feat: port upstream skills and Tools settings (#17691)

apps/server/package.json

@@ -37,6 +37,7 @@
     "@effect/platform-node": "catalog:",
     "@effect/platform-node-shared": "catalog:",
     "@ff-labs/fff-node": "0.11.0",
+    "@modelcontextprotocol/sdk": "1.29.0",
     "@muse-code/sdk": "1.4.6",
     "@napi-rs/keyring": "^1.3.0",
     "@opencode-ai/sdk": "^1.3.15",
@@ -60,6 +61,7 @@
     "node-pty": "^1.2.0-beta.15",
     "playwright-core": "1.60.0",
     "proper-lockfile": "4.1.2",
+    "skills": "1.7.1",
     "stream-chain": "^4.2.5",
     "stream-json": "3.6.0",
     "undici": "catalog:",
@@ -69,7 +71,6 @@
   "devDependencies": {
     "@effect/graphql-generator": "catalog:",
     "@effect/vitest": "catalog:",
-    "@modelcontextprotocol/sdk": "1.29.0",
     "@t3tools/contracts": "workspace:*",
     "@t3tools/provider-testing": "workspace:*",
     "@t3tools/shared": "workspace:*",

apps/server/src/auth/RpcAuthorization.test.ts

@@ -5,6 +5,7 @@ import {
   AuthProvidersManageScope,
   AuthSettingsWriteScope,
   DEFAULT_SERVER_SETTINGS,
+  ProjectId,
   ProviderInstanceId,
   ThreadId,
   AuthOrchestrationOperateScope,
@@ -219,6 +220,61 @@ describe("settings mutation authorization", () => {
     }).pipe(Effect.scoped),
   );
 
+  it.effect("lets a settings grant resend a project's stored MCP server, not change it", () =>
+    Effect.gen(function* () {
+      const projectId = ProjectId.make("project-tools");
+      const linear = {
+        enabled: true,
+        transport: { type: "http" as const, url: "https://mcp.linear.app/mcp", headers: [] },
+      };
+      let handled = 0;
+      const client = yield* RpcTest.makeClient(group).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            group.toLayerHandler(WS_METHODS.serverUpdateSettings, () =>
+              Effect.sync(() => {
+                handled++;
+                return DEFAULT_SERVER_SETTINGS;
+              }),
+            ),
+            RpcAuthorization.layer(
+              [AuthSettingsWriteScope],
+              Effect.succeed({
+                projectSettingsOverrides: { [projectId]: { mcpServers: { linear } } },
+              }),
+            ),
+          ),
+        ),
+      );
+      // Turning a skill off resends the project's server exactly as stored.
+      yield* client[WS_METHODS.serverUpdateSettings]({
+        patch: {
+          projectSettingsOverrides: {
+            [projectId]: { mcpServers: { linear }, disabledSkills: { "grill-me": true } },
+          },
+        },
+      });
+      expect(handled).toBe(1);
+      expect(
+        yield* client[WS_METHODS.serverUpdateSettings]({
+          patch: {
+            projectSettingsOverrides: {
+              [projectId]: {
+                mcpServers: {
+                  linear: {
+                    ...linear,
+                    transport: { ...linear.transport, url: "https://example.com/mcp" },
+                  },
+                },
+              },
+            },
+          },
+        }).pipe(Effect.flip),
+      ).toMatchObject({ requiredPermission: AuthProvidersManageScope });
+      expect(handled).toBe(1);
+    }).pipe(Effect.scoped),
+  );
+
   it.effect("does not let a settings grant create or remove providers", () =>
     Effect.gen(function* () {
       let handled = false;

