pi-mcp-adapter 3.1.0 → 3.2.0

package/init.ts

@@ -3,7 +3,7 @@ import type { McpExtensionState } from "./state.ts";
 import { formatToolName, isServerDisabled, resolveToolPrefix, type McpAdapterOptions, type PromptMetadata, type ToolMetadata, type ToolSelectorCandidateIndex } from "./types.ts";
 import { existsSync } from "node:fs";
 import { cloneMcpConfig, loadMcpConfig, resolveConfiguredClaudePluginMcp } from "./config.ts";
-import { applyProjectServerTrustToConfig, describeProjectServerBlock } from "./project-server-trust.ts";
+import { applyProjectServerTrustToConfig, describeProjectServerBlock, excludeProjectServersAtLoadTime } from "./project-server-trust.ts";
 import { ConsentManager } from "./consent-manager.ts";
 import { McpLifecycleManager } from "./lifecycle.ts";
 import {
@@ -104,6 +104,8 @@ type McpInitializationOptions = McpAdapterOptions & {
   oauthRuntime?: McpOAuthRuntime;
   statusEvents?: McpExtensionState["statusEvents"];
   onProjectTrustResolved?: () => void;
+  /** Load-time runs have no Pi context, so project trust is unknown; session_start decides later. */
+  excludeProjectServers?: boolean;
 };
 
 export async function initializeMcp(
@@ -142,7 +144,9 @@ export async function initializeMcp(
   const runtimeSignal = combineAbortSignals(owner.signal, initialSignal);
   const trustResult = options.config !== undefined
     ? { config: resolveConfiguredClaudePluginMcp(cloneMcpConfig(options.config), cwd), blockedServers: new Map() }
-    : await applyProjectServerTrustToConfig(loadMcpConfig(configPath, cwd), ctx);
+    : options.excludeProjectServers
+      ? { config: excludeProjectServersAtLoadTime(loadMcpConfig(configPath, cwd)), blockedServers: new Map() }
+      : await applyProjectServerTrustToConfig(loadMcpConfig(configPath, cwd), ctx);
   options.onProjectTrustResolved?.();
   const config = trustResult.config;
   const authStorageOptions = getAuthStorageOptions(config.settings?.oauthDir, cwd, config.settings?.oauthCredentialStore);
@@ -593,6 +597,7 @@ export function updateMetadataCache(
   if (!definition || isServerDisabled(definition)) return;
 
   const configHash = computeServerHash(definition);
+  if (connection.definition && computeServerHash(connection.definition) !== configHash) return;
   const existing = loadMetadataCache();
   const existingEntry = existing?.servers?.[serverName];
 
@@ -602,13 +607,13 @@ export function updateMetadataCache(
     ? existingEntry?.configHash === configHash ? existingEntry.prompts : undefined
     : serializePrompts(connection.prompts ?? []);
 
-  if (
-    definition.exposeResources !== false &&
-    connection.resourceDiscoveryFailed === true &&
-    existingEntry?.resources?.length &&
-    isServerCacheValid(existingEntry, definition)
-  ) {
-    resources = existingEntry.resources;
+  if (definition.exposeResources !== false && connection.resourceDiscoveryFailed === true) {
+    const sessionEntry = state.sessionMetadata?.get(serverName);
+    if (sessionEntry?.configHash === configHash) {
+      resources = sessionEntry.resources ?? [];
+    } else if (existingEntry?.resources?.length && isServerCacheValid(existingEntry, definition)) {
+      resources = existingEntry.resources;
+    }
   }
 
   const entry: ServerCacheEntry = {
@@ -622,6 +627,7 @@ export function updateMetadataCache(
     cachedAt: Date.now(),
   };
 
+  (state.sessionMetadata ??= new Map()).set(serverName, entry);
   saveMetadataCache({ version: 1, servers: { [serverName]: entry } });
 }
 

package/mcp-callback-server.ts

@@ -8,6 +8,7 @@
 import { createServer, type Server, type IncomingMessage, type ServerResponse } from "http"
 import { getAppName } from "./agent-dir.ts"
 import {
+  DEFAULT_OAUTH_CALLBACK_HOST,
   DEFAULT_OAUTH_CALLBACK_PATH,
   getConfiguredOAuthCallbackPort,
   getOAuthCallbackPath,
@@ -197,7 +198,6 @@ interface EnsureCallbackServerOptions {
   reserveState?: boolean
 }
 
-const DEFAULT_OAUTH_CALLBACK_HOST = "localhost"
 let callbackServerHost = DEFAULT_OAUTH_CALLBACK_HOST
 
