feat: install skills from a source, view their files, and let agents change Tools

apps/server/package.json

@@ -38,6 +38,7 @@
     "@effect/platform-node": "catalog:",
     "@effect/platform-node-shared": "catalog:",
     "@ff-labs/fff-node": "0.11.0",
+    "@modelcontextprotocol/sdk": "1.29.0",
     "@muse-code/sdk": "1.4.6",
     "@napi-rs/keyring": "^1.3.0",
     "@t3tools/provider-acp": "workspace:*",
@@ -66,6 +67,7 @@
     "playwright-core": "1.60.0",
     "proper-lockfile": "4.1.2",
     "saxes": "6.0.0",
+    "skills": "1.7.1",
     "stream-chain": "^4.2.5",
     "stream-json": "3.6.0",
     "undici": "catalog:",

apps/server/src/auth/RpcAuthorization.test.ts

@@ -6,6 +6,7 @@ import {
   AuthSettingsWriteScope,
   DEFAULT_SERVER_SETTINGS,
   ProviderDriverKind,
+  ProjectId,
   ProviderInstanceId,
   SecretProviderId,
   ThreadId,
@@ -196,6 +197,62 @@ describe("settings mutation authorization", () => {
     }).pipe(Effect.scoped),
   );
 
+  it.effect("lets a settings grant resend a project's stored MCP server, not change it", () =>
+    Effect.gen(function* () {
+      const projectId = ProjectId.make("project-tools");
+      const linear = {
+        enabled: true,
+        transport: { type: "http" as const, url: "https://mcp.linear.app/mcp", headers: [] },
+      };
+      let handled = 0;
+      const client = yield* RpcTest.makeClient(group).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            group.toLayerHandler(WS_METHODS.serverUpdateSettings, () =>
+              Effect.sync(() => {
+                handled++;
+                return DEFAULT_SERVER_SETTINGS;
+              }),
+            ),
+            RpcAuthorization.layer(
+              [AuthSettingsWriteScope],
+              undefined,
+              Effect.succeed({
+                projectSettingsOverrides: { [projectId]: { mcpServers: { linear } } },
+              }),
+            ),
+          ),
+        ),
+      );
+      // Turning a skill off resends the project's server exactly as stored.
+      yield* client[WS_METHODS.serverUpdateSettings]({
+        patch: {
+          projectSettingsOverrides: {
+            [projectId]: { mcpServers: { linear }, disabledSkills: { "grill-me": true } },
+          },
+        },
+      });
+      expect(handled).toBe(1);
+      expect(
+        yield* client[WS_METHODS.serverUpdateSettings]({
+          patch: {
+            projectSettingsOverrides: {
+              [projectId]: {
+                mcpServers: {
+                  linear: {
+                    ...linear,
+                    transport: { ...linear.transport, url: "https://example.com/mcp" },
+                  },
+                },
+              },
+            },
+          },
+        }).pipe(Effect.flip),
+      ).toMatchObject({ requiredPermission: AuthProvidersManageScope });
+      expect(handled).toBe(1);
+    }).pipe(Effect.scoped),
+  );
+
   it.effect("does not let a settings grant create or remove providers or secret providers", () =>
     Effect.gen(function* () {
       let handled = false;

apps/server/src/auth/RpcAuthorization.ts

@@ -6,6 +6,7 @@ import {
   AssetCreateUrlInput,
   AuthAccessReadScope,
   ServerSettingsPatch,
+  type ServerSettings,
   ProviderInstanceMutation,
   requiredScopesForServerSettingsPatch,
   requiredScopesForProjectMutation,
@@ -144,6 +145,16 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.sourceControlAppAccess]: AuthOrchestrationReadScope,
   [WS_METHODS.sourceControlStarred]: AuthOrchestrationReadScope,
   [WS_METHODS.subscribeProjectClones]: AuthOrchestrationReadScope,
+  // The server lists skill folders itself; a client never names a path.
+  [WS_METHODS.skillsInspect]: AuthFilesystemReadScope,
+  // A preview unpacks a source into a temp folder and deletes it.
+  [WS_METHODS.skillsPreview]: AuthFilesystemReadScope,
+  // Packs a folder an agent reports for that skill, nothing a client names.
+  [WS_METHODS.skillsExport]: AuthFilesystemReadScope,
+  // Listing a server's tools runs its command with its stored secrets, which
+  // only a connection allowed to add that command may do. A read the client
+  // caches as a query, so the client checks the scope itself (no guard entry).
+  [WS_METHODS.mcpServersListTools]: AuthProvidersManageScope,
   [WS_METHODS.projectsListEntries]: AuthFilesystemReadScope,
   [WS_METHODS.projectsListIgnoredFiles]: AuthFilesystemReadScope,
   [WS_METHODS.projectsReadFile]: AuthFilesystemReadScope,
@@ -235,9 +246,12 @@ const SettingsUpdate = Schema.Struct({
 // Middleware receives the payload already decoded, so it is checked against the decoded shape.
 const decodeSettingsUpdate = Schema.decodeUnknownSync(Schema.toType(SettingsUpdate));
 
