dsh-agent-plugins-market 0.4.5 → 0.4.6

package/lib/discovery.js

@@ -23,15 +23,10 @@ const DOT_DIRS = new Set(['.git', '.github', '.claude', '.cursor', '.kimi', '.pl
 /** Discover every suite under one cloned source checkout. */
 export async function discoverSuitesInSource(checkoutDir, sourceId, dimension) {
     const roots = await suiteRoots(checkoutDir);
-    const suites = [];
-    for (const root of roots) {
-        const suite = root.dir === undefined
-            ? remoteSuite(sourceId, dimension, root)
-            : await readSuite(root.dir, sourceId, dimension, root.hint);
-        if (suite !== undefined)
-            suites.push(suite);
-    }
-    return suites;
+    const suites = await Promise.all(roots.map(async (root) => root.dir === undefined
+        ? remoteSuite(sourceId, dimension, root)
+        : readSuite(root.dir, sourceId, dimension, root.hint)));
+    return suites.filter((suite) => suite !== undefined);
 }
 /**
  * Resolve the suite roots of one checkout. A marketplace manifest is the
@@ -205,30 +200,37 @@ export function isOutside(root, candidate) {
     return isAbsolute(candidate) ? !candidate.startsWith(root) : false;
 }
 /**
- * Discover every suite of one dimension's configured sources, plus manual
- * checkouts present under the dimension's `.sources/` that no source entry
- * names. Local sources read their directory directly; git sources read
- * their clone; a missing checkout contributes nothing.
+ * Discover suites for one dimension. User catalogs only read configured
+ * sources: unmanaged user checkouts have no persisted identity and otherwise
+ * leak stale repositories into the catalog totals. Project catalogs retain
+ * unmanaged checkout ids because project state may authorize them through its
+ * installed map without duplicating source configuration. All selected
+ * checkouts are discovered concurrently so one large repository does not
+ * serialize every other repository's scan.
  */
 export async function discoverSourceList(sources, dimension, dimensionRoot) {
     const checkoutRoot = sourcesDir(dimensionRoot);
-    const bySource = new Map();
     const listed = new Set(sources.map(source => source.id));
-    try {
-        for (const entry of await readdir(checkoutRoot, { withFileTypes: true })) {
-            if (!entry.isDirectory() || entry.name.startsWith('.') || listed.has(entry.name))
-                continue;
-            bySource.set(entry.name, await discoverSuitesInSource(join(checkoutRoot, entry.name), entry.name, dimension));
+    const checkouts = sources.map(source => ({
+        sourceId: source.id,
+        checkout: source.local === true ? expandHome(source.url) : join(checkoutRoot, source.id),
+    }));
+    if (dimension === 'project') {
+        try {
+            for (const entry of await readdir(checkoutRoot, { withFileTypes: true })) {
+                if (!entry.isDirectory() || entry.name.startsWith('.') || listed.has(entry.name))
+                    continue;
+                checkouts.push({ sourceId: entry.name, checkout: join(checkoutRoot, entry.name) });
+            }
+        }
+        catch {
+            // A missing project checkout root has no unmanaged project sources.
         }
     }
-    catch {
-        // a missing checkout root simply has no manual checkouts
-    }
-    for (const source of sources) {
-        const checkout = source.local === true ? expandHome(source.url) : join(checkoutRoot, source.id);
+    const discovered = await Promise.all(checkouts.map(async ({ sourceId, checkout }) => {
         if (!await isDirectory(checkout))
-            continue;
-        bySource.set(source.id, await discoverSuitesInSource(checkout, source.id, dimension));
-    }
-    return [...bySource.values()].flat();
+            return [];
+        return discoverSuitesInSource(checkout, sourceId, dimension);
+    }));
+    return discovered.flat();
 }

package/lib/index.js

@@ -3,6 +3,7 @@ import { HooksMountRegistry } from './hooks-mounts.js';
 import { mountSuiteContext } from './context.js';
 import { SuiteManager } from './manager.js';
 import { McpMountRegistry } from './mcp-mounts.js';
+import { inspectToolRegistry } from './mcp-status.js';
 import { resolveDataRoot, resolveUserRoot } from './paths.js';
 import { mountSuiteRoutes } from './routes.js';
 import { SuiteSkillProvider } from './skills-provider.js';
@@ -53,6 +54,9 @@ export function apply(ctx, config = {}) {
         reconcileMounts();
     };
     const manager = new SuiteManager({ userRoot, dataRoot, onChanged });
+    ctx.inject(['tools'], (toolsCtx) => {
+        manager.setMcpToolSnapshotProvider(() => inspectToolRegistry(toolsCtx.tools));
+    });
     void manager.load().then(async () => {
         await manager.mergeSources(config.sources ?? []);
         reconcileMounts();

