@oh-agent/dsh-mcp-manager 0.1.4 → 0.1.5

package/README.en.md

@@ -17,12 +17,12 @@ Install the bundle from the **Plugin Manager** page in Settings, or point
 `plugin_manager` at the npm package:
 
 ```
-plugin_manager  action: install_bundle  target: "@oh-agent/dsh-mcp-manager@0.1.4"
+plugin_manager  action: install_bundle  target: "@oh-agent/dsh-mcp-manager@0.1.5"
 ```
 
 An absolute directory works as `target` too, which is how you install a local
 checkout or the `dsh-mcp-manager.tgz` attached to the
-[v0.1.4 release](https://github.com/wangbobo-coder/dsh-mcp-manager/releases).
+[v0.1.5 release](https://github.com/wangbobo-coder/dsh-mcp-manager/releases).
 
 Do not `pnpm add` the package into the profile by hand, and do not edit the
 profile's `package.json` or `cordis.patch.yml`: installing a package is not the
@@ -219,10 +219,23 @@ How the mount works, by case:
 
 | the server is | the switch does | takes effect |
 | --- | --- | --- |
-| an `- insert:` item we wrote | deletes the item on off, rewrites it on on | on reconcile; the file returns to its exact previous bytes |
 | already a live `dsh-mcp-client` row | `pluginManager.setPluginEnabled(rowId, …)` | instantly — the row unmounts and its tools leave the tool list |
+| an `- insert:` item we wrote | deletes the item on off, rewrites it on on | on reconcile; the file returns to its exact previous bytes |
 | an `- insert:` item the user wrote | appends/removes the same `- id: …` / `disabled: true` override the plugin manager itself writes | on reconcile |
 | declared in another tool only, and switched on | writes a new `- insert:` row | live as soon as the Loader reconciles it (usually 1–4 s); the operation waits up to 8 s and reports `live: true`, else `activating: true` |
+
+The order matters, and it cost a real bug: **the Loader path must come before any
+file edit**. The first row and the rows below it overlap — an `- insert:` item we
+wrote ourselves is, once the Loader has read it, a live entry. An earlier version
+checked "is this row ours?" first and deleted the YAML row, so switching one off
+edited a file that needs a reconcile instead of hot-disposing the running
+instance; worse, switching it back on appended the block to the end of
+`cordis.patch.yml`, so the user's careful ordering was destroyed. Measured once:
+a 15,640-byte file changed SHA and the `mcp-playwright` block moved from the
+middle to the end after a single toggle round. It now tries the Loader first and
+only falls back to the file when no such entry exists at all;
+`scripts/test-toggle.mjs` pins this with "the patch file's bytes are identical
+after a toggle round".
 | not mounted anywhere, and switched off | nothing — already true, no dangling override | — |
 
 Our own row is removed before the Loader path is tried: the plugin manager can
@@ -258,23 +271,49 @@ That is the part that tells the truth.
 | --- | --- |
 | `loaded · N tools` | Connection succeeded, tools registered, the agent can call them now |
 | `mounted but failed to load` + Retry | The row is mounted but no tool registered — the process never started, or the handshake failed |
+| a red banner at the top + Retry all | N mounted servers cannot connect; retry every failed one in a single action |
 | `activating` | The patch row was just written; the Loader has not recomposed yet |
 | `load state unknown` | The tool registry cannot be read (older host) — **no conclusion is drawn**, and it is never reported as a failure |
 
