agent-trellis 0.20.0 → 0.21.0

package/dist/pi-bridge/index.js

@@ -24,7 +24,7 @@ import { toParametersSchema, toPiContent } from "./schemaTranslate.js";
  * extraction changed nothing it could observe. */
 export { withTimeout };
 const CLIENT_INFO = { name: "trellis-mcp-bridge", version: "0.0.0" };
-function listServerTools(client, timeoutMs) {
+async function listServerTools(client, timeoutMs) {
     return withTimeout(client.listTools(), timeoutMs, `listTools timed out after ${timeoutMs}ms`).then((result) => result.tools);
 }
 /**
@@ -43,7 +43,7 @@ export default async function trellisMcpBridge(pi, homeDir = homedir(), connectT
     // independent of whether `trellis onboard` was ever run to add pi to
     // managed.yaml. managedAgents governs static config-file writes; this
     // is pi reading canonical directly at its own runtime, P4's own concern.
-    const { desired } = resolveMcpPlan("pi", canonical.mcp, ALL_AGENTS, canonical.secretsPolicy);
+    const { desired } = await resolveMcpPlan("pi", canonical.mcp, ALL_AGENTS, canonical.secretsPolicy);
     const clients = new Set();
     const registry = new McpToolRegistry();
     const closeClient = async (client) => {

package/docs/research.md

@@ -221,7 +221,10 @@ real incidents during development (a GitLab PAT stored under the wrong
 variable name, and three divergent values of the same router token, one of
 which was silently invalid). Trellis's contribution here is `trellis secrets
 audit` — a linter that fails a build if any adapter output contains a raw
-credential — not a new secret store.
+credential — not a new secret store. The concrete reference form is
+`mxenv://<profile>/<KEY>` (mx-env-secret-source): written in `servers.yaml`
+`env`/`envAliases`, resolved from the encrypted mxenv store at consumption
+point, delivered under the `KEY` segment.
 
 A third real incident during migrate-in: a source config's `${VAR}`
 reference doesn't always name itself (`OPENAPI_MCP_HEADERS:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-trellis",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "A unified Code Agent Runtime for Skills, MCP, Memory, and shared instructions across Claude Code, Codex, Kiro, pi, Kimi Code, and ZCode.",
   "license": "MIT",
   "author": "Paul Leo",
@@ -69,6 +69,7 @@
     "@modelcontextprotocol/client": "^2.3.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@modelcontextprotocol/server": "^2.3.1",
+    "@morphixai/mxenv-core": "^0.12.2",
     "smol-toml": "^1.9.1",
     "yaml": "^2.9.1",
     "zod": "^4.6.5"

package/schema/secrets.policy.example.yaml

@@ -12,6 +12,11 @@
 # whose own native MCP client resolves `${VAR}` in its own process), so it
 # already has to read a value into memory to hand to that subprocess.
 #
+# Prefer `mxenv://<profile>/<KEY>` references in servers.yaml `env` /
+# `envAliases` entries where possible: they resolve from the encrypted
+# mxenv store at consumption time and need neither ambient env nor a
+# plaintext env_file (mx-env-secret-source).
+#
 # env_file (optional) narrows *where* the bridge reads those values from —
 # a dotenv-format file (KEY=VALUE per line, no quoting/interpolation), never
 # merged with ambient process env once set: a name absent from it resolves

package/schema/servers.example.yaml

@@ -1,7 +1,11 @@
 # .trellis/mcp/servers.yaml — canonical MCP server definitions.
 #
 # Rules (see docs/architecture.md and docs/research.md §"Secrets"):
-#   - `env` values are variable NAMES only. Never a literal secret.
+#   - `env` values are variable NAMES only, or `mxenv://<profile>/<KEY>`
+#     references resolved from the mxenv store at consumption time and
+#     delivered under the `KEY` segment (mx-env-secret-source). A
+#     reference gives this file value-free, machine-independent
+#     provenance; prefer it over relying on ambient process env.
 #   - Real values come from whatever already populates process env
 #     (a plain `.env`-style file, 1Password's `op run`, etc.) — Trellis
 #     does not store or transport secret values itself.