pi-code 1.0.5 → 1.0.6

package/extensions/mcp.ts

@@ -16,6 +16,17 @@
  * Values support ${VAR} / ${VAR:-default} interpolation, connect and per-call timeouts
  * honor MCP_TIMEOUT / MCP_TOOL_TIMEOUT, and a stdio server receives only the SDK's default
  * environment plus its own `env` block, not the whole process environment.
+ *
+ * Servers advertising the `prompts` capability get their prompts registered as Claude's
+ * /mcp__<server>__<prompt> slash commands (names normalized dashes/spaces to underscores,
+ * args space-separated and mapped positionally); the prompt result drives a turn via
+ * sendUserMessage, exactly how custom slash commands do. Servers advertising `resources`
+ * make the global list_mcp_resources / read_mcp_resource tools available, mirroring
+ * Claude's automatic resource tools. Resource and prompt output rides the same
+ * mapContent/capForContext budget as tool output. That budget is byte/line based
+ * (pi's DEFAULT_MAX_BYTES in the shared output guard); Claude's MAX_MCP_OUTPUT_TOKENS
+ * is a token budget and cannot be folded into it without making the guard token-aware,
+ * so the byte cap stands in for it.
  */
 
 import { execFile } from 'node:child_process'
@@ -32,8 +43,9 @@ import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js' //
 import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
 import { WebSocketClientTransport } from '@modelcontextprotocol/sdk/client/websocket.js'
-import { ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js'
+import { PromptListChangedNotificationSchema, ResourceListChangedNotificationSchema, ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js'
 import { Type } from 'typebox'
+import { splitArgs } from './internal/command-file.js'
 import { MCP_TOOLS_CHANNEL, type McpToolAlias } from './internal/mcp-alias.js'
 import { setMcpToolCaller } from './internal/mcp-call.js'
 import { FileOAuthProvider, openBrowser, startCallbackServer, waitForAuthCode } from './internal/mcp-oauth.js'
@@ -61,7 +73,9 @@ const callTimeoutMs = (): number => envTimeout('MCP_TOOL_TIMEOUT', DEFAULT_CALL_
 // pi's own built-ins (read, bash, edit, ...) cannot be produced and are not listed.
 // These are pi-code's own tools, and mcp.ts registers before the extensions owning
 // them, so without this guard a server named `web` would replace the SSRF-checked fetch.
-const RESERVED_NAMES = new Set(['web_fetch', 'web_search', 'plan_mode_complete'])
+// The resource tools are this extension's own globals; a server named `list` or `read`
+// must not take their names either.
+const RESERVED_NAMES = new Set(['web_fetch', 'web_search', 'plan_mode_complete', 'list_mcp_resources', 'read_mcp_resource'])
 
 export interface StdioServerConfig {
   type?: 'stdio'
@@ -193,6 +207,29 @@ export function loadUserScope(home: string, cwd: string): Record<string, ServerC
   return servers
 }
 
