dsh-agent-plugins-market 0.5.2 → 0.6.0

package/lib/catalog/surfaces.js

@@ -9,29 +9,47 @@
  * fail-closed: broken files produce a diagnostic and are skipped, never a
  * thrown discovery.
  */
-import { readFile, readdir, stat } from 'node:fs/promises';
-import { join } from 'node:path';
+import { readFile, readdir, realpath, stat } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
 import { parseSkillFrontmatter } from './skills-parse.js';
 import { isDirectory } from './paths.js';
 import { validateMcpJson } from './validate.js';
 import { declaredMcpServers } from './manifests.js';
 const DOT_DIRS = new Set(['.git', '.github', '.claude', '.cursor', '.kimi', '.plugin', '.sources', 'node_modules']);
-/** Resolve a manifest-declared skills path into absolute directories (string or array form). */
-function declaredSkillDirs(root, declared) {
+/**
+ * Resolve a manifest-declared skills path into absolute directories (string or
+ * array form). Containment is checked on the *realpath* of both sides: the
+ * declared path may be (or pass through) a symlink whose target leaves the
+ * suite root, which lexical resolution cannot see.
+ */
+async function declaredSkillDirs(root, declared) {
     const values = Array.isArray(declared) ? declared : [declared];
     const dirs = [];
+    const realRoot = await realpath(root).catch(() => root);
     for (const value of values) {
         if (typeof value !== 'string' || value === '')
             continue;
         const cleaned = value.replace(/^\.\//, '');
-        const path = join(root, cleaned);
-        if (isAbsoluteWithin(root, path))
+        const path = resolve(root, cleaned);
+        // A missing path is not an escape; the discovery walk reports it absent.
+        const realPath = await realpath(path).catch(() => undefined);
+        if (realPath === undefined)
+            continue;
+        if (isWithin(realRoot, realPath))
             dirs.push(path);
     }
     return dirs;
 }
-function isAbsoluteWithin(root, candidate) {
-    return candidate.startsWith(`${root}${candidate.includes('/') ? '/' : '\\'}`) || candidate.startsWith(root);
+/**
+ * Whether `candidate` stays inside `root` once both are resolved. Callers pass
+ * resolved paths: a sibling directory (`<root>-evil`) and any `../` escape
+ * must be rejected — a bare string-prefix test admits both.
+ */
+function isWithin(root, candidate) {
+    if (candidate === root)
+        return true;
+    const separator = candidate.includes('\\') && !candidate.includes('/') ? '\\' : '/';
+    return candidate.startsWith(`${root}${separator}`);
 }
 /** Discover SKILL.md files under the suite's skills directory, up to 3 levels deep. */
 export async function discoverSkills(root, errors, declared) {
@@ -41,7 +59,7 @@ export async function discoverSkills(root, errors, declared) {
     const rootParsed = await parseOneSkill(rootSkill, root, rootName, errors);
     if (rootParsed !== undefined)
         skills.push(rootParsed);
-    const skillsDirs = declaredSkillDirs(root, declared);
+    const skillsDirs = await declaredSkillDirs(root, declared);
     if (skillsDirs.length === 0) {
         const fallback = join(root, 'skills');
         if (await isDirectory(fallback))
@@ -76,30 +94,62 @@ export async function discoverSkills(root, errors, declared) {
     }
     return skills;
 }
+/**
+ * Parse cache for SKILL.md files, keyed by path and stamped by mtime+size —
+ * a rescan of an unchanged tree re-stats files but skips re-reading and
+ * re-parsing thousands of frontmatters (CPU dominates large marketplaces).
+ * Results are immutable parse verdicts; rejections are re-reported to each
+ * scan's `errors` on hit. Bounded: over the cap the cache resets wholesale
+ * (a marketplace-scale tree holds thousands of entries, not millions).
