Repository navigation
Isolate manual MCP stdio environment with explicit credential migration - #197
Merged
Merged
Conversation
This was referenced Oct 12, 2026
Merged
Lucas1479
marked this pull request as ready for review
October 12, 2026 15:09
Lucas1479
added a commit
that referenced
this pull request
Oct 12, 2026
## Outcome Community TTS, MCP and Skill packages share an explicit install/configure/bind/update/remove lifecycle. Electron owns installation and durable settings; Python consumes startup snapshots; independent SDK Runners own external TTS. Packages install disabled, backend changes require restart, and Main Chat gains no tools, Skills or Host grants. Design: #194. This PR now targets **main**, with the maintainer's authorization to merge after the rebuilt head passes CI. ## Mainline integration and review - Current head `c9b5f93` is one contribution commit on main `52194c0`, which already contains #189, #198 and the corrected #197. - Only the reviewed `7ea55dc..43eda97` net diff was applied, not the old pre-split commit history. It applied without conflicts. Its stable patch-id before status-only documentation updates was identical (`592bba5c748e042587fda10ba4b18c2748d923d6`). Scope remains 132 files, +9,653/-136. - The only additional changes state that the pinned protocol source is now in protocol main history. No runtime or SDK behavior was added during reconstruction. Main's MCP migration messages, credential handling, translations and both source-release documentation entries remain present. - Protocol [#1](Code-Amadeus/Amadeus-Extensions#1) was merged with merge commit `c770dfe`. Its pinned `49449a0f3572e74ac7269129c02c5b9a9e685bef` remains an ancestor of main; no new wheel or pin is needed. - Public annotated tag [`extension-host-profile-v0.1-55e62ab`](https://github.com/Code-Amadeus/Amadeus/tree/extension-host-profile-v0.1-55e62ab) retains the Host commit referenced by the wheel's immutable README link. This is a documentation snapshot, not a release. - Maintainer-provided external re-review accepted the implementation, cancellation recovery, SDK artifact and main-based reconstruction. #191/#192 and protocol #2 are separate follow-ups and were not restacked in this merge preparation. ## SDK delivery and runtime boundaries - Protocol/SDK use Apache-2.0; authored examples use MIT-0; Host remains AGPL-3.0. External models/voices/assets retain their own rights. - The Host carries one canonical SDK wheel selected by `protocol-source.json`. Frontend builds verify it with Node and do not invoke Python to build or download the SDK. Source archives and packaged Electron contain the same artifact. - SDK SHA-256 remains `274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084`. Independent Windows/Linux builds, a local rebuild and the vendored bytes match. Source hashes, PEP 639 metadata and embedded LICENSE are verified against the accepted source commit. - Static package inspection accepts compatible SDK ranges/exact versions, evaluates active markers, and rejects incompatible versions/direct SDK URLs before pip. Installation verifies its staged SDK bytes. Confirmation discloses the declared license, complete plugin wheel digest and local source filename. - Non-cooperative TTS cancellation has a 10-second cleanup grace, then bounded Runner recovery without replaying speech. Cooperative cleanup keeps the process/budget; old requests cannot cancel a replacement Runner. - MCP and Skill execution stays with the existing Provider paths. Installation is not a Host permission grant, and unsupported combinations fail closed. ## Validation on rebuilt head - `python -m pytest -q -rs tests/test_extensions.py tests/test_extension_sdk_build.py tests/test_extension_protocol_provenance.py tests/test_extension_mcp.py tests/test_extension_skills.py tests/test_extension_examples.py tests/test_extension_fish_audio.py tests/test_mcp_connections.py tests/test_mcp_provider_adapter.py tests/test_subprocess_environment.py tests/test_pi_web_tools.py tests/test_release_tooling.py tests/test_work_artifact_registry.py tests/test_work_artifact_preview.py tests/test_work_read_model.py`: **190 passed, 2 skipped** (local Windows symlink privileges). - Electron full suite: **463 passed**. Production build passed with `AMADEUS_PYTHON` pointing to a nonexistent interpreter. - Canonical-source comparison passes; the pinned protocol commit is in protocol main history. The vendored wheel and its digest are unchanged. - Clean source-release gate: **3,985 selected, 101 excluded, 0 errors/warnings**. Diff checks pass. - Final main-based CI must pass before merging; old-head green checks are not substituted for it. ## Remaining experimental limits Historical native Windows install/update/enable/restart/Chat playback/removal evidence is recorded in the Host profile. This reconstruction does not claim a new native-dialog acceptance run or new paid-service/natural-voice qualification. MiMo Japanese is unsupported. DSH stdout and Windows DACL/integrity limitations remain observable and fail closed. The accepted #197 follow-up about the MCP SDK reintroducing Windows `PATH` beside explicit `Path` remains a non-blocking independent migration fix; this reconstruction does not alter the approved MCP policy. The earlier bare-parameter MCP constructor defect was introduced and fixed within this experiment, not an existing main bug. Theme support/unified Plugins navigation (#191/#192), developer mode, logs, public SDK publication and memory are outside this PR. Merge to main with squash after final checks; do not merge to the retired temporary review base.
