pi-mcp-client 0.8.0 → 0.8.1

package/README.md

@@ -41,7 +41,9 @@ permissions. Tool activation isn't a per-call approval prompt. See
 ## ⚙️ Configuration
 
 Store server definitions in `~/.pi/agent/mcp.json` or a trusted project's
-`.mcp.json`. Project definitions replace same-named global definitions in full.
+`.mcp.json`. Project servers load only after an explicit
+[trust decision](docs/behavior.md#project-trust). Project definitions replace
+same-named global definitions in full.
 You can edit these files or use `/mcp add` and `/mcp remove`. To reuse a
 Claude/Cursor JSON or Codex TOML file, run `/mcp import --scope global <path>` and
 review the selected connections before saving.

package/dist/index.js

@@ -1,4 +1,5 @@
 // src/index.ts
+import { existsSync } from "node:fs";
 import { join as join4 } from "node:path";
 import {
   BorderedLoader as BorderedLoader2,
@@ -2329,7 +2330,7 @@ async function inspectConfigScopes(agentDir, cwd, trusted) {
 async function updateServerConfig(agentDir, cwd, trusted, mutation, validate) {
   const scoped = mutation.action !== "toggle";
   if (scoped && mutation.scope === "project" && !trusted)
-    throw new ConfigMutationError("Project configuration requires a trusted project. Use global scope or trust the project first.");
+    throw new ConfigMutationError("Project configuration requires a trusted project. Use global scope, or run /trust to trust this folder first.");
   const paths = [join(agentDir, "mcp.json"), ...trusted ? [join(cwd, ".mcp.json")] : []];
   const targets = await Promise.all(paths.map(configTarget));
   if (scoped && targets.length === 2 && targets[0] === targets[1])
@@ -3973,16 +3974,16 @@ function importAction(name, scope, scopes) {
   if (scope === "project" && Object.hasOwn(scopes.global, name)) return "Override global definition";
   return `Add ${scope} definition`;
 }
-async function runImportCommand(input, ctx, agentDir, signal, assertCurrent, save) {
+async function runImportCommand(input, ctx, agentDir, projectTrusted, signal, assertCurrent, save) {
   if (!ctx.hasUI) throw new ConfigMutationError("Configuration imports require an interactive session (TUI or RPC).");
   const { scope, path } = parseImportCommand(input);
-  const trusted = ctx.isProjectTrusted();
+  const trusted = projectTrusted();
   if (scope === "project" && !trusted)
-    throw new ConfigMutationError("Project configuration requires a trusted project. Use global scope or trust the project first.");
+    throw new ConfigMutationError("Project configuration requires a trusted project. Use global scope, or run /trust to trust this folder first.");
   const guard = () => {
     signal.throwIfAborted();
     assertCurrent();
-    if (ctx.isProjectTrusted() !== trusted)
+    if (projectTrusted() !== trusted)
       throw new ConfigMutationError("Project trust changed during the preview. Run /mcp import again; nothing was saved.");
   };
   const select = async (title, choices) => {
@@ -5958,6 +5959,41 @@ function statusPanel(snapshot, theme) {
   };
 }
 
