pi-mcp-adapter 5.3.1 → 5.3.2

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.3.2] - 2026-10-17
+
+### Highlights
+
+- The GitHub preset in `/mcp-adapter setup` now signs in with your GitHub CLI login, so connecting to GitHub works.
+- Saving direct tools in the MCP panel no longer brings back the "Allow project MCP server?" prompt for a server you already allowed.
+- The MCP panel shows a connected server's tools and your saved direct tools, even for servers like GitHub that don't let their tool list be cached.
+- MCP sampling uses your Pi thinking level, so servers that sample through a reasoning-only model stop failing.
+
+### Fixed
+
+- The GitHub preset in `/mcp-adapter setup` now signs in with your GitHub CLI login (`gh auth token`). Before, it used MCP OAuth, which GitHub doesn't offer to apps it hasn't registered, so `/mcp-auth github` always failed with "does not support dynamic client registration". Install `gh` and run `gh auth login` first. If you added the old preset, remove its `github` entry and add GitHub again from `/mcp-adapter setup`. Thanks to [@Milor123](https://github.com/Milor123) for [#841](https://github.com/nicobailon/pi-mcp-adapter/issues/841).
+- When one config file gives a server a different `url` than another file that set its headers or token, the adapter still leaves those credentials out so they aren't sent to the new address, but it now tells you at startup which server, which settings and which two files are involved. Before, the credentials disappeared silently and the server failed with sign-in errors. Thanks to [@Milor123](https://github.com/Milor123) for [#841](https://github.com/nicobailon/pi-mcp-adapter/issues/841).
+- The MCP panel now lists the tools of a server you already connected to in this session, with your saved direct tools checked, even when the server doesn't let its tool list be cached, as with GitHub. Before, such a server showed "(not cached)" with no tools every time you opened the panel, so direct tools you had saved looked lost. Thanks to [@Milor123](https://github.com/Milor123) for [#841](https://github.com/nicobailon/pi-mcp-adapter/issues/841).
+- Saving direct tools in the MCP panel for a project server you already allowed no longer makes Pi ask "Allow project MCP server?" again on the next start or `/reload`. Saving used to change the server's config in a way that cancelled your approval. A server you didn't allow still asks, and so does any other change to the server's config. Thanks to [@Milor123](https://github.com/Milor123) for [#841](https://github.com/nicobailon/pi-mcp-adapter/issues/841).
+- Approving a project MCP server now sticks when Pi is started from the same folder spelled with different capitalization, such as `C:\Users\Me` and `c:\users\me` on Windows. Before, each spelling counted as a separate project and asked "Allow project MCP server?" again. An approval saved under a differently capitalized spelling asks once more after this update. Thanks to [@Milor123](https://github.com/Milor123) for [#841](https://github.com/nicobailon/pi-mcp-adapter/issues/841).
+- MCP sampling requests now use your current Pi thinking level, so a server that samples through a model that requires reasoning no longer fails with "Reasoning is mandatory for this endpoint and cannot be disabled". Before, sampling always ran with thinking off. On Pi 0.84 and 0.85 sampling still runs with thinking off. Thanks to [@bardic](https://github.com/bardic) for [#846](https://github.com/nicobailon/pi-mcp-adapter/issues/846).
+
 ## [5.3.1] - 2026-10-15
 
 ### Highlights
@@ -136,6 +154,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `/mcp-adapter setup` adds Figma (desktop) to the global config instead of writing `.mcp.json` into whatever project you opened setup from.
 - `/mcp-adapter setup` warns when a server you add won't be used, because another config file already defines or disables it, or the current config mode doesn't read the file it was written to.
 - A bearer token or header value that isn't a valid HTTP header value, such as one containing a newline, no longer appears in connection errors. This covers `bearerToken` (including `!command` and `${VAR}` forms), `bearerTokenEnv`, and configured `headers`; the error now names the server and header instead.
+
 ## [4.0.0] - 2026-09-30
 
