agent: MCP Skills extension (SEP-2640) client support

crates/agent/Cargo.toml

@@ -192,6 +192,10 @@ http = "1"
 # for why that has to be explicit rather than inferred from crate features).
 rmcp = { version = "3.2.0", default-features = false, features = ["client", "macros", "transport-child-process", "transport-streamable-http-client-reqwest", "reqwest-tls-no-provider", "auth", "elicitation"] }
 
+# Names the SSE event type in `tools::mcp_wire`'s `StreamableHttpClient` impl (rmcp re-exports its error
+# but not the event). Already resolved transitively at this exact version via rmcp.
+sse-stream = "0.2.5"
+
 # `serve --listen`'s WebSocket transport (`serve_ws`): the server/`accept_async` side. Only
 # `handshake` is needed here (a plain-`ws://` loopback listener — the edge terminates TLS in front of
 # us, so no TLS feature). Same crate + exact version `agent-core` already depends on for its Codex

crates/agent/src/approval.rs

@@ -102,6 +102,10 @@ pub struct ApprovalRequest {
     /// exactly what they are agreeing to for the rest of the session.
     pub scope_key: String,
     pub origin: ApprovalOrigin,
+    /// Why this is being asked, when it is not just "this tool is gated": an MCP-served skill asking
+    /// to be activated, or a code-execution call while one is active (see
+    /// `tools::mcp_skills::SkillSession`). Sent to clients as the frame's `mcp_skill` object.
+    pub context: Option<Value>,
 }
 
 /// Whether a decision applies to this call only, or is remembered for the session.
@@ -397,6 +401,7 @@ pub async fn ask_gate(
         summary: summarize(input),
         scope_key: key,
         origin: origin.clone(),
+        context: None,
     };
     match runtime.gate.request(request, cancel).await {
         Ok(decision) => {