agent-trellis 0.1.0 → 0.3.0

package/dist/pi-bridge/bundle.js

@@ -7818,7 +7818,7 @@ var require_identity = __commonJS({
     var NODE_TYPE = /* @__PURE__ */ Symbol.for("yaml.node.type");
     var isAlias = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === ALIAS;
     var isDocument = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === DOC;
-    var isMap = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === MAP;
+    var isMap2 = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === MAP;
     var isPair = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === PAIR;
     var isScalar = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SCALAR;
     var isSeq = (node2) => !!node2 && typeof node2 === "object" && node2[NODE_TYPE] === SEQ;
@@ -7854,7 +7854,7 @@ var require_identity = __commonJS({
     exports.isAlias = isAlias;
     exports.isCollection = isCollection;
     exports.isDocument = isDocument;
-    exports.isMap = isMap;
+    exports.isMap = isMap2;
     exports.isNode = isNode;
     exports.isPair = isPair;
     exports.isScalar = isScalar;
@@ -11966,9 +11966,9 @@ var require_resolve_flow_collection = __commonJS({
     var blockMsg = "Block collections are not allowed within flow collections";
     var isBlock = (token) => token && (token.type === "block-map" || token.type === "block-seq");
     function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onError, tag) {
-      const isMap = fc.start.source === "{";
-      const fcName = isMap ? "flow map" : "flow sequence";
-      const NodeClass = tag?.nodeClass ?? (isMap ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
+      const isMap2 = fc.start.source === "{";
+      const fcName = isMap2 ? "flow map" : "flow sequence";
+      const NodeClass = tag?.nodeClass ?? (isMap2 ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
       const coll = new NodeClass(ctx.schema);
       coll.flow = true;
       const atRoot = ctx.atRoot;
@@ -12004,7 +12004,7 @@ var require_resolve_flow_collection = __commonJS({
             offset = props.end;
             continue;
           }
-          if (!isMap && ctx.options.strict && utilContainsNewline.containsNewline(key))
+          if (!isMap2 && ctx.options.strict && utilContainsNewline.containsNewline(key))
             onError(
               key,
               // checked by containsNewline()
@@ -12044,7 +12044,7 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep && !props.found) {
+        if (!isMap2 && !sep && !props.found) {
           const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
@@ -12067,7 +12067,7 @@ var require_resolve_flow_collection = __commonJS({
             startOnNewline: false
           });
           if (valueProps.found) {
-            if (!isMap && !props.found && ctx.options.strict) {
+            if (!isMap2 && !props.found && ctx.options.strict) {
               if (sep)
                 for (const st of sep) {
                   if (st === valueProps.found)
@@ -12099,7 +12099,7 @@ var require_resolve_flow_collection = __commonJS({
           const pair = new Pair.Pair(keyNode, valueNode);
           if (ctx.options.keepSourceTokens)
             pair.srcToken = collItem;
-          if (isMap) {
+          if (isMap2) {
             const map = coll;
             if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
               onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
@@ -12115,7 +12115,7 @@ var require_resolve_flow_collection = __commonJS({
           offset = valueNode ? valueNode.range[2] : valueProps.end;
         }
       }
-      const expectedEnd = isMap ? "}" : "]";
+      const expectedEnd = isMap2 ? "}" : "]";
       const [ce, ...ee] = fc.end;
       let cePos = offset;
       if (ce?.source === expectedEnd)
@@ -15016,7 +15016,7 @@ var require_public_api = __commonJS({
         return docs;
       return Object.assign([], { empty: true }, composer$1.streamInfo());
     }
-    function parseDocument(source, options = {}) {
+    function parseDocument2(source, options = {}) {
       const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
       const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
       const composer$1 = new composer.Composer(options);
@@ -15042,7 +15042,7 @@ var require_public_api = __commonJS({
       } else if (options === void 0 && reviver && typeof reviver === "object") {
         options = reviver;
       }
-      const doc = parseDocument(src, options);
+      const doc = parseDocument2(src, options);
       if (!doc)
         return null;
       doc.warnings.forEach((warning) => log.warn(doc.options.logLevel, warning));
@@ -15078,7 +15078,7 @@ var require_public_api = __commonJS({
     }
     exports.parse = parse3;
     exports.parseAllDocuments = parseAllDocuments;
-    exports.parseDocument = parseDocument;
+    exports.parseDocument = parseDocument2;
     exports.stringify = stringify;
   }
 });
@@ -27243,7 +27243,7 @@ import { homedir as homedir2 } from "node:os";
 
 // src/core/canonical.ts
 var import_yaml = __toESM(require_dist2(), 1);
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, join } from "node:path";
 
