@miphamai/cli 0.85.3 → 0.85.5

package/src/daemon/server.ts

@@ -3,7 +3,6 @@ import type { Server, ServerWebSocket } from 'bun'
 import type { DaemonDatabase } from './database'
 import type { SessionManager } from './session-manager'
 import type { AgentManager } from './agent-manager'
-import type { MessageBus } from './message-bus'
 import type { DaemonGoal, AgentKind } from './types'
 import type { GoalManager } from './goal-manager'
 import type { ScheduleManager } from './schedule-manager'
@@ -49,7 +48,6 @@ interface ServerConfig {
   port: number
   hostname: string
   agentManager: AgentManager
-  messageBus: MessageBus
   goalManager: GoalManager
   scheduleManager: ScheduleManager
   rateLimiter: RateLimiter
@@ -156,7 +154,6 @@ export function createServer(config: ServerConfig): Server<WsData> {
     port,
     hostname,
     agentManager,
-    messageBus,
     goalManager,
     scheduleManager,
     rateLimiter,
@@ -192,15 +189,8 @@ export function createServer(config: ServerConfig): Server<WsData> {
     }
   }
 
-  // ── Agent lifecycle → WebSocket broadcast + MessageBus registration ──
+  // ── Agent lifecycle → WebSocket broadcast ──
   agentManager.onLifecycleEvent((event) => {
-    // Register / unregister in the message bus for broadcastToSession routing
-    if (event.type === 'created') {
-      messageBus.registerAgent(event.agent.sessionId, event.agent.id)
-    } else if (event.type === 'completed' || event.type === 'failed') {
-      messageBus.unregisterAgent(event.agent.id)
-    }
-
     // Broadcast lifecycle events to all WebSocket clients in the agent's session
     broadcast(event.agent.sessionId, {
       type: 'agent_lifecycle',
@@ -670,8 +660,23 @@ export function createServer(config: ServerConfig): Server<WsData> {
           return json({ ok: false, error: 'Agent not found' }, { status: 404 })
         }
 
-        messageBus.send('user', agentId, content)
-        return json({ ok: true }, { status: 202 })
+        // 从前这里 `messageBus.send(...)` 后回 **202 + `{ok:true}`** —— 一张兑现不了的收条。
+        // daemon 侧**不存在 agent 执行循环**（`AgentManager` 纯持久化，`src/daemon/*.ts` 里
+        // `SubAgent`/`spawn` 零命中），所以进程内没有任何东西会去读这条消息；而真正在用的
+        // 那条总线（`src/agent/message-bus.ts`）由子代理 / workflow 用 `bg-…` 那套 id 投递，
+        // 与这里的 `agent-<uuid8>` **不同一个 id 空间**，改投它也找不到人。
+        // 202 在这里是有害的：调用方据此认为话已送达，于是不再重试、也不再报错。
+        // 报 501 并给出替代路径 —— 只说「不支持」会让调用方反复重试同一件事。
+        return json(
+          {
+            ok: false,
+            error:
+              'Agent messaging is not implemented on the daemon: this build has no agent ' +
+              'execution loop, so nothing would receive the message. Use ' +
+              'POST /api/v1/sessions/:id/prompt to send work to a session instead.',
+          },
+          { status: 501 },
+        )
       }
 
       // ── Goals (Phase 4 — service-backed) ────────────
@@ -806,7 +811,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
               {
                 method: 'POST',
                 path: '/api/v1/agents/:id/message',
-                description: 'Send message to an agent',
+                description: 'Not implemented — always 501; use POST /api/v1/sessions/:id/prompt',
               },
               { method: 'GET', path: '/api/v1/goals', description: 'List goals for a session' },
               { method: 'POST', path: '/api/v1/goals', description: 'Create a goal' },

