@1mcp/agent 0.35.0-beta.4 → 0.35.0

package/build/domains/admin/adminConfiguredServerService.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { mergeGlobalAndServerConfig } from '../../config/mcpConfigMerge.js';
+import { normalizeDisabledToolsForServer } from '../../core/server/disabledTools.js';
 import { GLOBAL_TRANSPORT_CONFIG_KEYS, transportConfigSchema, } from '../../core/types/index.js';
 import { fingerprintConfiguredServerConfigDocument, fingerprintConfiguredServerDefaults, fingerprintConfiguredServerSecretValue, fingerprintConfiguredServerTarget, isConfiguredServerTargetDisabled, } from '../../domains/config-change/configChange.js';
 import { createServerInstallationWorkflow, } from '../../domains/installation/serverInstallationWorkflow.js';
@@ -472,56 +473,71 @@ export class AdminConfiguredServerService {
         return this.options.operationService.executeReadOnly({
             context: input.context,
             operationName: 'listConfiguredServers',
-            run: async () => ({ servers: this.readConfiguredServers() }),
+            run: async () => this.readConfiguredServers(),
         });
     }
     async getConfiguredServerDetail(input) {
+        const configuredState = this.readConfiguredServerState(input.targetName, input.targetSource);
+        const source = configuredState.source;
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: input.targetName },
+            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
         };
         return this.options.operationService.executeReadOnly({
             context,
             operationName: 'getConfiguredServerDetail',
             run: async () => {
-                const { currentConfig, serverDefaults } = this.readConfiguredServerState(input.targetName);
-                const server = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig));
+                const { currentConfig, serverDefaults } = configuredState;
+                const server = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source, fingerprintConfiguredServerTarget(currentConfig), Object.hasOwn(currentConfig, 'instructionOverride') ? currentConfig.instructionOverride : undefined, Object.hasOwn(currentConfig, 'instructionOverride'));
                 return {
                     server,
                     editContract: createConfiguredServerEditContract(server, currentConfig, serverDefaults),
+                    ...(this.options.readToolInventory
+                        ? {
+                            toolInventory: await this.options.readToolInventory({
+                                targetName: input.targetName,
+                                source,
+                                config: currentConfig,
+                                ...(input.model ? { model: input.model } : {}),
+                            }),
+                        }
+                        : {}),
                 };
             },
         });
     }
     async previewConfiguredServerEdit(input) {
+        const configuredState = this.readConfiguredServerState(input.targetName, input.targetSource);
+        const source = configuredState.source;
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: input.targetName },
+            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
         };
-        const { currentConfig, serverDefaults } = this.readConfiguredServerState(input.targetName);
+        const { currentConfig, serverDefaults } = configuredState;
         return this.options.operationService.executeDryRun({
             context,
             operationName: 'previewConfiguredServerEdit',
-            run: async () => this.previewConfiguredServerEditResult(input, currentConfig, serverDefaults),
+            run: async () => this.previewConfiguredServerEditResult(input, currentConfig, serverDefaults, false, source),
         });
     }
     async applyConfiguredServerEdit(input) {
+        const source = this.resolveConfiguredServerSource(input.targetName, input.targetSource);
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: input.targetName },
+            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
             confirmationFacts: sanitizeApplyConfirmationFacts(input.context.confirmationFacts),
         };
         return this.options.operationService.executeMutation({
             context,
             operationName: 'applyConfiguredServerEdit',
             prepare: async () => {