+ */
+const SKILL_PARSE_CACHE_CAP = 20_000;
+const skillParseCache = new Map();
 async function parseOneSkill(file, directory, fallbackName, errors) {
-    if (!(await isFile(file)))
-        return undefined;
-    let text;
+    let info;
     try {
-        text = await readFile(file, 'utf8');
+        info = await stat(file);
+    }
+    catch {
+        return undefined;
     }
-    catch (error) {
-        errors.push(`skill "${fallbackName}": unreadable SKILL.md (${error instanceof Error ? error.message : String(error)})`);
+    if (!info.isFile())
         return undefined;
+    const stamp = { mtimeMs: info.mtimeMs, size: info.size };
+    const cached = skillParseCache.get(file);
+    let verdict;
+    if (cached !== undefined && cached.mtimeMs === stamp.mtimeMs && cached.size === stamp.size) {
+        verdict = cached.verdict;
+    }
+    else {
+        let text;
+        try {
+            text = await readFile(file, 'utf8');
+        }
+        catch (error) {
+            errors.push(`skill "${fallbackName}": unreadable SKILL.md (${error instanceof Error ? error.message : String(error)})`);
+            return undefined;
+        }
+        const parsed = parseSkillFrontmatter(text, undefined);
+        verdict =
+            typeof parsed === 'string'
+                ? parsed
+                : {
+                    name: parsed.name,
+                    directory,
+                    file,
+                    description: parsed.description,
+                    ...(parsed.whenToUse === undefined ? {} : { whenToUse: parsed.whenToUse }),
+                    invocation: parsed.invocation
+                };
+        if (skillParseCache.size >= SKILL_PARSE_CACHE_CAP)
+            skillParseCache.clear();
+        skillParseCache.set(file, { ...stamp, verdict });
     }
-    const parsed = parseSkillFrontmatter(text, undefined);
-    if (typeof parsed === 'string') {
-        errors.push(`skill "${fallbackName}": ${parsed}`);
+    if (typeof verdict === 'string') {
+        errors.push(`skill "${fallbackName}": ${verdict}`);
         return undefined;
     }
-    return {
-        name: parsed.name,
-        directory,
-        file,
-        description: parsed.description,
-        ...(parsed.whenToUse === undefined ? {} : { whenToUse: parsed.whenToUse }),
-        invocation: parsed.invocation
-    };
+    return { ...verdict, directory };
 }
 /** Read the suite's MCP config: `mcp.json` or `.mcp.json`, else the winning manifest's inline `mcpServers`. */
 export async function discoverMcp(root, errors) {
@@ -126,22 +176,22 @@ export async function discoverMcp(root, errors) {
     errors.push(...result.errors);
     return result.config;
 }
-/** Count surfaces for a suite; mcp counts only validated servers. */
-export async function countSurfaces(root, skills, mcp) {
+/** Count surfaces for a suite; mcp counts only validated servers, lsp counts inline servers plus directory entries. */
+export async function countSurfaces(root, skills, mcp, lsp) {
     let hooks = 0;
     for (const relative of [join('hooks', 'hooks.json'), 'hooks.json']) {
         hooks += await countHookEntries(join(root, relative));
     }
     const commands = (await listMdFiles(join(root, 'commands'))).length;
     const agents = (await listMdFiles(join(root, 'agents'))).length;
-    const lsp = (await discoverLspEntries(root)).length;
+    const lspCount = Object.keys(lsp?.servers ?? {}).length + (await discoverLspEntries(root)).length;
     return {
         skills: skills.length,
         mcp: mcp === undefined ? 0 : Object.keys(mcp.servers).length,
         hooks,
         commands,
         agents,
-        lsp
+        lsp: lspCount
     };
 }
 /** LSP definitions: `.claude-plugin/lsp/*.json` plus reverse-domain `lsp/` dirs. */

