agent-trellis 0.14.0 → 0.14.1

package/dist/adapters/piMcp.d.ts

@@ -28,8 +28,11 @@ export declare function supportsNativeMcp(version: string | undefined): boolean;
  * `pi mcp add` writes (observed 2026-10-11): stdio as
  * `{command, args, env?}`, http as `{url, headers?}`, no `type` field.
  * `env` names render as `${VAR}` references exactly like the other JSON
- * agents; OAuth `auth` metadata is Trellis-side routing information and
- * is never rendered (an agent-owned OAuth server becomes a bare `{url}`
- * entry that `pi mcp login <name>` authorizes into pi's own token store).
+ * agents; OAuth `auth` metadata is Trellis-side routing information and is
+ * never rendered — with one exception: a declared `auth.client_name` becomes
+ * the entry's `oauth.clientName`, the field `pi mcp add --oauth-client-name`
+ * writes, so providers that gate dynamic client registration by client name
+ * (Figma) accept `pi mcp login`'s registration and later syncs compare equal
+ * instead of stripping the block (oauth-client-name design.md D2).
  */
 export declare function piRenderer(def: McpServerDef, _name: string): Record<string, unknown>;

package/dist/adapters/piMcp.js

@@ -11,6 +11,7 @@
  * unchanged. sse is not a pi transport — the adapter turns sse servers
  * into conflict items rather than writing entries pi cannot connect.
  */
+import { isOAuthAuth } from "../core/types.js";
 import { resolvedEnvTextMap } from "../lib/mcpMigrateRead.js";
 /** The pi release that introduced the native MCP client (`pi mcp`,
  * `~/.pi/agent/mcp.json`). */
@@ -37,9 +38,12 @@ export function supportsNativeMcp(version) {
  * `pi mcp add` writes (observed 2026-10-11): stdio as
  * `{command, args, env?}`, http as `{url, headers?}`, no `type` field.
  * `env` names render as `${VAR}` references exactly like the other JSON
- * agents; OAuth `auth` metadata is Trellis-side routing information and
- * is never rendered (an agent-owned OAuth server becomes a bare `{url}`
- * entry that `pi mcp login <name>` authorizes into pi's own token store).
+ * agents; OAuth `auth` metadata is Trellis-side routing information and is
+ * never rendered — with one exception: a declared `auth.client_name` becomes
+ * the entry's `oauth.clientName`, the field `pi mcp add --oauth-client-name`
+ * writes, so providers that gate dynamic client registration by client name
+ * (Figma) accept `pi mcp login`'s registration and later syncs compare equal
+ * instead of stripping the block (oauth-client-name design.md D2).
  */
 export function piRenderer(def, _name) {
     if (def.transport === "http" || def.transport === "sse") {
@@ -47,6 +51,9 @@ export function piRenderer(def, _name) {
         if (def.headers && Object.keys(def.headers).length > 0) {
             entry.headers = def.headers;
         }
+        if (isOAuthAuth(def.auth) && typeof def.auth === "object" && def.auth.clientName !== undefined) {
+            entry.oauth = { clientName: def.auth.clientName };
+        }
         return entry;
     }
     const entry = { command: def.command, args: def.args ?? [] };

package/dist/core/canonical.d.ts

@@ -10,9 +10,10 @@ import type { BackupSession } from "../lib/backup.js";
  * The on-disk shape for one server entry — `static_env`/`env_aliases`
  * (snake_case, like every other multi-word key across `.trellis/*.yaml`)
  * are translated to `McpServerDef.staticEnv`/`envAliases` (camelCase)
- * below, and `auth`'s object form carries `client_id`/`client_secret_env`
- * the same way (trellis-mcp-static-env-and-disabled-servers,
- * trellis-migrate-env-var-alias, trellis-mcp-oauth-static-client).
+ * below, and `auth`'s object form carries `client_id`/`client_secret_env`/
+ * `client_name` the same way (trellis-mcp-static-env-and-disabled-servers,
+ * trellis-migrate-env-var-alias, trellis-mcp-oauth-static-client,
+ * oauth-client-name).
  */
 type McpServerDefYaml = Omit<McpServerDef, "staticEnv" | "envAliases" | "auth"> & {
     static_env?: Record<string, string>;
@@ -28,6 +29,7 @@ type McpAuthYaml = string | {
     owner?: unknown;
     client_id?: unknown;
     client_secret_env?: unknown;
+    client_name?: unknown;
 };
 /** Inverse of `fromServerDefYaml` (trellis-canonical-cli-crud) — strips
  * `undefined` fields so the written YAML never gets a literal `null`

