undefined
+  const callTuning = (name: string): ServerCallTuning => {
+    const config = serverConfigs.get(name)
+    return config ? serverCallTuning(config) : {}
+  }
   // Let other extensions (hooks' mcp_tool type) call a connected server's tool.
   setMcpToolCaller(async (server, tool, input) => {
     const client = clients.get(server)
     if (!client) throw new Error(`MCP server "${server}" is not connected`)
-    const result = await client.callTool({ name: tool, arguments: input }, undefined, callRequestOptions(callTimeoutMs()))
+    const tuning = callTuning(server)
+    const result = await client.callTool({ name: tool, arguments: input }, undefined, callRequestOptions(tuning.serverTimeoutMs ?? callTimeoutMs(), tuning))
     const text = mapContent(result.content as McpContentBlock[], result.structuredContent)
       .filter((part): part is { type: 'text'; text: string } => part.type === 'text')
       .map((part) => part.text)
@@ -138,9 +150,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           // own default request timeout is 60s and would otherwise reject first. The outer
           // race uses the wall budget, never the idle window, so a progressing call is not
           // cut off at the idle timeout.
-          const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
-          const wall = declared ?? callTimeoutMs()
-          const result = await withTimeout(current.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, callRequestOptions(wall)), wall, toolName)
+          const tuning = serverCallTuning(config)
+          const wall = tuning.serverTimeoutMs ?? callTimeoutMs()
+          const result = await withTimeout(current.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, callRequestOptions(wall, tuning)), wall, toolName)
           const content = mapContent(result.content as McpContentBlock[], result.structuredContent)
           const details: { error?: string } = {}
           if (result.isError) {
@@ -193,7 +205,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
             const params: { name: string; arguments?: Record<string, string> } = { name: prompt.name }
             if (Object.keys(promptArgs).length > 0) params.arguments = promptArgs
             const wall = callTimeoutMs()
-            const result = await withTimeout(current.getPrompt(params, callRequestOptions(wall)), wall, commandName)
+            const result = await withTimeout(current.getPrompt(params, callRequestOptions(wall, callTuning(name))), wall, commandName)
             // The prompt drives a turn exactly the way a custom slash command does
             // (see commands.ts), carrying its image blocks through. A prompt that
             // yields no content is reported rather than sent as an empty turn.
@@ -280,7 +292,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
         const client = clients.get(server)
         if (!client) throw new Error(`MCP server "${server}" is not connected`)
         const wall = callTimeoutMs()
-        const result = await withTimeout(client.readResource({ uri }, callRequestOptions(wall)), wall, `read ${uri}`)
+        const result = await withTimeout(client.readResource({ uri }, callRequestOptions(wall, callTuning(server))), wall, `read ${uri}`)
         const blocks = (result.contents as Array<{ uri: string; text?: string; blob?: string; mimeType?: string }>).map((entry): McpContentBlock => {
           if (typeof entry.text === 'string') return { type: 'resource', resource: { uri: entry.uri, text: entry.text } }
           if (entry.blob && entry.mimeType?.startsWith('image/')) return { type: 'image', data: entry.blob, mimeType: entry.mimeType }
@@ -341,13 +353,14 @@ export default async function mcpExtension(pi: ExtensionAPI) {
       // Seed in config order before connecting: parallel connects settle in completion
       // order, and /mcp plus the session summary iterate the map's insertion order.
       status.set(name, { state: 'connecting', tools: 0 })
+      serverConfigs.set(name, config)
       pending.push([name, config])
     }
     await Promise.all(
       pending.map(async ([name, config]) => {
         warnOnTypelessUrl(name, config)
         try {
-          const client = await connect(name, config, authUi)
+          const client = await connect(name, config, authUi, sessionDirs)
           clients.set(name, client)
           const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
           registerTools(name, config, tools)
@@ -424,9 +437,12 @@ export default async function mcpExtension(pi: ExtensionAPI) {
    * or whose transport dropped, without duplicate-name warnings. */
   async function connectNormalScopes(ctx: ExtensionContext, policy: McpPolicy, authUi?: AuthUi): Promise<void> {
     // Plugin servers merge under the user scope (plugins are user-installed);
-    // the user's own entry wins a name clash with a plugin's.
+    // the user's own entry wins a name clash with a plugin's. A server toggled off
+    // in ~/.claude.json's per-project disabledMcpServers list never connects.
     const pluginServers = loadPluginServers(installedPlugins(os.homedir()), repoRoot(ctx.cwd) ?? ctx.cwd)
-    const scoped = applyServerPolicy({ ...pluginServers, ...loadUserScope(os.homedir(), ctx.cwd) }, policy)
+    const disabled = disabledServerNames(os.homedir(), ctx.cwd)
+    const merged = Object.fromEntries(Object.entries({ ...pluginServers, ...loadUserScope(os.homedir(), ctx.cwd) }).filter(([name]) => !disabled.has(name)))
+    const scoped = applyServerPolicy(merged, policy)
     // Claude's precedence is project over user for a duplicate name. A project .mcp.json
     // server only outranks the user's own when it will actually connect (the user already
     // consented to it, or an approved project's), so a merely-present untrusted project
@@ -436,7 +452,15 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // The stored project decision, read without prompting: consent recorded inside
     // the project only counts once the project itself has been approved.
     const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
-    const { consented, gated } = splitByPolicy(applyServerPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), policy), projectPolicy)
+    // Tag the scope on each project server: a repository-supplied headersHelper runs
+    // with credential variables stripped, unlike a user-scope one.
+    const projectServers = Object.fromEntries(Object.entries(loadConfigFrom(projectConfigPaths(ctx.cwd))).map(([name, config]) => [name, { ...config, projectScope: true }]))
+    const { consented: consentedRaw, gated } = splitByPolicy(applyServerPolicy(projectServers, policy), projectPolicy)
+    // Claude's scope precedence is local over project: a name the local scope defines
+    // stays with the local (user-side) definition, so the project's entry is dropped
+    // here rather than allowed to shadow it.
+    const localNames = localScopeServerNames(os.homedir(), ctx.cwd)
+    const consented = Object.fromEntries(Object.entries(consentedRaw).filter(([name]) => !localNames.has(name)))
     const projectWinners = new Set(Object.keys(consented))
     const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name) && !projectWinners.has(name)))
     // The consented project servers carry no ordering dependency on the user scope:
@@ -463,6 +487,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // withdrawn tool keeps its registration and surfaces the server's own error), which
     // is why serverToolCount reads from `registered` to recover the true count here.
     status.clear()
+    // Claude answers roots/list with the session's launch directory and exports the
+    // project root as CLAUDE_PROJECT_DIR to stdio servers; both derive from ctx.cwd.
+    sessionDirs = { projectDir: repoRoot(ctx.cwd) ?? ctx.cwd, launchDir: ctx.cwd }
     const authUi = authUiFor(ctx)
     // The allow/deny lists filter every scope, including a managed-mcp.json set. They
     // merge from managed settings plus the trust-gated settings chain, as Claude

