dsh-agent-plugins-market 0.6.2 → 0.7.0

package/lib/runtime/profile-seam.js

@@ -0,0 +1,321 @@
+/**
+ * Legacy profile LSP layer: detection and one-action removal.
+ *
+ * Releases before the plugin provisioned LSP itself told users to expose the
+ * capability from their profile — a `cordis.patch.yml` `insert` row for
+ * `@deepseek-ai/dsh-lsp` and `@deepseek-ai/dsh-tool-lsp`, anchored by profile
+ * dependencies on the packages. `LspMountRegistry` now mounts both seams from
+ * this plugin's own aligned copies, so that layer registers a second `lsp`
+ * service and the mount fails with `seam-conflict`.
+ *
+ * The plugin cannot drop the layer by patching: a profile's own patch file is
+ * applied *after* every bundle layer, so this package's patch can never
+ * disable the row. The user has to remove it, and that is the whole job here:
+ * find the profile, and edit out exactly those rows.
+ *
+ * Editing happens on a file the user wrote by hand, so the rules are
+ * conservative: the YAML document model preserves comments and unknown keys,
+ * the rewrite is verified against an independently computed result before it
+ * lands, and the previous content is kept beside it. Nothing else is touched —
+ * a profile's `dependencies` stay as they are, because dropping a dependency
+ * means running pnpm and this module never spawns anything.
+ *
+ * All paths come from `node:path` and all file work from `node:fs/promises`
+ * plus the harness atomic-write helper, so the same code runs on macOS, Linux
+ * and Windows; no shell, no path-separator assumption.
+ */
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isMap, isNode, isScalar, isSeq, parseDocument } from 'yaml';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+import { resolveDshHome } from '../catalog/paths.js';
+/** Every package the plugin provisions for LSP, in declaration order. */
+export const LSP_PACKAGE_SPECIFIERS = ['@deepseek-ai/dsh-lsp', '@deepseek-ai/dsh-lsp-stdio', '@deepseek-ai/dsh-tool-lsp'];
+/**
+ * The specifiers whose `insert` row registers a seam this plugin now owns.
+ * The stdio provider is excluded: it publishes no service, so a row for it
+ * cannot conflict.
+ */
+const SEAM_SPECIFIERS = new Set(['@deepseek-ai/dsh-lsp', '@deepseek-ai/dsh-tool-lsp']);
+/** The profile patch filename the harness reads; part of the profile contract. */
+const PROFILE_PATCH_FILENAME = 'cordis.patch.yml';
+/** Default patch-file lifecycle when a profile manifest omits `dsh.profile.patchReload`. */
+const DEFAULT_PATCH_RELOAD = 'live';
+/**
+ * Find every profile that still registers a legacy LSP seam.
+ *
+ * Best effort by design: profile files are the user's, so a directory that
+ * cannot be read or a patch file that does not parse is skipped rather than
+ * failing the status surface that calls this.
+ * @param home - the Harness home; defaults to `$DSH_HOME` or `~/.dsh`.
+ * @returns each matching profile, ordered by profile name.
+ */
+export async function findLegacyLspSeams(home = resolveDshHome()) {
+    const profilesDir = join(home, 'profiles');
+    let entries;
+    try {
+        entries = await readdir(profilesDir);
+    }
+    catch {
+        return [];
+    }
+    const found = [];
+    for (const name of entries.sort()) {
+        // `node_modules` is the installation fallback sibling, not a profile, and
+        // dot-directories hold launcher bookkeeping or the user's own backups.
+        if (name === 'node_modules' || name.startsWith('.'))
+            continue;
+        const dir = join(profilesDir, name);
+        try {
+            if (!(await stat(dir)).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const seam = await inspectProfile(name, dir);
+        if (seam !== undefined)
+            found.push(seam);
+    }
+    return found;
+}
+/** Read one profile directory and report its legacy layer, or undefined when it has none. */
+async function inspectProfile(profile, dir) {
+    const patchPath = join(dir, PROFILE_PATCH_FILENAME);
+    let text;
+    try {
+        text = await readFile(patchPath, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    const document = parseDocument(text);
+    if (document.errors.length > 0)
+        return undefined;
+    const rows = seamRows(document);
+    const manifest = await readManifest(join(dir, 'package.json'));
+    // Only a row (or a bundle layer) claims a seam. A bare dependency cannot
+    // register anything, so a profile that lists the packages but inserts no row
+    // is not the cause of a conflict and stays out of the report.