+/** The mcpServers one plugin declares: an inline map on the manifest, or the file it
+ * points to (default .mcp.json at the plugin root), with ${CLAUDE_PLUGIN_*} substituted
+ * before parsing. Malformed or missing JSON yields no entries. */
+function pluginServerEntries(plugin: InstalledPlugin): Record<string, ServerConfig> {
+  const declared = plugin.manifest.mcpServers
+  // An inline map of name -> config; an array is not a valid mcpServers map (it
+  // would register a server named '0'), so it falls through to the path branch.
+  if (declared !== null && typeof declared === 'object' && !Array.isArray(declared)) {
+    try {
+      return JSON.parse(substitutePluginVars(JSON.stringify(declared), plugin))
+    } catch {
+      return {}
+    }
+  }
+  const file = path.resolve(plugin.root, typeof declared === 'string' ? declared : '.mcp.json')
+  try {
+    const parsed = JSON.parse(substitutePluginVars(fs.readFileSync(file, 'utf-8'), plugin))
+    return parsed.mcpServers ?? {}
+  } catch {
+    return {}
+  }
+}
+
 /** Servers shipped by enabled plugins (.mcp.json or the manifest's `mcpServers`,
  * inline or by path), with ${CLAUDE_PLUGIN_*} substituted before parsing. Their
  * tools alias as mcp__plugin_<plugin>_<server>__<tool> for hook matchers, as
@@ -201,26 +238,7 @@ export function loadPluginServers(plugins: InstalledPlugin[]): Record<string, Se
   const fold = (name: string): string => name.replaceAll('-', '_')
   const servers: Record<string, ServerConfig> = {}
   for (const plugin of plugins) {
-    const declared = plugin.manifest.mcpServers
-    let entries: Record<string, ServerConfig> = {}
-    // An inline map of name -> config; an array is not a valid mcpServers map (it
-    // would register a server named '0'), so it falls through to the path branch.
-    if (declared !== null && typeof declared === 'object' && !Array.isArray(declared)) {
-      try {
-        entries = JSON.parse(substitutePluginVars(JSON.stringify(declared), plugin))
-      } catch {
-        continue
-      }
-    } else {
-      const file = path.resolve(plugin.root, typeof declared === 'string' ? declared : '.mcp.json')
-      try {
-        const parsed = JSON.parse(substitutePluginVars(fs.readFileSync(file, 'utf-8'), plugin))
-        entries = parsed.mcpServers ?? {}
-      } catch {
-        continue
-      }
-    }
-    for (const [name, config] of Object.entries(entries)) {
+    for (const [name, config] of Object.entries(pluginServerEntries(plugin))) {
       servers[name] = { ...config, aliasPrefix: `mcp__plugin_${fold(plugin.name)}_${fold(name)}__` }
     }
   }
@@ -259,7 +277,7 @@ export function parseHelperHeaders(stdout: string): Record<string, string> {
 export function managedSettingsPath(platform: NodeJS.Platform = process.platform): string {
   if (platform === 'darwin') return '/Library/Application Support/ClaudeCode/managed-settings.json'
   // The legacy C:\ProgramData\ClaudeCode path was dropped in Claude Code v2.1.75.
-  if (platform === 'win32') return 'C:\\Program Files\\ClaudeCode\\managed-settings.json'
+  if (platform === 'win32') return String.raw`C:\Program Files\ClaudeCode\managed-settings.json`
   return '/etc/claude-code/managed-settings.json'
 }
 
@@ -282,8 +300,12 @@ export function mcpAllowDeny(managedFile: string = managedSettingsFileOverride ?
   } catch {
     // No managed policy on this machine: no restriction.
   }
-  const names = (value: unknown): string[] =>
-    Array.isArray(value) ? value.map((entry) => (typeof entry === 'string' ? entry : typeof (entry as { serverName?: unknown })?.serverName === 'string' ? (entry as { serverName: string }).serverName : undefined)).filter((name): name is string => typeof name === 'string' && name.length > 0) : []
+  const entryName = (entry: unknown): string | undefined => {
+    if (typeof entry === 'string') return entry
+    const serverName = (entry as { serverName?: unknown })?.serverName
+    return typeof serverName === 'string' ? serverName : undefined
+  }
+  const names = (value: unknown): string[] => (Array.isArray(value) ? value.map(entryName).filter((name): name is string => typeof name === 'string' && name.length > 0) : [])
   return {
     allowed: Array.isArray(settings.allowedMcpServers) ? new Set(names(settings.allowedMcpServers)) : null,
     denied: new Set(names(settings.deniedMcpServers)),
@@ -319,6 +341,52 @@ export function formatToolName(server: string, tool: string): string {
   return `${server}_${tool}`.replaceAll('-', '_')
 }
 