package/lib/contracts/lsp-status.js

@@ -0,0 +1,2 @@
+/** Browser-safe LSP status records shared by host aggregation and client rendering. */
+export {};

package/lib/contracts/market.js

@@ -5,12 +5,15 @@ export const MARKET_API_PREFIX = '/api/agent-plugins/';
 export const MARKET_ROUTES = {
     overview: `${MARKET_API_PREFIX}overview`,
     mcpStatus: `${MARKET_API_PREFIX}mcp-status`,
+    lspStatus: `${MARKET_API_PREFIX}lsp-status`,
+    lspServers: `${MARKET_API_PREFIX}lsp-servers`,
     progress: `${MARKET_API_PREFIX}progress`,
     config: `${MARKET_API_PREFIX}config`,
     suite: `${MARKET_API_PREFIX}suite`,
     skill: `${MARKET_API_PREFIX}skill`,
     addSource: `${MARKET_API_PREFIX}sources/add`,
     updateSource: `${MARKET_API_PREFIX}sources/update`,
+    adoptSource: `${MARKET_API_PREFIX}sources/adopt`,
     removeSource: `${MARKET_API_PREFIX}sources/remove`,
     refreshSource: `${MARKET_API_PREFIX}sources/refresh`,
     install: `${MARKET_API_PREFIX}install`,
@@ -18,7 +21,11 @@ export const MARKET_ROUTES = {
     setEnabled: `${MARKET_API_PREFIX}set-enabled`,
     setSurface: `${MARKET_API_PREFIX}set-surface`,
     mcpOverrides: `${MARKET_API_PREFIX}mcp-overrides`,
-    setMcpOverride: `${MARKET_API_PREFIX}set-mcp-override`
+    setMcpOverride: `${MARKET_API_PREFIX}set-mcp-override`,
+    mcpRetry: `${MARKET_API_PREFIX}mcp-retry`,
+    mcpReauthorize: `${MARKET_API_PREFIX}mcp-reauthorize`,
+    mcpBackend: `${MARKET_API_PREFIX}mcp-backend`,
+    setMcpBackend: `${MARKET_API_PREFIX}set-mcp-backend`
 };
 /** Build a suite-detail URL without duplicating route or query encoding logic. */
 export function suiteRoute(sourceId, suiteId) {

