@codemcp/ade 0.4.0 → 0.6.0

package/packages/core/src/writers/mcp-server.spec.ts

@@ -0,0 +1,62 @@
+import { describe, it, expect } from "vitest";
+import { mcpServerWriter } from "./mcp-server.js";
+import type { ResolutionContext } from "../types.js";
+
+describe("mcpServerWriter", () => {
+  const context: ResolutionContext = { resolved: {} };
+
+  it("has id 'mcp-server'", () => {
+    expect(mcpServerWriter.id).toBe("mcp-server");
+  });
+
+  it("returns mcp_servers with correct ref, command, args, and env", async () => {
+    const result = await mcpServerWriter.write(
+      {
+        ref: "my-server",
+        command: "npx",
+        args: ["my-mcp-package"],
+        env: { KEY: "value" }
+      },
+      context
+    );
+    expect(result).toEqual({
+      mcp_servers: [
+        {
+          ref: "my-server",
+          command: "npx",
+          args: ["my-mcp-package"],
+          env: { KEY: "value" }
+        }
+      ]
+    });
+  });
+
+  it("defaults env to an empty object when not specified", async () => {
+    const result = await mcpServerWriter.write(
+      { ref: "my-server", command: "npx", args: ["my-mcp-package"] },
+      context
+    );
+    expect(result.mcp_servers![0].env).toEqual({});
+  });
+
+  it("includes allowedTools when specified", async () => {
+    const result = await mcpServerWriter.write(
+      {
+        ref: "my-server",
+        command: "npx",
+        args: ["my-mcp-package"],
+        allowedTools: ["tool_a", "tool_b"]
+      },
+      context
+    );
+    expect(result.mcp_servers![0].allowedTools).toEqual(["tool_a", "tool_b"]);
+  });
+
+  it("omits allowedTools from entry when not specified", async () => {
+    const result = await mcpServerWriter.write(
+      { ref: "my-server", command: "npx", args: ["my-mcp-package"] },
+      context
+    );
+    expect(result.mcp_servers![0]).not.toHaveProperty("allowedTools");
+  });
+});

package/packages/core/src/writers/mcp-server.ts

@@ -0,0 +1,25 @@
+import type { ProvisionWriterDef } from "../types.js";
+
+export const mcpServerWriter: ProvisionWriterDef = {
+  id: "mcp-server",
+  async write(config) {
+    const { ref, command, args, env, allowedTools } = config as {
+      ref: string;
+      command: string;
+      args: string[];
+      env?: Record<string, string>;
+      allowedTools?: string[];
+    };
+    return {
+      mcp_servers: [
+        {
+          ref,
+          command,
+          args,
+          env: env ?? {},
+          ...(allowedTools !== undefined ? { allowedTools } : {})
+        }
+      ]
+    };
+  }
+};

package/packages/core/src/writers/workflows.spec.ts

@@ -59,6 +59,28 @@ describe("workflowsWriter", () => {
     expect(result.mcp_servers![0].env).toEqual({});
   });
 
+  it("includes allowedTools in the entry when specified", async () => {
+    const result = await workflowsWriter.write(
+      {
+        package: "@codemcp/workflows-server",
+        allowedTools: ["whats_next", "conduct_review"]
+      },
+      context
+    );
+    expect(result.mcp_servers![0].allowedTools).toEqual([
+      "whats_next",
+      "conduct_review"
+    ]);
+  });
+
+  it("omits allowedTools from entry when not specified", async () => {
+    const result = await workflowsWriter.write(
+      { package: "@codemcp/workflows-server" },
+      context
+    );
+    expect(result.mcp_servers![0]).not.toHaveProperty("allowedTools");
+  });
+
   it("only returns mcp_servers, not other LogicalConfig keys", async () => {
     const result = await workflowsWriter.write(
       { package: "@codemcp/workflows-server" },

package/packages/core/src/writers/workflows.ts

@@ -6,11 +6,13 @@ export const workflowsWriter: ProvisionWriterDef = {
     const {
       package: pkg,
       ref,
-      env
+      env,
+      allowedTools
     } = config as {
       package: string;
       ref?: string;
       env?: Record<string, string>;
+      allowedTools?: string[];
     };
     return {
       mcp_servers: [
@@ -18,7 +20,8 @@ export const workflowsWriter: ProvisionWriterDef = {
           ref: ref ?? pkg,
           command: "npx",
           args: [pkg],
-          env: env ?? {}
+          env: env ?? {},
+          ...(allowedTools !== undefined ? { allowedTools } : {})
         }
       ]
     };