+/** Claude exposes server prompts as /mcp__<server>__<prompt> slash commands. Both
+ * names normalize like formatToolName, extended to spaces: dashes and spaces each
+ * become an underscore. */
+export function formatPromptCommandName(server: string, prompt: string): string {
+  const normalize = (name: string): string => name.replace(/[\s-]/g, '_')
+  return `mcp__${normalize(server)}__${normalize(prompt)}`
+}
+
+export interface McpPromptArgumentInfo {
+  name: string
+  description?: string
+  required?: boolean
+}
+
+export interface McpPromptInfo {
+  name: string
+  description?: string
+  arguments?: McpPromptArgumentInfo[]
+}
+
+/** Claude passes prompt arguments space-separated after the command. Tokens map
+ * positionally onto the declared arguments, split the way slash-command args are
+ * (quoted runs stay together); the last declared argument absorbs any trailing
+ * tokens so free text at the end is not silently dropped. Declared arguments with
+ * no token are omitted, and the server enforces its own `required`. */
+export function mapPromptArguments(declared: ReadonlyArray<{ name: string }> | undefined, args: string): Record<string, string> {
+  const tokens = splitArgs(args)
+  const names = (declared ?? []).map((argument) => argument.name)
+  const mapped: Record<string, string> = {}
+  for (let index = 0; index < names.length && index < tokens.length; index++) {
+    mapped[names[index]] = index === names.length - 1 ? tokens.slice(index).join(' ') : tokens[index]
+  }
+  return mapped
+}
+
+/** The content blocks a getPrompt result injects. Each message carries one content
+ * block; the blocks ride the same mapContent budget as tool output, and image blocks
+ * are carried through rather than dropped, since sendUserMessage accepts them and a
+ * vision prompt is worthless flattened to text. An empty message list yields no
+ * blocks, and messages that carry only empty text yield none either, so the caller
+ * can skip the turn rather than drive it on an empty or sentinel message. */
+export function promptMessageContent(messages: ReadonlyArray<{ content: unknown }>): ToolContent[] {
+  if (messages.length === 0) return []
+  return mapContent(messages.map((message) => message.content as McpContentBlock)).filter((block) => block.type !== 'text' || block.text.trim() !== '')
+}
+
 export function normalizeSchema(schema: unknown): object {
   const base = (schema as Record<string, unknown>) ?? {}
   const { $schema: _dropSchema, additionalProperties: _dropAdditional, ...rest } = base
@@ -491,6 +559,15 @@ export interface AuthUi {
   notify: (message: string, level: 'info' | 'warning' | 'error') => void
 }
 
+/** The OAuth flow's UI seams, absent in headless runs. */
+function authUiFor(ctx: ExtensionContext): AuthUi | undefined {
+  if (!ctx.hasUI) return undefined
+  return {
+    confirm: (title, body) => ctx.ui.confirm(title, body),
+    notify: (message, level) => ctx.ui.notify(message, level),
+  }
+}
+
 /** Browser logins are human-paced; a connect-sized timeout would cut them off. */
 const OAUTH_FLOW_TIMEOUT_MS = 180_000
 
@@ -499,6 +576,14 @@ const OAUTH_FLOW_TIMEOUT_MS = 180_000
  * from a transport mismatch without matching on message text. */
 class OAuthRequiredError extends Error {}
 
+/** Wrap a login-flow failure as OAuthRequiredError, passing an existing one through
+ * unchanged so its message is not doubled. */
+function asOAuthRequiredError(name: string, error: unknown): OAuthRequiredError {
+  if (error instanceof OAuthRequiredError) return error
+  const detail = error instanceof Error ? error.message : String(error)
+  return new OAuthRequiredError(`login for ${name} failed: ${detail}`)
+}
+
 /** Whether a connect failure is an authentication problem: the SDK's own
  * UnauthorizedError, a transport error carrying HTTP 401 (which is what a 401
  * throws when no authProvider was attached, so a first-time login is detected),
@@ -508,6 +593,13 @@ function isUnauthorized(error: unknown): boolean {
   return typeof error === 'object' && error !== null && (error as { code?: unknown }).code === 401
 }
 