package/lib/index.js

@@ -1,15 +1,24 @@
 import { Catalog } from './application/catalog.js';
 import { RuntimeReconciler } from './runtime/reconciler.js';
 import { inspectToolRegistry } from './runtime/tool-registry-observer.js';
-import { resolveDataRoot, resolveUserRoot } from './catalog/paths.js';
+import { migrateLegacyDataRoot } from './catalog/legacy-root-migration.js';
+import { resolveDataRoot, resolveDshHome, resolveUserRoot } from './catalog/paths.js';
+import { join } from 'node:path';
 import { mountSuiteRoutes } from './routes.js';
+import { MCP_SETTINGS_NAMESPACE, MarketSettingsSchema, readMcpBackend } from './runtime/mcp-backend.js';
+import { narrowDownloadRegion } from './runtime/regions.js';
 import { SuiteSkillProvider } from './runtime/skills-provider.js';
+import { loadLspServers } from './runtime/lsp-direct-config.js';
 import { bindHostLocale, loadHostLocale } from './runtime/host-locale.js';
 export const name = 'dsh-agent-plugins-market';
 export const inject = ['skills', 'commands'];
 export function apply(ctx, config = {}) {
     const userRoot = resolveUserRoot(config.userRoot);
-    const dataRoot = resolveDataRoot(config.dataRoot);
+    const dataRoot = resolveDataRoot(config.dataRoot, userRoot);
+    // The pre-0.5.4 layout kept a sibling `agent-plugins-data` root; fold it in.
+    void migrateLegacyDataRoot(join(resolveDshHome(), 'agent-plugins-data'), dataRoot).catch(error => {
+        ctx.logger?.warn?.(`[dsh-agent-plugins-market] legacy data-root migration failed: ${String(error)}`);
+    });
     let providerControl;
     // Host runtime copy resolves from the harness `locale.preference` setting;
     // the async settings read lands before the first session starts in practice.
@@ -20,14 +29,17 @@ export function apply(ctx, config = {}) {
     });
     const hostLocale = { t };
     const runtime = new RuntimeReconciler(ctx, dataRoot, key => hostLocale.t(key));
-    const reconcileMounts = () => {
-        void (async () => {
+    const reconcileMounts = async () => {
+        try {
             const snapshot = await catalog.readUserCatalog();
             const diagnostics = await runtime.reconcile(snapshot.enabledSuites);
             catalog.mcpDiagnostics = diagnostics.mcp;
             for (const diagnostic of diagnostics.mcp) {
                 ctx.logger?.warn(`[dsh-agent-plugins-market] suite "${diagnostic.suiteId}" mcp server "${diagnostic.serverKey}": ${diagnostic.reason}`);
             }
+            for (const diagnostic of diagnostics.lsp) {
+                ctx.logger?.warn(`[dsh-agent-plugins-market] suite "${diagnostic.suiteId}" lsp server "${diagnostic.serverKey}": ${diagnostic.reason}`);
+            }
             for (const diagnostic of diagnostics.commands) {
                 if (diagnostic.reason !== '')
                     ctx.logger?.warn(`[dsh-agent-plugins-market] suite "${diagnostic.suiteId}" command "${diagnostic.command}": ${diagnostic.reason}`);
@@ -38,23 +50,111 @@ export function apply(ctx, config = {}) {
             for (const error of diagnostics.errors) {
                 ctx.logger?.warn(`[dsh-agent-plugins-market] ${error.surface} reconcile failed: ${error.reason}`);
             }
-        })().catch(error => {
+        }
+        catch (error) {
             ctx.logger?.warn(`[dsh-agent-plugins-market] runtime reconcile failed: ${error instanceof Error ? error.message : String(error)}`);
-        });
+            throw error;
+        }
     };
-    const onChanged = () => {
+    /**
+     * Coalesce credential updates.
+     *
+     * `runtime.usesCredential(ref)` reflects the last completed pass, so an event
+     * arriving while the first reconcile is still running would be filtered out
+     * and the remount lost. Pending refs are therefore kept until the next pass
+     * observes them, and bursts are collapsed into one reconcile.
+     */
+    const pendingCredentialRefs = new Set();
+    let credentialFlush;
+    const flushCredentialUpdates = () => {
+        credentialFlush = undefined;
+        const refs = [...pendingCredentialRefs];
+        pendingCredentialRefs.clear();
+        // Re-read the catalog first: an unknown ref means the snapshot predates
+        // this change, so reconcile anyway to refresh the known reference set.
+        void reconcileMounts().catch(() => { });
+        if (refs.length > 0) {
+            ctx.logger?.info?.(`[dsh-agent-plugins-market] reconciling after credential update: ${refs.join(', ')}`);
+        }
+    };
+    const onChanged = async () => {
         providerControl?.invalidate();
-        reconcileMounts();
+        await reconcileMounts();
     };
-    const catalog = new Catalog({ userRoot, dataRoot, onChanged });
+    // The credential store powers the MCP re-authorize action (dropping a grant
+    // record forces the next mount through a fresh browser authorization).
