Behavior-preserving cleanups:
- extract shared resolveBaseUrl helper for jira/confluence base-URL logic
- extract shared registerTool helper; port jira/gitlab/confluence tools to it
- make scanSecrets declarative (filter/map)
- collapse ok/warn pair into status() and drop double existsSync in kit-doctor
Typecheck clean; npm test 71 PASS, 0 FAIL.
Pi has no built-in MCP; this adds a bridge extension + declarative registry.
- config/mcp.json: jira/confluence/gitlab servers, all enabled:false; URLs from
company.json ({config:...}), tokens from env ({env:...}) — nothing hardcoded
- extensions/mcp-bridge.ts: resolves env templates, and for enabled servers
connects via MCP SDK (dynamic import) and registers their tools; /mcp-status
command; graceful no-op when disabled or SDK absent
- docs/mcp.md: how to enable, prerequisites (VPN, tokens, uvx/npx, SDK), security
- package.json: @modelcontextprotocol/sdk as optionalDependency; ignore package-lock
Verified offline: extension loads, /mcp-status lists 3 servers (disabled), env
resolver builds gitlab API URL from company.json gitHost + GITLAB_TOKEN. Live
connect needs VPN + a token + authorization to run the server package.
- /kit-doctor: environment health check (node, kit version/channel, config source+values, env vars presence, env.sh, loaded command/skill counts) with pass/warn summary; read-only, offline-safe
- /kit-help: catalog of package commands + skills (filtered to package path) + static guardrail list
Verified live via pi RPC: both commands register and render.
Deploy convention at M.Video: a release-* branch push deploys to stage and a
v* tag push deploys to PROD. The old guard only matched release/* (slash) and
never caught tag pushes, so a prod deploy could run unconfirmed.
- permission-gate: match main/master, release-[-/], --tags/--follow-tags, and
whitespace-preceded v<digit> tags; false-positive-safe (space discriminator)
- create-mr.sh: refuse source branch release-* (not just release/*)
- jira-workflow doc updated to release-*
Verified with a behavioral test suite (10 cases incl. v2, false-positive checks).
- protected-paths.ts: reword comment that contained a globstar+slash sequence which closed the /** */ block early (caused a ParseError at load)
- package.json: add "type": "module" (extensions are ESM)
Verified locally: pi install ./, all 5 commands + 4 skills load via RPC get_commands, /kit-config prints values+source, dynamic config change reflected, protected-paths + permission-gate pass a behavioral test suite.
Aleksey Shakhmatov
dev