@namzu/sdk 46.0.0 → 48.0.0

package/dist/plugin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxF,YAAY,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EACN,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,yBAAyB,EACzB,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EACN,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,yBAAyB,EACzB,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACX,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,iBAAiB,CAAA"}

package/dist/plugin/index.js

@@ -1,4 +1,5 @@
 export { discoverPlugins, loadPluginManifest, discoverAllPluginDirs } from './loader.js';
+export { definePlugin } from './define.js';
 export { PluginLifecycleManager } from './lifecycle.js';
 export { PluginResolver } from './resolver.js';
 export { attachShellHooks, createShellHook, DEFAULT_SHELL_HOOK_TIMEOUT_MS, MAX_SHELL_HOOK_TIMEOUT_MS, runShellHook, SHELL_HOOK_EVENTS, SHELL_HOOKS_PLUGIN_ID, shellHookMatches, shellHookVerdict, } from './shell-hook.js';

package/dist/plugin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAExF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EACN,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,yBAAyB,EACzB,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EACN,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,yBAAyB,EACzB,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,iBAAiB,CAAA"}

package/dist/plugin/lifecycle.d.ts

@@ -1,16 +1,17 @@
 import type { ConfigRegistry } from '../config/registry.js';
 import type { MCPToolDiscoveryOptions } from '../connector/mcp/discovery.js';
 import type { MCPToolPolicy } from '../connector/mcp/policy.js';
+import type { PromptContribution } from '../prompt/contributions.js';
 import type { PluginRegistry } from '../registry/plugin/index.js';
 import type { SkillRegistry } from '../skills/registry.js';
+import type { Toolset } from '../toolsets/types.js';
 import type { PluginId } from '../types/ids/index.js';
 import type { PluginDefinition, PluginEventListener, PluginHookContext, PluginHookDefinition, PluginHookEvent, PluginHookResult, PluginScope } from '../types/plugin/index.js';
 import type { SessionEvent } from '../types/session/index.js';
-import type { ToolRegistryContract } from '../types/tool/index.js';
 import type { Logger } from '../utils/logger.js';
+import { type DefinedPlugin } from './define.js';
 export interface PluginLifecycleManagerConfig {
     pluginRegistry: PluginRegistry;
-    toolRegistry: ToolRegistryContract;
     /**
      * Filesystem authorities for each plugin scope.
      *
@@ -70,7 +71,13 @@ export interface PluginLifecycleManagerConfig {
 }
 export declare class PluginLifecycleManager {
     private pluginRegistry;
-    private toolRegistry;
+    /** Each installed plugin owns its own file source and one source per MCP server. */
+    private readonly pluginFileTools;
+    private readonly pluginMcpTools;
+    private readonly mcpOwnerByName;
+    private readonly toolsetsByPlugin;
+    private readonly instructions;
+    private readonly toolsetChangeListeners;
     private listeners;
     private hookHandlers;
     private pluginContributions;
@@ -95,8 +102,22 @@ export declare class PluginLifecycleManager {
      * reads.
      */
     private mcpDiscovery;
+    private readonly mcpToolPolicies?;
+    private readonly onMCPToolDrift?;
     private readonly skillRegistry;
     constructor(config: PluginLifecycleManagerConfig);
+    /** Stable entries created at install, before a host composes its ToolManager. */
+    get toolsets(): readonly Toolset[];
+    /** Plugin-authored request context from enabled plugins. */
+    get promptContributions(): readonly PromptContribution[];
+    private registerToolsets;
+    private notifyToolsetChange;
+    /** A file-declared plugin tool. Always deferred, like every other tool this manager contributes. */
+    private addFileTool;
+    /** An MCP-discovered tool or a prompt adapted to one. */
+    private addMcpTool;
+    /** Reverses whichever of the two maps above actually holds `name`; a name in neither is a no-op. */
+    private removeContributedTool;
     /**
      * Attach a hook without installing a plugin from disk.
