agent-trellis 0.11.0 → 0.13.0

package/dist/commands/mcpRenew.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `trellis mcp renew` — scheduled, non-interactive renewal of stored OAuth
+ * tokens (trellis-mcp-oauth-renew).
+ *
+ * Deliberately an orchestrator and nothing more: the refresh itself is
+ * `ensureFreshToken`, the same function the gateway calls before every
+ * upstream request, with the same lock, skew, and rotation semantics
+ * (design.md D1). This command's entire job is to run that path *before*
+ * an Agent session discovers a dead credential as a 401, and to say
+ * plainly which servers need a human.
+ *
+ * Never opens a browser, never performs an initial grant — that remains
+ * `trellis mcp auth` (mcp-gateway-hosting design.md D9). Scope is
+ * canonical Trellis-owned OAuth servers only: classification is explicit,
+ * never inferred from token files or URLs (design.md D5), and since
+ * trellis-desktop-oauth-ownership an explicit `owner: trellis` is what
+ * makes a credential Trellis's responsibility at all — agent-owned
+ * servers are authorized by the Agent's own client, which neither reads
+ * Trellis's token store nor can be renewed from here, so reporting them
+ * as `no-token` would cry wolf on every run.
+ */
+import { type OAuthRenewStatus } from "../lib/oauth/renew.js";
+import type { FetchLike } from "../lib/oauth/discovery.js";
+export interface RunMcpRenewOptions {
+    json?: boolean;
+    dryRun?: boolean;
+    /** Defaults to the real `~`; overridable for tests — the seam every
+     * other Trellis entry point exposes. */
+    homeDir?: string;
+    /** Test seam for the token-endpoint call — an interval-scheduled run
+     * must use the real fetch, so this is not a supported user flag. */
+    fetchImpl?: FetchLike;
+}
+export interface McpRenewEntry {
+    server: string;
+    status: OAuthRenewStatus;
+    expiresAt?: number;
+    remediation?: string;
+}
+export interface McpRenewResult {
+    entries: McpRenewEntry[];
+    /** True when every classified server is healthy without a human step
+     * (design.md D6). The vacuous case — zero OAuth servers — is ok. */
+    ok: boolean;
+}
+/** Exported so tests and `doctor` reuse the exact iteration/scope rule
+ * without capturing stdout or re-deriving it (design.md D2's one-rule
+ * property). Read-only when `dryRun`: no network, no writes. */
+export declare function collectRenewEntries(opts: RunMcpRenewOptions): Promise<McpRenewResult>;
+export declare function runMcpRenew(opts: RunMcpRenewOptions): Promise<{
+    exitCode: number;
+}>;

