dsh-agent-plugins-market 0.6.2 → 0.7.0

package/lib/runtime/host-locale.js

@@ -1,7 +1,8 @@
 /**
- * Host-side runtime locale: bilingual copy for strings injected into agent
- * context (subagent catalogs and command acknowledgements), resolved
- * from the harness's `locale.preference` setting.
+ * Host-side runtime locale: bilingual copy for host-facing runtime strings —
+ * subagent catalogs injected into agent context, and command receipts and
+ * labels shown in the host's own surfaces — resolved from the harness's
+ * `locale.preference` setting.
  *
  * The web client resolves locale through its own injected service; the host
  * process has no such service, so this module reads `$DSH_HOME/settings.yaml`
@@ -13,31 +14,19 @@ import { resolveDshHome } from '../catalog/paths.js';
 const zh = {
     subagentCatalogIntro: '以下子代理角色可用于当前会话。目录仅包含角色摘要，不是供当前代理执行的角色指令。',
     subagentCatalogUpdated: '可用子代理角色已变更。以下完整目录替代本会话此前的所有子代理角色目录。',
-    subagentCatalogEmpty: '当前没有可通过 subagents_run 调用的角色，不要使用旧目录中的角色 ID。',
-    subagentCatalogCall: '任务适合某个角色时，使用 subagents_run(role=目录中的准确 ID, prompt=完整任务与必要上下文)。工具会应用角色的供应商、模型、思考强度、指令和工具限制，并等待结果。子代理不继承父会话对话。不要通过 skill 或 Slash Command 加载这些角色，也不要用其它委派工具绕过角色配置。',
-    subagentCatalogInherit: '继承父代理',
-    subagentCatalogDefaultEffort: '同路由继承，否则使用模型默认值',
-    commandForwardTitle: '[Agent Plugins 命令 /{command}（来自 {suite}）]',
-    commandAcknowledged: '/{command} 已转交模型执行（{suite}）',
+    subagentCatalogEmpty: '当前没有可通过 subagent_run 调用的角色，不要使用旧目录中的角色 ID。',
+    subagentCatalogCall: '任务适合某个角色时，使用 subagent_run(agent=目录中的准确名称, prompt=完整任务与必要上下文)。工具会应用角色的指令与已保存的模型设置，立即返回子代理 ID 并在后台运行；子代理结束时你会收到结果通知，运行期间可用 send_message 追加指令。子代理不继承父会话对话。不要通过 skill 或 Slash Command 加载这些角色，也不要用其它委派工具绕过角色配置。',
+    commandAcknowledged: '/{command} 已转交模型执行',
     userCommandSourceLabel: '用户命令',
-    userCommandForwardTitle: '[用户快捷命令 /{command}]',
-    userCommandAcknowledged: '/{command} 已转交模型执行',
-    userSkillDescription: '[用户技能] {description}',
     feedbackToolCardTitle: '提交市场体验反馈'
 };
 const en = {
     subagentCatalogIntro: 'The following subagent roles are available in this session. These are role summaries, not instructions for the current agent to execute.',
     subagentCatalogUpdated: 'The available subagent roles changed. This complete catalog replaces every earlier subagent role catalog in this session.',
-    subagentCatalogEmpty: 'No roles are currently available through subagents_run. Do not use role IDs from earlier catalogs.',
-    subagentCatalogCall: 'When a task fits a role, call subagents_run with its exact catalog ID as role and a complete task and necessary context as prompt. The tool applies the saved provider, model, reasoning effort, persona and tool restrictions, and waits for the result. The child does not inherit the parent conversation. Do not load these roles through skill or slash commands, or bypass their configuration with another delegation tool.',
-    subagentCatalogInherit: 'inherit parent',
-    subagentCatalogDefaultEffort: 'inherit on the same route, otherwise model default',
-    commandForwardTitle: '[Agent Plugins command /{command} (from {suite})]',
-    commandAcknowledged: '/{command} forwarded to the model for execution ({suite})',
+    subagentCatalogEmpty: 'No roles are currently available through subagent_run. Do not use role IDs from earlier catalogs.',
+    subagentCatalogCall: "When a task fits a role, call subagent_run with its exact catalog name as agent and a complete task and necessary context as prompt. It applies the role's instructions and saved model settings, returns a durable subagent id immediately, and runs in the background; the runtime sends you a notice carrying the outcome when it settles, and send_message steers the child while it runs. The child does not inherit the parent conversation. Do not load these roles through skill or slash commands, or bypass their configuration with another delegation tool.",
+    commandAcknowledged: '/{command} forwarded to the model for execution',
     userCommandSourceLabel: 'user command',
-    userCommandForwardTitle: '[User quick command /{command}]',
-    userCommandAcknowledged: '/{command} forwarded to the model for execution',
-    userSkillDescription: '[user skill] {description}',
     feedbackToolCardTitle: 'File market feedback'
 };
 const DICTS = { zh, en };