+    // Resolved lazily at call time: this plugin's apply may run before the
+    // credentials plugin provisions, and a snapshot taken here would be
+    // permanently undefined even after the service is live.
+    const catalog = new Catalog({ userRoot, dataRoot, onChanged, ...(config.git === undefined ? {} : { git: config.git }) });
+    // Mirror oauth.ts's `credentialIdFor`: the record is stored under the folded
+    // serverName, so the delete must fold the same way or it misses the record.
+    const credentialIdFor = (serverName) => serverName
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '') || 'server';
+    catalog.setCredentialsStore({
+        deleteGrantRecord: async (serverName) => {
+            const store = ctx.get?.('credentials');
+            if (store?.deleteRecord === undefined)
+                throw new Error('credentials service is not mounted');
+            await store.deleteRecord(`mcp-auth/${credentialIdFor(serverName)}`);
+        }
+    });
     runtime.setMcpOverridesProvider(() => catalog.allMcpOverrides());
+    // Re-authorize must rebuild the live bridge, not just drop the grant: the
+    // registry flags the mount and the following reconcile tears it down and
+    // remounts, so the server's 401 restarts the browser authorization.
+    catalog.setMcpRemountHook((suiteId, serverKey) => runtime.forceMcpRemount(suiteId, serverKey), serverName => runtime.mcpServerOwner(serverName));
+    catalog.setLspStatusSource(runtime.lsp);
+    runtime.lsp.setDirectProvider(async () => (await loadLspServers(dataRoot)).servers);
+    // The MCP backend choice is a host settings namespace (the registration is
+    // also what makes the plugin-config tab serve our card). The node half owns
+    // it: the provider derives the mount backend from the scope, the writer
+    // flips the switch, and the watcher remounts servers when it flips.
+    ctx.inject(['settings'], settingsCtx => {
+        const settings = settingsCtx.settings;
+        const scope = settings.register(MCP_SETTINGS_NAMESPACE, MarketSettingsSchema, {
+            base: { mcpEnhanced: true, downloadRegion: 'auto' }
+        });
+        catalog.setMcpBackendProvider(async () => (scope.get().mcpEnhanced === false ? 'host' : 'builtin'));
+        catalog.setMcpBackendWriter(async (backend) => {
+            await scope.update({ mcpEnhanced: backend !== 'host' });
+        });
+        catalog.setDownloadRegionProvider(async () => narrowDownloadRegion(scope.get().downloadRegion));
+        // One-time migration from the earlier data-root settings.json choice.
+        void readMcpBackend(dataRoot).then(backend => {
+            if (backend === 'host')
+                void scope.update({ mcpEnhanced: false }).catch(() => { });
+        });
+        scope.watch(() => {
+            void reconcileMounts().catch(() => { });
+        });
+    });
+    runtime.setMcpBackendProvider(() => catalog.mcpBackend());
+    const eventHost = ctx;
+    const disposeCredentialUpdates = eventHost.on?.('credentials/reference-updated', ref => {
+        pendingCredentialRefs.add(ref);
+        if (credentialFlush !== undefined)
+            clearTimeout(credentialFlush);
+        credentialFlush = setTimeout(flushCredentialUpdates, 150);
+        credentialFlush.unref?.();
+    }) ?? (() => { });
     ctx.inject(['tools'], toolsCtx => {
-        catalog.setMcpToolSnapshotProvider(() => inspectToolRegistry(toolsCtx.tools));
+        const registry = toolsCtx.tools;
+        catalog.setMcpToolSnapshotProvider(() => inspectToolRegistry(registry));
+        // Foreign-namespace guard: a native host MCP client (or another plugin)
+        // owning `mcp__<serverName>__` names makes the mount registry skip its
+        // own server with a clear diagnostic instead of failing mid-registration.
+        runtime.setMcpToolNamesProvider(() => inspectToolRegistry(registry).map(tool => tool.name));
     });
-    void catalog.load().then(async () => {
+    void catalog
+        .load()
+        .then(async () => {
         await catalog.mergeSources(config.sources ?? []);
-        reconcileMounts();
-    });
+        await reconcileMounts();
+    })
+        .catch(() => { });
     ctx.skills.registerProvider(control => {
         providerControl = control;
         return new SuiteSkillProvider(catalog, key => hostLocale.t(key));
@@ -63,6 +163,11 @@ export function apply(ctx, config = {}) {
         hostCtx.effect(() => mountSuiteRoutes(hostCtx, catalog), 'dsh-agent-plugins-market: http routes');
     });
     ctx.effect(() => () => {
+        disposeCredentialUpdates();
+        if (credentialFlush !== undefined)
+            clearTimeout(credentialFlush);
+        credentialFlush = undefined;
+        pendingCredentialRefs.clear();
         void runtime.dispose();
     }, 'dsh-agent-plugins-market: lifecycle');
 }