-                const { currentConfig, serverDefaults } = this.readConfiguredServerState(input.targetName);
-                const preview = await this.previewConfiguredServerEditResult({ ...input, connectivityCheck: 'auto' }, currentConfig, serverDefaults, true);
+                const { currentConfig, serverDefaults } = this.readConfiguredServerState(input.targetName, source);
+                const preview = await this.previewConfiguredServerEditResult({ ...input, connectivityCheck: 'auto' }, currentConfig, serverDefaults, true, source);
                 const normalizedEdit = normalizeEditDraft(input.edit);
-                const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig));
+                const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source);
                 const applicableEdit = filterApplicableSecretEdits(normalizedEdit.edit, currentReadModel.secretInputs);
-                const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults);
-                const proposedReadModel = createConfiguredServerReadModel(preview.proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig));
+                const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults, input.targetName);
+                const proposedReadModel = createConfiguredServerReadModel(preview.proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig), source);
                 const connectionCritical = preview.diff.some((entry) => entry.riskFlags.includes('connection_critical'));
                 const secretChange = preview.diff.some((entry) => entry.riskFlags.includes('secret'));
                 if (preview.validation.status !== 'valid') {
@@ -549,6 +565,9 @@ export class AdminConfiguredServerService {
                             : []),
                         ...(secretChange ? [{ code: 'secretChangeConfirmed', expected: true }] : []),
                         ...(connectionCritical ? [{ code: 'connectionCriticalConfirmed', expected: true }] : []),
+                        ...(preview.toolSelection?.requiresZeroEnabledConfirmation
+                            ? [{ code: 'zeroEnabledToolsConfirmed', expected: true }]
+                            : []),
                         ...(preview.connectivityCheck.status === 'failed'
                             ? [{ code: 'connectivityFailureOverrideConfirmed', expected: true }]
                             : []),
@@ -556,6 +575,7 @@ export class AdminConfiguredServerService {
                     run: async () => {
                         const configChange = await this.options.configChangeService.editConfiguredServerTarget({
                             sourceName: input.targetName,
+                            targetSource: source,
                             targetName: preview.proposedTargetName,
                             serverConfig: proposedConfig,
                             expectedSourceFingerprint: fingerprintConfiguredServerTarget(currentConfig),
@@ -584,17 +604,22 @@ export class AdminConfiguredServerService {
     }
     async setConfiguredServerEnabledState(input, enabled) {
         const operationName = enabled ? 'enableConfiguredServer' : 'disableConfiguredServer';
+        const source = input.targetSource ?? 'mcpServers';
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: input.targetName },
+            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
         };
         if (input.dryRun) {
             return this.options.operationService.executeDryRun({
                 context,
                 operationName,
                 run: async () => {
+                    if (source !== 'mcpServers') {
+                        throw new Error('Template Server definitions do not support enable or disable operations');
+                    }
                     const configChange = await this.options.configChangeService.previewConfiguredServerTargetEnabledState({
                         targetName: input.targetName,
+                        targetSource: source,
                         enabled,
                         backup: 'skip',
                     });
@@ -614,8 +639,12 @@ export class AdminConfiguredServerService {
             operationName,
             confirmationRequirements: input.confirmationRequirements,
             run: async () => {
+                if (source !== 'mcpServers') {
+                    throw new Error('Template Server definitions do not support enable or disable operations');
+                }
