dsh-agent-plugins-market 0.6.0 → 0.6.2

package/lib/catalog/codex-mcp.js

@@ -0,0 +1,114 @@
+import { PLUGIN_DATA_VARIABLES, PLUGIN_ROOT_VARIABLES } from '../model/layouts.js';
+const FIELDS = new Set([
+    'command',
+    'args',
+    'env',
+    'env_vars',
+    'cwd',
+    'url',
+    'http_headers',
+    'env_http_headers',
+    'bearer_token_env_var',
+    'enabled',
+    'enabled_tools',
+    'disabled_tools',
+    'startup_timeout_sec',
+    'startup_timeout_ms',
+    'tool_timeout_sec'
+]);
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) && !(value instanceof Date);
+}
+function text(value, field) {
+    if (typeof value !== 'string' || value.trim() === '')
+        throw new Error(`${field} must be a non-empty string`);
+    return value;
+}
+function strings(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || !value.every(item => typeof item === 'string'))
+        throw new Error(`${field} must be an array of strings`);
+    return value;
+}
+function table(value, field) {
+    if (value === undefined)
+        return {};
+    if (!record(value) || !Object.values(value).every(item => typeof item === 'string'))
+        throw new Error(`${field} must be a string table`);
+    return value;
+}
+function reference(value, field) {
+    const name = text(value, field);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || PLUGIN_ROOT_VARIABLES.has(name) || PLUGIN_DATA_VARIABLES.has(name))
+        throw new Error(`${field} must name a non-reserved environment variable`);
+    return `\${${name}}`;
+}
+function timeout(value, field, factor) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0 || value * factor > 2_147_483_647)
+        throw new Error(`${field} must be a positive finite timeout within the timer range`);
+    return Math.max(1, Math.ceil(value * factor));
+}
+/** Unknown or malformed server options reject that server; other servers stay independently usable. */
+export function normalizeCodexMcp(raw, errors) {
+    const servers = Object.create(null);
+    for (const [name, value] of Object.entries(raw)) {
+        try {
+            if (!record(value))
+                throw new Error('server must be a table');
+            if (value.enabled !== undefined && typeof value.enabled !== 'boolean')
+                throw new Error('enabled must be a boolean');
+            if (value.enabled === false)
+                continue;
+            const unsupported = Object.keys(value).filter(key => !FIELDS.has(key));
+            if (unsupported.length > 0)
+                throw new Error(`unsupported fields: ${unsupported.join(', ')}`);
+            const enabledTools = strings(value.enabled_tools, 'enabled_tools');
+            const disabledTools = strings(value.disabled_tools, 'disabled_tools');
+            const startupTimeoutMs = value.startup_timeout_sec === undefined ? timeout(value.startup_timeout_ms, 'startup_timeout_ms', 1) : timeout(value.startup_timeout_sec, 'startup_timeout_sec', 1000);
+            const toolCallTimeoutMs = timeout(value.tool_timeout_sec, 'tool_timeout_sec', 1000);
+            const policy = {
+                ...(enabledTools === undefined ? {} : { enabledTools }),
+                ...(disabledTools === undefined ? {} : { disabledTools }),
+                ...(startupTimeoutMs === undefined ? {} : { startupTimeoutMs }),
+                ...(toolCallTimeoutMs === undefined ? {} : { toolCallTimeoutMs })
+            };
+            if (value.command !== undefined) {
+                if (['url', 'http_headers', 'env_http_headers', 'bearer_token_env_var'].some(key => value[key] !== undefined))
+                    throw new Error('HTTP options cannot be combined with a stdio command');
+                const inherited = Object.fromEntries((strings(value.env_vars, 'env_vars') ?? []).map(key => [key, reference(key, 'env_vars')]));
+                servers[name] = {
+                    ...policy,
+                    type: 'stdio',
+                    command: text(value.command, 'command'),
+                    args: strings(value.args, 'args') ?? [],
+                    env: { ...inherited, ...table(value.env, 'env') },
+                    ...(value.cwd === undefined ? {} : { cwd: text(value.cwd, 'cwd') })
+                };
+            }
+            else {
+                if (['args', 'env', 'env_vars', 'cwd'].some(key => value[key] !== undefined))
+                    throw new Error('stdio options cannot be combined with an HTTP endpoint');
+                const url = text(value.url, 'url');
+                if (!['https:', 'http:'].includes(new URL(url).protocol))
+                    throw new Error('url must use HTTP or HTTPS');
+                const headers = {
+                    ...table(value.http_headers, 'http_headers'),
+                    ...Object.fromEntries(Object.entries(table(value.env_http_headers, 'env_http_headers')).map(([key, variable]) => [key, reference(variable, 'env_http_headers')]))
+                };