+    if (rows.length === 0 && manifest.bundles.length === 0)
+        return undefined;
+    return { profile, dir, patchPath, rows, bundles: manifest.bundles, dependencies: manifest.dependencies, patchReload: manifest.patchReload };
+}
+/**
+ * Remove one profile's legacy LSP rows.
+ *
+ * The file is re-read here rather than trusting the caller's snapshot, so a
+ * migration always edits the current on-disk content. The rewrite is verified
+ * before it lands and the pre-edit content is written beside it first, so a
+ * failure leaves the profile exactly as it was.
+ * @param seam - a profile previously returned by {@link findLegacyLspSeams}.
+ * @param now - timestamp used in the backup filename; injectable for tests.
+ * @returns what was removed and where the backup went.
+ * @throws Error when the profile no longer carries a removable row, or the rewrite does not verify.
+ */
+export async function migrateLegacyLspSeam(seam, now = new Date()) {
+    let original;
+    try {
+        original = await readFile(seam.patchPath, 'utf8');
+    }
+    catch (error) {
+        throw new Error(`cannot read the profile patch file ${seam.patchPath}: ${messageOf(error)}`, { cause: error });
+    }
+    const document = parseDocument(original);
+    if (document.errors.length > 0) {
+        throw new Error(`the profile patch file ${seam.patchPath} does not parse: ${document.errors[0]?.message ?? 'unknown error'}`);
+    }
+    const removed = stripSeamRows(document);
+    if (removed.length === 0)
+        throw new Error(`the profile ${seam.profile} no longer registers an LSP layer; reload the panel and try again`);
+    const next = document.toString();
+    assertStripped(original, next);
+    const mode = await fileMode(seam.patchPath);
+    const backupPath = `${seam.patchPath}.bak-lsp-seam-${stamp(now)}`;
+    await writeFileAtomic(backupPath, original, { mode });
+    await writeFileAtomic(seam.patchPath, next, { mode });
+    return { profile: seam.profile, patchPath: seam.patchPath, backupPath, removed, restartRequired: seam.patchReload !== 'live' };
+}
+/**
+ * Drop every `insert` entry naming a seam package, in place.
+ * A patch entry whose whole `insert` list is consumed leaves the document when
+ * nothing else remains — the entry existed only to insert.
+ * @returns the removed rows, in file order.
+ */
+function stripSeamRows(document) {
+    const removed = [];
+    for (const item of rootItems(document)) {
+        const container = mapNode(item, 'insert');
+        if (!isSeq(container))
+            continue;
+        const entries = container.items;
+        const keep = [];
+        for (const entry of entries) {
+            const name = mapText(entry, 'name');
+            if (name !== undefined && SEAM_SPECIFIERS.has(name)) {
+                removed.push({ id: mapText(entry, 'id') ?? '', name });
+                continue;
+            }
+            keep.push(entry);
+        }
+        if (keep.length === entries.length)
+            continue;
+        if (keep.length > 0) {
+            container.items = keep;
+            continue;
+        }
+        // The `- insert:` form carries no other key, so the entry goes with its
+        // list; the `- id: <group>` form configures a group and stays.
+        if (isMap(item) && item.items.length > 1) {
+            item.delete('insert');
+            continue;
+        }
+        const root = document.contents;
+        if (isSeq(root))
+            root.items = root.items.filter(candidate => candidate !== item);
+    }
+    return removed;
+}
+/**
+ * Prove the rewrite removed exactly the seam rows and nothing else.
+ *
+ * The expected result is computed independently from the plain parsed data, so
+ * this compares two derivations rather than trusting the edit that produced
+ * one of them. A mismatch aborts before anything is written.