                 const configChange = await this.options.configChangeService.setConfiguredServerTargetEnabledState({
                     targetName: input.targetName,
+                    targetSource: source,
                     enabled,
                     backup: 'required',
                 });
@@ -632,49 +661,84 @@ export class AdminConfiguredServerService {
     readConfiguredServers() {
         const parsed = this.options.readConfigDocument();
         if (!parsed) {
-            return [];
+            return { servers: [], configFingerprint: fingerprintConfiguredServerConfigDocument({}) };
         }
-        return Object.entries(parsed.mcpServers ?? {}).map(([name, serverConfig]) => createConfiguredServerReadModel(name, mergeGlobalAndServerConfig(parsed.serverDefaults, serverConfig)));
+        return {
+            configFingerprint: fingerprintConfiguredServerConfigDocument(parsed),
+            servers: ['mcpServers', 'mcpTemplates'].flatMap((source) => Object.entries(parsed[source] ?? {}).map(([name, serverConfig]) => createConfiguredServerReadModel(name, mergeGlobalAndServerConfig(parsed.serverDefaults, serverConfig), source, fingerprintConfiguredServerTarget(serverConfig), Object.hasOwn(serverConfig, 'instructionOverride') ? serverConfig.instructionOverride : undefined, Object.hasOwn(serverConfig, 'instructionOverride')))),
+        };
     }
-    readConfiguredServerState(targetName) {
+    readConfiguredServerState(targetName, targetSource) {
         const parsed = this.options.readConfigDocument();
-        const currentConfig = parsed?.mcpServers?.[targetName];
+        const source = this.resolveConfiguredServerSource(targetName, targetSource, parsed);
+        const currentConfig = parsed?.[source]?.[targetName];
         if (!currentConfig) {
             throw new AdminConfiguredServerNotFoundError(targetName);
         }
-        return { currentConfig, serverDefaults: parsed?.serverDefaults };
+        return { currentConfig, serverDefaults: parsed?.serverDefaults, source };
+    }
+    resolveConfiguredServerSource(targetName, targetSource, document = this.options.readConfigDocument()) {
+        if (targetSource)
+            return targetSource;
+        return document?.mcpTemplates?.[targetName] ? 'mcpTemplates' : 'mcpServers';
     }
     readConfiguredServerConfig(targetName) {
         const parsed = this.options.readConfigDocument();
-        const currentConfig = parsed?.mcpServers?.[targetName];
+        const currentConfig = parsed?.mcpTemplates?.[targetName] ?? parsed?.mcpServers?.[targetName];
         if (!currentConfig) {
             throw new AdminConfiguredServerNotFoundError(targetName);
         }
         return currentConfig;
     }
-    async previewConfiguredServerEditResult(input, currentConfig, serverDefaults, requireCriticalConnectivity = false) {
+    async previewConfiguredServerEditResult(input, currentConfig, serverDefaults, requireCriticalConnectivity = false, source = 'mcpServers') {
         const normalizedEdit = normalizeEditDraft(input.edit);
-        const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig));
+        const sourceValidation = validateEditForSource(source, normalizedEdit.edit);
+        const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source);
         const secretValidation = validateSecretEditCapabilities(normalizedEdit.edit, currentReadModel.secretInputs);
         const transportApplicabilityValidation = validateTransportFieldApplicability(currentConfig, normalizedEdit.edit);
         const overrideValidation = validateTransportOverrideClears(currentConfig, normalizedEdit.edit);
         const applicableEdit = filterApplicableSecretEdits(normalizedEdit.edit, currentReadModel.secretInputs);
         const proposedTargetName = applicableEdit.id?.trim() || input.targetName;
-        const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults);
-        const proposedReadModel = createConfiguredServerReadModel(proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig));
+        const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults, input.targetName);
+        const proposedReadModel = createConfiguredServerReadModel(proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig), source);
         const proposedTransportType = configuredTransportType(proposedConfig);
         const serverValidation = validatePreviewServerConfig(proposedConfig);