package/dist/commands/mcpRenew.js

@@ -0,0 +1,104 @@
+/**
+ * `trellis mcp renew` — scheduled, non-interactive renewal of stored OAuth
+ * tokens (trellis-mcp-oauth-renew).
+ *
+ * Deliberately an orchestrator and nothing more: the refresh itself is
+ * `ensureFreshToken`, the same function the gateway calls before every
+ * upstream request, with the same lock, skew, and rotation semantics
+ * (design.md D1). This command's entire job is to run that path *before*
+ * an Agent session discovers a dead credential as a 401, and to say
+ * plainly which servers need a human.
+ *
+ * Never opens a browser, never performs an initial grant — that remains
+ * `trellis mcp auth` (mcp-gateway-hosting design.md D9). Scope is
+ * canonical Trellis-owned OAuth servers only: classification is explicit,
+ * never inferred from token files or URLs (design.md D5), and since
+ * trellis-desktop-oauth-ownership an explicit `owner: trellis` is what
+ * makes a credential Trellis's responsibility at all — agent-owned
+ * servers are authorized by the Agent's own client, which neither reads
+ * Trellis's token store nor can be renewed from here, so reporting them
+ * as `no-token` would cry wolf on every run.
+ */
+import { homedir } from "node:os";
+import { loadCanonicalSource } from "../core/canonical.js";
+import { isOAuthAuth, oauthOwner } from "../core/types.js";
+import { ensureFreshToken } from "../lib/oauth/refresh.js";
+import { classifyRefreshFailure, classifyStoredToken, FAILURE_STATUSES, remediationFor, } from "../lib/oauth/renew.js";
+import { readToken } from "../lib/oauth/store.js";
+/** Exported so tests and `doctor` reuse the exact iteration/scope rule
+ * without capturing stdout or re-deriving it (design.md D2's one-rule
+ * property). Read-only when `dryRun`: no network, no writes. */
+export async function collectRenewEntries(opts) {
+    const homeDir = opts.homeDir ?? homedir();
+    const canonical = loadCanonicalSource(homeDir);
+    const names = Object.entries(canonical.mcp.servers)
+        .filter(([, def]) => isOAuthAuth(def.auth) && oauthOwner(def.auth) === "trellis")
+        .map(([name]) => name)
+        .sort();
+    const entries = [];
+    for (const name of names) {
+        entries.push(await renewOne(homeDir, name, opts));
+    }
+    return { entries, ok: entries.every((entry) => !FAILURE_STATUSES.has(entry.status)) };
+}
+async function renewOne(homeDir, name, opts) {
+    // The pre-refresh classification decides what `ensureFreshToken`'s
+    // return means: it only contacts the endpoint when the stored token was
+    // absent-but-not-required (returns undefined) or expiring (refreshes),
+    // so "expired-renewable before, token after" ⇒ a refresh just happened.
+    const before = classifyStoredToken(homeDir, name);
+    if (opts.dryRun)
+        return withDetails(homeDir, name, before);
+    try {
+        const token = await ensureFreshToken(homeDir, name, { ...(opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {}) });
+        if (!token)
+            return withDetails(homeDir, name, "no-token");
+        return withDetails(homeDir, name, before === "expired-renewable" ? "refreshed" : "valid");
+    }
+    catch (err) {
+        return withDetails(homeDir, name, classifyRefreshFailure(err));
+    }
+}
+function withDetails(homeDir, name, status) {
+    const expiresAt = readToken(homeDir, name)?.expiresAt;
+    return {
+        server: name,
+        status,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+        ...(FAILURE_STATUSES.has(status) || status === "expired-renewable" ? { remediation: remediationFor(status, name) } : {}),
+    };
+}
+const STATUS_ICON = {
+    valid: "✅",
+    refreshed: "🔄",
+    "expired-renewable": "⏳",
+    "no-token": "❌",
+    "refresh-failed": "❌",
+    "needs-auth": "❌",
+    unreadable: "⚠️",
+};
+export async function runMcpRenew(opts) {
+    let result;
+    try {
+        result = await collectRenewEntries(opts);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : String(err));
+        return { exitCode: 1 };
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else if (result.entries.length === 0) {
+        console.log("No OAuth-classified MCP servers in canonical config — nothing to renew.");
+    }
+    else {
+        for (const entry of result.entries) {
+            const expiry = entry.expiresAt !== undefined ? ` (expires ${new Date(entry.expiresAt).toISOString()})` : "";
+            console.log(`${STATUS_ICON[entry.status]} ${entry.server} — ${entry.status}${expiry}`);
+            if (entry.remediation)
+                console.log(`   → ${entry.remediation}`);
+        }
+    }
+    return { exitCode: result.ok ? 0 : 1 };
+}

package/dist/core/canonical.d.ts

@@ -25,6 +25,7 @@ type McpServerDefYaml = Omit<McpServerDef, "staticEnv" | "envAliases" | "auth">
  * them — a YAML cast is optimistic, validation is this module's job. */
 type McpAuthYaml = string | {
     kind?: unknown;
+    owner?: unknown;
     client_id?: unknown;
     client_secret_env?: unknown;
 };