+                if (value.bearer_token_env_var !== undefined) {
+                    if (Object.keys(headers).some(key => key.toLowerCase() === 'authorization'))
+                        throw new Error('bearer_token_env_var conflicts with an Authorization header');
+                    headers.Authorization = `Bearer ${reference(value.bearer_token_env_var, 'bearer_token_env_var')}`;
+                }
+                servers[name] = { ...policy, type: 'streamable-http', url, headers };
+            }
+        }
+        catch (error) {
+            errors.push(`Codex MCP server "${name}": ${error instanceof Error ? error.message : 'invalid configuration'}`);
+        }
+    }
+    return servers;
+}

package/lib/catalog/component-files.js

@@ -0,0 +1,151 @@
+/** Resolve declared component files once; all consumers use the same contained resource paths. */
+import { readFile, readdir, realpath, stat } from 'node:fs/promises';
+import { extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { PLUGIN_ROOT_VARIABLES } from '../model/layouts.js';
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Reject both lexical and symlink escapes. Optional defaults may be absent without a diagnostic. */
+export async function componentPath(root, value, errors, required = true) {
+    const clean = value.replace(/^\$\{([A-Z_]+)\}\//, (match, name) => (PLUGIN_ROOT_VARIABLES.has(name) ? './' : match));
+    const path = resolve(root, clean);
+    const rel = relative(resolve(root), path);
+    if (isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`)) {
+        errors.push(`component path ${value}: escapes the suite root`);
+        return undefined;
+    }
+    try {
+        const [base, target] = await Promise.all([realpath(root), realpath(path)]);
+        const actual = relative(base, target);
+        if (isAbsolute(actual) || actual === '..' || actual.startsWith(`..${sep}`)) {
+            errors.push(`component path ${value}: escapes the suite root through a symlink`);
+            return undefined;
+        }
+        return path;
+    }
+    catch {
+        if (required)
+            errors.push(`component path ${value}: missing or unreadable`);
+        return undefined;
+    }
+}
+/** Commands and agents may declare one file, several files, or recursive directories. */
+export async function discoverMarkdownResources(root, component, declaration, manifestPath, errors, extensions = ['.md']) {
+    const resources = [];
+    const seen = new Set();
+    const add = (resource) => {
+        const identity = `${resource.file}\0${resource.name}`;
+        if (!seen.has(identity)) {
+            seen.add(identity);
+            resources.push(resource);
+        }
+    };
+    async function visit(path, container) {
+        const valid = await componentPath(root, relative(root, path), errors);
+        if (valid === undefined)
+            return;
+        const info = await stat(valid);
+        if (info.isFile()) {
+            if (extensions.includes(extname(path)))
+                add({ name: relative(container, path).replace(/\\/g, '/').slice(0, -extname(path).length), file: path });
+            return;
+        }
+        if (!info.isDirectory())
+            return;
+        for (const entry of (await readdir(path, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+            if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.isSymbolicLink())
+                continue;
+            await visit(join(path, entry.name), container);
+        }
+    }
+    const declared = declaration === undefined ? [component] : Array.isArray(declaration) ? declaration : [declaration];
+    for (const item of declared) {
+        if (typeof item === 'string') {
+            const path = await componentPath(root, item, errors, declaration !== undefined);
+            if (path === undefined)
+                continue;
+            const info = await stat(path);
+            await visit(path, info.isDirectory() ? path : resolve(path, '..'));
+        }
+        else if (component === 'commands' && isRecord(item)) {
+            for (const [name, spec] of Object.entries(item)) {
+                if (!isRecord(spec) || (typeof spec.source !== 'string' && typeof spec.content !== 'string') || (spec.source !== undefined && spec.content !== undefined)) {
+                    errors.push(`commands.${name}: requires exactly one source or content`);
+                    continue;
+                }
+                if (typeof spec.source === 'string') {
+                    const file = await componentPath(root, spec.source, errors);
+                    if (file !== undefined)
+                        add({ name, file });
+                }
+                else {
+                    const metadata = Object.fromEntries(Object.entries(spec).filter(([key]) => !['source', 'content'].includes(key)));
+                    // JSON is a YAML subset, preserving command metadata without string-built YAML scalars.