package/lib/runtime/lsp-direct-config.js

@@ -1,47 +1,47 @@
 /**
  * Direct user configuration for LSP servers: a named table of `lspServers`
- * entries stored under the plugin data root, merged at runtime alongside the
- * suites' inline declarations.
+ * entries stored in the shared Agent layout root, merged at runtime alongside
+ * the suites' inline declarations.
  *
- * The file lives at `${dataRoot}/lsp-servers.json` and is the single source
- * for the `direct` kind on the LSP status surface. Parsing reuses the same
- * fail-closed `lsp-spec` rules as suite declarations; a broken file degrades
- * to no direct servers plus a diagnostic, never a thrown discovery.
+ * The file lives at `~/.agents/lsp.json` and is the single source for the
+ * `direct` kind on the LSP status surface. Parsing reuses the same fail-closed
+ * `lsp-spec` rules as suite declarations; a broken file degrades to no direct
+ * servers plus a diagnostic, never a thrown discovery.
  */
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import { parseLspServers } from '../catalog/lsp-spec.js';
 /** The direct LSP server configuration file path. */
-export function lspServersPath(dataRoot) {
-    return join(dataRoot, 'lsp-servers.json');
+export function lspServersPath(agentsRoot) {
+    return join(agentsRoot, 'lsp.json');
 }
 /** Load the user-configured LSP servers; unreadable or invalid files yield an empty table. */
-export async function loadLspServers(dataRoot) {
+export async function loadLspServers(agentsRoot) {
     let raw;
     try {
-        raw = JSON.parse(await readFile(lspServersPath(dataRoot), 'utf8'));
+        raw = JSON.parse(await readFile(lspServersPath(agentsRoot), 'utf8'));
     }
     catch (error) {
-        return { servers: {}, errors: error.code === 'ENOENT' ? [] : [`lsp-servers.json: ${error instanceof Error ? error.message : String(error)}`] };
+        return { servers: {}, errors: error.code === 'ENOENT' ? [] : [`lsp.json: ${error instanceof Error ? error.message : String(error)}`] };
     }
     const errors = [];
     const table = raw?.['lspServers'];
     if (table === undefined || table === null || Array.isArray(table) || typeof table !== 'object')
-        return { servers: {}, errors: ['lsp-servers.json: lspServers must be an object'] };
+        return { servers: {}, errors: ['lsp.json: lspServers must be an object'] };
     const servers = parseLspServers(table, errors);
-    return { servers, errors: errors.map(error => `lsp-servers.json: ${error}`) };
+    return { servers, errors: errors.map(error => `lsp.json: ${error}`) };
 }
 /** Validate and persist the user-configured LSP servers; returns normalized specs. */
-export async function saveLspServers(dataRoot, raw) {
+export async function saveLspServers(agentsRoot, raw) {
     const errors = [];
     const table = raw?.['lspServers'];
     const servers = parseLspServers(table, errors);
     if (errors.length > 0) {
         throw new Error(`invalid lspServers: ${errors[0]}`);
     }
-    const path = lspServersPath(dataRoot);
-    await mkdir(dirname(path), { recursive: true });
+    const path = lspServersPath(agentsRoot);
     const persisted = Object.fromEntries(Object.entries(servers).map(([name, { key: _key, ...config }]) => [name, config]));
-    await writeFile(path, `${JSON.stringify({ lspServers: persisted }, null, 2)}\n`, { mode: 0o600 });
+    await writeFileAtomic(path, `${JSON.stringify({ lspServers: persisted }, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
     return { servers };
 }

