pi-mcp-extension 1.9.8 → 1.9.9

package/README.md

@@ -2,6 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/pi-mcp-extension.svg)](https://www.npmjs.com/package/pi-mcp-extension)
 [![license](https://img.shields.io/npm/l/pi-mcp-extension.svg)](https://github.com/irahardianto/pi-mcp-extension/blob/main/LICENSE)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/irahardianto/pi-mcp-extension/badge)](https://scorecard.dev/viewer/?uri=github.com/irahardianto/pi-mcp-extension)
 
 **Connect [Pi](https://pi.dev) to any MCP server.** Supabase, DeepSource, Playwright, Context7, filesystem, databases — if it speaks [MCP](https://modelcontextprotocol.io), Pi can use it.
 
@@ -289,6 +290,10 @@ The test suite includes:
 - **Tool bridge & management tools** — JSON Schema → TypeBox conversion, name sanitization, image content passthrough, `isError` filtering, activate/deactivate, `mcp_status` / `mcp_connect`, and slash command completions
 - **End-to-end integration** — Real mock MCP and OAuth servers over stdio and HTTP with tool discovery and execution
 
+## Security
+
+Please report vulnerabilities privately, not in public issues. See [SECURITY.md](https://github.com/irahardianto/pi-mcp-extension/blob/main/SECURITY.md) for scope, supported versions, and how to report.
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-extension",
-  "version": "1.9.8",
+  "version": "1.9.9",
   "description": "MCP (Model Context Protocol) client extension for the Pi coding agent — connect Pi to any MCP server",
   "type": "module",
   "keywords": [
@@ -43,7 +43,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^22.0.0",
+    "@types/node": "^26.6.5",
     "eslint": "^10.13.0",
     "tsx": "^4.19.4",
     "typescript": "^5.7.0",

package/src/config.ts

@@ -64,7 +64,7 @@ const AuthConfigSchema = z.preprocess(
           callbackServerConfigFromRedirectUrl(auth.redirectUrl);
         } catch (err) {
           ctx.addIssue({
-            code: z.ZodIssueCode.custom,
+            code: "custom",
             path: ["redirectUrl"],
             message: err instanceof Error ? err.message : String(err),
           });
@@ -104,7 +104,7 @@ export const ServerConfigSchema = z.preprocess(
        * These merge with process.env; project env overrides parent env.
        * No ${VAR} interpolation — set vars in your shell environment instead.
        */
-      env: z.record(z.string()).optional(),
+      env: z.record(z.string(), z.string()).optional(),
       /** Transport protocol. Default: "stdio" (or "streamable-http" when "url" is provided). */
       transport: z.enum(["stdio", "streamable-http", "sse"]).default("stdio"),
       /**
@@ -117,7 +117,7 @@ export const ServerConfigSchema = z.preprocess(
        * Useful for API-key-based auth (e.g. { "Authorization": "Bearer <key>" }).
        * For OAuth2, use the "auth" field instead.
        */
-      headers: z.record(z.string()).optional(),
+      headers: z.record(z.string(), z.string()).optional(),
       /**
        * OAuth2 configuration for servers that require authorization.
        * When set, the transport will use the SDK's OAuth flow (discovery,
@@ -139,27 +139,36 @@ export const ServerConfigSchema = z.preprocess(
        */
       healthCheckIntervalMs: z.number().positive().optional(),
     })
-    .refine(
-      (cfg) => {
-        if (cfg.transport === "stdio") return cfg.command !== undefined;
-        return cfg.url !== undefined;
-      },
-      (cfg) => ({
-        message:
-          cfg.transport === "stdio"
-            ? `"command" is required for stdio transport`
-            : `"url" is required for ${cfg.transport} transport`,
-      }),
-    )
-    .refine(
-      (cfg) => !(cfg.transport === "stdio" && cfg.auth !== undefined),
-      {
-        message: "OAuth authentication is only supported for 'sse' and 'streamable-http' transports, not 'stdio'",
-        path: ["auth"],
-      },
-    ),
+    .superRefine((cfg, ctx) => {
+      if (cfg.transport === "stdio") {
+        if (cfg.command === undefined) {
+          ctx.addIssue({
+            code: "custom",
+            message: '"command" is required for stdio transport',
+          });
+        }
+        if (cfg.auth !== undefined) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["auth"],
+            message: "OAuth authentication is only supported for 'sse' and 'streamable-http' transports, not 'stdio'",
+          });
+        }
+      } else if (cfg.url === undefined) {
+        ctx.addIssue({
+          code: "custom",
+          message: `"url" is required for ${cfg.transport} transport`,
+        });
+      }
+    }),
 );
 