package/extensions/mcp/mapping.ts

@@ -5,19 +5,19 @@
  */
 
 import { DEFAULT_MAX_BYTES } from '@earendil-works/pi-coding-agent'
-import { splitArgs } from '../internal/command-file.js'
 import { capForContext } from '../internal/output-guard.js'
 
 export function formatToolName(server: string, tool: string): string {
   return `${server}_${tool}`.replaceAll('-', '_')
 }
 
-/** Claude exposes server prompts as /mcp__<server>__<prompt> slash commands. Both
- * names normalize like formatToolName, extended to spaces: dashes and spaces each
- * become an underscore. */
+/** Claude exposes server prompts as /mcp__<server>__<prompt> slash commands: any
+ * character in the server name outside A-Za-z0-9_- becomes an underscore (hyphens
+ * stay), and the prompt name is used as the server declares it. Divergence: pi
+ * dispatches commands on the first whitespace-delimited token, so whitespace in the
+ * prompt name also folds to an underscore or the command would be unreachable. */
 export function formatPromptCommandName(server: string, prompt: string): string {
-  const normalize = (name: string): string => name.replace(/[\s-]/g, '_')
-  return `mcp__${normalize(server)}__${normalize(prompt)}`
+  return `mcp__${server.replace(/[^A-Za-z0-9_-]/g, '_')}__${prompt.replace(/\s/g, '_')}`
 }
 
 export interface McpPromptArgumentInfo {
@@ -32,17 +32,16 @@ export interface McpPromptInfo {
   arguments?: McpPromptArgumentInfo[]
 }
 