+// SSEClientTransport is deprecated in favour of Streamable HTTP, but both concrete
+// transports expose finishAuth (the base Transport interface does not), so the union
+// stays as the http-family fallback type through the migration period.
+type HttpFamilyTransport = SSEClientTransport | StreamableHTTPClientTransport // NOSONAR typescript:S1874 - SSE fallback still required by the MCP SDK
+
+type MakeTransport = (authProvider?: OAuthClientProvider) => HttpFamilyTransport
+
 /**
  * Connect an http-family server, running Claude's OAuth login when the server
  * demands one. Stored tokens ride the first attempt so the SDK refreshes
@@ -516,7 +608,7 @@ function isUnauthorized(error: unknown): boolean {
  * Bearer-token servers never enter the OAuth path: an explicit token is the
  * user saying how auth works.
  */
-async function connectHttpFamily(name: string, config: { url: string }, makeTransport: (authProvider?: OAuthClientProvider) => SSEClientTransport | StreamableHTTPClientTransport, label: string, bearerToken: string | undefined, authUi: AuthUi | undefined): Promise<Client> {
+async function connectHttpFamily(name: string, config: { url: string }, makeTransport: MakeTransport, label: string, bearerToken: string | undefined, authUi: AuthUi | undefined): Promise<Client> {
   const newClient = () => new Client({ name: 'pi-code-mcp', version: '0.1.0' })
   // Stored tokens ride the first attempt so the SDK refreshes them; with none, no
   // provider is attached, so a 401 surfaces as a transport error carrying code 401
@@ -530,39 +622,47 @@ async function connectHttpFamily(name: string, config: { url: string }, makeTran
   } catch (error) {
     if (bearerToken || !isUnauthorized(error)) throw error
     if (!authUi) throw new OAuthRequiredError(`${name} requires a login; run pi interactively to authenticate`)
-    const approved = await authUi.confirm(`MCP server "${name}" requires login`, `Open your browser to authorize ${config.url}?`)
-    if (!approved) throw new OAuthRequiredError(`login declined for ${name}`)
-    const provider = new FileOAuthProvider(name, (authorizationUrl) => {
-      openBrowser(String(authorizationUrl))
-      authUi.notify(`Authorize "${name}" in the browser. If it did not open: ${authorizationUrl}`, 'info')
-    })
-    const { server, port } = await startCallbackServer(provider.savedRedirectPort())
-    provider.bindRedirectPort(port)
+    return await runInteractiveOAuth(name, config, makeTransport, label, authUi, newClient)
+  }
+}
+
+/**
+ * The interactive half of the OAuth login, reached only once a silent connect has
+ * failed with a 401 and a UI is present: confirm, open the browser, catch the loopback
+ * redirect, and exchange the code via the SDK's finishAuth. Past the confirm the server
+ * is known to need OAuth, so any failure here (a denied consent page, the 180s wait, a
+ * token exchange error) is wrapped as an auth failure, not a transport mismatch: that
+ * keeps the typeless-url caller from retrying over SSE and prompting for a second login.
+ */
+async function runInteractiveOAuth(name: string, config: { url: string }, makeTransport: MakeTransport, label: string, authUi: AuthUi, newClient: () => Client): Promise<Client> {
+  const approved = await authUi.confirm(`MCP server "${name}" requires login`, `Open your browser to authorize ${config.url}?`)
+  if (!approved) throw new OAuthRequiredError(`login declined for ${name}`)
+  const provider = new FileOAuthProvider(name, (authorizationUrl) => {
+    openBrowser(String(authorizationUrl))
+    authUi.notify(`Authorize "${name}" in the browser. If it did not open: ${authorizationUrl}`, 'info')
+  })
+  const { server, port } = await startCallbackServer(provider.savedRedirectPort())
+  provider.bindRedirectPort(port)
+  try {
+    const transport = makeTransport(provider)
+    const pendingCode = waitForAuthCode(server, OAUTH_FLOW_TIMEOUT_MS)
+    pendingCode.catch(() => {}) // consumed below; an abandoned login must not surface as unhandled
+    const client = newClient()
     try {
-      const transport = makeTransport(provider)
-      const pendingCode = waitForAuthCode(server, OAUTH_FLOW_TIMEOUT_MS)
-      pendingCode.catch(() => {}) // consumed below; an abandoned login must not surface as unhandled
-      const client = newClient()
-      try {
-        await connectWithTimeout(client, transport, label)
-        return client // authorized between attempts; nothing left to exchange
-      } catch (retryError) {
-        if (!isUnauthorized(retryError)) throw retryError
-        const code = await pendingCode
-        await transport.finishAuth(code)
-        const authed = newClient()
-        await connectWithTimeout(authed, makeTransport(provider), label)
-        return authed
-      }
-    } catch (flowError) {
-      // Past the confirm the server is known to need OAuth, so any failure here (a
-      // denied consent page, the 180s wait, a token exchange error) is an auth
-      // failure, not a transport mismatch. Marking it keeps the typeless-url caller
-      // from retrying over SSE and prompting the user to log in a second time.
-      throw flowError instanceof OAuthRequiredError ? flowError : new OAuthRequiredError(`login for ${name} failed: ${flowError instanceof Error ? flowError.message : String(flowError)}`)
-    } finally {
-      server.close()
+      await connectWithTimeout(client, transport, label)
+      return client // authorized between attempts; nothing left to exchange
+    } catch (retryError) {
+      if (!isUnauthorized(retryError)) throw retryError
+      const code = await pendingCode
+      await transport.finishAuth(code)
+      const authed = newClient()
+      await connectWithTimeout(authed, makeTransport(provider), label)
+      return authed
     }
+  } catch (flowError) {
+    throw asOAuthRequiredError(name, flowError)
+  } finally {
+    server.close()
   }
 }
 