-const requiredScopesForSettingsUpdate = (payload: unknown) => {
+const requiredScopesForSettingsUpdate = (
+  payload: unknown,
+  current: Pick<ServerSettings, "projectSettingsOverrides"> | undefined,
+) => {
   const input = decodeSettingsUpdate(payload);
-  const scopes = requiredScopesForServerSettingsPatch(input.patch);
+  const scopes = requiredScopesForServerSettingsPatch(input.patch, current);
   if (input.providerInstanceMutation === undefined) return scopes;
   return Object.values(input.patch).every((value) => value === undefined)
     ? [AuthProvidersManageScope]
@@ -250,6 +264,7 @@ const decodeAssetCreateUrlInput = Schema.decodeUnknownSync(AssetCreateUrlInput);
 const requiredScopesForRpcCall = (
   method: string,
   payload: unknown,
+  currentSettings?: Pick<ServerSettings, "projectSettingsOverrides">,
 ): ReadonlyArray<AuthEnvironmentScope> => {
   if (method === WS_METHODS.serverRetryResourceTelemetry) {
     return [AuthEnvironmentMaintainScope, AuthDiagnosticsReadScope];
@@ -264,7 +279,9 @@ const requiredScopesForRpcCall = (
         : AuthOrchestrationReadScope,
     ];
   }
-  if (method === WS_METHODS.serverUpdateSettings) return requiredScopesForSettingsUpdate(payload);
+  if (method === WS_METHODS.serverUpdateSettings) {
+    return requiredScopesForSettingsUpdate(payload, currentSettings);
+  }
   if (method === WS_METHODS.projectsMutate) {
     return requiredScopesForProjectMutation(decodeProjectMutation(payload));
   }
@@ -274,21 +291,28 @@ const requiredScopesForRpcCall = (
 };
 
 /**
- * `onAuthorized` runs once after an authorized request succeeds; for a stream
- * RPC, that is when the stream completes. Every RPC passes through here, so it
- * is the one place to observe requests without wrapping each handler.
+ * `onAuthorized` runs once after an authorized request succeeds (a stream RPC: when it
+ * completes), the one place to observe every request. `currentSettings` lets a settings
+ * update that only resends a project's stored MCP servers pass with `settings:write`.
  */
 export const layer = (
   scopes: ReadonlyArray<AuthEnvironmentScope>,
   onAuthorized?: (method: string, payload: unknown) => Effect.Effect<void>,
+  currentSettings?: Effect.Effect<Pick<ServerSettings, "projectSettingsOverrides"> | undefined>,
 ) =>
   Layer.succeed(RpcScopeAuthorization)((effect, { rpc, payload }) => {
-    const requiredScopes = requiredScopesForRpcCall(rpc._tag, payload);
-    const requiredScope = requiredScopes.find((scope) => !scopes.includes(scope));
-    if (requiredScope !== undefined) return Effect.fail(rpcAuthorizationError(requiredScope));
-    return onAuthorized === undefined
-      ? effect
-      : Effect.tap(effect, () => onAuthorized(rpc._tag, payload));
+    const authorize = (settings: Pick<ServerSettings, "projectSettingsOverrides"> | undefined) => {
+      const requiredScopes = requiredScopesForRpcCall(rpc._tag, payload, settings);
+      const requiredScope = requiredScopes.find((scope) => !scopes.includes(scope));
+      if (requiredScope !== undefined) return Effect.fail(rpcAuthorizationError(requiredScope));
+      return onAuthorized === undefined
+        ? effect
+        : Effect.tap(effect, () => onAuthorized(rpc._tag, payload));
+    };
+    // Only a settings update reads the stored settings, to tell a resent server from a new one.
+    return rpc._tag === WS_METHODS.serverUpdateSettings && currentSettings !== undefined
+      ? Effect.flatMap(currentSettings, authorize)
+      : authorize(undefined);
   });
 
