Add durable profile and proxy MCP contract parity

src/lib/mcp/dependencies.ts

@@ -0,0 +1,9 @@
+import { createKernelClient, type KernelClient } from "@/lib/mcp/kernel-client";
+
+export type McpDependencies = {
+  createKernelClient: (token: string) => KernelClient;
+};
+
+export const defaultMcpDependencies: McpDependencies = {
+  createKernelClient,
+};

src/lib/mcp/register.ts

@@ -1,4 +1,8 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  defaultMcpDependencies,
+  type McpDependencies,
+} from "@/lib/mcp/dependencies";
 import { registerKernelPrompts } from "@/lib/mcp/prompts";
 import { registerAPIKeyCapabilities } from "@/lib/mcp/tools/api-keys";
 import { registerAppCapabilities } from "@/lib/mcp/tools/apps";
@@ -19,7 +23,10 @@ import { registerProxyTools } from "@/lib/mcp/tools/proxies";
 import { registerReplayTools } from "@/lib/mcp/tools/replays";
 import { registerShellTool } from "@/lib/mcp/tools/shell";
 
-type RegisterMcpToolset = (server: McpServer) => void;
+type RegisterMcpToolset = (
+  server: McpServer,
+  dependencies?: McpDependencies,
+) => void;
 
 function registerManagedAuthCapabilities(server: McpServer) {
   registerAuthConnectionTools(server);
@@ -125,15 +132,18 @@ function toolsetEnabled(
 
 export function registerMcpCapabilities(
   server: McpServer,
-  { mcpApps = false }: { mcpApps?: boolean } = {},
+  {
+    mcpApps = false,
+    dependencies = defaultMcpDependencies,
+  }: { mcpApps?: boolean; dependencies?: McpDependencies } = {},
 ) {
   const disabledToolsets = disabledMcpToolsetsFromEnv();
 
   registerKernelPrompts(server);
 
   for (const [toolset, registerToolset] of mcpToolRegistrations) {
     if (toolsetEnabled(disabledToolsets, toolset)) {
-      registerToolset(server);
+      registerToolset(server, dependencies);
     }
   }
 

src/lib/mcp/resource-templates.ts

@@ -2,7 +2,11 @@ import {
   ResourceTemplate,
   type McpServer,
 } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { createKernelClient, type KernelClient } from "@/lib/mcp/kernel-client";
+import {
+  defaultMcpDependencies,
+  type McpDependencies,
+} from "@/lib/mcp/dependencies";
+import type { KernelClient } from "@/lib/mcp/kernel-client";
 
 type JsonResourceTemplateOptions = {
   name: string;
@@ -26,6 +30,7 @@ function templateVariableValue(
 export function registerJsonResourceTemplate(
   server: McpServer,
   options: JsonResourceTemplateOptions,
+  dependencies: McpDependencies = defaultMcpDependencies,
 ) {
   server.resource(
     options.name,
@@ -40,7 +45,7 @@ export function registerJsonResourceTemplate(
         throw new Error(`Invalid ${options.resourceLabel} URI: ${uri}`);
       }
 
-      const client = createKernelClient(extra.authInfo.token);
+      const client = dependencies.createKernelClient(extra.authInfo.token);
       const resource = await options.read(client, identifier);
 
       if (!resource) {

src/lib/mcp/responses.test.ts

@@ -17,6 +17,10 @@ function apiError(status: number, message: string) {
   return APIError.generate(status, undefined, message, new Headers());
 }
 
+function codedApiError(status: number, code: string, message: string) {
+  return APIError.generate(status, { code, message }, undefined, new Headers());
+}
+
 function caught(error: unknown) {
   try {
     throwToolError("manage_browsers", "get", error);
@@ -62,6 +66,38 @@ describe("throwToolError classification", () => {
       "Error in manage_browsers (get): plain string",
     );
   });
+
+  test("keeps stable API codes visible", () => {
+    expect(
+      caught(
+        codedApiError(
+          409,
+          "project_not_empty",
+          "Project still contains resources",
+        ),
+      ).message,
+    ).toBe(
+      "Error in manage_browsers (get): 409 Project still contains resources [code: project_not_empty]",
+    );
+    expect(
+      caught(
+        codedApiError(
+          409,
+          "last_active_project",
+          "Cannot delete the last active project",
+        ),
+      ).message,
+    ).toContain("[code: last_active_project]");
+  });
+
+  test("ignores absent and non-string API codes", () => {
+    const absent = apiError(409, "conflict");
+    expect(caught(absent).message).not.toContain("[code:");
+
+    const numeric = codedApiError(409, "temporary", "conflict");
+    (numeric as unknown as { error: { code: number } }).error.code = 123;
+    expect(caught(numeric).message).not.toContain("[code:");
+  });
 });
 
 describe("what the client receives", () => {
@@ -76,6 +112,18 @@ describe("what the client receives", () => {
       );
     });
 
+    server.tool("coded_api_failure", {}, async () => {
+      throwToolError(
+        "manage_projects",
+        "delete",
+        codedApiError(
+          409,
+          "project_not_empty",
+          "Project still contains resources",
+        ),
+      );
+    });
+
     server.tool("input_guard", {}, async () =>
       errorResponse("Error: session_id is required for get action."),
     );
@@ -113,4 +161,16 @@ describe("what the client receives", () => {
       { type: "text", text: "Error: session_id is required for get action." },
     ]);
   });
+
+  test("returns coded API rejections to the client", async () => {
+    const result = await callTool("coded_api_failure");
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toEqual([
+      {
+        type: "text",
+        text: "Error in manage_projects (delete): 409 Project still contains resources [code: project_not_empty]",
+      },
+    ]);
+  });
 });

src/lib/mcp/responses.ts

@@ -67,8 +67,23 @@ export function errorResponse(text: string) {
   return { ...textResponse(text), isError: true as const };
 }
 
+function apiErrorCode(error: APIError) {
+  if (
+    error.error &&
+    typeof error.error === "object" &&
+    "code" in error.error &&
+    typeof error.error.code === "string"
+  ) {
+    return error.error.code;
+  }
+}
+
 function errorMessage(error: unknown) {
-  return error instanceof Error ? error.message : String(error);
+  const message = error instanceof Error ? error.message : String(error);
+  if (!(error instanceof APIError)) return message;
+
+  const code = apiErrorCode(error);
+  return code ? `${message} [code: ${code}]` : message;
 }
 
 // Named after what the API said, so a stale session id (404) is distinguishable from an