package/src/i18n-core/locales/en-US.json

@@ -996,8 +996,9 @@
   "errors": {
     "tool_denied_deny_rule": "Tool \"{name}\" blocked by a deny rule (\"{pattern}\"). Deny rules override permission mode — try a different approach, or drop the rule with: /permissions remove \"{pattern}\"",
     "tool_denied_ask_rule": "Tool \"{name}\" requires approval (ask rule: \"{pattern}\"). Approve when prompted, or stop being asked with: /permissions allow \"{pattern}\"",
-    "tool_denied_mode": "Tool \"{name}\" requires approval under \"{mode}\" mode. Press Shift+Tab to switch permission mode, or stop being asked with: /permissions allow \"{name}\" (or a narrower \"{name}(arg)\")",
-    "tool_denied_classifier": "Tool \"{name}\" was blocked in auto mode by the permission classifier ({reason}). This is a policy decision, not a failure — switching modes will not change it, and repeating the identical call returns the same ruling. Change the call so it no longer trips the rule, or allow it outright with: /permissions allow \"{name}\"",
+    "tool_denied_mode": "Tool \"{name}\" requires approval under \"{mode}\" mode. Press Shift+Tab to switch permission mode, or stop being asked with: /permissions allow \"{name}\" (or a narrower \"{name}(arg)\") Treat this denial as covering the outcome, not only this exact command.",
+    "tool_denied_classifier": "Tool \"{name}\" was blocked in auto mode by the permission classifier ({reason}). This is a policy decision, not a failure — switching modes will not change it, and repeating the identical call returns the same ruling. Change the call so it no longer trips the rule, or allow it outright with: /permissions allow \"{name}\" Treat this denial as covering the outcome, not only this exact command.",
+    "tool_denied_dangerous_rm": "Tool \"{name}\" was refused: this is a recursive rm whose target is not a path written in the command (\"{target}\"). The target is produced when the command runs, so neither an allow rule nor the permission mode can bound what it deletes. Name the directory literally instead — `rm -rf node_modules` rather than `rm -rf \"$(pwd)\"` — and treat this refusal as covering the outcome, not only this exact spelling. To turn this check off: MIPHAM_DISABLE_DANGEROUS_RM_PROMPT=1",
     "tool_denied_classifier_unavailable": "Tool \"{name}\" was held back because the auto-mode classifier could not be reached or its answer could not be read ({reason}). This is NOT a policy decision — the call was never judged, and retrying is appropriate. If this keeps happening, switch modes with Shift+Tab.",
     "tool_blocked": "Tool \"{name}\" blocked by hook",
     "user_input_blocked": "User input blocked by hook.",
@@ -1020,6 +1021,8 @@
     "max_tool_turns": "Max tool-calling turns ({max}) reached. Some tool calls were not executed.",
     "max_tool_turns_warning": "You've reached the maximum of {max} tool-calling rounds. {pending} tool call(s) were not executed. Please summarize what you found so far and any next steps the user should take.",
     "turn_timeout": "Task produced no substantial output for {minutes} minutes and was stopped. Break the task into smaller steps or clarify the next step, then retry.",
+    "turn_truncated": "The response was cut off mid-turn, not finished — the provider stopped at its output limit or the connection closed.",
+    "stop_hook_budget_spent": "The Stop hook asked for more work (\"{reason}\"), but this turn has used all {max} of its tool-calling rounds — stopping here. Send another message to continue.",
     "mcp_not_connected": "Error: MCP server \"{server}\" not connected",
     "mcp_tool_error": "MCP tool error: {error}",
     "mcp_no_connection": "No connection for \"{name}\""