 ### Highlights

package/commands.ts

@@ -26,7 +26,7 @@ import {
 } from "./config.ts";
 import { markKeepAliveAfterConnect, notifyToolMetadataUpdated, updateMetadataCache, updateStatusBar, getFailureAgeSeconds, getFailureMessage, clearFailure, recordFailure } from "./init.ts";
 import { isServerInActiveFailureBackoff } from "./failure-backoff.ts";
-import { loadMetadataCache, reconstructPromptMetadata } from "./metadata-cache.ts";
+import { loadMetadataCache, reconstructPromptMetadata, withSessionMetadata } from "./metadata-cache.ts";
 import { buildToolMetadata } from "./tool-metadata.ts";
 import { supportsOAuth, authenticate, removeAuth, type McpOAuthRuntime } from "./mcp-auth-flow.ts";
 import { getAuthStorageOptions, inspectAuthForUrl } from "./mcp-auth.ts";
@@ -36,7 +36,7 @@ import { findPiSignInImports, importPiSignIn } from "./pi-signin-import.ts";
 import { formatTerminalError, openPath, providerSignInMessage, resolveServerUrl, sanitizeTerminalText } from "./utils.ts";
 import { isAbortError } from "./runtime-owner.ts";
 import { resolveJevCredential } from "./jev-key-store.ts";
-import { describeProjectServerBlock } from "./project-server-trust.ts";
+import { describeProjectServerBlock, keepProjectServerApprovals } from "./project-server-trust.ts";
 
 function terminalHyperlink(label: string, url: string): string {
   return `\u001B]8;;${sanitizeTerminalText(url)}\u001B\\${sanitizeTerminalText(label)}\u001B]8;;\u001B\\`;
@@ -792,7 +792,7 @@ export async function openMcpPanel(
   }
 
   const config = state.config;
-  const cache = loadMetadataCache();
+  const cache = withSessionMetadata(loadMetadataCache(), config, state.sessionMetadata);
   const configPath = pi.getFlag("mcp-config") as string | undefined ?? configOverridePath;
   const provenanceMap = getServerProvenance(configPath, ctx.cwd);
   const { lines: noticeLines, fingerprint } = buildSharedConfigNoticeLines(configPath, ctx.cwd);
@@ -838,9 +838,11 @@ export async function openMcpPanel(
               }
             }
             if (!result.cancelled && result.changes.size > 0) {
+              const before = loadMcpConfig(configPath, ctx.cwd);
               writeDirectToolsConfig(result.changes, provenanceMap, config, () => {
                 directToolsFileWritten = true;
               });
+              keepProjectServerApprovals(ctx, before, loadMcpConfig(configPath, ctx.cwd), result.changes.keys());
               directToolsSaved = true;
               await onDirectToolsConfigChanged?.(result.changes);
               ctx.ui.notify("Direct tools updated for this session.", "info");

package/config.ts

@@ -79,8 +79,10 @@ export const KNOWN_SERVER_PRESETS: readonly KnownServerPreset[] = [
   {
     id: "github",
     name: "GitHub",
-    summary: "Work with GitHub through your Copilot account.",
-    entry: { url: "https://api.githubcopilot.com/mcp", auth: "oauth", protocolVersion: "auto" },
+    summary: "Work with GitHub using your GitHub CLI sign-in. Needs `gh` installed and `gh auth login` done.",
+    // GitHub's OAuth server has no dynamic client registration, so MCP OAuth can't sign in;
+    // the GitHub CLI token works and is read at connect time, never written to config.
+    entry: { url: "https://api.githubcopilot.com/mcp/", auth: "bearer", bearerToken: "!gh auth token", protocolVersion: "auto" },
   },
   {
     id: "chrome-devtools",
@@ -269,7 +271,88 @@ function legacyMcpConfigHasContent(filePath: string): boolean {
 }
 