+ */
+function assertStripped(original, next) {
+    if (seamRows(parseDocument(next)).length !== 0)
+        throw new Error('the rewritten profile patch file still registers an LSP layer');
+    const before = parseDocument(original).toJS();
+    const after = parseDocument(next).toJS();
+    const expected = stripSeamEntriesFromData(before);
+    if (JSON.stringify(expected) !== JSON.stringify(after)) {
+        throw new Error('the rewritten profile patch file would change unrelated patch entries; remove the LSP rows by hand instead');
+    }
+}
+/** The same removal applied to plain parsed data, as the independent expectation. */
+function stripSeamEntriesFromData(data) {
+    if (!Array.isArray(data))
+        return data;
+    const result = [];
+    for (const entry of data) {
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+            result.push(entry);
+            continue;
+        }
+        const record = entry;
+        if (!Array.isArray(record['insert'])) {
+            result.push(entry);
+            continue;
+        }
+        const keep = record['insert'].filter(item => {
+            if (typeof item !== 'object' || item === null || Array.isArray(item))
+                return true;
+            const name = item['name'];
+            return !(typeof name === 'string' && SEAM_SPECIFIERS.has(name));
+        });
+        if (keep.length === record['insert'].length) {
+            result.push(entry);
+            continue;
+        }
+        if (keep.length > 0) {
+            result.push({ ...record, insert: keep });
+            continue;
+        }
+        const rest = Object.entries(record).filter(([key]) => key !== 'insert');
+        if (rest.length > 0)
+            result.push(Object.fromEntries(rest));
+    }
+    return result;
+}
+/** Collect the `insert` rows that name one of {@link SEAM_SPECIFIERS}. */
+function seamRows(document) {
+    const found = [];
+    for (const item of rootItems(document)) {
+        const entries = sequenceItems(mapNode(item, 'insert'));
+        if (entries === undefined)
+            continue;
+        for (const entry of entries) {
+            const name = mapText(entry, 'name');
+            if (name === undefined || !SEAM_SPECIFIERS.has(name))
+                continue;
+            found.push({ id: mapText(entry, 'id') ?? '', name });
+        }
+    }
+    return found;
+}
+/** The root sequence of a patch document; empty when the file holds something else. */
+function rootItems(document) {
+    return sequenceItems(document.contents) ?? [];
+}
+/** Read a mapping key as a child node, or undefined when the node is not a mapping. */
+function mapNode(node, key) {
+    if (!isMap(node))
+        return undefined;
+    const value = node.get(key, true);
+    return isNode(value) ? value : undefined;
+}
+/** Read a mapping key that holds a string scalar. */
+function mapText(node, key) {
+    const value = mapNode(node, key);
+    return isScalar(value) && typeof value.value === 'string' ? value.value : undefined;
+}
+/** The items of a sequence node, or undefined when the node is not one. */
+function sequenceItems(node) {
+    return isSeq(node) ? node.items : undefined;
+}
+/** Read the manifest facts, treating an absent or malformed file as an empty profile. */
+async function readManifest(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch {
+        return { bundles: [], dependencies: [], patchReload: DEFAULT_PATCH_RELOAD };
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return { bundles: [], dependencies: [], patchReload: DEFAULT_PATCH_RELOAD };
+    }
+    const record = parsed;
+    const known = new Set(LSP_PACKAGE_SPECIFIERS);
+    const dependencies = [];
+    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+        const table = record[field];
+        if (typeof table !== 'object' || table === null || Array.isArray(table))
+            continue;
+        for (const name of Object.keys(table))
+            if (known.has(name) && !dependencies.includes(name))
+                dependencies.push(name);
+    }
+    const scope = objectAt(objectAt(record['dsh'], 'profile'));
+    const rawBundles = scope['bundles'];
+    const bundles = Array.isArray(rawBundles) ? rawBundles.filter((value) => typeof value === 'string' && known.has(value)) : [];
+    return { bundles, dependencies, patchReload: scope['patchReload'] === 'startup' ? 'startup' : DEFAULT_PATCH_RELOAD };
+}