 /** Retrying can install or restart tools even though ordinary listing is readable. */

apps/server/src/bin.ts

@@ -35,6 +35,10 @@ if (
   } else if (command === "acp-mcp-bridge" || command === "acp-mcp-call") {
     const { runAcpMcpCliFastPath } = await import("./mcp/AcpMcpStdioBridge.ts");
     await runAcpMcpCliFastPath(command, process.argv.slice(3));
+  } else if (command === "skills-cli") {
+    // Option parsing belongs to the skills CLI, so it skips the T3 CLI entirely.
+    const { runSkillsCli } = await import("./cli/skillsCli.ts");
+    await runSkillsCli(process.argv.slice(3));
   } else {
     enableCliCompileCache();
     // Windows desktop launches without stdin; attach before reading, except on fast paths using pipes.

apps/server/src/binCli.ts

@@ -10,6 +10,7 @@ import * as CliError from "effect/cli/CliError";
 import * as NetService from "@t3tools/shared/Net";
 import packageJson from "../package.json" with { type: "json" };
 import { acpMcpBridgeCommand, acpMcpCallCommand } from "./cli/acpMcpBridge.ts";
+import { skillsCliCommand } from "./cli/skillsCli.ts";
 import { authCommand } from "./cli/auth.ts";
 import { environmentCommand } from "./cli/environment.ts";
 import { appCommand } from "./cli/app.ts";
@@ -74,6 +75,7 @@ export const makeCli = ({ cloudEnabled = hasCloudPublicConfig } = {}) =>
       ),
       acpMcpBridgeCommand,
       acpMcpCallCommand,
+      skillsCliCommand,
       startCommand,
       serveCommand,
       appCommand,

apps/server/src/cli/skillsCli.ts

@@ -0,0 +1,29 @@
+import * as Effect from "effect/Effect";
+import { Argument, Command } from "effect/cli";
+
+/**
+ * `t3 skills-cli <args…>` runs the bundled `skills` CLI (vercel-labs/skills, what
+ * `npx skills` runs), so installs need no Node or npm of their own. The server spawns
+ * it as a child, which keeps its `process.exit` and prompts out of the server.
+ */
+export async function runSkillsCli(args: ReadonlyArray<string>): Promise<void> {
+  // The CLI calls `process.exit` right after printing its `--json` result, and POSIX
+  // pipe writes are async, so a large result was cut at 64 KiB. A blocking pipe
+  // finishes each write first. Do not defer exit instead: the CLI relies on it.
+  const stdout = process.stdout as typeof process.stdout & {
+    readonly _handle?: { readonly setBlocking?: (blocking: boolean) => void };
+  };
+  stdout._handle?.setBlocking?.(true);
+  // The CLI reads its command from argv[2] onward.
+  process.argv = [process.argv[0] ?? "node", "skills", ...args];
+  await import("skills/dist/cli.mjs");
+}
+
+/** Real invocations dispatch through the bin.ts fast path before the CLI graph loads. */
+export const skillsCliCommand = Command.make("skills-cli", {
+  args: Argument.String("args").pipe(Argument.variadic()),
+}).pipe(
+  Command.withDescription("Run the bundled skills installer."),
+  Command.unlisted,
+  Command.withHandler(({ args }) => Effect.promise(() => runSkillsCli(args))),
+);

apps/server/src/device/DeviceService.test.ts

@@ -290,6 +290,7 @@ const fixture = Effect.fn("fixture")(function* (
       ServerSettings.ServerSettingsService,
       ServerSettings.ServerSettingsService.of({
         updateProviderInstance: () => Effect.die("Unexpected provider mutation"),
+        updateSettingsWith: () => Effect.die("Unexpected settings update"),
         withSettingsSnapshot: (use) => Effect.flatMap(Ref.get(settings), use),
         start: Effect.void,
         ready: Effect.void,