-/** Claude passes prompt arguments space-separated after the command. Tokens map
- * positionally onto the declared arguments, split the way slash-command args are
- * (quoted runs stay together); the last declared argument absorbs any trailing
- * tokens so free text at the end is not silently dropped. Declared arguments with
- * no token are omitted, and the server enforces its own `required`. */
+/** Claude passes prompt arguments space-separated after the command and "splits the
+ * arguments on whitespace, so each argument is a single token": no quote handling,
+ * one token per declared argument, extra trailing tokens dropped. Declared arguments
+ * with no token are omitted, and the server enforces its own `required`. */
 export function mapPromptArguments(declared: ReadonlyArray<{ name: string }> | undefined, args: string): Record<string, string> {
-  const tokens = splitArgs(args)
+  const tokens = args.split(/\s+/).filter((token) => token !== '')
   const names = (declared ?? []).map((argument) => argument.name)
   const mapped: Record<string, string> = {}
   for (let index = 0; index < names.length && index < tokens.length; index++) {
-    mapped[names[index]] = index === names.length - 1 ? tokens.slice(index).join(' ') : tokens[index]
+    mapped[names[index]] = tokens[index]
   }
   return mapped
 }

package/extensions/mcp/transport.ts

@@ -5,6 +5,7 @@
  */
 
 import { execFile } from 'node:child_process'
+import { pathToFileURL } from 'node:url'
 // SSE is deprecated in favour of Streamable HTTP, but the SDK notes servers still on
 // the old spec exist, so this stays as a fallback for the migration period.
 import { type OAuthClientProvider, UnauthorizedError } from '@modelcontextprotocol/sdk/client/auth.js'
@@ -13,42 +14,66 @@ import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js' //
 import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
 import { WebSocketClientTransport } from '@modelcontextprotocol/sdk/client/websocket.js'
+import { ListRootsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
 import { FileOAuthProvider } from '../internal/mcp-oauth.js'
-import { expandCwd, interpolateEnv, type ServerConfig, type StdioServerConfig } from './config.js'
+import { expandCwd, type HttpServerConfig, interpolateEnv, type ServerConfig, type StdioServerConfig } from './config.js'
 import { runInteractiveOAuth, serializeInteractiveOAuth } from './oauth-flow.js'
 
-const DEFAULT_CONNECT_TIMEOUT_MS = 10_000
+// Claude's MCP_TIMEOUT default: 30 seconds per connect attempt.
+const DEFAULT_CONNECT_TIMEOUT_MS = 30_000
 // Claude's MCP_TOOL_TIMEOUT default is effectively hours: the per-call wall-clock budget
 // is only a ceiling, and the idle timeout below is the real guard. 4h matches that model,
 // so a legitimately slow-but-progressing tool is not killed at the old 2 minutes.
 const DEFAULT_CALL_TIMEOUT_MS = 14_400_000
 // The idle timeout: the longest a call may go with no response or progress before it is
-// abandoned. Claude uses a separate idle guard (minutes) rather than the hours-long
-// wall-clock budget; the SDK resets this window on every progress notification.
+// abandoned. Claude uses a separate idle guard rather than the hours-long wall-clock
+// budget, defaulting to five minutes for remote transports and 30 minutes for stdio
+// servers; the SDK resets this window on every progress notification.
 const DEFAULT_CALL_IDLE_TIMEOUT_MS = 300_000
+const DEFAULT_STDIO_CALL_IDLE_TIMEOUT_MS = 1_800_000
+
+/** Claude's numeric env vars accept scientific notation and digit-separator spellings
+ * (2e3 as 2000, 64_000 as 64000). A non-numeric value is undefined, not zero. */
+function parseNumericEnv(raw: string): number | undefined {
+  const cleaned = raw.replaceAll('_', '')
+  if (cleaned.trim() === '') return undefined
+  const value = Number(cleaned)
+  return Number.isFinite(value) ? Math.floor(value) : undefined
+}
 