+/** Read one nested object field, or an empty record when the value is not an object. */
+function objectAt(value, key) {
+    const target = key === undefined ? value : typeof value === 'object' && value !== null && !Array.isArray(value) ? value[key] : undefined;
+    return typeof target === 'object' && target !== null && !Array.isArray(target) ? target : {};
+}
+/** Preserve the patch file's permission bits; Windows reports a synthetic mode. */
+async function fileMode(path) {
+    try {
+        return (await stat(path)).mode & 0o777 || 0o644;
+    }
+    catch {
+        return 0o644;
+    }
+}
+/** A filename-safe local timestamp: no colons, so Windows accepts it. */
+function stamp(now) {
+    const pad = (value, width = 2) => String(value).padStart(width, '0');
+    return `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** One-line remediation shared by the mount diagnostic and the status payload. */
+export function describeLegacySeam(seam) {
+    const rows = seam.rows.map(row => (row.id === '' ? row.name : `${row.id} (${row.name})`)).join(', ');
+    return `profile "${seam.profile}" still inserts the LSP layer (${rows}) from ${seam.patchPath}`;
+}

package/lib/runtime/project-runtime.js

@@ -1,7 +1,6 @@
 import { CommandMountRegistry } from './commands-mounts.js';
 import { McpMountRegistry } from './mcp-mounts.js';
 import { HooksMountRegistry } from './hooks-mounts.js';
-import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { stripFrontmatter } from '../catalog/skills-parse.js';
 import { parseFrontmatterRecord } from './user-store.js';
@@ -11,8 +10,8 @@ export function mountProjectCommands(ctx, catalog, t) {
 }
 /** MCP uses a separate injected child so network startup cannot delay local commands. */
 export function mountProjectMcp(ctx, catalog, dataRoot) {
-    return mountProjectSurface(ctx, catalog, 'tools', (scope, agent) => {
-        const registry = new McpMountRegistry(scope, dataRoot, agent.session.id ?? randomUUID());
+    return mountProjectSurface(ctx, catalog, 'tools', scope => {
+        const registry = new McpMountRegistry(scope, dataRoot);
         registry.setBackendProvider(() => catalog.mcpBackend());
         return registry;
     });
@@ -44,7 +43,7 @@ export async function suiteInstructions(suites) {
     const chunks = [];
     const errors = [];
     for (const suite of suites) {
-        if (!suite.enabled || suite.activeSurfaces?.skills === false)
+        if (!suite.enabled || suite.activeSurfaces.skills === false)
             continue;
         if (suite.systemPrompt !== undefined)
             chunks.push(suite.systemPrompt);
@@ -72,8 +71,9 @@ export async function suiteInstructions(suites) {
 function mountProjectSurface(ctx, catalog, service, create, withoutProject = false) {
     const host = ctx;
     const mounts = new Map();
+    const serviceLabel = typeof service === 'string' ? service : service.join(',');
     let disposed = false;
-    const warn = (error) => ctx.logger?.warn(`[dsh-agent-plugins-market] project ${service}: ${String(error)}`);
+    const warn = (error) => ctx.logger?.warn(`[dsh-agent-plugins-market] project ${serviceLabel}: ${String(error)}`);
     const attach = (agent) => {
         const cwd = agent.session.header.cwd;
         if (disposed || (cwd === undefined && !withoutProject) || mounts.has(agent))
@@ -101,7 +101,7 @@ function mountProjectSurface(ctx, catalog, service, create, withoutProject = fal
             scope.effect(() => async () => {
                 active = false;
                 await registry.disposeAll();
-            }, `dsh-agent-plugins-market: project ${service}`);
+            }, `dsh-agent-plugins-market: project ${serviceLabel}`);
             void refresh().catch(warn);
         });
         mounts.set(agent, { fiber, refresh: () => refresh() });
@@ -115,9 +115,12 @@ function mountProjectSurface(ctx, catalog, service, create, withoutProject = fal
     const unwatchDisposed = ctx.on('agent/disposed', ({ agent }) => {
         void detach(agent).catch(warn);
     });
-    const unwatchStart = ctx.on('agent/session-start', async ({ agent }) => {
+    const unwatchStart = ctx.on('agent/session-start', ({ agent }) => {
         attach(agent);
-        await mounts.get(agent)?.refresh();
+        // The refresh chain can reject — its queue body re-reads the project
+        // catalog — and the host emits this event without awaiting the listener,
+        // so an unhandled rejection here would surface at every session start.