package/dist/core/canonical.js

@@ -34,12 +34,12 @@ function fromAuthYaml(serverName, auth) {
     if (auth === "oauth")
         return "oauth";
     if (typeof auth !== "object" || auth === null) {
-        throw new Error(`mcp/servers.yaml: "${serverName}" auth must be the scalar "oauth" or { kind: oauth, client_id?, client_secret_env? }`);
+        throw new Error(`mcp/servers.yaml: "${serverName}" auth must be the scalar "oauth" or { kind: oauth, client_id?, client_secret_env?, client_name? }`);
     }
-    const { kind, owner, client_id, client_secret_env, ...extra } = auth;
+    const { kind, owner, client_id, client_secret_env, client_name, ...extra } = auth;
     const unknownKey = Object.keys(extra)[0];
     if (unknownKey !== undefined) {
-        throw new Error(`mcp/servers.yaml: "${serverName}" auth has unrecognized key "${unknownKey}" — expected kind, owner, client_id, client_secret_env`);
+        throw new Error(`mcp/servers.yaml: "${serverName}" auth has unrecognized key "${unknownKey}" — expected kind, owner, client_id, client_secret_env, client_name`);
     }
     if (kind !== "oauth") {
         throw new Error(`mcp/servers.yaml: "${serverName}" auth.kind must be "oauth" — kind is the only recognized discriminator`);
@@ -50,6 +50,9 @@ function fromAuthYaml(serverName, auth) {
     if (client_secret_env !== undefined && (typeof client_secret_env !== "string" || !isValidSecretVarName(client_secret_env))) {
         throw new Error(`mcp/servers.yaml: "${serverName}" auth.client_secret_env must be a variable NAME (e.g. FIGMA_CLIENT_SECRET), never a secret value`);
     }
+    if (client_name !== undefined && typeof client_name !== "string") {
+        throw new Error(`mcp/servers.yaml: "${serverName}" auth.client_name must be a string`);
+    }
     const out = { kind: "oauth" };
     if (owner !== undefined && owner !== "agent" && owner !== "trellis")
         throw new Error(`mcp/servers.yaml: "${serverName}" auth.owner must be agent or trellis`);
@@ -59,6 +62,8 @@ function fromAuthYaml(serverName, auth) {
         out.clientId = client_id;
     if (typeof client_secret_env === "string")
         out.clientSecretEnv = client_secret_env;
+    if (typeof client_name === "string")
+        out.clientName = client_name;
     return out;
 }
 /** Inverse of `fromServerDefYaml` (trellis-canonical-cli-crud) — strips
@@ -80,6 +85,7 @@ export function toServerDefYaml(def) {
                     ...(auth.owner !== undefined ? { owner: auth.owner } : {}),
                     ...(auth.clientId !== undefined ? { client_id: auth.clientId } : {}),
                     ...(auth.clientSecretEnv !== undefined ? { client_secret_env: auth.clientSecretEnv } : {}),
+                    ...(auth.clientName !== undefined ? { client_name: auth.clientName } : {}),
                 };
     }
     for (const key of Object.keys(out)) {

package/dist/core/types.d.ts

@@ -19,6 +19,10 @@ export interface McpAuthConfig {
     owner?: "agent" | "trellis";
     clientId?: string;
     clientSecretEnv?: string;
+    /** Self-asserted display name an Agent presents at dynamic client
+     * registration — for providers that gate DCR by client name (Figma).
+     * Public metadata, not a credential (oauth-client-name design.md D1). */
+    clientName?: string;
 }
 /** True when `auth` classifies the server as OAuth, in either form. Every
  * former `def.auth === "oauth"` check must go through this now that the

