pi-mcp-extension 1.10.0 → 1.10.2

package/README.md

@@ -3,6 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/pi-mcp-extension.svg)](https://www.npmjs.com/package/pi-mcp-extension)
 [![license](https://img.shields.io/npm/l/pi-mcp-extension.svg)](https://github.com/irahardianto/pi-mcp-extension/blob/main/LICENSE)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/irahardianto/pi-mcp-extension/badge)](https://scorecard.dev/viewer/?uri=github.com/irahardianto/pi-mcp-extension)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15659/badge)](https://www.bestpractices.dev/projects/15659)
 
 **Connect [Pi](https://pi.dev) to any MCP server.** Supabase, DeepSource, Playwright, Context7, filesystem, databases — if it speaks [MCP](https://modelcontextprotocol.io), Pi can use it.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-extension",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "MCP (Model Context Protocol) client extension for the Pi coding agent — connect Pi to any MCP server",
   "type": "module",
   "keywords": [
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",

package/src/config.ts

@@ -16,6 +16,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { callbackServerConfigFromRedirectUrl } from "./callback-server.js";
 import { McpError } from "./errors.js";
+import { stripJsonComments } from "./jsonc.js";
 
 // ─── Zod Schemas ──────────────────────────────────────────────────────────────
 
@@ -227,80 +228,6 @@ export interface LoadConfigOptions {
 
 // ─── Loader ───────────────────────────────────────────────────────────────────
 
-/**
- * Strip `//` line comments and `/* ... *\/` block comments outside of double-quoted
- * JSON strings in a single character-by-character pass.
- *
- * Preserves `\n` and `\r` characters so line numbers in `JSON.parse` error messages
- * remain accurate. Unterminated `/*` block comments are left intact so `JSON.parse`
- * fails with a syntax error rather than silently truncating the document.
- */
-export function stripJsonComments(text: string): string {
-  let out = "";
-  let inString = false;
-  let i = 0;
-
-  while (i < text.length) {
-    const ch = text[i]!;
-
-    if (inString) {
-      if (ch === "\\") {
-        out += ch;
-        if (i + 1 < text.length) {
-          out += text[i + 1]!;
-          i += 2;
-        } else {
-          i += 1;
-        }
-        continue;
-      }
-      if (ch === '"') {
-        inString = false;
-      }
-      out += ch;
-      i += 1;
-      continue;
-    }
-
-    if (ch === '"') {
-      inString = true;
-      out += ch;
-      i += 1;
-      continue;
-    }
-
-    if (ch === "/" && text[i + 1] === "/") {
-      i += 2;
-      while (i < text.length && text[i] !== "\n") {
-        if (text[i] === "\r" && text[i + 1] === "\n") break;
-        i += 1;
-      }
-      continue;
-    }
-
-    if (ch === "/" && text[i + 1] === "*") {
-      const closeIdx = text.indexOf("*/", i + 2);
-      if (closeIdx === -1) {
-        // WHY: Leave unterminated block comments intact so JSON.parse fails with a
-        // SyntaxError rather than silently truncating the rest of the file.
-        out += text.slice(i);
-        break;
-      }
-      for (let j = i; j < closeIdx + 2; j += 1) {
-        const commentCh = text[j]!;
-        out += commentCh === "\n" || commentCh === "\r" ? commentCh : " ";
-      }
-      i = closeIdx + 2;
-      continue;
-    }
-
-    out += ch;
-    i += 1;
-  }
-
-  return out;
-}
-
 async function readJsonFile(path: string): Promise<unknown> {
   let text: string;
   try {

package/src/jsonc.ts

@@ -0,0 +1,95 @@
+/**
+ * Pure JSON-with-comments (JSONC) text utilities. This module has no `src/`
+ * dependencies of its own and is safe for `scripts/` and `tests/` to import: it
+ * does not load `zod`, the MCP error types, or the OAuth/callback modules, so
+ * non-runtime consumers stay free of runtime MCP imports.
+ *
+ * The only behaviour this module performs is `stripJsonComments` — a single-pass
+ * character scan that removes `//` line comments and `/* ... *\/` block comments
+ * while leaving the rest of the document byte-equivalent. Comments inside
+ * double-quoted strings are preserved verbatim, so a JSON value such as
+ * `"https://example.com/foo"` is never accidentally truncated. Trailing commas
+ * (the other common JSONC extension) are **not** handled here — none of the
+ * files this helper feeds today uses them, and an explicit `JSON.parse` failure
+ * on a misplaced comma is a more honest signal than silent acceptance.
+ */
+
+/**
+ * Strip `//` line comments and `/* ... *\/` block comments outside of double-quoted
+ * JSON strings in a single character-by-character pass.
+ *
+ * Preserves `\n` and `\r` characters so line numbers in `JSON.parse` error messages
+ * remain accurate. Unterminated `/*` block comments are left intact so `JSON.parse`
+ * fails with a syntax error rather than silently truncating the document.
+ *
+ * WHY: this module exists so `scripts/ruleset-audit.ts` and `tests/repo-policy.test.ts`
+ * can read `.github/rulesets/*.json` with the same JSONC tolerance the runtime uses
+ * for `mcp.json`. A future maintainer can add `// WHY: …` style comments to the
+ * ruleset files (mirroring the convention used throughout `src/`) without breaking the
+ * ruleset audit or policy tests.
+ */
+export function stripJsonComments(text: string): string {
+  let out = "";
+  let inString = false;
+  let i = 0;
+
+  while (i < text.length) {
+    const ch = text[i]!;
+
+    if (inString) {
+      if (ch === "\\") {
+        out += ch;
+        if (i + 1 < text.length) {
+          out += text[i + 1]!;
+          i += 2;
+        } else {
+          i += 1;
+        }
+        continue;
+      }
+      if (ch === '"') {
+        inString = false;
+      }
+      out += ch;
+      i += 1;
+      continue;
+    }
+
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      i += 1;
+      continue;
+    }
+
+    if (ch === "/" && text[i + 1] === "/") {
+      i += 2;
+      while (i < text.length && text[i] !== "\n") {
+        if (text[i] === "\r" && text[i + 1] === "\n") break;
+        i += 1;
+      }
+      continue;
+    }
+
+    if (ch === "/" && text[i + 1] === "*") {
+      const closeIdx = text.indexOf("*/", i + 2);
+      if (closeIdx === -1) {
+        // WHY: Leave unterminated block comments intact so JSON.parse fails with a
+        // SyntaxError rather than silently truncating the rest of the file.
+        out += text.slice(i);
+        break;
+      }
+      for (let j = i; j < closeIdx + 2; j += 1) {
+        const commentCh = text[j]!;
+        out += commentCh === "\n" || commentCh === "\r" ? commentCh : " ";
+      }
+      i = closeIdx + 2;
+      continue;
+    }
+
+    out += ch;
+    i += 1;
+  }
+
+  return out;
+}