+                    add({ name, file: manifestPath, content: `---\n${JSON.stringify(metadata)}\n---\n${spec.content}` });
+                }
+            }
+        }
+        else {
+            errors.push(`${component}: invalid component declaration`);
+        }
+    }
+    return resources;
+}
+/** A malformed declared file invalidates that configuration surface instead of falling back. */
+export async function componentDocuments(root, declaration, errors, allowDirectory = false) {
+    const result = [];
+    for (const item of Array.isArray(declaration) ? declaration : [declaration]) {
+        if (typeof item === 'string') {
+            const path = await componentPath(root, item, errors);
+            if (path === undefined)
+                return undefined;
+            if (allowDirectory && (await stat(path)).isDirectory()) {
+                const files = (await readdir(path))
+                    .filter(file => file.endsWith('.json'))
+                    .sort()
+                    .map(file => relative(root, join(path, file)));
+                const nested = await componentDocuments(root, files, errors);
+                if (nested === undefined)
+                    return undefined;
+                result.push(...nested);
+                continue;
+            }
+            try {
+                const value = JSON.parse(await readFile(path, 'utf8'));
+                if (!isRecord(value)) {
+                    errors.push(`${item}: configuration must be an object`);
+                    return undefined;
+                }
+                result.push({ path, value });
+            }
+            catch {
+                errors.push(`${item}: invalid JSON configuration`);
+                return undefined;
+            }
+        }
+        else if (isRecord(item)) {
+            result.push({ value: item });
+        }
+        else {
+            errors.push('invalid JSON component declaration');
+            return undefined;
+        }
+    }
+    return result;
+}
+export async function firstComponentFile(root, candidates) {
+    for (const path of candidates)
+        if ((await stat(join(root, path)).catch(() => undefined))?.isFile())
+            return path;
+    return undefined;
+}
+/** Legacy/native suites without catalog resource lists keep their conventional directory behavior. */
+export async function defaultMarkdownResources(root, component) {
+    return discoverMarkdownResources(root, component, undefined, '', []);
+}
+export async function resourceText(resource) {
+    return resource.content ?? (await readFile(resource.file, 'utf8'));
+}
+export function resourceCommandName(name) {
+    return name.replaceAll('/', '-').replaceAll('\\', '-').toLowerCase();
+}

package/lib/catalog/manifests.js

@@ -8,7 +8,10 @@
  * - claude-code: `.claude-plugin/plugin.json`;
  * - cursor: `.cursor-plugin/plugin.json`;
  * - kimi: `.kimi-plugin/plugin.json`;
- * - codex: `.codex-plugin/plugin.json`.
+ * - codex: `.codex-plugin/plugin.json`;
+ * - zcode: `.zcode-plugin/plugin.json`;
+ * - qoder: `.qoder-plugin/plugin.json`;
+ * - github-copilot: `.github/plugin/plugin.json`.
