agent-trellis 0.10.0 → 0.12.0

package/dist/commands/skill.d.ts

@@ -1,5 +1,5 @@
 /**
- * `trellis skill list|add|remove` — command-line CRUD for canonical
+ * `trellis skill list|add|remove|scope` — command-line CRUD for canonical
  * skills (trellis-canonical-cli-crud), an alternative to hand-editing
  * `~/.trellis/skills/<name>/SKILL.md` directly. `add`'s conflict
  * decision and `remove`'s "sync will un-sync it" behavior both reuse
@@ -10,6 +10,7 @@
 import type { AgentId } from "../core/types.js";
 import { type BackupSession } from "../lib/backup.js";
 import type { SyncReport } from "./sync.js";
+import { type ScopeSelectorRaw } from "../lib/scopeSelection.js";
 import type { RemoteSkillLockEntry } from "../lib/remoteSkillLock.js";
 export type BuiltinSkillUpdateAction = "create" | "update" | "already-current";
 export interface BuiltinSkillUpdatePlan {
@@ -97,3 +98,46 @@ export declare function runSkillRemove(name: string, opts?: {
 }): Promise<{
     exitCode: number;
 }>;
+export type SkillScopeAction = "updated" | "already-set" | "not-found" | "invalid-input";
+export interface SkillScopePlan {
+    name: string;
+    action: SkillScopeAction;
+    detail: string;
+    /** What will be recorded in `scope.yaml`; `undefined` clears the explicit
+     * scope so the skill reaches every managed agent. Set when the selection was
+     * valid, whatever the action. */
+    scope?: AgentId[];
+    mode?: "all" | "none" | "explicit";
+    /** True when a full selection was dropped instead of recorded
+     * (trellis-scope-editing-and-auth-status design.md D3). */
+    normalizedFromFull?: boolean;
+    /** The agents that will actually receive the skill afterwards. */
+    effective?: readonly AgentId[];
+}
+/**
+ * `skill scope <name> --agents a,b | --all | --none`
+ * (trellis-scope-editing-and-auth-status tasks.md 1.1). Plan only — the write
+ * and the cascade sync live in `applySkillScopeWithSync`.
+ */
+export declare function collectSkillScopePlan(name: string | undefined, raw: ScopeSelectorRaw, homeDir?: string): SkillScopePlan;
+export interface SkillScopeOutcome {
+    plan: SkillScopePlan;
+    writeError?: string;
+    sync?: SyncReport;
+}
+/** Write inside a backup session so `trellis rollback` covers it, then the
+ * same skills sync `add` / `remove` run — narrowing is converged by
+ * `symlinkPlan`'s existing "canonical entry gone or scoped away" removal
+ * (design.md D5). */
+export declare function applySkillScopeWithSync(plan: SkillScopePlan, opts?: {
+    homeDir?: string;
+    dryRun?: boolean;
+    backupSession?: BackupSession;
+}): Promise<SkillScopeOutcome>;
+export declare function runSkillScope(name: string | undefined, raw: ScopeSelectorRaw, opts?: {
+    homeDir?: string;
+    json?: boolean;
+    dryRun?: boolean;
+}): Promise<{
+    exitCode: number;
+}>;