      *
@@ -114,11 +135,14 @@ export declare class PluginLifecycleManager {
     on(listener: PluginEventListener): void;
     off(listener: PluginEventListener): void;
     install(pluginDir: string, scope: PluginScope): Promise<PluginDefinition>;
+    /** Register a host-authored plugin without reading a manifest or importing modules. */
+    installDefined(plugin: DefinedPlugin, scope?: PluginScope): PluginDefinition;
     private definitionFrom;
     private readLegacyAdmission;
     enable(pluginId: PluginId): Promise<void>;
     private attachMCPServer;
     private rollbackContributions;
+    private stopMcpContributions;
     disable(pluginId: PluginId): Promise<void>;
     uninstall(pluginId: PluginId): Promise<void>;
     executeHooks(event: PluginHookEvent, context: Omit<PluginHookContext, 'pluginId' | 'event'>, emitSessionEvent?: (event: SessionEvent) => Promise<void>): Promise<PluginHookResult[]>;

package/dist/plugin/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/plugin/lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAI3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAS/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EACX,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAGhB,WAAW,EACX,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAkB,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAIlF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAmDhD,MAAM,WAAW,4BAA4B;IAC5C,cAAc,EAAE,cAAc,CAAA;IAC9B,YAAY,EAAE,oBAAoB,CAAA;IAClC;;;;;;;;OAQG;IACH,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IACjD;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAA;CACnD;AAED,qBAAa,sBAAsB;IAClC,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,YAAY,CAQP;IACb,OAAO,CAAC,mBAAmB,CAAqD;IAChF,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB,CAA4C;IACpE,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,OAAO,CAAC,GAAG,CAAQ;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,YAAY,CAAkB;IAEtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;gBAE7C,MAAM,EAAE,4BAA4B;IAehD;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,GAAG,IAAI;IAoBlE,EAAE,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAIvC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAKlC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8C/E,OAAO,CAAC,cAAc;YAYR,mBAAmB;IA6B3B,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;YAmKjC,eAAe;YAyEf,qBAAqB;IA4C7B,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAqE1C,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB5C,YAAY,CACjB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,OAAO,CAAC,EACtD,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GACvD,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyJ9B,OAAO,CAAC,IAAI;CAWZ"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/plugin/lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAG3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAA;AAE5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAS/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAG1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EACX,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAGhB,WAAW,EACX,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAK7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,KAAK,aAAa,EAAgB,MAAM,aAAa,CAAA;AA6E9D,MAAM,WAAW,4BAA4B;IAC5C,cAAc,EAAE,cAAc,CAAA;IAC9B;;;;;;;;OAQG;IACH,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IACjD;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;IAEzD;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAA;CACnD;AAED,qBAAa,sBAAsB;IAClC,OAAO,CAAC,cAAc,CAAgB;IACtC,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoC;IACpE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAC3E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAwB;IAC/D,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,YAAY,CAQP;IACb,OAAO,CAAC,mBAAmB,CAAqD;IAChF,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB,CAA4C;IACpE,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,OAAO,CAAC,GAAG,CAAQ;IACnB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAyC;IAC1E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAoC;IAEpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;gBAE7C,MAAM,EAAE,4BAA4B;IAgBhD,iFAAiF;IACjF,IAAI,QAAQ,IAAI,SAAS,OAAO,EAAE,CAEjC;IAED,4DAA4D;IAC5D,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,EAAE,CAEvD;IAED,OAAO,CAAC,gBAAgB;IAsCxB,OAAO,CAAC,mBAAmB;IAI3B,oGAAoG;IACpG,OAAO,CAAC,WAAW;IAKnB,yDAAyD;IACzD,OAAO,CAAC,UAAU;IAMlB,oGAAoG;IACpG,OAAO,CAAC,qBAAqB;IAS7B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,GAAG,IAAI;IAoBlE,EAAE,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAIvC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAKlC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA+C/E,uFAAuF;IACvF,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,GAAE,WAAuB,GAAG,gBAAgB;IAmCvF,OAAO,CAAC,cAAc;YAYR,mBAAmB;IA6B3B,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;YA8MjC,eAAe;YAyDf,qBAAqB;YA8BrB,oBAAoB;IAsB5B,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2D1C,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B5C,YAAY,CACjB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,OAAO,CAAC,EACtD,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GACvD,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyJ9B,OAAO,CAAC,IAAI;CAWZ"}

package/dist/plugin/lifecycle.js

@@ -1,18 +1,40 @@
 import { pathToFileURL } from 'node:url';
-import { mcpToolToToolDefinition } from '../connector/mcp/adapter.js';
 import { MCPClient } from '../connector/mcp/client.js';
 import { MCPToolDiscovery } from '../connector/mcp/discovery.js';
-import { mcpPromptToToolDefinition } from '../connector/mcp/prompt-adapter.js';
-import { MCPReconnectOptionsSchema, MCPReconnectSupervisor } from '../connector/mcp/reconnect.js';
+import { mcpToolset } from '../connector/mcp/mcp-toolset.js';
+import { MCPReconnectOptionsSchema } from '../connector/mcp/reconnect.js';
 import { DEFAULT_HOOK_PRIORITY, HOOK_TIMEOUT_MS, PLUGIN_NAMESPACE_SEPARATOR, } from '../constants/plugin/index.js';
 import { GENAI } from '../constants/telemetry/index.js';
+import { PromptContributionRegistry } from '../prompt/contributions.js';
 import { loadSkill } from '../skills/loader.js';
 import { resolveWithinReal } from '../tools/paths.js';
+import { wrapUntrusted } from '../tools/untrusted-envelope.js';
+import { deferred, prefixed } from '../toolsets/wrappers.js';
 import { assertPluginHookEvent } from '../types/plugin/index.js';
 import { toErrorMessage } from '../utils/error.js';
 import { generatePluginId } from '../utils/id.js';
 import { SCOPE_ATTRIBUTE } from '../utils/log/types.js';
+import { definePlugin } from './define.js';
 import { assertEnableable, loadPluginManifest } from './loader.js';
+/** Dynamic imports bypass ToolDefinition's TypeScript contract. */
+function assertPluginTool(value, pluginName, origin, index) {
+    const tool = value && typeof value === 'object' ? value : null;
+    const label = `Plugin "${pluginName}" tool #${index} from ${origin}`;
+    if (!tool ||
+        typeof tool.name !== 'string' ||
+        tool.name.length === 0 ||
+        typeof tool.description !== 'string' ||
+        typeof tool.execute !== 'function') {
+        throw new Error(`${label} must define name, description and execute.`);
+    }
+    const schema = tool.inputSchema;
+    if (!schema ||
+        typeof schema !== 'object' ||
+        typeof schema.safeParse !== 'function' ||
+        (!tool.modelInputSchema && typeof schema._def !== 'object')) {
+        throw new Error(`${label} must define inputSchema as a Zod schema, or as a compatible parser with modelInputSchema.`);
+    }
+}
 function immutableManifest(manifest) {
     const mcpServers = manifest.mcpServers?.map((server) => Object.freeze({
         name: server.name,
@@ -25,6 +47,7 @@ function immutableManifest(manifest) {
         version: manifest.version,
         description: manifest.description,
         ...(manifest.author !== undefined ? { author: manifest.author } : {}),
+        ...(manifest.instructions !== undefined ? { instructions: manifest.instructions } : {}),
         ...(manifest.tools ? { tools: Object.freeze([...manifest.tools]) } : {}),
         ...(manifest.skills ? { skills: Object.freeze([...manifest.skills]) } : {}),
         ...(manifest.hooks ? { hooks: Object.freeze([...manifest.hooks]) } : {}),
@@ -35,7 +58,13 @@ function immutableManifest(manifest) {
 }
 export class PluginLifecycleManager {
     pluginRegistry;
-    toolRegistry;
+    /** Each installed plugin owns its own file source and one source per MCP server. */
+    pluginFileTools = new Map();
+    pluginMcpTools = new Map();
+    mcpOwnerByName = new Map();
+    toolsetsByPlugin = new Map();
+    instructions = new PromptContributionRegistry();
+    toolsetChangeListeners = new Set();
     listeners = [];
     hookHandlers = new Map();
     pluginContributions = new Map();
@@ -60,14 +89,17 @@ export class PluginLifecycleManager {
      * reads.