  *
  * The same repo can declare several dialects (e.g. vercel/vercel-plugin ships
  * all of them); a suite's identity comes from the highest-precedence dialect
@@ -19,26 +22,19 @@ import { readFile, stat } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { sanitizeId } from './paths.js';
 import { isRecognizedSchema, validatePluginManifest } from './validate.js';
-/** Dialect precedence: v1 wins over universal over claude over cursor over kimi over codex. */
-const KIND_PRECEDENCE = ['agent-plugin-v1', 'universal', 'claude-code', 'cursor', 'kimi', 'codex'];
-const MANIFEST_PATHS = {
-    'agent-plugin-v1': 'plugin.json',
-    universal: join('.plugin', 'plugin.json'),
-    'claude-code': join('.claude-plugin', 'plugin.json'),
-    cursor: join('.cursor-plugin', 'plugin.json'),
-    kimi: join('.kimi-plugin', 'plugin.json'),
-    codex: join('.codex-plugin', 'plugin.json')
-};
+import { PLUGIN_LAYOUTS, MANIFEST_ALIASES, MARKETPLACE_PATHS } from '../model/layouts.js';
 /** The highest-precedence manifest file a directory carries, if any. */
 export async function detectManifest(dir) {
-    for (const kind of KIND_PRECEDENCE) {
-        const path = join(dir, MANIFEST_PATHS[kind]);
-        try {
-            if ((await stat(path)).isFile())
-                return { kind, path };
-        }
-        catch {
-            // try the next dialect
+    for (const { kind, manifest } of PLUGIN_LAYOUTS) {
+        for (const relative of [...(MANIFEST_ALIASES[kind] ?? []), manifest]) {
+            const path = join(dir, relative);
+            try {
+                if ((await stat(path)).isFile())
+                    return { kind, path };
+            }
+            catch {
+                // try the next candidate
+            }
         }
     }
     return undefined;
@@ -51,6 +47,10 @@ export async function hasSuiteManifest(dir) {
 export function syntheticManifestName(root) {
     return root.split(/[\\/]/).at(-1) ?? 'plugin';
 }
+export function componentDeclarations(record) {
+    const value = record;
+    return Object.fromEntries(['skills', 'commands', 'agents', 'hooks', 'mcpServers', 'lspServers'].filter(key => value[key] !== undefined).map(key => [key, value[key]]));
+}
 /**
  * Parse one manifest document into a normalized SuiteManifest. The v1 dialect
  * is schema-validated (fail-closed); the others are structurally read with
@@ -68,7 +68,7 @@ export async function readManifest(root, errors, hint) {
         errors.push(`${candidate.path} unparsable: ${error instanceof Error ? error.message : String(error)}`);
         return undefined;
     }
-    if (typeof raw !== 'object' || raw === null) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
         errors.push(`${candidate.path}: manifest is not a JSON object`);
         return undefined;
     }
@@ -82,6 +82,30 @@ export async function readManifest(root, errors, hint) {
     // layout instead — strict validation only ever applies to manifests
     // that actually declare the v1 schema.
     const kind = candidate.kind === 'agent-plugin-v1' && !isRecognizedSchema(record.$schema) ? 'claude-code' : candidate.kind;
+    let fallbackComponents = {};
+    if (candidate.kind === 'agent-plugin-v1' && kind === 'claude-code') {
+        const path = join(root, '.claude-plugin/plugin.json');
+        let text;
+        try {
+            text = await readFile(path, 'utf8');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                errors.push(`${path}: component fallback is unreadable`);
+        }
+        if (text !== undefined) {
+            try {
+                const fallback = JSON.parse(text);
+                if (typeof fallback !== 'object' || fallback === null || Array.isArray(fallback))
+                    errors.push(`${path}: component fallback must be an object`);
+                else
+                    fallbackComponents = componentDeclarations(fallback);
+            }
+            catch {
+                errors.push(`${path}: invalid component fallback JSON`);
+            }
+        }
+    }
     const problems = kind === 'agent-plugin-v1' ? await validatePluginManifest(raw) : [];
     errors.push(...problems.map(problem => `${candidate.path}: ${problem}`));
     const name = pickString(record.name) ?? hint?.name ?? syntheticManifestName(root);
@@ -89,23 +113,26 @@ export async function readManifest(root, errors, hint) {
     const description = pickString(record.description) ?? hint?.description;
     const author = record.author;
     return {
-        layout: kind === 'agent-plugin-v1'
-            ? 'agent-plugin-v1'
-            : kind === 'universal'
-                ? 'universal'
-                : kind === 'claude-code'
-                    ? 'claude-code'
-                    : kind === 'cursor'
-                        ? 'cursor'
-                        : kind === 'kimi'
-                            ? 'kimi'