package/src/i18n-core/locales/zh-CN.json

@@ -996,8 +996,9 @@
   "errors": {
     "tool_denied_deny_rule": "工具 \"{name}\" 被拒绝规则（\"{pattern}\"）阻止。拒绝规则优先于权限模式 — 请改用其他方式，或移除该规则：/permissions remove \"{pattern}\"",
     "tool_denied_ask_rule": "工具 \"{name}\" 需要批准（ask 规则：\"{pattern}\"）。请在提示时批准，或不再询问：/permissions allow \"{pattern}\"",
-    "tool_denied_mode": "工具 \"{name}\" 在 \"{mode}\" 模式下需要批准。按 Shift+Tab 切换权限模式，或不再询问：/permissions allow \"{name}\"（更窄的 \"{name}(arg)\" 亦可）",
-    "tool_denied_classifier": "工具 \"{name}\" 在 auto 模式下被权限分类器拦下（{reason}）。这是策略裁决、不是故障 —— 切换模式不会改变它，把同一次调用原样重发也只会得到同一个裁决。请改变这次调用使其不再触犯该规则，或直接放行：/permissions allow \"{name}\"",
+    "tool_denied_mode": "工具 \"{name}\" 在 \"{mode}\" 模式下需要批准。按 Shift+Tab 切换权限模式，或不再询问：/permissions allow \"{name}\"（更窄的 \"{name}(arg)\" 亦可） 请把这次拒绝理解为对结果本身的禁止，而不只是这一条命令。",
+    "tool_denied_classifier": "工具 \"{name}\" 在 auto 模式下被权限分类器拦下（{reason}）。这是策略裁决、不是故障 —— 切换模式不会改变它，把同一次调用原样重发也只会得到同一个裁决。请改变这次调用使其不再触犯该规则，或直接放行：/permissions allow \"{name}\" 请把这次拒绝理解为对结果本身的禁止，而不只是这一条命令。",
+    "tool_denied_dangerous_rm": "工具 \"{name}\" 被拒绝：这是一条递归 rm，其目标并非命令里写出的路径（\"{target}\"）。该目标要到命令运行时才产生，所以任何放行规则与权限模式都无法界定它会删掉什么。请改为字面写出目录名 —— 用 `rm -rf node_modules` 而不是 `rm -rf \"$(pwd)\"` —— 并把这次拒绝理解为对结果本身的禁止，而不只是这一种写法。关闭此检查：MIPHAM_DISABLE_DANGEROUS_RM_PROMPT=1",
     "tool_denied_classifier_unavailable": "工具 \"{name}\" 被暂缓：auto 模式的分类器不可达，或其回复无法解析（{reason}）。这**不是**策略裁决 —— 该调用从未被裁决，重试是恰当的。若持续发生，按 Shift+Tab 切换模式。",
     "tool_blocked": "工具 \"{name}\" 被钩子拦截",
     "user_input_blocked": "用户输入被钩子拦截。",
@@ -1020,6 +1021,8 @@
     "max_tool_turns": "超出最大工具调用轮次（{max}）。部分工具调用未执行。",
     "max_tool_turns_warning": "已达到最大 {max} 轮工具调用。{pending} 个工具调用未执行。请总结当前发现及后续步骤。",
     "turn_timeout": "任务已超过 {minutes} 分钟无实质产出，已自动停止。建议拆分任务或明确下一步后重新发起。",
+    "turn_truncated": "回复写到一半就断了，不是正常写完 —— 提供商到了输出上限，或连接被关闭。",
+    "stop_hook_budget_spent": "Stop 钩子要求继续（{reason}），但本轮 {max} 轮工具调用已用尽 —— 就此停下。再发一条消息即可继续。",
     "mcp_not_connected": "错误：MCP 服务器 \"{server}\" 未连接",
     "mcp_tool_error": "MCP 工具错误：{error}",
     "mcp_no_connection": "未找到 \"{name}\" 的连接"

package/src/index.tsx

@@ -21,7 +21,7 @@ import {
   discoverSessions,
 } from './agent/cross-session/discovery'
 import { bootstrapProviders } from './providers/bootstrap'
-import { InstructionsLoader } from './core/instructions'
+import { InstructionsLoader, formatInstructionSizeNotice } from './core/instructions'
 import { loadSessionMemories, getMemoryManager } from './core/memory/memory-loader'
 import { ContextManager } from './core/context'
 import { PrefixCacheTracker } from './core/context-token'
@@ -44,6 +44,7 @@ import { mountLlm, LLM_KEY } from './providers/llm'
 import { mountConstitution, createConstitution } from './core/constitution-seam'
 import { ConstitutionLoader } from './core/constitution-loader'
 import { McpClient } from './mcp/client'
+import { buildMcpInstructionsBlock } from './mcp/instructions'
 import { registerMcpServerTools, syncMcpToolsOnChange } from './mcp/registry'
 import { formatMcpConnectFailures, type McpConnectFailure } from './mcp/connect-failures'
 import { AgentRegistry } from './agent/agent-registry'
@@ -58,7 +59,7 @@ import { getWorkspaceTrust, warnProjectHooksSkipped } from './core/workspace-tru
 import { ARTIFACT_PORT, MIPHAM_DIR } from './shared/constants'
 import { artifactsRoot } from './artifacts/paths'
 import { AgentViewManager } from './agent-view/agent-view-manager'
-import { AgentViewDashboard } from './agent-view/dashboard'
+import { AgentsStandalone } from './agent-view/agents-standalone'
 import { createT } from './i18n-core/t'
 import { detectLocale } from './i18n-core/detect'
 import { I18nProvider } from './i18n-context'
@@ -380,11 +381,7 @@ export async function runApp(options: RunOptions): Promise<void> {
   if (args[0] === 'agents') {
     const agentViewManager = new AgentViewManager()
     const { waitUntilExit } = render(
-      <AgentViewDashboard
-        manager={agentViewManager}
-        onAttach={() => {}}
-        onExit={() => process.exit(0)}
-      />,
+      <AgentsStandalone manager={agentViewManager} onExit={() => process.exit(0)} />,
       { exitOnCtrlC: false },
     )
     await waitUntilExit()
@@ -476,6 +473,11 @@ export async function runApp(options: RunOptions): Promise<void> {
   const instructions = new InstructionsLoader()
   instructions.loadAll(process.cwd())
 