package/dist/commands/skill.js

@@ -1,5 +1,5 @@
 /**
- * `trellis skill list|add|remove` — command-line CRUD for canonical
+ * `trellis skill list|add|remove|scope` — command-line CRUD for canonical
  * skills (trellis-canonical-cli-crud), an alternative to hand-editing
  * `~/.trellis/skills/<name>/SKILL.md` directly. `add`'s conflict
  * decision and `remove`'s "sync will un-sync it" behavior both reuse
@@ -14,12 +14,13 @@ import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { decideDirImport } from "../lib/dirEquals.js";
 import { findSkillFile } from "../lib/skillFile.js";
-import { loadCanonicalSource } from "../core/canonical.js";
+import { loadCanonicalSource, writeSkillScopeYaml } from "../core/canonical.js";
 import { resolveScope } from "../core/types.js";
 import { isBuiltinSkillName } from "../lib/builtinSkills.js";
 import { openBackupSession } from "../lib/backup.js";
 import { collectSyncReport, printReport as printSyncReport } from "./sync.js";
 import { remoteSkillProvenance } from "./remoteSkill.js";
+import { describeScope, resolveScopeSelection, sameScope } from "../lib/scopeSelection.js";
 function builtinSkillTemplate() {
     const here = dirname(fileURLToPath(import.meta.url));
     return readFileSync(join(here, "..", "..", "schema", "builtin-skills", "trellis-runtime", "SKILL.md"), "utf8");
@@ -205,3 +206,83 @@ export async function runSkillRemove(name, opts = {}) {
     const syncConflict = syncReport?.reports.some((r) => r.items.some((i) => i.action === "conflict")) ?? false;
     return { exitCode: failed || syncConflict ? 1 : 0 };
 }
+/**
+ * `skill scope <name> --agents a,b | --all | --none`
+ * (trellis-scope-editing-and-auth-status tasks.md 1.1). Plan only — the write
+ * and the cascade sync live in `applySkillScopeWithSync`.
+ */
+export function collectSkillScopePlan(name, raw, homeDir = homedir()) {
+    if (!name)
+        return { name: "(none)", action: "invalid-input", detail: "usage: trellis skill scope <name> --agents <ids> | --all | --none" };
+    if (isBuiltinSkillName(name)) {
+        return { name, action: "invalid-input", detail: `"${name}" is a Trellis package-owned Skill — its scope is not editable` };
+    }
+    const canonical = loadCanonicalSource(homeDir);
+    const selection = resolveScopeSelection(raw, canonical.managedAgents);
+    if (!selection.ok)
+        return { name, action: "invalid-input", detail: selection.detail };
+    const skill = canonical.skills.find((candidate) => candidate.name === name);
+    if (!skill)
+        return { name, action: "not-found", detail: `no canonical skill named "${name}"` };
+    const base = {
+        name,
+        scope: selection.scope,
+        mode: selection.mode,
+        normalizedFromFull: selection.normalizedFromFull,
+        effective: resolveScope(selection.scope, canonical.managedAgents),
+    };
+    const summary = describeScope(selection.scope, canonical.managedAgents);
+    const normalized = selection.normalizedFromFull ? " (every managed agent selected — recorded as the default, so a newly managed agent is included)" : "";
+    if (sameScope(skill.scope, selection.scope)) {
+        return { ...base, action: "already-set", detail: `scope is already ${summary}` };
+    }
+    return { ...base, action: "updated", detail: `set scope to ${summary}${normalized}` };
+}
+/** Write inside a backup session so `trellis rollback` covers it, then the
+ * same skills sync `add` / `remove` run — narrowing is converged by
+ * `symlinkPlan`'s existing "canonical entry gone or scoped away" removal
+ * (design.md D5). */
+export async function applySkillScopeWithSync(plan, opts = {}) {
+    const homeDir = opts.homeDir ?? homedir();
+    const ownSession = !opts.dryRun && !opts.backupSession && plan.action === "updated" ? openBackupSession(homeDir, "skill-scope") : undefined;
+    const session = opts.backupSession ?? ownSession;
+    let writeError;
+    if (!opts.dryRun && plan.action === "updated") {
+        const result = writeSkillScopeYaml(join(homeDir, ".trellis", "scope.yaml"), plan.name, plan.scope, session);
+        if (!result.ok)
+            writeError = result.error;
+    }
+    ownSession?.finalize();
+    let syncReport;
+    if (!writeError && plan.action === "updated" && existsSync(join(homeDir, ".trellis"))) {
+        syncReport = await collectSyncReport({ target: "skills", homeDir, dryRun: opts.dryRun });
+    }
+    return { plan, ...(writeError ? { writeError } : {}), ...(syncReport ? { sync: syncReport } : {}) };
+}
+export async function runSkillScope(name, raw, opts = {}) {
+    const homeDir = opts.homeDir ?? homedir();
+    let outcome;
+    try {
+        outcome = await applySkillScopeWithSync(collectSkillScopePlan(name, raw, homeDir), { homeDir, dryRun: opts.dryRun });
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        return { exitCode: 1 };
+    }
+    const { plan, writeError, sync: syncReport } = outcome;
+    if (opts.json) {
+        const payload = writeError ? { ...plan, writeError } : plan;
+        console.log(JSON.stringify(syncReport ? { ...payload, sync: syncReport } : payload, null, 2));
+    }
+    else {
+        console.log(`${opts.dryRun ? "[dry run] " : ""}skill scope ${plan.name}`);
+        console.log(`  [${plan.action}] ${plan.detail}`);
+        if (writeError)
+            console.error(`  write failed: ${writeError}`);
+        if (syncReport)
+            printSyncReport(syncReport, opts.dryRun ?? false);
+    }
+    const failed = plan.action === "invalid-input" || plan.action === "not-found" || Boolean(writeError);
+    const syncConflict = syncReport?.reports.some((r) => r.items.some((i) => i.action === "conflict")) ?? false;
+    return { exitCode: failed || syncConflict ? 1 : 0 };
+}