-                            : 'codex',
+        components: { ...componentDeclarations(hint ?? {}), ...fallbackComponents, ...componentDeclarations(raw) },
+        ...(typeof raw.skillInstructions === 'string' ? { skillInstructions: raw.skillInstructions } : {}),
+        ...(typeof raw.systemPrompt === 'string' ? { systemPrompt: raw.systemPrompt } : {}),
+        ...(typeof raw.systemPromptPath === 'string' ? { systemPromptPath: raw.systemPromptPath } : {}),
+        ...(typeof raw.sessionStart?.skill === 'string'
+            ? { startupSkill: raw.sessionStart.skill }
+            : {}),
+        layout: kind,
         path: candidate.path,
         id: sanitizeId(name),
         name,
         ...(version === undefined ? {} : { version }),
         ...(description === undefined ? {} : { description }),
-        ...(author?.name !== undefined ? { author: author.name } : pickString(record.homepage) !== undefined ? { author: pickString(record.homepage) } : {}),
+        ...(typeof record.author === 'string'
+            ? { author: record.author }
+            : author?.name !== undefined
+                ? { author: author.name }
+                : pickString(record.homepage) !== undefined
+                    ? { author: pickString(record.homepage) }
+                    : {}),
         keywords: Array.isArray(record.keywords) ? record.keywords.filter((entry) => typeof entry === 'string') : [],
         ...(isRecognizedSchema(record.$schema) ? { schemaVersion: record.$schema } : {})
     };
@@ -113,8 +140,6 @@ export async function readManifest(root, errors, hint) {
 function pickString(value) {
     return typeof value === 'string' && value !== '' ? value : undefined;
 }
-/** Marketplace manifest locations per dialect (Claude Code, Codex). */
-const MARKETPLACE_PATHS = ['.claude-plugin/marketplace.json', '.agents/plugins/marketplace.json'];
 /** Read one marketplace manifest file; malformed documents are diagnosed, not thrown. */
 async function readOneMarketplace(path, errors) {
     let text;
@@ -132,35 +157,71 @@ async function readOneMarketplace(path, errors) {
         errors.push(`marketplace ${path} unparsable: ${error instanceof Error ? error.message : String(error)}`);
         return undefined;
     }
-    if (typeof parsed !== 'object' || parsed === null) {
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
         errors.push(`marketplace ${path}: manifest is not a JSON object`);
         return undefined;
     }
     const record = parsed;
-    const plugins = record['plugins'];
-    if (!Array.isArray(plugins)) {
+    const rawPlugins = record['plugins'];
+    const plugins = Array.isArray(rawPlugins)
+        ? rawPlugins
+        : typeof rawPlugins === 'object' && rawPlugins !== null
+            ? Object.entries(rawPlugins).map(([name, entry]) => (typeof entry === 'object' && entry !== null && !Array.isArray(entry) ? { ...entry, name } : entry))
+            : undefined;
+    if (plugins === undefined) {
         errors.push(`marketplace ${path}: "plugins" is not an array`);
         return undefined;
     }
     return {
+        ...(typeof record.metadata?.pluginRoot === 'string' ? { pluginRoot: record.metadata.pluginRoot } : {}),
         ...(typeof record['name'] === 'string' ? { name: record['name'] } : {}),
-        entries: plugins,
+        entries: plugins
+            .map(entry => {
+            if (typeof entry !== 'object' || entry === null || Array.isArray(entry))
+                return entry;
+            const value = entry;
+            if (typeof value.id !== 'string')
+                return value;
+            const source = [value.source, value.url, value.downloadUrl].find(candidate => typeof candidate === 'string' && candidate.trim() !== '') ?? value.source;
+            return { ...value, name: value.id, description: value.description ?? value.shortDescription, source, layout: 'kimi' };
+        })
+            .filter((entry) => {
+            if (typeof entry !== 'object' || entry === null || Array.isArray(entry) || !('source' in entry)) {
+                errors.push(`marketplace ${path}: invalid plugin entry`);
+                return false;
+            }
+            const metadata = entry;
+            if (['name', 'version', 'description'].some(key => metadata[key] !== undefined && typeof metadata[key] !== 'string') ||
+                (typeof metadata.name === 'string' && metadata.name.trim() === '')) {
+                errors.push(`marketplace ${path}: invalid plugin entry metadata`);
+                return false;
+            }
+            return true;
+        }),
         path
     };
 }
 /**
  * Read every marketplace manifest the checkout carries, in dialect
- * precedence order (Claude Code before Codex). Both dialects can coexist
- * (e.g. a repo shipping one marketplace per agent); callers decide which
- * dialect's entries win, so no dialect is silently shadowed.