package/lib/model/state.js

@@ -38,7 +38,20 @@ function normalizeState(record) {
                 return [];
             const branch = typeof source['branch'] === 'string' ? source['branch'] : undefined;
             const local = source['local'] === true;
-            return [{ id, url, ...(branch === undefined ? {} : { branch }), ...(local ? { local: true } : {}) }];
+            const kind = source['kind'] === 'git' || source['kind'] === 'local' || source['kind'] === 'archive' ? source['kind'] : undefined;
+            const sha256 = typeof source['sha256'] === 'string' && source['sha256'] !== '' ? source['sha256'] : undefined;
+            const adopted = source['adopted'] === true;
+            return [
+                {
+                    id,
+                    url,
+                    ...(branch === undefined ? {} : { branch }),
+                    ...(local ? { local: true } : {}),
+                    ...(kind === undefined ? {} : { kind }),
+                    ...(sha256 === undefined ? {} : { sha256 }),
+                    ...(adopted ? { adopted: true } : {})
+                }
+            ];
         })
         : [];
     const installed = {};

package/lib/model/types.js

@@ -7,8 +7,26 @@
  * Codex `.codex-plugin/plugin.json`). Discovery maps every layout onto this
  * internal shape; runtime injection consumes only the internal shape.
  */
+/** Archive URL extensions the archive acquisition path understands. */
+const ARCHIVE_URL_PATTERN = /\.(zip|tgz|tar\.gz|tar)$/i;
+/** Whether a URL points at a downloadable archive. */
+export function isArchiveUrl(url) {
+    return ARCHIVE_URL_PATTERN.test(url.trim());
+}
+/**
+ * Effective acquisition kind of a source: the explicit `kind` wins, the
+ * legacy `local` flag maps to `'local'`, archive-shaped URLs infer
+ * `'archive'`, and everything else stays `'git'`.
+ */
+export function resolveSourceKind(source) {
+    if (source.local === true || source.kind === 'local')
+        return 'local';
+    if (source.kind === 'git' || source.kind === 'archive')
+        return source.kind;
+    return isArchiveUrl(source.url) ? 'archive' : 'git';
+}
 /** The full set of toggleable surfaces, in display order. */
-export const SUITE_SURFACE_KEYS = ['skills', 'mcp', 'hooks', 'commands', 'agents'];
+export const SUITE_SURFACE_KEYS = ['skills', 'mcp', 'hooks', 'commands', 'agents', 'lsp'];
 /** Merge user overrides over the enabled default into the effective surface set. */
 export function effectiveSurfaces(overrides) {
     return {
@@ -16,6 +34,7 @@ export function effectiveSurfaces(overrides) {
         mcp: overrides?.mcp !== false,
         hooks: overrides?.hooks !== false,
         commands: overrides?.commands !== false,
-        agents: overrides?.agents !== false
+        agents: overrides?.agents !== false,
+        lsp: overrides?.lsp !== false
     };
 }