+const DEFAULT_SETTINGS = {
+  toolPrefix: "mcp",
+  requestTimeoutMs: 30000,
+  maxRetries: 5,
+} as const;
+
 const SettingsSchema = z.object({
   /**
    * Prefix used in Pi tool names: <prefix>_<server>_<tool>.
@@ -168,16 +177,16 @@ const SettingsSchema = z.object({
   toolPrefix: z
     .string()
     .regex(/^[a-zA-Z][a-zA-Z0-9_]*$/, "toolPrefix must start with a letter and contain only alphanumeric characters and underscores")
-    .default("mcp"),
+    .default(DEFAULT_SETTINGS.toolPrefix),
   /** Default per-request timeout in ms for all servers. Default: 30000. */
-  requestTimeoutMs: z.number().positive().default(30000),
+  requestTimeoutMs: z.number().positive().default(DEFAULT_SETTINGS.requestTimeoutMs),
   /** Maximum retry attempts when a server fails to connect. Default: 5. */
-  maxRetries: z.number().int().min(0).max(10).default(5),
+  maxRetries: z.number().int().min(0).max(10).default(DEFAULT_SETTINGS.maxRetries),
 });
 
 const McpConfigSchema = z.object({
-  settings: SettingsSchema.default({}),
-  mcpServers: z.record(ServerConfigSchema).default({}),
+  settings: SettingsSchema.default(() => ({ ...DEFAULT_SETTINGS })),
+  mcpServers: z.record(z.string(), ServerConfigSchema).default({}),
 });
 
 /**
@@ -195,7 +204,7 @@ const ProjectSettingsSchema = z.object({
 });
 const ProjectConfigSchema = z.object({
   settings: ProjectSettingsSchema.default({}),
-  mcpServers: z.record(ServerConfigSchema).default({}),
+  mcpServers: z.record(z.string(), ServerConfigSchema).default({}),
 });
 type ProjectConfig = z.output<typeof ProjectConfigSchema>;
 

package/src/index.ts

@@ -16,6 +16,7 @@ import type {
 } from "@earendil-works/pi-coding-agent";
 import { loadConfig, parseRegisteredServerConfig, type McpConfig, type ServerConfig } from "./config.js";
 import { ServerManager } from "./server-manager.js";
+import { sanitizeTerminalText } from "./terminal-text.js";
 import { AuthLockError, AuthRequiredError } from "./oauth-provider.js";
 import * as Type from "typebox";
 import { ToolBridge } from "./tool-bridge.js";
@@ -65,7 +66,7 @@ function openBrowser(url: string): Promise<void> {
     });
 
     child.once("error", (err) => {
-      console.error(`[pi-mcp] Failed to open browser: ${err.message}`);
+      console.error(`[pi-mcp] Failed to open browser: ${sanitizeTerminalText(err.message)}`);
       reject(err);
     });
 
@@ -86,7 +87,7 @@ export const startupAuthLaterOption = "Not now";
 
 function formatErrorMessage(err: unknown): string {
   const msg = err instanceof McpError ? err.userMessage : err instanceof Error ? err.message : String(err);
-  return msg.replace(/^AuthRequiredError:\s*/, "");
+  return sanitizeTerminalText(msg.replace(/^AuthRequiredError:\s*/, ""));
 }
 
 interface OAuthCallbackResult {
@@ -220,7 +221,7 @@ export async function waitForOAuthCallback(
         });
       } catch (err) {
         if (err instanceof CallbackUrlValidationError) {
-          context.ui.notify?.(`pi-mcp: Invalid redirect URL — ${err.message}`, "error");
+          context.ui.notify?.(`pi-mcp: Invalid redirect URL — ${sanitizeTerminalText(err.message)}`, "error");
           continue;
         }
         throw err;
@@ -346,7 +347,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
   } catch (err) {
     // Can't notify yet (no ctx), so log to stderr. The session_start handler
     // will re-try with the real cwd and surface errors properly.
-    console.error(`[pi-mcp] Config error: ${err instanceof McpError ? err.message : String(err)}`);
+    console.error(`[pi-mcp] Config error: ${sanitizeTerminalText(err instanceof McpError ? err.message : String(err))}`);
   }
 
   const getRegisteredEntries = (): RegisteredMcpServer[] =>
@@ -357,7 +358,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
   let extensionServers = collectRegisteredServers(
     getRegisteredEntries(),
     fileConfig.mcpServers,
-    (err) => console.error(`[pi-mcp] Config error: ${err instanceof McpError ? err.message : String(err)}`),
+    (err) => console.error(`[pi-mcp] Config error: ${sanitizeTerminalText(err instanceof McpError ? err.message : String(err))}`),
   );
   let config: McpConfig = mergeWithRegisteredServers(fileConfig, extensionServers);
 