@@ -27254,11 +27254,16 @@ var ALL_AGENTS = [
   "kiro",
   "pi"
 ];
-function resolveScope(scope) {
-  return scope ?? ALL_AGENTS;
+function resolveScope(scope, managedAgents) {
+  const candidates = scope ?? managedAgents;
+  return candidates.filter((id) => managedAgents.includes(id));
 }
 
 // src/core/canonical.ts
+function fromServerDefYaml(def) {
+  const { static_env, ...rest } = def;
+  return static_env ? { ...rest, staticEnv: static_env } : rest;
+}
 function trellisRoot(homeDir) {
   return join(homeDir, ".trellis");
 }
@@ -27302,8 +27307,9 @@ function loadServersYaml(path) {
     return { servers: {}, knownHostInjected: [] };
   }
   const parsed = (0, import_yaml.parse)(readFileSync(path, "utf-8")) ?? {};
+  const servers = Object.fromEntries(Object.entries(parsed.servers ?? {}).map(([name, def]) => [name, fromServerDefYaml(def)]));
   return {
-    servers: parsed.servers ?? {},
+    servers,
     knownHostInjected: parsed.known_host_injected ?? [],
     hub: parsed.hub
   };
@@ -27319,6 +27325,22 @@ function loadSecretsPolicyYaml(path, homeDir) {
     envFile: parsed.env_file ? parsed.env_file.replace(/^~(?=$|\/)/, homeDir) : void 0
   };
 }
+function loadManagedYaml(path, diagnostics) {
+  if (!existsSync(path)) {
+    return [];
+  }
+  const parsed = (0, import_yaml.parse)(readFileSync(path, "utf-8")) ?? {};
+  const raw = parsed.agents ?? [];
+  const valid = [];
+  for (const id of raw) {
+    if (ALL_AGENTS.includes(id)) {
+      valid.push(id);
+    } else {
+      diagnostics.push(`managed.yaml: "${id}" is not a recognized agent id \u2014 ignored`);
+    }
+  }
+  return valid;
+}
 function scopeFor(map, name) {
   return map?.[name];
 }
@@ -27334,6 +27356,7 @@ function loadCanonicalSource(homeDir = homedir()) {
     );
   }
   const diagnostics = [];
+  const managedAgents = loadManagedYaml(join(root, "managed.yaml"), diagnostics);
   const scopeYaml = loadScopeYaml(join(root, "scope.yaml"));
   const skillDirs = listSkillDirs(join(root, "skills"));
   const knownSkillNames = new Set(skillDirs.map((s) => s.name));
@@ -27368,6 +27391,7 @@ function loadCanonicalSource(homeDir = homedir()) {
   }
   return {
     instructionsFile: join(root, "agents.md"),
+    managedAgents,
     skills,
     agents,
     memories,
@@ -27381,8 +27405,8 @@ function loadCanonicalSource(homeDir = homedir()) {
 }
 
 // src/core/adapter.ts
-function isInScope(id, scope) {
-  return resolveScope(scope).includes(id);
+function isInScope(id, scope, managedAgents) {
+  return resolveScope(scope, managedAgents).includes(id);
 }
 
 // src/lib/tomlSection.ts
@@ -27397,6 +27421,33 @@ function codexBearerTokenEnvVar(def) {
   return BEARER_TOKEN_VALUE_RE.exec(value)?.[1];
 }
 