package/dist/core/canonical.js

@@ -25,7 +25,7 @@ function fromServerDefYaml(serverName, def) {
  * `auth` translation and shape validation
  * (trellis-mcp-oauth-static-client tasks 1.1/1.3): the scalar and the
  * object form share one discriminator — `kind: oauth` — and the object
- * accepts exactly `kind`, `client_id`, `client_secret_env`. Everything
+ * accepts exactly `kind`, `owner`, `client_id`, `client_secret_env`. Everything
  * else is refused here at load, naming the field but never echoing the
  * value: an invalid `client_secret_env` is at best a typo, at worst a
  * pasted secret.
@@ -36,10 +36,10 @@ function fromAuthYaml(serverName, auth) {
     if (typeof auth !== "object" || auth === null) {
         throw new Error(`mcp/servers.yaml: "${serverName}" auth must be the scalar "oauth" or { kind: oauth, client_id?, client_secret_env? }`);
     }
-    const { kind, client_id, client_secret_env, ...extra } = auth;
+    const { kind, owner, client_id, client_secret_env, ...extra } = auth;
     const unknownKey = Object.keys(extra)[0];
     if (unknownKey !== undefined) {
-        throw new Error(`mcp/servers.yaml: "${serverName}" auth has unrecognized key "${unknownKey}" — expected kind, client_id, client_secret_env`);
+        throw new Error(`mcp/servers.yaml: "${serverName}" auth has unrecognized key "${unknownKey}" — expected kind, owner, client_id, client_secret_env`);
     }
     if (kind !== "oauth") {
         throw new Error(`mcp/servers.yaml: "${serverName}" auth.kind must be "oauth" — kind is the only recognized discriminator`);
@@ -51,6 +51,10 @@ function fromAuthYaml(serverName, auth) {
         throw new Error(`mcp/servers.yaml: "${serverName}" auth.client_secret_env must be a variable NAME (e.g. FIGMA_CLIENT_SECRET), never a secret value`);
     }
     const out = { kind: "oauth" };
+    if (owner !== undefined && owner !== "agent" && owner !== "trellis")
+        throw new Error(`mcp/servers.yaml: "${serverName}" auth.owner must be agent or trellis`);
+    if (owner !== undefined)
+        out.owner = owner;
     if (typeof client_id === "string")
         out.clientId = client_id;
     if (typeof client_secret_env === "string")
@@ -73,6 +77,7 @@ export function toServerDefYaml(def) {
                 ? auth
                 : {
                     kind: auth.kind,
+                    ...(auth.owner !== undefined ? { owner: auth.owner } : {}),
                     ...(auth.clientId !== undefined ? { client_id: auth.clientId } : {}),
                     ...(auth.clientSecretEnv !== undefined ? { client_secret_env: auth.clientSecretEnv } : {}),
                 };

package/dist/core/types.d.ts

@@ -15,6 +15,8 @@ export type McpAuthMode = "oauth";
  */
 export interface McpAuthConfig {
     kind: McpAuthMode;
+    /** Omitted preserves each Agent's native authorization. */
+    owner?: "agent" | "trellis";
     clientId?: string;
     clientSecretEnv?: string;
 }
@@ -23,6 +25,7 @@ export interface McpAuthConfig {
  * object form exists — a strict-equality check would silently strip the
  * OAuth routing from metadata-bearing servers. */
 export declare function isOAuthAuth(auth: McpAuthMode | McpAuthConfig | undefined): boolean;
+export declare function oauthOwner(auth: McpAuthMode | McpAuthConfig | undefined): "agent" | "trellis";
 /** The pre-registered client metadata a classification carries. A scalar
  * carries none — both forms route identically (design.md D1). */
 export declare function oauthClientMetadata(auth: McpAuthMode | McpAuthConfig | undefined): {
@@ -53,7 +56,7 @@ export interface McpServerDef {
     /** Explicit authorization classification. Absence means ordinary MCP;
      * Trellis never infers OAuth from a URL or a transient 401. The scalar
      * form and a metadata-less object are equivalent — metadata extends the
-     * authorization flow, it never changes routing
+     * authorization flow; only explicit `owner: trellis` changes routing
      * (trellis-mcp-oauth-static-client design.md D1). */
     auth?: McpAuthMode | McpAuthConfig;
     /** stdio only */

package/dist/core/types.js

@@ -11,6 +11,9 @@
 export function isOAuthAuth(auth) {
     return auth === "oauth" || (typeof auth === "object" && auth !== null && auth.kind === "oauth");
 }
+export function oauthOwner(auth) {
+    return typeof auth === "object" && auth?.owner === "trellis" ? "trellis" : "agent";
+}
 /** The pre-registered client metadata a classification carries. A scalar
  * carries none — both forms route identically (design.md D1). */
 export function oauthClientMetadata(auth) {