@@ -808,7 +809,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           `Server: ${serverName}`,
           `State:  ${server.state}`,
           `Retries: ${server.retryCount}`,
-          server.lastError ? `Last error: ${server.lastError.message}` : null,
+          server.lastError ? `Last error: ${sanitizeTerminalText(server.lastError.message)}` : null,
           "",
           "Recent output:",
           logs,
@@ -867,7 +868,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
         ctx.ui.notify(`pi-mcp: Started ${serverName}`, "info");
       } catch (err) {
         if (err instanceof AuthCancelledError) {
-          ctx.ui.notify(`pi-mcp: ${err.message}`, "info");
+          ctx.ui.notify(`pi-mcp: ${sanitizeTerminalText(err.message)}`, "info");
           return;
         }
         const msg = formatErrorMessage(err);
@@ -950,7 +951,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
             );
           } catch (err) {
             ctx.ui.notify(
-              `pi-mcp: Failed to open browser for ${serverName} (${err instanceof Error ? err.message : String(err)}). Open ${url.toString()} manually or choose "${authPasteOption}".`,
+              `pi-mcp: Failed to open browser for ${serverName} (${sanitizeTerminalText(err instanceof Error ? err.message : String(err))}). Open ${url.toString()} manually or choose "${authPasteOption}".`,
               "error",
             );
           }
@@ -977,7 +978,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
             await authProvider.invalidateCredentials("tokens");
           } catch (err) {
             if (err instanceof McpError && err.code === "config" && /Corrupt OAuth state file/i.test(err.message)) {
-              console.error(`[pi-mcp] ${err.message}`);
+              console.error(`[pi-mcp] ${sanitizeTerminalText(err.message)}`);
             } else {
               throw err;
             }
@@ -1044,7 +1045,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           if (err instanceof McpError && err.code === "config" && /Corrupt OAuth state file/i.test(err.message)) {
             // WHY: McpOAuthProvider._loadState() backed up and removed the corrupt state file.
             // Retry auth() once so interactive authorization proceeds cleanly.
-            console.error(`[pi-mcp] ${err.message}`);
+            console.error(`[pi-mcp] ${sanitizeTerminalText(err.message)}`);
             authResult = await auth(authProvider, authOptions);
           } else {
             throw err;
@@ -1292,7 +1293,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
           } catch (err) {
             // WHY: Never let a single server's corrupt state file abort mcp_status for all servers.
             // getAuthStatus() already backed up and deleted the corrupt file before throwing.
-            console.error(`[pi-mcp] ${err instanceof Error ? err.message : String(err)}`);
+            console.error(`[pi-mcp] ${sanitizeTerminalText(err instanceof Error ? err.message : String(err))}`);
             authCorrupt = true;
           }
         }
@@ -1364,7 +1365,7 @@ export default async function (pi: ExtensionAPI, paths: { bootstrapCwd?: string;
       }
       try { await connectRequested(name, ctx, undefined, reset); ctx.ui.notify(`pi-mcp: ${name} ready`, "info"); }
       catch (err) {
-        ctx.ui.notify(`pi-mcp: ${err instanceof Error ? err.message : String(err)}`, err instanceof AuthCancelledError ? "info" : "error");
+        ctx.ui.notify(`pi-mcp: ${sanitizeTerminalText(err instanceof Error ? err.message : String(err))}`, err instanceof AuthCancelledError ? "info" : "error");
       }
     },
     getArgumentCompletions: (prefix) => serverNameCompletions(prefix, manager.getAllServers(), { authOnly: true }),

package/src/oauth-provider.ts

@@ -164,7 +164,7 @@ export const StoredStateSchema = z.object({
   serverUrl: z.string().optional(),
   clientInfo: StoredClientInfoSchema.optional(),
   tokens: StoredTokensSchema.optional(),
-  discoveryState: z.record(z.unknown()).optional(),
+  discoveryState: z.record(z.string(), z.unknown()).optional(),
 });
 
 // ─── File helpers ─────────────────────────────────────────────────────────────

package/src/server-manager.ts

@@ -34,8 +34,16 @@ import {
   getClientDefaultOptions,
   type ToolRefreshOptions,
 } from "./tool-bridge.js";
+import { sanitizeTerminalText, type SanitizeTerminalTextOptions } from "./terminal-text.js";
 