package/lib/manager.js

@@ -13,6 +13,7 @@ import { mkdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { discoverLspEntries, discoverSourceList, discoverSuitesInSource, listMdFiles, repoName } from './discovery.js';
 import { gitClone, gitHead, gitPull, gitRemove } from './git.js';
+import { buildMcpStatus } from './mcp-status.js';
 import { deriveSourceId, expandHome, isDirectory, resolveProjectRoot, sanitizeId, sourceCheckoutDir, sourcesDir, STATE_FILE_NAME } from './paths.js';
 import { loadState, saveState, EMPTY_STATE } from './state.js';
 export class SuiteManager {
@@ -24,10 +25,20 @@ export class SuiteManager {
     headCache = new Map();
     /** Latest MCP mount diagnostics (suiteId -> reasons), fed by the host reconcile. */
     mcpDiagnostics = [];
+    toolSnapshotProvider = () => [];
     constructor(options) {
         this.options = options;
         this.statePath = join(options.userRoot, STATE_FILE_NAME);
     }
+    /** Install the host tool snapshot provider used by the MCP status surface. */
+    setMcpToolSnapshotProvider(provider) {
+        this.toolSnapshotProvider = provider;
+    }
+    /** Build the flat MCP service inventory for the status surface. */
+    async mcpStatus() {
+        const suites = await this.discoverDimension('user', this.options.userRoot);
+        return buildMcpStatus(suites, this.mcpDiagnostics, this.toolSnapshotProvider());
+    }
     /** Load persisted state once at plugin activation. */
     async load() {
         this.state = await loadState(this.statePath);