package/dist/lib/agentBridgeProvider.d.ts

@@ -1,4 +1,4 @@
-import type { CallToolResult, Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { CallToolResult, Tool } from "@modelcontextprotocol/server";
 import type { RuntimeContext, TrellisProvider } from "./mcpRuntime.js";
 /** Exposes every `agent-bridge.yaml` target — other than the calling
  * Agent itself — as one MCP tool per target Agent. Routing which target

package/dist/lib/gatewayBackend.d.ts

@@ -18,6 +18,8 @@
 import type { McpServerDef, SecretsPolicy } from "../core/types.js";
 import { type McpClientInfo } from "./mcpConnect.js";
 import { type AggregatedTool } from "./mcpToolRegistry.js";
+import type { Resource, ReadResourceResult } from "@modelcontextprotocol/client";
+import type { SkillEntry } from "./skillManifest.js";
 export interface GatewayBackend {
     /** Every tool available through this backend, under its aggregated name. */
     listTools(): Promise<AggregatedTool[]>;
@@ -25,6 +27,10 @@ export interface GatewayBackend {
     callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
     /** Sanitized connection state for user/Agent remediation. */
     listStatus?(): readonly UpstreamStatus[];
+    listResources?(): Promise<Resource[]>;
+    readResource?(uri: string): Promise<ReadResourceResult>;
+    listSkills?(): Promise<SkillEntry[]>;
+    getSkill?(uri: string): Promise<SkillEntry | undefined>;
     /** Release everything this backend holds. Must be safe to call twice. */
     close(): Promise<void>;
 }
@@ -39,6 +45,11 @@ export interface UpstreamStatus {
     name: string;
     transport: "stdio" | "http" | "sse";
     status: UpstreamStatusKind;
+    /** How many tools this upstream contributed at connect time — the
+     * structured form of the count `detail` already carries in prose, so
+     * Agents reasoning about capability never parse a sentence
+     * (trellis-mcp-status-credential-health design.md D5). */
+    toolCount?: number;
     detail?: string;
     remediation?: string;
     remediationKind?: "oauth" | "environment" | "install" | "endpoint" | "router";
@@ -79,11 +90,16 @@ export declare class LocalBackend implements GatewayBackend {
     private readonly connected;
     private readonly statuses;
     private closed;
+    private readonly resources;
     private constructor();
     static connect(upstreams: readonly UpstreamSpec[], options: LocalBackendOptions): Promise<LocalBackend>;
     private addUpstream;
     listTools(): Promise<AggregatedTool[]>;
     callTool(name: string, args?: Record<string, unknown>): Promise<unknown>;
+    listResources(): Promise<Resource[]>;
+    readResource(uri: string): Promise<ReadResourceResult>;
+    listSkills(): Promise<SkillEntry[]>;
+    getSkill(uri: string): Promise<SkillEntry | undefined>;
     listStatus(): readonly UpstreamStatus[];
     close(): Promise<void>;
     private closeUpstream;