 /** A positive-integer env override, or the default when unset or unparseable. */
 function envTimeout(name: string, fallback: number): number {
   const raw = process.env[name]
   if (raw === undefined) return fallback
-  const value = Number.parseInt(raw, 10)
-  return Number.isInteger(value) && value > 0 ? value : fallback
+  const value = parseNumericEnv(raw)
+  return value !== undefined && value > 0 ? value : fallback
 }
 
 // Claude honors MCP_TIMEOUT (connect) and MCP_TOOL_TIMEOUT (per-call), both in ms.
 export const connectTimeoutMs = (): number => envTimeout('MCP_TIMEOUT', DEFAULT_CONNECT_TIMEOUT_MS)
 export const callTimeoutMs = (): number => envTimeout('MCP_TOOL_TIMEOUT', DEFAULT_CALL_TIMEOUT_MS)
 
+/** Per-server inputs to the idle-window choice: the transport kind picks the default
+ * tier, and a per-server `timeout` of at least 1000 also floors the idle window. */
+export interface ServerCallTuning {
+  stdio?: boolean
+  serverTimeoutMs?: number
+}
+
 /** The idle timeout in ms: the longest a call may go with no response or progress before
- * it is abandoned, overridable by CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT, with 0 disabling it
- * (leaving only the wall-clock budget). Unlike envTimeout, an explicit 0 is honored as
- * "disabled" rather than falling back to the default. */
-function idleTimeoutMs(): number {
+ * it is abandoned. Defaults to Claude's tiers (five minutes remote, 30 minutes stdio),
+ * overridable by CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT, with 0 disabling it (leaving only
+ * the wall-clock budget). Unlike envTimeout, an explicit 0 is honored as "disabled"
+ * rather than falling back to the default. A per-server timeout of at least 1000 floors
+ * the enabled window, so a server granted a long wall budget is not idled out earlier. */
+function idleTimeoutMs(tuning: ServerCallTuning): number {
   const raw = process.env.CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT
-  if (raw === undefined) return DEFAULT_CALL_IDLE_TIMEOUT_MS
-  const value = Number.parseInt(raw, 10)
-  if (value === 0) return 0
-  return Number.isInteger(value) && value > 0 ? value : DEFAULT_CALL_IDLE_TIMEOUT_MS
+  const override = raw === undefined ? undefined : parseNumericEnv(raw)
+  if (override === 0) return 0
+  const tierDefault = tuning.stdio ? DEFAULT_STDIO_CALL_IDLE_TIMEOUT_MS : DEFAULT_CALL_IDLE_TIMEOUT_MS
+  const base = override !== undefined && override > 0 ? override : tierDefault
+  const floor = tuning.serverTimeoutMs !== undefined && tuning.serverTimeoutMs >= 1000 ? tuning.serverTimeoutMs : 0
+  return Math.max(base, floor)
 }
 
 /** The SDK RequestOptions for a call under pi's two-tier timeout: a wall-clock ceiling and,
@@ -60,12 +85,20 @@ function idleTimeoutMs(): number {
  * wall budget, only the wall budget applies. The outer withTimeout race is a wall-clock
  * backstop and must be raced against `wall`, never the idle window, so a legitimately
  * progressing call is not cut off. */
-export function callRequestOptions(wall: number): { timeout: number; resetTimeoutOnProgress?: boolean; maxTotalTimeout?: number; onprogress?: () => void } {
-  const idle = idleTimeoutMs()
+export function callRequestOptions(wall: number, tuning: ServerCallTuning = {}): { timeout: number; resetTimeoutOnProgress?: boolean; maxTotalTimeout?: number; onprogress?: () => void } {
+  const idle = idleTimeoutMs(tuning)
   if (idle === 0 || idle >= wall) return { timeout: wall }
   return { timeout: idle, resetTimeoutOnProgress: true, maxTotalTimeout: wall, onprogress: () => {} }
 }
 