 /**

package/mcp-code.ts

@@ -3,7 +3,7 @@ import { formatWithOptions } from "node:util";
 import { Worker } from "node:worker_threads";
 import { throwIfAborted } from "./abort.ts";
 import { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from "./mcp-output-guard.ts";
-import { loadMcpScriptWasm } from "./mcp-script-wasm.ts";
+import { loadMcpScriptWasm, resolveMcpScriptQuickJsUrl } from "./mcp-script-wasm.ts";
 import { evaluateJev, validateJevSettings } from "./jev-client.ts";
 import type { JevErrorCode, JevEvaluateInput, JevEvaluationEnvelope } from "./jev-contracts.ts";
 import { executeCall } from "./proxy-modes.ts";
@@ -408,7 +408,7 @@ export async function runMcpScript(
   try {
     const wasm = await Promise.race([loadMcpScriptWasm(), timeout, aborted]);
     worker = new Worker(new URL("./mcp-script-worker.mjs", import.meta.url), {
-      workerData: { code, wasm, interrupt, outputMaxBytes: MCP_SCRIPT_OUTPUT_MAX_BYTES },
+      workerData: { code, wasm, quickjsUrl: resolveMcpScriptQuickJsUrl(), interrupt, outputMaxBytes: MCP_SCRIPT_OUTPUT_MAX_BYTES },
       env: {},
       // The sandbox cannot open files, and the host always terminates this worker.
       // Disable Node's unmanaged FD bookkeeping, which emits false warnings when

package/mcp-oauth-provider.ts

@@ -89,6 +89,9 @@ function toOAuthTokens(tokens: StoredTokens): IssuerBoundTokens {
 }
 
 // Callback server configuration
+// RFC 8252 section 7.3: use the loopback IP literal, not "localhost". The
+// callback listener binds this same host so the advertised redirect reaches it.
+const DEFAULT_OAUTH_CALLBACK_HOST = "127.0.0.1"
 const DEFAULT_OAUTH_CALLBACK_PORT = 19876
 const DEFAULT_OAUTH_CALLBACK_PATH = "/callback"
 
@@ -287,7 +290,7 @@ export class McpOAuthProvider implements OAuthClientProvider {
     this.flowState = initialState
     this.redirectUrlSnapshot = config.grantType === "client_credentials"
       ? undefined
-      : config.redirectUri ?? `http://localhost:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`
+      : config.redirectUri ?? `http://${DEFAULT_OAUTH_CALLBACK_HOST}:${getOAuthCallbackPort()}${getOAuthCallbackPath()}`
   }
 
   setAuthFetch(fetchFn: OAuthFetch): void {
@@ -816,4 +819,4 @@ export class McpOAuthProvider implements OAuthClientProvider {
   }
 }
 
-export { DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }
+export { DEFAULT_OAUTH_CALLBACK_HOST, DEFAULT_OAUTH_CALLBACK_PORT, DEFAULT_OAUTH_CALLBACK_PATH }

package/mcp-script-wasm.ts

@@ -1,12 +1,29 @@
 import { readFile } from "node:fs/promises";
 import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
 
 export type McpScriptWasmModule = object;
 
 const cached = new Map<string, Promise<McpScriptWasmModule>>();
 
+function resolveQuickJsWasmPath(): string {
+  return createRequire(import.meta.url).resolve("quickjs-wasi/quickjs.wasm");
+}
+
+/**
+ * Resolve the quickjs-wasi entry on the host thread. The worker imports this
+ * file URL because Bun-compiled executables cannot resolve bare package names
+ * from a worker file loaded from disk.
+ * Those executables also fail to resolve the bare `quickjs-wasi` root on the
+ * host thread, while package subpaths resolve. So the entry is located next to
+ * the wasm file, which is how quickjs-wasi's `"."` export lays it out.
+ */
+export function resolveMcpScriptQuickJsUrl(): string {
+  return new URL("./dist/index.js", pathToFileURL(resolveQuickJsWasmPath())).href;
+}
+
 /** Load and compile the packaged QuickJS runtime once per host process. */
-export function loadMcpScriptWasm(path = createRequire(import.meta.url).resolve("quickjs-wasi/quickjs.wasm")): Promise<McpScriptWasmModule> {
+export function loadMcpScriptWasm(path = resolveQuickJsWasmPath()): Promise<McpScriptWasmModule> {
   let module = cached.get(path);
   if (!module) {
     const webAssembly = (globalThis as unknown as {

package/mcp-script-worker.mjs

@@ -1,16 +1,18 @@
 import { parentPort, workerData } from "node:worker_threads";
-import { JSException, MAX_STACK_SIZE, QuickJS } from "quickjs-wasi";
 
 const MEMORY_LIMIT_BYTES = 64 * 1024 * 1024;
 const ERROR_MAX_BYTES = 64 * 1024;
 const ERROR_TRUNCATION_MARKER = "\n...[mcpScript error truncated]";
 