package/dist/lib/gatewayBackend.js

@@ -15,10 +15,13 @@
  * standard `Client` rather than something with its own shape to maintain
  * (D12).
  */
+import { isOAuthAuth, oauthOwner } from "../core/types.js";
 import { connectServer } from "./mcpConnect.js";
 import { withTimeout } from "./mcpConnect.js";
 import { ensureFreshToken } from "./oauth/refresh.js";
+import { readToken } from "./oauth/store.js";
 import { McpToolRegistry } from "./mcpToolRegistry.js";
+import { UpstreamResources } from "./upstreamResources.js";
 /**
  * v1's backend: connects each upstream itself and aggregates the result.
  *
@@ -34,12 +37,14 @@ export class LocalBackend {
     connected = new Set();
     statuses = new Map();
     closed = false;
-    constructor(warn) {
+    resources;
+    constructor(warn, timeoutMs) {
         this.warn = warn;
+        this.resources = new UpstreamResources(timeoutMs, warn);
     }
     static async connect(upstreams, options) {
         const warn = options.onWarning ?? ((message) => console.error(message));
-        const backend = new LocalBackend(warn);
+        const backend = new LocalBackend(warn, options.connectTimeoutMs);
         await Promise.all(upstreams.map((upstream) => backend.addUpstream(upstream, options)));
         return backend;
     }
@@ -62,7 +67,7 @@ export class LocalBackend {
         }
         let client;
         try {
-            client = (await connectServer(effectiveDef, options.secretsPolicy, options.connectTimeoutMs, options.clientInfo));
+            client = await connectServer(effectiveDef, options.secretsPolicy, options.connectTimeoutMs, options.clientInfo);
         }
         catch (err) {
             this.warn(`trellis-mcp-gateway: failed to connect to MCP server "${name}": ${errorText(err)}`);
@@ -72,7 +77,9 @@ export class LocalBackend {
         this.connected.add(client);
         let tools;
         try {
-            const result = await withTimeout(client.listTools(), options.connectTimeoutMs, `listTools timed out after ${options.connectTimeoutMs}ms`);
+            const result = client.getServerCapabilities()?.tools
+                ? await withTimeout(client.listTools(), options.connectTimeoutMs, `listTools timed out after ${options.connectTimeoutMs}ms`)
+                : { tools: [] };
             tools = result.tools;
         }
         catch (err) {
@@ -82,6 +89,7 @@ export class LocalBackend {
             return;
         }
         const { skipped } = this.registry.add(name, client, tools);
+        this.resources.add(name, client);
         for (const collided of skipped) {
             this.warn(`trellis-mcp-gateway: tool "${collided}" from server "${name}" collides with an already-registered tool and was skipped`);
         }
@@ -90,6 +98,7 @@ export class LocalBackend {
                 name,
                 transport,
                 status: "degraded",
+                toolCount: 0,
                 detail: "router connected but exposed no downstream tools",
                 remediationKind: "router",
                 requiresHuman: true,
@@ -98,7 +107,7 @@ export class LocalBackend {
             });
         }
         else {
-            this.statuses.set(name, { name, transport, status: "ready", detail: `connected; ${tools.length} tool(s) available` });
+            this.statuses.set(name, { name, transport, status: "ready", toolCount: tools.length, detail: `connected; ${tools.length} tool(s) available` });
         }
     }
     async listTools() {
@@ -107,6 +116,10 @@ export class LocalBackend {
     async callTool(name, args) {
         return this.registry.callTool(name, args);
     }
+    listResources() { return this.resources.listResources(); }
+    readResource(uri) { return this.resources.readResource(uri); }
+    listSkills() { return this.resources.listSkills(); }
+    getSkill(uri) { return this.resources.getSkill(uri); }
     listStatus() {
         return [...this.statuses.values()];
     }
@@ -189,9 +202,16 @@ function failureStatus(name, def, error) {
  * the kind of invisible precedence that is impossible to debug.
  */
 export async function withOAuthHeader(name, def, homeDir) {
+    if (!isOAuthAuth(def.auth) || oauthOwner(def.auth) !== "trellis")
+        return def;
     const hasExplicitAuth = Object.keys(def.headers ?? {}).some((key) => key.toLowerCase() === "authorization");
     if (hasExplicitAuth)
         return def;
+    const stored = readToken(homeDir, name);
+    const resource = new URL(def.url);
+    resource.hash = "";
+    if (stored?.resourceUrl && stored.resourceUrl !== resource.toString())
+        throw new Error("OAuth authorization required: saved credential targets another MCP resource");
     const token = await ensureFreshToken(homeDir, name);
     if (!token)
         return def;

package/dist/lib/mcpConnect.d.ts

@@ -12,8 +12,7 @@
  * which servers are in scope, or knows what a tool is; callers isolate
  * failures in whatever way suits them.
  */
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import { Client } from "@modelcontextprotocol/client";
 import type { McpServerDef, SecretsPolicy } from "../core/types.js";
 /** What an MCP upstream is told this client is. Each consumer passes its
  * own so an upstream's logs name the thing that actually connected. */
@@ -40,7 +39,11 @@ export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, m
  * on close, but the original connect failure is what the caller needs
  * to see, not a secondary cleanup error.
  */
-export declare function connectWithCleanup(client: Client, transport: Transport, timeoutMs: number, message: string): Promise<Client>;
+export declare function connectWithCleanup<T, TTransport extends {
+    close(): Promise<void>;
+}>(client: T & {
+    connect(transport: TTransport): Promise<unknown>;
+}, transport: TTransport, timeoutMs: number, message: string): Promise<T>;
 export declare function connectStdio(def: McpServerDef, secretsPolicy: SecretsPolicy, timeoutMs: number, clientInfo: McpClientInfo): Promise<Client>;
 export declare function resolveHeaders(def: McpServerDef, secretsPolicy: SecretsPolicy): Record<string, string> | undefined;
 export declare function connectHttp(def: McpServerDef, secretsPolicy: SecretsPolicy, timeoutMs: number, clientInfo: McpClientInfo): Promise<Client>;