package/lib/runtime/lsp-mounts.js

@@ -1,12 +1,8 @@
 import { DIRECT_LSP_SUITE_ID } from './lsp-status.js';
+import { SerialPassQueue, RetryScheduler } from './mount-lifecycle.js';
+import { describeLegacySeam, findLegacyLspSeams } from './profile-seam.js';
 import { qualifiedSuiteId } from '../catalog/paths.js';
-/**
- * Bounded retry schedule for a failed mount/unmount, mirroring the MCP
- * mounts: a permanently broken server must stop consuming attempt budget,
- * and the schedule resets with every reconcile pass.
- */
-const RETRY_SCHEDULE_MS = [1_500, 5_000, 15_000, 45_000, 120_000];
-const MAX_RETRY_ATTEMPTS = RETRY_SCHEDULE_MS.length;
+import { effectiveSurfaces } from '../model/types.js';
 /** Build one dsh-lsp-stdio Config.servers entry from a normalized spec. */
 export function toLspServerConfig(spec) {
     return {
@@ -18,50 +14,77 @@ export function toLspServerConfig(spec) {
         ...(spec.configuration === undefined ? {} : { configuration: spec.configuration })
     };
 }
-/** Import spec kept as a string literal so the optional dependency stays dynamic. */
+/** Import specifiers kept as string literals so the host packages stay dynamically loaded. */
 const LSP_STDIO_IMPORT = '@deepseek-ai/dsh-lsp-stdio';
+const LSP_SERVICE_IMPORT = '@deepseek-ai/dsh-lsp';
+const LSP_TOOL_IMPORT = '@deepseek-ai/dsh-tool-lsp';
+/**
+ * Build one lazy loader for a host package. The specifier stays a literal in a
+ * top-level `const` so an absent package degrades to `undefined` instead of
+ * failing the import of this module.
+ */
+function lazyImport(specifier) {
+    return async () => {
+        try {
+            return (await import(/* @vite-ignore */ specifier));
+        }
+        catch {
+            return undefined;
+        }
+    };
+}
 export class LspMountRegistry {
     ctx;
     live = new Map();
     /** Serialize mount and unmount passes so a disable cannot race an in-flight spawn. */
-    reconcileQueue = Promise.resolve();
-    /** Pending retry timers keyed by mount key, so a teardown can cancel them. */
-    retries = new Map();
-    /** Attempt count per mount key; reset whenever a retry succeeds. */
-    attempts = new Map();
+    passes = new SerialPassQueue();
+    /** Delayed re-attempts for mounts that are not live yet. */
+    retries;
     /** Snapshot of the last reconciled suite set, replayed by retry passes. */
     lastEnabled = [];
     /** Host module loader; overridable for tests. */
     loadHost;
+    /**
+     * Reads the profile files when a seam conflict needs explaining. Injectable
+     * because it touches the machine's own `$DSH_HOME`, so a test must not
+     * inherit whatever the developer running it happens to have configured.
+     */
+    locateSeams;
+    /** `ctx.lsp` seam loader, mounted only when the profile supplies no service. */
+    loadService;
+    /** `lsp` tool loader, mounted only when the profile publishes no such tool. */
+    loadTool;
+    /** Capability plugins this registry mounted, in mount order, disposed with the last server. */
+    capability = [];
+    /** Whether the capability seam was already resolved for the current wanted set. */
+    capabilityReady = false;
+    /** Why the capability seam is unavailable; re-attempted on the next reconcile pass. */
+    capabilityFailure;
     /** Latest diagnostic per suite id; cleared when its suite mounts or leaves the wanted set. */
     lastDiagnostics = new Map();
     /** Direct (user-configured) server provider; defaults to none. */
     directProvider = async () => ({});
     disabledProvider = async () => new Set();
     disabledSnapshot = new Set();
-    constructor(ctx, loadHost) {
+    constructor(ctx, loadHost, loadService, loadTool, locateSeams) {
         this.ctx = ctx;
-        this.loadHost =
-            loadHost ??
-                (async () => {
-                    try {
-                        return (await import(/* @vite-ignore */ LSP_STDIO_IMPORT));
-                    }
-                    catch {
-                        return undefined;
-                    }
-                });
+        this.loadHost = loadHost ?? lazyImport(LSP_STDIO_IMPORT);
+        this.loadService = loadService ?? lazyImport(LSP_SERVICE_IMPORT);
+        this.loadTool = loadTool ?? lazyImport(LSP_TOOL_IMPORT);
+        this.locateSeams = locateSeams ?? findLegacyLspSeams;
+        this.retries = new RetryScheduler({
+            replay: () => this.reconcile(this.lastEnabled),
+            log: message => this.ctx.logger?.warn?.(`[dsh-agent-plugins-market] ${message}`)
+        });
     }
     /** Queue one reconciliation behind any in-flight mount/unmount pass. */
     reconcile(enabledSuites) {
-        const run = this.reconcileQueue.then(() => this.reconcileNow(enabledSuites));
-        this.reconcileQueue = run.then(() => undefined, () => undefined);
-        return run;
+        return this.passes.run(() => this.reconcileNow(enabledSuites));
     }
     /** Mount/unmount LSP servers to match the enabled suites plus direct config exactly. */
     async reconcileNow(enabledSuites) {
         this.lastEnabled = [...enabledSuites];
-        const active = enabledSuites.filter(suite => suite.activeSurfaces?.lsp !== false);