apps/server/src/auth/RpcAuthorization.ts

@@ -6,6 +6,7 @@ import {
   AssetCreateUrlInput,
   AuthAccessReadScope,
   ServerSettingsPatch,
+  type ServerSettings,
   ProviderInstanceMutation,
   requiredScopesForServerSettingsPatch,
   requiredScopesForProjectMutation,
@@ -154,6 +155,16 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.pullRequestsLabelCandidates]: AuthOrchestrationReadScope,
   [WS_METHODS.sourceControlLookupRepository]: AuthOrchestrationReadScope,
   [WS_METHODS.subscribeProjectClones]: AuthOrchestrationReadScope,
+  // The server lists skill folders itself; a client never names a path.
+  [WS_METHODS.skillsInspect]: AuthFilesystemReadScope,
+  // A preview unpacks a source into a temp folder and deletes it.
+  [WS_METHODS.skillsPreview]: AuthFilesystemReadScope,
+  // Packs a folder an agent reports for that skill, nothing a client names.
+  [WS_METHODS.skillsExport]: AuthFilesystemReadScope,
+  // Listing a server's tools runs its command with its stored secrets, which
+  // only a connection allowed to add that command may do. A read the client
+  // caches as a query, so the client checks the scope itself (no guard entry).
+  [WS_METHODS.mcpServersListTools]: AuthProvidersManageScope,
   [WS_METHODS.projectsListEntries]: AuthFilesystemReadScope,
   [WS_METHODS.projectsListIgnoredFiles]: AuthFilesystemReadScope,
   [WS_METHODS.projectsReadFile]: AuthFilesystemReadScope,
@@ -245,9 +256,12 @@ const SettingsUpdate = Schema.Struct({
   providerInstanceMutation: Schema.optionalKey(ProviderInstanceMutation),
 });
 
-const requiredScopesForSettingsUpdate = (payload: unknown) => {
+const requiredScopesForSettingsUpdate = (
+  payload: unknown,
+  current: Pick<ServerSettings, "projectSettingsOverrides"> | undefined,
+) => {
   const input = Schema.decodeUnknownSync(SettingsUpdate)(payload);
-  const scopes = requiredScopesForServerSettingsPatch(input.patch);
+  const scopes = requiredScopesForServerSettingsPatch(input.patch, current);
   if (input.providerInstanceMutation === undefined) return scopes;
   // An atomic provider mutation carries an empty patch unless it also changes settings.
   return Object.values(input.patch).every((value) => value === undefined)
@@ -260,6 +274,7 @@ const decodeProjectMutation = Schema.decodeUnknownSync(ProjectMutation);
 const requiredScopesForRpcCall = (
   method: string,
   payload: unknown,
+  currentSettings?: Pick<ServerSettings, "projectSettingsOverrides">,
 ): ReadonlyArray<AuthEnvironmentScope> => {
   if (method === WS_METHODS.serverRetryResourceTelemetry) {
     return [AuthEnvironmentMaintainScope, AuthDiagnosticsReadScope];
@@ -274,7 +289,9 @@ const requiredScopesForRpcCall = (
         : AuthOrchestrationReadScope,
     ];
   }
-  if (method === WS_METHODS.serverUpdateSettings) return requiredScopesForSettingsUpdate(payload);
+  if (method === WS_METHODS.serverUpdateSettings) {
+    return requiredScopesForSettingsUpdate(payload, currentSettings);
+  }
   if (method === WS_METHODS.projectsMutate) {
     return requiredScopesForProjectMutation(decodeProjectMutation(payload));
   }
@@ -284,22 +301,34 @@ const requiredScopesForRpcCall = (
 };
 
 /**
+ * Authorizes every RPC on one connection against that connection's session scopes.
+ * `currentSettings` lets a settings update that only resends a project's stored
+ * MCP servers pass with `settings:write`.
+ *
  * `onAuthorized` runs once after an authorized request succeeds; for a stream
  * RPC, that is when the stream completes. Every RPC passes through here, so it
  * is the one place to observe requests without wrapping each handler.
  */
 export const layer = (
   scopes: ReadonlyArray<AuthEnvironmentScope>,
+  currentSettings: Effect.Effect<
+    Pick<ServerSettings, "projectSettingsOverrides"> | undefined
+  > = Effect.succeed(undefined),
   onAuthorized?: (method: string, payload: unknown) => Effect.Effect<void>,
 ) =>
-  Layer.succeed(RpcScopeAuthorization)((effect, { rpc, payload }) => {
-    const requiredScopes = requiredScopesForRpcCall(rpc._tag, payload);
-    const requiredScope = requiredScopes.find((scope) => !scopes.includes(scope));
-    if (requiredScope !== undefined) return Effect.fail(rpcAuthorizationError(requiredScope));
-    return onAuthorized === undefined
-      ? effect
-      : Effect.tap(effect, () => onAuthorized(rpc._tag, payload));
-  });
+  Layer.succeed(RpcScopeAuthorization)((effect, { rpc, payload }) =>
+    Effect.gen(function* () {
+      const settings =
+        rpc._tag === WS_METHODS.serverUpdateSettings ? yield* currentSettings : undefined;
+      const requiredScopes = requiredScopesForRpcCall(rpc._tag, payload, settings);
+      const requiredScope = requiredScopes.find((scope) => !scopes.includes(scope));
+      if (requiredScope !== undefined)
+        return yield* Effect.fail(rpcAuthorizationError(requiredScope));
+      return yield* onAuthorized === undefined
+        ? effect
+        : Effect.tap(effect, () => onAuthorized(rpc._tag, payload));
+    }),
+  );
 
