feat(skills): route MCP CRUD + skills-create scope to the bridge on the alt harness

- registerMcpServer/setMcpServerEnabled/deleteMcpServer: when ew.altHarness is
  set, read-modify-write the bridge's overrides mcp_servers array instead of the
  DA config sheet (personal scope); AO/DA path unchanged when off
- uploadSkillFileToAo takes an optional scope, forwarding scope=org to the
  bridge create endpoint
- org-scope selector UI is a flagged TODO (personal scope for now)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: anfibiacreativa

blocks/skills/skills-editor-api.js

@@ -622,7 +622,8 @@ export async function fetchSkillFileFromAo(skillName, path = 'SKILL.md', skillId
  * skill server-side. A 409 with needs_confirmation means a skill of that name
  * already exists for this user (not auto-overwritten here).
  */
-export async function uploadSkillFileToAo(file) {
+// TODO: org-scope create needs an admin-gated scope selector in the UI; defaults to owner.
+export async function uploadSkillFileToAo(file, scope = 'owner') {
   const ctx = await aoAuthContext();
   if (!ctx) return { ok: false, error: 'Not signed in' };
 
@@ -631,6 +632,7 @@ export async function uploadSkillFileToAo(file) {
       const form = new FormData();
       form.append('file', file, file.name);
       form.append('display_title', file.name.replace(/\.md$/i, ''));
+      if (scope === 'org') form.append('scope', 'org');
       const resp = await fetch(`${ctx.base}/api/v1/skills`, {
         method: 'POST',
         headers: {
@@ -1078,6 +1080,37 @@ function mcpKeyMatch(serverKey) {
   return (r) => normaliseRowKey(r) === serverKey;
 }
 
+// ─── MCP servers on the CMA bridge (AO `overrides.settings.mcp_servers`) ─────
+// On the alt harness, MCP servers live in the bridge's per-user overrides
+// instead of the DA config sheet. Each entry keeps the same shape as an
+// `mcp-servers` config row ({ key, url, description?, headers?, enabled? }) so
+// the editor UI round-trips unchanged.
+// TODO: org-scope MCP needs an admin-gated scope selector in the UI; personal only for now.
+function bridgeHeaders(ctx) {
+  return {
+    authorization: `Bearer ${ctx.token}`,
+    'x-tenant-id': ctx.orgId,
+    'x-user-id': ctx.userId || '',
+  };
+}
+
+async function bridgeGetMcpServers(ctx) {
+  const resp = await fetch(`${ctx.base}/api/v1/overrides/user`, { headers: bridgeHeaders(ctx) });
+  if (!resp.ok) throw new Error(`Could not load overrides (${resp.status})`);
+  const json = await resp.json();
+  const servers = json?.settings?.mcp_servers;
+  return Array.isArray(servers) ? servers : [];
+}
+
+async function bridgePutMcpServers(ctx, servers) {
+  const resp = await fetch(`${ctx.base}/api/v1/overrides/user/settings/mcp_servers`, {
+    method: 'PUT',
+    headers: { ...bridgeHeaders(ctx), 'content-type': 'application/json' },
+    body: JSON.stringify({ value: servers }),
+  });
+  if (!resp.ok) throw new Error(`Save failed (${resp.status})`);
+}
+
 export async function registerMcpServer(
   org,
   site,
@@ -1095,6 +1128,28 @@ export async function registerMcpServer(
       value: String(h?.value || '').trim(),
     }))
     .filter((h) => h.name && h.value);
+
+  if (altHarnessEnabled) {
+    const ctx = await aoAuthContext();
+    if (!ctx) return { ok: false, error: 'Not signed in' };
+    try {
+      const servers = await bridgeGetMcpServers(ctx);
+      const entry = { key: serverKey, url: serverUrl };
+      if (description) entry.description = String(description).trim();
+      if (safeHeaders.length) entry.headers = safeHeaders;
+      const idx = servers.findIndex((s) => s?.key === serverKey);
+      const prevEnabled = idx >= 0 ? servers[idx]?.enabled : undefined;
+      if (prevEnabled !== undefined) entry.enabled = prevEnabled;
+      const next = idx >= 0
+        ? servers.map((s, i) => (i === idx ? entry : s))
+        : [...servers, entry];
+      await bridgePutMcpServers(ctx, next);
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: String(err?.message ?? err) };
+    }
+  }
+
   return upsertSheetRow(
     org,
     site,
@@ -1117,6 +1172,21 @@ export async function setMcpServerEnabled(org, site, key, enabled) {
   const serverKey = String(key || '').trim();
   if (!serverKey) return { ok: false, error: 'Server id required' };
 
+  if (altHarnessEnabled) {
+    const ctx = await aoAuthContext();
+    if (!ctx) return { ok: false, error: 'Not signed in' };
+    try {
+      const servers = await bridgeGetMcpServers(ctx);
+      const idx = servers.findIndex((s) => s?.key === serverKey);
+      if (idx < 0) return { ok: false, error: 'Server not found' };
+      const next = servers.map((s, i) => (i === idx ? { ...s, enabled: !!enabled } : s));
+      await bridgePutMcpServers(ctx, next);
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: String(err?.message ?? err) };
+    }
+  }
+
   const loaded = await fetchDaConfigSheets(org, site);
   if (!loaded.ok) return { ok: false, error: 'Could not load config' };
 