+// Set once main() imports quickjs-wasi from the host-resolved file URL.
+let JSException;
+
 function post(message) {
   parentPort?.postMessage(message);
 }
 
 function errorText(error) {
-  if (error instanceof JSException) {
+  if (JSException && error instanceof JSException) {
     const head = error.message ? `${error.name}: ${error.message}` : error.name;
     return error.stack ? `${head}\n${error.stack}` : head;
   }
@@ -172,6 +174,11 @@ const PRELUDE_SOURCE = `(function (bridge) {
 })`;
 
 async function main() {
+  // Bun-compiled executables cannot resolve bare package names from this
+  // worker file, so import quickjs-wasi from the URL the host resolved.
+  const quickjs = await import(workerData.quickjsUrl);
+  JSException = quickjs.JSException;
+  const { MAX_STACK_SIZE, QuickJS } = quickjs;
   const interrupt = new Int32Array(workerData.interrupt);
   let outputBytes = 0;
   let outputExceeded = false;

package/namespace-tools.ts

@@ -190,6 +190,10 @@ export interface SyncNamespaceProxyToolsInput {
   activeDirectNames?: ReadonlySet<string>;
   existingNamespaceNames: Set<string>;
   unavailableServers?: ReadonlySet<string>;
+  // Names the adapter removed from Pi's active tools because Pi could not
+  // unregister them. Pi does not re-activate a name it already knows, so a
+  // later re-registration must add the name back.
+  fallbackDeactivatedNames?: Set<string>;
   pi: ExtensionAPI;
   getState: GetState;
   getInitPromise: GetInitPromise;
@@ -265,10 +269,19 @@ function registerNamespaceProxyTool(
     ),
   });
   input.guardReentrant?.();
+  if (input.fallbackDeactivatedNames?.delete(spec.toolName)) {
+    // Only undo a fallback deactivation the adapter still owns.
+    input.guardReentrant?.();
+    const activeTools = getActiveToolsIfReady(input.pi);
+    input.guardReentrant?.();
+    if (activeTools && !activeTools.includes(spec.toolName)) {
+      input.pi.setActiveTools([...activeTools, spec.toolName]);
+      input.guardReentrant?.();
+    }
+  }
 }
 
-function getActiveToolsForStaleCleanup(pi: ExtensionAPI, staleNames: string[]): string[] | undefined {
-  if (staleNames.length === 0) return undefined;
+function getActiveToolsIfReady(pi: ExtensionAPI): string[] | undefined {
   try {
     return pi.getActiveTools?.();
   } catch (error) {
@@ -277,6 +290,11 @@ function getActiveToolsForStaleCleanup(pi: ExtensionAPI, staleNames: string[]):
   }
 }
 
+function getActiveToolsForStaleCleanup(pi: ExtensionAPI, staleNames: string[]): string[] | undefined {
+  if (staleNames.length === 0) return undefined;
+  return getActiveToolsIfReady(pi);
+}
+
 function deactivateStaleNamespaceTools(input: SyncNamespaceProxyToolsInput, nextNames: Set<string>): string[] {
   const activeDirectNames = input.activeDirectNames ?? new Set<string>();
   const staleNames = [...input.existingNamespaceNames].filter(
@@ -298,12 +316,14 @@ function deactivateStaleNamespaceTools(input: SyncNamespaceProxyToolsInput, next
   if (!activeTools) return deactivated;
 
   const stale = new Set(staleNames);
+  const fallbackRemoved = staleNames.filter((name) => !deactivated.includes(name) && activeTools.includes(name));
   const nextActiveTools = activeTools.filter((name) => !stale.has(name));
   if (nextActiveTools.length === activeTools.length) return deactivated;
 
   input.guardReentrant?.();
   input.pi.setActiveTools(nextActiveTools);
   input.guardReentrant?.();
+  for (const name of fallbackRemoved) input.fallbackDeactivatedNames?.add(name);
   for (const name of staleNames) {
     if (!deactivated.includes(name)) deactivated.push(name);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "types": "./index.ts",
@@ -20,6 +20,11 @@
       "import": "./oauth.ts",
       "default": "./oauth.ts"
     },
+    "./host-managed": {
+      "types": "./host-managed.ts",
+      "import": "./host-managed.ts",
+      "default": "./host-managed.ts"
+    },
     "./config": {
       "types": "./dist/config.d.ts",
       "import": "./dist/config.js",
@@ -86,6 +91,8 @@
     "ts-shape.ts",
     "search-ranking.ts",
     "tool-approval.ts",
+    "tool-parameters.ts",
+    "host-managed.ts",
     "session-approvals.ts",
     "project-server-trust.ts",
     "init.ts",