+// src/trust.ts
+import {
+  hasTrustRequiringProjectResources,
+  ProjectTrustStore,
+  SettingsManager
+} from "@earendil-works/pi-coding-agent";
+var CHOICES = /* @__PURE__ */ new Map([
+  ["Trust", { trusted: true, save: true }],
+  ["Trust (this session only)", { trusted: true, save: false }],
+  ["Do not trust", { trusted: false, save: true }],
+  ["Do not trust (this session only)", { trusted: false, save: false }]
+]);
+function projectTrustDecision(agentDir, cwd, piTrusted) {
+  if (!piTrusted) return false;
+  if (hasTrustRequiringProjectResources(cwd)) return true;
+  const saved = new ProjectTrustStore(agentDir).get(cwd);
+  if (saved !== null) return saved;
+  const policy = SettingsManager.create(cwd, agentDir, { projectTrusted: false }).getDefaultProjectTrust();
+  return policy === "ask" ? void 0 : policy === "always";
+}
+async function askProjectTrust(agentDir, cwd, select, signal) {
+  const answer = await select(
+    `Trust project folder?
+${cwd}
+
+Its .mcp.json defines MCP servers, which can run local commands with your permissions. Saved decisions use Pi's project trust and also apply to Pi project resources.`,
+    [...CHOICES.keys()],
+    { signal }
+  );
+  const choice = answer === void 0 ? void 0 : CHOICES.get(answer);
+  if (!choice || signal.aborted) return void 0;
+  if (choice.save) new ProjectTrustStore(agentDir).set(cwd, choice.trusted);
+  return choice.trusted;
+}
+
 // src/index.ts
 var CommandUsageError = class extends Error {
 };
@@ -5986,6 +6022,8 @@ function mcpClient(pi, options = {}) {
   let loginController;
   let promptController;
   let importController;
+  let trustController;
+  let sessionTrust;
   pi.registerEntryRenderer(
     STATUS_ENTRY,
     (entry, _options, theme) => statusPanel(entry.data ?? { servers: [], loaded: [] }, theme)
@@ -6053,6 +6091,35 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
       }
     });
   }
+  const trustDecision = (ctx) => projectTrustDecision(agentDir, ctx.cwd, ctx.isProjectTrusted()) ?? (sessionTrust?.cwd === ctx.cwd ? sessionTrust.trusted : void 0);
+  const projectTrusted = (ctx) => trustDecision(ctx) ?? false;
+  async function resolveProjectTrust(ctx) {
+    let trusted = trustDecision(ctx);
+    if (!existsSync(join4(ctx.cwd, ".mcp.json"))) return trusted ?? false;
+    let answered = false;
+    if (trusted === void 0 && ctx.hasUI) {
+      const controller = new AbortController();
+      trustController = controller;
+      try {
+        trusted = await askProjectTrust(
+          agentDir,
+          ctx.cwd,
+          ctx.ui.select.bind(ctx.ui),
+          AbortSignal.any([controller.signal, ...ctx.signal ? [ctx.signal] : []])
+        );
+      } finally {
+        if (trustController === controller) trustController = void 0;
+      }
+      if (controller.signal.aborted) return false;
+      if (trusted !== void 0) {
+        sessionTrust = { cwd: ctx.cwd, trusted };
+        answered = true;
+      }
+    }
+    if (!trusted && !answered && ctx.hasUI && ctx.isProjectTrusted())
+      ctx.ui.notify("Project .mcp.json ignored: this folder isn't trusted for MCP servers. Run /trust to save a decision, then /mcp reload.", "warning");
+    return trusted ?? false;
+  }
   const restore = (ctx) => {
     const tools = restoredTools(ctx.sessionManager.getBranch()).filter((tool) => {
       try {
@@ -6087,14 +6154,15 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
       }
     };
     ctx.signal?.throwIfAborted();
+    const trusted = mutation ? projectTrusted(ctx) : await resolveProjectTrust(ctx);
     const update = mutation && await updateServerConfig(
       agentDir,
       ctx.cwd,
-      ctx.isProjectTrusted(),
+      trusted,
       mutation,
       validate
     );
-    const nextConfig = update ? update.config : await loadConfig(agentDir, ctx.cwd, ctx.isProjectTrusted());
+    const nextConfig = update ? update.config : await loadConfig(agentDir, ctx.cwd, trusted);
     validate(nextConfig);
     const next = new McpRuntime(
       nextConfig,
@@ -6122,15 +6190,18 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
     return update?.scope;
   }
   pi.on("session_start", async (_event, ctx) => {
-    sessionGeneration++;
+    const generation = ++sessionGeneration;
     promptController?.abort();
     importController?.abort();
+    trustController?.abort();
     await runtime?.close();
     runtime = void 0;
     config = {};
     configError = void 0;
     try {
-      config = await loadConfig(agentDir, ctx.cwd, ctx.isProjectTrusted());
+      const trusted = await resolveProjectTrust(ctx);
+      if (generation !== sessionGeneration) return;
+      config = await loadConfig(agentDir, ctx.cwd, trusted);
       runtime = new McpRuntime(config, ctx.cwd, join4(agentDir, "cache", "pi-mcp-client"), createSdkConnector(storeFactory));
       resourceNotifications(runtime, ctx);
     } catch (error) {
@@ -6150,6 +6221,7 @@ Text output is limited to 2000 lines or 50 KiB; larger results are saved to a pr
     loginController?.abort();
     promptController?.abort();
     importController?.abort();
+    trustController?.abort();
     const old = runtime;
     runtime = void 0;
     await old?.close();
@@ -6419,6 +6491,7 @@ Variables: ${(candidate.variables ?? []).join(", ") || "none"}. Supply known val
               args,
               ctx,
               agentDir,
+              () => projectTrusted(ctx),
               AbortSignal.any([controller.signal, ...ctx.signal ? [ctx.signal] : []]),
               () => {
                 if (sessionGeneration !== generation || runtime !== activeRuntime)
@@ -6478,7 +6551,7 @@ ${snapshot.body}`,
           server = mutation.server;
           await reloadConfiguration(ctx, mutation);
           const remaining = Object.hasOwn(config, server);
-          const message = mutation.action === "add" ? `\u2714\uFE0E ${server}: saved in ${mutation.scope} configuration. Connections, authentication, and tool discovery remain on demand.` + (mutation.scope === "global" && ctx.isProjectTrusted() ? " Trusted project definitions take precedence over global definitions." : "") : `\u2714\uFE0E ${server}: removed from ${mutation.scope} configuration. Credentials were retained.` + (remaining ? " A definition from the other scope remains effective; connections reopen on demand." : " Its connection is closed and its tools are no longer active.");
+          const message = mutation.action === "add" ? `\u2714\uFE0E ${server}: saved in ${mutation.scope} configuration. Connections, authentication, and tool discovery remain on demand.` + (mutation.scope === "global" && projectTrusted(ctx) ? " Trusted project definitions take precedence over global definitions." : "") : `\u2714\uFE0E ${server}: removed from ${mutation.scope} configuration. Credentials were retained.` + (remaining ? " A definition from the other scope remains effective; connections reopen on demand." : " Its connection is closed and its tools are no longer active.");
           if (ctx.hasUI) ctx.ui.notify(message, "info");
           return;
         }