-        const validation = mergeValidation(mergeValidation(mergeValidation(mergeValidation(normalizedEdit.validation, secretValidation), transportApplicabilityValidation), overrideValidation), serverValidation);
+        const currentToolInventory = this.options.readToolInventory
+            ? await this.options.readToolInventory({
+                targetName: input.targetName,
+                source,
+                config: currentConfig,
+                ...(input.model ? { model: input.model } : {}),
+            })
+            : undefined;
+        const toolEditValidation = validateConfiguredToolEdit(applicableEdit, currentToolInventory);
+        const validation = mergeValidation(mergeValidation(mergeValidation(mergeValidation(normalizedEdit.validation, secretValidation), transportApplicabilityValidation), overrideValidation), mergeValidation(mergeValidation(serverValidation, sourceValidation), toolEditValidation));
         const diff = createPreviewDiff(currentReadModel, proposedReadModel, applicableEdit);
+        pushDiff(diff, ['disabledTools'], currentConfig.disabledTools ?? [], proposedConfig.disabledTools ?? [], [
+            'tool_visibility',
+        ]);
+        pushDiff(diff, ['toolDescriptionOverrides'], currentConfig.toolDescriptionOverrides ?? {}, proposedConfig.toolDescriptionOverrides ?? {}, ['tool_metadata']);
         appendClearedOverrideDiff(diff, currentReadModel, proposedReadModel, applicableEdit);
         const changed = validation.status === 'valid' && diff.length > 0;
         const endpointChangedWithPreservedSecrets = endpointAuthorityChanged(currentConfig, proposedConfig) &&
             hasPreservedSecretInputs(currentReadModel.secretInputs.filter((input) => !proposedTransportType || transportFieldAppliesToType(input.fieldPath[0], proposedTransportType)), applicableEdit);
+        const proposedToolInventory = this.options.readToolInventory
+            ? await this.options.readToolInventory({
+                targetName: proposedTargetName,
+                source,
+                config: proposedConfig,
+                ...(input.model ? { model: input.model } : {}),
+            })
+            : undefined;
+        const toolSelection = currentToolInventory && proposedToolInventory
+            ? createConfiguredToolSelectionPreview(currentToolInventory, proposedToolInventory)
+            : undefined;
         return {
             targetName: input.targetName,
             proposedTargetName,
             previewFingerprint: previewFingerprint({
                 targetName: input.targetName,
+                targetSource: source,
                 sourceFingerprint: fingerprintConfiguredServerTarget(currentConfig),
                 globalConfigFingerprint: fingerprintConfiguredServerDefaults(serverDefaults),
                 edit: normalizedEdit.edit,
@@ -682,10 +746,11 @@ export class AdminConfiguredServerService {
                 proposed: proposedReadModel,
                 diff,
                 validation,
+                toolSelection,
             }),
             validation,
             diff,
-            configChange: previewConfigChange(input.targetName, changed),
+            configChange: previewConfigChange(input.targetName, changed, source),
             connectivityCheck: await this.previewConnectivityCheck({
                 targetName: proposedTargetName,
                 serverConfig: proposedConfig,
@@ -696,6 +761,7 @@ export class AdminConfiguredServerService {
                     (requireCriticalConnectivity && diff.some((entry) => entry.riskFlags.includes('connection_critical'))),
                 endpointChangedWithPreservedSecrets,
             }),
+            ...(toolSelection ? { toolSelection } : {}),
         };
     }
     async previewConnectivityCheck(input) {
@@ -787,6 +853,20 @@ export class AdminConfiguredServerService {
         };
     }
 }
+function validateEditForSource(source, edit) {
+    if (source !== 'mcpTemplates')
+        return { status: 'valid', errors: [] };
+    const supportedTemplateMetadata = new Set(['instructionOverride', 'disabledTools', 'toolDescriptionOverrides']);
+    const unsupported = Object.keys(edit).filter((key) => !supportedTemplateMetadata.has(key));
+    return {
+        status: unsupported.length === 0 ? 'valid' : 'invalid',
+        errors: unsupported.map((key) => ({
+            fieldPath: [key],
+            code: 'template_edit_field_unsupported',
+            message: 'Template Server edits may only change instruction and tool metadata.',
+        })),
+    };
+}