+  // 指令体积提示：**按总量**说话（单文件都不大也可能一起挤占上下文）。
+  // 计数读的是真正会被发出去的那份投影（见 `instructionPartText`），不是磁盘上的字节。
+  const sizeNotice = formatInstructionSizeNotice(instructions.sizeReport())
+  if (sizeNotice) console.log(`\n${sizeNotice}\n`)
+
   // 空目录提示：愣建文件夹时温和提醒走 mipham init，而非默默开始（寒暄克制——一句即可）
   const { isEmptyProject } = await import('./core/project-scaffold')
   if (isEmptyProject(process.cwd())) {
@@ -555,6 +557,14 @@ export async function runApp(options: RunOptions): Promise<void> {
   // 这里接的是 live `permission` —— 同一实例也交给引擎去执行，故下一次请求就与新档一致。
   context.setPermissionContextSource(() => instructions.buildPermissionBlock(permission.getMode()))
 
+  // MCP server 自带的 `instructions` 走同一条读时派生的路，理由比权限段更硬：server 是**启动后
+  // 异步连上**的（见下方 `connectMcpServers`），而提示在这一刻就建好了。组装时烘进去的话，
+  // 本次会话里后连上的 server 永远进不了提示 —— 用户只能重启。读 `/listConnections()` 是
+  // live 的，连上一个下一次请求就带上。
+  context.setMcpInstructionsSource(() =>
+    buildMcpInstructionsBlock(McpClient.getInstance().listConnections()),
+  )
+
   // Adaptive memory budget: scale with model's context window
   getMemoryManager().setContextWindow(modelContextWindow)
 

package/src/mcp/client.ts

@@ -26,6 +26,11 @@ const t = createT(bundles['en-US'] || (enUS as TranslationMap), enUS as Translat
 // than block on the per-request 60s timeout. Overridable via env for tests.
 const DEFAULT_CONNECT_TIMEOUT_MS = 15_000
 
+// How often a caller waiting on a handshake re-checks it. A handshake settles in
+// tens of milliseconds when it settles at all; this only bounds how long the wait
+// can overshoot the moment it actually did.
+const CONNECT_POLL_MS = 50
+
 function connectTimeoutMs(): number {
   const env = Number(process.env.MIPHAM_MCP_CONNECT_TIMEOUT_MS)
   return Number.isFinite(env) && env > 0 ? env : DEFAULT_CONNECT_TIMEOUT_MS
@@ -48,6 +53,8 @@ interface ActiveConnection {
   status: ConnectionStatus
   tools: ToolDefinition[]
   serverInfo?: { name: string; version: string }
+  /** initialize 自带的 server 使用说明；见 `mcp/instructions.ts`。 */
+  instructions?: string
   error?: string
   /** Coalescing timer for `tools/list_changed` (see scheduleToolsRefresh). */
   toolsRefreshTimer?: ReturnType<typeof setTimeout>
@@ -72,6 +79,17 @@ interface ActiveConnection {
 export class McpClient {
   private static instance: McpClient | null = null
   private connections = new Map<string, ActiveConnection>()
+  /**
+   * 同名连接**正在握手中**的那一次。
+   *
+   * 两条来源在启动时是并发的：配置里的 server 在 `index.tsx` 一次 `Promise.allSettled`
+   * 里连（同一个同步块里那句没被 await），插件声明的 server 紧接着在 `loadPlugins` 里各
+   * 连一次（`.mcp.json` 走 `plugin-loader`、manifest 内联的 `mcpServers` 走 `claude-plugin`，
+   * 两处也都不 await）。撞上同一个名字时，第二条看到的是 `connecting`，于是**另起一条传输**
+   * 并把它塞回 map —— 而 `closeAll` 只遍历 `connections`，被换掉的那条没人关：stdio 的子
+   * 进程就此不被回收。名字就是身份（URL 怎么拼都不参与判重），所以同名就该是同一个连接。
+   */
+  private connecting = new Map<string, Promise<void>>()
   private _tokenStore: TokenStore | null = null
   private _oauthClient: OAuthClient | null = null
   private eventHandlers = new Map<string, Array<(...args: any[]) => void>>()
@@ -262,6 +280,21 @@ export class McpClient {
     const existing = this.connections.get(config.name)
     if (existing?.status === 'connected') return
 
