dsh-agent-plugins-market 0.6.2 → 0.7.0

package/lib/types/catalog/validate.d.ts

@@ -32,5 +32,3 @@ export declare function validateMcpJson(pluginRoot: string, raw: unknown, option
 export declare function expandPlaceholders(value: string, pluginRoot: string, pluginData: string, env?: NodeJS.ProcessEnv): string;
 /** Resolve an expanded plugin-relative cwd to an absolute path. */
 export declare function resolveCwd(value: string, pluginRoot: string, pluginData: string): string;
-/** Whether one absolute path equals or lies under another absolute path. */
-export declare function isWithin(root: string, candidate: string): boolean;

package/lib/types/contracts/lsp-status.d.ts

@@ -50,4 +50,39 @@ export interface LspStatusPayload {
     };
     /** True when the host lacks the LSP packages, so every declaration is blocked. */
     hostMissing: boolean;
+    /**
+     * A profile layer that still registers the seam this plugin owns, present
+     * only while a `seam-conflict` is actually being reported. Releases before
+     * the plugin provisioned LSP itself told users to add such a layer by hand,
+     * so an upgrade can land here and the panel offers to remove it.
+     */
+    legacySeam?: LspLegacySeam;
+}
+/** One profile layer that must be removed before this plugin can own the LSP seam. */
+export interface LspLegacySeam {
+    /** Profile name, as passed to `dsh --profile`. */
+    profile: string;
+    /** Absolute path of the profile's patch file. */
+    patchPath: string;
+    /** The conflicting `insert` rows, as `id` plus package name. */
+    rows: Array<{
+        id: string;
+        name: string;
+    }>;
+    /** Other profiles carrying a legacy layer, which this action does not touch. */
+    otherProfiles: string[];
+    /** Whether the host must restart before the removal takes effect. */
+    restartRequired: boolean;
+    /** Human-readable summary of the layer, used in the panel copy. */
+    summary: string;
+}
+/** The outcome of removing one profile's legacy LSP layer. */
+export interface LspLegacySeamMigration {
+    profile: string;
+    /** Absolute path of the patch file that was edited. */
+    patchPath: string;
+    /** Where the pre-edit content was kept. */
+    backupPath: string;
+    /** True when the host must restart before the removal takes effect. */
+    restartRequired: boolean;
 }

package/lib/types/contracts/market.d.ts

@@ -9,6 +9,7 @@ export declare const MARKET_ROUTES: {
     readonly lspStatus: "/api/agent-plugins/lsp-status";
     readonly lspServers: "/api/agent-plugins/lsp-servers";
     readonly addLspServer: "/api/agent-plugins/lsp-servers/add";
+    readonly migrateLspSeam: "/api/agent-plugins/lsp-servers/migrate-seam";
     readonly serverConfig: "/api/agent-plugins/server-config";
     readonly saveServerConfig: "/api/agent-plugins/server-config/save";
     readonly progress: "/api/agent-plugins/progress";
@@ -71,7 +72,7 @@ export declare function userPanelRoute(kind: UserPanelKind): string;
 /** Build one user-panel mutation route URL (all POSTs). */
 export declare function userPanelMutationRoute(kind: UserPanelKind, mutation: UserPanelMutation, name?: string): string;
 /** The MCP mount backend state reported to the settings page. */
-export interface McpBackendPayload {
+export type McpBackendInfo = {
     backend: 'builtin' | 'host';
     /** Whether the host `dsh-mcp-client` resolves from the plugin context. */
     hostClient: {
@@ -83,7 +84,7 @@ export interface McpBackendPayload {
         setting: 'auto' | 'global' | 'china';
         effective: 'global' | 'china';
     };
-}
+};
 /** One unmanaged `.sources/` checkout the user can adopt as a source. */
 export interface UnmanagedSource {
     id: string;

package/lib/types/contracts/mcp-status.d.ts

@@ -35,6 +35,10 @@ export interface McpStatusEntry {
     advertisedTools?: boolean;
     /** Whether a failed server will be retried automatically. */
     retryable?: boolean;
+    /** A remote server whose suite declares no `auth` block: the bridge still
+     *  runs the OAuth flow when the server answers 401, which the redacted
+     *  configuration alone cannot show. */
+    oauthDefault?: boolean;
 }
 /** The MCP status response returned by the host. */
 export interface McpStatusPayload {