      */
     mcpDiscovery;
+    mcpToolPolicies;
+    onMCPToolDrift;
     skillRegistry;
     constructor(config) {
         this.pluginRegistry = config.pluginRegistry;
-        this.toolRegistry = config.toolRegistry;
         this.skillRegistry = config.skillRegistry;
         this.scopeRoots = Object.freeze({ ...config.scopeRoots });
         this.hookTimeoutMs = config.hookTimeoutMs ?? HOOK_TIMEOUT_MS;
         this.configRegistry = config.configRegistry;
+        this.mcpToolPolicies = config.mcpToolPolicies;
+        this.onMCPToolDrift = config.onMCPToolDrift;
         this.log = config.log.child({ [SCOPE_ATTRIBUTE]: 'plugin/lifecycle' });
         this.mcpDiscovery = new MCPToolDiscovery([], {
             ...(config.mcpToolPolicies ? { policies: config.mcpToolPolicies } : {}),
@@ -75,6 +107,67 @@ export class PluginLifecycleManager {
             logger: this.log,
         });
     }
+    /** Stable entries created at install, before a host composes its ToolManager. */
+    get toolsets() {
+        return [...this.toolsetsByPlugin.values()].flat();
+    }
+    /** Plugin-authored request context from enabled plugins. */
+    get promptContributions() {
+        return this.instructions.list();
+    }
+    registerToolsets(admission) {
+        if (this.toolsetsByPlugin.has(admission.id))
+            return;
+        const pluginName = admission.manifest.name;
+        const onChange = (listener) => {
+            this.toolsetChangeListeners.add(listener);
+            return () => this.toolsetChangeListeners.delete(listener);
+        };
+        const fileTools = deferred({
+            source: {
+                id: `plugin:${pluginName}`,
+                kind: 'plugin',
+                name: pluginName,
+            },
+            tools: () => [...this.pluginFileTools.values()].filter((tool) => tool.name.startsWith(`${pluginName}${PLUGIN_NAMESPACE_SEPARATOR}`)),
+            onChange,
+        });
+        const mcpTools = (admission.manifest.mcpServers ?? []).map((server) => deferred({
+            source: {
+                id: `plugin:${pluginName}/mcp:${server.name}`,
+                kind: 'mcp_server',
+                name: server.name,
+                mcpServer: { name: server.name, readOnlyHintTrusted: false },
+            },
+            tools: () => [...this.pluginMcpTools.values()].filter((tool) => this.mcpOwnerByName.get(tool.name) === `plugin:${pluginName}/mcp:${server.name}`),
+            onChange,
+        }));
+        this.toolsetsByPlugin.set(admission.id, [fileTools, ...mcpTools]);
+    }
+    notifyToolsetChange() {
+        for (const listener of this.toolsetChangeListeners)
+            listener();
+    }
+    /** A file-declared plugin tool. Always deferred, like every other tool this manager contributes. */
+    addFileTool(tool) {
+        this.pluginFileTools.set(tool.name, tool);
+        this.notifyToolsetChange();
+    }
+    /** An MCP-discovered tool or a prompt adapted to one. */
+    addMcpTool(tool, sourceId) {
+        this.pluginMcpTools.set(tool.name, tool);
+        this.mcpOwnerByName.set(tool.name, sourceId);
+        this.notifyToolsetChange();
+    }
+    /** Reverses whichever of the two maps above actually holds `name`; a name in neither is a no-op. */
+    removeContributedTool(name) {
+        const removedFile = this.pluginFileTools.delete(name);
+        const removedMcp = this.pluginMcpTools.delete(name);
+        this.mcpOwnerByName.delete(name);
+        if (removedFile || removedMcp) {
+            this.notifyToolsetChange();
+        }
+    }
     /**
      * Attach a hook without installing a plugin from disk.