 export function getLegacyMcpMigrationNotices(cwd = process.cwd(), overridePath?: string): string[] {
-  return [...getPiMcpConfigNotices(cwd, overridePath), ...getOpenCodeImportNotices(cwd, overridePath)];
+  return [
+    ...getPiMcpConfigNotices(cwd, overridePath),
+    ...getOpenCodeImportNotices(cwd, overridePath),
+    ...getDroppedCredentialNotices(cwd, overridePath),
+  ];
+}
+
+/** server name -> credential field -> the file that supplied it. */
+type CredentialFiles = Map<string, Map<string, string>>;
+
+function credentialFiles(servers: Record<string, ServerEntry>, fileOf: (name: string, field: string) => string): CredentialFiles {
+  return new Map(Object.entries(servers).map(([name, definition]) => [
+    name,
+    new Map(CREDENTIAL_FIELDS.filter((field) => definition[field] !== undefined).map((field) => [field, fileOf(name, field)])),
+  ]));
+}
+
+/**
+ * Replays the server merges of loadMcpConfigWithSources with the file behind each credential field,
+ * and reports the fields mergeServerMaps drops because a later file points the server at another url.
+ */
+function getDroppedCredentialNotices(cwd: string, overridePath?: string): string[] {
+  const notices: string[] = [];
+  const merge = (
+    base: Record<string, ServerEntry>,
+    baseFiles: CredentialFiles,
+    next: Record<string, ServerEntry>,
+    nextFiles: CredentialFiles,
+    urlFile: (name: string) => string,
+  ): [Record<string, ServerEntry>, CredentialFiles] => {
+    const files: CredentialFiles = new Map(baseFiles);
+    for (const [name, definition] of Object.entries(next)) {
+      const existing = base[name];
+      const fieldFiles = new Map(files.get(name));
+      const byFile = new Map<string, string[]>();
+      for (const field of existing ? droppedUrlBoundAuth(existing, definition) : []) {
+        const from = fieldFiles.get(field);
+        if (from !== undefined) byFile.set(from, [...byFile.get(from) ?? [], field]);
+        fieldFiles.delete(field);
+      }
+      for (const [from, fields] of byFile) {
+        notices.push(`"${name}": ignoring ${fields.join(", ")} from ${from}, because ${urlFile(name)} sets a different url for this server. Use one url, or set ${fields.length === 1 ? "it" : "them"} next to that url.`);
+      }
+      for (const [field, path] of nextFiles.get(name) ?? []) fieldFiles.set(field, path);
+      files.set(name, fieldFiles);
+    }
+    return [mergeServerMaps(base, next), files];
+  };
+
+  const host = !isExclusiveConfigMode() && getConfiguredHostConfigDiscovery(overridePath, cwd) === "on"
+    ? loadDiscoveredHostConfigs(cwd)
+    : { config: { mcpServers: {} }, serverSources: new Map<string, ImportedServerSource>() };
+  const hostFile = (name: string) => host.serverSources.get(name)?.path ?? "a host config";
+  let servers = host.config.mcpServers;
+  let files = credentialFiles(servers, hostFile);
+  const sourceSpecs = getConfigSources(overridePath, cwd);
+  const piProjectSource = sourceSpecs.find((source) => source.id === "pi-mcp-project");
+  const piProjectNames = Object.keys((piProjectSource && readPiMcpConfig(piProjectSource.readPath))?.mcpServers ?? {});
+  for (const source of sourceSpecs) {
+    const loaded = readSourceConfig(source.id, source.readPath);
+    if (!loaded) continue;
+    if (source.id === "pi-mcp-global") {
+      for (const name of piProjectNames) delete loaded.mcpServers[name];
+    }
+    // The same two merges as expandImports and mergeConfigs: the file's own entries over its imports,
+    // then the file over the files before it.
+    const imported = expandImports({ ...loaded, mcpServers: {} }, cwd);
+    // An OpenCode project entry can inherit a credential from the global file, so name the file per key.
+    const importFile = (name: string, field: string) =>
+      imported.keySources?.get(name)?.get(field) ?? imported.serverSources.get(name)?.path ?? source.readPath;
+    const ownFile = () => source.readPath;
+    const [fileServers, fileFiles] = merge(
+      imported.config.mcpServers,
+      credentialFiles(imported.config.mcpServers, importFile),
+      loaded.mcpServers,
+      credentialFiles(loaded.mcpServers, ownFile),
+      ownFile,
+    );
+    const urlFile = (name: string) => typeof loaded.mcpServers[name]?.url === "string" ? source.readPath : importFile(name, "url");
+    [servers, files] = merge(servers, files, fileServers, fileFiles, urlFile);
+  }
+  return notices;
 }
 