package/lib/types/model/types.d.ts

@@ -26,8 +26,20 @@ export interface SourceRef {
     /** The checkout pre-existed (manually cloned or adopted); never deleted on source removal. */
     adopted?: boolean;
 }
+/**
+ * Archive URL suffixes with the payload kind each names, longest suffix first
+ * so `.tar.gz` wins over `.tar`. Source-kind inference, source-id derivation,
+ * and archive extraction all read this one table.
+ */
+export declare const ARCHIVE_SUFFIXES: readonly [readonly [".tar.gz", "targz"], readonly [".tgz", "targz"], readonly [".zip", "zip"], readonly [".tar", "tar"]];
+/** Payload kind of an archive source. */
+export type ArchiveFormat = (typeof ARCHIVE_SUFFIXES)[number][1];
+/** Classify an archive URL by extension; undefined when unsupported. */
+export declare function archiveFormatOf(url: string): ArchiveFormat | undefined;
 /** Whether a URL points at a downloadable archive. */
 export declare function isArchiveUrl(url: string): boolean;
+/** Drop a trailing archive suffix (`plugin-0.1.zip` → `plugin-0.1`); other values pass through. */
+export declare function stripArchiveSuffix(value: string): string;
 /**
  * Effective acquisition kind of a source: the explicit `kind` wins, the
  * legacy `local` flag maps to `'local'`, archive-shaped URLs infer
@@ -163,8 +175,13 @@ export interface LspSuiteConfig {
 }
 /** Install dimension of a suite. */
 export type SuiteDimension = 'user' | 'project';
-/** One discovered suite with runtime-relevant fields resolved. */
-export interface Suite {
+/**
+ * One suite as scanning produced it, with runtime-relevant fields resolved:
+ * no install entry has been merged in, so there is no lock commit, install
+ * timestamp, or effective surface set — except where the layout describes the
+ * set itself (project-native). Runtime consumers take {@link Suite}.
+ */
+export interface DiscoveredSuite {
     resources?: {
         commands: SuiteMarkdownResource[];
         agents: SuiteMarkdownResource[];
@@ -184,7 +201,7 @@ export interface Suite {
     surfaces: SuiteSurfaceCounts;
     dimension: SuiteDimension;
     enabled: boolean;
-    /** Effective per-surface enablement (overrides merged over enabled defaults). */
+    /** Effective per-surface enablement, declared only by a self-describing layout. */
     activeSurfaces?: Record<SuiteSurfaceKey, boolean>;
     lockCommit?: string;
     installedAt?: string;
@@ -196,6 +213,15 @@ export interface Suite {
     /** Surface diagnostics on a surviving suite; invalid declared manifests are rejected before discovery returns a suite. */
     errors: string[];
 }
+/**
+ * A suite with its install state applied: the shape `CatalogContext.project()`
+ * returns and every runtime consumer takes. The effective surface set is
+ * always present, so no consumer has to interpret its absence.
+ */
+export interface Suite extends DiscoveredSuite {
+    /** Effective per-surface enablement (overrides merged over enabled defaults). */
+    activeSurfaces: Record<SuiteSurfaceKey, boolean>;
+}
 export interface ProjectHooks {
     projectRoot: string;
     events: Record<string, Array<{
@@ -229,5 +255,3 @@ export interface SuiteState {
     sources: SourceRef[];
     installed: Record<string, InstalledEntry>;
 }
-/** Browser-safe market records are shared from the transport contracts. */
-export type { OverviewPayload, SourceOverview, SuiteOverviewCard } from '../contracts/market.js';

package/lib/types/runtime/agent-role-names.d.ts

@@ -0,0 +1,6 @@
+/** Internal IDs stay opaque to callers; only colliding resource names need qualification. */
+export declare function namedAgentRoles<T extends {
+    name: string;
+}>(entries: readonly T[]): Array<T & {
+    callName: string;
+}>;