      *
@@ -138,6 +231,7 @@ export class PluginLifecycleManager {
         const definition = this.definitionFrom(admission, 'installed');
         this.pluginRegistry.register(definition);
         this.pluginAdmissions.set(pluginId, admission);
+        this.registerToolsets(admission);
         this.emit({
             type: 'plugin_installed',
             pluginId,
@@ -152,6 +246,41 @@ export class PluginLifecycleManager {
         });
         return definition;
     }
+    /** Register a host-authored plugin without reading a manifest or importing modules. */
+    installDefined(plugin, scope = 'project') {
+        const defined = definePlugin(plugin);
+        const existing = this.pluginRegistry.findByName(defined.name);
+        if (existing) {
+            throw new Error(`Plugin "${defined.name}" is already installed (id: ${existing.id})`);
+        }
+        const pluginId = generatePluginId();
+        const manifest = immutableManifest({
+            name: defined.name,
+            version: defined.version,
+            description: defined.description,
+            ...(defined.instructions !== undefined ? { instructions: defined.instructions } : {}),
+            mcpServers: defined.mcpServers,
+        });
+        const admission = Object.freeze({
+            id: pluginId,
+            manifest,
+            scope,
+            rootDir: this.scopeRoots[scope],
+            installedAt: Date.now(),
+            inCode: defined,
+        });
+        const definition = this.definitionFrom(admission, 'installed');
+        this.pluginRegistry.register(definition);
+        this.pluginAdmissions.set(pluginId, admission);
+        this.registerToolsets(admission);
+        this.emit({
+            type: 'plugin_installed',
+            pluginId,
+            name: defined.name,
+            scope,
+        });
+        return definition;
+    }
     definitionFrom(admission, status, enabledAt) {
         return Object.freeze({
             ...admission,
@@ -198,6 +327,7 @@ export class PluginLifecycleManager {
             try {
                 admission = await this.readLegacyAdmission(plugin);
                 this.pluginAdmissions.set(pluginId, admission);
+                this.registerToolsets(admission);
             }
             catch (error) {
                 this.pluginRegistry.register({
@@ -217,7 +347,9 @@ export class PluginLifecycleManager {
         // `installed`: a status that says the plugin is fine while it can
         // never enable is how the next reader gets misled.
         try {
-            assertEnableable(manifest, { skillsSupported: Boolean(this.skillRegistry) });
+            assertEnableable(manifest, {
+                skillsSupported: Boolean(this.skillRegistry),
+            });
         }
         catch (err) {
             this.pluginRegistry.register({
@@ -229,12 +361,22 @@ export class PluginLifecycleManager {
         const contributions = {
             toolNames: [],
             mcpClients: [],
+            mcpToolsets: [],
+            mcpUnsubscribers: [],
+            mcpNamesBySource: new Map(),
             skillNames: [],
-            mcpSupervisors: [],
         };
         try {
-            // Load tools
-            if (manifest.tools && manifest.tools.length > 0) {
+            // Host-authored definitions have no file path to resolve or module to import.