package/packages/harnesses/package.json

@@ -40,5 +40,5 @@
     "typescript": "catalog:",
     "vitest": "catalog:"
   },
-  "version": "0.4.0"
+  "version": "0.6.0"
 }

package/packages/harnesses/src/index.spec.ts

@@ -1,5 +1,11 @@
 import { describe, it, expect } from "vitest";
-import { allHarnessWriters, getHarnessWriter, getHarnessIds } from "./index.js";
+import {
+  allHarnessWriters,
+  getHarnessWriter,
+  getHarnessIds,
+  buildHarnessWriters
+} from "./index.js";
+import type { HarnessWriter } from "./types.js";
 
 describe("harness registry", () => {
   it("exports all harness writers", () => {
@@ -43,3 +49,44 @@ describe("harness registry", () => {
     }
   });
 });
+
+describe("buildHarnessWriters", () => {
+  it("returns all built-in writers when no extensions provided", () => {
+    const writers = buildHarnessWriters({});
+    expect(writers).toHaveLength(allHarnessWriters.length);
+    expect(writers.map((w) => w.id)).toEqual(
+      allHarnessWriters.map((w) => w.id)
+    );
+  });
+
+  it("appends extension harness writers after built-ins", () => {
+    const customWriter: HarnessWriter = {
+      id: "sap-copilot",
+      label: "SAP Copilot",
+      description: "SAP internal Copilot harness",
+      install: async () => {}
+    };
+
+    const writers = buildHarnessWriters({ harnessWriters: [customWriter] });
+    expect(writers).toHaveLength(allHarnessWriters.length + 1);
+    expect(writers.map((w) => w.id)).toContain("sap-copilot");
+    // built-ins come first
+    expect(writers[0].id).toBe("universal");
+    expect(writers[writers.length - 1].id).toBe("sap-copilot");
+  });
+
+  it("does not mutate allHarnessWriters", () => {
+    const originalLength = allHarnessWriters.length;
+    buildHarnessWriters({
+      harnessWriters: [
+        {
+          id: "ephemeral",
+          label: "Ephemeral",
+          description: "Should not persist",
+          install: async () => {}
+        }
+      ]
+    });
+    expect(allHarnessWriters).toHaveLength(originalLength);
+  });
+});

package/packages/harnesses/src/index.ts

@@ -45,3 +45,13 @@ export function getHarnessWriter(id: string): HarnessWriter | undefined {
 export function getHarnessIds(): string[] {
   return allHarnessWriters.map((w) => w.id);
 }
+
+/**
+ * Returns the full list of harness writers: built-ins first, then any
+ * additional writers contributed via extensions. Does not mutate allHarnessWriters.
+ */
+export function buildHarnessWriters(extensions: {
+  harnessWriters?: HarnessWriter[];
+}): HarnessWriter[] {
+  return [...allHarnessWriters, ...(extensions.harnessWriters ?? [])];
+}

package/packages/harnesses/src/writers/copilot.spec.ts

@@ -198,12 +198,8 @@ describe("copilotWriter", () => {
     expect(sensibleAgent).not.toContain("  - execute");
     expect(sensibleAgent).not.toContain("  - todo");
     expect(sensibleAgent).not.toContain("  - web");
-    expect(sensibleAgent).toContain("  - workflows/whats_next");
-    expect(sensibleAgent).toContain("  - workflows/proceed_to_phase");
-    expect(sensibleAgent).not.toContain("  - workflows/*");
-    expect(sensibleAgent).toContain(
-      '    tools: ["whats_next","proceed_to_phase"]'
-    );
+    expect(sensibleAgent).toContain("  - workflows/*");
+    expect(sensibleAgent).toContain('    tools: ["*"]');
 
     expect(maxAgent).toContain("  - read");
     expect(maxAgent).toContain("  - edit");

package/packages/harnesses/src/writers/copilot.ts

@@ -56,14 +56,7 @@ function getBuiltInTools(profile: AutonomyProfile | undefined): string[] {
 }
 
 function getForwardedMcpTools(servers: McpServerEntry[]): string[] {
-  return servers.flatMap((server) => {
-    const allowedTools = server.allowedTools ?? ["*"];
-    if (allowedTools.includes("*")) {
-      return [`${server.ref}/*`];
-    }
-
-    return allowedTools.map((tool) => `${server.ref}/${tool}`);
-  });
+  return servers.map((server) => `${server.ref}/*`);
 }
 