package/dist/core/canonical.d.ts

@@ -25,6 +25,7 @@ type McpServerDefYaml = Omit<McpServerDef, "staticEnv" | "envAliases" | "auth">
  * them — a YAML cast is optimistic, validation is this module's job. */
 type McpAuthYaml = string | {
     kind?: unknown;
+    owner?: unknown;
     client_id?: unknown;
     client_secret_env?: unknown;
 };

package/dist/core/canonical.js

@@ -25,7 +25,7 @@ function fromServerDefYaml(serverName, def) {
  * `auth` translation and shape validation
  * (trellis-mcp-oauth-static-client tasks 1.1/1.3): the scalar and the
  * object form share one discriminator — `kind: oauth` — and the object
- * accepts exactly `kind`, `client_id`, `client_secret_env`. Everything
+ * accepts exactly `kind`, `owner`, `client_id`, `client_secret_env`. Everything
  * else is refused here at load, naming the field but never echoing the
  * value: an invalid `client_secret_env` is at best a typo, at worst a
  * pasted secret.
@@ -36,10 +36,10 @@ function fromAuthYaml(serverName, auth) {
     if (typeof auth !== "object" || auth === null) {
         throw new Error(`mcp/servers.yaml: "${serverName}" auth must be the scalar "oauth" or { kind: oauth, client_id?, client_secret_env? }`);
     }
-    const { kind, client_id, client_secret_env, ...extra } = auth;
+    const { kind, owner, client_id, client_secret_env, ...extra } = auth;
     const unknownKey = Object.keys(extra)[0];
     if (unknownKey !== undefined) {
-        throw new Error(`mcp/servers.yaml: "${serverName}" auth has unrecognized key "${unknownKey}" — expected kind, client_id, client_secret_env`);
+        throw new Error(`mcp/servers.yaml: "${serverName}" auth has unrecognized key "${unknownKey}" — expected kind, owner, client_id, client_secret_env`);
     }
     if (kind !== "oauth") {
         throw new Error(`mcp/servers.yaml: "${serverName}" auth.kind must be "oauth" — kind is the only recognized discriminator`);
@@ -51,6 +51,10 @@ function fromAuthYaml(serverName, auth) {
         throw new Error(`mcp/servers.yaml: "${serverName}" auth.client_secret_env must be a variable NAME (e.g. FIGMA_CLIENT_SECRET), never a secret value`);
     }
     const out = { kind: "oauth" };
+    if (owner !== undefined && owner !== "agent" && owner !== "trellis")
+        throw new Error(`mcp/servers.yaml: "${serverName}" auth.owner must be agent or trellis`);
+    if (owner !== undefined)
+        out.owner = owner;
     if (typeof client_id === "string")
         out.clientId = client_id;
     if (typeof client_secret_env === "string")
@@ -73,6 +77,7 @@ export function toServerDefYaml(def) {
                 ? auth
                 : {
                     kind: auth.kind,
+                    ...(auth.owner !== undefined ? { owner: auth.owner } : {}),
                     ...(auth.clientId !== undefined ? { client_id: auth.clientId } : {}),
                     ...(auth.clientSecretEnv !== undefined ? { client_secret_env: auth.clientSecretEnv } : {}),
                 };