package/dist/pi-bridge/bundle.js

@@ -7948,12 +7948,12 @@ function fromServerDefYaml(serverName, def) {
 function fromAuthYaml(serverName, auth2) {
   if (auth2 === "oauth") return "oauth";
   if (typeof auth2 !== "object" || auth2 === null) {
-    throw new Error(`mcp/servers.yaml: "${serverName}" auth must be the scalar "oauth" or { kind: oauth, client_id?, client_secret_env? }`);
+    throw new Error(`mcp/servers.yaml: "${serverName}" auth must be the scalar "oauth" or { kind: oauth, client_id?, client_secret_env?, client_name? }`);
   }
-  const { kind, owner, client_id, client_secret_env, ...extra } = auth2;
+  const { kind, owner, client_id, client_secret_env, client_name, ...extra } = auth2;
   const unknownKey = Object.keys(extra)[0];
   if (unknownKey !== void 0) {
-    throw new Error(`mcp/servers.yaml: "${serverName}" auth has unrecognized key "${unknownKey}" \u2014 expected kind, owner, client_id, client_secret_env`);
+    throw new Error(`mcp/servers.yaml: "${serverName}" auth has unrecognized key "${unknownKey}" \u2014 expected kind, owner, client_id, client_secret_env, client_name`);
   }
   if (kind !== "oauth") {
     throw new Error(`mcp/servers.yaml: "${serverName}" auth.kind must be "oauth" \u2014 kind is the only recognized discriminator`);
@@ -7964,11 +7964,15 @@ function fromAuthYaml(serverName, auth2) {
   if (client_secret_env !== void 0 && (typeof client_secret_env !== "string" || !isValidSecretVarName(client_secret_env))) {
     throw new Error(`mcp/servers.yaml: "${serverName}" auth.client_secret_env must be a variable NAME (e.g. FIGMA_CLIENT_SECRET), never a secret value`);
   }
+  if (client_name !== void 0 && typeof client_name !== "string") {
+    throw new Error(`mcp/servers.yaml: "${serverName}" auth.client_name must be a string`);
+  }
   const out = { kind: "oauth" };
   if (owner !== void 0 && owner !== "agent" && owner !== "trellis") throw new Error(`mcp/servers.yaml: "${serverName}" auth.owner must be agent or trellis`);
   if (owner !== void 0) out.owner = owner;
   if (typeof client_id === "string") out.clientId = client_id;
   if (typeof client_secret_env === "string") out.clientSecretEnv = client_secret_env;
+  if (typeof client_name === "string") out.clientName = client_name;
   return out;
 }
 function trellisRoot(homeDir) {

package/docs/getting-started.md

@@ -309,6 +309,22 @@ Two pi-specific behaviors to know:
   run `pi mcp login <name>` once; the grant lives in pi's own token store
   (`~/.pi/agent/mcp-auth.json`), and `trellis.mcp.status` reports them as
   `agent-managed`.
+- Some providers (Figma, while in beta) gate OAuth dynamic client
+  registration by an allowlisted `client_name`, which rejects pi's default.
+  Declare the name canonically and pi registers under it:
+
+  ```yaml
+  figma:
+    transport: http
+    url: https://mcp.figma.com/mcp
+    auth:
+      kind: oauth
+      client_name: Claude Code
+  ```
+
+  Trellis then writes `oauth.clientName` into the pi entry — the same field
+  `pi mcp add --oauth-client-name` writes — so syncs converge instead of
+  stripping it.
 
 On pi older than 1.1.0 nothing changes: the bridge extension remains the
 delivery mechanism and `mcp.json` is never written.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-trellis",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "A unified Code Agent Runtime for Skills, MCP, Memory, and shared instructions across Claude Code, Codex, Kiro, pi, Kimi Code, and ZCode.",
   "license": "MIT",
   "author": "Paul Leo",