+        const active = enabledSuites.filter(suite => suite.activeSurfaces.lsp !== false);
         const wanted = new Map();
         const diagnostics = [];
         const disabled = await this.disabledProvider();
@@ -102,29 +125,39 @@ export class LspMountRegistry {
                         surfaces: { skills: 0, mcp: 0, hooks: 0, commands: 0, agents: 0, lsp: directKeys.length },
                         dimension: 'user',
                         enabled: true,
+                        // Direct servers carry no install state and no per-surface
+                        // overrides, so every surface keeps its enabled default.
+                        activeSurfaces: effectiveSurfaces(undefined),
                         errors: []
                     },
                     config
                 });
         }
+        // The last remaining server releases the capability seam; the first one mounts it.
+        if (wanted.size === 0)
+            await this.releaseCapability();
         for (const [key, live] of [...this.live]) {
-            if (!wanted.has(key) || live.fingerprint !== JSON.stringify(wanted.get(key).config)) {
+            const target = wanted.get(key);
+            if (target === undefined || live.fingerprint !== JSON.stringify(target.config)) {
                 const reason = await this.unmount(key, live);
                 this.lastDiagnostics.delete(key);
                 if (reason !== undefined)
                     diagnostics.push({ suiteId: key, serverKey: live.serverKeys.join(','), reason, code: 'unmount-failed' });
             }
         }
+        const capabilityFailure = wanted.size > 0 ? await this.ensureCapability() : undefined;
         for (const [key, entry] of wanted) {
             if (this.live.has(key)) {
                 this.lastDiagnostics.delete(key);
                 continue;
             }
-            const failure = await this.mountWith(key, entry.suite, entry.config);
+            const failure = capabilityFailure === undefined
+                ? await this.mountWith(key, entry.suite, entry.config)
+                : { suiteId: key, serverKey: Object.keys(entry.config).join(','), reason: capabilityFailure.reason, code: capabilityFailure.code };
             if (failure !== undefined) {
                 diagnostics.push(failure);
                 this.lastDiagnostics.set(key, failure);
-                this.scheduleRetry(key, failure.code === 'host-missing' ? undefined : failure);
+                this.retries.schedule({ key, label: failure.suiteId, ...(failure.code === 'host-missing' ? {} : { reason: failure.reason }) });
             }
             else {
                 this.lastDiagnostics.delete(key);
@@ -132,6 +165,98 @@ export class LspMountRegistry {
         }
         return diagnostics;
     }
+    /**
+     * Mount the capability seam this plugin delivers end to end: `ctx.lsp`, then the model-facing
+     * `lsp` tool.
+     *
+     * The plugin never asks what the profile already carries. Its dependency declaration decides
+     * the version, so deferring to a seam another layer registered would silently run whatever
+     * version that layer picked. Both mounts are therefore unconditional; a seam that is already
+     * taken comes back as a `seam-conflict` diagnostic naming the layer to remove, which is the
+     * only way the aligned copy can own it.
+     * @returns the failure, or undefined when the seam is ready.
+     */
+    async ensureCapability() {
+        // A previous failure is re-attempted on the next pass: the user can fix a profile and the
+        // retry schedule re-runs reconcile, while a module that still cannot load fails just as fast.
+        if (this.capabilityReady && this.capabilityFailure === undefined)
+            return undefined;
+        this.capabilityReady = true;
+        this.capabilityFailure = undefined;
+        const ctx = this.ctx;
+        if (typeof ctx.plugin !== 'function')
+            return (this.capabilityFailure = { reason: 'the host context does not support dynamic plugin mounting', code: 'host-missing' });
+        for (const [load, specifier] of [
+            [this.loadService, LSP_SERVICE_IMPORT],
+            [this.loadTool, LSP_TOOL_IMPORT]
+        ]) {
+            const failure = await this.mountCapability(load, specifier);
+            if (failure !== undefined)
+                return (this.capabilityFailure = failure);
+        }
+        return undefined;
+    }
+    /** Mount one capability plugin and remember it for teardown with the last server. */
+    async mountCapability(load, specifier) {
+        const module = await load();
+        if (module === undefined)
+            return { reason: `the ${specifier} package is not installed in this profile`, code: 'host-missing' };
+        const ctx = this.ctx;
+        let handle;
+        try {
+            handle = ctx.plugin(module.default ?? module, {});
+            await handle.await();
+        }
+        catch (error) {
+            // A failed startup can leave a half-mounted handle behind; drop it before reporting.
+            if (handle !== undefined) {
+                try {
