pi-mcp-extension 1.7.0 → 1.7.2

package/README.md

@@ -63,7 +63,7 @@ Config files are loaded from two locations. **Project config overrides global co
 
 | Location | Scope |
 |---|---|
-| `~/.pi/agent/mcp.json` | Global — applies to all projects |
+| `~/.pi/agent/mcp.json` | Global — applies to all projects (honors `$PI_CODING_AGENT_DIR` when set: `<agent dir>/mcp.json`) |
 | `.pi/mcp.json` | Project — overrides global per-server |
 
 ### Full Example

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-extension",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "MCP (Model Context Protocol) client extension for the Pi coding agent — connect Pi to any MCP server",
   "type": "module",
   "keywords": [

package/src/callback-server.ts

@@ -193,7 +193,11 @@ export function callbackServerConfigFromRedirectUrl(redirectUrl?: string): Callb
     throw new Error(`Local OAuth redirect URL must use path ${CALLBACK_PATH}`);
   }
 
-  const preferredPort = Number(url.port || "80");
+  if (!url.port) {
+    throw new Error("Manual OAuth redirect URL must include an explicit port (e.g. http://127.0.0.1:19876/callback)");
+  }
+
+  const preferredPort = Number(url.port);
   if (preferredPort === 0) {
     throw new Error("Manual OAuth redirect URL must use a fixed non-zero port");
   }

package/src/config.ts

@@ -2,8 +2,9 @@
  * Configuration loading, validation, and merging for pi-mcp.
  *
  * Config file locations (Pi-native convention, highest priority first):
- *   1. <cwd>/.pi/mcp.json   — project-level config
- *   2. ~/.pi/agent/mcp.json — global config
+ *   1. <cwd>/.pi/mcp.json      — project-level config
+ *   2. <agent dir>/mcp.json    — global config; the agent dir is what Pi itself uses:
+ *      $PI_CODING_AGENT_DIR when set (Pi profiles / alternative agent dirs), else ~/.pi/agent
  *
  * Project servers/settings override global servers/settings per-key (shallow merge).
  * No deep merge, no env var interpolation — WYSIWYG config.
@@ -118,6 +119,25 @@ const McpConfigSchema = z.object({
   mcpServers: z.record(ServerConfigSchema).default({}),
 });
 
+/**
+ * Project-level file: `settings` keys are optional and carry NO defaults, so a project file
+ * only overrides what it actually states. (Parsing it with SettingsSchema filled in the
+ * defaults — e.g. toolPrefix "mcp" — and the merge then overwrote the global settings.)
+ */
+const ProjectSettingsSchema = z.object({
+  toolPrefix: z
+    .string()
+    .regex(/^[a-zA-Z0-9_]+$/, "toolPrefix must match [a-zA-Z0-9_]")
+    .optional(),
+  requestTimeoutMs: z.number().positive().optional(),
+  maxRetries: z.number().int().min(0).max(10).optional(),
+});
+const ProjectConfigSchema = z.object({
+  settings: ProjectSettingsSchema.default({}),
+  mcpServers: z.record(ServerConfigSchema).default({}),
+});
+type ProjectConfig = z.output<typeof ProjectConfigSchema>;
+
 // ─── Public Types ─────────────────────────────────────────────────────────────
 
 export type AuthConfig = z.output<typeof AuthConfigSchema>;
@@ -139,7 +159,15 @@ async function readJsonFile(path: string): Promise<unknown | null> {
 }
 
 function parseConfig(raw: unknown, sourcePath: string): McpConfig {
-  const result = McpConfigSchema.safeParse(raw);
+  return parseWith(McpConfigSchema, raw, sourcePath);
+}
+
+function parseWith<S extends z.ZodTypeAny>(
+  schema: S,
+  raw: unknown,
+  sourcePath: string,
+): z.output<S> {
+  const result = schema.safeParse(raw);
   if (!result.success) {
     const issues = result.error.issues
       .map((i) => `  ${i.path.join(".")}: ${i.message}`)
@@ -155,22 +183,41 @@ function parseConfig(raw: unknown, sourcePath: string): McpConfig {
 