+// src/lib/secretEnv.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+var LINE_RE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+function parseDotenv(content) {
+  const result = {};
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    const match = LINE_RE.exec(line);
+    if (match) result[match[1]] = match[2];
+  }
+  return result;
+}
+function loadEnvFile(path) {
+  return existsSync2(path) ? parseDotenv(readFileSync2(path, "utf-8")) : {};
+}
+function resolveSecretEnv(names, policy) {
+  const result = {};
+  if (policy.envFile) {
+    const map = loadEnvFile(policy.envFile);
+    for (const name of names) result[name] = map[name];
+  } else {
+    for (const name of names) result[name] = process.env[name];
+  }
+  return result;
+}
+
 // src/adapters/mcpPlan.ts
 var HUB_ENTRY_NAME = "trellis-hub";
 var CODEX_STDIO_URL_CRASH_NOTE = ' On Codex specifically, this crashes the entire process at startup ("url is not supported for stdio"), not just this one server \u2014 see docs/research.md.';
@@ -27410,7 +27461,9 @@ var DANGEROUS_LITERAL_PATTERNS = [
   { label: "mcp-router token (mcpr_)", pattern: /mcpr_/ }
 ];
 function findLiteralSecret(def) {
-  const candidates = [def.command, def.url, ...def.args ?? [], ...Object.values(def.headers ?? {})].filter((v) => typeof v === "string");
+  const candidates = [def.command, def.url, ...def.args ?? [], ...Object.values(def.headers ?? {}), ...Object.values(def.staticEnv ?? {})].filter(
+    (v) => typeof v === "string"
+  );
   for (const candidate of candidates) {
     for (const { label, pattern } of DANGEROUS_LITERAL_PATTERNS) {
       if (pattern.test(candidate)) {
@@ -27420,7 +27473,13 @@ function findLiteralSecret(def) {
   }
   return void 0;
 }
-function resolveMcpPlan(agentId, mcp) {
+function findUnresolvedEnvName(def, policy) {
+  const names = def.env ?? [];
+  if (names.length === 0) return void 0;
+  const resolved = resolveSecretEnv(names, policy);
+  return names.find((name) => !resolved[name]);
+}
+function resolveMcpPlan(agentId, mcp, managedAgents, policy) {
   if (mcp.hub) {
     if (mcp.knownHostInjected.includes(HUB_ENTRY_NAME)) {
       return { desired: [], conflicts: [{ name: HUB_ENTRY_NAME, message: collisionMessage(HUB_ENTRY_NAME, agentId) }] };
@@ -27430,7 +27489,10 @@ function resolveMcpPlan(agentId, mcp) {
   const desired = [];
   const conflicts = [];
   for (const [name, def] of Object.entries(mcp.servers)) {
-    if (!isInScope(agentId, def.agents)) {
+    if (def.enabled === false) {
+      continue;
+    }
+    if (!isInScope(agentId, def.agents, managedAgents)) {
       continue;
     }
     if (mcp.knownHostInjected.includes(name)) {
@@ -27452,38 +27514,20 @@ function resolveMcpPlan(agentId, mcp) {
       });
       continue;
     }
+    const unresolvedName = findUnresolvedEnvName(def, policy);
+    if (unresolvedName) {
+      const source = policy.envFile ?? "process environment";
+      conflicts.push({
+        name,
+        message: `refusing to write MCP server "${name}": its declared env var "${unresolvedName}" has no resolvable value in ${source} \u2014 writing it now would silently break this server's connection once the agent starts it (trellis-mcp-static-env-and-disabled-servers)`
+      });
+      continue;
+    }
     desired.push({ name, def });
   }
   return { desired, conflicts };
 }
 
-// src/lib/secretEnv.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-var LINE_RE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
-function parseDotenv(content) {
-  const result = {};
-  for (const rawLine of content.split("\n")) {
-    const line = rawLine.trim();
-    if (line === "" || line.startsWith("#")) continue;
-    const match = LINE_RE.exec(line);
-    if (match) result[match[1]] = match[2];
-  }
-  return result;
-}
-function loadEnvFile(path) {
-  return existsSync2(path) ? parseDotenv(readFileSync2(path, "utf-8")) : {};
-}
-function resolveSecretEnv(names, policy) {
-  const result = {};
-  if (policy.envFile) {
-    const map = loadEnvFile(policy.envFile);
-    for (const name of names) result[name] = map[name];
-  } else {
-    for (const name of names) result[name] = process.env[name];
-  }
-  return result;
-}
-
 // src/lib/envVarNames.ts
 var TEMPLATE_VAR_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function extractTemplateVarNames(value) {
@@ -31955,7 +31999,12 @@ async function connectStdio(def, secretsPolicy, timeoutMs) {
   const transport = new StdioClientTransport({
     command: def.command,
     args: def.args,
-    env: { ...getDefaultEnvironment(), ...namedEnv }
+    // staticEnv merges last: a literal, intentionally-plain value (an
+    // email, an environment tag) always wins over an unresolved name-only
+    // entry's empty-string fallback for the same key — though in practice
+    // resolveMcpPlan's D6 refusal never lets an unresolved name reach
+    // this point at all (trellis-mcp-static-env-and-disabled-servers).
+    env: { ...getDefaultEnvironment(), ...namedEnv, ...def.staticEnv ?? {} }
   });
   return connectWithCleanup(client, transport, timeoutMs, `connect timed out after ${timeoutMs}ms`);
 }
@@ -32010,7 +32059,7 @@ function registerServerTools(pi, serverName, client, timeoutMs) {
 }
 async function trellisMcpBridge(pi, homeDir = homedir2(), connectTimeoutMs = DEFAULT_CONNECT_TIMEOUT_MS) {
   const canonical = loadCanonicalSource(homeDir);
-  const { desired } = resolveMcpPlan("pi", canonical.mcp);
+  const { desired } = resolveMcpPlan("pi", canonical.mcp, ALL_AGENTS, canonical.secretsPolicy);
   const clients = /* @__PURE__ */ new Set();
   const closeClient = async (client) => {
     if (!clients.delete(client)) return;