+                    await handle.dispose();
+                }
+                catch {
+                    // Ignore teardown errors: the startup failure is the real signal.
+                }
+            }
+            const message = error instanceof Error ? error.message : String(error);
+            // `service "lsp" has been registered` / `tool "lsp" is already registered`: another layer
+            // owns the seam. Report the layer to drop rather than falling back to its version.
+            if (/already registered|has been registered/.test(message)) {
+                return { reason: await this.seamConflictReason(specifier, message), code: 'seam-conflict' };
+            }
+            return { reason: `mount failed: ${message}`, code: 'mount-failed' };
+        }
+        this.capability.push(handle);
+        return undefined;
+    }
+    /**
+     * Explain a taken seam, naming the profile layer to remove when one can be
+     * found on disk. Releases before the plugin provisioned LSP itself told users
+     * to add that layer by hand, so the message points at the exact file and rows
+     * rather than at "the profile" in general.
+     */
+    async seamConflictReason(specifier, message) {
+        const head = `the profile already registers its own ${specifier} (${message})`;
+        const seams = await this.locateSeams().catch(() => []);
+        const seam = seams[0];
+        if (seam === undefined) {
+            return `${head}; remove that layer from the profile (a manual \`cordis.patch.yml\` row, or a profile dependency on the package) so this plugin's aligned copy owns the seam`;
+        }
+        return `${head}; ${describeLegacySeam(seam)} — remove those rows (the LSP panel offers a one-click removal) so this plugin's aligned copy owns the seam`;
+    }
+    /** Dispose the capability seam this registry mounted, once no wanted server needs it. */
+    async releaseCapability() {
+        const handles = this.capability.splice(0);
+        this.capabilityReady = false;
+        this.capabilityFailure = undefined;
+        for (const handle of handles.reverse()) {
+            try {
+                await handle.dispose();
+            }
+            catch (error) {
+                this.ctx.logger?.warn?.(`[dsh-agent-plugins-market] LSP capability teardown failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
     /** Install the direct (user-configured) server provider used at reconcile time. */
     setDirectProvider(provider) {
         this.directProvider = provider;
@@ -202,49 +327,15 @@ export class LspMountRegistry {
             return reason;
         }
     }
-    /**
-     * Schedule a delayed re-attempt for a mount that still is not live. A
-     * `host-missing` failure passes no diagnostic and is never retried; the
-     * schedule is bounded and resets with every reconcile pass.
-     */
-    scheduleRetry(key, failure) {
-        const pending = this.retries.get(key);
-        if (pending !== undefined)
-            clearTimeout(pending);
-        this.retries.delete(key);
-        if (failure === undefined || failure.code === 'host-missing') {
-            this.attempts.delete(key);
-            return;
-        }
-        const attempt = (this.attempts.get(key) ?? 0) + 1;
-        this.attempts.set(key, attempt);
-        if (attempt > MAX_RETRY_ATTEMPTS) {
-            this.ctx.logger?.warn?.(`[dsh-agent-plugins-market] ${failure.suiteId}: giving up after ${MAX_RETRY_ATTEMPTS} attempts — ${failure.reason}`);
-            return;
-        }
-        const delay = RETRY_SCHEDULE_MS[attempt - 1] ?? RETRY_SCHEDULE_MS[RETRY_SCHEDULE_MS.length - 1];
-        const timer = setTimeout(() => {
-            this.retries.delete(key);
-            // Re-run against the last known suite set: a retry must not resurrect
-            // servers of a suite that has since been disabled or uninstalled.
-            void this.reconcile(this.lastEnabled).catch(() => { });
-        }, delay);
-        timer.unref?.();
-        this.retries.set(key, timer);
-    }
     /** Dispose every live mount after queued reconciliation passes settle. */
     async disposeAll() {
-        const run = this.reconcileQueue.then(async () => {
+        await this.passes.run(async () => {
             for (const [key, live] of [...this.live]) {
                 await this.unmount(key, live);
             }
+            await this.releaseCapability();
         });
-        this.reconcileQueue = run.then(() => undefined, () => undefined);
-        await run;
-        for (const timer of this.retries.values())
-            clearTimeout(timer);
         this.retries.clear();
-        this.attempts.clear();
     }
 }
-const HOST_MISSING_REASON = 'the @deepseek-ai/dsh-lsp-stdio package is not installed in this profile; upgrade to a DSH build carrying the LSP packages (@deepseek-ai/dsh-lsp, dsh-lsp-stdio, dsh-tool-lsp) and mount tool-lsp in the profile to expose the `lsp` tool';
+const HOST_MISSING_REASON = `the ${LSP_STDIO_IMPORT} package could not be loaded from this profile; reinstall the plugin (\`dsh plugin --profile <profile> add dsh-agent-plugins-market\`) so its LSP dependencies are provisioned`;