@@ -1137,6 +1207,20 @@ export async function setMcpServerEnabled(org, site, key, enabled) {
 export async function deleteMcpServer(org, site, key) {
   const serverKey = String(key || '').trim();
   if (!serverKey) return { ok: false, error: 'Key required' };
+
+  if (altHarnessEnabled) {
+    const ctx = await aoAuthContext();
+    if (!ctx) return { ok: false, error: 'Not signed in' };
+    try {
+      const servers = await bridgeGetMcpServers(ctx);
+      const next = servers.filter((s) => s?.key !== serverKey);
+      await bridgePutMcpServers(ctx, next);
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: String(err?.message ?? err) };
+    }
+  }
+
   return deleteSheetRow(org, site, MCP_SHEET, mcpKeyMatch(serverKey), 'MCP server');
 }
 

test/unit/skills-editor-api.test.js

@@ -14,6 +14,9 @@ import {
   fetchSkillFileFromAo,
   uploadSkillFileToAo,
   removePersonalSkillSource,
+  registerMcpServer,
+  setMcpServerEnabled,
+  deleteMcpServer,
 } from '../../blocks/skills/skills-editor-api.js';
 import { initAuth } from '../../blocks/skills/utils/da-fetch.js';
 
@@ -466,5 +469,81 @@ describe('AO / bridge backend switch', () => {
       expect(calls).to.have.length(1);
       expect(calls[0].url).to.equal('https://aem-sites-claudebridge-va6.adobe.io/api/v1/skills/skill-uuid-9');
     });
+
+    it('uploadSkillFileToAo passes scope:org in the multipart body when requested', async () => {
+      const file = new File(['# Body'], 'my-skill.md', { type: 'text/markdown' });
+      const calls = trackFetch(() => ({ ok: true, json: async () => ({ id: 'skill-uuid-3' }) }));
+      const result = await uploadSkillFileToAo(file, 'org');
+      expect(result.ok).to.be.true;
+      expect(calls[0].opts.body.get('scope')).to.equal('org');
+    });
+
+    // MCP servers: GET the overrides bag, mutate mcp_servers, PUT it back.
+    const OVERRIDES_BAG = (servers) => ({
+      settings: { skills: { sources: [], disabled_skills: [] }, mcp_servers: servers, plugins: { installed: [] } },
+    });
+
+    it('registerMcpServer GETs overrides then PUTs the appended server', async () => {
+      const calls = trackFetch((url, opts) => {
+        if (opts.method === undefined) return { ok: true, json: async () => OVERRIDES_BAG([]) };
+        return { ok: true, json: async () => ({}) };
+      });
+      const result = await registerMcpServer('o', 's', 'my-mcp', 'https://mcp.example', 'desc', [{ name: 'H', value: 'v' }]);
+      expect(result.ok).to.be.true;
+      expect(calls[0].url).to.equal('https://aem-sites-claudebridge-va6.adobe.io/api/v1/overrides/user');
+      expect(calls[1].url).to.equal('https://aem-sites-claudebridge-va6.adobe.io/api/v1/overrides/user/settings/mcp_servers');
+      expect(calls[1].opts.method).to.equal('PUT');
+      expect(calls[1].opts.headers['x-user-id']).to.equal('user-123');
+      const sent = JSON.parse(calls[1].opts.body).value;
+      expect(sent).to.have.length(1);
+      expect(sent[0]).to.deep.include({ key: 'my-mcp', url: 'https://mcp.example', description: 'desc' });
+      expect(sent[0].headers).to.deep.equal([{ name: 'H', value: 'v' }]);
+    });
+
+    it('registerMcpServer replaces an existing entry by key, preserving enabled', async () => {
+      const calls = trackFetch((url, opts) => {
+        if (opts.method === undefined) {
+          return { ok: true, json: async () => OVERRIDES_BAG([{ key: 'my-mcp', url: 'old', enabled: false }]) };
+        }
+        return { ok: true, json: async () => ({}) };
+      });
+      await registerMcpServer('o', 's', 'my-mcp', 'https://new.example');
+      const sent = JSON.parse(calls[1].opts.body).value;
+      expect(sent).to.have.length(1);
+      expect(sent[0]).to.deep.include({ key: 'my-mcp', url: 'https://new.example', enabled: false });
+    });
+
+    it('setMcpServerEnabled toggles enabled on the matching entry', async () => {
+      const calls = trackFetch((url, opts) => {
+        if (opts.method === undefined) {
+          return { ok: true, json: async () => OVERRIDES_BAG([{ key: 'my-mcp', url: 'u', enabled: false }]) };
+        }
+        return { ok: true, json: async () => ({}) };
+      });
+      const result = await setMcpServerEnabled('o', 's', 'my-mcp', true);
+      expect(result.ok).to.be.true;
+      expect(JSON.parse(calls[1].opts.body).value[0].enabled).to.be.true;
+    });
+
+    it('deleteMcpServer removes the entry by key and PUTs the rest', async () => {
+      const calls = trackFetch((url, opts) => {
+        if (opts.method === undefined) {
+          return { ok: true, json: async () => OVERRIDES_BAG([{ key: 'a', url: 'u' }, { key: 'my-mcp', url: 'u' }]) };
+        }
+        return { ok: true, json: async () => ({}) };
+      });
+      const result = await deleteMcpServer('o', 's', 'my-mcp');
+      expect(result.ok).to.be.true;
+      const sent = JSON.parse(calls[1].opts.body).value;
+      expect(sent.map((x) => x.key)).to.deep.equal(['a']);
+    });
+  });
+
+  describe('MCP altHarness off (DA config, unchanged)', () => {
+    it('deleteMcpServer does not call the bridge overrides endpoint', async () => {
+      const calls = trackFetch(() => ({ ok: true, text: async () => '{}', json: async () => ({}) }));
+      await deleteMcpServer('exp-workspace', 'frescopa', 'my-mcp');
+      expect(calls.every((c) => !String(c.url).includes('claudebridge'))).to.be.true;
+    });
   });
 });