Lucas1479
added a commit
that referenced
this pull request
Oct 12, 2026
…y preparation (#191) ## Outcome and dependencies P1 supplies the Host-owned support matrix, saved/loaded revisions and resource-only preparation consumed by #192. It adds no Host authority or new executable contribution kind; themes remain closed until P2. Design #194. **External re-review completed; maintainer requested merge after all checks passed.** Head `b263720f786c16000d3d178812109583266eb896` targets accepted main `c569a0f`, which contains #189/#197/#198/#188. #192 is stacked on this repaired head. The earlier reconstruction retained P1's original patch-id; subsequent audit repairs are explicit commits. No pre-split history was replayed. ## Lifecycle invariants and audit repairs - Every backend launch retires the previous process's logical loaded receipts. Physical deletion still requires confirmed shutdown and absence of references; retiring a receipt does not authorize deleting files. - Python reports snapshot admission separately from runtime health: a valid, unique package identity/revision receives `startup: accepted` or `startup: rejected`. A rejected launch settles that exact revision without creating a loaded receipt. Later Runner/contribution failures do not rewrite an already admitted snapshot. - **Explicit rejection is not missing evidence.** An unreadable snapshot, failed/unavailable status section, invalid or duplicate identity, malformed receipt, wrong revision or absent result remains unconfirmed and pending. Electron does not manufacture success/rejection from an empty response. A late old response cannot acknowledge a newer edit. - Host-generated `startup_error` records settle their exact launch revision as before. Frontend-only unavailable/removal errors do not create backend restart work. - Resource-only wheels are inspected/extracted without private venv, pip, imports or SDK installation. POSIX executable bits are retained so package MCP commands can run; setuid/setgid and archive write permissions are not imported. Dependencies remain rejected. - Saved revisions advance only on real changes. Actual installation references retain files until their owners stop. Python extensions keep staged preparation with a digest-verified SDK wheel. SDK source remains `49449a0`; wheel SHA-256 remains `274bd66b81932c8ea50f39f58e7bf91530a8015196acfcf9bcfd77fa2d8b8084`. Protocol #2 is a dependency of the theme consumer, not of P1. ## Validation - The new explicit-rejection regression failed before the repair; three Python validation failures also reproduced missing revisions. Regressions now cover accepted/rejected/unconfirmed results, duplicate identities, malformed and stale receipts, newer edits and post-admission health failures. - Full P1 Electron suite: **480 passed**; `npm run build` passed. - Scoped P1 extension/Skill/MCP Python run: **62 passed, 1 skipped**. The POSIX permission regression runs the extracted command and is included in Linux/macOS CI; local Windows results do not claim POSIX execution. - Canonical-source comparison passed. `python -X utf8 tools/build_source_release.py` on the clean final P1 head passed: **3,991 selected, 101 excluded, zero errors/warnings**. Exact-head CI is complete: **16/16 successful checks**, including Windows Python/model-less smoke, Electron, Linux/macOS and source release. ## Review and scope Review admission acknowledgment versus runtime health and physical cleanup. Keep #192 stacked until P1 is accepted, then move only its own diff onto main. This merge closes P1 only. Developer mode, logs feature, later phases and memory remain outside this batch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User scenario and compatibility
On current main, the Host-owned Settings → Providers → MCP → Test probe is the only consumer of manually configured stdio MCP connections that this environment migration changes. Its process receives platform/toolchain variables plus explicitly encrypted connection bindings, rather than arbitrary Host environment credentials.
A service relying on an ambient Host token may fail the probe while continuing to work through Codex/ACP's independently launched MCP service. Native Codex/ACP launch behavior and stored v1 records, commands, arguments and cwd are unchanged. Pi does not accept manual MCP connection bindings on main; its built-in web search uses HTTP and is unaffected. Later Host-owned stdio consumers, such as extension execution paths, can reuse this boundary; this PR does not introduce those consumers.
Design #195. Standalone main-based review extracted from #188. Current head
06a4fc2contains audit repair38089f7and current main0dbf7ef(including merged #189 and #198). Keep Draft pending review/CI; no merge is requested.Changes and audit repairs
unhandled errors in a TaskGroup. Explicit credentials and resolved HTTP bearer tokens are redacted before truncation.Validation
Five new/strengthened regression cases failed before repair, reproducing the TaskGroup message, missing guidance and Windows duplicate-key behavior.
On the synchronized head:
python -m pytest -q tests/test_mcp_connections.py tests/test_subprocess_environment.py tests/test_mcp_provider_adapter.py tests/test_pi_web_tools.py: 26 passed, including 15 focused environment/probe cases.Connection closedplus migration guidance; adding the explicit binding makes discovery and a direct helper tool call succeed, preserving cwd without an unrelated Host secret.cd electron; npm test: 406 passed;npm run build: passed. The first run caught unsorted new translation keys; the final catalog is sorted and the entire suite passes.Migration documentation.
Latest main synchronization validation
At
06a4fc2:MERGEABLE; new-head CI and review requirements still apply. Draft status is retained.Review and integration
#189 and #198 have been merged by the maintainer. Main
0dbf7efis now integrated here. The only conflict was the adjacent documentation insertion inrelease/source_release_policy.json; bothdocs/mcp_environment.mdanddocs/backend_shutdown.mdare retained. No MCP or shutdown implementation was changed while resolving it. After approval, freeze this prerequisite; rebuild/restack #188 from its own net diff rather than replaying its pre-split history. This update does not cascade changes through #188/#191/#192.The earlier experimental bare-parameter MCP constructor regression was not a main defect; main already used
Client(stdio_client(...)). No extension capability grant, backend-stop policy, SDK licensing work, diagnostics feature or memory implementation is included here.