package/lib/runtime/lsp-server-state.js

@@ -1,5 +1,6 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 export function lspServerStatePath(dataRoot) {
     return join(dataRoot, 'lsp-server-state.json');
 }
@@ -14,6 +15,5 @@ export async function loadDisabledLspServers(dataRoot) {
 }
 export async function saveDisabledLspServers(dataRoot, disabled) {
     const path = lspServerStatePath(dataRoot);
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, `${JSON.stringify({ disabled: [...new Set(disabled)].sort() }, null, 2)}\n`, 'utf8');
+    await writeFileAtomic(path, `${JSON.stringify({ disabled: [...new Set(disabled)].sort() }, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
 }

package/lib/runtime/lsp-status.js

@@ -40,7 +40,7 @@ export function buildLspStatus(suites, registry, direct = { servers: {}, errors:
         if (suite.lsp === undefined || suite.installedAt === undefined || !suite.enabled)
             continue;
         const suiteKey = qualifiedSuiteId(suite.sourceId, suite.id);
-        const disabled = suite.activeSurfaces?.lsp === false;
+        const disabled = suite.activeSurfaces.lsp === false;
         const diagnostic = diagnostics.get(suiteKey);
         const { state, reason, retryable } = deriveState(disabled, diagnostic, anyLive);
         if (state === 'mounted')