package/state.ts

@@ -3,7 +3,7 @@ import type { ConsentManager } from "./consent-manager.ts";
 import type { McpLifecycleManager } from "./lifecycle.ts";
 import type { McpServerManager } from "./server-manager.ts";
 import type { AuthStorageOptions } from "./mcp-auth.ts";
-import type { ServerDefinition, ToolMetadata, PromptMetadata, McpConfig, UiSessionMessages, UiStreamSummary, McpStatusEventBus, UiServerHandle, ProjectServerBlock } from "./types.ts";
+import type { ServerDefinition, ToolMetadata, PromptMetadata, ServerCacheEntry, McpConfig, UiSessionMessages, UiStreamSummary, McpStatusEventBus, UiServerHandle, ProjectServerBlock } from "./types.ts";
 import type { UiResourceHandler } from "./ui-resource-handler.ts";
 import type { McpRuntimeOwner } from "./runtime-owner.ts";
 import type { McpOAuthRuntime } from "./mcp-auth-flow.ts";
@@ -33,6 +33,7 @@ export interface McpExtensionState {
   manager: McpServerManager;
   lifecycle: McpLifecycleManager;
   toolMetadata: Map<string, ToolMetadata[]>;
+  sessionMetadata?: Map<string, ServerCacheEntry>;
   /** Number of tools currently registered directly with Pi, by server. */
   directToolCounts: Map<string, number>;
   /** Resource counts retained separately because tool metadata includes resource tools. */

package/tool-approval.ts

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { abortable } from "./abort.ts";
 import { combineAbortSignals } from "./runtime-owner.ts";
 import type { McpExtensionState } from "./state.ts";
@@ -88,15 +89,19 @@ function isMcpToolApprovalDecision(value: unknown): value is McpToolApprovalDeci
     || value === "abstain";
 }
 
-async function requestBrokerApproval(
-  state: McpExtensionState,
+/**
+ * Returns "abstain" when no handler claims the request. A handler that throws
+ * or returns an unknown value counts as "deny". Rethrows only when `signal` aborted.
+ */
+export async function requestBrokerApproval(
+  events: ExtensionAPI["events"] | undefined,
   serverName: string,
-  toolMeta: ToolMetadata,
+  toolMeta: Pick<ToolMetadata, "name" | "originalName">,
   args: Record<string, unknown> | undefined,
   origin: McpToolApprovalOrigin,
   signal?: AbortSignal,
 ): Promise<McpToolApprovalDecision> {
-  if (!state.approvalEvents) return "abstain";
+  if (!events) return "abstain";
 
   let acceptingClaim = true;
   let handler: McpToolApprovalHandler | undefined;
@@ -115,7 +120,7 @@ async function requestBrokerApproval(
     },
   };
 
-  state.approvalEvents.emit(MCP_TOOL_APPROVAL_REQUEST_EVENT, request);
+  events.emit(MCP_TOOL_APPROVAL_REQUEST_EVENT, request);
   acceptingClaim = false;
   if (!handler) return "abstain";
 
@@ -140,7 +145,7 @@ export async function ensureToolCallApproved(
   const ownedSignal = combineAbortSignals(state.owner?.signal, signal);
   const approvedServers = state.approvedServers ??= new Map();
   const serverIdentity = getServerApprovalIdentity(state, serverName);
-  const brokerDecision = await requestBrokerApproval(state, serverName, toolMeta, args, origin, signal);
+  const brokerDecision = await requestBrokerApproval(state.approvalEvents, serverName, toolMeta, args, origin, signal);
   if (brokerDecision === "allow_once") return { ok: true };
   if (brokerDecision === "allow_for_session") {
     rememberToolApproval(state, serverName, toolMeta, args);

package/tool-parameters.ts

@@ -0,0 +1,11 @@
+import { Type } from "typebox";
+
+// OMP remaps `typebox` to a host shim that historically lacked Type.Unsafe.
+// Prefer Unsafe when present (real TypeBox / fixed OMP shim); otherwise pass
+// the normalized JSON Schema through as a plain object so toolWireSchema and
+// validateToolArguments still treat it as JSON Schema.
+export function toToolParameters(schema: Record<string, unknown>): unknown {
+  return typeof (Type as { Unsafe?: (value: never) => unknown }).Unsafe === "function"
+    ? (Type as { Unsafe: (value: never) => unknown }).Unsafe(schema as never)
+    : schema;
+}