package/dist/lib/mcpConnect.js

@@ -12,10 +12,8 @@
  * which servers are in scope, or knows what a tool is; callers isolate
  * failures in whatever way suits them.
  */
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { Client, StreamableHTTPClientTransport, SSEClientTransport } from "@modelcontextprotocol/client";
+import { StdioClientTransport, getDefaultEnvironment } from "@modelcontextprotocol/client/stdio";
 import { resolveSecretEnv } from "./secretEnv.js";
 import { extractTemplateVarNames } from "./envVarNames.js";
 export const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
@@ -68,7 +66,7 @@ export async function connectWithCleanup(client, transport, timeoutMs, message)
     }
 }
 export async function connectStdio(def, secretsPolicy, timeoutMs, clientInfo) {
-    const client = new Client(clientInfo, { capabilities: {} });
+    const client = new Client(clientInfo, { capabilities: {}, versionNegotiation: { mode: "auto", probe: { timeoutMs: Math.min(3000, timeoutMs / 2) } } });
     const envAliases = def.envAliases ?? {};
     // `envAliases`' values are source variable names — resolved through the
     // exact same call as `env`'s own names, never delivered as the raw
@@ -81,6 +79,9 @@ export async function connectStdio(def, secretsPolicy, timeoutMs, clientInfo) {
     const transport = new StdioClientTransport({
         command: def.command,
         args: def.args,
+        // A 16 MiB skill file can expand sixfold when JSON escapes control bytes.
+        // Keep framing bounded without rejecting a valid Skills-extension file.
+        maxBufferSize: 128 * 1024 * 1024,
         // staticEnv merges last: a literal, intentionally-plain value (an
         // email, an environment tag) always wins over an unresolved name-only
         // entry's empty-string fallback for the same key — though in practice
@@ -102,12 +103,13 @@ export function resolveHeaders(def, secretsPolicy) {
     return result;
 }
 export async function connectHttp(def, secretsPolicy, timeoutMs, clientInfo) {
-    const client = new Client(clientInfo, { capabilities: {} });
+    const client = new Client(clientInfo, { capabilities: {}, versionNegotiation: { mode: "auto", probe: { timeoutMs } } });
     const headers = resolveHeaders(def, secretsPolicy);
     const opts = headers ? { requestInit: { headers } } : undefined;
     return connectWithCleanup(client, new StreamableHTTPClientTransport(new URL(def.url), opts), timeoutMs, `connect timed out after ${timeoutMs}ms`);
 }
 export async function connectSse(def, secretsPolicy, timeoutMs, clientInfo) {
+    // HTTP+SSE is a legacy transport; it cannot carry modern discovery.
     const client = new Client(clientInfo, { capabilities: {} });
     const headers = resolveHeaders(def, secretsPolicy);
     const opts = headers ? { requestInit: { headers } } : undefined;

package/dist/lib/mcpRuntime.d.ts

@@ -1,5 +1,5 @@
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import type { CallToolResult, GetPromptResult, Implementation, Prompt, ReadResourceResult, Resource, Tool } from "@modelcontextprotocol/sdk/types.js";
+import { Server } from "@modelcontextprotocol/server";
+import type { CallToolResult, GetPromptResult, Implementation, Prompt, ReadResourceResult, Resource, Tool } from "@modelcontextprotocol/server";
 import type { AgentId } from "../core/types.js";
 import type { GatewayBackend } from "./gatewayBackend.js";
 import type { SkillEntry } from "./skillManifest.js";
@@ -47,6 +47,10 @@ export declare class UpstreamProvider implements TrellisProvider {
     constructor(backend: GatewayBackend);
     listTools(): Promise<Tool[]>;
     callTool(name: string, args: unknown): Promise<CallToolResult>;
+    listResources(): Promise<Resource[]>;
+    readResource(uri: URL): Promise<ReadResourceResult>;
+    listSkillEntries(): Promise<SkillEntry[]>;
+    getSkillEntry(uri: string): Promise<SkillEntry | undefined>;
     close(): Promise<void>;
 }
 export declare function createRuntimeServer(serverInfo: Implementation, context: RuntimeContext, registry: BuiltinRegistry): Server;