+        void mounts.get(agent)?.refresh().catch(warn);
     });
     for (const agent of host.agents.list())
         attach(agent);

package/lib/runtime/reconcile-scheduler.js

@@ -0,0 +1,99 @@
+/** Credential updates are batched for this long before one reconcile runs. */
+const CREDENTIAL_DEBOUNCE_MS = 150;
+export class ReconcileScheduler {
+    ctx;
+    runtime;
+    host;
+    disposed = false;
+    requested = false;
+    pass;
+    pendingCredentialRefs = new Set();
+    credentialFlush;
+    releaseCredentialUpdates;
+    constructor(ctx, runtime, host) {
+        this.ctx = ctx;
+        this.runtime = runtime;
+        this.host = host;
+        const eventHost = ctx;
+        this.releaseCredentialUpdates =
+            eventHost.on?.('credentials/reference-updated', ref => {
+                this.pendingCredentialRefs.add(ref);
+                if (this.credentialFlush !== undefined)
+                    clearTimeout(this.credentialFlush);
+                this.credentialFlush = setTimeout(() => this.flushCredentialUpdates(), CREDENTIAL_DEBOUNCE_MS);
+                this.credentialFlush.unref?.();
+            }) ?? (() => { });
+    }
+    /** Reconcile now, joining the pass in flight and remembering one follow-up for it. */
+    request() {
+        if (this.disposed)
+            return Promise.resolve();
+        this.requested = true;
+        this.pass ??= (async () => {
+            try {
+                do {
+                    this.requested = false;
+                    await this.reconcileOnce();
+                } while (this.requested && !this.disposed);
+            }
+            finally {
+                this.pass = undefined;
+            }
+        })();
+        return this.pass;
+    }
+    /** Stop scheduling; later events are dropped. */
+    dispose() {
+        this.disposed = true;
+        this.releaseCredentialUpdates();
+        if (this.credentialFlush !== undefined)
+            clearTimeout(this.credentialFlush);
+        this.credentialFlush = undefined;
+        this.pendingCredentialRefs.clear();
+    }
+    async reconcileOnce() {
+        try {
+            const suites = await this.host.enabledSuites();
+            if (this.disposed)
+                return;
+            const diagnostics = await this.runtime.reconcile(suites);
+            this.host.publishMcpDiagnostics(diagnostics.mcp);
+            for (const diagnostic of diagnostics.mcp) {
+                this.ctx.logger?.warn(`[dsh-agent-plugins-market] suite "${diagnostic.suiteId}" mcp server "${diagnostic.serverKey}": ${diagnostic.reason}`);
+            }
+            for (const diagnostic of diagnostics.lsp) {
+                this.ctx.logger?.warn(`[dsh-agent-plugins-market] suite "${diagnostic.suiteId}" lsp server "${diagnostic.serverKey}": ${diagnostic.reason}`);
+            }
+            for (const diagnostic of diagnostics.commands) {
+                if (diagnostic.reason !== '')
+                    this.ctx.logger?.warn(`[dsh-agent-plugins-market] suite "${diagnostic.suiteId}" command "${diagnostic.command}": ${diagnostic.reason}`);
+            }
+            for (const diagnostic of diagnostics.hooks) {
+                this.ctx.logger?.warn(`[dsh-agent-plugins-market] suite "${diagnostic.suiteId}" hooks: ${diagnostic.reason}`);
+            }
+            for (const error of diagnostics.errors) {
+                this.ctx.logger?.warn(`[dsh-agent-plugins-market] ${error.surface} reconcile failed: ${error.reason}`);
+            }
+        }
+        catch (error) {
+            this.ctx.logger?.warn(`[dsh-agent-plugins-market] runtime reconcile failed: ${error instanceof Error ? error.message : String(error)}`);
+            throw error;
+        }
+    }
+    /**
+     * Coalesce credential updates: the debounce collapses a burst into one pass,
+     * and the pending refs are kept until that pass runs, so an update arriving
+     * mid-reconcile is never dropped.
+     */
+    flushCredentialUpdates() {
+        this.credentialFlush = undefined;
+        const refs = [...this.pendingCredentialRefs];
+        this.pendingCredentialRefs.clear();
+        // Re-read the catalog first: an unknown ref means the snapshot predates
+        // this change, so reconcile anyway to refresh the known reference set.
