feat(tools): manage skills and MCP servers safely - #25

Ports pingdotgg/t3code#17101 onto this fork's current provider architecture. Adds Settings → Tools for environment/project skills and MCP servers, then fixes the bot-reported credential, permission, and provider lifecycle issues.

Changes

• Protect stored credentials during redacted edits, secret/plain toggles, renames, and multi-environment edits. Require replacement values when a rename cannot safely preserve a secret; migrate inline sensitive values into the secret store.
• Serialize settings saves and authorize transport changes against the exact current server snapshot. Unchanged project transports no longer block ordinary settings edits; environment switches require provider management.
• Keep Claude credentials out of process arguments and Codex credentials out of protocol logs. Preserve normal approval prompts for user MCP tools.
• Isolate OpenCode registrations per session/server/configuration, retry failed registration, handle reconnect and external servers, and retain disabled-skill rules on resume/rollback.
• Resolve ACP commands with the agent's actual environment. Fix MCP search navigation, prototype-name collisions, and disabled skills in web/mobile composer menus and slash commands.

Verification

• 958 tests passed across 19 focused settings, authorization, provider, replay, shared, web, and mobile test files.
• Two ACP detached-process cleanup tests were skipped in the final combined run after reproducing both failures on unmodified fork main in this sandbox.
• Full web, mobile, and contracts typechecks passed locally, along with focused server typechecks. The local full-server check exceeded the container's memory limit; the full aggregate typecheck subsequently passed in CI.
• Changed-file lint, formatting, and unused-export checks for the CI-covered changed workspaces passed; git diff --check is clean.
• No interactive browser/native-client pass or new screenshots was performed. The repository requires explicit browser approval; this draft records that remaining visual verification limit.
• CI run 37976892015 passed on exact head df2e350c1e4b2cba455d1a5bcb0e117423596cdf: lint/unused-code checks, full typecheck, desktop build, web/shared tests, both server shards (7,224 passing tests), and the final Check gate. The workflow's optional Rust and Other Packages jobs were skipped by its configured conditions.

Source and attribution

Based on Julius Marminge's feature/cleanup commits 0b19d512, 54f5ab7f, and the Claude skill-forwarding fix 22c016bf. Preserves the source's Julius Marminge and Claude coauthor credit. The unrelated upstream provider-package refactor was not imported into this fork. Subsequent upstream fixes and bot comments through 79912b20 were compared against this implementation; a repository-skill grouping regression was also fixed.

Implemented with OpenAI through the Codex harness.