feat(mcp): open an agent's tools and skills rosters, so webchat can remove as well as add

[spacedragon]

Follow-up to #2129, from using it: installSkill and installMcpServer can only ever add.
Asked to remove a skill from an agent, admin MCP had nothing to offer and had to send the user
to the Console by hand — install without uninstall is not a finished surface.

Why the roster, and not a removeSkill tool

Removal is a per-row decision over live state. A tool argument naming what to take away would
mean the model guessing at rows it has never seen — the wrong shape, and the same reason the
code-host surface is a dialog rather than a set of write tools. So the roster itself is the tool.

manageAgentTools opens ui://agentconnect/agent-tools, which mounts the same two cards the
Console's Tools & Skills tab mounts — AgentToolsCard (attached MCP servers) and
AgentSkillsCard (enabled skills) — each row keeping its own add and remove control, under the
reader's own Console JWT. focus: 'mcp' | 'skills' narrows it to one roster; omitted shows both,
as the tab does. The card title follows the resource and the focus: Tools & skills, Skills,
MCP servers.

Because the two surfaces are the tab's own cards, they cannot drift from it, and every change
saves itself the moment a row is toggled. Done reports the resulting state as counts only —
never a server url or a repository address. Both installers' descriptions now name this tool for
the half of the job they do not do.

Verification

• pnpm typecheck, pnpm lint, prettier — clean.
• control-plane unit + mcp.route.test.ts integration (35, real Postgres), daemon MCP suites, and
  the web console modal suites — all green.
• New coverage: the tool's intent and its refusal of a remove argument or an unknown focus,
  the card title and tool name per focus, the resource in resources/list, dialog routing, both
  rosters mounting with the right props, the focus narrowing, the counts summary firing only on
  Done, and a read-only reader still seeing the rosters.

🤖 Generated with Claude Code

[agentconnect-md-test]

One correctness issue in the new roster dialog needs fixing: Done can complete while a row save is still pending, sending stale counts to the agent and hiding any subsequent save error. Coordinate completion with both cards’ pending writes before reading and reporting the final state.

The tool registration, focus routing, and existing Console permission checks otherwise look consistent. Reviewed the exact GitHub revision 6bc23cd59b8a761f1d809e22fd4e1d3c672cbc39; tests were not rerun locally because no trusted PR checkout was available.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

[P2] Wait for pending row saves before completing the dialog

busy only tracks this Done handler; both roster cards keep their asynchronous updateAgent writes in private saving state and remove rows optimistically. Remove a row and click Done while its PATCH is still pending: this GET can return the old roster, after which onCompleted notifies the agent and onClose unmounts the cards. A later successful write makes the reported counts stale, and a later failed write loses the card’s error message entirely. Expose the cards’ pending-save state to this dialog and wait for those writes before completing; also prevent new row edits while the final snapshot is being read.

[spacedragon]

Fixed in 4a5ba99 — you were right, Done read the roster without regard for a write still in flight, which meant stale counts and a card unmounted before it could show the error its save was about to produce.

AgentToolsCard and AgentSkillsCard now report their pending write upward through an optional onBusyChange, and the dialog disables Done and shows "Saving…" until every card has settled. Covered by a new case: toggling a row into its saving state disables Done, and clicking it then reads nothing and reports nothing.

[agentconnect-md-test]

The pending-save callbacks fix clicking Done after a row write starts. One part of the same P2 issue remains: row edits are still enabled while Done fetches the final counts. An edit during that read can leave the dialog reporting stale state and closing over a pending write. Disable row mutations for the duration of completion.

No other blocking findings in revision 4a5ba99be598734ffcc45989129601b31106390c. Reviewed through revision-addressed GitHub reads; tests were not rerun locally.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

[P2] Disable row edits while Done reads the final state

Both cards still receive canEdit={canEdit} while the dialog's busy is true. Click Done with no saves pending, then remove a row while fetchAgentDto is awaiting its response: the row starts a PATCH, but the already-running Done handler still reports the earlier snapshot and closes as soon as its GET resolves. Updating rowSaving does not stop that handler, so stale counts and hidden late save errors remain possible. This is the remaining direction of the original race; disable both cards' mutation controls while the completion read is in progress.

[agentconnect-md-test]

That fixes the save → Done case. My latest review of 4a5ba99b flags the reverse ordering: click Done, then edit a row while its GET is pending. Both cards remain editable, and Done can close before that new save settles.

Disable both cards’ mutation controls while the dialog’s busy state is true to complete the fix.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[spacedragon]

Fixed in ebb32d9 — right, holding Done only closed half the window. The cards now take canEdit false for the duration of the completion read, so no edit can be accepted while Done is fetching the state it will report. The read-only notice still keys off the agent’s real canEdit, so it does not flash during a normal completion. New case covers it: with the read left pending, the skills card is mounted with canEdit: false.

[agentconnect-md-test]

Reviewed revision ebb32d900c40c09f5196f595ae8c472015bb7468. The completion race is resolved: Done is disabled while either card saves, and both cards’ mutation controls are disabled while Done reads the final counts. No remaining blocking findings.

Review used revision-addressed GitHub reads. Tests were not rerun locally; CI was still running at review time.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

Confirmed in ebb32d90: both cards disable edits during the completion read, and the read-only notice still reflects actual permissions. Approved that revision; no remaining blocking findings.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}