 function mergeConfigs(
   globalCfg: McpConfig,
-  projectCfg: McpConfig,
+  projectCfg: ProjectConfig,
 ): McpConfig {
+  // Only the settings the project file states may override the global ones.
+  const stated = Object.fromEntries(
+    Object.entries(projectCfg.settings).filter(([, v]) => v !== undefined),
+  ) as Partial<Settings>;
   return {
     // Shallow spread: project settings override global settings per key
-    settings: { ...globalCfg.settings, ...projectCfg.settings },
+    settings: { ...globalCfg.settings, ...stated },
     // Per-server override: project server entry completely replaces global entry with same name
     mcpServers: { ...globalCfg.mcpServers, ...projectCfg.mcpServers },
   };
 }
 
 /**
- * Load and merge global (~/.pi/agent/mcp.json) and project (<cwd>/.pi/mcp.json) configs.
+ * Pi's agent directory, resolved the way Pi resolves it (`getAgentDir()` in
+ * @mariozechner/pi-coding-agent): $PI_CODING_AGENT_DIR when set (tilde expanded), else
+ * ~/.pi/agent. Pi profiles and alternative agent dirs only work through that variable.
+ */
+export function agentDir(env: NodeJS.ProcessEnv = process.env): string {
+  const fromEnv = env.PI_CODING_AGENT_DIR;
+  if (fromEnv && fromEnv.length > 0) {
+    if (fromEnv === "~") return homedir();
+    if (fromEnv.startsWith("~/")) return join(homedir(), fromEnv.slice(2));
+    return fromEnv;
+  }
+  return join(homedir(), ".pi", "agent");
+}
+
+/**
+ * Load and merge global (<agent dir>/mcp.json) and project (<cwd>/.pi/mcp.json) configs.
  * Project config takes precedence over global config.
  * Returns a fully validated, merged config.
  */
-export async function loadConfig(cwd: string, globalPath = join(homedir(), ".pi", "agent", "mcp.json")): Promise<McpConfig> {
+export async function loadConfig(cwd: string, globalPath = join(agentDir(), "mcp.json")): Promise<McpConfig> {
   const projectPath = join(cwd, ".pi", "mcp.json");
 
   const [globalRaw, projectRaw] = await Promise.all([
@@ -189,6 +236,6 @@ export async function loadConfig(cwd: string, globalPath = join(homedir(), ".pi"
 
   if (projectRaw === null) return globalCfg;
 
-  const projectCfg = parseConfig(projectRaw, projectPath);
+  const projectCfg = parseWith(ProjectConfigSchema, projectRaw, projectPath);
   return mergeConfigs(globalCfg, projectCfg);
 }

package/src/index.ts

@@ -418,9 +418,12 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           () => signal.aborted,
         );
 
-        // Set the state before auth() builds the authorization URL.
+        // Why set state before calling auth(): the SDK reads provider.state() while
+        // building the authorization URL inside auth(), and omits the state parameter
+        // if empty, which the callback server then rejects as a CSRF error.
         authProvider.setState(oauthState);
 
+        // 4. Discover protected-resource challenge metadata from the server.
         const authChallenge: ManualAuthChallenge = await discoverManualAuthChallenge(config.url, {
           headers: config.headers,
         }).catch((): ManualAuthChallenge => {
@@ -430,7 +433,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           return {};
         });
 
-        // Register the callback immediately before auth() can open the browser.
+        // 5. Register the callback immediately before auth() can open the browser.
         // Attach a catch handler so cancellation after immediate authorization
         // does not produce an unhandled rejection.
         const callbackPromise = waitForCallback(oauthState);
@@ -448,7 +451,11 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           authOptions.scope = authChallenge.scope;
         }
 
-        // Start the auth flow. REDIRECT means browser interaction is required.
+        // 6. Start the auth flow.
+        // Why branch on the return value: the SDK auth() call returns "AUTHORIZED" when
+        // stored or refreshed tokens already succeeded without opening a browser, or
+        // "REDIRECT" after invoking redirectToAuthorization(), in which case we must
+        // wait for the callback code and call auth() a second time with authorizationCode.
         const authResult = await auth(authProvider, authOptions);
         if (signal.aborted) throw new AuthCancelledError(serverName);
 