 function renderCopilotAgentMcpServers(servers: McpServerEntry[]): string[] {
@@ -78,7 +71,7 @@ function renderCopilotAgentMcpServers(servers: McpServerEntry[]): string[] {
     lines.push("    type: stdio");
     lines.push(`    command: ${JSON.stringify(server.command)}`);
     lines.push(`    args: ${JSON.stringify(server.args)}`);
-    lines.push(`    tools: ${JSON.stringify(server.allowedTools ?? ["*"])}`);
+    lines.push(`    tools: ${JSON.stringify(["*"])}`);
 
     if (Object.keys(server.env).length > 0) {
       lines.push("    env:");

package/packages/harnesses/src/writers/kiro.spec.ts

@@ -186,4 +186,36 @@ describe("kiroWriter", () => {
     expect(rigidMcp.mcpServers.workflows.autoApprove).toEqual(["*"]);
     expect(maxMcp.mcpServers.workflows.autoApprove).toEqual(["*"]);
   });
+
+  it("uses wildcard in tools but restricted names in allowedTools when allowedTools is set", async () => {
+    const config: LogicalConfig = {
+      mcp_servers: [
+        {
+          ref: "workflows",
+          command: "npx",
+          args: ["-y", "@codemcp/workflows"],
+          env: {},
+          allowedTools: ["whats_next", "conduct_review"]
+        }
+      ],
+      instructions: [],
+      cli_actions: [],
+      knowledge_sources: [],
+      skills: [],
+      git_hooks: [],
+      setup_notes: []
+    };
+
+    await kiroWriter.install(config, dir);
+
+    const agent = JSON.parse(
+      await readFile(join(dir, ".kiro", "agents", "ade.json"), "utf-8")
+    );
+
+    expect(agent.tools).toContain("@workflows/*");
+    expect(agent.tools).not.toContain("@workflows/whats_next");
+    expect(agent.allowedTools).toContain("@workflows/whats_next");
+    expect(agent.allowedTools).toContain("@workflows/conduct_review");
+    expect(agent.allowedTools).not.toContain("@workflows/*");
+  });
 });

package/packages/harnesses/src/writers/kiro.ts

@@ -27,6 +27,10 @@ export const kiroWriter: HarnessWriter = {
     });
 
     const tools = getKiroTools(getAutonomyProfile(config), config.mcp_servers);
+    const allowedTools = getKiroAllowedTools(
+      getAutonomyProfile(config),
+      config.mcp_servers
+    );
     await writeJson(join(projectRoot, ".kiro", "agents", "ade.json"), {
       name: "ade",
       description:
@@ -36,7 +40,7 @@ export const kiroWriter: HarnessWriter = {
         "ADE — Agentic Development Environment agent.",
       mcpServers: getKiroAgentMcpServers(config.mcp_servers),
       tools,
-      allowedTools: tools,
+      allowedTools,
       useLegacyMcpJson: true
     });
 
@@ -48,7 +52,7 @@ function getKiroTools(
   profile: AutonomyProfile | undefined,
   servers: McpServerEntry[]
 ): string[] {
-  const mcpTools = getKiroForwardedMcpTools(servers);
+  const mcpTools = servers.map((server) => `@${server.ref}/*`);
 
   switch (profile) {
     case "rigid":
@@ -62,15 +66,28 @@ function getKiroTools(
   }
 }
 
-function getKiroForwardedMcpTools(servers: McpServerEntry[]): string[] {
-  return servers.flatMap((server) => {
+function getKiroAllowedTools(
+  profile: AutonomyProfile | undefined,
+  servers: McpServerEntry[]
+): string[] {
+  const mcpAllowedTools = servers.flatMap((server) => {
     const allowedTools = server.allowedTools ?? ["*"];
     if (allowedTools.includes("*")) {
       return [`@${server.ref}/*`];
     }
-
     return allowedTools.map((tool) => `@${server.ref}/${tool}`);
   });
+
+  switch (profile) {
+    case "rigid":
+      return ["read", "shell", "spec", ...mcpAllowedTools];
+    case "sensible-defaults":
+      return ["read", "write", "shell", "spec", ...mcpAllowedTools];
+    case "max-autonomy":
+      return ["read", "write", "shell(*)", "spec", ...mcpAllowedTools];
+    default:
+      return ["read", "write", "shell", "spec", ...mcpAllowedTools];
+  }
 }
 
 function getKiroAgentMcpServers(

package/packages/harnesses/src/writers/opencode.spec.ts

@@ -148,6 +148,72 @@ describe("opencodeWriter", () => {
     expect(rigidAgent).not.toContain("tools:");
   });
 