package/dist/lib/mcpRuntime.js

@@ -1,6 +1,7 @@
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { CallToolRequestSchema, ErrorCode, McpError, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { Server, ProtocolErrorCode, ProtocolError } from "@modelcontextprotocol/server";
+import { z } from "zod/v4";
 import { allocateExposedToolNames } from "./mcpToolRegistry.js";
+import { withoutUpstreamServerInfo } from "./upstreamResources.js";
 function compactBuiltinToolName(name) {
     return name.startsWith("trellis.") ? name.slice("trellis.".length).replaceAll(".", "_") : name;
 }
@@ -102,6 +103,9 @@ export class BuiltinRegistry {
             await this.listResources(context);
             provider = this.resourceOwners.get(key);
         }
+        // A manifest can introduce supporting files not returned by resources/list.
+        if (!provider && uri.protocol === "trellis-upstream:")
+            provider = this.providers.find((candidate) => candidate.id === "upstream");
         if (!provider?.readResource)
             throw new Error(`unknown Trellis resource "${key}"`);
         return provider.readResource(uri, context);
@@ -190,8 +194,16 @@ export class UpstreamProvider {
         return (await this.backend.listTools());
     }
     async callTool(name, args) {
-        return (await this.backend.callTool(name, args));
+        return withoutUpstreamServerInfo((await this.backend.callTool(name, args)));
     }
+    async listResources() { return await this.backend.listResources?.() ?? []; }
+    async readResource(uri) {
+        if (!this.backend.readResource)
+            throw new Error("upstream resources unavailable");
+        return this.backend.readResource(uri.toString());
+    }
+    async listSkillEntries() { return await this.backend.listSkills?.() ?? []; }
+    async getSkillEntry(uri) { return this.backend.getSkill?.(uri); }
     async close() {
         await this.backend.close();
     }
@@ -202,35 +214,33 @@ export function createRuntimeServer(serverInfo, context, registry) {
             tools: { listChanged: true },
             resources: { listChanged: true },
             prompts: { listChanged: true },
+            extensions: { "io.modelcontextprotocol/skills": {} },
         },
     });
-    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: await registry.listTools(context) }));
-    server.setRequestHandler(CallToolRequestSchema, async (request) => registry.callTool(request.params.name, request.params.arguments, context));
-    server.setRequestHandler(ListResourcesRequestSchema, async () => ({ resources: await registry.listResources(context) }));
-    server.setRequestHandler(ReadResourceRequestSchema, async (request) => registry.readResource(new URL(request.params.uri), context));
-    server.setRequestHandler(ListPromptsRequestSchema, async () => ({ prompts: await registry.listPrompts(context) }));
-    server.setRequestHandler(GetPromptRequestSchema, async (request) => registry.getPrompt(request.params.name, request.params.arguments, context));
-    // `skills/list` and `skills/get` are not in this SDK's schema set (it speaks
-    // at most 2025-11-25), so they are answered through the SDK's fallback for
-    // methods with no registered handler, which keeps the extension free of a new
-    // direct zod dependency. The extension itself is deliberately NOT declared in
-    // the capabilities above: the specification declares it only through
-    // `server/discover`, which this revision lacks, and inventing another field
-    // would claim a protocol nobody defined (trellis-skills-over-mcp D4). Any
-    // other unknown method keeps the SDK's usual "method not found".
-    server.fallbackRequestHandler = async (request) => {
-        const cache = { resultType: "complete", ttlMs: 0, cacheScope: "private" };
-        if (request.method === "skills/list") {
-            return { ...cache, skills: await registry.listSkills(context) };
+    server.setRequestHandler("tools/list", async () => ({ tools: await registry.listTools(context) }));
+    server.setRequestHandler("tools/call", async ({ params }) => registry.callTool(params.name, params.arguments, context));
+    server.setRequestHandler("resources/list", async () => ({ resources: await registry.listResources(context) }));
+    server.setRequestHandler("resources/read", async ({ params }) => {
+        try {
+            return await registry.readResource(new URL(params.uri), context);
         }
-        if (request.method === "skills/get") {
-            const uri = request.params?.uri;
-            const entry = typeof uri === "string" ? await registry.getSkill(uri, context) : undefined;
-            if (!entry)
-                throw new McpError(ErrorCode.InvalidParams, "unknown skill");
-            return { ...cache, skill: entry };
+        catch (err) {
+            if (err instanceof TypeError || (err instanceof Error && /unknown|not found|not allowed|outside|secret-like|invalid.*uri/i.test(err.message))) {
+                throw new ProtocolError(ProtocolErrorCode.InvalidParams, "unknown or unreadable resource");
+            }
+            throw err;
         }
-        throw new McpError(ErrorCode.MethodNotFound, `Method not found: ${request.method}`);
-    };
+    });
+    server.setRequestHandler("prompts/list", async () => ({ prompts: await registry.listPrompts(context) }));
+    server.setRequestHandler("prompts/get", async ({ params }) => registry.getPrompt(params.name, params.arguments, context));
+    const result = z.looseObject({});
+    const cache = { ttlMs: 0, cacheScope: "private" };
+    server.setRequestHandler("skills/list", { params: z.object({ cursor: z.string().optional() }), result }, async () => ({ ...cache, skills: await registry.listSkills(context) }));
+    server.setRequestHandler("skills/get", { params: z.object({ uri: z.string() }), result }, async ({ uri }) => {
+        const entry = await registry.getSkill(uri, context);
+        if (!entry)
+            throw new ProtocolError(ProtocolErrorCode.InvalidParams, "unknown skill");
+        return { ...cache, skill: entry };
+    });
     return server;
 }