+    // 名字正在握手中：合并到那一次，别另起一条传输。
+    const inflight = this.connecting.get(config.name)
+    if (inflight) return inflight
+
+    const attempt = this.connectOnce(config)
+    this.connecting.set(config.name, attempt)
+    try {
+      await attempt
+    } finally {
+      // 无论成败都要放开这个名字：失败后用户重连，得能真的重连。
+      this.connecting.delete(config.name)
+    }
+  }
+
+  private async connectOnce(config: McpServerConfig): Promise<void> {
     const transport: StdioTransport | HttpTransport = config.url
       ? new HttpTransport(undefined, config.request_timeout_ms)
       : new StdioTransport(config.request_timeout_ms)
@@ -289,6 +322,7 @@ export class McpClient {
 
         connection.status = 'connected'
         connection.serverInfo = initResult.serverInfo
+        connection.instructions = initResult.instructions
 
         // Wire tools-changed notification (coalesced — see scheduleToolsRefresh)
         protocol.on('tools-changed', () => {
@@ -335,6 +369,31 @@ export class McpClient {
     }
   }
 
+  /**
+   * Wait for a server that is still mid-handshake to settle.
+   *
+   * Startup connects servers without blocking, so a caller that fires alongside
+   * it — a hook, SessionStart work — can arrive while a server is *becoming*
+   * connected. Asked for a tool then, `callTool` answers "not connected", which
+   * is a statement about this moment rather than about the server.
+   *
+   * Bounded by the same timeout the handshake itself is, so a server that never
+   * settles fails the waiting caller instead of hanging it.
+   *
+   * @returns `false` only when the deadline passed with the server still
+   * connecting. A server this client knows nothing about is `true`: there is
+   * nothing to wait for, and `callTool` will say so.
+   */
+  async waitUntilReady(name: string, timeoutMs: number = connectTimeoutMs()): Promise<boolean> {
+    const deadline = Date.now() + timeoutMs
+    for (;;) {
+      const conn = this.connections.get(name)
+      if (!conn || conn.status !== 'connecting') return true
+      if (Date.now() >= deadline) return false
+      await new Promise((resolve) => setTimeout(resolve, CONNECT_POLL_MS))
+    }
+  }
+
   /**
    * Disconnect an MCP server and return the names of its registered tools
    * so the caller can unregister them from the central tool registry.
@@ -386,6 +445,7 @@ export class McpClient {
       tools: conn.tools,
       error: conn.error,
       serverInfo: conn.serverInfo,
+      instructions: conn.instructions,
     }
   }
 
@@ -401,6 +461,7 @@ export class McpClient {
       tools: conn.tools,
       error: conn.error,
       serverInfo: conn.serverInfo,
+      instructions: conn.instructions,
     }))
   }
 

