feat(harness): add MCP resource tools and keep oversized output on the host - #81

Summary

Stacked on #80. Adds MCP resources and Pi's handling of results the model isn't shown in full. Everything stays on the host: MCP runs in the harness process and never touches a session's sandbox, local or remote.

Resource tools (src/mcp/resources.ts)

• list_mcp_resources, list_mcp_resource_templates and read_mcp_resource, named and shaped like the tools other agents use, so models trained on them use them unchanged.
• They're registered when any enabled, non-hidden server offers resources, and reach every such server when they run.
• With a server, one page is listed and cursor continues it. Without one, every page of every server is listed, and servers that fail go into errors.
• MCP App resources (ui://, profile=mcp-app) and icons are left out of listings.
• Reads become text and images; several contents are labelled with their URIs.

Result content (src/mcp/content.ts)

• Text over 20 KB keeps its start and end, cut in the middle, and the full text is saved to a file whose path the result names.
• Binary resources are saved; text-typed blobs (text/*, JSON, XML) are shown as text.
• Resource links name read_mcp_resource when the server's resources can be read.

Saved files (src/mcp/output.ts)

• They go to the host temp directory as codework-mcp-*, mode 0600, created exclusively, never into a sandbox.

One request path (src/mcp/mcp.ts)

• Tool calls and resource requests share it: the current connection is looked up when the request runs, a dropped one reconnects, an expired HTTP session gets one more attempt on a new session, and a sign-in failure is reported. Tool calls are still never retried otherwise.

Docs

• A new page, customize/mcp: where servers run (always on your machine), mcp.json, project overrides, exposure, resources, connections.

Review fixes (Codex peer review)

• Strict paging. Listing every server's resources or templates uses the SDK's own pagination and limits, as tools() does. A server repeating a cursor can't keep a listing running.
• Opaque cursors. A cursor goes back exactly as the server gave it; only server names and URIs are trimmed. The fixture's cursor is now " page-2 " to prove it.
• Test cleanup. Tests remove the files they save, and read saved paths between the message's own delimiters, so a temp directory with spaces still parses.
• Docs. Which servers a message waits for, that exposure changes keep a server running, and where server logs go.

Test plan

• test/mcp.session.test.ts gains a third exchange, through the full harness against a real stdio server. It covers:
  • the server's configured cwd
  • a resource link
  • a 30 KB result cut below 21 KB, with the saved file holding all of it
  • listing every page and paging one server by cursor, with the ui:// resource left out
  • templates
  • a text read and a binary read, with the binary saved as a 0600 host file holding the right bytes
  • an unknown server
• test/mcp.client.test.ts: artifact updated for saved binaries and Pi-style resource links
• Full harness suite: 514 passed, 34 skipped (live/remote)
• vp check and vp run typecheck

🤖 Generated with Claude Code