package/lib/mcp-status.js

@@ -0,0 +1,147 @@
+import { deriveServerName } from './mcp-config.js';
+/** Build status rows from discovered plugin MCP definitions and observed tool names. */
+export function buildMcpStatus(suites, diagnostics, observed) {
+    const entries = [];
+    const claimedServers = new Set();
+    const knownServerNames = new Set();
+    for (const suite of suites) {
+        if (suite.mcp === undefined || suite.installedAt === undefined || !suite.enabled)
+            continue;
+        for (const serverKey of Object.keys(suite.mcp.servers))
+            knownServerNames.add(deriveServerName(suite.id, serverKey));
+    }
+    const diagnosticsByKey = new Map(diagnostics.map(diagnostic => [`${diagnostic.suiteId}\u0000${diagnostic.serverKey}`, diagnostic]));
+    const observedByServer = groupObservedTools(observed, knownServerNames);
+    for (const suite of suites) {
+        // This is an operational inventory, not a configuration audit: suite MCP
+        // definitions only appear after their suite is both installed and enabled.
+        if (suite.mcp === undefined || suite.installedAt === undefined || !suite.enabled)
+            continue;
+        for (const [serverKey, server] of Object.entries(suite.mcp.servers)) {
+            const serverName = deriveServerName(suite.id, serverKey);
+            const tools = observedByServer.get(serverName) ?? [];
+            claimedServers.add(serverName);
+            const diagnostic = diagnosticsByKey.get(`${suite.id}\u0000${serverKey}`);
+            const state = diagnostic !== undefined
+                ? 'failed'
+                : tools.length > 0
+                    ? 'connected'
+                    : 'degraded';
+            entries.push({
+                id: `plugin:${suite.sourceId}/${suite.id}/${serverKey}`,
+                name: serverName,
+                kind: 'plugin',
+                state,
+                source: suite.manifest.name,
+                suiteId: suite.id,
+                serverKey,
+                transport: server.type,
+                endpoint: endpointOf(server),
+                config: redactConfig(server),
+                tools: tools.map(tool => ({ name: tool.name, ...tool.description === undefined ? {} : { description: tool.description } })),
+                ...diagnostic === undefined ? {} : { reason: diagnostic.reason },
+            });
+        }
+    }
+    for (const [serverName, tools] of observedByServer) {
+        if (claimedServers.has(serverName))
+            continue;
+        entries.push({
+            id: `direct:${serverName}`,
+            name: serverName,
+            kind: 'direct',
+            state: 'connected',
+            transport: 'observed',
+            tools: tools.map(tool => ({ name: tool.name, ...tool.description === undefined ? {} : { description: tool.description } })),
+        });
+    }
+    const totals = {
+        all: entries.length,
+        connected: entries.filter(entry => entry.state === 'connected').length,
+        degraded: entries.filter(entry => entry.state === 'degraded').length,
+        failed: entries.filter(entry => entry.state === 'failed').length,
+        disabled: entries.filter(entry => entry.state === 'disabled').length,
+    };
+    return { entries, observedAt: new Date().toISOString(), totals, directObservationOnly: true };
+}
+function groupObservedTools(observed, knownServerNames) {
+    const grouped = new Map();
+    for (const tool of observed) {
+        if (!tool.name.startsWith('mcp__'))
+            continue;
+        let serverName;
+        let rawName;
+        // Plugin server names contain `__` themselves (`suite__server`), so use
+        // known names first and choose the longest matching namespace.
+        for (const candidate of knownServerNames) {
+            const prefix = `mcp__${candidate}__`;
+            if (tool.name.startsWith(prefix) && (serverName === undefined || candidate.length > serverName.length)) {
+                serverName = candidate;
+                rawName = tool.name.slice(prefix.length);
+            }
+        }
+        if (serverName === undefined) {
+            const parts = tool.name.split('__');
+            if (parts.length < 3)
+                continue;
+            serverName = parts[1];
+            rawName = parts.slice(2).join('__');
+        }
+        if (serverName === undefined || rawName === undefined || rawName === '')
+            continue;
+        const list = grouped.get(serverName) ?? [];
+        list.push({ name: rawName, ...tool.description === undefined ? {} : { description: tool.description } });
+        grouped.set(serverName, list);
+    }
+    return grouped;
+}
+function endpointOf(server) {
+    if (server.type === 'stdio')
+        return [server.command, ...(server.args ?? [])].join(' ');
+    return server.url;
+}
+const SENSITIVE_KEY = /(authorization|token|secret|password|credential|api[-_]?key)/i;
+function redactConfig(value) {
+    return redactValue(value);
+}
+function redactValue(value, key = '') {
+    if (SENSITIVE_KEY.test(key))
+        return '[redacted]';
+    if (Array.isArray(value))
+        return value.map(item => redactValue(item));
+    if (typeof value === 'object' && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [childKey, redactValue(childValue, childKey)]));
+    }
+    return value;
+}
+/** Read model-facing MCP tool names from the dsh-tools runtime when available.
+ * The registry intentionally has no public listing API in rc.6; this adapter
+ * uses only the runtime's stable `layers.merge(...).tools.entries()` data shape
+ * and safely returns an empty observation when another host changes it. */
+export function inspectToolRegistry(runtime) {
+    if (typeof runtime !== 'object' || runtime === null)
+        return [];
+    const layers = runtime.layers;
+    if (typeof layers !== 'object' || layers === null)
+        return [];
+    const merge = layers.merge;
+    if (typeof merge !== 'function')
+        return [];
+    const empty = { entries: () => [] };
+    try {
+        const visible = merge.call(layers, undefined, layer => layer.tools ?? empty);
+        const output = [];
+        for (const [name, definition] of visible.entries()) {
+            if (!name.startsWith('mcp__'))
+                continue;
+            const description = typeof definition === 'object' && definition !== null && typeof definition.description === 'string'
+                ? definition.description
+                : undefined;
+            output.push({ name, ...description === undefined ? {} : { description } });
+        }
+        return output;
+    }
+    catch {
+        return [];
+    }
+}

package/lib/routes.js

@@ -46,6 +46,9 @@ export function mountSuiteRoutes(hostCtx, manager) {
     get(`${API_PREFIX}overview`, async (_request, response) => {
         sendJson(response, 200, await manager.overview());
     });
+    get(`${API_PREFIX}mcp-status`, async (_request, response) => {
+        sendJson(response, 200, await manager.mcpStatus());
+    });
     get(`${API_PREFIX}progress`, async (_request, response) => {
         sendJson(response, 200, manager.sourceProgress());
     });