+/** The tuning one server's config yields: its transport kind, and its declared
+ * per-server timeout. Per Claude, timeout values below 1000 are ignored and fall
+ * through to MCP_TOOL_TIMEOUT. */
+export function serverCallTuning(config: ServerConfig): ServerCallTuning {
+  const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
+  return { stdio: isStdio(config), ...(declared !== undefined ? { serverTimeoutMs: declared } : {}) }
+}
+
 /** Claude reports a config entry that has a url but no type as an error; pi-code
  * still connects (streamable HTTP with SSE fallback) but says the entry is wrong. */
 /** An inline bearerToken (interpolated) wins over bearerTokenEnv, which names an
@@ -97,6 +130,67 @@ function isStdio(config: ServerConfig): config is StdioServerConfig {
   return 'command' in config && (config.type === undefined || config.type === 'stdio')
 }
 
+/** The session's directories: the launch directory answers roots/list, and the
+ * project root becomes CLAUDE_PROJECT_DIR in a stdio server's environment. */
+export interface SessionDirs {
+  projectDir: string
+  launchDir: string
+}
+
+/** A client that, like Claude, declares the roots capability and answers roots/list
+ * with the session's launch directory. pi's directory set is static, so no
+ * roots/list_changed notification is ever sent. */
+function makeClient(session?: SessionDirs): Client {
+  if (!session) return new Client({ name: 'pi-code-mcp', version: '0.1.0' })
+  const client = new Client({ name: 'pi-code-mcp', version: '0.1.0' }, { capabilities: { roots: {} } })
+  client.setRequestHandler(ListRootsRequestSchema, () => ({ roots: [{ uri: pathToFileURL(session.launchDir).href }] }))
+  return client
+}
+
+/** Claude's credential heuristic for helper environments: any name with TOKEN,
+ * SECRET, PASSWORD, KEY, or AUTH in it in either case (Git's GIT_CONFIG_KEY_<n>
+ * excepted), plus a fixed list of credential names outside the pattern. */
+const CREDENTIAL_NAME_EXTRAS = new Set(['ANTHROPIC_CUSTOM_HEADERS'])
+function isCredentialEnvName(name: string): boolean {
+  if (/^GIT_CONFIG_KEY_\d+$/.test(name)) return false
+  return /TOKEN|SECRET|PASSWORD|KEY|AUTH/i.test(name) || CREDENTIAL_NAME_EXTRAS.has(name)
+}
+
+/** process.env with every credential-named value replaced by REDACTED, used to
+ * expand the url a helper is shown without handing it the credential. */
+function redactedEnv(): NodeJS.ProcessEnv {
+  return Object.fromEntries(Object.entries(process.env).map(([key, value]) => [key, isCredentialEnvName(key) ? 'REDACTED' : value]))
+}
+
+/** The environment a headersHelper runs with: Claude's CLAUDE_CODE_MCP_SERVER_NAME
+ * and CLAUDE_CODE_MCP_SERVER_URL (credential-expanded url parts REDACTED), plus
+ * CLAUDE_PLUGIN_ROOT for a plugin's server. A helper a repository or plugin
+ * supplies is a command the user did not write, so it runs without the
+ * credential-named variables; a user-scope helper keeps them. */
+function helperEnv(name: string, config: HttpServerConfig): NodeJS.ProcessEnv {
+  const stripped = config.projectScope === true || config.pluginRoot !== undefined
+  const env: NodeJS.ProcessEnv = {}
+  for (const [key, value] of Object.entries(process.env)) {
+    if (stripped && isCredentialEnvName(key)) continue
+    env[key] = value
+  }
+  env.CLAUDE_CODE_MCP_SERVER_NAME = name
+  env.CLAUDE_CODE_MCP_SERVER_URL = interpolateEnv(config.url, redactedEnv())
+  if (config.pluginRoot !== undefined) env.CLAUDE_PLUGIN_ROOT = config.pluginRoot
+  return env
+}
+
+/** The env a stdio server process starts with: the SDK allowlist, the config's own
+ * env block, and Claude's path variables (CLAUDE_PROJECT_DIR, and CLAUDE_PLUGIN_ROOT
+ * for a plugin's server). */
+function stdioEnv(config: StdioServerConfig, fill: (value: string) => string, session?: SessionDirs): Record<string, string> {
+  const env: Record<string, string> = { ...getDefaultEnvironment() }
+  for (const [key, value] of Object.entries(config.env ?? {})) env[key] = fill(value)
+  if (session) env.CLAUDE_PROJECT_DIR = session.projectDir
+  if (config.pluginRoot !== undefined) env.CLAUDE_PLUGIN_ROOT = config.pluginRoot
+  return env
+}
+
 export async function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {
   let timer: ReturnType<typeof setTimeout> | undefined
   const timeout = new Promise<never>((_, reject) => {
@@ -112,8 +206,8 @@ export async function withTimeout<T>(promise: Promise<T>, ms: number, label: str
   }
 }
 