+ * precedence order shared with suite manifests, then the shared root catalog.
+ * The scan strategy selects the first catalog that produces suites; an empty
+ * or invalid catalog allows the next candidate to be tried.
  */
-export async function readMarketplaces(checkoutDir) {
+export async function readMarketplaces(checkoutDir, errors = []) {
     const results = [];
-    const errors = [];
     for (const relative of MARKETPLACE_PATHS) {
         const result = await readOneMarketplace(join(checkoutDir, relative), errors);
-        if (result !== undefined)
+        if (result !== undefined) {
+            const kind = PLUGIN_LAYOUTS.find(layout => layout.marketplaces.some(path => path === relative))?.kind;
+            for (const entry of result.entries) {
+                entry.layout ??= kind;
+                if (typeof entry.source === 'string' && /^https?:\/\//.test(entry.source))
+                    entry.source = { source: 'url', url: entry.source };
+                if (typeof entry.source === 'string' && result.pluginRoot !== undefined && !entry.source.startsWith('.'))
+                    entry.source = join(result.pluginRoot, entry.source);
+            }
             results.push(result);
+        }
     }
     return results;
 }

package/lib/catalog/native-project.js

@@ -1,35 +1,27 @@
 /**
  * Native project-layout discovery: read a coding agent's own project-local
- * directories (`.claude/`, `.agents/`) in place as read-only suites.
+ * directories from the shared layout registry in place as read-only suites.
  *
  * Migrating a repository from Claude Code / Codex / Cursor should not
  * require copying files into `.dsh/agent-plugins/`. For the layouts with a
- * project-local convention (Claude Code `.claude/`, agent-plugins
- * `.agents/`), the project dimension discovers each content-carrying child
+ * project-local convention, the project dimension discovers each content-carrying directory
  * as one synthetic suite so skills and agents reuse the ordinary injection
  * pipeline. The directories are the repository's own: they are never
  * installed, uninstalled, or mutated by this manager.
  */
 import { join } from 'node:path';
-import { isDirectory, sanitizeId } from './paths.js';
+import { stat } from 'node:fs/promises';
+import { sanitizeId } from './paths.js';
 import { countSurfaces, discoverSkills } from './surfaces.js';
+import { PROJECT_LAYOUTS } from '../model/layouts.js';
+import { discoverProjectMcp } from './project-config.js';
+import { discoverProjectHooks } from './project-hooks.js';
+import { discoverMarkdownResources } from './component-files.js';
 /**
  * Project-local directory conventions, in precedence order. Each entry maps
  * one agent convention onto the content subdirectories it owns.
  */
-export const NATIVE_PROJECT_DIRS = [
-    { dirName: '.claude', label: 'Claude Code', subdirs: ['skills', 'agents', 'commands'] },
-    { dirName: '.agents', label: 'agents', subdirs: ['skills', 'agents', 'commands'] }
-];
-/** A native project directory that carries no relevant content is skipped. */
-async function carriesContent(dir, projectRoot) {
-    for (const subdir of dir.subdirs) {
-        const path = join(projectRoot, dir.dirName, subdir);
-        if (await isDirectory(path))
-            return true;
-    }
-    return false;
-}
+export const NATIVE_PROJECT_DIRS = PROJECT_LAYOUTS;
 /**
  * Discover native project-layout suites under a project root. Each
  * convention directory that carries content becomes one synthetic suite;
@@ -38,10 +30,6 @@ async function carriesContent(dir, projectRoot) {
 export async function discoverNativeProjectSuites(projectRoot, dimension) {
     const suites = [];
     for (const native of NATIVE_PROJECT_DIRS) {
-        if (!(await isDirectory(join(projectRoot, native.dirName))))
-            continue;
-        if (!(await carriesContent(native, projectRoot)))
-            continue;
         const root = join(projectRoot, native.dirName);
         const id = sanitizeId(`${native.dirName}-native`);
         const manifest = {
@@ -52,20 +40,53 @@ export async function discoverNativeProjectSuites(projectRoot, dimension) {
             description: `Skills and agents read in place from the project's ${native.dirName}/ directory.`
         };
         const errors = [];
+        const lspFiles = [join(native.dirName, 'lsp.json'), join(native.dirName, '.lsp.json')];
+        if (native.dirName === '.claude')
+            lspFiles.push('.lsp.json');
+        if (native.dirName === '.github')
+            lspFiles.push('lsp.json');
+        for (const path of lspFiles) {
+            if ((await stat(join(projectRoot, path)).catch(() => undefined))?.isFile()) {
+                errors.push(`${path}: project LSP configuration is not mounted; the host LSP registry does not isolate projects`);
+            }
+        }
         // Skills live in `<dir>/skills/<name>/SKILL.md` — the same shape as the
         // ordinary skills container; agents/commands only surface as counts here
         // and are read by the runtime providers directly from the same files.