package/lib/types/discovery.d.ts

@@ -8,9 +8,12 @@ export declare function discoverSuitesInSource(checkoutDir: string, sourceId: st
 /** Whether a suite root path lies outside the checkout (defense for malformed marketplace sources). */
 export declare function isOutside(root: string, candidate: string): boolean;
 /**
- * Discover every suite of one dimension's configured sources, plus manual
- * checkouts present under the dimension's `.sources/` that no source entry
- * names. Local sources read their directory directly; git sources read
- * their clone; a missing checkout contributes nothing.
+ * Discover suites for one dimension. User catalogs only read configured
+ * sources: unmanaged user checkouts have no persisted identity and otherwise
+ * leak stale repositories into the catalog totals. Project catalogs retain
+ * unmanaged checkout ids because project state may authorize them through its
+ * installed map without duplicating source configuration. All selected
+ * checkouts are discovered concurrently so one large repository does not
+ * serialize every other repository's scan.
  */
 export declare function discoverSourceList(sources: SourceRef[], dimension: SuiteDimension, dimensionRoot: string): Promise<Suite[]>;

package/lib/types/manager.d.ts

@@ -1,3 +1,4 @@
+import { type McpStatusPayload, type McpToolSnapshot } from './mcp-status.js';
 import type { OverviewPayload, SourceRef, Suite, SuiteDimension } from './types.js';
 export interface ManagerOptions {
     userRoot: string;
@@ -17,7 +18,12 @@ export declare class SuiteManager {
         serverKey: string;
         reason: string;
     }>;
+    private toolSnapshotProvider;
     constructor(options: ManagerOptions);
+    /** Install the host tool snapshot provider used by the MCP status surface. */
+    setMcpToolSnapshotProvider(provider: () => readonly McpToolSnapshot[]): void;
+    /** Build the flat MCP service inventory for the status surface. */
+    mcpStatus(): Promise<McpStatusPayload>;
     /** Load persisted state once at plugin activation. */
     load(): Promise<void>;
     get sources(): SourceRef[];

package/lib/types/mcp-status.d.ts

@@ -0,0 +1,51 @@
+import type { Suite } from './types.js';
+/** A tool observed in the host tool registry. */
+export interface McpToolSnapshot {
+    name: string;
+    description?: string;
+}
+export type McpStatusKind = 'plugin' | 'direct';
+export type McpStatusState = 'connected' | 'degraded' | 'failed' | 'disabled';
+/** One MCP service row for the status surface. */
+export interface McpStatusEntry {
+    id: string;
+    name: string;
+    kind: McpStatusKind;
+    state: McpStatusState;
+    source?: string;
+    suiteId?: string;
+    serverKey?: string;
+    transport: string;
+    endpoint?: string;
+    config?: Record<string, unknown>;
+    tools: Array<{
+        name: string;
+        description?: string;
+    }>;
+    reason?: string;
+}
+export interface McpStatusPayload {
+    entries: McpStatusEntry[];
+    observedAt: string;
+    totals: {
+        all: number;
+        connected: number;
+        degraded: number;
+        failed: number;
+        disabled: number;
+    };
+    directObservationOnly: boolean;
+}
+interface McpDiagnostic {
+    suiteId: string;
+    serverKey: string;
+    reason: string;
+}
+/** Build status rows from discovered plugin MCP definitions and observed tool names. */
+export declare function buildMcpStatus(suites: Suite[], diagnostics: McpDiagnostic[], observed: readonly McpToolSnapshot[]): McpStatusPayload;
+/** Read model-facing MCP tool names from the dsh-tools runtime when available.
+ * The registry intentionally has no public listing API in rc.6; this adapter
+ * uses only the runtime's stable `layers.merge(...).tools.entries()` data shape
+ * and safely returns an empty observation when another host changes it. */
+export declare function inspectToolRegistry(runtime: unknown): McpToolSnapshot[];
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-agent-plugins-market",
   "description": "The standard way to install Claude Code / Codex / Cursor / Kimi plugin marketplace suites in DeepSeek Harness (DSH) — zero conversion, zero file copying. Skills, MCP servers, hooks and slash commands are injected into your dsh sessions at runtime.",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",