 function assertSuccessfulConfigChange(configChange) {
     if (configChange.reload.status === 'failed') {
         throw new Error(`Config reload observation failed: ${configChange.reload.error ?? 'unknown reload failure'}`);
@@ -831,6 +911,7 @@ function sanitizeApplyConfirmationFacts(facts) {
         return undefined;
     const allowed = ['previewConfirmed', 'targetNameConfirmed', 'secretChangeConfirmed', 'connectionCriticalConfirmed'];
     allowed.push('connectivityFailureOverrideConfirmed');
+    allowed.push('zeroEnabledToolsConfirmed');
     const sanitized = Object.fromEntries(allowed.filter((key) => key in facts).map((key) => [key, facts[key]]));
     return Object.keys(sanitized).length > 0 ? sanitized : undefined;
 }
@@ -843,7 +924,17 @@ function mutationOutcome(enabled, changed) {
 function normalizeEditDraft(value) {
     const errors = [];
     const edit = {};
-    const supportedKeys = new Set(['id', 'enabled', 'tags', 'transport', 'secrets', 'clearTransportOverrides']);
+    const supportedKeys = new Set([
+        'id',
+        'enabled',
+        'tags',
+        'transport',
+        'secrets',
+        'clearTransportOverrides',
+        'instructionOverride',
+        'disabledTools',
+        'toolDescriptionOverrides',
+    ]);
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return {
             edit,
@@ -905,6 +996,36 @@ function normalizeEditDraft(value) {
             });
         }
     }
+    if (record.disabledTools !== undefined) {
+        if (Array.isArray(record.disabledTools) && record.disabledTools.every((name) => typeof name === 'string')) {
+            edit.disabledTools = Array.from(new Set(record.disabledTools.map((name) => name.trim()).filter((name) => name.length > 0))).sort((left, right) => left.localeCompare(right));
+        }
+        else {
+            errors.push({
+                fieldPath: ['disabledTools'],
+                code: 'invalid_disabled_tools',
+                message: 'Disabled tools must be a list of logical tool names.',
+            });
+        }
+    }
+    if (record.toolDescriptionOverrides !== undefined) {
+        if (record.toolDescriptionOverrides &&
+            typeof record.toolDescriptionOverrides === 'object' &&
+            !Array.isArray(record.toolDescriptionOverrides) &&
+            Object.entries(record.toolDescriptionOverrides).every(([name, description]) => name.length > 0 && name === name.trim() && typeof description === 'string')) {
+            edit.toolDescriptionOverrides = Object.fromEntries(Object.entries(record.toolDescriptionOverrides)
+                .map(([name, description]) => [name, description.trim()])
+                .filter(([name, description]) => name.length > 0 && description.length > 0)
+                .sort(([left], [right]) => left.localeCompare(right)));
+        }
+        else {
+            errors.push({
+                fieldPath: ['toolDescriptionOverrides'],
+                code: 'invalid_tool_description_overrides',
+                message: 'Tool description overrides must map logical tool names to descriptions.',
+            });
+        }
+    }
     if (record.transport !== undefined) {
         if (record.transport && typeof record.transport === 'object' && !Array.isArray(record.transport)) {
             edit.transport = normalizeTransportEditDraft(record.transport, errors);
@@ -943,6 +1064,23 @@ function normalizeEditDraft(value) {
             });
         }
     }
+    if (record.instructionOverride !== undefined) {
+        const parsed = z
+            .discriminatedUnion('action', [
+            z.object({ action: z.literal('set'), value: z.string() }).strict(),
+            z.object({ action: z.literal('remove') }).strict(),
+        ])
+            .safeParse(record.instructionOverride);
+        if (parsed.success)
+            edit.instructionOverride = parsed.data;
+        else {
+            errors.push({
+                fieldPath: ['instructionOverride'],
+                code: 'invalid_instruction_override',
+                message: 'Instruction override must set a string value or remove the configured override.',
+            });
+        }
+    }
     return {
         edit,
         validation: { status: errors.length === 0 ? 'valid' : 'invalid', errors },
@@ -971,6 +1109,20 @@ function normalizeTransportEditDraft(record, errors) {
     }
     return transport;
 }
+function validateConfiguredToolEdit(edit, inventory) {
+    if (!inventory)
+        return { status: 'valid', errors: [] };