 function getPiMcpConfigNotices(cwd: string, overridePath?: string): string[] {
@@ -476,6 +559,8 @@ interface ImportedServerSource {
 interface LoadedHostConfig {
   config: McpConfig;
   serverSources: Map<string, ImportedServerSource>;
+  /** OpenCode imports only: the file that last set each key of each server. */
+  keySources?: Map<string, Map<string, string>>;
 }
 
 export const MCP_CONFIG_SOURCE_METADATA = Symbol.for("pi-mcp-adapter/config-source-metadata");
@@ -939,6 +1024,18 @@ function mergeConfigs(base: McpConfig, next: McpConfig): McpConfig {
 // otherwise the original endpoint's credentials would be shipped to the new
 // url. See the SECURITY note in mergeServerMaps.
 const URL_BOUND_AUTH_FIELDS = ["headers", "bearerToken", "bearerTokenEnv", "bearerTokenStore", "requestHeadersCommand", "caFile"] as const;
+const CREDENTIAL_FIELDS = [...URL_BOUND_AUTH_FIELDS, "auth", "oauth"] as const;
+
+/** The credential fields of `existing` that mergeServerMaps drops for `definition`'s different url. */
+function droppedUrlBoundAuth(existing: ServerEntry, definition: ServerEntry): (typeof CREDENTIAL_FIELDS)[number][] {
+  if (typeof definition.url !== "string" || definition.url === existing.url) return [];
+  return CREDENTIAL_FIELDS.filter((field) => {
+    if (Object.hasOwn(definition, field)) return false;
+    if (field === "auth") return typeof existing.auth === "object";
+    if (field === "oauth") return existing.oauth !== undefined && existing.oauth !== false;
+    return existing[field] !== undefined;
+  });
+}
 
 function mergeServerMaps(
   base: Record<string, ServerEntry>,
@@ -985,14 +1082,11 @@ function mergeServerMaps(
     }
     if (existing && typeof definition.url === "string" && definition.url !== existing.url) {
       if (baseEntry === existing) baseEntry = { ...existing };
-      for (const field of URL_BOUND_AUTH_FIELDS) {
+      // Provider tokens (object `auth`) and OAuth config are bound to the url too; the startup
+      // notice reports exactly these fields, so both read the one rule.
+      for (const field of droppedUrlBoundAuth(existing, definition)) {
         delete baseEntry[field];
       }
-      // A provider token is bound to the url that asked for it, like the fields above.
-      if (typeof baseEntry.auth === "object") delete baseEntry.auth;
-      if (baseEntry.oauth !== false) {
-        delete baseEntry.oauth;
-      }
     }
     if (existing && Object.hasOwn(definition, "env") && isBuiltInAgentPlugin(existing, "env") && !Object.hasOwn(definition, "literalEnv")) {
       if (baseEntry === existing) baseEntry = { ...existing };
@@ -1014,6 +1108,7 @@ function expandImports(config: McpConfig, cwd = process.cwd()): LoadedHostConfig
 
   const importedServers: Record<string, ServerEntry> = {};
   const serverSources = new Map<string, ImportedServerSource>();
+  const keySources = new Map<string, Map<string, string>>();
   for (const importKind of config.imports) {
     const imported = loadImportedConfig(importKind, cwd, `Failed to import MCP config from ${importKind}:`);
     if (!imported) continue;
@@ -1023,6 +1118,8 @@ function expandImports(config: McpConfig, cwd = process.cwd()): LoadedHostConfig
       if (!importedServers[name]) {
         importedServers[name] = definition;
         serverSources.set(name, imported.serverSources.get(name) ?? imported.source);
+        const keys = imported.keySources?.get(name);
+        if (keys) keySources.set(name, keys);
       }
     }
   }
@@ -1035,6 +1132,7 @@ function expandImports(config: McpConfig, cwd = process.cwd()): LoadedHostConfig
       mcpServers: mergeServerMaps(importedServers, config.mcpServers),
     },
     serverSources,
+    keySources,
   };
 }
 