@@ -603,6 +703,73 @@ async function listAllTools(client: Client): Promise<McpToolInfo[]> {
   return tools
 }
 
+async function listAllPrompts(client: Client): Promise<McpPromptInfo[]> {
+  const prompts: McpPromptInfo[] = []
+  let cursor: string | undefined
+  do {
+    const page = await client.listPrompts({ cursor })
+    prompts.push(...page.prompts)
+    cursor = page.nextCursor
+  } while (cursor)
+  return prompts
+}
+
+/** One resource's flat record for the list_mcp_resources output, dropping the optional
+ * description/mimeType when the server omits them. */
+function resourceEntry(server: string, resource: { uri: string; name: string; description?: string; mimeType?: string }): Record<string, unknown> {
+  return { server, uri: resource.uri, name: resource.name, ...(resource.description ? { description: resource.description } : {}), ...(resource.mimeType ? { mimeType: resource.mimeType } : {}) }
+}
+
+/** One resource template's flat record, likewise dropping absent optional fields. */
+function resourceTemplateEntry(server: string, template: { uriTemplate: string; name: string; description?: string; mimeType?: string }): Record<string, unknown> {
+  return { server, uriTemplate: template.uriTemplate, name: template.name, ...(template.description ? { description: template.description } : {}), ...(template.mimeType ? { mimeType: template.mimeType } : {}) }
+}
+
+/** Page a server's resources to exhaustion under the call budget, appending each as a
+ * flat record. Pushed into the caller's array incrementally so a mid-pagination failure
+ * still leaves the earlier pages in place. */
+async function collectResources(entries: Array<Record<string, unknown>>, name: string, client: Client, budget: number): Promise<void> {
+  let cursor: string | undefined
+  do {
+    const page = await withTimeout(client.listResources({ cursor }, { timeout: budget }), budget, `list resources ${name}`)
+    for (const resource of page.resources) entries.push(resourceEntry(name, resource))
+    cursor = page.nextCursor
+  } while (cursor)
+}
+
+/** Page a server's resource templates to exhaustion under the call budget. */
+async function collectResourceTemplates(entries: Array<Record<string, unknown>>, name: string, client: Client, budget: number): Promise<void> {
+  let cursor: string | undefined
+  do {
+    const page = await withTimeout(client.listResourceTemplates({ cursor }, { timeout: budget }), budget, `list resource templates ${name}`)
+    for (const template of page.resourceTemplates) entries.push(resourceTemplateEntry(name, template))
+    cursor = page.nextCursor
+  } while (cursor)
+}
+
+/** Append every resource and template one server exposes. A resource-listing failure
+ * surfaces inline as an error record, so one server cannot empty the whole listing; a
+ * template-listing failure is silent, templates being optional (a server with the
+ * resources capability but no templates answers method-not-found). */
+async function collectServerResourceEntries(entries: Array<Record<string, unknown>>, name: string, client: Client, budget: number): Promise<void> {
+  try {
+    await collectResources(entries, name, client, budget)
+  } catch (error) {
+    entries.push({ server: name, error: error instanceof Error ? error.message : String(error) })
+  }
+  try {
+    await collectResourceTemplates(entries, name, client, budget)
+  } catch {
+    // Templates are optional: a method-not-found here is not worth reporting.
+  }
+}
+
+/** The optional server-name filter for list_mcp_resources: a non-empty string, else undefined. */
+function resourceServerFilter(params: unknown): string | undefined {
+  const server = (params as { server?: unknown }).server
+  return typeof server === 'string' && server.length > 0 ? server : undefined
+}
+
 export default async function mcpExtension(pi: ExtensionAPI) {
   const clients = new Map<string, Client>()
   const status = new Map<string, { state: string; tools: number }>()
@@ -662,6 +829,147 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     return count
   }
 