 /** Retrying can install or restart tools even though ordinary listing is readable. */
 export const requiredScopeForDeviceList = (input: DeviceListInput): AuthEnvironmentScope =>

apps/server/src/bin.ts

@@ -23,6 +23,10 @@ if (
   } else if (command === "acp-mcp-bridge" || command === "acp-mcp-call") {
     const { runAcpMcpCliFastPath } = await import("./mcp/AcpMcpStdioBridge.ts");
     await runAcpMcpCliFastPath(command, process.argv.slice(3));
+  } else if (command === "skills-cli") {
+    // Option parsing belongs to the skills CLI, so it skips the T3 CLI entirely.
+    const { runSkillsCli } = await import("./cli/skillsCli.ts");
+    await runSkillsCli(process.argv.slice(3));
   } else {
     // Before anything reads stdin: the desktop app's Windows launcher starts
     // the CLI without one. Never for the fast paths, whose stdin is a pipe.

apps/server/src/binCli.ts

@@ -9,6 +9,7 @@ import * as CliError from "effect/cli/CliError";
 import * as NetService from "@t3tools/shared/Net";
 import packageJson from "../package.json" with { type: "json" };
 import { acpMcpBridgeCommand, acpMcpCallCommand } from "./cli/acpMcpBridge.ts";
+import { skillsCliCommand } from "./cli/skillsCli.ts";
 import { authCommand } from "./cli/auth.ts";
 import { appCommand } from "./cli/app.ts";
 import { browserCommand } from "./cli/browser.ts";
@@ -70,6 +71,7 @@ export const makeCli = ({ cloudEnabled = hasCloudPublicConfig } = {}) =>
       ),
       acpMcpBridgeCommand,
       acpMcpCallCommand,
+      skillsCliCommand,
       startCommand,
       serveCommand,
       appCommand,

apps/server/src/cli/skillsCli.ts

@@ -0,0 +1,33 @@
+import * as Effect from "effect/Effect";
+import { Argument, Command } from "effect/cli";
+
+/**
+ * `t3 skills-cli <args…>` runs the bundled `skills` CLI (vercel-labs/skills),
+ * the installer `npx skills` runs. The server spawns it through this hidden
+ * subcommand so installs need no Node or npm of their own: the CLI is part of
+ * this build, and runs as a child so its `process.exit` and prompts stay out
+ * of the server.
+ */
+export async function runSkillsCli(args: ReadonlyArray<string>): Promise<void> {
+  // The CLI prints its `--json` result and calls `process.exit` straight
+  // away. Writes to a pipe are asynchronous on POSIX, so whatever hasn't
+  // flushed would be lost: a large result is cut at 64 KiB. A blocking pipe
+  // finishes each write before the next statement, so exit loses nothing.
+  // (Windows pipes are already synchronous.)
+  const stdout = process.stdout as typeof process.stdout & {
+    readonly _handle?: { readonly setBlocking?: (blocking: boolean) => void };
+  };
+  stdout._handle?.setBlocking?.(true);
+  // The CLI reads its command from argv[2] onward.
+  process.argv = [process.argv[0] ?? "node", "skills", ...args];
+  await import("skills/dist/cli.mjs");
+}
+
+/** Real invocations dispatch through the bin.ts fast path before the CLI graph loads. */
+export const skillsCliCommand = Command.make("skills-cli", {
+  args: Argument.String("args").pipe(Argument.variadic()),
+}).pipe(
+  Command.withDescription("Run the bundled skills installer."),
+  Command.unlisted,
+  Command.withHandler(({ args }) => Effect.promise(() => runSkillsCli(args))),
+);

apps/server/src/device/DeviceService.test.ts

@@ -198,6 +198,7 @@ const fixture = Effect.fn("fixture")(function* (
       ServerSettings.ServerSettingsService,
       ServerSettings.ServerSettingsService.of({
         updateProviderInstance: () => Effect.die("Unexpected provider mutation"),
+        updateSettingsWith: () => Effect.die("Unexpected settings update"),
         withSettingsSnapshot: (use) => Effect.flatMap(Ref.get(settings), use),
         start: Effect.void,
         ready: Effect.void,