package/dist/pi-bridge/index.js

@@ -20,6 +20,7 @@ import { loadCanonicalSource } from "../core/canonical.js";
 import { resolveMcpPlan } from "../adapters/mcpPlan.js";
 import { resolveSecretEnv } from "../lib/secretEnv.js";
 import { extractTemplateVarNames } from "../lib/envVarNames.js";
+import { ALL_AGENTS } from "../core/types.js";
 import { bridgedToolName, toParametersSchema, toPiContent } from "./schemaTranslate.js";
 const CLIENT_INFO = { name: "trellis-mcp-bridge", version: "0.0.0" };
 const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
@@ -74,7 +75,12 @@ async function connectStdio(def, secretsPolicy, timeoutMs) {
     const transport = new StdioClientTransport({
         command: def.command,
         args: def.args,
-        env: { ...getDefaultEnvironment(), ...namedEnv },
+        // staticEnv merges last: a literal, intentionally-plain value (an
+        // email, an environment tag) always wins over an unresolved name-only
+        // entry's empty-string fallback for the same key — though in practice
+        // resolveMcpPlan's D6 refusal never lets an unresolved name reach
+        // this point at all (trellis-mcp-static-env-and-disabled-servers).
+        env: { ...getDefaultEnvironment(), ...namedEnv, ...(def.staticEnv ?? {}) },
     });
     return connectWithCleanup(client, transport, timeoutMs, `connect timed out after ${timeoutMs}ms`);
 }
@@ -128,7 +134,13 @@ function registerServerTools(pi, serverName, client, timeoutMs) {
  */
 export default async function trellisMcpBridge(pi, homeDir = homedir(), connectTimeoutMs = DEFAULT_CONNECT_TIMEOUT_MS) {
     const canonical = loadCanonicalSource(homeDir);
-    const { desired } = resolveMcpPlan("pi", canonical.mcp);
+    // Deliberately ALL_AGENTS, not canonical.managedAgents: this bridge only
+    // ever runs because pi itself loaded the extension — that's already the
+    // strongest possible consent signal (trellis-managed-agents design.md),
+    // independent of whether `trellis onboard` was ever run to add pi to
+    // managed.yaml. managedAgents governs static config-file writes; this
+    // is pi reading canonical directly at its own runtime, P4's own concern.
+    const { desired } = resolveMcpPlan("pi", canonical.mcp, ALL_AGENTS, canonical.secretsPolicy);
     const clients = new Set();
     const closeClient = async (client) => {
         if (!clients.delete(client))

package/dist/probes/codex.js

@@ -36,16 +36,24 @@ export async function probe(homeDir = homedir(), opts = {}) {
         return { agent: "codex", present: false, skillRoots: [], mcpServers: [], diagnostics: [] };
     }
     const diagnostics = [];
+    // `codex` resolves its own config via $HOME (confirmed by running it with
+    // an overridden HOME against an empty scratch dir — it returns `[]`, not
+    // the real machine's servers), so every subprocess call here must be
+    // scoped to `homeDir` explicitly — otherwise a caller probing a non-
+    // default `homeDir` would silently get this real machine's real MCP
+    // server list instead (trellis-migrate-mcp-servers found this gap in
+    // src/lib/mcpMigrateRead.ts's own equivalent call; fixed there first).
+    const codexEnv = { ...process.env, HOME: homeDir };
     let version;
     try {
-        version = execFileSync("codex", ["--version"], { encoding: "utf-8", timeout: 5_000 }).trim();
+        version = execFileSync("codex", ["--version"], { encoding: "utf-8", timeout: 5_000, env: codexEnv }).trim();
     }
     catch {
         // config exists without the binary on PATH — unusual, still probeable
     }
     let mcpEntries = [];
     try {
-        const raw = execFileSync("codex", ["mcp", "list", "--json"], { encoding: "utf-8", timeout: 5_000 });
+        const raw = execFileSync("codex", ["mcp", "list", "--json"], { encoding: "utf-8", timeout: 5_000, env: codexEnv });
         mcpEntries = JSON.parse(raw);
     }
     catch (err) {

package/docs/architecture.md

@@ -45,10 +45,13 @@ Aligned to the `.agents Protocol` draft, extended where the draft is silent:
 ├── memories/*.md             # shared memory entries (server-memory backed)
 ├── scope.yaml                 # exceptions to "shared with all agents" —
 │                             # see "Private / agent-specific capabilities"
-├── secrets.policy.yaml       # which var names are allowed, nothing else
-└── trellis.lock.json         # NOT YET BUILT — planned ownership-tracking
-                              # file for MCP removal (docs/roadmap.md's P2
-                              # note); nothing in src/ reads or writes this
+└── secrets.policy.yaml       # which var names are allowed, nothing else
+
+# Not user-authored, so not shown in the tree above — Trellis's own
+# bookkeeping, written/read only by `trellis mcp sync` itself:
+#   mcp/ownership.json  # what Trellis last wrote per (agent, server name) —
+#                       # the ownership marker MCP removal needed
+#                       # (docs/roadmap.md P14, src/lib/mcpOwnership.ts)
 ```
 
 ## Global vs. workspace scope