+        void this.request().catch(() => { });
+        if (refs.length > 0) {
+            this.ctx.logger?.info?.(`[dsh-agent-plugins-market] reconciling after credential update: ${refs.join(', ')}`);
+        }
+    }
+}

package/lib/runtime/reconciler.js

@@ -40,6 +40,10 @@ export class RuntimeReconciler {
     forceMcpRemount(suiteId, serverKey) {
         this.mcp.forceRemount(suiteId, serverKey);
     }
+    /** Flag every live MCP mount for a rebuild on the next reconcile. */
+    forceMcpRemountAll() {
+        this.mcp.forceRemountAll();
+    }
     /** The mount key owning one derived serverName; undefined when not mounted here. */
     mcpServerOwner(serverName) {
         return this.mcp.serverOwner(serverName);

package/lib/runtime/server-config.js

@@ -1,5 +1,6 @@
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import { MCP_SCHEMA_ID, validateAgainstSchema, validateMcpJson } from '../catalog/validate.js';
 import { parseLspServers } from '../catalog/lsp-spec.js';
 import { qualifiedSuiteId } from '../catalog/paths.js';
@@ -56,10 +57,11 @@ export async function loadLspOverrides(root) {
 export async function saveLspOverride(root, id, config) {
     const overrides = await loadLspOverrides(root);
     overrides[id] = config;
-    await mkdir(root, { recursive: true });
     const path = join(root, 'lsp-overrides.json');
-    await writeFile(`${path}.tmp`, JSON.stringify(Object.fromEntries(Object.entries(overrides).map(([key, value]) => [key, lspConfig(value)])), null, 2), { mode: 0o600 });
-    await rename(`${path}.tmp`, path);
+    await writeFileAtomic(path, JSON.stringify(Object.fromEntries(Object.entries(overrides).map(([key, value]) => [key, lspConfig(value)])), null, 2), {
+        mode: 0o600,
+        dirMode: 0o700
+    });
 }
 export async function applyLspOverrides(root, suites) {
     const overrides = await loadLspOverrides(root);

package/lib/runtime/settings-namespace.js

@@ -0,0 +1,136 @@
+import { FEEDBACK_TOOL_NAME, mountFeedbackTool } from './feedback-tool.js';
+import { MCP_SETTINGS_NAMESPACE, MarketSettingsSchema, readMcpBackend } from './mcp-backend.js';
+import { narrowDownloadRegion } from './regions.js';
+export class MarketSettingsNamespace {
+    ctx;
+    dataRoot;
+    locale;
+    host;
+    scope;
+    watchers = [];
+    feedbackDisposer;
+    /**
+     * The feedback tool's last reported mount state. A settings change that does
+     * not move it (region, backend, project layouts) must not re-log the same
+     * line, and every other state is exactly one line: mounted, skipped by the
+     * switch, or skipped because the host has no tools registry to register on.
+     */
+    feedbackMountState;
+    constructor(ctx, dataRoot, locale, host) {
+        this.ctx = ctx;
+        this.dataRoot = dataRoot;
+        this.locale = locale;
+        this.host = host;
+    }
+    /** Register the namespace; the host resolves it whenever the settings service mounts. */
+    mount() {
+        this.ctx.inject(['settings'], settingsCtx => this.register(settingsCtx));
+    }
+    /** The persisted MCP backend choice; the built-in client until registration lands. */
+    async backend() {
+        return this.scope !== undefined && this.scope.get().mcpEnhanced === false ? 'host' : 'builtin';
+    }
+    /**
+     * Persist a backend choice.
+     * @throws when the settings service is not mounted.