+  // Prompt command name -> the server and prompt that own it, so a refresh re-listing
+  // the same prompt is told apart both from a cross-server collision and from a second
+  // prompt on the same server whose name normalizes to the one already taken (e.g.
+  // `deploy-prod` and `deploy_prod`), mirroring `registered` for tools.
+  const registeredPrompts = new Map<string, { server: string; prompt: string }>()
+
+  /** Register a slash command for every not-yet-registered prompt of a server. pi has
+   * no command unregister, so, like tools, a withdrawn prompt keeps its registration
+   * and surfaces the server's own error when invoked; an edit to a prompt's declared
+   * arguments only lands on new names, since an existing command keeps its binding. */
+  function registerPrompts(name: string, client: Client, prompts: McpPromptInfo[]): void {
+    for (const prompt of prompts) {
+      const commandName = formatPromptCommandName(name, prompt.name)
+      const owner = registeredPrompts.get(commandName)
+      if (owner) {
+        if (owner.server === name && owner.prompt === prompt.name) continue // a refresh re-listing the same prompt
+        console.warn(`pi-code-mcp: skipping colliding prompt command ${commandName}`)
+        continue
+      }
+      registeredPrompts.set(commandName, { server: name, prompt: prompt.name })
+      const hint = (prompt.arguments ?? []).map((argument) => (argument.required ? `<${argument.name}>` : `[${argument.name}]`)).join(' ')
+      const base = prompt.description ?? `MCP prompt ${prompt.name} from ${name}`
+      pi.registerCommand(commandName, {
+        description: hint ? `${base} ${hint}` : base,
+        handler: async (args, ctx) => {
+          try {
+            const promptArgs = mapPromptArguments(prompt.arguments, args)
+            const params: { name: string; arguments?: Record<string, string> } = { name: prompt.name }
+            if (Object.keys(promptArgs).length > 0) params.arguments = promptArgs
+            const budget = callTimeoutMs()
+            const result = await withTimeout(client.getPrompt(params, { timeout: budget }), budget, commandName)
+            // The prompt drives a turn exactly the way a custom slash command does
+            // (see commands.ts), carrying its image blocks through. A prompt that
+            // yields no content is reported rather than sent as an empty turn.
+            const content = promptMessageContent(result.messages)
+            if (content.length === 0) {
+              ctx.ui.notify(`${commandName}: prompt returned no content`, 'info')
+              return
+            }
+            pi.sendUserMessage(content)
+          } catch (error) {
+            ctx.ui.notify(`${commandName}: ${error instanceof Error ? error.message : String(error)}`, 'error')
+          }
+        },
+      })
+    }
+  }
+
+  /** Claude exposes prompts as slash commands only for servers advertising the
+   * prompts capability; a listing failure loses the prompts, not the server. */
+  async function connectPrompts(name: string, client: Client): Promise<void> {
+    if (!client.getServerCapabilities()?.prompts) return
+    try {
+      registerPrompts(name, client, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
+    } catch (error) {
+      console.warn(`pi-code-mcp: prompt listing failed for ${name}: ${error instanceof Error ? error.message : String(error)}`)
+    }
+  }
+
+  /** Mirror of subscribeToToolChanges for the prompt list: a newly announced prompt
+   * registers without a restart, a withdrawn one keeps its registration. */
+  function subscribeToPromptChanges(name: string, client: Client): void {
+    try {
+      client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {
+        try {
+          registerPrompts(name, client, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
+        } catch (error) {
+          console.warn(`pi-code-mcp: prompt refresh failed for ${name}: ${error instanceof Error ? error.message : String(error)}`)
+        }
+      })
+    } catch {
+      // a transport or client without notification support simply never refreshes
+    }
+  }
+
+  /** Servers currently connected that advertise the resources capability. */
+  const resourceServers = (): Array<[string, Client]> => [...clients.entries()].filter(([, client]) => Boolean(client.getServerCapabilities()?.resources))
+
+  let resourceToolsRegistered = false
+
+  /** Claude auto-provides tools to list and read MCP resources when servers support
+   * them. Registered once, globally, the first time a connected server advertises the