package/dist/core/types.d.ts

@@ -15,6 +15,8 @@ export type McpAuthMode = "oauth";
  */
 export interface McpAuthConfig {
     kind: McpAuthMode;
+    /** Omitted preserves each Agent's native authorization. */
+    owner?: "agent" | "trellis";
     clientId?: string;
     clientSecretEnv?: string;
 }
@@ -23,6 +25,7 @@ export interface McpAuthConfig {
  * object form exists — a strict-equality check would silently strip the
  * OAuth routing from metadata-bearing servers. */
 export declare function isOAuthAuth(auth: McpAuthMode | McpAuthConfig | undefined): boolean;
+export declare function oauthOwner(auth: McpAuthMode | McpAuthConfig | undefined): "agent" | "trellis";
 /** The pre-registered client metadata a classification carries. A scalar
  * carries none — both forms route identically (design.md D1). */
 export declare function oauthClientMetadata(auth: McpAuthMode | McpAuthConfig | undefined): {
@@ -53,7 +56,7 @@ export interface McpServerDef {
     /** Explicit authorization classification. Absence means ordinary MCP;
      * Trellis never infers OAuth from a URL or a transient 401. The scalar
      * form and a metadata-less object are equivalent — metadata extends the
-     * authorization flow, it never changes routing
+     * authorization flow; only explicit `owner: trellis` changes routing
      * (trellis-mcp-oauth-static-client design.md D1). */
     auth?: McpAuthMode | McpAuthConfig;
     /** stdio only */

package/dist/core/types.js

@@ -11,6 +11,9 @@
 export function isOAuthAuth(auth) {
     return auth === "oauth" || (typeof auth === "object" && auth !== null && auth.kind === "oauth");
 }
+export function oauthOwner(auth) {
+    return typeof auth === "object" && auth?.owner === "trellis" ? "trellis" : "agent";
+}
 /** The pre-registered client metadata a classification carries. A scalar
  * carries none — both forms route identically (design.md D1). */
 export function oauthClientMetadata(auth) {

package/dist/lib/agentBridgeProvider.d.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult, Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { CallToolResult, Tool } from "@modelcontextprotocol/server";
 import type { RuntimeContext, TrellisProvider } from "./mcpRuntime.js";
 /** Exposes every `agent-bridge.yaml` target — other than the calling
  * Agent itself — as one MCP tool per target Agent. Routing which target

package/dist/lib/gatewayBackend.d.ts

@@ -18,6 +18,8 @@
 import type { McpServerDef, SecretsPolicy } from "../core/types.js";
 import { type McpClientInfo } from "./mcpConnect.js";
 import { type AggregatedTool } from "./mcpToolRegistry.js";
+import type { Resource, ReadResourceResult } from "@modelcontextprotocol/client";
+import type { SkillEntry } from "./skillManifest.js";
 export interface GatewayBackend {
     /** Every tool available through this backend, under its aggregated name. */
     listTools(): Promise<AggregatedTool[]>;
@@ -25,6 +27,10 @@ export interface GatewayBackend {
     callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
     /** Sanitized connection state for user/Agent remediation. */
     listStatus?(): readonly UpstreamStatus[];
+    listResources?(): Promise<Resource[]>;
+    readResource?(uri: string): Promise<ReadResourceResult>;
+    listSkills?(): Promise<SkillEntry[]>;
+    getSkill?(uri: string): Promise<SkillEntry | undefined>;
     /** Release everything this backend holds. Must be safe to call twice. */
     close(): Promise<void>;
 }
@@ -79,11 +85,16 @@ export declare class LocalBackend implements GatewayBackend {
     private readonly connected;
     private readonly statuses;
     private closed;
+    private readonly resources;
     private constructor();
     static connect(upstreams: readonly UpstreamSpec[], options: LocalBackendOptions): Promise<LocalBackend>;
     private addUpstream;
     listTools(): Promise<AggregatedTool[]>;
     callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
+    listResources(): Promise<Resource[]>;
+    readResource(uri: string): Promise<ReadResourceResult>;
+    listSkills(): Promise<SkillEntry[]>;
+    getSkill(uri: string): Promise<SkillEntry | undefined>;
     listStatus(): readonly UpstreamStatus[];
     close(): Promise<void>;
     private closeUpstream;