package/dist/config.js

@@ -68,8 +68,10 @@ export const KNOWN_SERVER_PRESETS = [
     {
         id: "github",
         name: "GitHub",
-        summary: "Work with GitHub through your Copilot account.",
-        entry: { url: "https://api.githubcopilot.com/mcp", auth: "oauth", protocolVersion: "auto" },
+        summary: "Work with GitHub using your GitHub CLI sign-in. Needs `gh` installed and `gh auth login` done.",
+        // GitHub's OAuth server has no dynamic client registration, so MCP OAuth can't sign in;
+        // the GitHub CLI token works and is read at connect time, never written to config.
+        entry: { url: "https://api.githubcopilot.com/mcp/", auth: "bearer", bearerToken: "!gh auth token", protocolVersion: "auto" },
     },
     {
         id: "chrome-devtools",
@@ -162,7 +164,73 @@ function legacyMcpConfigHasContent(filePath) {
     }
 }
 export function getLegacyMcpMigrationNotices(cwd = process.cwd(), overridePath) {
-    return [...getPiMcpConfigNotices(cwd, overridePath), ...getOpenCodeImportNotices(cwd, overridePath)];
+    return [
+        ...getPiMcpConfigNotices(cwd, overridePath),
+        ...getOpenCodeImportNotices(cwd, overridePath),
+        ...getDroppedCredentialNotices(cwd, overridePath),
+    ];
+}
+function credentialFiles(servers, fileOf) {
+    return new Map(Object.entries(servers).map(([name, definition]) => [
+        name,
+        new Map(CREDENTIAL_FIELDS.filter((field) => definition[field] !== undefined).map((field) => [field, fileOf(name, field)])),
+    ]));
+}
+/**
+ * Replays the server merges of loadMcpConfigWithSources with the file behind each credential field,
+ * and reports the fields mergeServerMaps drops because a later file points the server at another url.
+ */
+function getDroppedCredentialNotices(cwd, overridePath) {
+    const notices = [];
+    const merge = (base, baseFiles, next, nextFiles, urlFile) => {
+        const files = new Map(baseFiles);
+        for (const [name, definition] of Object.entries(next)) {
+            const existing = base[name];
+            const fieldFiles = new Map(files.get(name));
+            const byFile = new Map();
+            for (const field of existing ? droppedUrlBoundAuth(existing, definition) : []) {
+                const from = fieldFiles.get(field);
+                if (from !== undefined)
+                    byFile.set(from, [...byFile.get(from) ?? [], field]);
+                fieldFiles.delete(field);
+            }
+            for (const [from, fields] of byFile) {
+                notices.push(`"${name}": ignoring ${fields.join(", ")} from ${from}, because ${urlFile(name)} sets a different url for this server. Use one url, or set ${fields.length === 1 ? "it" : "them"} next to that url.`);
+            }
+            for (const [field, path] of nextFiles.get(name) ?? [])
+                fieldFiles.set(field, path);
+            files.set(name, fieldFiles);
+        }
+        return [mergeServerMaps(base, next), files];
+    };
+    const host = !isExclusiveConfigMode() && getConfiguredHostConfigDiscovery(overridePath, cwd) === "on"
+        ? loadDiscoveredHostConfigs(cwd)
+        : { config: { mcpServers: {} }, serverSources: new Map() };
+    const hostFile = (name) => host.serverSources.get(name)?.path ?? "a host config";
+    let servers = host.config.mcpServers;
+    let files = credentialFiles(servers, hostFile);
+    const sourceSpecs = getConfigSources(overridePath, cwd);
+    const piProjectSource = sourceSpecs.find((source) => source.id === "pi-mcp-project");
+    const piProjectNames = Object.keys((piProjectSource && readPiMcpConfig(piProjectSource.readPath))?.mcpServers ?? {});
+    for (const source of sourceSpecs) {
+        const loaded = readSourceConfig(source.id, source.readPath);
+        if (!loaded)
+            continue;
+        if (source.id === "pi-mcp-global") {
+            for (const name of piProjectNames)
+                delete loaded.mcpServers[name];
+        }
+        // The same two merges as expandImports and mergeConfigs: the file's own entries over its imports,
+        // then the file over the files before it.
+        const imported = expandImports({ ...loaded, mcpServers: {} }, cwd);