+   * resources capability: the tools span servers, taking the server name as an
+   * argument, so per-server registration would only produce duplicates. Listings are
+   * fetched live on every call, so a resources list_changed needs no cache
+   * invalidation; its handler only re-checks this gate (see subscribeToResourceChanges). */
+  function ensureResourceTools(): void {
+    if (resourceToolsRegistered || resourceServers().length === 0) return
+    resourceToolsRegistered = true
+    pi.registerTool({
+      name: 'list_mcp_resources',
+      label: 'List MCP resources',
+      description: 'List available resources and resource templates from connected MCP servers. Optionally filter to a single server by name.',
+      parameters: Type.Object({ server: Type.Optional(Type.String({ description: 'Only list resources from this server' })) }),
+      async execute(_id, params) {
+        const filter = resourceServerFilter(params)
+        if (filter && !clients.has(filter)) throw new Error(`MCP server "${filter}" is not connected`)
+        const entries: Array<Record<string, unknown>> = []
+        for (const [name, client] of resourceServers()) {
+          if (filter && name !== filter) continue
+          await collectServerResourceEntries(entries, name, client, callTimeoutMs())
+        }
+        return { content: mapContent([{ type: 'text', text: JSON.stringify(entries, null, 2) }]), details: {} }
+      },
+    })
+    pi.registerTool({
+      name: 'read_mcp_resource',
+      label: 'Read MCP resource',
+      description: 'Read a resource from a connected MCP server by URI.',
+      parameters: Type.Object({ server: Type.String({ description: 'The MCP server name' }), uri: Type.String({ description: 'The resource URI to read' }) }),
+      async execute(_id, params) {
+        const { server, uri } = params as { server: string; uri: string }
+        const client = clients.get(server)
+        if (!client) throw new Error(`MCP server "${server}" is not connected`)
+        const budget = callTimeoutMs()
+        const result = await withTimeout(client.readResource({ uri }, { timeout: budget }), budget, `read ${uri}`)
+        const blocks = (result.contents as Array<{ uri: string; text?: string; blob?: string; mimeType?: string }>).map((entry): McpContentBlock => {
+          if (typeof entry.text === 'string') return { type: 'resource', resource: { uri: entry.uri, text: entry.text } }
+          if (entry.blob && entry.mimeType?.startsWith('image/')) return { type: 'image', data: entry.blob, mimeType: entry.mimeType }
+          // Non-image binary has no useful text form; a placeholder beats megabytes
+          // of base64 reaching the model as JSON.
+          return { type: 'text', text: `[Binary resource ${entry.uri} (${entry.mimeType ?? 'unknown type'})]` }
+        })
+        return { content: mapContent(blocks), details: {} }
+      },
+    })
+  }
+
+  /** Resource listings are fetched live per call, so the notification has no cache to
+   * invalidate; re-checking the registration gate covers a server whose capabilities
+   * settled after the connect-time check. */
+  function subscribeToResourceChanges(client: Client): void {
+    try {
+      client.setNotificationHandler(ResourceListChangedNotificationSchema, async () => {
+        ensureResourceTools()
+      })
+    } catch {
+      // a transport or client without notification support simply never refreshes
+    }
+  }
+
   /** Claude refreshes tools on a server's list_changed notification. pi has no
    * unregister, so a withdrawn tool keeps its registration and surfaces the server's
    * own error when called; a newly announced one is registered without a restart. */
@@ -708,6 +1016,12 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
           const count = registerTools(name, config, client, tools)
           subscribeToToolChanges(name, config, client)
+          // Prompts and resources are additive surfaces: their failures warn (inside
+          // connectPrompts) rather than flipping a tool-serving server to failed.
+          await connectPrompts(name, client)
+          subscribeToPromptChanges(name, client)
+          ensureResourceTools()
+          subscribeToResourceChanges(client)
           status.set(name, { state: 'connected', tools: count })
           // A server that dies mid-session would otherwise stay "connected" in /mcp
           // while every call fails with the SDK's bare "Not connected"; flip the
@@ -749,15 +1063,6 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     return true
   }
 