package/dist/lib/gatewayBackend.js

@@ -15,10 +15,13 @@
  * standard `Client` rather than something with its own shape to maintain
  * (D12).
  */
+import { isOAuthAuth, oauthOwner } from "../core/types.js";
 import { connectServer } from "./mcpConnect.js";
 import { withTimeout } from "./mcpConnect.js";
 import { ensureFreshToken } from "./oauth/refresh.js";
+import { readToken } from "./oauth/store.js";
 import { McpToolRegistry } from "./mcpToolRegistry.js";
+import { UpstreamResources } from "./upstreamResources.js";
 /**
  * v1's backend: connects each upstream itself and aggregates the result.
  *
@@ -34,12 +37,14 @@ export class LocalBackend {
     connected = new Set();
     statuses = new Map();
     closed = false;
-    constructor(warn) {
+    resources;
+    constructor(warn, timeoutMs) {
         this.warn = warn;
+        this.resources = new UpstreamResources(timeoutMs, warn);
     }
     static async connect(upstreams, options) {
         const warn = options.onWarning ?? ((message) => console.error(message));
-        const backend = new LocalBackend(warn);
+        const backend = new LocalBackend(warn, options.connectTimeoutMs);
         await Promise.all(upstreams.map((upstream) => backend.addUpstream(upstream, options)));
         return backend;
     }
@@ -62,7 +67,7 @@ export class LocalBackend {
         }
         let client;
         try {
-            client = (await connectServer(effectiveDef, options.secretsPolicy, options.connectTimeoutMs, options.clientInfo));
+            client = await connectServer(effectiveDef, options.secretsPolicy, options.connectTimeoutMs, options.clientInfo);
         }
         catch (err) {
             this.warn(`trellis-mcp-gateway: failed to connect to MCP server "${name}": ${errorText(err)}`);
@@ -72,7 +77,9 @@ export class LocalBackend {
         this.connected.add(client);
         let tools;
         try {
-            const result = await withTimeout(client.listTools(), options.connectTimeoutMs, `listTools timed out after ${options.connectTimeoutMs}ms`);
+            const result = client.getServerCapabilities()?.tools
+                ? await withTimeout(client.listTools(), options.connectTimeoutMs, `listTools timed out after ${options.connectTimeoutMs}ms`)
+                : { tools: [] };
             tools = result.tools;
         }
         catch (err) {
@@ -82,6 +89,7 @@ export class LocalBackend {
             return;
         }
         const { skipped } = this.registry.add(name, client, tools);
+        this.resources.add(name, client);
         for (const collided of skipped) {
             this.warn(`trellis-mcp-gateway: tool "${collided}" from server "${name}" collides with an already-registered tool and was skipped`);
         }
@@ -107,6 +115,10 @@ export class LocalBackend {
     async callTool(name, args) {
         return this.registry.callTool(name, args);
     }
+    listResources() { return this.resources.listResources(); }
+    readResource(uri) { return this.resources.readResource(uri); }
+    listSkills() { return this.resources.listSkills(); }
+    getSkill(uri) { return this.resources.getSkill(uri); }
     listStatus() {
         return [...this.statuses.values()];
     }
@@ -189,9 +201,16 @@ function failureStatus(name, def, error) {
  * the kind of invisible precedence that is impossible to debug.
  */
 export async function withOAuthHeader(name, def, homeDir) {
+    if (!isOAuthAuth(def.auth) || oauthOwner(def.auth) !== "trellis")
+        return def;
     const hasExplicitAuth = Object.keys(def.headers ?? {}).some((key) => key.toLowerCase() === "authorization");
     if (hasExplicitAuth)
         return def;
+    const stored = readToken(homeDir, name);
+    const resource = new URL(def.url);
+    resource.hash = "";
+    if (stored?.resourceUrl && stored.resourceUrl !== resource.toString())
+        throw new Error("OAuth authorization required: saved credential targets another MCP resource");
     const token = await ensureFreshToken(homeDir, name);
     if (!token)
         return def;

package/dist/lib/mcpConnect.d.ts

@@ -12,8 +12,7 @@
  * which servers are in scope, or knows what a tool is; callers isolate
  * failures in whatever way suits them.
  */
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import { Client } from "@modelcontextprotocol/client";
 import type { McpServerDef, SecretsPolicy } from "../core/types.js";
 /** What an MCP upstream is told this client is. Each consumer passes its
  * own so an upstream's logs name the thing that actually connected. */
@@ -40,7 +39,11 @@ export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, m
  * on close, but the original connect failure is what the caller needs
  * to see, not a secondary cleanup error.
  */
-export declare function connectWithCleanup(client: Client, transport: Transport, timeoutMs: number, message: string): Promise<Client>;
+export declare function connectWithCleanup<T, TTransport extends {
+    close(): Promise<void>;
+}>(client: T & {
+    connect(transport: TTransport): Promise<unknown>;
+}, transport: TTransport, timeoutMs: number, message: string): Promise<T>;
 export declare function connectStdio(def: McpServerDef, secretsPolicy: SecretsPolicy, timeoutMs: number, clientInfo: McpClientInfo): Promise<Client>;
 export declare function resolveHeaders(def: McpServerDef, secretsPolicy: SecretsPolicy): Record<string, string> | undefined;
 export declare function connectHttp(def: McpServerDef, secretsPolicy: SecretsPolicy, timeoutMs: number, clientInfo: McpClientInfo): Promise<Client>;