package/dist/lib/mcpStatusProvider.d.ts

@@ -1,10 +1,44 @@
-import type { CallToolResult, Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { CallToolResult, Tool } from "@modelcontextprotocol/server";
 import type { GatewayBackend } from "./gatewayBackend.js";
 import type { RuntimeContext, TrellisProvider } from "./mcpRuntime.js";
+import { type OAuthRenewStatus } from "./oauth/renew.js";
+export interface McpStatusProviderOptions {
+    /** Where the OAuth token store lives. Omitted, the `oauth` section of
+     * the report is empty — the provider stays usable by callers with no
+     * home directory, the same contract `LocalBackend` exposes. */
+    homeDir?: string;
+    /** OAuth-classified servers in scope for this agent, with their
+     * ownership (trellis-desktop-oauth-ownership). Trellis-owned servers
+     * connect through the gateway with a Trellis-store token, so their
+     * stored-credential health is meaningful and reported. Agent-owned
+     * servers are direct native entries authorized by the Agent's own
+     * client — reported as `agent-managed` precisely because inferring
+     * their state from Trellis's store would be a lie (that change's
+     * "unknown native authorization is displayed as unknown"). */
+    oauthServers?: readonly OAuthServerRef[];
+}
+export interface OAuthServerRef {
+    name: string;
+    owner: "agent" | "trellis";
+}
+/** One OAuth-classified server's credential health. `credential` — not
+ * `status` — because the gateway cannot observe a direct-routed server's
+ * connection state; claiming "ready" would be a lie
+ * (trellis-mcp-status-credential-health design.md D1). */
+export interface OAuthCredentialReport {
+    name: string;
+    owner: "agent" | "trellis";
+    credential: OAuthRenewStatus | "agent-managed";
+    /** ISO 8601, when the stored token carries an expiry at all. */
+    expiresAt?: string;
+    /** Present only when there is an action for Trellis to take. */
+    remediation?: string;
+}
 export declare class McpStatusProvider implements TrellisProvider {
     private readonly backend;
+    private readonly options;
     readonly id = "mcp";
-    constructor(backend: GatewayBackend);
+    constructor(backend: GatewayBackend, options?: McpStatusProviderOptions);
     listTools(): Tool[];
     callTool(name: string, _args: unknown, _context: RuntimeContext): Promise<CallToolResult>;
 }