-export async function connect(name: string, config: ServerConfig, authUi?: AuthUi): Promise<Client> {
-  const client = new Client({ name: 'pi-code-mcp', version: '0.1.0' })
+export async function connect(name: string, config: ServerConfig, authUi?: AuthUi, session?: SessionDirs): Promise<Client> {
+  const client = makeClient(session)
   // Names referenced by ${VAR} with no value and no default, gathered across this
   // server's interpolated fields so the connect can warn once rather than fail with a
   // mystery 401 or a command that lost an argument.
@@ -126,12 +220,10 @@ export async function connect(name: string, config: ServerConfig, authUi?: AuthU
     // Start from the SDK's allowlist (PATH, HOME, SHELL, ...) rather than the whole
     // process env: a server should not receive ANTHROPIC_API_KEY or GITHUB_TOKEN just
     // for being launched. A server that needs a variable names it in its own env block.
-    const env: Record<string, string> = { ...getDefaultEnvironment() }
-    for (const [key, value] of Object.entries(config.env ?? {})) env[key] = fill(value)
     const transport = new StdioClientTransport({
       command: fill(config.command),
       args: (config.args ?? []).map((arg) => fill(arg)),
-      env,
+      env: stdioEnv(config, fill, session),
       cwd: expandCwd(config.cwd),
       stderr: 'ignore',
     })
@@ -161,26 +253,30 @@ export async function connect(name: string, config: ServerConfig, authUi?: AuthU
   if (token) headers.Authorization = `Bearer ${token}`
   // A headersHelper generates connect-time headers for non-OAuth auth schemes; its
   // JSON stdout merges over the static headers.
-  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(fill(config.headersHelper)))
+  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(fill(config.headersHelper), helperEnv(name, config)))
   warnMissing()
+  // Claude: a configured Authorization header, whether static, a bearer token, or
+  // helper output, is the server's authentication; there is no OAuth fallback for it.
+  const configuredAuth = Boolean(token) || Object.keys(headers).some((header) => header.toLowerCase() === 'authorization')
   const sseTransport = (authProvider?: OAuthClientProvider) => new SSEClientTransport(url, { requestInit: { headers }, authProvider }) // NOSONAR: explicitly declared or deliberate legacy transport
   if (config.type === 'sse') {
-    return await connectHttpFamily(name, config, sseTransport, `connect ${name} (sse)`, token, authUi)
+    return await connectHttpFamily(name, config, sseTransport, `connect ${name} (sse)`, configuredAuth, authUi, session)
   }
   try {
-    return await connectHttpFamily(name, config, (authProvider) => new StreamableHTTPClientTransport(url, { requestInit: { headers }, authProvider }), `connect ${name}`, token, authUi)
+    return await connectHttpFamily(name, config, (authProvider) => new StreamableHTTPClientTransport(url, { requestInit: { headers }, authProvider }), `connect ${name}`, configuredAuth, authUi, session)
   } catch (error) {
     // An explicitly declared streamable transport must not silently degrade to SSE.
     if (config.type !== undefined || isUnauthorized(error)) throw error
-    return await connectHttpFamily(name, config, sseTransport, `connect ${name} (sse)`, token, authUi)
+    return await connectHttpFamily(name, config, sseTransport, `connect ${name} (sse)`, configuredAuth, authUi, session)
   }
 }
 