package/dist/lib/mcpConnect.js

@@ -12,10 +12,8 @@
  * which servers are in scope, or knows what a tool is; callers isolate
  * failures in whatever way suits them.
  */
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { Client, StreamableHTTPClientTransport, SSEClientTransport } from "@modelcontextprotocol/client";
+import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/client/stdio";
 import { resolveSecretEnv } from "./secretEnv.js";
 import { extractTemplateVarNames } from "./envVarNames.js";
 export const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
@@ -68,7 +66,7 @@ export async function connectWithCleanup(client, transport, timeoutMs, message)
     }
 }
 export async function connectStdio(def, secretsPolicy, timeoutMs, clientInfo) {
-    const client = new Client(clientInfo, { capabilities: {} });
+    const client = new Client(clientInfo, { capabilities: {}, versionNegotiation: { mode: "auto", probe: { timeoutMs: Math.min(3000, timeoutMs / 2) } } });
     const envAliases = def.envAliases ?? {};
     // `envAliases`' values are source variable names — resolved through the
     // exact same call as `env`'s own names, never delivered as the raw
@@ -81,6 +79,9 @@ export async function connectStdio(def, secretsPolicy, timeoutMs, clientInfo) {
     const transport = new StdioClientTransport({
         command: def.command,
         args: def.args,
+        // A 16 MiB skill file can expand sixfold when JSON escapes control bytes.
+        // Keep framing bounded without rejecting a valid Skills-extension file.
+        maxBufferSize: 128 * 1024 * 1024,
         // staticEnv merges last: a literal, intentionally-plain value (an
         // email, an environment tag) always wins over an unresolved name-only
         // entry's empty-string fallback for the same key — though in practice
@@ -102,12 +103,13 @@ export function resolveHeaders(def, secretsPolicy) {
     return result;
 }
 export async function connectHttp(def, secretsPolicy, timeoutMs, clientInfo) {
-    const client = new Client(clientInfo, { capabilities: {} });
+    const client = new Client(clientInfo, { capabilities: {}, versionNegotiation: { mode: "auto", probe: { timeoutMs } } });
     const headers = resolveHeaders(def, secretsPolicy);
     const opts = headers ? { requestInit: { headers } } : undefined;
     return connectWithCleanup(client, new StreamableHTTPClientTransport(new URL(def.url), opts), timeoutMs, `connect timed out after ${timeoutMs}ms`);
 }
 export async function connectSse(def, secretsPolicy, timeoutMs, clientInfo) {
+    // HTTP+SSE is a legacy transport; it cannot carry modern discovery.
     const client = new Client(clientInfo, { capabilities: {} });
     const headers = resolveHeaders(def, secretsPolicy);
     const opts = headers ? { requestInit: { headers } } : undefined;