@@ -462,7 +469,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
             "info",
           );
 
-          // 6. Wait for the callback while giving the user an escape hatch.
+          // 7. Wait for the callback while giving the user an escape hatch.
           const code = await waitForOAuthCallback(
             serverName,
             callbackPromise,
@@ -483,7 +490,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
             `pi-mcp: Authorization callback received for ${serverName}. Exchanging token...`,
             "info",
           );
-          // 7. Complete the OAuth flow with the authorization code
+          // 8. Complete the OAuth flow with the authorization code
           const finishAuthOptions: {
             serverUrl: string;
             authorizationCode: string;

package/src/oauth-provider.ts

@@ -15,8 +15,8 @@ import type { OAuthClientProvider, OAuthDiscoveryState } from "@modelcontextprot
 import type { OAuthClientMetadata, OAuthClientInformationMixed, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { readFile, writeFile, mkdir, unlink, chmod, open, stat } from "node:fs/promises";
 import { join } from "node:path";
-import { homedir } from "node:os";
 import { createHash } from "node:crypto";
+import { agentDir } from "./config.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -84,7 +84,7 @@ interface StoredState {
 // ─── File helpers ─────────────────────────────────────────────────────────────
 
 function authDir(storageDir?: string): string {
-  return storageDir ?? join(homedir(), ".pi", "agent", "mcp-auth");
+  return storageDir ?? join(agentDir(), "mcp-auth");
 }
 
 function statePath(serverName: string, storageDir?: string): string {
@@ -405,7 +405,12 @@ export async function getAuthStatus(serverName: string, storageDir?: string): Pr
  * Used to force re-authorization on next connection.
  */
 export async function resetAuth(serverName: string, storageDir?: string): Promise<void> {
-  await unlink(statePath(serverName, storageDir)).catch(() => {});
+  try {
+    await unlink(statePath(serverName, storageDir));
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw err;
+  }
 }
 
 export class AuthRequiredError extends Error {

package/src/server-manager.ts

@@ -25,7 +25,16 @@ import {
 import { McpError } from "./errors.js";
 import type { McpConfig, ServerConfig, Settings } from "./config.js";
 import { McpOAuthProvider, AuthRequiredError, getAuthStatus, resetAuth } from "./oauth-provider.js";
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import { UnauthorizedError, type OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+
+export function isOAuthUnauthorizedError(error: unknown): boolean {
+  return (
+    error instanceof AuthRequiredError ||
+    error instanceof UnauthorizedError ||
+    (typeof (error as { code?: unknown })?.code === "number" && (error as { code: number }).code === 401) ||
+    /\b(401|Unauthorized)\b/i.test(error instanceof Error ? error.message : String(error))
+  );
+}
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -356,7 +365,7 @@ export class ServerManager {
     try {
       await client.connect(transport);
       if (signal.aborted) throw new Error("Connection cancelled");
-      if (server.config.transport === "stdio") server.childPid = (transport as any).process?.pid ?? null;
+      server.childPid = transport instanceof StdioClientTransport ? transport.pid : null;
       // Readiness includes tool discovery, not just the MCP handshake.
       if (this.onToolRefresh) await this.onToolRefresh(server.name, client);
       if (signal.aborted) throw new Error("Connection cancelled");
@@ -388,10 +397,16 @@ export class ServerManager {
       if (signal.aborted) throw new Error("Connection cancelled");
       const error = err instanceof Error ? err : new Error(String(err));
       server.lastError = error;
-      if (error instanceof AuthRequiredError || error instanceof McpError && error.code === "protocol") {
+      if (error instanceof AuthRequiredError || (error instanceof McpError && error.code === "protocol")) {
         server.state = "stopped";
         throw error;
       }
+      if (Boolean(server.config.auth) && server.config.transport !== "stdio" && isOAuthUnauthorizedError(error)) {
+        const authError = new AuthRequiredError(server.name);
+        server.lastError = authError;
+        server.state = "stopped";
+        throw authError;
+      }
       if (server.retryCount >= this.settings.maxRetries) {
         server.state = "stopped";
         throw new McpError(`Connection failed after ${server.retryCount} retries: ${error.message}`, server.name, "connection", err);