+            if (admission.inCode) {
+                for (const [index, tool] of admission.inCode.tools.entries()) {
+                    assertPluginTool(tool, manifest.name, 'the in-code declaration', index + 1);
+                    const namespacedName = manifest.name + PLUGIN_NAMESPACE_SEPARATOR + tool.name;
+                    this.addFileTool({ ...tool, name: namespacedName });
+                    contributions.toolNames.push(namespacedName);
+                }
+            }
+            else if (manifest.tools && manifest.tools.length > 0) {
                 for (const toolPath of manifest.tools) {
                     const absolutePath = await resolveWithinReal(admission.rootDir, toolPath);
                     const fileUrl = pathToFileURL(absolutePath).href;
@@ -242,10 +384,14 @@ export class PluginLifecycleManager {
                     if (!mod.tools || !Array.isArray(mod.tools)) {
                         throw new Error(`Plugin "${manifest.name}": tool module "${toolPath}" must export a "tools" array`);
                     }
-                    for (const tool of mod.tools) {
+                    for (const [index, tool] of mod.tools.entries()) {
+                        assertPluginTool(tool, manifest.name, `"${toolPath}"`, index + 1);
                         const namespacedName = manifest.name + PLUGIN_NAMESPACE_SEPARATOR + tool.name;
-                        const namespacedTool = { ...tool, name: namespacedName };
-                        this.toolRegistry.register(namespacedTool, 'deferred');
+                        const namespacedTool = {
+                            ...tool,
+                            name: namespacedName,
+                        };
+                        this.addFileTool(namespacedTool);
                         contributions.toolNames.push(namespacedName);
                     }
                 }
@@ -275,7 +421,11 @@ export class PluginLifecycleManager {
                 }
             }
             // Load hooks
-            if (manifest.hooks && manifest.hooks.length > 0) {
+            if (admission.inCode) {
+                for (const hook of admission.inCode.hooks)
+                    this.registerHook(pluginId, hook);
+            }
+            else if (manifest.hooks && manifest.hooks.length > 0) {
                 for (const hookPath of manifest.hooks) {
                     const absolutePath = await resolveWithinReal(admission.rootDir, hookPath);
                     const fileUrl = pathToFileURL(absolutePath).href;
@@ -300,6 +450,22 @@ export class PluginLifecycleManager {
             throw err;
         }
         this.pluginContributions.set(pluginId, contributions);
+        const pluginInstructions = manifest.instructions;
+        if (pluginInstructions?.trim()) {
+            this.instructions.register({
+                id: `plugin:${manifest.name}:instructions`,
+                placement: 'context',
+                render: () => {
+                    if (!this.pluginContributions.has(pluginId))
+                        return null;
+                    return wrapUntrusted({
+                        kind: 'plugin-instructions',
+                        attributes: { plugin: manifest.name },
+                        provenance: `Plugin ${JSON.stringify(manifest.name)} supplied this text; it is plugin-authored context, not operator instructions or tool permissions.`,
+                    }, pluginInstructions);
+                },
+            });
+        }
         const enabled = this.definitionFrom(admission, 'enabled', Date.now());
         this.pluginRegistry.register(enabled);
         this.emit({
@@ -314,7 +480,8 @@ export class PluginLifecycleManager {
             // prose that is itself the debt.
             'namzu.plugin.id': pluginId,
             'namzu.plugin.name': manifest.name,
-            'namzu.plugin.tool_count': contributions.toolNames.length,
+            'namzu.plugin.tool_count': contributions.toolNames.length +
+                [...contributions.mcpNamesBySource.values()].reduce((count, names) => count + names.size, 0),
             'namzu.plugin.skill_count': contributions.skillNames.length,
             'namzu.plugin.mcp_server_count': contributions.mcpClients.length,
         });
@@ -332,55 +499,45 @@ export class PluginLifecycleManager {
         });
         await client.connect();
         contributions.mcpClients.push(client);
-        // Watched from here on. `connect()` above is the only attempt anything
-        // made: `transport.onClose` marked the client disconnected and rejected
-        // its pending calls, and nothing scheduled another try — so one blip
-        // took this plugin's tools out for the life of the process while the
-        // plugin went on reporting as enabled.
-        // The policy is read from the registry on EVERY attempt, not captured
-        // here. That is what makes the seam live: raising `maxAttempts` during
-        // an outage takes effect on the retry that is already running, which is
-        // the moment an operator actually reaches for it.
-        //
-        // Namespaced per server rather than globally, because two plugins'
-        // servers fail differently — one behind a flaky proxy wants patience,
-        // one behind a crash loop wants to give up and say so.