-export { setClientDefaultOptions, getClientDefaultOptions, type ToolRefreshOptions, AuthCancelledError };
+export {
+  setClientDefaultOptions,
+  getClientDefaultOptions,
+  type ToolRefreshOptions,
+  AuthCancelledError,
+  sanitizeTerminalText,
+  type SanitizeTerminalTextOptions,
+};
 
 
 export function isOAuthUnauthorizedError(error: unknown, seen = new Set<unknown>()): boolean {
@@ -101,12 +109,19 @@ export function isOAuthUnauthorizedError(error: unknown, seen = new Set<unknown>
   }
 
   if (
+    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /^\s*401\s*$/.test(msg) ||
+    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\bHTTP\s+401\b/i.test(msg) ||
+    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\bstatus(?:\s+code)?[:\s(]+401\b/i.test(msg) ||
+    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\breturned\s+401\b/i.test(msg) ||
+    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\b401\s+Unauthorized\b/i.test(msg) ||
+    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /:\s*401\b/.test(msg) ||
+    // nosemgrep: pi-mcp.no-401-substring -- WHY: intentional message-text fallback after structured checks for SDK paths that only surface text
     /\(401\)/.test(msg) ||
     /\bUnauthorized\b/i.test(msg) ||
     /\binvalid_token\b/i.test(msg)
@@ -129,13 +144,7 @@ export function isOAuthUnauthorizedError(error: unknown, seen = new Set<unknown>
  * control characters from a single server stderr line before storing or logging.
  */
 export function sanitizeStderrLine(line: string): string {
-  return line
-    .replace(/\r$/, "")
-    .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "")
-    .replace(/\x1b\][\s\S]*?(?:\x07|\x1b\\)/g, "")
-    .replace(/\x1b[P^_][\s\S]*?\x1b\\/g, "")
-    .replace(/\x1b[@-Z\\-_]/g, "")
-    .replace(/\x1b|[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, "");
+  return sanitizeTerminalText(line);
 }
 
 function resolveEnv(extra?: Record<string, string>): Record<string, string> {
@@ -411,7 +420,7 @@ export class ServerManager {
     if (all.length === 0) return "pi-mcp: No servers configured (create ~/.pi/agent/mcp.json)";
     const lines = all.map((s) => {
       const icon = s.state === "ready" ? "✓" : s.state === "starting" ? "⟳" : "✗";
-      const err = s.lastError ? ` — ${s.lastError.message}` : "";
+      const err = s.lastError ? ` — ${sanitizeTerminalText(s.lastError.message)}` : "";
       return `  ${icon} ${s.name} (${s.state})${err}`;
     });
     const ready = all.filter((s) => s.state === "ready").length;
@@ -820,9 +829,9 @@ export class ServerManager {
               signal,
             });
           } catch (err) {
+            const msg = sanitizeTerminalText(err instanceof Error ? err.message : String(err));
             console.error(
-              `[pi-mcp] Failed to refresh tools for ${server.name}:`,
-              err,
+              `[pi-mcp] Failed to refresh tools for ${server.name}: ${msg}`,
             );
           }
         }
@@ -834,9 +843,12 @@ export class ServerManager {
       LoggingMessageNotificationSchema,
       async (notification) => {
         const { level = "info", logger = server.name, data } = notification.params ?? {};
-        const msg = typeof data === "string" ? data : JSON.stringify(data);
-        console.error(`[pi-mcp:${server.name}] [${level}] ${logger}: ${msg}`);
-        appendStderr(`[${level}] ${logger}: ${msg}`);
+        const rawMsg = typeof data === "string" ? data : JSON.stringify(data);
+        const safeLevel = sanitizeTerminalText(String(level), { maxLength: 32 });
+        const safeLogger = sanitizeTerminalText(String(logger), { maxLength: 100 });
+        const safeMsg = sanitizeTerminalText(rawMsg ?? "");
+        console.error(`[pi-mcp:${server.name}] [${safeLevel}] ${safeLogger}: ${safeMsg}`);
+        appendStderr(`[${safeLevel}] ${safeLogger}: ${safeMsg}`);
       },
     );
 