apps/server/src/mcp/McpHttpServer.ts

@@ -47,7 +47,9 @@ import * as OrchestratorMcpService from "./OrchestratorMcpService.ts";
 import { PreviewControlsToolkit } from "./toolkits/previewControls/tools.ts";
 import * as PreviewControlsHandlers from "./toolkits/previewControls/handlers.ts";
 import { EnvironmentToolkit } from "./toolkits/environment/tools.ts";
+import { ToolsToolkit } from "./toolkits/tools/tools.ts";
 import * as EnvironmentHandlers from "./toolkits/environment/handlers.ts";
+import * as ToolsHandlers from "./toolkits/tools/handlers.ts";
 import { ProjectToolkit } from "./toolkits/project/tools.ts";
 import * as ProjectHandlers from "./toolkits/project/handlers.ts";
 import { AttachmentToolkit } from "./toolkits/attachment/tools.ts";
@@ -1122,6 +1124,10 @@ const layerEnvironmentToolkit = toolkitRegistration(
 
 export const layerProjectRegistration = toolkitRegistration(ProjectToolkit, ProjectHandlers.layer);
 
+const layerToolsRegistration = toolkitRegistration(ToolsToolkit, ToolsHandlers.layer).pipe(
+  Layer.provide(ThreadCommandExecutor.layer),
+);
+
 export const layerAttachmentToolkit = toolkitRegistration(
   AttachmentToolkit,
   AttachmentHandlers.layer,
@@ -1155,6 +1161,29 @@ export const layerMcpTransport = McpServer.layerHttp({
   allowSessionTermination: true,
 }).pipe(Layer.provide(layerMcpAuthMiddleware));
 
+/**
+ * Every toolkit `layerTools` registers, for describing `t3-code` without a
+ * session (Settings → Tools). Add a toolkit here when you register one below;
+ * AgentContextBudget.test.ts checks the two match.
+ */
+export const T3_MCP_TOOLKITS: ReadonlyArray<Toolkit.Any> = [
+  PreviewStandardToolkit,
+  PreviewSnapshotToolkit,
+  OrchestratorToolkit,
+  ThreadToolkit,
+  AttachmentToolkit,
+  ProjectToolkit,
+  EnvironmentToolkit,
+  ToolsToolkit,
+  PreviewControlsToolkit,
+  WorktreeToolkit,
+  PullRequestsToolkit,
+  DeviceStandardToolkit,
+  DeviceScreenshotToolkit,
+  HtmlRenderToolkit,
+  HtmlPreviewToolkit,
+];
+
 /** Every tool the T3 MCP server advertises. AgentContextBudget.test.ts measures this set. */
 export const layerTools = Layer.mergeAll(
   layerPreviewToolkit,
@@ -1163,6 +1192,7 @@ export const layerTools = Layer.mergeAll(
   layerAttachmentToolkit,
   layerProjectRegistration,
   layerEnvironmentToolkit,
+  layerToolsRegistration,
   layerPreviewControlsRegistration,
   layerWorktreeToolkitRegistration,
   layerPullRequestsToolkit,

apps/server/src/mcp/resolveAgentTools.ts

@@ -0,0 +1,37 @@
+import type {
+  ProjectId,
+  ResolvedMcpServer,
+  ServerSettings,
+  ThreadToolPresets,
+} from "@t3tools/contracts";
+import { applyThreadToolPresets } from "@t3tools/shared/agentTools";
+import { resolveProjectSettings } from "@t3tools/shared/projectSettings";
+
+import type { McpProviderSessionTools } from "@t3tools/provider-core/server/mcpSession";
+
+/**
+ * A thread's tools from secret-materialized settings: project overrides, then
+ * the thread's presets, disabled servers dropped. The fingerprint covers the
+ * full config (a rotated secret counts) and is only compared, never sent.
+ */
+export function resolveAgentTools(
+  settings: ServerSettings,
+  projectId: ProjectId | null,
+  threadPresets?: ThreadToolPresets,
+): McpProviderSessionTools {
+  const effective = applyThreadToolPresets(
+    resolveProjectSettings(settings, projectId).settings,
+    settings.toolPresets,
+    threadPresets,
+  );
+  const servers: ResolvedMcpServer[] = Object.entries(effective.mcpServers)
+    .filter(([, server]) => server.enabled)
+    .map(([name, server]) => ({ name, transport: server.transport }))
+    .toSorted((left, right) => left.name.localeCompare(right.name));
+  const disabledSkills = [...new Set(effective.disabledSkills)].toSorted();
+  const fingerprint =
+    servers.length === 0 && disabledSkills.length === 0
+      ? ""
+      : JSON.stringify({ servers, disabledSkills });
+  return { servers, disabledSkills, fingerprint };
+}