+    const allowedNames = new Set(inventory.rows.map((row) => row.name));
+    const requestedNames = new Set([...(edit.disabledTools ?? []), ...Object.keys(edit.toolDescriptionOverrides ?? {})]);
+    const errors = Array.from(requestedNames)
+        .filter((name) => !allowedNames.has(name))
+        .map((name) => ({
+        fieldPath: ['tools', name],
+        code: 'unknown_configured_tool',
+        message: 'Tool changes must refer to an observed tool or a retained unresolved entry.',
+    }));
+    return { status: errors.length === 0 ? 'valid' : 'invalid', errors };
+}
 function isSecretCapableRawTransportEdit(key, value) {
     if (key === 'url') {
         return isSecretCapableUrlEdit(value);
@@ -1267,7 +1419,7 @@ function potentialSecretInput(fieldPath) {
     }
     return undefined;
 }
-function applyEditDraft(currentConfig, edit, serverDefaults) {
+function applyEditDraft(currentConfig, edit, serverDefaults, logicalServerName) {
     const nextConfig = cloneServerConfig(currentConfig);
     for (const key of edit.clearTransportOverrides ?? []) {
         delete nextConfig[key];
@@ -1283,6 +1435,27 @@ function applyEditDraft(currentConfig, edit, serverDefaults) {
     if (Array.isArray(edit.tags)) {
         nextConfig.tags = edit.tags.filter((tag) => typeof tag === 'string');
     }
+    if (edit.instructionOverride?.action === 'set') {
+        nextConfig.instructionOverride = edit.instructionOverride.value;
+    }
+    else if (edit.instructionOverride?.action === 'remove') {
+        delete nextConfig.instructionOverride;
+    }
+    if (Array.isArray(edit.disabledTools)) {
+        const disabledTools = logicalServerName
+            ? normalizeDisabledToolsForServer(logicalServerName, edit.disabledTools)
+            : edit.disabledTools;
+        if (disabledTools.length === 0)
+            delete nextConfig.disabledTools;
+        else
+            nextConfig.disabledTools = disabledTools;
+    }
+    if (edit.toolDescriptionOverrides) {
+        if (Object.keys(edit.toolDescriptionOverrides).length === 0)
+            delete nextConfig.toolDescriptionOverrides;
+        else
+            nextConfig.toolDescriptionOverrides = { ...edit.toolDescriptionOverrides };
+    }
     if (edit.transport && typeof edit.transport === 'object') {
         const currentType = configuredTransportType(currentConfig);
         const proposedType = configuredTransportType({ ...currentConfig, ...edit.transport });
@@ -1666,12 +1839,12 @@ function isValidUrlOrEnvReference(value) {
         return false;
     }
 }
-function previewConfigChange(targetName, changed) {
+function previewConfigChange(targetName, changed, source = 'mcpServers') {
     return {
         status: changed ? 'changed' : 'unchanged',
         operation: 'set_static',
         configPath: '[redacted]',
-        target: { name: targetName, source: 'mcpServers' },
+        target: { name: targetName, source },
         changed,
         backup: { created: false },
         retentionCleanup: { attempted: false, deletedPaths: [], warnings: [] },
@@ -1684,6 +1857,7 @@ function previewFingerprint(input) {
         .update(stableStringify({
         schemaVersion: 2,
         targetName: input.targetName,
+        targetSource: input.targetSource,
         sourceFingerprint: input.sourceFingerprint,
         globalConfigFingerprint: input.globalConfigFingerprint,
         edit: redactEditDraftForFingerprint(input.edit),
@@ -1691,9 +1865,39 @@ function previewFingerprint(input) {
         proposed: input.proposed,
         diff: input.diff,
         validation: input.validation,
+        toolSelection: input.toolSelection,
     }))
         .digest('hex')}`;
 }
+function createConfiguredToolSelectionPreview(current, proposed) {
+    const currentRows = new Map(current.rows.map((row) => [row.name, row]));
+    const proposedRows = new Map(proposed.rows.map((row) => [row.name, row]));
+    const changedTools = Array.from(new Set([...currentRows.keys(), ...proposedRows.keys()]))
+        .filter((name) => {
+        const before = currentRows.get(name);
+        const after = proposedRows.get(name);
+        return (before?.enabled !== after?.enabled ||
+            before?.descriptionOverride !== after?.descriptionOverride ||
+            before?.effectiveDescription !== after?.effectiveDescription);
+    })
+        .sort((left, right) => left.localeCompare(right));
+    return {
+        capabilityGeneration: current.generation,