package/docs/behavior.md

@@ -125,7 +125,8 @@ see [large results](troubleshooting.md#large-results) for size limits.
 
 Only load configuration you trust. Server executables and secret commands run
 with your user permissions; trusted project configuration can replace global
-connections and settings.
+connections and settings. See [project trust](#project-trust) for when a
+project's `.mcp.json` loads.
 
 Configuration imports require an explicit file, scope, selection, and final
 confirmation. Import previews hide connection values; review the source file
@@ -148,3 +149,28 @@ Pi's tool restrictions to prevent discovery and resource operations. Already act
 native tools have their own tool restrictions. Per-resource permission policies
 aren't implemented. Prompt selection uses explicit user commands, not the
 model-facing tool allowlist; disable the server to prevent prompt access.
+
+## Project trust
+
+A project's `.mcp.json` can start local commands, so it loads only after an
+explicit trust decision for the folder. Pi asks for trust only in folders with Pi
+project resources, such as `.pi/settings.json` or `.agents/skills`, and trusts
+other folders implicitly. The extension doesn't rely on that implicit trust:
+
+- **Folders with Pi project resources:** Pi's decision applies, including
+  `--approve` and session-only trust.
+- **Other folders:** a saved decision for the folder or a parent folder applies.
+  Without one, Pi's `defaultProjectTrust` setting applies: `always` loads project
+  servers and `never` ignores them. With the default `ask`, interactive sessions
+  ask when a `.mcp.json` exists, and headless sessions ignore the file.
+- **Untrusted folders:** `--no-approve` or a refusal in Pi always ignores project
+  servers.
+
+Saved answers go to Pi's project trust store, so they also apply to Pi project
+resources. Use Pi's `/trust` command to save or change a decision, then run
+`/mcp reload`; MCP servers don't require a restart. In folders without Pi project
+resources, `--approve` doesn't trust `.mcp.json`; save a decision instead.
+
+Only session start and `/mcp reload` ask. Other configuration commands, such as
+`/mcp add` and `/mcp import`, use the current decision. Untrusted project files
+are neither read nor changed.

package/docs/commands.md

@@ -120,8 +120,9 @@ capabilities you need.
 Both commands require an explicit `--scope global` or `--scope project`:
 
 - **Global:** `~/.pi/agent/mcp.json`.
-- **Project:** `.mcp.json` in the current trusted project. Untrusted project files
-  are neither read nor changed.
+- **Project:** `.mcp.json` in the current
+  [trusted project](behavior.md#project-trust). Untrusted project files are
+  neither read nor changed.
 