package/lib/runtime/mcp-auth-record.js

@@ -0,0 +1,42 @@
+/**
+ * The credential record one MCP server's OAuth grant lives under.
+ *
+ * `runtime/mcp-client/oauth.ts` writes those records; this module addresses
+ * the same key so a grant can be dropped without waking the transport that
+ * wrote it. The scope and the name fold must stay identical to that writer's,
+ * or the delete silently misses the record.
+ *
+ * @module runtime/mcp-auth-record
+ */
+import { credentialKey } from './mcp-client/host-seams.js';
+/** Credential-record scope for MCP OAuth state; per-server ids follow it. */
+export const MCP_AUTH_RECORD_SCOPE = 'mcp-auth';
+/**
+ * Fold a `serverName` into a credential-key id segment. Server names carry
+ * `__` separators (e.g. `cloudflare__cloudflare-api`), and the key grammar
+ * admits only `[a-z0-9-]`, so non-conforming characters collapse to `-` —
+ * deterministic, so the same server always reads and writes one record.
+ */
+export function mcpAuthRecordId(serverName) {
+    const folded = serverName
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return folded === '' ? 'server' : folded;
+}
+/** The credential record key one MCP server's OAuth grant is stored under. */
+export function mcpAuthRecordKey(serverName) {
+    return credentialKey(MCP_AUTH_RECORD_SCOPE, mcpAuthRecordId(serverName));
+}
+/**
+ * Drop one MCP server's OAuth grant record so the next mount re-runs the
+ * browser authorization — the path for "I picked too narrow a scope".
+ * @param store - the host credentials service, when one is mounted.
+ * @throws when the credentials service is not mounted.
+ */
+export async function deleteMcpAuthGrant(store, serverName) {
+    const records = store;
+    if (typeof records?.deleteRecord !== 'function')
+        throw new Error('credentials service is not mounted');
+    await records.deleteRecord(mcpAuthRecordKey(serverName));
+}

package/lib/runtime/mcp-backend.js

@@ -17,19 +17,20 @@ import { readFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
-export const MCP_BACKENDS = ['builtin', 'host'];
 /** Settings namespace this plugin registers; the key the plugin-config tab pairs our card by. */
 export const MCP_SETTINGS_NAMESPACE = 'dsh-agent-plugins-market';
-/** Schema of the market settings namespace: the MCP enhancement switch, the download region, and the feedback tool switch. */
+/** Schema of the market settings namespace: the switches this plugin's config card serves. */
 export const MarketSettingsSchema = z.object({
     /** ON (default) = the built-in bridge with OAuth and SSE; OFF = host client compat mode. */
     mcpEnhanced: z.boolean().default(true),
-    /** Read native Agent layouts under the project root; default preserves existing discovery. */
-    scanProjectLayouts: z.boolean().default(true),
+    /** Read native Agent layouts under the project root; OFF (default) scans configured sources only. */
+    scanProjectLayouts: z.boolean().default(false),
     /** Download region for GitHub acquisition; `auto` follows the interface language. */
     downloadRegion: z.union([z.const('auto'), z.const('global'), z.const('china')]).default('auto'),
     /** ON (default) = the `report_market_issue` model tool is registered; OFF = unregistered. */
-    feedbackEnabled: z.boolean().default(true)
+    feedbackEnabled: z.boolean().default(true),
+    /** ON = refresh every configured source in the background; OFF (default) = never. */
+    autoUpdateSources: z.boolean().default(false)
 });
 /** Path of the legacy persisted settings file under the plugin data root. */
 export function marketSettingsPath(dataRoot) {

package/lib/runtime/mcp-client/config.js

@@ -8,7 +8,6 @@
  *
  * @module runtime/mcp-client/config
  */
-export { RECONNECT_DEFAULTS } from './connection.js';
 /** Default timeout for individual MCP tool calls (ms). */
 export const DEFAULT_TOOL_CALL_TIMEOUT_MS = 60_000;
 /** Valid `serverName`, kept below the public tool-name budget. */

