feat(cli): warn when print mode skips untrusted project MCP servers

Author: elkaix

.changeset/warn-trust-gated-mcp.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Warn in print mode when an untrusted folder skips project-level MCP servers.

apps/pythinker-code/src/cli/v2/run-v2-print.ts

@@ -30,7 +30,9 @@ import {
   IBootstrapService,
   IConfigService,
   IEventBus,
+  IHostFileSystem,
   ISessionIndex,
+  IWorkspaceInstanceManager,
   ISessionManager,
   ITelemetryService,
   PRINT_MAX_TURNS_DEFAULT,
@@ -54,8 +56,13 @@ import {
   type ISessionScopeHandle,
   type LoopRunResult,
   type PrintBackgroundMode,
+  type McpServerConfig,
   type Scope,
 } from '@pymodel/agent-core-v2';
+import {
+  loadMcpServersDetailed,
+  resolveMcpJsonPaths,
+} from '@pymodel/agent-core-v2/app/mcpConfig/configLoader';
 import { createPythinkerDefaultHeaders, createPythinkerDeviceId } from '@pymodel/pythinker-code-oauth';
 import type { GoalUpdated } from '@pymodel/agent-core-v2/features/goal/goalOps';
 import type { TurnEnded } from '@pymodel/agent-core-v2/agent/loop/turnOps';
@@ -217,6 +224,13 @@ export async function runV2Print(
       );
     }
 
+    try {
+      const gated = await listTrustGatedMcpServers(app, workDir, homeDir);
+      if (gated.length > 0) stderr.write(formatTrustGatedMcpWarning(gated));
+    } catch {
+      // Best-effort: a broken mcp.json or trust store must not fail the run.
+    }
+
     const resolved = await resolveNativeSession(app, opts, workDir, defaultModel, stderr);
     restorePermission = resolved.restorePermission;
 
@@ -266,6 +280,49 @@ interface ResolvedNativeSession {
   readonly goalModel: string | undefined;
 }
 
+export interface TrustGatedMcpServer {
+  readonly name: string;
+  readonly target: string;
+}
+
+export async function listTrustGatedMcpServers(
+  app: Scope,
+  workDir: string,
+  homeDir: string,
+): Promise<readonly TrustGatedMcpServer[]> {
+  const workspace = await app.accessor
+    .get(IWorkspaceInstanceManager)
+    .getOrCreate({ root: workDir });
+  if (await workspace.program.trust.get()) return [];
+  const fs = app.accessor.get(IHostFileSystem);
+  const [paths, loaded] = await Promise.all([
+    resolveMcpJsonPaths({ fs, cwd: workDir, homeDir }),
+    loadMcpServersDetailed({ fs, cwd: workDir, homeDir, includeProject: true }),
+  ]);
+  const projectPaths = new Set([paths.projectRoot, paths.project]);
+  return Object.entries(loaded.servers)
+    .filter(([name]) => projectPaths.has(loaded.origins[name] ?? ''))
+    .map(([name, config]) => ({ name, target: describeMcpTarget(config) }))
+    .toSorted((a, b) => a.name.localeCompare(b.name));
+}
+
+export function formatTrustGatedMcpWarning(servers: readonly TrustGatedMcpServer[]): string {
+  const noun = servers.length === 1 ? 'server' : 'servers';
+  const list = servers.map((server) => `${server.name} (${server.target})`).join(', ');
+  return (
+    `Warning: this folder is not trusted; skipped ${servers.length} project-level MCP ${noun}: ${list}.\n` +
+    '  Run `pythinker` here and choose "Trust this folder" to enable them.\n\n'
+  );
+}
+
+function describeMcpTarget(config: McpServerConfig): string {
+  if (config.transport === 'stdio') {
+    const args = config.args === undefined ? '' : ` ${config.args.join(' ')}`;
+    return `stdio: ${config.command}${args}`;
+  }
+  return `${config.transport}: ${config.url}`;
+}
+
 async function resolveNativeSession(
   app: Scope,
   opts: CLIOptions,

apps/pythinker-code/test/cli/run-v2-print.test.ts

@@ -4,9 +4,11 @@ import { describe, expect, it, vi } from 'vitest';
 import {
   applyPrintBackgroundPolicy,
   createPrintTurnEndings,
+  formatTrustGatedMcpWarning,
   PrintSteeredTurnFailedError,
   type PrintTurnEnding,
   type PrintTurnEndings,
+  type TrustGatedMcpServer,
 } from '#/cli/v2/run-v2-print';
 
 function ending(
@@ -502,3 +504,23 @@ describe('createPrintTurnEndings', () => {
     await expect(pending).resolves.toMatchObject({ turnId: 7 });
   });
 });
+
+describe('formatTrustGatedMcpWarning', () => {
+  it('singularizes the noun for one skipped server', () => {
+    const text = formatTrustGatedMcpWarning([
+      { name: 'fs', target: 'stdio: node server.js' },
+    ]);
+    expect(text).toContain('skipped 1 project-level MCP server: fs (stdio: node server.js).');
+    expect(text).toContain('"Trust this folder"');
+  });
+
+  it('pluralizes and joins multiple skipped servers', () => {
+    const servers: readonly TrustGatedMcpServer[] = [
+      { name: 'api', target: 'http: https://example.test/mcp' },
+      { name: 'fs', target: 'stdio: node server.js' },
+    ];
+    const text = formatTrustGatedMcpWarning(servers);
+    expect(text).toContain('skipped 2 project-level MCP servers:');
+    expect(text).toContain('api (http: https://example.test/mcp), fs (stdio: node server.js)');
+  });
+});