package/src/mcp/instructions.ts

@@ -0,0 +1,49 @@
+import type { ConnectionInfo } from './types'
+
+/**
+ * 单个 server 的 instructions 上限。
+ *
+ * 这是**不受我们控制**的第三方文本，且**每次请求都要重新付一遍前缀** ——
+ * 一个啰嗦的 server 能靠一段自带说明把别人的预算吃光。截断而非拒绝：
+ * 前半段通常正是「这个 server 该怎么用」那部分。
+ */
+export const MCP_INSTRUCTIONS_PER_SERVER_CAP = 2000
+
+const TRUNCATION_MARKER = '… [truncated]'
+
+/**
+ * 把已连接 MCP server 自带的 `instructions` 拼成一段**系统提示用**的文本。
+ *
+ * 依据（MCP 规范）：`initialize` 的返回值里 `instructions` 是 server 运维方写的
+ * 「我该怎么被使用」—— 它**不是**工具描述，没地方能寄生，不收就等于丢掉。
+ *
+ * 三条刻意的约束：
+ *   - 没写 instructions 的 server **整段不出现**（空标题会让模型去猜一个不存在的 server）；
+ *   - 按 server 名**排序**，与连接完成顺序无关 —— 同一组 server 两次拼出的必须是同一段字节，
+ *     否则每次请求前缀都变，提供方的 prefix cache 全部落空；
+ *   - 无话可说时返回**空串**，由调用方据此整段不注入（而不是注入一个空壳标题）。
+ *
+ * **已知边界**：接的是**主会话**的系统提示（`index.tsx` → `ContextManager`）。子代理自己拼
+ * 提示词、且**请求读的是局部变量而非上下文**（见 `agent/sub-agent.ts` 的 `currentSystemPrompt`），
+ * 所以子代理**拿不到**这一段 —— 与权限段那道班是同一个形状，但那道班里子代理是**必须**知道
+ * 自己处在哪一档（不然会拒绝做已被允许的事），MCP instructions 只是「这个 server 怎么用」，
+ * 拿不到不影响正确性。此处如实记下，免得被当成已覆盖。
+ */
+export function buildMcpInstructionsBlock(connections: ConnectionInfo[]): string {
+  const sections = connections
+    .filter((c) => typeof c.instructions === 'string' && c.instructions.trim() !== '')
+    .slice()
+    .sort((a, b) => a.config.name.localeCompare(b.config.name))
+    .map((c) => {
+      const raw = c.instructions!.trim()
+      const body =
+        raw.length > MCP_INSTRUCTIONS_PER_SERVER_CAP
+          ? `${raw.slice(0, MCP_INSTRUCTIONS_PER_SERVER_CAP)}\n${TRUNCATION_MARKER}`
+          : raw
+      return `### ${c.config.name}\n${body}`
+    })
+
+  if (sections.length === 0) return ''
+
+  return ['## MCP server guidance', '', ...sections].join('\n')
+}

package/src/mcp/types.ts

@@ -45,6 +45,11 @@ export interface InitializeResult {
   protocolVersion: string
   capabilities: ServerCapabilities
   serverInfo: { name: string; version: string }
+  /**
+   * MCP 规范里 server 自带的「我该怎么被使用」。它没有工具描述那种可寄生之处，
+   * 不收就一个字节都到不了模型（见 `mcp/instructions.ts`）。
+   */
+  instructions?: string
 }
 
 export interface ServerCapabilities {
@@ -109,4 +114,6 @@ export interface ConnectionInfo {
   tools: ToolDefinition[]
   error?: string
   serverInfo?: { name: string; version: string }
+  /** 见 `InitializeResult.instructions`。 */
+  instructions?: string
 }

package/src/plugin/claude-plugin.ts

@@ -64,8 +64,18 @@ function loadClaudeSkills(dir: string, skillsLoader: SkillsLoader): void {
   }
 }
 
-/** Map a Claude MCP server entry to a Mipham `McpServerConfig`. */
-function toMcpServerConfig(name: string, raw: Record<string, unknown>): McpServerConfig | null {
+/**
+ * Map a Claude MCP server entry to a Mipham `McpServerConfig`, or `null` if the
+ * entry carries no transport.
+ *
+ * Exported so `validatePlugin` can ask *this* function — rather than its own copy
+ * of the rule — whether an entry would survive the load. A second copy is a second
+ * answer, and the one that drifts is the one the operator reads.
+ */
+export function toMcpServerConfig(
+  name: string,
+  raw: Record<string, unknown>,
+): McpServerConfig | null {
   const command = typeof raw.command === 'string' ? raw.command : undefined
   const url = typeof raw.url === 'string' ? raw.url : undefined
   if (!command && !url) return null

package/src/plugin/plugin-loader.ts

@@ -7,7 +7,7 @@ import type { HookEngine } from '../core/hooks'
 import type { McpClient } from '../mcp/client'
 import { registerMcpServerTools } from '../mcp/registry'
 import { executeHook } from '../core/hooks-executor'
-import { detectPluginFormat } from './plugin-validator'
+import { detectPluginFormat, isLoadableMcpConfig } from './plugin-validator'
 import { loadClaudePlugin } from './claude-plugin'
 import type { McpServerConfig, ToolDefinition, HookConfig, HookEvent } from '../shared/types'
 
@@ -50,7 +50,6 @@ export function loadPlugins(
     }
 
     const mcpServers: string[] = []
-    const hookEvents: HookEvent[] = []
 