package/dist/lib/mcpRuntime.d.ts

@@ -1,7 +1,8 @@
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import type { CallToolResult, GetPromptResult, Implementation, Prompt, ReadResourceResult, Resource, Tool } from "@modelcontextprotocol/sdk/types.js";
+import { Server } from "@modelcontextprotocol/server";
+import type { CallToolResult, GetPromptResult, Implementation, Prompt, ReadResourceResult, Resource, Tool } from "@modelcontextprotocol/server";
 import type { AgentId } from "../core/types.js";
 import type { GatewayBackend } from "./gatewayBackend.js";
+import type { SkillEntry } from "./skillManifest.js";
 export interface RuntimeContext {
     agentId: AgentId;
     homeDir: string;
@@ -14,6 +15,9 @@ export interface TrellisProvider {
     readResource?(uri: URL, context: RuntimeContext): Promise<ReadResourceResult> | ReadResourceResult;
     listPrompts?(context: RuntimeContext): Promise<Prompt[]> | Prompt[];
     getPrompt?(name: string, args: Record<string, string> | undefined, context: RuntimeContext): Promise<GetPromptResult> | GetPromptResult;
+    /** Skills-over-MCP `skills/list` and `skills/get` (trellis-skills-over-mcp). */
+    listSkillEntries?(context: RuntimeContext): Promise<SkillEntry[]> | SkillEntry[];
+    getSkillEntry?(uri: string, context: RuntimeContext): Promise<SkillEntry | undefined> | SkillEntry | undefined;
     close?(): Promise<void>;
 }
 export declare class BuiltinRegistry {
@@ -29,6 +33,8 @@ export declare class BuiltinRegistry {
     callTool(name: string, args: unknown, context: RuntimeContext): Promise<CallToolResult>;
     listResources(context: RuntimeContext): Promise<Resource[]>;
     readResource(uri: URL, context: RuntimeContext): Promise<ReadResourceResult>;
+    listSkills(context: RuntimeContext): Promise<SkillEntry[]>;
+    getSkill(uri: string, context: RuntimeContext): Promise<SkillEntry | undefined>;
     listPrompts(context: RuntimeContext): Promise<Prompt[]>;
     getPrompt(name: string, args: Record<string, string> | undefined, context: RuntimeContext): Promise<GetPromptResult>;
     close(): Promise<void>;
@@ -41,6 +47,10 @@ export declare class UpstreamProvider implements TrellisProvider {
     constructor(backend: GatewayBackend);
     listTools(): Promise<Tool[]>;
     callTool(name: string, args: unknown): Promise<CallToolResult>;
+    listResources(): Promise<Resource[]>;
+    readResource(uri: URL): Promise<ReadResourceResult>;
+    listSkillEntries(): Promise<SkillEntry[]>;
+    getSkillEntry(uri: string): Promise<SkillEntry | undefined>;
     close(): Promise<void>;
 }
 export declare function createRuntimeServer(serverInfo: Implementation, context: RuntimeContext, registry: BuiltinRegistry): Server;