+        // The toolset owns reconnection and reads this policy on each attempt.
         const policyScope = this.configRegistry?.register(`mcp.${config.name}`, MCPReconnectOptionsSchema);
-        const supervisor = new MCPReconnectSupervisor(client, policyScope ? () => policyScope.get() : {});
-        supervisor.start();
-        contributions.mcpSupervisors.push(supervisor);
-        // Through the boundary, not around it. This used to call
-        // `client.listTools()` and register everything the server answered
-        // with, so the remote side decided what entered the agent's registry
-        // — least privilege inverted. `discoverFrom` applies the per-server
-        // allow/deny policy and reports a tool set that changed since the
-        // last discovery.
-        const discovered = await this.mcpDiscovery.discoverFrom(client);
-        const mcpTools = discovered.map((d) => d.tool);
-        for (const mcpTool of mcpTools) {
-            const baseDef = mcpToolToToolDefinition(mcpTool, client, config.name);
-            // Double-underscore between serverName and toolName so that e.g.
-            // (server="fs", tool="read_file") and (server="fs_read", tool="file")
-            // produce distinct final names.
-            const namespacedName = `${pluginName}${PLUGIN_NAMESPACE_SEPARATOR}mcp__${config.name}__${mcpTool.name}`;
-            const namespacedTool = { ...baseDef, name: namespacedName };
-            this.toolRegistry.register(namespacedTool, 'deferred');
-            contributions.toolNames.push(namespacedName);
-        }
-        // Prompts, through the same gate. A server publishing one is the same
-        // trust question as a server publishing a tool.
-        const prompts = await this.mcpDiscovery.discoverPromptsFrom(client);
-        for (const prompt of prompts) {
-            const baseDef = mcpPromptToToolDefinition(prompt, client, config.name);
-            const namespacedName = `${pluginName}${PLUGIN_NAMESPACE_SEPARATOR}${baseDef.name}`;
-            this.toolRegistry.register({ ...baseDef, name: namespacedName }, 'deferred');
-            contributions.toolNames.push(namespacedName);
-        }
+        // Preserve cross-disable drift detection. The live toolset below owns
+        // changes during this enablement; this manager-owned discovery remembers
+        // the server's earlier admission across clients and plugin lifetimes.
+        await this.mcpDiscovery.discoverFrom(client);
+        const sourceId = `plugin:${pluginName}/mcp:${config.name}`;
+        const policy = this.mcpToolPolicies?.[config.name] ?? this.mcpToolPolicies?.['*'];
+        const entries = await mcpToolset(client, {
+            id: sourceId,
+            availability: 'deferred',
+            allow: policy?.allow,
+            deny: policy?.deny,
+            reconnect: policyScope ? () => policyScope.get() : {},
+            onDrift: this.onMCPToolDrift,
+            logger: this.log,
+        });
+        contributions.mcpToolsets.push(...entries);
+        const wrapped = entries.map((entry) => prefixed(entry, `${pluginName}${PLUGIN_NAMESPACE_SEPARATOR}`));
+        const sync = () => {
+            const previous = contributions.mcpNamesBySource.get(sourceId) ?? new Set();
+            const nextTools = wrapped.flatMap((entry) => entry.tools());
+            const nextNames = new Set(nextTools.map((tool) => tool.name));
+            for (const name of previous) {
+                if (!nextNames.has(name))
+                    this.removeContributedTool(name);
+            }
+            for (const tool of nextTools)
+                this.addMcpTool(tool, sourceId);
+            contributions.mcpNamesBySource.set(sourceId, nextNames);
+        };
+        contributions.mcpUnsubscribers.push(entries[0].onChange?.(sync) ?? (() => { }));
+        sync();
     }
     async rollbackContributions(pluginId, contributions) {
+        await this.stopMcpContributions(contributions, 'rollback');
         for (const name of contributions.toolNames) {
             try {
-                this.toolRegistry.unregister(name);
+                this.removeContributedTool(name);
             }
             catch (unregErr) {
                 this.log.warn('Rollback: tool unregister failed', {
@@ -394,23 +551,6 @@ export class PluginLifecycleManager {
             // Wrapping it would suggest a failure mode that does not exist.
             this.skillRegistry?.unregister(name);
         }
-        // Stop supervising BEFORE disconnecting. The lifecycle event a
-        // deliberate disconnect emits is the same one a dropped transport
-        // emits, so a still-attached supervisor would reconnect what this
-        // rollback just closed.