     // ── Custom agents ──
     const agentsDir = join(plugin.path, 'agents')
@@ -86,7 +85,11 @@ export function loadPlugins(
           try {
             const raw = readFileSync(join(mcpDir, entry), 'utf-8')
             const cfg = JSON.parse(raw) as McpServerConfig
-            if (cfg.name && cfg.command) {
+            // Both transports, not just the local one. Requiring `command` here used
+            // to drop every server declared by `url` — a remote server carries no
+            // command — and dropping it in silence, so the plugin looked installed
+            // and its tools simply never appeared.
+            if (isLoadableMcpConfig(cfg)) {
               mcpServers.push(cfg.name)
               mcpClient
                 .connect(cfg)
@@ -103,9 +106,20 @@ export function loadPlugins(
                     `[plugin] Failed to connect MCP "${cfg.name}" from "${plugin.name}": ${String(err)}\n`,
                   )
                 })
+            } else {
+              // Silent skips are the failure this branch exists to end: the operator
+              // sees a plugin that loaded and tools that are missing, with nothing
+              // connecting the two.
+              const declared =
+                typeof cfg.name === 'string' && cfg.name !== '' ? ` "MCP server ${cfg.name}"` : ''
+              process.stderr.write(
+                `[plugin] "${plugin.name}": mcp-servers/${entry}${declared} declares neither command nor url — skipped\n`,
+              )
             }
-          } catch {
-            // skip unparseable MCP config files
+          } catch (err) {
+            process.stderr.write(
+              `[plugin] "${plugin.name}": mcp-servers/${entry} could not be parsed — skipped: ${String(err)}\n`,
+            )
           }
         }
       } catch (err) {
@@ -126,10 +140,14 @@ export function loadPlugins(
               const event = (hookCfg as unknown as Record<string, unknown>).event as
                 HookEvent | undefined
               if (event) {
-                hookEvents.push(event)
                 hookEngine.register({
                   event,
-                  handler: async (ctx) => executeHook(hookCfg, ctx),
+                  // Whoever is running the session can no longer tell this hook from
+                  // one they wrote themselves: the failure it prints would name only
+                  // its command, its health would be tracked under the bare event
+                  // name, and the cleanup below would have nothing to scope to.
+                  source: plugin.name,
+                  handler: async (ctx) => executeHook(hookCfg, ctx, plugin.name),
                 })
               }
             }
@@ -153,13 +171,13 @@ export function loadPlugins(
           /* best effort */
         }
       }
-      // Unregister hooks
-      for (const event of hookEvents) {
-        try {
-          hookEngine.unregister(event)
-        } catch {
-          /* best effort */
-        }
+      // Unregister hooks — this plugin's, and only this plugin's. Keyed by event,
+      // this removed every hook on those events: the operator's own from settings
+      // and other plugins' alike, silently.
+      try {
+        hookEngine.unregisterSource(plugin.name)
+      } catch {
+        /* best effort */
       }
     })
   }

package/src/plugin/plugin-manager.ts

@@ -15,6 +15,18 @@ import { miphamHome } from '../core/paths.ts'
 
 const PLUGIN_DIR = miphamHome('plugins')
 
+/**
+ * Render validation warnings for the install result.
+ *
+ * A warning the install message drops is a warning nobody reads, and the whole
+ * point of reporting a declaration we would skip is that the operator finds out
+ * here — before wondering why the plugin's tools never appeared.
+ */
+function warningsBlock(warnings: string[]): string {
+  if (warnings.length === 0) return ''
+  return warnings.map((w) => `\n⚠ ${w}`).join('')
+}
+
 export interface InstalledPlugin {
   name: string
   version: string
@@ -68,7 +80,8 @@ export class PluginManager {
       success: true,
       message:
         `Plugin "${validation.manifest.name}" v${validation.manifest.version} installed` +
-        (similarWarning ? `\n⚠ ${similarWarning}` : ''),
+        (similarWarning ? `\n⚠ ${similarWarning}` : '') +
+        warningsBlock(validation.warnings),
     }
   }
 
@@ -169,7 +182,8 @@ export class PluginManager {
         success: true,
         message:
           `Plugin "${manifestName}" installed from npm` +
-          (similarWarning ? `\n⚠ ${similarWarning}` : ''),
+          (similarWarning ? `\n⚠ ${similarWarning}` : '') +
+          warningsBlock(validation.warnings),
       }
     } catch (err: unknown) {
       const msg = err instanceof Error ? err.message : String(err)