+     */
+    async setBackend(backend) {
+        if (this.scope === undefined)
+            throw new Error('the settings service is not mounted');
+        await this.scope.update({ mcpEnhanced: backend !== 'host' });
+    }
+    /** The persisted download-region setting. */
+    async downloadRegion() {
+        return narrowDownloadRegion(this.scope?.get().downloadRegion);
+    }
+    /** Release every watcher and unmount the feedback tool. */
+    dispose() {
+        for (const release of this.watchers.splice(0))
+            release();
+        this.feedbackDisposer?.();
+        this.feedbackDisposer = undefined;
+    }
+    register(settingsCtx) {
+        try {
+            this.ctx.logger?.info?.('[dsh-agent-plugins-market] settings inject resolved — registering namespace');
+            const settings = settingsCtx.settings;
+            const scope = settings.register(MCP_SETTINGS_NAMESPACE, MarketSettingsSchema, {
+                base: { mcpEnhanced: true, downloadRegion: 'auto', feedbackEnabled: true, scanProjectLayouts: false }
+            });
+            this.scope = scope;
+            this.ctx.logger?.info?.('[dsh-agent-plugins-market] settings namespace registered — plugin-config card will serve');
+            this.syncProjectLayouts();
+            this.watchers.push(scope.watch(() => this.syncProjectLayouts()));
+            this.syncAutoUpdateSources();
+            this.watchers.push(scope.watch(() => this.syncAutoUpdateSources()));
+            // One-time migration from the earlier data-root settings.json choice.
+            void readMcpBackend(this.dataRoot).then(backend => {
+                if (backend === 'host')
+                    void scope.update({ mcpEnhanced: false }).catch(() => { });
+            });
+            let previousBackend = scope.get().mcpEnhanced !== false;
+            this.watchers.push(scope.watch(() => {
+                const backend = scope.get().mcpEnhanced !== false;
+                if (backend === previousBackend)
+                    return;
+                previousBackend = backend;
+                this.host.refreshMcpMounts();
+            }));
+            // The experience-feedback model tool: gated by the namespace's
+            // `feedbackEnabled` field (default on); the switch unregisters it. The
+            // tool mount is doubly contained — its failure must never take the
+            // settings namespace (and with it the config card) down with it. The
+            // mount outcome is logged on every transition so an absent
+            // `report_market_issue` in a session is traceable to its cause.
+            this.syncFeedbackTool();
+            this.watchers.push(scope.watch(() => this.syncFeedbackTool()));
+        }
+        catch (error) {
+            this.ctx.logger?.error?.(`[dsh-agent-plugins-market] settings namespace registration failed — the plugin-config card will be hidden this boot: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+        }
+    }
+    /** Apply the background source-update switch; OFF is the default. */
+    syncAutoUpdateSources() {
+        try {
+            this.host.setAutoUpdateSources(this.scope?.get().autoUpdateSources === true);
+        }
+        catch (error) {
+            this.ctx.logger?.error?.(`[dsh-agent-plugins-market] background source update switch failed: ${String(error)}`);
+        }
+    }
+    syncProjectLayouts() {
+        void this.host.setScanProjectLayouts(this.scope?.get().scanProjectLayouts === true).catch(error => {
+            this.ctx.logger?.error?.(`[dsh-agent-plugins-market] project layout reconciliation failed: ${String(error)}`);
+        });
+    }
+    syncFeedbackTool() {
+        try {
+            const wanted = this.scope?.get().feedbackEnabled !== false;
+            if (!wanted) {
+                if (this.feedbackDisposer !== undefined) {
+                    this.feedbackDisposer();
+                    this.feedbackDisposer = undefined;
+                }
+            }
+            else if (this.feedbackDisposer === undefined) {
+                this.feedbackDisposer = mountFeedbackTool(this.ctx, this.dataRoot, (key, params) => this.locale.t(key, params)) ?? undefined;
+            }
+            const state = !wanted ? 'off' : this.feedbackDisposer === undefined ? 'unavailable' : 'mounted';
+            if (state === this.feedbackMountState)
+                return;
+            this.feedbackMountState = state;
+            if (state === 'mounted') {
+                this.ctx.logger?.info?.(`[dsh-agent-plugins-market] ${FEEDBACK_TOOL_NAME} mounted on the host tools registry`);
+            }
+            else if (state === 'off') {
+                this.ctx.logger?.info?.(`[dsh-agent-plugins-market] ${FEEDBACK_TOOL_NAME} not mounted: feedbackEnabled is off`);
+            }
+            else {
+                this.ctx.logger?.warn?.(`[dsh-agent-plugins-market] ${FEEDBACK_TOOL_NAME} not mounted: the host exposes no tools registry`);
+            }
+        }
+        catch (error) {
+            this.ctx.logger?.error?.(`[dsh-agent-plugins-market] feedback tool mount failed: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
+        }
+    }
+}