package/lib/routes.js

@@ -50,6 +50,12 @@ export function mountSuiteRoutes(hostCtx, manager) {
     get(MARKET_ROUTES.mcpStatus, async (_request, response) => {
         sendJson(response, 200, await manager.mcpStatus());
     });
+    get(MARKET_ROUTES.lspStatus, async (_request, response) => {
+        sendJson(response, 200, await manager.lspStatus());
+    });
+    get(MARKET_ROUTES.lspServers, async (_request, response) => {
+        sendJson(response, 200, { lspServers: await manager.lspServers() });
+    });
     get(MARKET_ROUTES.progress, async (_request, response) => {
         sendJson(response, 200, manager.sourceProgress());
     });
@@ -97,11 +103,20 @@ export function mountSuiteRoutes(hostCtx, manager) {
             if (!url.startsWith('~/') && url !== '~' && !isAbsolute(expanded))
                 throw new Error('local source url must be an absolute path or start with ~/');
         }
+        const kind = parseSourceKind(body['kind']);
+        if (kind === 'local' && !local) {
+            const expanded = expandHome(url);
+            if (!url.startsWith('~/') && url !== '~' && !isAbsolute(expanded))
+                throw new Error('local source url must be an absolute path or start with ~/');
+        }
         const branch = body['branch'];
+        const sha256 = parseSha256(body['sha256']);
         const source = await manager.addSource({
-            url: local ? expandHome(url) : url,
+            url: local || kind === 'local' ? expandHome(url) : url,
             ...(typeof branch === 'string' && branch.trim() !== '' ? { branch: branch.trim() } : {}),
-            ...(local ? { local: true } : {})
+            ...(local ? { local: true } : {}),
+            ...(kind === undefined ? {} : { kind }),
+            ...(sha256 === undefined ? {} : { sha256 })
         });
         return { source };
     });
@@ -120,9 +135,24 @@ export function mountSuiteRoutes(hostCtx, manager) {
             patch.branch = String(body['branch']).trim();
         if (body['local'] !== undefined)
             patch.local = body['local'] === true;
+        const kind = parseSourceKind(body['kind']);
+        if (kind !== undefined)
+            patch.kind = kind;
+        const sha256 = parseSha256(body['sha256']);
+        if (sha256 !== undefined)
+            patch.sha256 = sha256;
         await manager.updateSource(id, patch);
         return {};
     });
+    // Register one unmanaged `.sources/` checkout in place — the manual-clone
+    // repair path. Nothing is cloned, moved, or deleted.
+    post(MARKET_ROUTES.adoptSource, async (body) => {
+        const id = body['id'];
+        if (typeof id !== 'string' || id === '')
+            throw new Error('missing checkout id');
+        const source = await manager.adoptSource(id);
+        return { source };
+    });
     post(MARKET_ROUTES.removeSource, async (body) => {
         const id = body['id'];
         if (typeof id !== 'string' || id === '')
@@ -165,13 +195,15 @@ export function mountSuiteRoutes(hostCtx, manager) {
         return {};
     });
     get(MARKET_ROUTES.mcpOverrides, async (request, response) => {
-        const suiteId = queryOf(request).get('suiteId');
-        if (suiteId === null) {
-            sendJson(response, 400, { ok: false, error: 'missing suiteId' });
+        const query = queryOf(request);
+        const sourceId = query.get('sourceId');
+        const suiteId = query.get('suiteId');
+        if (sourceId === null || suiteId === null) {
+            sendJson(response, 400, { ok: false, error: 'missing sourceId or suiteId' });
             return;
         }
         try {
-            sendJson(response, 200, { ok: true, overrides: await manager.mcpOverrides(suiteId) });
+            sendJson(response, 200, { ok: true, overrides: await manager.mcpOverrides(sourceId, suiteId) });
         }
         catch (error) {
             sendJson(response, 404, { ok: false, error: error instanceof Error ? error.message : String(error) });
@@ -189,6 +221,39 @@ export function mountSuiteRoutes(hostCtx, manager) {
         await manager.setMcpOverride(sourceId, suiteId, serverKey, sanitized ?? null);
         return {};
     });
+    // Manual MCP reconcile: retries failed mounts and clears residual tools
+    // without touching any catalog state.
+    post(MARKET_ROUTES.mcpRetry, async () => {
+        await manager.retryMounts();
+        return {};
+    });
+    // Drop one server's OAuth grant record: the next mount re-runs the browser
+    // authorization, which is how a user widens a too-narrow scope.
+    post(MARKET_ROUTES.mcpReauthorize, async (body) => {
+        const serverName = body['serverName'];
+        if (typeof serverName !== 'string' || serverName === '')
+            throw new Error('serverName is required');
+        await manager.reauthorizeMcpServer(serverName);
+        return {};
+    });
+    // The MCP backend block: which client mounts suite servers, and whether the
+    // host's dsh-mcp-client is resolvable as the compatibility option.
+    get(MARKET_ROUTES.mcpBackend, async (_request, response) => {
+        sendJson(response, 200, await manager.mcpBackendInfo());
+    });
+    post(MARKET_ROUTES.setMcpBackend, async (body) => {
+        const backend = body['backend'];
+        if (backend !== 'builtin' && backend !== 'host')
+            throw new Error('backend must be "builtin" or "host"');
+        await manager.setMcpBackend(backend);
+        return await manager.mcpBackendInfo();
+    });
+    // Validate and persist the user's direct LSP server table; the reconcile
+    // pass picks it up and mounts it alongside the suite declarations.
+    post(MARKET_ROUTES.lspServers, async (body) => {
+        const servers = await manager.setLspServers(body['lspServers']);
+        return { lspServers: servers };
+    });
     return () => {
         for (const dispose of disposers)
             dispose();
@@ -203,6 +268,23 @@ function parseTarget(body) {
         throw new Error('missing suiteId');
     return { sourceId, suiteId };
 }
+/** Parse an optional acquisition-kind field; rejects unknown values. */
+function parseSourceKind(raw) {
+    if (raw === undefined || raw === null || raw === '')
+        return undefined;
+    if (raw === 'git' || raw === 'local' || raw === 'archive')
+        return raw;
+    throw new Error(`invalid source kind "${String(raw)}"`);
+}
+/** Parse an optional SHA-256 hex digest; rejects malformed values. */
+function parseSha256(raw) {
+    if (raw === undefined || raw === null || raw === '')
+        return undefined;
+    const value = String(raw).trim().toLowerCase();
+    if (!/^[0-9a-f]{64}$/.test(value))
+        throw new Error('sha256 must be a 64-character hex digest');
+    return value;
+}
 function sameOrigin(request) {
     const origin = request.headers['origin'];
     if (origin === undefined)