+  it("writes allowed MCP tools into the permission block of the agent frontmatter", async () => {
+    const projectRoot = join(dir, "mcp-tools");
+    const config: LogicalConfig = {
+      mcp_servers: [
+        {
+          ref: "workflows",
+          command: "npx",
+          args: ["@codemcp/workflows-server@latest"],
+          env: {},
+          allowedTools: ["whats_next", "conduct_review"]
+        }
+      ],
+      instructions: ["Follow project rules."],
+      cli_actions: [],
+      knowledge_sources: [],
+      skills: [],
+      git_hooks: [],
+      setup_notes: []
+    };
+
+    await opencodeWriter.install(config, projectRoot);
+
+    const agent = await readFile(
+      join(projectRoot, ".opencode", "agents", "ade.md"),
+      "utf-8"
+    );
+    const frontmatter = parseFrontmatter(agent);
+    const permission = frontmatter.permission as Record<string, string>;
+
+    expect(permission["workflows*"]).toBe("ask");
+    expect(permission["workflows_whats_next"]).toBe("allow");
+    expect(permission["workflows_conduct_review"]).toBe("allow");
+    expect(agent).not.toContain("tools:");
+  });
+
+  it("writes wildcard MCP permission when allowedTools is not restricted", async () => {
+    const projectRoot = join(dir, "mcp-wildcard");
+    const config: LogicalConfig = {
+      mcp_servers: [
+        {
+          ref: "workflows",
+          command: "npx",
+          args: ["@codemcp/workflows-server@latest"],
+          env: {}
+        }
+      ],
+      instructions: ["Follow project rules."],
+      cli_actions: [],
+      knowledge_sources: [],
+      skills: [],
+      git_hooks: [],
+      setup_notes: []
+    };
+
+    await opencodeWriter.install(config, projectRoot);
+
+    const agent = await readFile(
+      join(projectRoot, ".opencode", "agents", "ade.md"),
+      "utf-8"
+    );
+    const frontmatter = parseFrontmatter(agent);
+    const permission = frontmatter.permission as Record<string, string>;
+
+    expect(permission["workflows*"]).toBe("allow");
+  });
+
   it("keeps MCP servers in project config and writes documented environment fields", async () => {
     const projectRoot = join(dir, "mcp");
     const config = {

package/packages/harnesses/src/writers/opencode.ts

@@ -1,5 +1,9 @@
 import { join } from "node:path";
-import type { AutonomyProfile, LogicalConfig } from "@codemcp/ade-core";
+import type {
+  AutonomyProfile,
+  LogicalConfig,
+  McpServerEntry
+} from "@codemcp/ade-core";
 import type { HarnessWriter } from "../types.js";
 import {
   writeAgentMd,
@@ -138,6 +142,24 @@ const MAX_AUTONOMY_RULES: Record<string, PermissionRule> = {
   doom_loop: "deny"
 };
 
+function getMcpPermissions(
+  servers: McpServerEntry[]
+): Record<string, PermissionRule> | undefined {
+  const entries: [string, PermissionRule][] = servers.flatMap((server) => {
+    const allowedTools = server.allowedTools ?? ["*"];
+    if (allowedTools.includes("*")) {
+      return [[`${server.ref}*`, "allow"]] as [string, PermissionRule][];
+    }
+    return [
+      [`${server.ref}*`, "ask"] as [string, PermissionRule],
+      ...allowedTools.map(
+        (tool) => [`${server.ref}_${tool}`, "allow"] as [string, PermissionRule]
+      )
+    ];
+  });
+  return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
+
 function getPermissionRules(
   profile: AutonomyProfile | undefined
 ): Record<string, PermissionRule> | undefined {
@@ -170,11 +192,16 @@ export const opencodeWriter: HarnessWriter = {
     });
 
     const permission = getPermissionRules(getAutonomyProfile(config));
+    const mcpPermissions = getMcpPermissions(config.mcp_servers);
+    const mergedPermission =
+      permission || mcpPermissions
+        ? { ...(mcpPermissions ?? {}), ...(permission ?? {}) }
+        : undefined;
 
     await writeAgentMd(config, {
       path: join(projectRoot, ".opencode", "agents", "ade.md"),
-      extraFrontmatter: permission
-        ? renderYamlMapping("permission", permission)
+      extraFrontmatter: mergedPermission
+        ? renderYamlMapping("permission", mergedPermission)
         : undefined,
       fallbackBody:
         "ADE — Agentic Development Environment agent with project conventions and tools."

package/pnpm-workspace.yaml

@@ -17,3 +17,5 @@ catalog:
   rimraf: "^6.1.3"
   tsx: "^4.19.0"
   tsup: "^8.3.0"
+  # Runtime
+  zod: "4.3.6"