 Reporting "unknown" rather than "failed" when the registry is unavailable is
-deliberate: marking a healthy server as broken is worse than marking nothing.
-
-Retry goes through `hmr.reconcileProfile([entryId])`, serialized inside
-`hmr.runExclusive`. That makes the Loader re-import the rows that failed and
-judge activation. Backoff retries after a failed connection are the mcp-client's
-own business, but once it gives up it registers nothing and waits for a reload
-that a settings page cannot deliver — so the reload has to come from us.
-Reconnecting is not instant (process spawn plus handshake), so the page re-reads
-state 2.5 seconds after the button is pressed.
-
-`scripts/test-load.mjs` pins this down, mostly the boundary between `unknown`,
+deliberate: marking a healthy server as broken is worse than marking nothing. The
+red banner follows the same rule and only appears when the registry is readable —
+otherwise every row reads `unknown`, and calling that a failure would be a guess.
+
+Retry is **not** `hmr.reconcileProfile`. That looks like the right lever and is a
+no-op: it only restarts entries that are **inactive**, while
+`@deepseek-ai/dsh-mcp-client` swallows the connect error under
+`failOnStartupError: false` and leaves the fiber **active**. Measured against a
+dead row: `reconcileProfile` returned success and rebuilt nothing — a retry button
+that lies.
+
+The lever that works is `pluginManager.setPluginEnabled(entryId, false)` followed
+by `(entryId, true)`: dispose the dead fiber, then mount it again from scratch.
+Hence three steps:
+
+1. `setPluginEnabled(entryId, false)` tears the old connection down. If that call
+   itself fails, report `could not dispose the stale connection: <code>` — never
+   pretend a retry happened;
+2. `setPluginEnabled(entryId, true)` rebuilds it. If it throws, best-effort
+   re-enable, because leaving a server switched off is worse than a retry that
+   did not help;
+3. poll the tool registry (`mcp__<mountName>__*`) until tools appear or the
+   budget runs out. **The verdict comes from the registry, not the composition**:
+   a rebuilt fiber shows up in the composition instantly, but only registered
+   tools prove the connection is real.
+
+Polling the registry rather than the fiber is the whole point: `active` only says
+"this plugin is loaded", and it stays active when the connection is dead — that is
+exactly why the page used to say "mounted" while nothing worked. Reconnecting is
+not instant (process spawn plus handshake), so the page re-reads state 2.5 seconds
+after the button is pressed, and a retry that still finds no tools reports the
+host's own reason instead of a generic "something went wrong".
+
+`scripts/test-load.mjs` pins the verdicts down (the boundary between `unknown`,
 `failed` and `loaded`, plus the name matching that decides which tools belong to
-which server.
+which server), and `scripts/test-retry.mjs` pins the retry itself: exactly one
+disable followed by one enable, the host's reason surfaced verbatim, and a failed
+rebuild must not leave the row switched off.
 
 ### A mount name is not always the display name
 

package/README.md

@@ -17,11 +17,11 @@
 直接说「安装 @oh-agent/dsh-mcp-manager」，等价于：
 
 ```
-plugin_manager  action: install_bundle  target: "@oh-agent/dsh-mcp-manager@0.1.4"
+plugin_manager  action: install_bundle  target: "@oh-agent/dsh-mcp-manager@0.1.5"
 ```
 
 `target` 也可以填一个绝对目录 —— 本地源码目录，或者
-[v0.1.4 release](https://github.com/wangbobo-coder/dsh-mcp-manager/releases) 里附的
+[v0.1.5 release](https://github.com/wangbobo-coder/dsh-mcp-manager/releases) 里附的
 `dsh-mcp-manager.tgz` 解出来的目录。
 
 **不要**手动 `pnpm add` 进 profile，也不要手改 profile 的 `package.json` 或
@@ -135,12 +135,14 @@ client.js  (设置页)                 index.js  (宿主入口)
 
 | 服务器是 | 开关做的事 | 生效时机 |
 | --- | --- | --- |
-| 我们自己写的 `- insert:` 项 | 关：删掉该项；开：重写它 | 重排后生效；文件回到精确的原始字节 |
 | 已经是运行中的 `dsh-mcp-client` 行 | `pluginManager.setPluginEnabled(rowId, …)` | 立即 —— 行卸载，其工具从工具列表消失 |
+| 我们自己写的 `- insert:` 项 | 关：删掉该项；开：重写它 | 重排后生效；文件回到精确的原始字节 |
 | 用户自己写的 `- insert:` 项 | 追加/移除插件管理器自己也会写的那种 `- id: …` / `disabled: true` 覆盖项 | 重排后生效 |
 | 只声明在别的工具里，且被打开 | 写一条新的 `- insert:` 行 | Loader 重排后即生效（通常 1–4 秒）；操作最多等 8 秒并上报 `live: true`，否则 `activating: true` |
 | 哪里都没挂载，且被关闭 | 什么都不做 —— 本就是事实，不留悬空覆盖项 | — |
 
+顺序很重要，这是踩过的坑：**Loader 路径必须排在改文件之前**。上面第一行和下面几行会同时命中 —— 我们自己写过的 `- insert:` 项，一旦被 Loader 读进来就是一条活的 entry。早先的版本先判「这行是我们的就删文件」，结果关一次开关，删掉的是 YAML 行（要重排才生效），而不是热卸载那个正在跑的实例；更糟的是重新打开时该块会被追加到文件末尾，用户精心排过序的 `cordis.patch.yml` 被搬了家。实测过一次：15640 字节的文件在开关一轮之后 SHA 变了、`mcp-playwright` 整块从前面挪到了文件尾。现在先走 Loader，只有在根本不存在这个 entry 时才回落到改文件，`scripts/test-toggle.mjs` 用「开关一轮之后补丁文件字节零变化」钉住了这件事。
+
 我们自己写的行会在尝试 Loader 路径之前被移除：插件管理器确实能热卸载一行，但它的做法是在定义旁边追加一条 `disabled: true` 覆盖项，那会让我们的行和这条覆盖项一起永久留在用户的组合文件里。删除 insert 项既是卸载也是清理。
 
 因为覆盖项是独立的一项而不是重写，且我们自己写的行是删除而不是禁用，一次完整的挂载 → 卸载循环会把 `cordis.patch.yml` 还原到精确的原始字节。
@@ -157,14 +159,23 @@ client.js  (设置页)                 index.js  (宿主入口)
 | --- | --- |
 | `已加载 · N 个工具` | 连接成功，工具已注册，agent 现在就能调 |
 | `已挂载但加载失败` + 「重试」 | 行挂上了，但一个工具都没注册 —— 进程没起来或握手失败 |
+| 页面顶部红色横幅 + 「全部重试」 | 有 N 个服务器挂上了却连不上，一次把失败的全部重试 |
 | `正在激活` | 刚写完补丁行，Loader 还没重排完 |
 | `加载状态未知` | 读不到工具注册表（老版本宿主），此时**不下结论**，绝不误判成失败 |
 
-拿不到注册表时宁可显示「未知」也不显示「失败」：把一台健康的服务器标成坏的，比不标更糟。
+拿不到注册表时宁可显示「未知」也不显示「失败」：把一台健康的服务器标成坏的，比不标更糟。同理，红色横幅只在注册表可读时才出现 —— 否则每一行都是「未知」，那时候报「失败」纯属猜测。
+
+失败行的「重试」**不是** `hmr.reconcileProfile`。那个看着像正解，实际是个假动作：它只重启处于 **inactive** 的行，而 `@deepseek-ai/dsh-mcp-client` 在 `failOnStartupError: false` 下会把连接错误吞掉，fiber 一直是 **active**。拿一条死行实测过：`reconcileProfile` 返回成功，一个连接都没重建 —— 一个会说谎的重试按钮。
+
+真正的杠杆是 `pluginManager.setPluginEnabled(entryId, false)` 再 `(entryId, true)`：先 dispose 掉那条死 fiber，再重新走一遍完整的挂载。据此分三步：
+
+1. `setPluginEnabled(entryId, false)` 拆掉旧连接 —— 这一步失败就直接报「could not dispose the stale connection: <code>」，不要假装重试过；
+2. `setPluginEnabled(entryId, true)` 重建 —— 抛异常时尽力恢复成「开着」，宁可保留一个连不上的行，也不能把用户的服务悄悄关掉；
+3. 轮询工具注册表（`mcp__<挂载名>__*`）直到出现工具或超时。**判定依据是注册表，不是组合文件**：重建后的 fiber 会立刻出现在组合里，可只有它真注册上工具才算连上了。
 
-「重试」走的是 `hmr.reconcileProfile([entryId])`（在 `hmr.runExclusive` 里串行执行），它会让 Loader 重新导入那些失败的行并判定激活结果 —— 连接失败之后的退避重试是 mcp-client 自己的事，可它一旦放弃就什么都不注册、只等一次重载，而设置页给不了这次重载，所以必须由我们来触发。重连不是瞬时的（起进程 + 握手），因此按钮点完 2.5 秒后页面会自己再读一次状态。
+为什么轮询注册表而不是直接看 fiber：fiber `active` 只说明「这个插件被加载了」，连不上也照样 active，这正是当初「显示已挂载、其实加载失败」的根源。重连不是瞬时的（起进程 + 握手），所以按钮点完 2.5 秒后页面会自己再读一次状态；等不到工具时提示里带的是宿主返回的真实原因，而不是一句「出错了」。
 
-`scripts/test-load.mjs` 钉住了这套判定，重点是 `unknown` / `failed` / `loaded` 三者的边界，以及按名字归属工具时不能张冠李戴。
+`scripts/test-load.mjs` 钉住了判定边界（`unknown` / `failed` / `loaded` 三者不能互相冒充，按名字归属工具也不能张冠李戴），`scripts/test-retry.mjs` 钉住了重试本身：必须是「先关后开」两次调用、失败原因要原样透出、重建失败时不能把行留在关闭状态。
 
 ### 挂载名不总是显示名
 

package/lib/client.js

@@ -88,9 +88,13 @@ window.__ModuleLoader__.load({
         'load.unknownTitle': 'The tool registry is not available, so whether this server connected cannot be checked from here.',
         'toast.retried': 'Reconnected “{name}” — {count} tools are live now.',
         'toast.retryFailed': '“{name}” is still not loaded. Run a test to see why the process will not start.',
+        'toast.retryReason': 'Could not reconnect “{name}”: {reason}',
+        'toast.retryWarn': '{count} warning(s) from DeepSeek Harness — the connection was rebuilt anyway.',
         'error.retry': 'DeepSeek Harness could not re-run this connection.',
         'banner.secrets': '{count} server(s) store credentials as literal text in a configuration file that may be committed.',
         'banner.parse': '{count} file(s) could not be parsed.',
+        'banner.loadFailed': '{count} server(s) are mounted in DeepSeek Harness but failed to connect — no tool is registered from them.',
+        'btn.retryAll': 'Retry all',
         'confirm.sync': 'Copy “{name}” into {count} other tool(s)?',
         'confirm.reveal': 'Show credential values in clear text?',
         'error.title': 'Something went wrong',
@@ -167,9 +171,13 @@ window.__ModuleLoader__.load({
         'load.unknownTitle': '当前取不到工具注册表，无法从这里判断该服务器是否连上。',
         'toast.retried': '已重连 “{name}” —— 现有 {count} 个工具可用。',
         'toast.retryFailed': '“{name}” 仍未加载。点“测试”可以看清进程为什么起不来。',
+        'toast.retryReason': '无法重连 “{name}”：{reason}',
+        'toast.retryWarn': 'DeepSeek Harness 返回了 {count} 条警告，但连接已重建。',
         'error.retry': 'DeepSeek Harness 无法重新发起这次连接。',
         'banner.secrets': '有 {count} 个服务器把凭据以明文保存在可能被提交的配置文件里。',
         'banner.parse': '有 {count} 个文件无法解析。',
+        'banner.loadFailed': '有 {count} 个服务器已挂载到 DeepSeek Harness，但连接失败 —— 没有任何工具注册成功。',
+        'btn.retryAll': '全部重试',
         'confirm.sync': '把 “{name}” 复制到 {count} 个其他工具？',
         'confirm.reveal': '以明文显示凭据？',
         'error.title': '出错了',
@@ -353,6 +361,9 @@ window.__ModuleLoader__.load({
 .mcpm-banner { border: 0.5px solid var(--dsw-alias-border-l2); border-radius: var(--dsw-radius-lg, 16px);
   padding: 9px 11px; color: var(--dsw-alias-label-secondary); font-size: 12px; line-height: 18px; }
 .mcpm-banner.warn { border-color: var(--dsw-alias-state-warn-primary); color: var(--dsw-alias-state-warn-primary); }
+.mcpm-banner.err { border-color: var(--dsw-alias-state-error-primary); color: var(--dsw-alias-state-error-primary); }
+.mcpm-banner-row { display: flex; flex-wrap: wrap; align-items: center; gap: 10px; }
+.mcpm-banner-row > span { flex: 1 1 220px; min-width: 0; }
 .mcpm-error { border: 0.5px solid var(--dsw-alias-state-error-primary); border-radius: var(--dsw-radius-lg, 16px);
   padding: 9px 11px; color: var(--dsw-alias-state-error-primary); font-size: 12px; line-height: 18px; }
 .mcpm-error-lines { display: flex; flex-direction: column; gap: 6px; }
@@ -717,6 +728,18 @@ window.__ModuleLoader__.load({
         return counts;
       }, [mountIndex]);
 
+      /*
+       * The names that "Retry all" will visit, in list order. Only rows that are
+       * mounted, enabled and stuck in `failed` qualify — a row that is merely
+       * off must stay off, and a healthy row must not be bounced.
+       */
+      const failedList = useMemo(
+        () => [...mountIndex.values()]
+          .filter((item) => item.mounted && item.enabled && item.load?.status === 'failed')
+          .map((item) => item.node.name),
+        [mountIndex],
+      );
+
       /*
        * Opt-in, not opt-out: an older host snapshot has no `loadSummary` at all,
        * and that must read as "cannot tell" rather than as "registry is fine".
@@ -798,24 +821,37 @@ window.__ModuleLoader__.load({
        * The failure is often environmental and temporary — the wrong Node was on
        * PATH when the Host booted, a package was still downloading — so the fix
        * is simply to run the connection again. That is a Host-side operation
-       * (a profile reconcile), not a config edit.
+       * (dispose the dead fiber, then re-enable it), not a config edit.
+       *
+       * This does NOT go through run(): a failed retry answers with a specific
+       * reason ("could not dispose the stale connection: operation-error — …"),
+       * and a generic "it did not work" toast would throw that away.
        */
       const retryLoad = async (name) => {
         setRetrying((current) => ({ ...current, [name]: true }));
+        setError(null);
         try {
-          const data = await run('retry', { name });
-          if (!data) {
-            flash(t('error.retry'));
-            return;
-          }
-          if (data.loaded) flash(t('toast.retried', { name, count: data.load?.toolCount ?? 0 }));
+          const data = await api('retry', { name });
+          if (data?.state && mounted.current) setState(data.state);
+          if (data?.loaded) flash(t('toast.retried', { name, count: data.load?.toolCount ?? 0 }));
           else flash(t('toast.retryFailed', { name }));
+          if (data?.warnings?.length) {
+            flash(t('toast.retryWarn', { count: data.warnings.length }));
+          }
           /*
            * A reconnect is not instant: the process still has to spawn and do its
            * initialize handshake, so the snapshot in the response can be one beat
            * too early. Re-read once after it has had a moment.
            */
           setTimeout(() => { if (mounted.current) void load(reveal); }, 2500);
+        } catch (cause) {
+          /*
+           * Keep the reason visible: the usual cause is a spawn failure that
+           * only the Host knows about, so surfacing cause.message here is the
+           * whole point of the button.
+           */
+          setError(cause);
+          flash(t('toast.retryReason', { name, reason: cause?.message ?? t('error.retry') }));
         } finally {
           setRetrying((current) => {
             const next = { ...current };
@@ -825,6 +861,21 @@ window.__ModuleLoader__.load({
         }
       };
 
+      /*
+       * Retry every failed row in one go.
+       *
+       * Serial on purpose: each retry disposes and rebuilds one fiber, and doing
+       * them at once would spawn a burst of npm processes that fight for the same
+       * network and the same CPU, which makes a slow failure look like a hang.
+       * The list is recomputed from the LAST snapshot so a row that recovers
+       * halfway through is not retried twice.
+       */
+      const retryAll = async () => {
+        const names = failedList;
+        if (names.length === 0) return;
+        for (const name of names) await retryLoad(name);
+      };
+
       const doSync = async (server) => {
         if (!window.confirm(t('confirm.sync', { name: server.name, count: syncPicks.length }))) return;
         const data = await run('sync', { name: server.name, server: server.canonical, targets: syncPicks });
@@ -944,6 +995,22 @@ window.__ModuleLoader__.load({
         state.warnings.length
           ? h('div', { className: 'mcpm-banner warn', key: 'parse' }, t('banner.parse', { count: state.warnings.length }))
           : null,
+        /*
+         * Only when the registry is readable: without it every mounted row reads
+         * as `unknown`, and claiming a failure there would be a guess.
+         */
+        registryAvailable && failedList.length
+          ? h('div', { className: 'mcpm-banner err mcpm-banner-row', key: 'loadFailed' }, [
+            h('span', { key: 't' }, t('banner.loadFailed', { count: failedList.length })),
+            h('button', {
+              key: 'r',
+              type: 'button',
+              className: 'mcpm-btn sm',
+              disabled: busy,
+              onClick: retryAll,
+            }, t('btn.retryAll')),
+          ])
+          : null,
       ].filter(Boolean) : [];
 
       const probeTag = (name) => {

package/lib/index.js

@@ -21,6 +21,7 @@ import { applyServerToTarget, removeServer, syncServer, snippetFor } from './ops
 import { CLIENTS, CLIENT_BY_ID } from './adapters.js';
 import { redactServer, isSecretKey, isSecretValue, maskValue, dshMountName } from './canonical.js';
 import { toggleServer } from './toggle.js';
+import { countLiveTools, liveToolNames, loadRecord } from './load.js';
 import { mcpEntries } from './dsh.js';
 
 export const name = 'mcp-manager';
@@ -135,6 +136,7 @@ export function apply(ctx, config = {}) {
     backupsToKeep: Number.isFinite(config.backupsToKeep) ? config.backupsToKeep : 20,
     includeProjectScope: config.includeProjectScope !== false,
     probeConcurrency: Number.isFinite(config.probeConcurrency) ? config.probeConcurrency : 4,
+    retryTimeoutMs: Number.isFinite(config.retryTimeoutMs) ? config.retryTimeoutMs : 25000,
   };
 
   const home = process.env.DSH_HOME || join(process.env.USERPROFILE || process.env.HOME || '.', '.dsh');
@@ -265,6 +267,25 @@ export function apply(ctx, config = {}) {
     }
   }
 
+  /**
+   * Wait until a reconnected server has registered at least one tool.
+   *
+   * Polls the tool registry rather than the composition: a rebuilt fiber shows up
+   * in the composition immediately, but the connection is only proven by the
+   * `mcp__<mount>__*` names it registers. Returns the tool count it last saw, so
+   * a 0 after the budget expires is a measured failure, not a guess.
+   */
+  async function waitForTools(mountName, budgetMs) {
+    const deadline = Date.now() + budgetMs;
+    for (;;) {
+      const names = liveToolNames(toolRegistry());
+      const count = names ? countLiveTools(names, mountName) : 0;
+      if (count > 0) return count;
+      if (Date.now() >= deadline) return count;
+      await new Promise((resolve) => setTimeout(resolve, 300));
+    }
+  }
+
   async function opProbe({ names, timeoutMs } = {}) {
     const state = snapshot(true);
     const wanted = Array.isArray(names) && names.length ? new Set(names) : null;
@@ -342,11 +363,22 @@ export function apply(ctx, config = {}) {
    * backoff timer for that, but once it gives up it registers nothing and waits
    * for a reload that a settings page has no way to deliver.
    *
-   * The supported lever is `hmr.reconcileProfile(requiredIds)`: it recomposes the
-   * profile, re-imports the entry, and — because the id is listed as required —
-   * reports its inactivity instead of silently tolerating it. That re-runs the
-   * connection, which is exactly the retry the user asked for. Serialized through
-   * `runExclusive` so it cannot race an automatic reload.
+   * `hmr.reconcileProfile` looks like the right lever and is NOT. It recomposes
+   * the profile and re-imports the entry, but a failed mcp-client keeps its fiber
+   * `active` (it swallows the connect error under `failOnStartupError: false`),
+   * and reconcile only restarts entries that are INACTIVE. Measured against a
+   * dead row it returned success and rebuilt nothing — a retry button that lies.
+   *
+   * The lever that does rebuild the connection is the one the plugin manager
+   * itself uses: `setPluginEnabled(id, false)` disposes the mcp-client fiber and
+   * `setPluginEnabled(id, true)` recreates it, running `apply()` again — a fresh
+   * connection attempt. This does exactly that, then polls the tool registry
+   * (the only truthful proof of a successful connect) until tools appear or the
+   * budget runs out, so the answer is measured rather than assumed.
+   *
+   * Failure safety: the row is enabled again even when the enable call throws,
+   * because leaving a server switched off would be a worse outcome than a retry
+   * that did not help.
    */
   async function opRetry(body) {
     const name = typeof body.name === 'string' ? body.name.trim() : '';
@@ -360,34 +392,67 @@ export function apply(ctx, config = {}) {
     if (target.pending === true) return { ok: false, code: 'error.dsh.pending', error: `${name} is still being mounted; wait for it to appear first` };
     if (!target.entryId) return { ok: false, code: 'error.dsh.noEntry', error: `${name} has no Loader entry id; reload the plugin instead` };
 
-    const hmr = typeof ctx.get === 'function' ? ctx.get('hmr') : undefined;
-    if (!hmr || typeof hmr.reconcileProfile !== 'function') {
-      return { ok: false, code: 'error.dsh.noHmr', error: 'the hot-reload service is not available, so the connection cannot be re-run' };
+    const manager = typeof ctx.get === 'function' ? ctx.get('pluginManager') : undefined;
+    if (!manager || typeof manager.setPluginEnabled !== 'function') {
+      return { ok: false, code: 'error.dsh.noManager', error: 'the plugin manager is not available, so the connection cannot be rebuilt' };
     }
 
+    const entryId = target.entryId;
+    const mountName = target.mountedAs ?? target.server?.mountName ?? dshMountName(name);
     const before = node.load ?? null;
+    const warnings = [];
+    let disabled = false;
+    let enabled = null;
+
     try {
-      const run = () => hmr.reconcileProfile([target.entryId]);
-      const reconciled = typeof hmr.runExclusive === 'function' ? await hmr.runExclusive(run) : await run();
-      const after = snapshot(false).servers.find((item) => item.name === name);
-      const load = after?.load ?? null;
-      /* A reconcile that succeeds only proves the profile recomposed. Whether the
-         connection came back is decided by the registry, read again after it. */
+      const off = await manager.setPluginEnabled(entryId, false);
+      for (const warning of off?.warnings ?? []) warnings.push(warning);
+      if (off?.application === 'failed') {
+        return {
+          ok: false,
+          code: 'error.dsh.retry',
+          error: `could not dispose the stale connection: ${off?.error?.code ?? 'unknown'}${off?.error?.diagnostic ? ` — ${off.error.diagnostic}` : ''}`,
+          before,
+          state: snapshot(false),
+        };
+      }
+      disabled = true;
+      enabled = await manager.setPluginEnabled(entryId, true);
+      for (const warning of enabled?.warnings ?? []) warnings.push(warning);
+    } catch (error) {
+      /* Put the row back the way the user left it before reporting the failure. */
+      if (disabled) {
+        try {
+          enabled = await manager.setPluginEnabled(entryId, true);
+        } catch { /* the retry error below is the one worth reporting */ }
+      }
       return {
-        ok: true,
-        name,
-        entryId: target.entryId,
+        ok: false,
+        code: 'error.dsh.retry',
+        error: String(error && error.message ? error.message : error),
         before,
-        load,
-        loaded: load?.status === 'loaded',
-        warnings: Array.isArray(reconciled?.warnings) ? reconciled.warnings : [],
-        pending: Array.isArray(reconciled?.pending) ? reconciled.pending.map((item) => item.reason) : [],
-        restartReason: reconciled?.restartReason ?? null,
         state: snapshot(false),
       };
-    } catch (error) {
-      return { ok: false, code: 'error.dsh.retry', error: String(error && error.message ? error.message : error) };
     }
+
+    const toolCount = await waitForTools(mountName, options.retryTimeoutMs);
+    const after = snapshot(false).servers.find((item) => item.name === name);
+    const load = after?.load ?? loadRecord({ mountName, mounted: true, enabled: true, pending: false, counts: null, registry: false });
+
+    return {
+      ok: true,
+      name,
+      entryId,
+      mountName,
+      before,
+      load,
+      loaded: load?.status === 'loaded',
+      toolCount,
+      warnings,
+      application: enabled?.application ?? null,
+      restartReason: enabled?.restartReason ?? null,
+      state: snapshot(false),
+    };
   }
 
   const dispatch = async (action, body = {}) => {

package/lib/probe.js

@@ -25,7 +25,7 @@ const PROTOCOL_VERSION = '2025-06-18';
  * connection to this plugin and a version we still recognise. `test-release.mjs`
  * asserts it matches package.json — a stale value here is otherwise invisible.
  */
-const CLIENT_INFO = { name: 'dsh-mcp-manager', version: '0.1.4' };
+const CLIENT_INFO = { name: 'dsh-mcp-manager', version: '0.1.5' };
 
 function rpcRequest(id, method, params) {
   return JSON.stringify({ jsonrpc: '2.0', id, method, params });

package/lib/toggle.js

@@ -67,25 +67,6 @@ export async function toggleServer({ get, profileDir, store }, { name, enabled,
 
   const manager = pluginManagerOf(get);
 
-  /*
-   * Unmounting a row WE created takes our own row out again.
-   *
-   * This runs first, before the Loader path and before the manager check, for
-   * three reasons: the Loader disposes the instance hot but does so by appending
-   * a `disabled: true` override beside the `- insert:` item, which leaves our
-   * row (and the override) in the user's composition forever; removing the
-   * insert item returns the file to exactly the bytes it had before we mounted
-   * anything; and removing a row needs no service, so the switch still works if
-   * the plugin manager is unavailable. A row the user authored is never touched
-   * here — `ownedByUs` requires our own ledger entry for it.
-   */
-  if (!enabled && ownedByUs(store, rowName)) {
-    const removed = removeDshPatchServer({ serverName: rowName, store, profileDir });
-    if (removed.ok && removed.changed) {
-      return { ok: true, changed: true, enabled: false, via: 'patch', restartRequired: false, target: removed.path, unmounted: true };
-    }
-  }
-
   if (!manager) {
     /*
      * No plugin manager: a row we can reach in the patch layer can still be
@@ -149,8 +130,30 @@ export async function toggleServer({ get, profileDir, store }, { name, enabled,
   }
 
   /*
-   * No live row answered. Either the server is only an insert item we have not
-   * reconciled yet, or it is not mounted here at all.
+   * No live row answered. Unmounting a row WE created takes our own row back out
+   * rather than leaving a `disabled: true` override in the user's composition
+   * forever: removing the `- insert:` item returns the file to exactly the bytes
+   * it had before we mounted anything.
+   *
+   * This runs AFTER the Loader path, not before it. It used to run first, and
+   * that was a real bug: a mounted row we once created is also a live Loader
+   * entry, so the switch deleted the YAML row (a file edit that needs a reload)
+   * instead of disposing the running instance hot. Worse, because the removal
+   * appends the block back on re-enable, toggling a row MOVED it to the end of
+   * cordis.patch.yml — the user's file lost its authored ordering. The Loader is
+   * now always asked first; only a row the Loader cannot address is removed from
+   * the patch layer.
+   */
+  if (!enabled && ownedByUs(store, rowName)) {
+    const removed = removeDshPatchServer({ serverName: rowName, store, profileDir });
+    if (removed.ok && removed.changed) {
+      return { ok: true, changed: true, enabled: false, via: 'patch', restartRequired: false, target: removed.path, unmounted: true };
+    }
+  }
+
+  /*
+   * Either the server is only an insert item we have not reconciled yet, or it
+   * is not mounted here at all.
    */
   const pending = readDshPatchServers(profileDir).find((item) => item.name === rowName);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oh-agent/dsh-mcp-manager",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "One settings page for every MCP server on your machine: scan each AI tool's own config file, see which directory holds which server, probe whether it really starts, tell you whether it actually loaded in DeepSeek Harness with a retry button, and mount or unmount it without ever editing the other tools' files. / 一个设置页管理本机所有 AI 开发工具的 MCP：按配置文件分组展示、真连探活、明确显示在 DeepSeek Harness 里是否真正加载成功并可重试，只在 Harness 内挂载/卸载，绝不改动其他工具的配置。",
   "license": "MIT",
   "type": "module",