apps/server/src/mcp/McpHttpServer.ts

@@ -43,7 +43,9 @@ import * as OrchestratorMcpService from "./OrchestratorMcpService.ts";
 import { PreviewControlsToolkit } from "./toolkits/previewControls/tools.ts";
 import * as PreviewControlsHandlers from "./toolkits/previewControls/handlers.ts";
 import { EnvironmentToolkit } from "./toolkits/environment/tools.ts";
+import { ToolsToolkit } from "./toolkits/tools/tools.ts";
 import * as EnvironmentHandlers from "./toolkits/environment/handlers.ts";
+import * as ToolsHandlers from "./toolkits/tools/handlers.ts";
 import { ProjectToolkit } from "./toolkits/project/tools.ts";
 import * as ProjectHandlers from "./toolkits/project/handlers.ts";
 import { AttachmentToolkit } from "./toolkits/attachment/tools.ts";
@@ -1055,6 +1057,10 @@ const layerEnvironmentToolkit = toolkitRegistration(
 
 const layerProjectRegistration = toolkitRegistration(ProjectToolkit, ProjectHandlers.layer);
 
+const layerToolsRegistration = toolkitRegistration(ToolsToolkit, ToolsHandlers.layer).pipe(
+  Layer.provide(ThreadCommandExecutor.layer),
+);
+
 export const layerAttachmentToolkit = toolkitRegistration(
   AttachmentToolkit,
   AttachmentHandlers.layer,
@@ -1148,13 +1154,39 @@ export const layerMcpTransport = McpServer.layerHttp({
   allowSessionTermination: true,
 }).pipe(Layer.provide(layerMcpAuthMiddleware));
 
+/**
+ * Every tool `layer` registers, for describing `t3-code` without a session
+ * (Settings → Tools). Add a toolkit here when you register one below.
+ */
+export const T3_MCP_TOOLKITS: ReadonlyArray<Toolkit.Any> = [
+  PreviewStandardToolkit,
+  PreviewSnapshotToolkit,
+  OrchestratorToolkit,
+  ThreadToolkit,
+  AttachmentToolkit,
+  ProjectToolkit,
+  EnvironmentToolkit,
+  ToolsToolkit,
+  PreviewControlsToolkit,
+  WorktreeToolkit,
+  PullRequestsToolkit,
+  DeviceStandardToolkit,
+  DeviceScreenshotToolkit,
+  HtmlRenderToolkit,
+  HtmlPreviewToolkit,
+  DocsToolkit,
+  AipmToolkit,
+  McpServersToolkit,
+];
+
 export const layer = Layer.mergeAll(
   layerPreviewToolkit,
   layerOrchestratorToolkit,
   layerThreadToolkit,
   layerAttachmentToolkit,
   layerProjectRegistration,
   layerEnvironmentToolkit,
+  layerToolsRegistration,
   layerPreviewControlsRegistration,
   layerWorktreeToolkitRegistration,
   layerPullRequestsToolkit,

apps/server/src/mcp/resolveAgentTools.ts

@@ -0,0 +1,27 @@
+import type { ProjectId, ResolvedMcpServer, ServerSettings } from "@t3tools/contracts";
+import { resolveProjectSettings } from "@t3tools/shared/projectSettings";
+
+import type { McpProviderSessionTools } from "@t3tools/provider-core/server/mcpSession";
+
+/**
+ * A thread's tools from settings whose secrets are already materialized:
+ * the project's overrides applied, disabled servers dropped. The fingerprint
+ * covers the full config so a rotated secret also counts as a change; it
+ * stays on the server and is only ever compared, never sent or logged.
+ */
+export function resolveAgentTools(
+  settings: ServerSettings,
+  projectId: ProjectId | null,
+): McpProviderSessionTools {
+  const effective = resolveProjectSettings(settings, projectId).settings;
+  const servers: ResolvedMcpServer[] = Object.entries(effective.mcpServers)
+    .filter(([, server]) => server.enabled)
+    .map(([name, server]) => ({ name, transport: server.transport }))
+    .toSorted((left, right) => left.name.localeCompare(right.name));
+  const disabledSkills = [...new Set(effective.disabledSkills)].toSorted();
+  const fingerprint =
+    servers.length === 0 && disabledSkills.length === 0
+      ? ""
+      : JSON.stringify({ servers, disabledSkills });
+  return { servers, disabledSkills, fingerprint };
+}