@@ -956,14 +968,15 @@ export class ServerManager {
         if (server.state !== "ready" || signal.aborted || server.client !== client) {
           return;
         }
-        const msg = err instanceof Error ? err.message : String(err);
+        const rawMsg = err instanceof Error ? err.message : String(err);
         if (
           /unknown message ID|Received a response for an unknown message ID|notifications\/progress|unknown token/i.test(
-            msg,
+            rawMsg,
           )
         ) {
           return;
         }
+        const msg = sanitizeTerminalText(rawMsg);
         if (server.config.transport === "sse") {
           console.error(`[pi-mcp] Server ${server.name} SSE stream error, reconnecting: ${msg}`);
           scheduleErrorRecovery();
@@ -982,7 +995,7 @@ export class ServerManager {
           // on GET. Ignore it so POST-only servers do not enter a spurious recovery loop; genuine
           // stream drops on established streams report "SSE stream disconnected" or
           // "Maximum reconnection attempts (0) exceeded." instead.
-          if (/Failed to open SSE stream:/i.test(msg)) {
+          if (/Failed to open SSE stream:/i.test(rawMsg)) {
             return;
           }
           console.error(`[pi-mcp] Server ${server.name} HTTP stream error, reconnecting: ${msg}`);
@@ -1017,7 +1030,7 @@ export class ServerManager {
         // WHY: McpOAuthProvider._loadState() already backed up and removed the corrupt
         // state file before throwing this error. Log the warning and retry once immediately
         // without consuming retryCount so OAuth can proceed cleanly into AuthRequiredError.
-        console.error(`[pi-mcp] ${error.message}`);
+        console.error(`[pi-mcp] ${sanitizeTerminalText(error.message)}`);
         if (signal.aborted) throw new AuthCancelledError(server.name);
         return this._connect(server, server.cwd ?? cwd, signal, true);
       }
@@ -1089,7 +1102,7 @@ export class ServerManager {
           if (err instanceof AuthCancelledError) return;
           const error = err instanceof Error ? err : new Error(String(err));
           server.lastError = error;
-          console.error(`[pi-mcp] [${server.name}] Background recovery failed: ${error.message}`);
+          console.error(`[pi-mcp] [${server.name}] Background recovery failed: ${sanitizeTerminalText(error.message)}`);
           this.onRecoveryFailed?.(server.name, error);
         });
       });

package/src/terminal-text.ts

@@ -0,0 +1,67 @@
+/**
+ * Pure terminal-text sanitization helpers.
+ *
+ * Strips ANSI/VT escape sequences (7-bit ESC and 8-bit C1 CSI/OSC/DCS/PM/APC),
+ * C0/C1 control characters, and embedded line breaks, and bounds string length
+ * before server-controlled strings reach Pi UI notifications or process.stderr.
+ */
+
+/** Default maximum character budget for a single log or notification string. */
+export const DEFAULT_TERMINAL_TEXT_MAX_LENGTH = 500;
+
+export interface SanitizeTerminalTextOptions {
+  /** Maximum UTF-16 code units before truncating with `…` (default: 500). */
+  maxLength?: number | undefined;
+}
+
+function isHighSurrogate(code: number): boolean {
+  return code >= 0xd800 && code <= 0xdbff;
+}
+
+function isLowSurrogate(code: number): boolean {
+  return code >= 0xdc00 && code <= 0xdfff;
+}
+
+/**
+ * Strip ANSI CSI/OSC/DCS/PM/APC sequences (7-bit and 8-bit C1), single-char ESC
+ * sequences, and C0/C1 control characters, collapse embedded CR/LF into spaces
+ * so a single log or notification cannot inject fake lines, and bound length
+ * with `…` without splitting a UTF-16 surrogate pair.
+ */
+export function sanitizeTerminalText(
+  text: string,
+  opts?: SanitizeTerminalTextOptions,
+): string {
+  const maxLength = opts?.maxLength ?? DEFAULT_TERMINAL_TEXT_MAX_LENGTH;
+  if (maxLength <= 0) {
+    return "";
+  }
+
+  const cleaned = text
+    .replace(/\r$/, "")
+    .replace(/(?:\x1b\[|\u009b)[0-?]*[ -/]*[@-~]/g, "")
+    .replace(/(?:\x1b\]|\u009d)[\s\S]*?(?:\x07|\x1b\\|\u009c|$)/g, "")
+    .replace(/(?:\x1b[PX^_]|[\u0090\u0098\u009e\u009f])[\s\S]*?(?:\x1b\\|\u009c|\x07|$)/g, "")
+    .replace(/\x1b[@-Z\\-_]/g, "")
+    .replace(/[\r\n\t]+/g, " ")
+    .replace(/\x1b|[\x00-\x1f\x7f-\x9f]/g, "");
+
+  if (cleaned.length <= maxLength) {
+    return cleaned;
+  }
+
+  if (maxLength === 1) {
+    return "…";
+  }
+
+  let end = maxLength - 1;
+  if (
+    end > 0 &&
+    isHighSurrogate(cleaned.charCodeAt(end - 1)) &&
+    isLowSurrogate(cleaned.charCodeAt(end))
+  ) {
+    end -= 1;
+  }
+
+  return `${cleaned.slice(0, end)}…`;
+}