-  /** The OAuth flow's UI seams, absent in headless runs. */
-  function authUiFor(ctx: ExtensionContext): AuthUi | undefined {
-    if (!ctx.hasUI) return undefined
-    return {
-      confirm: (title, body) => ctx.ui.confirm(title, body),
-      notify: (message, level) => ctx.ui.notify(message, level),
-    }
-  }
-
   let projectConnected = false
 
   pi.on('session_start', async (_event, ctx) => {

package/extensions/memory.ts

@@ -159,6 +159,33 @@ export function saveMemory(dir: string, indexPath: string, name: string | undefi
   return { content: [{ type: 'text', text: `Saved memory ${name}.` }], details: {} }
 }
 
+/** The read action: a memory's body, capped for context, or a not-found message. */
+function readMemory(dir: string, name: string): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
+  try {
+    const body = fs.readFileSync(path.join(dir, `${name}.md`), 'utf-8')
+    return { content: [{ type: 'text', text: capForContext(body) }], details: {} }
+  } catch {
+    return { content: [{ type: 'text', text: `No memory named ${name}.` }], details: {} }
+  }
+}
+
+/** The delete action: remove a memory file and its index line. The index is read
+ * before anything is removed: refusing on a failed read must leave both the memory
+ * file and the index as they were. */
+function deleteMemory(dir: string, indexPath: string, name: string): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
+  let index: string
+  try {
+    index = readIndex(dir)
+  } catch (error) {
+    return { content: [{ type: 'text', text: `Memory delete failed: ${error instanceof Error ? error.message : String(error)}. Nothing was deleted.` }], details: {} }
+  }
+  fs.rmSync(path.join(dir, `${name}.md`), { force: true })
+  const remaining = removeIndexLine(index, name)
+  if (remaining) writeIndex(indexPath, remaining)
+  else fs.rmSync(indexPath, { force: true })
+  return { content: [{ type: 'text', text: `Deleted memory ${name}.` }], details: {} }
+}
+
 /** The index as injected into the prompt, bounded like Claude's startup load. */
 export function capIndexForPrompt(index: string): string {
   const loaded = stripNonLoaded(index)
@@ -327,29 +354,12 @@ export default function memoryExtension(pi: ExtensionAPI) {
 
       if (params.action === 'read') {
         if (!name) return { content: [{ type: 'text' as const, text: 'read requires name.' }], details: {} }
-        try {
-          const body = fs.readFileSync(path.join(dir, `${name}.md`), 'utf-8')
-          return { content: [{ type: 'text' as const, text: capForContext(body) }], details: {} }
-        } catch {
-          return { content: [{ type: 'text' as const, text: `No memory named ${name}.` }], details: {} }
-        }
+        return readMemory(dir, name)
       }
 
       if (params.action === 'delete') {
         if (!name) return { content: [{ type: 'text' as const, text: 'delete requires name.' }], details: {} }
-        // The index is read before anything is removed: refusing on a failed read
-        // must leave both the memory file and the index as they were.
-        let index: string
-        try {
-          index = readIndex(dir)
-        } catch (error) {
-          return { content: [{ type: 'text' as const, text: `Memory delete failed: ${error instanceof Error ? error.message : String(error)}. Nothing was deleted.` }], details: {} }
-        }
-        fs.rmSync(path.join(dir, `${name}.md`), { force: true })
-        const remaining = removeIndexLine(index, name)
-        if (remaining) writeIndex(indexPath, remaining)
-        else fs.rmSync(indexPath, { force: true })
-        return { content: [{ type: 'text' as const, text: `Deleted memory ${name}.` }], details: {} }
+        return deleteMemory(dir, indexPath, name)
       }
 
       const index = readIndexQuietly(dir)

package/extensions/notify.ts

@@ -104,10 +104,9 @@ export default function notifyExtension(pi: ExtensionAPI) {
   // Claude's "appear to be away" check. Undefined until the first prompt this session.
   let lastInputAt: number | undefined
 
-  pi.on('session_start', async (_event, ctx) => {
+  pi.on('session_start', async (_event, _ctx) => {
     channel = resolveNotifChannel(readPreferredNotifChannel(os.homedir()))
     lastInputAt = undefined
-    void ctx
   })
 
   pi.on('input', async () => {