package/lib/runtime/commands-mounts.js

@@ -14,6 +14,7 @@ import { readFile, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 import { parseSkillFrontmatter, stripFrontmatter } from '../catalog/skills-parse.js';
+import { qualifiedSuiteId } from '../catalog/paths.js';
 import { bindHostLocale } from './host-locale.js';
 const COMMAND_NAME = /^[a-z][a-z0-9_-]*$/;
 export class CommandMountRegistry {
@@ -36,8 +37,11 @@ export class CommandMountRegistry {
                     ...(suite.activeSurfaces?.agents === false ? [] : await readAgents(suite.root, this.t))
                 ];
             for (const spec of specs) {
-                const key = `${suite.id}/${spec.name}`;
-                wanted.set(key, { ...spec, suiteId: suite.id, suiteName: suite.manifest.name });
+                // The registry key is source-qualified: bare suite ids are unique per
+                // source only, so two sources' same-named suites would collide.
+                const suiteKey = qualifiedSuiteId(suite.sourceId, suite.id);
+                const key = `${suiteKey}/${spec.name}`;
+                wanted.set(key, { ...spec, suiteId: suiteKey, suiteName: suite.manifest.name });
             }
         }
         for (const [key, disposer] of [...this.live]) {

package/lib/runtime/hooks-mounts.js

@@ -12,6 +12,7 @@
  */
 import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
+import { qualifiedSuiteId } from '../catalog/paths.js';
 export class HooksMountRegistry {
     ctx;
     live = new Map();
@@ -22,18 +23,20 @@ export class HooksMountRegistry {
     async reconcile(enabledSuites) {
         const diagnostics = [];
         const active = enabledSuites.filter(suite => suite.activeSurfaces?.hooks !== false);
-        const wanted = new Set(active.map(suite => suite.id));
+        // Keys are the qualified suite id: bare ids are unique per source only.
+        const wanted = new Set(active.map(suite => qualifiedSuiteId(suite.sourceId, suite.id)));
         for (const [suiteId, handle] of [...this.live]) {
             if (!wanted.has(suiteId)) {
                 await this.unmount(suiteId, handle);
             }
         }
         for (const suite of active) {
-            if (this.live.has(suite.id))
+            const key = qualifiedSuiteId(suite.sourceId, suite.id);
+            if (this.live.has(key))
                 continue;
-            const reason = await this.mount(suite);
+            const reason = await this.mount(key, suite);
             if (reason !== undefined)
-                diagnostics.push({ suiteId: suite.id, reason });
+                diagnostics.push({ suiteId: key, reason });
         }
         return diagnostics;
     }
@@ -43,7 +46,7 @@ export class HooksMountRegistry {
             await this.unmount(suiteId, handle);
         }
     }
-    async mount(suite) {
+    async mount(key, suite) {
         const configPath = await hookConfigPath(suite.root);
         if (configPath === undefined)
             return undefined;
@@ -63,7 +66,7 @@ export class HooksMountRegistry {
                 pluginRoot: suite.root
             });
             await handle.await();
-            this.live.set(suite.id, handle);
+            this.live.set(key, handle);
             return undefined;
         }
         catch (error) {