 Add an HTTP server by URL, or a stdio server after `--`:
 
@@ -194,7 +195,8 @@ automatically; no conversion file is needed:
 ```
 
 The command requires an interactive TUI or RPC session and an explicit
-`--scope global` or `--scope project`. Project scope requires a trusted project.
+`--scope global` or `--scope project`. Project scope requires a
+[trusted project](behavior.md#project-trust).
 Relative source paths resolve against Pi's current directory; `~/` is supported.
 The path isn't evaluated by a shell, and no application settings are scanned.
 

package/docs/configuration.md

@@ -3,9 +3,10 @@
 [Back to the README](../README.md)
 
 You configure which servers the model can access. Add connections to
-`~/.pi/agent/mcp.json`, or `.mcp.json` in a trusted project. For command-based
-setup, see [Add and remove servers](commands.md#add-and-remove-servers). To reuse
-an existing Claude/Cursor JSON or Codex TOML file, see
+`~/.pi/agent/mcp.json`, or `.mcp.json` in a
+[trusted project](behavior.md#project-trust). For command-based setup, see
+[Add and remove servers](commands.md#add-and-remove-servers). To reuse an
+existing Claude/Cursor JSON or Codex TOML file, see
 [Import server definitions](commands.md#import-server-definitions).
 
 ## Files and transports
@@ -16,8 +17,10 @@ MCP configuration standard. Live configuration must use JSON, not VS Code's
 this format. `PI_CODING_AGENT_DIR` overrides the global Pi directory.
 Project definitions replace same-named global definitions in full; fields and
 filters aren't merged. Untrusted project definitions aren't loaded or edited.
-An explicitly named import source is read as data for review; saving into project
-scope still requires project trust.
+Project servers need an explicit trust decision even in folders that Pi trusts
+implicitly; see [project trust](behavior.md#project-trust). An explicitly named
+import source is read as data for review; saving into project scope still
+requires project trust.
 
 ```json
 {
@@ -44,13 +47,24 @@ scope still requires project trust.
 | `type` | Optional `stdio` or `http`. If omitted, inferred from `command` or `url`. A conflicting type is rejected. |
 | `command`, `args` | Executable and arguments for a stdio server. No shell is used. |
 | `cwd` | Working directory for stdio; defaults to Pi's current directory. Relative paths resolve there. |
-| `env` | Additional environment variables for stdio. |
+| `env` | Environment variables for stdio, in addition to a minimal inherited set. |
 | `url` | Streamable HTTP endpoint; mutually exclusive with `command`. |
 | `headers` | HTTP request headers, including optional bearer authentication. |
 
 Strings in `command`, `args`, `cwd`, `env`, `url`, and `headers` support `${VAR}`
 interpolation. Missing variables prevent that server from connecting.
 
+Stdio servers don't inherit Pi's environment. They receive only the MCP SDK's
+default set (`HOME`, `LOGNAME`, `PATH`, `SHELL`, `TERM`, and `USER` on Unix, and
+similar system variables on Windows) plus `env`. Pass other variables a server
+needs explicitly, for example a custom browser location:
+
+```json
+"env": {
+  "PLAYWRIGHT_BROWSERS_PATH": "${PLAYWRIGHT_BROWSERS_PATH}"
+}
+```
+
 Only stdio and Streamable HTTP are supported. The extension rejects `type: "sse"`
 and unsupported connection fields rather than silently changing their meaning.
 

package/docs/troubleshooting.md

@@ -69,6 +69,21 @@ remain visible as content, even when the tool reports an error; they aren't
 sanitized transport diagnostics. Tool-call failures aren't replayed automatically;
 verify the outcome before retrying.
 
+## Missing project servers
+
+A project's `.mcp.json` loads only after an explicit trust decision, even in
+folders that Pi otherwise trusts implicitly. Headless sessions ignore it when no
+decision exists. Run Pi's `/trust` command to save a decision, then run
+`/mcp reload`. See [project trust](behavior.md#project-trust).
+
+## Missing server dependencies
+
+If a stdio server reports a missing browser, SDK, credential, or configuration
+file that works in your shell, it probably reads an environment variable that
+it doesn't receive. Servers don't inherit Pi's environment; pass the variable
+through `env`, for example `PLAYWRIGHT_BROWSERS_PATH`. See
+[files and transports](configuration.md#files-and-transports).
+
 ## Large results
 
 Text output is limited to 2,000 lines or 50 KiB, including resource reads and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-client",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "MCP tools for Pi, discovered on demand and called natively through the official SDK.",
   "type": "module",
   "license": "MIT",