-        const skills = await discoverSkills(root, errors, 'skills');
-        const surfaces = await countSurfaces(root, skills, undefined);
+        const skills = await discoverSkills(root, errors);
+        const mcp = await discoverProjectMcp(projectRoot, native.mcpFiles ?? [], errors, native.mcpFormat);
+        const hooks = await discoverProjectHooks(projectRoot, native.hookFiles ?? [], errors, native.hookFormat);
+        const resources = {
+            commands: native.subdirs.includes('commands') ? await discoverMarkdownResources(root, 'commands', undefined, manifest.path, errors) : [],
+            agents: native.subdirs.includes('agents') ? await discoverMarkdownResources(root, 'agents', undefined, manifest.path, errors) : []
+        };
+        const surfaces = await countSurfaces(root, skills, mcp);
+        surfaces.commands = resources.commands.length;
+        surfaces.agents = resources.agents.length;
+        surfaces.hooks = Object.values(hooks?.events ?? {}).reduce((total, groups) => total + groups.reduce((count, group) => count + group.hooks.length, 0), 0);
+        surfaces.lsp = 0;
+        if (Object.values(surfaces).every(count => count === 0) && errors.length === 0)
+            continue;
         suites.push({
             sourceId: 'native',
             id,
             root,
             manifest,
             skills,
+            resources,
+            ...(mcp === undefined ? {} : { mcp }),
+            ...(hooks === undefined ? {} : { hooks }),
             surfaces,
             dimension,
             enabled: true,
+            activeSurfaces: {
+                skills: true,
+                commands: native.subdirs.includes('commands'),
+                agents: native.subdirs.includes('agents'),
+                mcp: mcp !== undefined,
+                hooks: hooks !== undefined,
+                lsp: false
+            },
             errors
         });
     }

package/lib/catalog/paths.js

@@ -29,17 +29,17 @@ export function expandHome(path) {
 export function resolveDshHome() {
     return process.env.DSH_HOME === undefined ? join(homedir(), '.dsh') : resolve(process.env.DSH_HOME);
 }
-/** Resolve the user-dimension suite root. */
-export function resolveUserRoot(configUserRoot) {
-    return resolve(expandHome(configUserRoot ?? join(resolveDshHome(), 'agent-plugins')));
+/** Resolve the canonical user-dimension root. Legacy overrides are migration inputs only. */
+export function resolveUserRoot(_configUserRoot) {
+    return join(resolveDshHome(), 'agent-plugins');
 }
 /**
  * Resolve the suite data root hosting `${PLUGIN_DATA}` directories and the
  * MCP overrides. Defaults under the user root so the whole plugin persists
- * into one directory; an explicit `dataRoot` config still wins.
+ * into one directory. Legacy overrides are migration inputs only.
  */
-export function resolveDataRoot(configDataRoot, configUserRoot) {
-    return resolve(expandHome(configDataRoot ?? join(configUserRoot ?? resolveUserRoot(), 'data')));
+export function resolveDataRoot(_configDataRoot, _configUserRoot) {
+    return join(resolveUserRoot(), 'data');
 }
 /** Resolve a project root from a workspace cwd: nearest ancestor with `.git`. */
 export async function findProjectRoot(cwd) {