package/dist/lib/mcpRuntime.js

@@ -1,6 +1,7 @@
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { Server, ProtocolErrorCode, ProtocolError } from "@modelcontextprotocol/server";
+import { z } from "zod/v4";
 import { allocateExposedToolNames } from "./mcpToolRegistry.js";
+import { withoutUpstreamServerInfo } from "./upstreamResources.js";
 function compactBuiltinToolName(name) {
     return name.startsWith("trellis.") ? name.slice("trellis.".length).replaceAll(".", "_") : name;
 }
@@ -102,10 +103,42 @@ export class BuiltinRegistry {
             await this.listResources(context);
             provider = this.resourceOwners.get(key);
         }
+        // A manifest can introduce supporting files not returned by resources/list.
+        if (!provider && uri.protocol === "trellis-upstream:")
+            provider = this.providers.find((candidate) => candidate.id === "upstream");
         if (!provider?.readResource)
             throw new Error(`unknown Trellis resource "${key}"`);
         return provider.readResource(uri, context);
     }
+    async listSkills(context) {
+        const skills = [];
+        for (const provider of this.providers) {
+            if (!provider.listSkillEntries)
+                continue;
+            try {
+                skills.push(...(await provider.listSkillEntries(context)));
+            }
+            catch (err) {
+                this.warn(providerError(provider.id, err));
+            }
+        }
+        return skills;
+    }
+    async getSkill(uri, context) {
+        for (const provider of this.providers) {
+            if (!provider.getSkillEntry)
+                continue;
+            try {
+                const entry = await provider.getSkillEntry(uri, context);
+                if (entry)
+                    return entry;
+            }
+            catch (err) {
+                this.warn(providerError(provider.id, err));
+            }
+        }
+        return undefined;
+    }
     async listPrompts(context) {
         const prompts = [];
         this.promptOwners.clear();
@@ -161,8 +194,16 @@ export class UpstreamProvider {
         return (await this.backend.listTools());
     }
     async callTool(name, args) {
-        return (await this.backend.callTool(name, args));
+        return withoutUpstreamServerInfo((await this.backend.callTool(name, args)));
+    }
+    async listResources() { return await this.backend.listResources?.() ?? []; }
+    async readResource(uri) {
+        if (!this.backend.readResource)
+            throw new Error("upstream resources unavailable");
+        return this.backend.readResource(uri.toString());
     }
+    async listSkillEntries() { return await this.backend.listSkills?.() ?? []; }
+    async getSkillEntry(uri) { return this.backend.getSkill?.(uri); }
     async close() {
         await this.backend.close();
     }
@@ -173,13 +214,33 @@ export function createRuntimeServer(serverInfo, context, registry) {
             tools: { listChanged: true },
             resources: { listChanged: true },
             prompts: { listChanged: true },
+            extensions: { "io.modelcontextprotocol/skills": {} },
         },
     });
-    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: await registry.listTools(context) }));
-    server.setRequestHandler(CallToolRequestSchema, async (request) => registry.callTool(request.params.name, request.params.arguments, context));
-    server.setRequestHandler(ListResourcesRequestSchema, async () => ({ resources: await registry.listResources(context) }));
-    server.setRequestHandler(ReadResourceRequestSchema, async (request) => registry.readResource(new URL(request.params.uri), context));
-    server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: await registry.listPrompts(context) }));
-    server.setRequestHandler(GetPromptRequestSchema, async (request) => registry.getPrompt(request.params.name, request.params.arguments, context));
+    server.setRequestHandler("tools/list", async () => ({ tools: await registry.listTools(context) }));
+    server.setRequestHandler("tools/call", async ({ params }) => registry.callTool(params.name, params.arguments, context));
+    server.setRequestHandler("resources/list", async () => ({ resources: await registry.listResources(context) }));
+    server.setRequestHandler("resources/read", async ({ params }) => {
+        try {
+            return await registry.readResource(new URL(params.uri), context);
+        }
+        catch (err) {
+            if (err instanceof TypeError || (err instanceof Error && /unknown|not found|not allowed|outside|secret-like|invalid.*uri/i.test(err.message))) {
+                throw new ProtocolError(ProtocolErrorCode.InvalidParams, "unknown or unreadable resource");
+            }
+            throw err;
+        }
+    });
+    server.setRequestHandler("prompts/list", async () => ({ prompts: await registry.listPrompts(context) }));
+    server.setRequestHandler("prompts/get", async ({ params }) => registry.getPrompt(params.name, params.arguments, context));
+    const result = z.looseObject({});
+    const cache = { ttlMs: 0, cacheScope: "private" };
+    server.setRequestHandler("skills/list", { params: z.object({ cursor: z.string().optional() }), result }, async () => ({ ...cache, skills: await registry.listSkills(context) }));
+    server.setRequestHandler("skills/get", { params: z.object({ uri: z.string() }), result }, async ({ uri }) => {
+        const entry = await registry.getSkill(uri, context);
+        if (!entry)
+            throw new ProtocolError(ProtocolErrorCode.InvalidParams, "unknown skill");
+        return { ...cache, skill: entry };
+    });
     return server;
 }

package/dist/lib/mcpStatusProvider.d.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult, Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { CallToolResult, Tool } from "@modelcontextprotocol/server";
 import type { GatewayBackend } from "./gatewayBackend.js";
 import type { RuntimeContext, TrellisProvider } from "./mcpRuntime.js";
 export declare class McpStatusProvider implements TrellisProvider {

package/dist/lib/memoryProvider.d.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult, ReadResourceResult, Resource, Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { CallToolResult, ReadResourceResult, Resource, Tool } from "@modelcontextprotocol/server";
 import type { Scope } from "../core/types.js";
 import type { RuntimeContext, TrellisProvider } from "./mcpRuntime.js";
 /**

package/dist/lib/oauth/discovery.d.ts

@@ -27,6 +27,7 @@ export interface AuthorizationServerMetadata {
     registrationEndpoint?: string;
     scopesSupported?: string[];
     codeChallengeMethodsSupported?: string[];
+    issuerParameterSupported?: boolean;
 }
 export type FetchLike = (url: string, init?: {
     method?: string;

package/dist/lib/oauth/discovery.js

@@ -37,6 +37,8 @@ function toMetadata(raw) {
         out.scopesSupported = raw.scopes_supported;
     if (raw.code_challenge_methods_supported)
         out.codeChallengeMethodsSupported = raw.code_challenge_methods_supported;
+    if (raw.authorization_response_iss_parameter_supported)
+        out.issuerParameterSupported = true;
     return out;
 }
 async function tryJson(fetchImpl, url) {