package/lib/runtime/mcp-client/connection.js

@@ -23,6 +23,7 @@
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
 import { MAX_TIMER_DELAY_MS } from './host-seams.js';
+import { PLUGIN_NAME, PLUGIN_VERSION } from './plugin-identity.js';
 import { createTransport } from './transport.js';
 import { syncTools } from './tools.js';
 /** Defaults shared by the config and {@link resolveReconnectPolicy}. */
@@ -197,7 +198,7 @@ export function startConnection(host, config, policy, credentials) {
      * @param startup - Whether this is the bridge's activation attempt.
      */
     async function connectGeneration(startup) {
-        const generation = new Client({ name: 'dsh-agent-plugins-market', version: '0.1.0' }, { capabilities: {} });
+        const generation = new Client({ name: PLUGIN_NAME, version: PLUGIN_VERSION }, { capabilities: {} });
         const closed = Promise.withResolvers();
         let attemptSettled = false;
         let closeObserved = false;
@@ -228,6 +229,31 @@ export function startConnection(host, config, policy, credentials) {
                     host.logger.error(`${label}: tool re-sync failed: ${String(error)}`);
             }
         });
+        /**
+         * Retire a generation whose attempt failed: close it, wait for the
+         * transport's own close signal, then hand it to the disconnect path. A
+         * generation that will not close stops reconnection outright — respawning
+         * would overlap the server process still running behind it.
+         */
+        async function teardownFailedAttempt() {
+            try {
+                await generation.close();
+            }
+            catch {
+                /* transport already gone */
+            }
+            const quiesced = hasClosed() || (await waitForClose(closed.promise));
+            attemptSettled = true;
+            if (!isCurrent(generation))
+                return;
+            if (quiesced) {
+                generationDown(generation);
+                return;
+            }
+            client = undefined;
+            clientClosed = undefined;
+            host.logger.error(`${label}: failed generation did not close within ${GENERATION_CLOSE_TIMEOUT_MS}ms — reconnect stopped to avoid overlapping server processes; reload the plugin or restart the Host to retry`);
+        }
         const { transport, oauthProvider } = createTransport(config, credentials, (message) => {
             host.logger.info(message);
         });
@@ -261,11 +287,9 @@ export function startConnection(host, config, policy, credentials) {
                 attemptSettled = true;
                 if (!isCurrent(generation))
                     return;
-                if (hasClosed()) {
-                    generationDown(generation);
-                    return;
-                }
-                if (!legSettled) {
+                // The leg failed, or the transport closed while it ran: no generation
+                // is left to finish establishing.
+                if (hasClosed() || !legSettled) {
                     generationDown(generation);
                     return;
                 }
@@ -277,20 +301,7 @@ export function startConnection(host, config, policy, credentials) {
                 catch (syncError) {
                     if (isCurrent(generation))
                         host.logger.warn(`${label}: tool sync after authorization failed: ${String(syncError)}`);
-                    try {
-                        await generation.close();
-                    }
-                    catch {
-                        /* transport already gone */
-                    }
-                    const quiescedSync = hasClosed() || (await waitForClose(closed.promise));
-                    if (!quiescedSync) {
-                        client = undefined;
-                        clientClosed = undefined;
-                        host.logger.error(`${label}: failed generation did not close within ${GENERATION_CLOSE_TIMEOUT_MS}ms — reconnect stopped to avoid overlapping server processes`);
-                        return;
-                    }
-                    generationDown(generation);
+                    await teardownFailedAttempt();
                     return;
                 }
                 if (hasClosed()) {
@@ -304,23 +315,7 @@ export function startConnection(host, config, policy, credentials) {
                     host.logger.info(`${label}: authorized and re-synced tools (attempt ${failedAttempts}/${policy.maxAttempts})`);
                 return;
             }
-            try {
-                await generation.close();
-            }
-            catch {
-                /* transport already gone */
-            }
-            const quiesced = hasClosed() || (await waitForClose(closed.promise));
-            attemptSettled = true;
-            if (!isCurrent(generation))
-                return;
-            if (!quiesced) {
-                client = undefined;
-                clientClosed = undefined;
-                host.logger.error(`${label}: failed generation did not close within ${GENERATION_CLOSE_TIMEOUT_MS}ms — reconnect stopped to avoid overlapping server processes; reload the plugin or restart the Host to retry`);
-                return;
-            }
-            generationDown(generation);
+            await teardownFailedAttempt();
             return;
         }
         attemptSettled = true;