+        model: proposed.model,
+        changedTools,
+        counts: proposed.counts,
+        approximateTokens: {
+            before: current.approximateTokens.enabled,
+            after: proposed.approximateTokens.enabled,
+            savings: current.approximateTokens.enabled - proposed.approximateTokens.enabled,
+        },
+        targetEnabled: proposed.targetEnabled,
+        effect: proposed.targetEnabled ? 'immediate' : 'deferred_until_target_enabled',
+        requiresZeroEnabledConfirmation: changedTools.length > 0 &&
+            current.rows.some((row) => row.observed && row.enabled) &&
+            !proposed.rows.some((row) => row.observed && row.enabled),
+    };
+}
 function redactEditDraftForFingerprint(edit) {
     return {
         ...edit,
@@ -1721,6 +1925,9 @@ function createPreviewDiff(current, proposed, edit) {
     pushDiff(diff, ['id'], current.id, proposed.id, proposed.id === current.id ? [] : ['rename']);
     pushDiff(diff, ['enabled'], current.enabled, proposed.enabled, ['connection_critical']);
     pushDiff(diff, ['tags'], current.tags, proposed.tags, []);
+    if (edit.instructionOverride) {
+        pushDiff(diff, ['instructionOverride'], current.instructionOverride, proposed.instructionOverride, []);
+    }
     const secretEditedTopLevelKeys = new Set((edit.secrets ?? []).map((secret) => secret.fieldPath[0]));
     const transportEditedKeys = new Set(Object.keys(edit.transport ?? {}));
     const transportKeys = new Set([...Object.keys(current.transport), ...Object.keys(proposed.transport)]);
@@ -1857,11 +2064,15 @@ function stableStringify(value) {
     }
     return JSON.stringify(value);
 }
-function createConfiguredServerReadModel(name, serverConfig) {
+function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServers', revision = fingerprintConfiguredServerTarget(serverConfig), instructionOverride = serverConfig.instructionOverride, hasInstructionOverride = Object.hasOwn(serverConfig, 'instructionOverride')) {
     const secretInputs = [];
     const transport = {};
     for (const [key, value] of Object.entries(serverConfig)) {
-        if (key === 'disabled' || key === 'tags') {
+        if (key === 'disabled' ||
+            key === 'tags' ||
+            key === 'instructionOverride' ||
+            key === 'disabledTools' ||
+            key === 'toolDescriptionOverrides') {
             continue;
         }
         if (key === 'env') {
@@ -1889,22 +2100,33 @@ function createConfiguredServerReadModel(name, serverConfig) {
     const enabled = !isConfiguredServerTargetDisabled(serverConfig.disabled);
     return {
         id: name,
-        source: 'mcpServers',
+        source,
         target: {
             type: 'configured_server',
             id: name,
-            source: 'mcpServers',
+            source,
         },
+        revision,
         enabled,
         tags: normalizeTags(serverConfig.tags),
         transportSummary: createTransportSummary(serverConfig, transport),
         mutationAvailability: {
-            available: true,
-            operations: ['enable', 'disable'],
+            available: source === 'mcpServers',
+            operations: source === 'mcpServers' ? ['enable', 'disable'] : [],
         },
-        actionState: createActionState(name, enabled),
+        actionState: source === 'mcpServers'
+            ? createActionState(name, enabled)
+            : {
+                enable: { available: false, label: `Enable ${name}`, disabledReason: 'already_enabled' },
+                disable: { available: false, label: `Disable ${name}`, disabledReason: 'already_disabled' },
+            },
         transport,
         secretInputs,
+        instructionOverride: !hasInstructionOverride
+            ? { state: 'upstream' }
+            : instructionOverride === ''
+                ? { state: 'suppress', value: '' }
+                : { state: 'replace', value: instructionOverride },
     };
 }
 const STDIO_TRANSPORT_TYPES = ['stdio'];
@@ -1919,7 +2141,6 @@ const TRANSPORT_FIELD_DEFINITIONS = [
     { key: 'timeout', label: 'Deprecated Timeout', control: 'number' },
     { key: 'connectionTimeout', label: 'Connection Timeout', control: 'number' },
     { key: 'requestTimeout', label: 'Request Timeout', control: 'number' },
-    { key: 'disabledTools', label: 'Disabled Tools', control: 'string-list', defaultValue: [] },
     { key: 'template', label: 'Template', control: 'record', defaultValue: {} },
     {
         key: 'url',