+        // An OpenCode project entry can inherit a credential from the global file, so name the file per key.
+        const importFile = (name, field) => imported.keySources?.get(name)?.get(field) ?? imported.serverSources.get(name)?.path ?? source.readPath;
+        const ownFile = () => source.readPath;
+        const [fileServers, fileFiles] = merge(imported.config.mcpServers, credentialFiles(imported.config.mcpServers, importFile), loaded.mcpServers, credentialFiles(loaded.mcpServers, ownFile), ownFile);
+        const urlFile = (name) => typeof loaded.mcpServers[name]?.url === "string" ? source.readPath : importFile(name, "url");
+        [servers, files] = merge(servers, files, fileServers, fileFiles, urlFile);
+    }
+    return notices;
 }
 function getPiMcpConfigNotices(cwd, overridePath) {
     if (piMcpConfigEnabled) {
@@ -779,6 +847,21 @@ function mergeConfigs(base, next) {
 // otherwise the original endpoint's credentials would be shipped to the new
 // url. See the SECURITY note in mergeServerMaps.
 const URL_BOUND_AUTH_FIELDS = ["headers", "bearerToken", "bearerTokenEnv", "bearerTokenStore", "requestHeadersCommand", "caFile"];
+const CREDENTIAL_FIELDS = [...URL_BOUND_AUTH_FIELDS, "auth", "oauth"];
+/** The credential fields of `existing` that mergeServerMaps drops for `definition`'s different url. */
+function droppedUrlBoundAuth(existing, definition) {
+    if (typeof definition.url !== "string" || definition.url === existing.url)
+        return [];
+    return CREDENTIAL_FIELDS.filter((field) => {
+        if (Object.hasOwn(definition, field))
+            return false;
+        if (field === "auth")
+            return typeof existing.auth === "object";
+        if (field === "oauth")
+            return existing.oauth !== undefined && existing.oauth !== false;
+        return existing[field] !== undefined;
+    });
+}
 function mergeServerMaps(base, next) {
     const merged = { ...base };
     for (const [name, definition] of Object.entries(next)) {
@@ -824,15 +907,11 @@ function mergeServerMaps(base, next) {
         if (existing && typeof definition.url === "string" && definition.url !== existing.url) {
             if (baseEntry === existing)
                 baseEntry = { ...existing };
-            for (const field of URL_BOUND_AUTH_FIELDS) {
+            // Provider tokens (object `auth`) and OAuth config are bound to the url too; the startup
+            // notice reports exactly these fields, so both read the one rule.
+            for (const field of droppedUrlBoundAuth(existing, definition)) {
                 delete baseEntry[field];
             }
-            // A provider token is bound to the url that asked for it, like the fields above.
-            if (typeof baseEntry.auth === "object")
-                delete baseEntry.auth;
-            if (baseEntry.oauth !== false) {
-                delete baseEntry.oauth;
-            }
         }
         if (existing && Object.hasOwn(definition, "env") && isBuiltInAgentPlugin(existing, "env") && !Object.hasOwn(definition, "literalEnv")) {
             if (baseEntry === existing)
@@ -854,6 +933,7 @@ function expandImports(config, cwd = process.cwd()) {
         return { config, serverSources: new Map() };
     const importedServers = {};
     const serverSources = new Map();
+    const keySources = new Map();
     for (const importKind of config.imports) {
         const imported = loadImportedConfig(importKind, cwd, `Failed to import MCP config from ${importKind}:`);
         if (!imported)
@@ -863,6 +943,9 @@ function expandImports(config, cwd = process.cwd()) {
             if (!importedServers[name]) {
                 importedServers[name] = definition;
                 serverSources.set(name, imported.serverSources.get(name) ?? imported.source);
+                const keys = imported.keySources?.get(name);
+                if (keys)
+                    keySources.set(name, keys);
             }
         }
     }
@@ -874,6 +957,7 @@ function expandImports(config, cwd = process.cwd()) {
             mcpServers: mergeServerMaps(importedServers, config.mcpServers),
         },
         serverSources,
+        keySources,
     };
 }
 function resolveImportCandidates(importKind, cwd) {