-        for (const supervisor of contributions.mcpSupervisors)
-            supervisor.stop();
-        for (const client of contributions.mcpClients) {
-            try {
-                await client.disconnect();
-            }
-            catch (discErr) {
-                this.log.warn('Rollback: MCP disconnect failed', {
-                    'namzu.mcp.client_id': client.id,
-                    'exception.message': toErrorMessage(discErr),
-                });
-            }
-        }
         for (const [event, handlers] of this.hookHandlers) {
             const filtered = handlers.filter((h) => h.pluginId !== pluginId);
             if (filtered.length === 0) {
@@ -421,32 +561,39 @@ export class PluginLifecycleManager {
             }
         }
     }
-    async disable(pluginId) {
-        const plugin = this.pluginRegistry.getOrThrow(pluginId);
-        const admission = this.pluginAdmissions.get(pluginId);
-        const contributions = this.pluginContributions.get(pluginId);
-        if (!contributions) {
-            throw new Error(`Cannot disable plugin "${admission?.manifest.name ?? plugin.manifest.name}": status is not "enabled"`);
-        }
-        // Stop supervising first, for the same reason as the rollback path: the
-        // disconnect below emits the event the supervisor treats as a fault.
-        for (const supervisor of contributions.mcpSupervisors)
-            supervisor.stop();
-        // Disconnect MCP clients first so no new tool calls can reach them mid-teardown.
+    async stopMcpContributions(contributions, operation) {
+        for (const unsubscribe of contributions.mcpUnsubscribers)
+            unsubscribe();
+        for (const entry of contributions.mcpToolsets)
+            await entry.close?.();
         for (const client of contributions.mcpClients) {
             try {
                 await client.disconnect();
             }
-            catch (err) {
-                this.log.warn('MCP client disconnect failed during disable', {
+            catch (error) {
+                this.log.warn('MCP disconnect failed', {
+                    'namzu.plugin.operation': operation,
                     'namzu.mcp.client_id': client.id,
-                    'exception.message': toErrorMessage(err),
+                    'exception.message': toErrorMessage(error),
                 });
             }
         }
-        // Unregister contributed tools (plugin tools + MCP-adapted tools)
+        for (const names of contributions.mcpNamesBySource.values()) {
+            for (const name of names)
+                this.removeContributedTool(name);
+        }
+    }
+    async disable(pluginId) {
+        const plugin = this.pluginRegistry.getOrThrow(pluginId);
+        const admission = this.pluginAdmissions.get(pluginId);
+        const contributions = this.pluginContributions.get(pluginId);
+        if (!contributions) {
+            throw new Error(`Cannot disable plugin "${admission?.manifest.name ?? plugin.manifest.name}": status is not "enabled"`);
+        }
+        await this.stopMcpContributions(contributions, 'disable');
+        // Unregister file-declared tools; MCP entries were removed above.
         for (const name of contributions.toolNames) {
-            this.toolRegistry.unregister(name);
+            this.removeContributedTool(name);
         }
         // And its skills. A disabled plugin whose skills stayed registered
         // would keep offering the model instructions from something the
@@ -466,6 +613,7 @@ export class PluginLifecycleManager {
             }
         }
         this.pluginContributions.delete(pluginId);
+        this.instructions.unregister(`plugin:${admission?.manifest.name ?? plugin.manifest.name}:instructions`);
         // Update status to disabled
         const disabled = admission
             ? this.definitionFrom(admission, 'disabled')
@@ -488,7 +636,9 @@ export class PluginLifecycleManager {
             await this.disable(pluginId);
         }
         this.pluginRegistry.unregister(pluginId);
+        this.instructions.unregister(`plugin:${admission?.manifest.name ?? plugin.manifest.name}:instructions`);
         this.pluginAdmissions.delete(pluginId);
+        this.toolsetsByPlugin.delete(pluginId);
         this.emit({
             type: 'plugin_uninstalled',
             pluginId,