package/lib/types/runtime/agent-role-router.d.ts

@@ -1,10 +1,7 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { type SubagentCatalogEntry } from './subagent-catalog.js';
 import { type HostTranslate } from './host-locale.js';
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-export declare const AGENT_ROLE_TOOL_NAME = "subagents_run";
+export declare const AGENT_ROLE_TOOL_NAME = "subagent_run";
 /** Panel identity is preserved so identically named cards from different suites remain addressable. */
 export interface AgentRoleEntry {
     name: string;
@@ -14,6 +11,10 @@ export interface AgentRoleEntry {
     title?: string;
     rawText?: string;
 }
+/**
+ * The executable part of one card. `tools` / `disallowedTools` stay in the file
+ * and are preserved by the editors, but they are not applied.
+ */
 export interface AgentRolePolicy {
     content: string;
     model?: string;
@@ -21,75 +22,77 @@ export interface AgentRolePolicy {
     reasoningEffort?: string;
     title?: string;
     description?: string;
-    tools?: string[];
-    disallowedTools?: string[];
     disabled: boolean;
 }
-/** Strict YAML parsing prevents malformed routing/restriction metadata from silently inheriting wider privileges. */
-export declare function parseAgentRole(text: string): AgentRolePolicy;
-interface ModelCatalog {
-    listProviders(): {
-        id: string;
-    }[];
-    listModels(provider: string): Promise<{
-        id: string;
-    }[]>;
-    resolveCallConfig(config: {
-        provider: string;
-        model: string;
-        reasoningEffort?: string;
-    }, signal?: AbortSignal): Promise<unknown>;
-}
-/** Bare ids must resolve uniquely; Claude aliases are accepted only if actually advertised by a DSH provider. */
-export declare function resolveAgentModel(policy: AgentRolePolicy, catalog: ModelCatalog): Promise<{
+/** Child LLM options this plugin sends; never carries inherited parent values. */
+export interface AgentRoleOptions {
     provider?: string;
     model?: string;
-}>;
-export interface AgentRoleRequest {
-    label: string;
+    reasoningEffort?: string;
+}
+/** What the host `ctx.subagents` seam receives for one role delegation. */
+export interface AgentRoleDelegation {
     prompt: {
         type: 'text';
         text: string;
     }[];
     parent: unknown;
-    signal: AbortSignal;
     maxDepth: number;
-    agentOptions: {
-        provider?: string;
-        model?: string;
-        reasoningEffort?: string;
-    };
     persona: string;
-    toolFilter?: {
-        allow?: string[];
-        deny?: string[];
-    };
+    agentOptions?: AgentRoleOptions;
 }
 export interface AgentRoleHost {
     tools: {
         register(definition: unknown): () => void;
     };
-    llm: ModelCatalog;
+    llm: {
+        resolveCallConfig(config: {
+            provider: string;
+            model: string;
+            reasoningEffort?: string;
+        }, signal?: AbortSignal): Promise<unknown>;
+    };
     subagents: {
-        start(provider: string, request: AgentRoleRequest): Promise<{
-            id: string;
-            result: Promise<{
-                stopReason: string;
-                output: JsonValue[];
-            }>;
-            dispose(): void | Promise<void>;
+        startContinuable(spec: {
+            provider: string;
+            label: string;
+            request: AgentRoleDelegation;
+            signal: AbortSignal;
+        }): Promise<{
+            childId: string;
+            messageId: string;
         }>;
     };
 }
-/** Read the same declaration for catalog summaries and execution, including inline resources. */
-export declare function readAgentRole(entry: AgentRoleEntry): Promise<AgentRolePolicy>;
+/** Strict YAML parsing prevents malformed routing metadata from silently inheriting wider privileges. */
+export declare function parseAgentRole(text: string): AgentRolePolicy;
+/**
+ * Resolve the child LLM options one card may contribute.
+ *
+ * A card route is advisory. Only an exact `provider` plus `model` pair is
+ * applied, and only when the live LLM runtime accepts it; every other
+ * declaration — a bare id, a Claude alias, a lone `provider`, an unsupported
+ * effort — degrades to inheriting the parent route and reports a diagnostic.
+ * @param policy - the card's parsed routing metadata.
+ * @param parent - the calling Agent whose route an unusable declaration falls back to.
+ * @param llm - live LLM runtime owning provider, model and effort validation.
+ * @param signal - tool-call cancellation signal.
+ * @param subject - role name used in diagnostics.
+ * @param diagnose - diagnostic sink; degradation is reported, never silent.
+ * @returns the options to send, or undefined for pure inheritance.
+ */
+export declare function resolveAgentOptions(policy: AgentRolePolicy, parent: unknown, llm: AgentRoleHost['llm'], signal: AbortSignal, subject: string, diagnose: (message: string) => void): Promise<AgentRoleOptions | undefined>;
 /** Stable summaries; invalid declarations are excluded and transient read failures abort publication. */
 export declare function agentRoleCatalog(entries: AgentRoleEntry[], signal: AbortSignal, diagnose?: (message: string) => void): Promise<SubagentCatalogEntry[]>;
-/** Resolve fresh panel state and raw Markdown on every call, including after edits, disabling and uninstall. */
-export declare function executeAgentRole(host: AgentRoleHost, listRoles: (parent?: unknown) => Promise<AgentRoleEntry[]>, name: string, prompt: string, parent: unknown, signal: AbortSignal): Promise<{
-    runId: string;
-    output: JsonValue[];
+/** Read the same declaration for catalog summaries and execution, including inline resources. */
+export declare function readAgentRole(entry: AgentRoleEntry): