@sunshaobei/dsh-mcp-manager 0.4.0 → 0.6.1

package/lib/index.js

@@ -590,132 +590,138 @@ var init_sources = __esm({
   }
 });
 
-// lib/shared/placement-math.js
-function clampZIndexBase(value, dflt) {
-  if (typeof value !== "number" || !Number.isFinite(value))
-    return dflt;
-  return Math.min(Z_INDEX_BASE_MAX, Math.max(Z_INDEX_BASE_MIN, Math.round(value)));
+// lib/server/config/normalize.js
+function assertReconnectDelay(value, path) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > MAX_TIMER_DELAY_MS) {
+    throw new Error(`${path} must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);
+  }
 }
-function panelTopForAnchor(anchor, pillTop, pillBottom, panelHeight, gap) {
-  return anchor === "bottom" ? Math.max(6, pillTop - panelHeight - gap) : Math.max(6, pillBottom + gap);
+function assertReconnectRelation(out) {
+  const initialDelayMs = out.initialDelayMs ?? RECONNECT_DEFAULTS.initialDelayMs;
+  const maxDelayMs = out.maxDelayMs ?? RECONNECT_DEFAULTS.maxDelayMs;
+  if (initialDelayMs > maxDelayMs) {
+    throw new Error("reconnect.initialDelayMs must be less than or equal to maxDelayMs");
+  }
+  const { maxAttempts } = out;
+  if (maxAttempts !== void 0 && (typeof maxAttempts !== "number" || !Number.isInteger(maxAttempts) || maxAttempts < 1)) {
+    throw new Error("reconnect.maxAttempts must be a positive integer");
+  }
 }
-var DEFAULT_Z_INDEX_BASE, Z_INDEX_BASE_MIN, Z_INDEX_BASE_MAX;
-var init_placement_math = __esm({
-  "lib/shared/placement-math.js"() {
-    "use strict";
-    DEFAULT_Z_INDEX_BASE = 10;
-    Z_INDEX_BASE_MIN = 1;
-    Z_INDEX_BASE_MAX = 9e3;
+function normalizeReconnect(raw) {
+  if (raw === void 0 || raw === null)
+    return {};
+  if (typeof raw !== "object" || Array.isArray(raw))
+    throw new Error("reconnect must be an object");
+  const out = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (RECONNECT_KEYS.has(key))
+      out[key] = value;
   }
-});
-
-// lib/shared/status.js
-var SERVER_STATES, EMPTY_STATUS_COUNTS;
-var init_status = __esm({
-  "lib/shared/status.js"() {
-    "use strict";
-    SERVER_STATES = {
-      connected: "connected",
-      connecting: "connecting",
-      reconnecting: "reconnecting",
-      disabled: "disabled",
-      stopped: "stopped",
-      failed: "failed"
-    };
-    EMPTY_STATUS_COUNTS = {
-      connected: 0,
-      connecting: 0,
-      reconnecting: 0,
-      disabled: 0,
-      stopped: 0,
-      failed: 0
-    };
+  assertReconnectFields(out);
+  return out;
+}
+function assertReconnectFields(out) {
+  if (out.initialDelayMs !== void 0)
+    assertReconnectDelay(out.initialDelayMs, "reconnect.initialDelayMs");
+  if (out.maxDelayMs !== void 0)
+    assertReconnectDelay(out.maxDelayMs, "reconnect.maxDelayMs");
+  if (out.enabled !== void 0 && typeof out.enabled !== "boolean") {
+    throw new Error("reconnect.enabled must be a boolean");
   }
-});
-
-// lib/shared/frames.js
-var SSE_FRAMES;
-var init_frames = __esm({
-  "lib/shared/frames.js"() {
-    "use strict";
-    SSE_FRAMES = {
-      summary: "summary",
-      uiConfigChanged: "ui-config-changed",
-      ping: "ping"
-    };
+  assertReconnectRelation(out);
+}
+function assertTransportRequired(src, transport) {
+  if (transport === "stdio") {
+    if (typeof src.command !== "string" || src.command.trim() === "") {
+      throw new Error("stdio server requires a command");
+    }
+    return;
   }
-});
-
-// lib/shared/routes.js
-var ROUTES, ROUTE_FENCE;
-var init_routes = __esm({
-  "lib/shared/routes.js"() {
-    "use strict";
-    ROUTES = {
-      servers: "/api/dsh-mcp/servers",
-      config: "/api/dsh-mcp/config",
-      session: "/api/dsh-mcp/session",
-      resume: "/api/dsh-mcp/resume",
-      connect: "/api/dsh-mcp/servers/connect",
-      disconnect: "/api/dsh-mcp/servers/disconnect",
-      reconnect: "/api/dsh-mcp/servers/reconnect",
-      importJson: "/api/dsh-mcp/import/json",
-      sources: "/api/dsh-mcp/sources",
-      sourceSave: "/api/dsh-mcp/sources/save",
-      sourceActivate: "/api/dsh-mcp/sources/activate",
-      events: "/api/dsh-mcp/events",
-      health: "/api/dsh-mcp/health",
-      toolDisable: "/api/dsh-mcp/tool-disable"
-    };
-    ROUTE_FENCE = {
-      servers: { guarded: ["GET", "POST", "PATCH", "DELETE"], loopbackExempt: [] },
-      config: { guarded: ["POST"], loopbackExempt: ["GET"] },
-      session: { guarded: ["POST"], loopbackExempt: [] },
-      resume: { guarded: ["POST"], loopbackExempt: [] },
-      connect: { guarded: ["POST"], loopbackExempt: [] },
-      disconnect: { guarded: ["POST"], loopbackExempt: [] },
-      reconnect: { guarded: ["POST"], loopbackExempt: [] },
-      importJson: { guarded: ["POST"], loopbackExempt: [] },
-      sources: { guarded: ["GET", "POST"], loopbackExempt: [] },
-      sourceSave: { guarded: ["POST"], loopbackExempt: [] },
-      sourceActivate: { guarded: ["POST"], loopbackExempt: [] },
-      events: { guarded: ["GET"], loopbackExempt: [] },
-      health: { guarded: ["GET"], loopbackExempt: [] },
-      toolDisable: { guarded: ["PATCH"], loopbackExempt: [] }
-    };
+  if (typeof src.url !== "string" || src.url.trim() === "") {
+    throw new Error("streamable-http server requires a url");
   }
-});
-
-// lib/shared/constants.js
-var SCOPE_GLOBAL, SCOPE_PROJECT, MIDDLEWARE_GLOBAL_ROOT, MCP_MANAGER_BUNDLE_PACKAGE, MCP_MANAGER_ROW_ID, MCP_MANAGER_SETTINGS_NAMESPACE, MCP_MANAGER_IDENTITY;
-var init_constants2 = __esm({
-  "lib/shared/constants.js"() {
-    "use strict";
-    SCOPE_GLOBAL = "global";
-    SCOPE_PROJECT = "project";
-    MIDDLEWARE_GLOBAL_ROOT = "@global";
-    MCP_MANAGER_BUNDLE_PACKAGE = "dsh-mcp-manager";
-    MCP_MANAGER_ROW_ID = "dsh-mcp-manager";
-    MCP_MANAGER_SETTINGS_NAMESPACE = "dsh-mcp-manager";
-    MCP_MANAGER_IDENTITY = Object.freeze({
-      bundlePackage: MCP_MANAGER_BUNDLE_PACKAGE,
-      rowId: MCP_MANAGER_ROW_ID,
-      settingsNamespace: MCP_MANAGER_SETTINGS_NAMESPACE,
-      rowConfigKey: `${MCP_MANAGER_BUNDLE_PACKAGE}#${MCP_MANAGER_ROW_ID}`
-    });
+  let parsed;
+  try {
+    parsed = new URL(src.url);
+  } catch {
+    throw new Error(`invalid url: ${src.url}`);
   }
-});
-
-// lib/shared/interface.js
-var init_interface2 = __esm({
-  "lib/shared/interface.js"() {
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`unsupported protocol: ${parsed.protocol}//`);
+  }
+}
+function applyTransportFields(server, src, transport) {
+  if (transport === "stdio") {
+    server.command = src.command;
+    if (Array.isArray(src.args))
+      server.args = src.args.map(String);
+    if (typeof src.cwd === "string" && src.cwd !== "")
+      server.cwd = src.cwd;
+    if (typeof src.env === "object" && src.env !== null) {
+      server.env = Object.fromEntries(Object.entries(src.env).map(([key, value]) => [
+        key,
+        String(value)
+      ]));
+    }
+    return;
+  }
+  server.url = src.url;
+  if (typeof src.headers === "object" && src.headers !== null) {
+    server.headers = Object.fromEntries(Object.entries(src.headers).map(([key, value]) => [
+      key,
+      String(value)
+    ]));
+  }
+}
+function normalizeToolCallTimeoutMs(value) {
+  return typeof value === "number" && value > 0 ? Math.floor(value) : DEFAULT_TOOL_CALL_TIMEOUT_MS;
+}
+function normalizeDescription(value) {
+  if (typeof value !== "string")
+    return void 0;
+  const trimmed = value.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function normalizeServer(input) {
+  if (typeof input !== "object" || input === null)
+    throw new Error("server config must be an object");
+  const src = input;
+  const name2 = String(src.name ?? "").trim();
+  if (!SERVER_NAME_PATTERN.test(name2)) {
+    throw new Error(`server name must match ${SERVER_NAME_PATTERN.source}`);
+  }
+  const transport = src.transport === "streamable-http" ? "streamable-http" : src.transport === "stdio" ? "stdio" : void 0;
+  if (transport === void 0)
+    throw new Error('transport must be "stdio" or "streamable-http"');
+  assertTransportRequired(src, transport);
+  const server = {
+    name: name2,
+    transport,
+    enabled: src.enabled !== false,
+    toolCallTimeoutMs: normalizeToolCallTimeoutMs(src.toolCallTimeoutMs),
+    reconnect: normalizeReconnect(src.reconnect),
+    // 能力目录的自定义描述（用户手写；MCP 协议无服务器级自描述，完整保留不截断）。
+    description: normalizeDescription(src.description)
+  };
+  if (typeof src.source === "string" && /^[a-z-]+$/.test(src.source)) {
+    server.source = src.source;
+  }
+  applyTransportFields(server, src, transport);
+  return server;
+}
+var RECONNECT_KEYS, MAX_TIMER_DELAY_MS, RECONNECT_DEFAULTS;
+var init_normalize = __esm({
+  "lib/server/config/normalize.js"() {
     "use strict";
-    init_placement_math();
-    init_placement_math();
-    init_status();
-    init_frames();
-    init_routes();
-    init_constants2();
+    init_interface();
+    RECONNECT_KEYS = /* @__PURE__ */ new Set(["enabled", "initialDelayMs", "maxDelayMs", "maxAttempts"]);
+    MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+    RECONNECT_DEFAULTS = {
+      enabled: true,
+      initialDelayMs: 500,
+      maxDelayMs: 3e4,
+      maxAttempts: 10
+    };
   }
 });
 
@@ -725,7 +731,7 @@ __export(sources_sync_exports, {
   collectParsedSources: () => collectParsedSources,
   syncSourcesIntoManager: () => syncSourcesIntoManager
 });
-import { dirname as dirname5, join as join5 } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 function collectParsedSources(projectRoot) {
   return SOURCE_IDS.map((id) => {
     const path = sourcePath(id, projectRoot);
@@ -735,10 +741,15 @@ function collectParsedSources(projectRoot) {
 async function syncSourcesIntoManager(manager, projectRoot, activate = /* @__PURE__ */ new Map()) {
   const parsed = collectParsedSources(projectRoot);
   const effective = resolveEffective(parsed, activate);
+  for (const [name2, item] of effective) {
+    if (sourceScope(item.source) !== (projectRoot === void 0 ? "global" : "project"))
+      effective.delete(name2);
+  }
   const summary = { effective: [], removed: [], warnings: [] };
   let projectStore;
   try {
-    projectStore = await manager.projectStoreOrThrow();
+    if (projectRoot !== void 0)
+      projectStore = await manager.projectStoreOrThrow();
   } catch {
     summary.warnings.push("无项目会话：项目来源本轮未落运行面（连接项目会话后重试）");
   }
@@ -750,36 +761,24 @@ async function syncSourcesIntoManager(manager, projectRoot, activate = /* @__PUR
       continue;
     }
     try {
-      item.config.source = item.source;
+      item.config = normalizeServer({ ...item.config, source: item.source });
       const existing = store.find(name2);
       if (existing === void 0) {
         await manager.add(item.config, scope);
-      } else if (JSON.stringify(existing) !== JSON.stringify(item.config)) {
-        await manager.update(name2, item.config, scope);
+      } else {
+        const merged = {
+          ...item.config,
+          ...existing.enabled !== void 0 ? { enabled: existing.enabled } : {}
+        };
+        if (!isDeepStrictEqual(existing, merged)) {
+          await manager.update(name2, merged, scope);
+        }
       }
       summary.effective.push({ name: name2, source: item.source, scope, shadowed: item.shadowed });
     } catch (error) {
       summary.warnings.push(`${name2}（${item.source}）落运行面失败：${error instanceof Error ? error.message : String(error)}`);
     }
   }
-  for (const [name2, item] of effective) {
-    const winnerScope = sourceScope(item.source);
-    for (const loserScope of ["global", "project"]) {
-      if (loserScope === winnerScope)
-        continue;
-      const store = loserScope === "global" ? manager.store : projectStore;
-      if (store === void 0)
-        continue;
-      if (store.find(name2) === void 0)
-        continue;
-      try {
-        await manager.remove(name2, loserScope);
-      } catch {
-      }
-      store.remove(name2);
-      summary.removed.push({ name: name2, scope: loserScope });
-    }
-  }
   const staleSweep = async (store, scope) => {
     for (const server of [...store.data.servers]) {
       if (effective.has(server.name))
@@ -792,18 +791,50 @@ async function syncSourcesIntoManager(manager, projectRoot, activate = /* @__PUR
       summary.removed.push({ name: server.name, scope });
     }
   };
-  await staleSweep(manager.store, "global");
+  if (projectRoot === void 0)
+    await staleSweep(manager.store, "global");
   if (projectStore !== void 0)
     await staleSweep(projectStore, "project");
   try {
-    const { configFile: configFile2, projectConfigFile: projectConfigFile2, writeFileAtomic: writeFileAtomic2 } = await Promise.resolve().then(() => (init_interface(), interface_exports));
-    const globalServers = [...effective.values()].filter((item) => sourceScope(item.source) === "global").map((item) => item.config);
-    await writeFileAtomic2(configFile2(), `${JSON.stringify({ version: 1, servers: globalServers }, null, 2)}
-`);
+    const globalNames = new Set([...effective.values()].filter((i) => sourceScope(i.source) === "global").map((i) => i.config.name));
+    const projectNames = /* @__PURE__ */ new Set();
+    try {
+      const current = projectStore ?? await manager.projectStoreOrThrow();
+      for (const server of current.data.servers)
+        projectNames.add(server.name);
+    } catch {
+    }
+    if (projectRoot === void 0 && manager.sweepOrphanUserDisabled !== void 0) {
+      await manager.sweepOrphanUserDisabled(globalNames, projectNames);
+    }
+  } catch (error) {
+    summary.warnings.push(`孤儿禁用痕清扫失败：${error instanceof Error ? error.message : String(error)}`);
+  }
+  try {
+    const { readTextFile: readTextFile2, writeFileAtomic: writeFileAtomic2 } = await Promise.resolve().then(() => (init_interface(), interface_exports));
+    const writeIfChanged = async (path, servers) => {
+      const text = `${JSON.stringify({ version: 1, servers }, null, 2)}
+`;
+      const previous = await readTextFile2(path);
+      if (previous !== null) {
+        try {
+          if (isDeepStrictEqual(JSON.parse(previous), JSON.parse(text)))
+            return;
+        } catch {
+        }
+      }
+      await writeFileAtomic2(path, text);
+    };
+    const withRuntimeEnabled = (config, store) => {
+      const cur = store.find(String(config.name));
+      return cur?.enabled !== void 0 ? { ...config, enabled: cur.enabled } : config;
+    };
+    const globalServers = [...effective.values()].filter((item) => sourceScope(item.source) === "global").map((item) => withRuntimeEnabled(item.config, manager.store));
+    if (projectRoot === void 0)
+      await writeIfChanged(manager.store.path, globalServers);
     if (projectRoot !== void 0 && projectStore !== void 0) {
-      const projectServers = [...effective.values()].filter((item) => sourceScope(item.source) === "project").map((item) => item.config);
-      await writeFileAtomic2(projectConfigFile2(projectRoot), `${JSON.stringify({ version: 1, servers: projectServers }, null, 2)}
-`);
+      const projectServers = [...effective.values()].filter((item) => sourceScope(item.source) === "project").map((item) => withRuntimeEnabled(item.config, projectStore));
+      await writeIfChanged(projectStore.path, projectServers);
     }
   } catch (error) {
     summary.warnings.push(`生效配置回写失败：${error instanceof Error ? error.message : String(error)}`);
@@ -813,89 +844,13 @@ async function syncSourcesIntoManager(manager, projectRoot, activate = /* @__PUR
   } catch (error) {
     summary.warnings.push(`refreshFromDisk 失败：${error instanceof Error ? error.message : String(error)}`);
   }
-  try {
-    const { appendFileSync, mkdirSync: mkdirSync3 } = await import("node:fs");
-    const { homedir: homedir3 } = await import("node:os");
-    const logPath = join5(homedir3(), ".dsh", "dsh-mcp-manager", "sync-debug.log");
-    mkdirSync3(dirname5(logPath), { recursive: true });
-    const stamp = (/* @__PURE__ */ new Date()).toISOString();
-    const lines = [
-      `[${stamp}] projectRoot=${projectRoot ?? "(none)"}`,
-      ...parsed.map((p2) => `  parse ${p2.id}: exists=${p2.exists} servers=[${p2.servers.map((s2) => s2.name).join(",")}]${p2.error ? ` ERROR=${p2.error}` : ""}`),
-      ...summary.effective.map((e2) => `  effective ${e2.name} <- ${e2.source} (shadowed: ${e2.shadowed.join(",") || "-"})`),
-      ...summary.removed.map((r2) => `  removed ${r2.name} @ ${r2.scope}`),
-      ...summary.warnings.map((w2) => `  WARN ${w2}`)
-    ];
-    appendFileSync(logPath, lines.join("\n") + "\n");
-  } catch {
-  }
   return summary;
 }
 var init_sources_sync = __esm({
   "lib/server/config/sources-sync.js"() {
     "use strict";
     init_sources();
-  }
-});
-
-// lib/server/workspace/impl/root-resolution/index.js
-var root_resolution_exports = {};
-__export(root_resolution_exports, {
-  findProjectRoot: () => findProjectRoot,
-  makeResolveRoot: () => makeResolveRoot,
-  normalizedProjectRoot: () => normalizedProjectRoot
-});
-import { existsSync as existsSync3, realpathSync } from "node:fs";
-import { dirname as dirname6, join as join6, resolve } from "node:path";
-function dshHomePath() {
-  return resolve(dshHome());
-}
-async function findProjectRoot(cwd) {
-  const home = dshHomePath();
-  let current = resolve(cwd ?? process.cwd());
-  for (let depth = 0; depth < 16; depth += 1) {
-    const dotDsh = join6(current, ".dsh");
-    const hasProjectDsh = existsSync3(dotDsh) && resolve(dotDsh) !== home;
-    if (existsSync3(join6(current, ".git")) || hasProjectDsh || existsSync3(join6(current, ".mcp.json"))) {
-      return current;
-    }
-    const parent = dirname6(current);
-    if (parent === current)
-      break;
-    current = parent;
-  }
-  return resolve(cwd ?? process.cwd());
-}
-async function normalizedProjectRoot(cwd) {
-  if (cwd === void 0 || cwd === null || cwd === "")
-    return void 0;
-  const root = await findProjectRoot(cwd);
-  try {
-    return realpathSync(root);
-  } catch {
-    return root;
-  }
-}
-function makeResolveRoot(manager) {
-  return async (agent) => {
-    if (typeof agent !== "object" || agent === null)
-      return void 0;
-    const session = agent.session;
-    const cwd = session?.header?.cwd;
-    const root = await normalizedProjectRoot(typeof cwd === "string" ? cwd : void 0);
-    if (root !== void 0)
-      return root;
-    const globalServers = (await manager.projectServersFor(MIDDLEWARE_GLOBAL_ROOT) ?? []).filter((server) => server.enabled !== false);
-    if (globalServers.length > 0)
-      return MIDDLEWARE_GLOBAL_ROOT;
-    return void 0;
-  };
-}
-var init_root_resolution = __esm({
-  "lib/server/workspace/impl/root-resolution/index.js"() {
-    "use strict";
-    init_dsh_home();
-    init_interface2();
+    init_normalize();
   }
 });
 
@@ -1924,8 +1879,9 @@ var require_lib2 = __commonJS({
 });
 
 // lib/index.js
+init_sources_sync();
 init_sources();
-import { dirname as dirname13 } from "node:path";
+import { dirname as dirname12 } from "node:path";
 
 // lib/vendor/shared/settings-namespace.js
 function isUnloading(ctx) {
@@ -2315,11 +2271,98 @@ var OrchestratorPorts = class {
 var orchestratorPorts = new OrchestratorPorts();
 
 // lib/server/connection/orchestrator/manager.js
-init_interface2();
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { mkdir as mkdir2, rename as rename2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
 import { existsSync as existsSync2 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
+
+// lib/shared/placement-math.js
+var DEFAULT_Z_INDEX_BASE = 10;
+var Z_INDEX_BASE_MIN = 1;
+var Z_INDEX_BASE_MAX = 9e3;
+function clampZIndexBase(value, dflt) {
+  if (typeof value !== "number" || !Number.isFinite(value))
+    return dflt;
+  return Math.min(Z_INDEX_BASE_MAX, Math.max(Z_INDEX_BASE_MIN, Math.round(value)));
+}
+function panelTopForAnchor(anchor, pillTop, pillBottom, panelHeight, gap) {
+  return anchor === "bottom" ? Math.max(6, pillTop - panelHeight - gap) : Math.max(6, pillBottom + gap);
+}
+
+// lib/shared/status.js
+var SERVER_STATES = {
+  connected: "connected",
+  connecting: "connecting",
+  reconnecting: "reconnecting",
+  disabled: "disabled",
+  stopped: "stopped",
+  failed: "failed"
+};
+var EMPTY_STATUS_COUNTS = {
+  connected: 0,
+  connecting: 0,
+  reconnecting: 0,
+  disabled: 0,
+  stopped: 0,
+  failed: 0
+};
+
+// lib/shared/frames.js
+var SSE_FRAMES = {
+  summary: "summary",
+  uiConfigChanged: "ui-config-changed",
+  ping: "ping"
+};
+
+// lib/shared/routes.js
+var ROUTES = {
+  servers: "/api/dsh-mcp/servers",
+  config: "/api/dsh-mcp/config",
+  session: "/api/dsh-mcp/session",
+  resume: "/api/dsh-mcp/resume",
+  connect: "/api/dsh-mcp/servers/connect",
+  disconnect: "/api/dsh-mcp/servers/disconnect",
+  reconnect: "/api/dsh-mcp/servers/reconnect",
+  importJson: "/api/dsh-mcp/import/json",
+  sources: "/api/dsh-mcp/sources",
+  sourceSave: "/api/dsh-mcp/sources/save",
+  sourceActivate: "/api/dsh-mcp/sources/activate",
+  events: "/api/dsh-mcp/events",
+  health: "/api/dsh-mcp/health",
+  toolDisable: "/api/dsh-mcp/tool-disable"
+};
+var ROUTE_FENCE = {
+  servers: { guarded: ["GET", "POST", "PATCH", "DELETE"], loopbackExempt: [] },
+  config: { guarded: ["POST"], loopbackExempt: ["GET"] },
+  session: { guarded: ["POST"], loopbackExempt: [] },
+  resume: { guarded: ["POST"], loopbackExempt: [] },
+  connect: { guarded: ["POST"], loopbackExempt: [] },
+  disconnect: { guarded: ["POST"], loopbackExempt: [] },
+  reconnect: { guarded: ["POST"], loopbackExempt: [] },
+  importJson: { guarded: ["POST"], loopbackExempt: [] },
+  sources: { guarded: ["GET", "POST"], loopbackExempt: [] },
+  sourceSave: { guarded: ["POST"], loopbackExempt: [] },
+  sourceActivate: { guarded: ["POST"], loopbackExempt: [] },
+  events: { guarded: ["GET"], loopbackExempt: [] },
+  health: { guarded: ["GET"], loopbackExempt: [] },
+  toolDisable: { guarded: ["PATCH"], loopbackExempt: [] }
+};
+
+// lib/shared/constants.js
+var SCOPE_GLOBAL = "global";
+var SCOPE_PROJECT = "project";
+var MIDDLEWARE_GLOBAL_ROOT = "@global";
+var MCP_MANAGER_BUNDLE_PACKAGE = "dsh-mcp-manager";
+var MCP_MANAGER_ROW_ID = "dsh-mcp-manager";
+var MCP_MANAGER_SETTINGS_NAMESPACE = "dsh-mcp-manager";
+var MCP_MANAGER_IDENTITY = Object.freeze({
+  bundlePackage: MCP_MANAGER_BUNDLE_PACKAGE,
+  rowId: MCP_MANAGER_ROW_ID,
+  settingsNamespace: MCP_MANAGER_SETTINGS_NAMESPACE,
+  rowConfigKey: `${MCP_MANAGER_BUNDLE_PACKAGE}#${MCP_MANAGER_ROW_ID}`
+});
+
+// lib/server/connection/orchestrator/manager.js
 init_interface();
 function isPlainRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -2455,6 +2498,8 @@ function projectBaseFieldsForSummary(server) {
     name: server.name,
     transport: server.transport
   };
+  if (server.source !== void 0)
+    projected.source = server.source;
   if (server.enabled !== void 0)
     projected.enabled = server.enabled;
   if (server.toolCallTimeoutMs !== void 0)
@@ -2537,11 +2582,13 @@ function touchUnitInBackground(middleware, target, onFail) {
       middleware.evictIfNeeded();
   }, (error) => onFail(error));
 }
-function releaseUndesiredConnections(middleware, desired) {
+function releaseUndesiredConnections(middleware, desired, projectRoot) {
   if (middleware === void 0)
     return false;
   let released = false;
   for (const unit of [...middleware.units.values()]) {
+    if (unit.root !== MIDDLEWARE_GLOBAL_ROOT && unit.root !== projectRoot)
+      continue;
     for (const serverName of [...unit.connections.keys()]) {
       const want = desired.get(`${unit.root}\0${serverName}`);
       if (want !== void 0 && want.server.enabled !== false)
@@ -2561,7 +2608,7 @@ function touchRootFor(scope, projectRoot) {
   return scope === SCOPE_PROJECT ? projectRoot : MIDDLEWARE_GLOBAL_ROOT;
 }
 function syncPool(middleware, desired, projectRoot, start) {
-  let changed = releaseUndesiredConnections(middleware, desired);
+  let changed = releaseUndesiredConnections(middleware, desired, projectRoot);
   for (const want of desired.values()) {
     if (want.server.enabled === false)
       continue;
@@ -2828,7 +2875,10 @@ var McpManager = class {
   getRedactionServers() {
     const { configModel } = orchestratorPorts.get();
     const servers = this.store.data.servers.map((server) => configModel.expandServerEnv(server));
-    for (const store of this.projectStores.values()) {
+    const cachedStores = new Set(this.projectStores.values());
+    if (this.projectStore !== void 0)
+      cachedStores.add(this.projectStore);
+    for (const store of cachedStores) {
       for (const server of store.data.servers)
         servers.push(configModel.expandServerEnv(server));
     }
@@ -2876,7 +2926,10 @@ var McpManager = class {
    */
   async projectServersFor(root) {
     if (root === MIDDLEWARE_GLOBAL_ROOT) {
-      const servers = [...this.store.data.servers];
+      const servers = this.store.data.servers.map((server) => ({
+        ...server,
+        enabled: server.enabled !== false || [...this.disabledByRoot.values()].some((flags) => flags.has(`@global-enabled/${server.name}`))
+      }));
       for (const server of this.runtimeRegistry.values())
         servers.push(server);
       return servers;
@@ -2925,7 +2978,8 @@ var McpManager = class {
       catalogCachePath: (root) => this.catalogCachePathFor(root),
       isGlobalServer: (name2) => this.isGlobalServer(name2),
       isRuntimeServer: (name2) => this.isRuntimeServer(name2),
-      recordCatalogTools: (name2, tools) => this.recordCatalogTools(name2, tools)
+      recordCatalogTools: (name2, tools) => this.recordCatalogTools(name2, tools),
+      serverEnabledFor: (root, target, name2) => target !== MIDDLEWARE_GLOBAL_ROOT || this.globalEnabledFor(root, name2)
     });
     try {
       this.disabledByRoot = await configStore.loadUserState(this.userStatePath);
@@ -2942,6 +2996,48 @@ var McpManager = class {
   }
   /** userDisabled 映射（root → Set<server>），中间层单元创建时合并。 */
   disabledByRoot = /* @__PURE__ */ new Map();
+  /** Workspace-local switches for shared global transports (stored with the existing root state). */
+  globalEnabledFor(root, name2) {
+    const flags = this.middleware?.units.get(root)?.userDisabled ?? this.disabledByRoot.get(root);
+    if (flags?.has(`@global-enabled/${name2}`))
+      return true;
+    if (flags?.has(`@global/${name2}`))
+      return false;
+    return (this.runtimeRegistry.get(name2) ?? this.store.find(name2))?.enabled !== false;
+  }
+  async setGlobalEnabled(name2, enabled) {
+    const server = this.store.find(name2) ?? this.runtimeRegistry.get(name2);
+    if (server === void 0)
+      throw new Error(`server "${name2}" not found in global scope`);
+    const root = this.projectRoot ?? MIDDLEWARE_GLOBAL_ROOT;
+    const mw = this.middleware;
+    const flags = mw?.units.get(root)?.userDisabled ?? new Set(this.disabledByRoot.get(root));
+    flags.delete(`@global/${name2}`);
+    flags.delete(`@global-enabled/${name2}`);
+    flags.add(`${enabled ? "@global-enabled" : "@global"}/${name2}`);
+    this.disabledByRoot.set(root, flags);
+    if (mw !== void 0) {
+      if (enabled)
+        mw.units.get(MIDDLEWARE_GLOBAL_ROOT)?.userDisabled.delete(name2);
+      const units = new Map(mw.units);
+      for (const [savedRoot, savedFlags] of this.disabledByRoot) {
+        if (!units.has(savedRoot))
+          units.set(savedRoot, {
+            root: savedRoot,
+            userDisabled: savedFlags,
+            connections: /* @__PURE__ */ new Map(),
+            inFlight: /* @__PURE__ */ new Map(),
+            lastTouchedAt: Date.now()
+          });
+      }
+      units.set(root, { root, userDisabled: flags, connections: /* @__PURE__ */ new Map(), inFlight: /* @__PURE__ */ new Map(), lastTouchedAt: Date.now() });
+      await this.saveUserState(units);
+      if (enabled)
+        this.touchGlobalUnit(name2);
+    }
+    this.emitStatus();
+    return { ...server, enabled };
+  }
   /** 工具级禁用（root → server → Set<tool>）；root=@global 跨工作空间共享。 */
   disabledTools = /* @__PURE__ */ new Map();
   /**
@@ -2977,24 +3073,31 @@ var McpManager = class {
   async projectStoreFor(root) {
     if (typeof root !== "string" || root === "")
       return void 0;
-    const { configStore, upgrade } = orchestratorPorts.get();
-    let store = this.projectStores.get(root);
+    const store = this.projectStores.get(root);
     if (store === void 0) {
+      const pending = this.projectStoreLoads.get(root);
+      if (pending !== void 0)
+        return pending;
+      const load = this.loadProjectStore(root);
+      this.projectStoreLoads.set(root, load);
+      try {
+        return await load;
+      } finally {
+        this.projectStoreLoads.delete(root);
+      }
+    }
+    return store;
+  }
+  async loadProjectStore(root) {
+    const { configStore, upgrade } = orchestratorPorts.get();
+    let store;
+    {
       store = await upgrade.withSettledProjectConfig(root, this.logger, async (settledPath) => {
         const fresh = new configStore.McpStore(settledPath);
         await fresh.load();
         return fresh;
       });
       this.projectStores.set(root, store);
-    } else {
-      const cached = store;
-      try {
-        await upgrade.withSettledProjectConfig(root, this.logger, async () => {
-          await cached.reloadIfChanged();
-        });
-      } catch (error) {
-        this.logger.warn(`dsh-mcp-manager: reload project config failed: ${this.redactError(error)}`);
-      }
     }
     return store;
   }
@@ -3020,10 +3123,16 @@ var McpManager = class {
    */
   async catalogServersFor(cwd) {
     const servers = /* @__PURE__ */ new Map();
-    collectCatalogServers(servers, this.store.data.servers.map(serverEntry), SCOPE_GLOBAL);
+    const root = await this.workspaceRoot(cwd);
+    collectCatalogServers(servers, this.store.data.servers.map((server) => serverEntry({
+      ...server,
+      enabled: this.globalEnabledFor(root ?? MIDDLEWARE_GLOBAL_ROOT, server.name)
+    })), SCOPE_GLOBAL);
     collectCatalogServers(servers, this.runtimeRegistry, SCOPE_GLOBAL);
-    const { workspace } = orchestratorPorts.get();
-    const root = await projectRootForCwd(cwd, workspace.findProjectRoot);
+    for (const [name2, entry] of servers) {
+      if (entry.scope === SCOPE_GLOBAL && !this.globalEnabledFor(root ?? MIDDLEWARE_GLOBAL_ROOT, name2))
+        servers.delete(name2);
+    }
     if (root === void 0)
       return servers;
     const store = await this.projectStoreFor(root);
@@ -3043,34 +3152,63 @@ var McpManager = class {
   async catalogViewFor(cwd, servers) {
     return this.catalogViewResolver(cwd, servers);
   }
-  /**
-   * 会话切换：只切 currentRoot + fire-and-forget 惰性启动（不 await 任何连接）。
-   * 变更点驱动（#111/#228）：POST /api/dsh-mcp/session 永不挂起——连接/发现
-   * 由中间层惰性驱动（per-root in-flight 去重），此处零连接副作用。
-   * 单池后项目级连接恒由中间层池按 root 常驻，切走不断开。
-   */
+  /** Cached workspace resolution and preparation never wait for a remote MCP server. */
+  workspaceRoots = /* @__PURE__ */ new Map();
+  selectionVersion = 0;
+  touchedRoots = /* @__PURE__ */ new Set();
+  projectStoreLoads = /* @__PURE__ */ new Map();
+  sourceSnapshot;
+  sourcesChanged;
+  prepareWorkspace;
+  workspaceRoot(cwd) {
+    const key = cwd ?? "";
+    let root = this.workspaceRoots.get(key);
+    if (root === void 0) {
+      root = projectRootForCwd(cwd, orchestratorPorts.get().workspace.findProjectRoot);
+      this.workspaceRoots.set(key, root);
+      void root.catch(() => this.workspaceRoots.delete(key));
+    }
+    return root;
+  }
+  /** A request owns its workspace view; asynchronous requests cannot change another request's root. */
+  async forWorkspace(cwd) {
+    const root = await this.workspaceRoot(cwd);
+    const view = Object.create(this);
+    view.projectRoot = root;
+    view.projectStore = root === void 0 ? void 0 : await this.projectStoreFor(root);
+    view.setSession = async () => {
+    };
+    view.emitStatus = this.emitStatus.bind(this);
+    return view;
+  }
+  /** Selection changes pointers only. Source sync/connection checks belong to background preparation. */
   async setSession(cwd) {
-    const { workspace } = orchestratorPorts.get();
-    const root = await projectRootForCwd(cwd, workspace.findProjectRoot);
-    if (root === this.projectRoot && this.projectStore !== void 0)
+    const version = ++this.selectionVersion;
+    const root = await this.workspaceRoot(cwd);
+    if (version !== this.selectionVersion)
       return;
-    if (root === void 0 && this.projectStore === void 0)
+    if (root === this.projectRoot && (root === void 0 || this.projectStore !== void 0))
+      return;
+    const store = root === void 0 ? void 0 : await this.projectStoreFor(root);
+    if (version !== this.selectionVersion)
       return;
     this.projectRoot = root;
-    this.projectStore = void 0;
-    if (root !== void 0) {
-      this.projectStore = await this.projectStoreFor(root);
-    }
-    await reloadStoreQuietly(this.store, (error) => {
-      this.logger.warn(`dsh-mcp-manager: reload global config failed: ${this.redactError(error)}`);
-    });
-    if (this.middleware !== void 0) {
+    this.projectStore = store;
+    this.emitStatus();
+    if (this.prepareWorkspace === void 0 && this.middleware !== void 0) {
       const target = root ?? MIDDLEWARE_GLOBAL_ROOT;
-      touchUnitInBackground(this.middleware, target, (error) => {
-        this.logger.warn(`dsh-mcp-manager: setSession touch unit(${target}) failed: ${this.redactError(error)}`);
-      });
+      if (!this.touchedRoots.has(target)) {
+        this.touchedRoots.add(target);
+        touchUnitInBackground(this.middleware, target, (error) => this.logger.warn(`dsh-mcp-manager: setSession touch unit(${target}) failed: ${this.redactError(error)}`));
+      }
+    }
+    if (this.prepareWorkspace !== void 0) {
+      setTimeout(() => {
+        void this.prepareWorkspace?.(cwd).catch((error) => {
+          this.logger.warn(`dsh-mcp-manager: workspace preparation failed: ${this.redactError(error)}`);
+        });
+      }, 0).unref?.();
     }
-    this.emitStatus();
   }
   /**
    * 切回前台可用性恢复：对本次请求工作空间连接的非强制恢复（对齐 SSE forceReconnect 的
@@ -3128,10 +3266,25 @@ var McpManager = class {
     let configChanged = await reloadStoreQuietly(this.store, (error) => {
       this.logger.warn(`dsh-mcp-manager: reload global config failed: ${this.redactError(error)}`);
     });
-    if (this.projectStore !== void 0) {
-      configChanged = await reloadStoreQuietly(this.projectStore, (error) => {
+    const cachedStores = new Set(this.projectStores.values());
+    if (this.projectStore !== void 0)
+      cachedStores.add(this.projectStore);
+    for (const store of cachedStores) {
+      const cachedRoot = [...this.projectStores].find(([, candidate]) => candidate === store)?.[0];
+      if (cachedRoot !== void 0)
+        await orchestratorPorts.get().upgrade.withSettledProjectConfig(cachedRoot, this.logger, async () => {
+        });
+      const changed = await reloadStoreQuietly(store, (error) => {
         this.logger.warn(`dsh-mcp-manager: reload project config failed: ${this.redactError(error)}`);
-      }) || configChanged;
+      });
+      if (changed) {
+        const root = [...this.projectStores].find(([, candidate]) => candidate === store)?.[0];
+        if (root !== void 0) {
+          const view = await this.forWorkspace(root);
+          view.reconcileServers();
+        }
+        configChanged = true;
+      }
     }
     if (!configChanged)
       return;
@@ -3154,13 +3307,21 @@ var McpManager = class {
       return false;
     this.reconcileBusy = true;
     try {
-      return syncPool(this.middleware, buildDesiredServers(this.store, this.projectStore, this.runtimeRegistry, (scope) => this.poolRootFor(scope)), this.projectRoot, (name2, scope) => this.start(name2, scope));
+      return syncPool(this.middleware, buildDesiredServers(this.transportStore(), this.projectStore, this.runtimeRegistry, (scope) => this.poolRootFor(scope)), this.projectRoot, (name2, scope) => this.start(name2, scope));
     } finally {
       this.reconcileBusy = false;
     }
   }
+  transportStore() {
+    const view = Object.create(this.store);
+    view.data = { ...this.store.data, servers: this.store.data.servers.map((server) => ({
+      ...server,
+      enabled: server.enabled !== false || [...this.disabledByRoot.values()].some((flags) => flags.has(`@global-enabled/${server.name}`))
+    })) };
+    return view;
+  }
   async startAll() {
-    for (const server of this.store.data.servers) {
+    for (const server of this.transportStore().data.servers) {
       if (server.enabled !== false)
         this.start(server.name, SCOPE_GLOBAL);
     }
@@ -3239,16 +3400,17 @@ var McpManager = class {
     });
   }
   /**
-   * 拆除中间层池中该 server 的连接（update/remove 配置变更后强制重建；
-   * 不写 userDisabled——与 disconnect 的禁用语义区分）。此前 update/remove 仅
-   * 处理项目单元，@global 池连接与目录残留导致「已删服务器仍可调用」。
+   * 只拆除目标 (root, server) 的连接与目录，不影响其他工作区的同名服务器。
+   * 不写 userDisabled——配置变更与用户主动断开的语义不同。
    */
-  dropMiddlewareConnection(name2) {
+  dropMiddlewareConnection(name2, root) {
     const mw = this.middleware;
     if (mw === void 0)
       return;
     let dropped = false;
     for (const unit of mw.units.values()) {
+      if (unit.root !== root)
+        continue;
       if (mw.releaseConnection(unit.root, name2))
         dropped = true;
       const { catalogDirectory: catalogDirectory2 } = orchestratorPorts.get().catalog;
@@ -3262,7 +3424,7 @@ var McpManager = class {
         dropped = true;
       }
     }
-    mw.abandonInFlight(name2);
+    mw.abandonInFlight(name2, root);
     if (dropped)
       this.emitStatus();
   }
@@ -3308,7 +3470,7 @@ var McpManager = class {
     const run = this.registerQueue.then(async () => {
       if (this.runtimeRegistry.has(name2)) {
         this.runtimeRegistry.delete(name2);
-        this.dropMiddlewareConnection(name2);
+        this.dropMiddlewareConnection(name2, MIDDLEWARE_GLOBAL_ROOT);
         this.reconcileServers();
       }
     });
@@ -3334,7 +3496,11 @@ var McpManager = class {
   }
   async update(name2, patch, scope = SCOPE_GLOBAL) {
     const { configModel } = orchestratorPorts.get();
+    if (scope !== SCOPE_PROJECT && Object.keys(patch).length === 1 && typeof patch.enabled === "boolean") {
+      return this.setGlobalEnabled(name2, patch.enabled);
+    }
     const store = scope === SCOPE_PROJECT ? await this.projectStoreOrThrow() : this.store;
+    const root = this.poolRootFor(scope);
     const existing = store.find(name2);
     if (existing === void 0)
       throw new Error(`server "${name2}" not found in ${scope} scope`);
@@ -3346,15 +3512,16 @@ var McpManager = class {
     configModel.assertEnvPolicy(merged.env, merged.headers, void 0, merged.url, merged.args);
     store.upsert(merged);
     await store.save();
-    this.dropMiddlewareConnection(name2);
-    if (merged.enabled !== false) {
+    this.dropMiddlewareConnection(name2, root);
+    if ((scope === SCOPE_PROJECT ? merged.enabled : this.transportStore().find(name2)?.enabled) !== false) {
       this.start(name2, scope);
     }
     return merged;
   }
   async remove(name2, scope = SCOPE_GLOBAL) {
     const store = scope === SCOPE_PROJECT ? await this.projectStoreOrThrow() : this.store;
-    this.dropMiddlewareConnection(name2);
+    const root = this.poolRootFor(scope);
+    this.dropMiddlewareConnection(name2, root);
     store.remove(name2);
     await store.save();
   }
@@ -3413,9 +3580,38 @@ var McpManager = class {
     targetUnit.userDisabled.add(name2);
     await this.saveUserState(mw.units);
     mw.releaseConnection(targetUnit.root, name2);
-    mw.abandonInFlight(name2);
+    mw.abandonInFlight(name2, targetUnit.root);
     this.emitStatus();
   }
+  /**
+   * 孤儿禁用痕清扫：userDisabled 里挂着但对应 scope 的生效表已无此名的记录
+   * 一律移除。早期互斥清理经 disconnect 落下的污染痕（同名切走后残留）会让
+   * 之后切回/重启时的 start 静默短路（userDisabled 命中不连），表现为「经常
+   * 连接不全」；生效表已是唯一事实，孤儿痕无语义。
+   */
+  async sweepOrphanUserDisabled(validGlobal, validProject) {
+    const mw = this.middleware;
+    if (mw === void 0)
+      return;
+    let changed = false;
+    for (const unit of mw.units.values()) {
+      if (unit.root !== MIDDLEWARE_GLOBAL_ROOT && unit.root !== this.projectRoot)
+        continue;
+      const valid = unit.root === MIDDLEWARE_GLOBAL_ROOT ? validGlobal : validProject;
+      if (valid.size === 0 && unit.userDisabled.size === 0)
+        continue;
+      for (const name2 of [...unit.userDisabled]) {
+        if (name2.startsWith("@global/") || name2.startsWith("@global-enabled/"))
+          continue;
+        if (!valid.has(name2)) {
+          unit.userDisabled.delete(name2);
+          changed = true;
+        }
+      }
+    }
+    if (changed)
+      await this.saveUserState(mw.units);
+  }
   async reconnect(name2, scope = SCOPE_GLOBAL) {
     await this.disconnect(name2, scope);
     await this.connect(name2, scope);
@@ -3457,7 +3653,13 @@ var McpManager = class {
   }
   summarize(server, scope) {
     const { catalog: catalogPort, pipeline } = orchestratorPorts.get();
+    if (scope !== SCOPE_PROJECT) {
+      server = { ...server, enabled: this.globalEnabledFor(this.projectRoot ?? MIDDLEWARE_GLOBAL_ROOT, server.name) };
+    }
     const base = projectServerForSummary(server, pipeline.maskSecretArgsForDisplay);
+    const workspaceFlags = this.middleware?.units.get(this.projectRoot ?? MIDDLEWARE_GLOBAL_ROOT)?.userDisabled ?? this.disabledByRoot.get(this.projectRoot ?? MIDDLEWARE_GLOBAL_ROOT);
+    if (scope !== SCOPE_PROJECT && workspaceFlags?.has(`@global/${server.name}`))
+      return summarizeAbsent(base, scope, server);
     const unit = this.middlewareUnitFor(server.name, scope);
     const entry = unit?.connections.get(server.name);
     if (unit === void 0 || entry === void 0)
@@ -3665,17 +3867,63 @@ function createSseHub(options) {
   };
 }
 
-// lib/server/api/routes.js
-init_interface2();
-
 // lib/server/api/routes-controllers.js
 init_sources();
 init_sources_sync();
-init_root_resolution();
-init_interface();
-init_interface2();
 import { readFile as readFile2 } from "node:fs/promises";
 
+// lib/server/workspace/impl/root-resolution/index.js
+init_dsh_home();
+import { existsSync as existsSync3, realpathSync } from "node:fs";
+import { dirname as dirname5, join as join5, resolve } from "node:path";
+function dshHomePath() {
+  return resolve(dshHome());
+}
+async function findProjectRoot(cwd) {
+  const home = dshHomePath();
+  let current = resolve(cwd ?? process.cwd());
+  for (let depth = 0; depth < 16; depth += 1) {
+    const dotDsh = join5(current, ".dsh");
+    const hasProjectDsh = existsSync3(dotDsh) && resolve(dotDsh) !== home;
+    if (existsSync3(join5(current, ".git")) || hasProjectDsh || existsSync3(join5(current, ".mcp.json"))) {
+      return current;
+    }
+    const parent = dirname5(current);
+    if (parent === current)
+      break;
+    current = parent;
+  }
+  return resolve(cwd ?? process.cwd());
+}
+async function normalizedProjectRoot(cwd) {
+  if (cwd === void 0 || cwd === null || cwd === "")
+    return void 0;
+  const root = await findProjectRoot(cwd);
+  try {
+    return realpathSync(root);
+  } catch {
+    return root;
+  }
+}
+function makeResolveRoot(manager) {
+  return async (agent) => {
+    if (typeof agent !== "object" || agent === null)
+      return void 0;
+    const session = agent.session;
+    const cwd = session?.header?.cwd;
+    const root = await normalizedProjectRoot(typeof cwd === "string" ? cwd : void 0);
+    if (root !== void 0)
+      return root;
+    const globalServers = (await manager.projectServersFor(MIDDLEWARE_GLOBAL_ROOT) ?? []).filter((server) => server.enabled !== false);
+    if (globalServers.length > 0)
+      return MIDDLEWARE_GLOBAL_ROOT;
+    return void 0;
+  };
+}
+
+// lib/server/api/routes-controllers.js
+init_interface();
+
 // lib/server/api/routes-helpers.js
 function queryParam(url, name2) {
   const value = url.searchParams.get(name2);
@@ -3809,13 +4057,13 @@ function buildServersRoute(manager, helpers) {
           const base = manager.summary();
           const runtimeServers = base.servers ?? [];
           try {
-            const cwd = typeof base.cwd === "string" && base.cwd !== "" ? base.cwd : void 0;
-            const projectRoot = cwd === void 0 ? void 0 : await findProjectRoot(cwd);
-            const parsedSources = SOURCE_IDS.map((sid) => {
+            const projectRoot = typeof base.projectRoot === "string" ? base.projectRoot : void 0;
+            const snapshot = manager.sourceSnapshot?.();
+            const parsedSources = manager.sourceSnapshot !== void 0 ? snapshot?.sources ?? [] : SOURCE_IDS.map((sid) => {
               const p2 = sourcePath(sid, projectRoot);
               return parseSourceEntry(sid, p2, p2 === null ? null : readSourceFile(p2));
             });
-            const prefs = await loadSourcePrefs();
+            const prefs = snapshot?.prefs ?? (manager.sourceSnapshot !== void 0 ? /* @__PURE__ */ new Map() : await loadSourcePrefs());
             const eff = resolveEffective(parsedSources, prefs);
             const declared = [];
             const seen = /* @__PURE__ */ new Set();
@@ -3827,17 +4075,17 @@ function buildServersRoute(manager, helpers) {
                 seen.add(key);
                 const winner = eff.get(server.name);
                 const isActive = winner !== void 0 && winner.source === entry.id;
+                const scope = sourceScope(entry.id);
+                const runtime = runtimeServers.find((r) => r.name === server.name && r.scope === scope && (r.source === entry.id || isActive && r.source === void 0));
+                if (runtime !== void 0)
+                  runtimeServers.splice(runtimeServers.indexOf(runtime), 1);
+                const safe = manager.summarize?.(server, scope) ?? server;
                 if (isActive) {
-                  const runtime = runtimeServers.find((r) => r.name === server.name && r.scope === sourceScope(entry.id));
-                  declared.push({ ...server, source: entry.id, ...runtime ?? { status: "stopped", tools: [] } });
-                  if (runtime !== void 0) {
-                    const idx = runtimeServers.indexOf(runtime);
-                    if (idx >= 0)
-                      runtimeServers.splice(idx, 1);
-                  }
+                  declared.push({ ...safe, ...runtime ?? { status: "stopped", tools: [] }, scope, source: entry.id });
                 } else {
                   declared.push({
-                    ...server,
+                    ...safe,
+                    scope,
                     source: entry.id,
                     enabled: false,
                     status: "stopped",
@@ -3848,6 +4096,14 @@ function buildServersRoute(manager, helpers) {
               }
             }
             base.servers = [...declared, ...runtimeServers];
+            const counts = {};
+            for (const server of base.servers) {
+              if (server.shadowedBy !== void 0)
+                continue;
+              const status = String(server.status ?? "stopped");
+              counts[status] = (counts[status] ?? 0) + 1;
+            }
+            base.counts = counts;
           } catch {
           }
           writeJson(res, 200, base);
@@ -4196,7 +4452,15 @@ function buildSourceSaveRoute(manager, helpers) {
       if (typeof rec.cwd === "string" && rec.cwd !== "")
         await manager.setSession(rec.cwd);
       const prefs = await loadSourcePrefs();
-      const summary = await syncSourcesIntoManager(manager, projectRoot, prefs);
+      const scoped = manager.forWorkspace !== void 0 ? await manager.forWorkspace(cwd ?? manager.projectRoot) : manager;
+      const globalSummary = sourceScope(id) === "global" ? await syncSourcesIntoManager(scoped, void 0, prefs) : void 0;
+      const summary = projectRoot === void 0 ? globalSummary ?? await syncSourcesIntoManager(scoped, void 0, prefs) : await syncSourcesIntoManager(scoped, projectRoot, prefs);
+      if (projectRoot !== void 0 && globalSummary !== void 0) {
+        summary.effective.unshift(...globalSummary.effective);
+        summary.removed.unshift(...globalSummary.removed);
+        summary.warnings.unshift(...globalSummary.warnings);
+      }
+      await manager.sourcesChanged?.();
       writeJson(res, 200, { ok: true, path, ...summary });
     }
   };
@@ -4213,8 +4477,8 @@ function buildSourceActivateRoute(manager, helpers) {
         try {
           const { appendFileSync } = await import("node:fs");
           const { homedir: homedir3 } = await import("node:os");
-          const { join: join9 } = await import("node:path");
-          const p = join9(homedir3(), ".dsh", "dsh-mcp-manager", "sync-debug.log");
+          const { join: join8 } = await import("node:path");
+          const p = join8(homedir3(), ".dsh", "dsh-mcp-manager", "sync-debug.log");
           appendFileSync(p, `[${(/* @__PURE__ */ new Date()).toISOString()}] activate ${line}
 `);
         } catch {
@@ -4252,9 +4516,17 @@ function buildSourceActivateRoute(manager, helpers) {
         const persisted = saveSourcePrefs(prefs);
         if (typeof rec.cwd === "string" && rec.cwd !== "")
           await manager.setSession(rec.cwd);
-        const summary = await syncSourcesIntoManager(manager, projectRoot, prefs);
+        const scoped = manager.forWorkspace !== void 0 ? await manager.forWorkspace(cwd ?? manager.projectRoot) : manager;
+        const globalSummary = sourceScope(id) === "global" ? await syncSourcesIntoManager(scoped, void 0, prefs) : void 0;
+        const summary = projectRoot === void 0 ? globalSummary ?? await syncSourcesIntoManager(scoped, void 0, prefs) : await syncSourcesIntoManager(scoped, projectRoot, prefs);
+        if (projectRoot !== void 0 && globalSummary !== void 0) {
+          summary.effective.unshift(...globalSummary.effective);
+          summary.removed.unshift(...globalSummary.removed);
+          summary.warnings.unshift(...globalSummary.warnings);
+        }
+        await manager.sourcesChanged?.();
         try {
-          await manager.connect(name2, sourceScope(id));
+          await scoped.connect(name2, sourceScope(id));
         } catch (error) {
           await activateTrace(`post-sync connect failed: ${error instanceof Error ? error.message : String(error)}`);
         }
@@ -4269,7 +4541,7 @@ function buildSourceActivateRoute(manager, helpers) {
 }
 
 // lib/server/api/routes.js
-function makeRoutes(manager, _cwd = process.cwd()) {
+function makeRoutes(manager, _cwd = process.cwd(), scoped = false) {
   const handleError = (res, error) => {
     let message;
     try {
@@ -4286,7 +4558,7 @@ function makeRoutes(manager, _cwd = process.cwd()) {
       await manager.setSession(cwdParam);
   };
   const helpers = { handleError, scopeParam, maybeSession };
-  return [
+  const routes = [
     buildConfigRoute(manager, helpers),
     buildServersRoute(manager, helpers),
     buildSessionRoute(manager, helpers),
@@ -4300,6 +4572,25 @@ function makeRoutes(manager, _cwd = process.cwd()) {
     buildSourceActivateRoute(manager, helpers),
     buildToolDisableRoute(manager, helpers)
   ];
+  if (scoped || manager.forWorkspace === void 0)
+    return routes;
+  return routes.map((route, index) => ({ ...route, handler: async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (!url.searchParams.has("cwd") || route.path === ROUTES.session)
+      return route.handler(req, res);
+    const name2 = Object.keys(ROUTES).find((name3) => ROUTES[name3] === route.path);
+    if (name2 !== void 0) {
+      const fence = ROUTE_FENCE[name2];
+      if (!fence.loopbackExempt.includes(req.method ?? "GET") && !guardLoopbackMethod(req, res, fence.guarded))
+        return;
+    }
+    try {
+      const view = await manager.forWorkspace(url.searchParams.get("cwd") ?? "");
+      return await makeRoutes(view, _cwd, true)[index].handler(req, res);
+    } catch (error) {
+      handleError(res, error);
+    }
+  } }));
 }
 function uiConfigChangedFrame() {
   return sseData({ type: SSE_FRAMES.uiConfigChanged });
@@ -4746,14 +5037,13 @@ function resolveCatalogInjection(decision, messages, supervisors, maxEntries = D
 
 // lib/server/catalog/impl/cache-view/index.js
 init_interface();
-init_interface2();
 import { existsSync as existsSync5, statSync } from "node:fs";
 
 // lib/server/catalog/impl/directory/index.js
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { existsSync as existsSync4 } from "node:fs";
 import { mkdir as mkdir3, readFile as readFile3, rename as rename3, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname7 } from "node:path";
+import { dirname as dirname6 } from "node:path";
 init_interface();
 function shortCircuitsFresh(invalidated, entry) {
   return !invalidated && isCatalogFresh(entry);
@@ -4769,7 +5059,7 @@ async function writeDirectoryCacheFile(file, data) {
     await writeFileAtomic(file, data);
     return;
   }
-  const dir = dirname7(file);
+  const dir = dirname6(file);
   if (!existsSync4(dir))
     await mkdir3(dir, { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now().toString(36)}.${randomBytes3(6).toString("hex")}.tmp`;
@@ -5201,7 +5491,6 @@ function makeCatalogViewFor(host) {
 }
 
 // lib/server/catalog/search.js
-init_interface2();
 init_interface();
 function tokenize(text) {
   const lowered = text.toLowerCase();
@@ -5254,7 +5543,7 @@ function scoreTerms(terms, haystack) {
   }
   return { score, matchedTerms };
 }
-function searchCatalog(units, root, query, limit) {
+function searchCatalog(units, root, query, limit, serverEnabled) {
   const { connection: { CATALOG_TTL_MS: CATALOG_TTL_MS2 }, workspace: { fullServerName: fullServerName2 } } = catalogPorts.get();
   if (!units.has(root))
     return { results: [], unavailable: [], truncated: false };
@@ -5265,6 +5554,8 @@ function searchCatalog(units, root, query, limit) {
   const unavailable = [];
   let truncated = false;
   for (const [serverName, catalog] of servers) {
+    if (serverEnabled?.(root, serverName) === false)
+      continue;
     if (catalog.unavailable !== void 0) {
       unavailable.push({ server: fullServerName2(root, serverName), reason: catalog.unavailable });
       continue;
@@ -5294,14 +5585,14 @@ function searchCatalog(units, root, query, limit) {
   }
   return { results, unavailable, truncated };
 }
-function searchCatalogMulti(units, roots, query, limit) {
+function searchCatalogMulti(units, roots, query, limit, serverEnabled) {
   if (roots.length === 1) {
-    return searchCatalog(units, roots[0], query, limit);
+    return searchCatalog(units, roots[0], query, limit, serverEnabled);
   }
   const results = [];
   const unavailable = [];
   for (const root of roots) {
-    const single = searchCatalog(units, root, query, limit);
+    const single = searchCatalog(units, root, query, limit, serverEnabled);
     results.push(...single.results);
     unavailable.push(...single.unavailable);
   }
@@ -5344,7 +5635,7 @@ function resolveListRoots(roots, serverFilter) {
   }
   return void 0;
 }
-function listCatalog(units, roots, serverFilter, toolLimit, emptyHint, disabledTools) {
+function listCatalog(units, roots, serverFilter, toolLimit, emptyHint, disabledTools, serverEnabled) {
   const { workspace: { fullServerName: fullServerName2 } } = catalogPorts.get();
   const safeLimit = safeToolLimit(toolLimit);
   const rootSet = resolveListRoots(roots, serverFilter);
@@ -5361,6 +5652,8 @@ function listCatalog(units, roots, serverFilter, toolLimit, emptyHint, disabledT
     if (rootCatalog === void 0)
       continue;
     for (const [serverName, catalog] of rootCatalog) {
+      if (serverEnabled?.(root, serverName) === false)
+        continue;
       if (!matchesServerFilter(serverName, root, serverFilter, fullServerName2))
         continue;
       const built = buildListServerEntry(serverName, root, catalog, unit.userDisabled, safeLimit, disabledTools, fullServerName2);
@@ -5506,135 +5799,7 @@ __export(interface_exports3, {
   panelTopForAnchor: () => panelTopForAnchor,
   parseClaudeJson: () => parseClaudeJson
 });
-
-// lib/server/config/normalize.js
-init_interface();
-var RECONNECT_KEYS = /* @__PURE__ */ new Set(["enabled", "initialDelayMs", "maxDelayMs", "maxAttempts"]);
-var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
-var RECONNECT_DEFAULTS = {
-  enabled: true,
-  initialDelayMs: 500,
-  maxDelayMs: 3e4,
-  maxAttempts: 10
-};
-function assertReconnectDelay(value, path) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > MAX_TIMER_DELAY_MS) {
-    throw new Error(`${path} must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);
-  }
-}
-function assertReconnectRelation(out) {
-  const initialDelayMs = out.initialDelayMs ?? RECONNECT_DEFAULTS.initialDelayMs;
-  const maxDelayMs = out.maxDelayMs ?? RECONNECT_DEFAULTS.maxDelayMs;
-  if (initialDelayMs > maxDelayMs) {
-    throw new Error("reconnect.initialDelayMs must be less than or equal to maxDelayMs");
-  }
-  const { maxAttempts } = out;
-  if (maxAttempts !== void 0 && (typeof maxAttempts !== "number" || !Number.isInteger(maxAttempts) || maxAttempts < 1)) {
-    throw new Error("reconnect.maxAttempts must be a positive integer");
-  }
-}
-function normalizeReconnect(raw) {
-  if (raw === void 0 || raw === null)
-    return {};
-  if (typeof raw !== "object" || Array.isArray(raw))
-    throw new Error("reconnect must be an object");
-  const out = {};
-  for (const [key, value] of Object.entries(raw)) {
-    if (RECONNECT_KEYS.has(key))
-      out[key] = value;
-  }
-  assertReconnectFields(out);
-  return out;
-}
-function assertReconnectFields(out) {
-  if (out.initialDelayMs !== void 0)
-    assertReconnectDelay(out.initialDelayMs, "reconnect.initialDelayMs");
-  if (out.maxDelayMs !== void 0)
-    assertReconnectDelay(out.maxDelayMs, "reconnect.maxDelayMs");
-  if (out.enabled !== void 0 && typeof out.enabled !== "boolean") {
-    throw new Error("reconnect.enabled must be a boolean");
-  }
-  assertReconnectRelation(out);
-}
-function assertTransportRequired(src, transport) {
-  if (transport === "stdio") {
-    if (typeof src.command !== "string" || src.command.trim() === "") {
-      throw new Error("stdio server requires a command");
-    }
-    return;
-  }
-  if (typeof src.url !== "string" || src.url.trim() === "") {
-    throw new Error("streamable-http server requires a url");
-  }
-  let parsed;
-  try {
-    parsed = new URL(src.url);
-  } catch {
-    throw new Error(`invalid url: ${src.url}`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`unsupported protocol: ${parsed.protocol}//`);
-  }
-}
-function applyTransportFields(server, src, transport) {
-  if (transport === "stdio") {
-    server.command = src.command;
-    if (Array.isArray(src.args))
-      server.args = src.args.map(String);
-    if (typeof src.cwd === "string" && src.cwd !== "")
-      server.cwd = src.cwd;
-    if (typeof src.env === "object" && src.env !== null) {
-      server.env = Object.fromEntries(Object.entries(src.env).map(([key, value]) => [
-        key,
-        String(value)
-      ]));
-    }
-    return;
-  }
-  server.url = src.url;
-  if (typeof src.headers === "object" && src.headers !== null) {
-    server.headers = Object.fromEntries(Object.entries(src.headers).map(([key, value]) => [
-      key,
-      String(value)
-    ]));
-  }
-}
-function normalizeToolCallTimeoutMs(value) {
-  return typeof value === "number" && value > 0 ? Math.floor(value) : DEFAULT_TOOL_CALL_TIMEOUT_MS;
-}
-function normalizeDescription(value) {
-  if (typeof value !== "string")
-    return void 0;
-  const trimmed = value.trim();
-  return trimmed === "" ? void 0 : trimmed;
-}
-function normalizeServer(input) {
-  if (typeof input !== "object" || input === null)
-    throw new Error("server config must be an object");
-  const src = input;
-  const name2 = String(src.name ?? "").trim();
-  if (!SERVER_NAME_PATTERN.test(name2)) {
-    throw new Error(`server name must match ${SERVER_NAME_PATTERN.source}`);
-  }
-  const transport = src.transport === "streamable-http" ? "streamable-http" : src.transport === "stdio" ? "stdio" : void 0;
-  if (transport === void 0)
-    throw new Error('transport must be "stdio" or "streamable-http"');
-  assertTransportRequired(src, transport);
-  const server = {
-    name: name2,
-    transport,
-    enabled: src.enabled !== false,
-    toolCallTimeoutMs: normalizeToolCallTimeoutMs(src.toolCallTimeoutMs),
-    reconnect: normalizeReconnect(src.reconnect),
-    // 能力目录的自定义描述（用户手写；MCP 协议无服务器级自描述，完整保留不截断）。
-    description: normalizeDescription(src.description)
-  };
-  if (typeof src.source === "string" && /^[a-z-]+$/.test(src.source)) {
-    server.source = src.source;
-  }
-  applyTransportFields(server, src, transport);
-  return server;
-}
+init_normalize();
 
 // lib/server/config/impl/env/index.js
 var SECRET_ENV_NAME = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH)/i;
@@ -5833,9 +5998,7 @@ init_import();
 
 // lib/server/config/config-schema.js
 var import_schemastery = __toESM(require_lib2(), 1);
-init_interface2();
 init_interface();
-init_interface2();
 var DEFAULT_UI_CONFIG = {
   position: "top-right",
   offset: { x: 8, y: 8, blankY: 40 },
@@ -6201,7 +6364,6 @@ var MountLedger = class {
 var mountLedger = new MountLedger();
 
 // lib/server/servers/lifecycle/impl/state/index.js
-init_interface2();
 function projectServerState(id, input) {
   if (!input.enabled || input.userDisabled)
     return SERVER_STATES.disabled;
@@ -6224,7 +6386,6 @@ function settledState(input, id) {
 
 // lib/server/servers/lifecycle/impl/timeout/index.js
 init_interface();
-init_interface2();
 
 // lib/server/servers/lifecycle/impl/logs/index.js
 init_interface();
@@ -6696,7 +6857,6 @@ function withTimeout(promise, ms, message, signal) {
 }
 
 // lib/server/pipeline/impl/authorize/index.js
-init_interface2();
 function globMatch(pattern, name2) {
   if (pattern === "*")
     return true;
@@ -6834,7 +6994,6 @@ var MAX_TOTAL_CATALOG_BYTES = 256 * 1024;
 var LIST_MAX_TOOLS_PER_SERVER = 500;
 
 // lib/server/connection/runtime/middleware.js
-init_interface2();
 function connectWrappedServer(unit, root, serverName, server, host) {
   if (!Array.isArray(server.toolDefinitions))
     return false;
@@ -6976,6 +7135,10 @@ var McpMiddleware = class {
     this.host = host;
     this.units = /* @__PURE__ */ new Map();
   }
+  /** Authorization belongs to the caller workspace, independently of the shared connection root. */
+  serverEnabledFor(root, target, name2) {
+    return this.host.serverEnabledFor?.(root, target, name2) !== false;
+  }
   /** 读取/创建 root 的单元（root 无项目标记 → undefined）。 */
   async projectUnitFor(root) {
     if (root === void 0)
@@ -6985,6 +7148,9 @@ var McpMiddleware = class {
       const servers = await this.host.projectServersFor(root);
       if (servers === void 0)
         return void 0;
+      const existing = this.units.get(root);
+      if (existing !== void 0)
+        return existing;
       unit = {
         root,
         connections: /* @__PURE__ */ new Map(),
@@ -7039,9 +7205,11 @@ var McpMiddleware = class {
    *  全部吞掉，且旧 attempt 收敛时命中让位/disposed 守卫静默返回、无人补连 → 这段时间内
    *  该服务器无法重连。拆除时必须同步废弃标记；旧 attempt 稍后收敛由 connectInternal
    *  的让位/disposed 守卫兜底，无副作用。 */
-  abandonInFlight(serverName) {
-    for (const unit of this.units.values())
-      unit.inFlight.delete(serverName);
+  abandonInFlight(serverName, root) {
+    for (const unit of this.units.values()) {
+      if (root === void 0 || unit.root === root)
+        unit.inFlight.delete(serverName);
+    }
   }
   async connectInternal(root, serverName, opts = {}) {
     const unit = this.units.get(root);
@@ -7197,7 +7365,15 @@ var McpMiddleware = class {
    */
   async callTool(fullName, toolRaw, rawArgs, signal, identity) {
     const { dispatch, pipeline, workspace, catalog: catalogPort } = runtimePorts.get();
-    const catalogRoot = workspace.parseFullServerName(fullName)?.root;
+    const parsedTarget = workspace.parseFullServerName(fullName);
+    const catalogRoot = parsedTarget?.root;
+    if (parsedTarget !== void 0 && this.host.serverEnabledFor !== void 0) {
+      const cwd = identity.agent?.session?.header?.cwd;
+      const callerRoot = await this.host.normalizedProjectRoot(cwd) ?? MIDDLEWARE_GLOBAL_ROOT;
+      if (!this.serverEnabledFor(callerRoot, parsedTarget.root, parsedTarget.server)) {
+        throw new Error(`ws_mcp_call: server ${fullName} 已在当前工作区停用`);
+      }
+    }
     const registeredNameFor = (id, tool) => publicToolName(id, tool);
     const execute = (input) => this.host.ctx.tools.execute(input);
     const parent = identity.parent;
@@ -7341,7 +7517,7 @@ __export(interface_exports8, {
 init_interface();
 import { createHash as createHash3, randomBytes as randomBytes4 } from "node:crypto";
 import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2, renameSync, existsSync as existsSync6, readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname8, resolve as resolve2 } from "node:path";
+import { dirname as dirname7, resolve as resolve2 } from "node:path";
 var EMPTY_SEARCH_BUCKET = "<empty>";
 var SEARCH_BUCKET_PREFIX = "h:";
 var SEARCH_BUCKET_HASH_LENGTH = 12;
@@ -7608,7 +7784,7 @@ var McpStatsCollector = class {
     if (!this.isDirty || !this.enabled)
       return;
     try {
-      const dir = dirname8(this.filePath);
+      const dir = dirname7(this.filePath);
       if (!existsSync6(dir)) {
         mkdirSync2(dir, mkdirOptionsFor(dir));
       }
@@ -7659,7 +7835,7 @@ init_interface();
 import { randomBytes as randomBytes5 } from "node:crypto";
 import { mkdir as mkdir4, readFile as readFile4, rename as rename4, rm as rm4, stat, writeFile as writeFile4 } from "node:fs/promises";
 import { existsSync as existsSync7 } from "node:fs";
-import { dirname as dirname9 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 var saveChains = /* @__PURE__ */ new Map();
 var windowsRenameRetryDelays = [50, 100, 150, 200, 250];
 function isRetryableWindowsRenameError(error) {
@@ -7747,7 +7923,7 @@ var McpStore = class {
     if (await this.changedSince(baseline.mtimeMs, baseline.snapshot)) {
       throw externalModificationError(this.path);
     }
-    const dir = dirname9(this.path);
+    const dir = dirname8(this.path);
     if (!existsSync7(dir))
       await mkdir4(dir, { recursive: true });
     let mode;
@@ -7826,7 +8002,7 @@ init_interface();
 import { createHash as createHash4, randomBytes as randomBytes6 } from "node:crypto";
 import { mkdir as mkdir5, rename as rename5, rm as rm5, writeFile as writeFile5 } from "node:fs/promises";
 import { existsSync as existsSync8 } from "node:fs";
-import { dirname as dirname10 } from "node:path";
+import { dirname as dirname9 } from "node:path";
 async function writeStateFile(file, data) {
   let registered = true;
   try {
@@ -7838,7 +8014,7 @@ async function writeStateFile(file, data) {
     await writeFileAtomic(file, data);
     return;
   }
-  const dir = dirname10(file);
+  const dir = dirname9(file);
   if (!existsSync8(dir))
     await mkdir5(dir, { recursive: true });
   const tmp = `${file}.${process.pid}.${Date.now().toString(36)}.${randomBytes6(6).toString("hex")}.tmp`;
@@ -8016,7 +8192,6 @@ var injectPorts = new InjectPorts();
 
 // lib/server/inject/middleware-register.js
 init_interface();
-init_interface2();
 
 // lib/server/inject/impl/image-admission/index.js
 var IMAGE_MEDIA_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
@@ -8221,6 +8396,10 @@ function visibleProjectServers(root) {
   const { catalog } = injectPorts.get();
   return [...new Set(catalog.catalogDirectory.serverNamesFor(root))].sort();
 }
+function serverVisible(mw, root, fullName) {
+  const parsed = injectPorts.get().workspace.parseFullServerName(fullName);
+  return parsed === void 0 || mw.serverEnabledFor?.(root, parsed.root, parsed.server) !== false;
+}
 async function waitForDiscovery(unit) {
   const { pipeline: { withTimeout: withTimeout2 } } = injectPorts.get();
   const inflight = [...unit.inFlight.values()];
@@ -8297,9 +8476,13 @@ async function executeSearch(toolCtx, args, exec) {
       await waitForDiscovery(visibleUnit);
   }
   const { catalog: { searchCatalogMulti: searchCatalogMulti2 } } = injectPorts.get();
-  const { results, unavailable, truncated } = searchCatalogMulti2(toolCtx.mw.units, roots, query, limit);
+  const { results, unavailable, truncated } = searchCatalogMulti2(toolCtx.mw.units, roots, query, limit, (target, name2) => toolCtx.mw.serverEnabledFor?.(root, target, name2) !== false);
   const filtered = serverFilter === void 0 ? results : results.filter((hit) => hit.server === serverFilter);
-  return { results: filtered, unavailable, truncated };
+  return {
+    results: filtered.filter((hit) => serverVisible(toolCtx.mw, root, hit.server)),
+    unavailable: unavailable.filter((entry) => serverVisible(toolCtx.mw, root, entry.server)),
+    truncated
+  };
 }
 function buildSearchTool(toolCtx) {
   return {
@@ -8402,6 +8585,8 @@ async function executeCall(toolCtx, args, exec) {
   const { server, tool, arguments: callArguments } = parseCallParams(args);
   if (server === "" || tool === "")
     throw new Error("ws_mcp_call: server 与 tool 均为必填");
+  if (!serverVisible(toolCtx.mw, root, server))
+    throw new Error(`ws_mcp_call: server ${server} 已在当前工作区停用`);
   const { parsed, unit } = await assertCallableTarget(toolCtx, server, root);
   await toolCtx.mw.ensureConnected(unit.root, parsed.server);
   const startTime = Date.now();
@@ -8534,7 +8719,7 @@ async function resolveListWithoutUnit(mw, root, serverFilter, toolLimit) {
   const globalUnit = await mw.projectUnitFor("@global");
   if (globalUnit !== void 0)
     await waitForDiscovery(globalUnit);
-  return listCatalog2(mw.units, ["@global"], serverFilter, toolLimit, "当前工作空间没有可用 MCP 服务器（项目级与全局均未发现；若刚添加配置，请稍后重试）", mw.disabledTools);
+  return listCatalog2(mw.units, ["@global"], serverFilter, toolLimit, "当前工作空间没有可用 MCP 服务器（项目级与全局均未发现；若刚添加配置，请稍后重试）", mw.disabledTools, (target, name2) => mw.serverEnabledFor?.(root, target, name2) !== false);
 }
 async function executeList(toolCtx, args, exec) {
   const root = await toolCtx.resolveRoot(exec.agent);
@@ -8555,7 +8740,7 @@ async function executeList(toolCtx, args, exec) {
       await waitForDiscovery(visibleUnit);
   }
   const { catalog: { listCatalog: listCatalog2 } } = injectPorts.get();
-  const result = listCatalog2(toolCtx.mw.units, roots, serverFilter, toolLimit, "", toolCtx.mw.disabledTools);
+  const result = listCatalog2(toolCtx.mw.units, roots, serverFilter, toolLimit, "", toolCtx.mw.disabledTools, (target, name2) => toolCtx.mw.serverEnabledFor?.(root, target, name2) !== false);
   if (result.servers.length === 0) {
     result.message = resolveEmptyListMessage(serverFilter, toolCtx.mw, root);
   }
@@ -8636,6 +8821,8 @@ async function executeDetail(toolCtx, args, exec) {
     toolCtx.stats.recordDetail(parsed?.server ?? server, tool);
   }
   const targetRoot = await checkMiddlewareRoot("ws_mcp_detail", server, root);
+  if (!serverVisible(toolCtx.mw, root, server))
+    throw new Error(`ws_mcp_detail: server ${server} 已在当前工作区停用`);
   if (targetRoot === void 0) {
     throw new Error(`ws_mcp_detail: server ${JSON.stringify(server)} 不属于当前工作空间 ${JSON.stringify(root)}；路由一致性校验失败（防跨空间串台）`);
   }
@@ -8831,7 +9018,7 @@ __export(interface_exports10, {
 
 // lib/vendor/shared/upgrade-chain.js
 import { existsSync as existsSync9, readFileSync as readFileSync3 } from "node:fs";
-import { dirname as dirname11, join as join7 } from "node:path";
+import { dirname as dirname10, join as join6 } from "node:path";
 var UNKNOWN_VERSION = "0.0.0";
 var PACKAGE_ROOT_MAX_DEPTH = 8;
 function selectPendingSteps(steps, recorded) {
@@ -8886,9 +9073,9 @@ function parseVersion(text) {
 function packageRootFrom(fromDir) {
   let current = fromDir;
   for (let depth = 0; depth < PACKAGE_ROOT_MAX_DEPTH; depth += 1) {
-    if (existsSync9(join7(current, "package.json")))
+    if (existsSync9(join6(current, "package.json")))
       return current;
-    const parent = dirname11(current);
+    const parent = dirname10(current);
     if (parent === current)
       return void 0;
     current = parent;
@@ -8900,7 +9087,7 @@ function pluginVersion(fromDir) {
   if (root === void 0)
     return UNKNOWN_VERSION;
   try {
-    const parsed = JSON.parse(readFileSync3(join7(root, "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync3(join6(root, "package.json"), "utf8"));
     if (typeof parsed !== "object" || parsed === null || !("version" in parsed)) {
       return UNKNOWN_VERSION;
     }
@@ -8961,7 +9148,7 @@ function createUpgradeRunner(label, run) {
 }
 
 // lib/server/upgrade/impl/chain/index.js
-import { dirname as dirname12 } from "node:path";
+import { dirname as dirname11 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // lib/vendor/shared/upgrade-tick.js
@@ -8971,7 +9158,7 @@ async function tickUpgradeVersion() {
 // lib/server/upgrade/impl/steps/storage-layout.js
 init_interface();
 import { existsSync as existsSync10, readFileSync as readFileSync4, renameSync as renameSync2, statSync as statSync2 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join7 } from "node:path";
 var MIGRATED_SUFFIX = ".migrated.bak";
 var EMPTY_CONFIG = `${JSON.stringify({ version: 1, servers: [] }, null, 2)}
 `;
@@ -8987,7 +9174,7 @@ var LAYOUT = [
   // 上一代包分区目录形态的全局配置（~/.dsh/dsh-mcp-manager/mcp.json）→ .config 单文件。
   // 排在 dsh-mcp.json 之后：目标已存在时只归档不覆盖（settleOne 幂等语义）。
   {
-    legacy: () => join8(mcpManagerHome(), "mcp.json"),
+    legacy: () => join7(mcpManagerHome(), "mcp.json"),
     target: configFile,
     initial: EMPTY_CONFIG,
     takenOver: (deps) => deps.storePath !== ""
@@ -9080,7 +9267,7 @@ async function writeStoredVersion(version) {
 }
 
 // lib/server/upgrade/impl/chain/index.js
-var MODULE_DIR = dirname12(fileURLToPath(import.meta.url));
+var MODULE_DIR = dirname11(fileURLToPath(import.meta.url));
 function runUpgradeChain2(deps) {
   return runUpgradeChain({
     label: "dsh-mcp-manager",
@@ -9427,9 +9614,6 @@ function startSdkErasure(args) {
   });
 }
 
-// lib/index.js
-init_interface2();
-
 // lib/server/workspace/interface.js
 var interface_exports11 = {};
 __export(interface_exports11, {
@@ -9446,10 +9630,8 @@ __export(interface_exports11, {
   normalizedProjectRoot: () => normalizedProjectRoot,
   parseFullServerName: () => parseFullServerName
 });
-init_root_resolution();
 
 // lib/server/workspace/impl/full-name/index.js
-init_interface2();
 function fullServerName(root, server) {
   return `@${root}/${server}`;
 }
@@ -9481,14 +9663,10 @@ function normalizeToolName(serverName, toolName, caller = "ws_mcp_call") {
 }
 
 // lib/server/workspace/impl/scope/index.js
-init_interface2();
 function normalizeScope(value) {
   return value === SCOPE_PROJECT ? SCOPE_PROJECT : SCOPE_GLOBAL;
 }
 
-// lib/server/workspace/interface.js
-init_interface2();
-
 // lib/server/workspace/impl/server-id/index.js
 init_interface();
 import { randomBytes as randomBytes7 } from "node:crypto";
@@ -9533,7 +9711,6 @@ function makeServerIdTable(options = {}) {
 }
 
 // lib/index.js
-init_interface2();
 installCatalog({ store: interface_exports9, connection: interface_exports7, workspace: interface_exports11 });
 installPipeline({ workspace: interface_exports11 });
 installInject({
@@ -9709,10 +9886,11 @@ async function setupConfigWatchersAsync(manager) {
     const fs = await import("node:fs");
     const watchers = [];
     const watched = /* @__PURE__ */ new Set();
-    const watchConfig = (dir) => {
-      if (watched.has(dir))
+    const watchConfig = (dir, sources = false) => {
+      const key = `${dir}:${sources}`;
+      if (watched.has(key))
         return;
-      watched.add(dir);
+      watched.add(key);
       let busy = false;
       let rerun = false;
       const run = () => {
@@ -9723,7 +9901,10 @@ async function setupConfigWatchersAsync(manager) {
         busy = true;
         void (async () => {
           try {
-            await manager.refreshFromDisk();
+            if (sources)
+              await manager.sourcesChanged?.();
+            else
+              await manager.refreshFromDisk();
           } finally {
             busy = false;
             if (rerun) {
@@ -9734,8 +9915,14 @@ async function setupConfigWatchersAsync(manager) {
         })();
       };
       try {
-        const watcher = fs.watch(dir, { persistent: false }, () => run());
+        const watcher = fs.watch(dir, { persistent: false }, (_event, filename) => {
+          const name2 = filename?.toString();
+          if (name2 !== void 0 && (sources ? name2 !== "mcp.json" : name2 !== "dsh-mcp-manager.config"))
+            return;
+          run();
+        });
         watcher.on("error", () => {
+          watched.delete(key);
           const index = watchers.indexOf(watcher);
           if (index >= 0)
             watchers.splice(index, 1);
@@ -9746,14 +9933,26 @@ async function setupConfigWatchersAsync(manager) {
         });
         watchers.push(watcher);
       } catch {
+        watched.delete(key);
       }
     };
-    watchConfig(dirname13(manager.store.path));
+    watchConfig(dirname12(manager.store.path));
+    for (const id of SOURCE_IDS) {
+      const path = sourcePath(id);
+      if (path !== null)
+        watchConfig(dirname12(path), true);
+    }
     if (manager.projectStore !== void 0)
-      watchConfig(dirname13(manager.projectStore.path));
+      watchConfig(dirname12(manager.projectStore.path));
     const unwatchProject = manager.onStatus(() => {
-      if (manager.projectStore !== void 0)
-        watchConfig(dirname13(manager.projectStore.path));
+      for (const [root, store] of manager.projectStores) {
+        watchConfig(dirname12(store.path));
+        for (const id of SOURCE_IDS) {
+          const path = sourcePath(id, root);
+          if (path !== null)
+            watchConfig(dirname12(path), true);
+        }
+      }
     });
     return () => {
       unwatchProject();
@@ -9931,9 +10130,7 @@ async function assembleEnabledRuntime(ctx, manager, options, syncFromSettings, f
       faces.logger.warn(`dsh-mcp-manager: catalog reprojection failed: ${String(error)}`);
     });
   });
-  await manager.startAll();
   await manager.loadCatalogCache();
-  manager.reconcileServers();
   manager.logger.info("dsh-mcp-manager: middleware assembled (single pool, all servers via middleware)");
   syncFromSettings();
   let disposeInjection = () => {
@@ -9942,27 +10139,93 @@ async function assembleEnabledRuntime(ctx, manager, options, syncFromSettings, f
     disposeInjection = registerCatalogInjection(ctx, manager, options.catalogMaxEntries);
   }
   const disposeRoutes = ctx.effect(() => setupRoutesAndBroadcast(ctx, manager), "dsh-mcp-manager: routes");
-  const watchCleanup = await setupConfigWatchersAsync(manager);
-  try {
+  let watchCleanup = await setupConfigWatchersAsync(manager);
+  const sourceViews = /* @__PURE__ */ new Map();
+  manager.sourceSnapshot = function() {
+    return sourceViews.get(this.projectRoot ?? "");
+  };
+  const prepared = /* @__PURE__ */ new Map();
+  let stopped = false;
+  const syncWorkspace = async (cwd) => {
     const { syncSourcesIntoManager: syncSourcesIntoManager2 } = await Promise.resolve().then(() => (init_sources_sync(), sources_sync_exports));
-    const { findProjectRoot: findProjectRoot2 } = await Promise.resolve().then(() => (init_root_resolution(), root_resolution_exports));
-    const runSync = async (cwd) => {
-      try {
-        const root = cwd === void 0 || cwd === "" ? void 0 : await findProjectRoot2(cwd);
-        await syncSourcesIntoManager2(manager, root, await loadSourcePrefsForSync());
-      } catch (error) {
-        manager.logger?.warn?.(`dsh-mcp-manager: 多源同步失败（不影响其余功能）：${error instanceof Error ? error.message : String(error)}`);
+    const view = await manager.forWorkspace(cwd);
+    const prefs = await loadSourcePrefsForSync();
+    await syncSourcesIntoManager2(view, view.projectRoot, prefs);
+    sourceViews.set(view.projectRoot ?? "", { sources: collectParsedSources(view.projectRoot), prefs });
+    if (stopped)
+      return;
+    if (view.projectRoot === void 0)
+      await manager.startAll();
+    else
+      await mw.projectUnitFor(view.projectRoot);
+    manager.emitStatus();
+  };
+  manager.prepareWorkspace = async (cwd) => {
+    const key = (await manager.forWorkspace(cwd)).projectRoot ?? "";
+    let task = prepared.get(key);
+    if (task === void 0) {
+      task = (async () => {
+        if (key !== "")
+          await manager.prepareWorkspace?.();
+        await syncWorkspace(key === "" ? void 0 : key);
+      })();
+      prepared.set(key, task);
+      void task.catch(() => prepared.delete(key));
+    }
+    return task;
+  };
+  let sourceUpdates = Promise.resolve();
+  manager.sourcesChanged = () => {
+    sourceUpdates = sourceUpdates.catch(() => {
+    }).then(async () => {
+      await syncWorkspace();
+      for (const cwd of prepared.keys()) {
+        if (cwd !== "")
+          await syncWorkspace(cwd);
       }
-    };
-    await runSync(void 0);
-    const origSetSession = manager.setSession.bind(manager);
-    manager.setSession = async (cwd) => {
-      await origSetSession(cwd);
-      await runSync(cwd);
-    };
-  } catch (error) {
-    manager.logger?.warn?.(`dsh-mcp-manager: 启动多源同步装配失败（不影响其余启动）：${error instanceof Error ? error.message : String(error)}`);
-  }
+    });
+    return sourceUpdates;
+  };
+  const bootstrapTimer = setTimeout(() => {
+    if (typeof ctx.get !== "function")
+      return;
+    void (async () => {
+      await manager.prepareWorkspace?.();
+      const registry = typeof ctx.get === "function" ? ctx.get("workspaceRegistry") : void 0;
+      const workspaces = registry?.list?.() ?? [];
+      for (const workspace of workspaces) {
+        if (stopped)
+          return;
+        await manager.prepareWorkspace?.(workspace.path);
+        await new Promise((resolve3) => setTimeout(resolve3, 0));
+      }
+    })().catch((error) => manager.logger.warn(`dsh-mcp-manager: background bootstrap failed: ${manager.redactError(error)}`));
+  }, 0);
+  bootstrapTimer.unref?.();
+  const disposeWorkspaceWarmup = typeof ctx.inject === "function" ? ctx.inject(["workspaceRegistry"], (injected) => {
+    const timer = setTimeout(() => {
+      const registry = injected.get("workspaceRegistry");
+      void (async () => {
+        for (const workspace of registry?.list() ?? []) {
+          if (stopped)
+            return;
+          await manager.prepareWorkspace?.(workspace.path);
+          await new Promise((resolve3) => setTimeout(resolve3, 0));
+        }
+      })().catch((error) => manager.logger.warn(`dsh-mcp-manager: workspace warmup failed: ${manager.redactError(error)}`));
+    }, 0);
+    timer.unref?.();
+    return () => clearTimeout(timer);
+  }) : void 0;
+  const stopWatchers = watchCleanup;
+  watchCleanup = () => {
+    stopped = true;
+    clearTimeout(bootstrapTimer);
+    manager.prepareWorkspace = void 0;
+    manager.sourcesChanged = void 0;
+    void disposeWorkspaceWarmup?.dispose?.();
+    stopWatchers();
+  };
   let disposeSection = () => {
   };
   if (options.announceToAgent) {