-/** Run a headersHelper command and parse its JSON stdout into headers. A failure or
- * a 10s timeout yields no extra headers rather than blocking the connection. */
-function runHeadersHelper(command: string): Promise<Record<string, string>> {
+/** Run a headersHelper command and parse its JSON stdout into headers, under the
+ * environment helperEnv built. A failure or a 10s timeout yields no extra headers
+ * rather than blocking the connection. */
+function runHeadersHelper(command: string, env: NodeJS.ProcessEnv): Promise<Record<string, string>> {
   return new Promise((resolve) => {
-    execFile('/bin/sh', ['-c', command], { timeout: 10_000 }, (error, stdout) => {
+    execFile('/bin/sh', ['-c', command], { timeout: 10_000, env }, (error, stdout) => {
       resolve(error ? {} : parseHelperHeaders(stdout))
     })
   })
@@ -198,12 +294,12 @@ export interface AuthUi {
 export class OAuthRequiredError extends Error {}
 
 /** Whether a connect failure is an authentication problem: the SDK's own
- * UnauthorizedError, a transport error carrying HTTP 401 (which is what a 401
- * throws when no authProvider was attached, so a first-time login is detected),
- * or our own marker. */
+ * UnauthorizedError, a transport error carrying HTTP 401 or 403 (Claude: "either
+ * status code flags it" for OAuth), or our own marker. */
 export function isUnauthorized(error: unknown): boolean {
   if (error instanceof UnauthorizedError || error instanceof OAuthRequiredError) return true
-  return typeof error === 'object' && error !== null && (error as { code?: unknown }).code === 401
+  const code = typeof error === 'object' && error !== null ? (error as { code?: unknown }).code : undefined
+  return code === 401 || code === 403
 }
 
 // SSEClientTransport is deprecated in favour of Streamable HTTP, but both concrete
@@ -218,22 +314,23 @@ export type MakeTransport = (authProvider?: OAuthClientProvider) => HttpFamilyTr
  * demands one. Stored tokens ride the first attempt so the SDK refreshes
  * silently; a 401 without tokens asks the user, opens the browser, catches the
  * loopback redirect, and exchanges the code via the SDK's finishAuth.
- * Bearer-token servers never enter the OAuth path: an explicit token is the
- * user saying how auth works.
+ * A server with configured authentication (a bearer token, a static Authorization
+ * header, or one from a headersHelper) never enters the OAuth path: the credential
+ * to fix is the configured one, so an auth failure reports as a failed connection.
  */
-async function connectHttpFamily(name: string, config: { url: string }, makeTransport: MakeTransport, label: string, bearerToken: string | undefined, authUi: AuthUi | undefined): Promise<Client> {
-  const newClient = () => new Client({ name: 'pi-code-mcp', version: '0.1.0' })
+async function connectHttpFamily(name: string, config: { url: string }, makeTransport: MakeTransport, label: string, hasConfiguredAuth: boolean, authUi: AuthUi | undefined, session?: SessionDirs): Promise<Client> {
+  const newClient = () => makeClient(session)
   // Stored tokens ride the first attempt so the SDK refreshes them; with none, no
   // provider is attached, so a 401 surfaces as a transport error carrying code 401
   // (isUnauthorized detects it) and only the interactive provider below ever runs
   // dynamic registration, keeping it bound to the real callback port.
-  const silent = bearerToken ? undefined : new FileOAuthProvider(name, () => {})
+  const silent = hasConfiguredAuth ? undefined : new FileOAuthProvider(name, () => {})
   try {
     const client = newClient()
     await connectWithTimeout(client, makeTransport(silent?.hasTokens() ? silent : undefined), label)
     return client
   } catch (error) {
-    if (bearerToken || !isUnauthorized(error)) throw error
+    if (hasConfiguredAuth || !isUnauthorized(error)) throw error
     if (!authUi) throw new OAuthRequiredError(`${name} requires a login; run pi interactively to authenticate`)
     return await serializeInteractiveOAuth(() => runInteractiveOAuth(name, config, makeTransport, label, authUi, newClient))
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.25",
+  "version": "1.0.27",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",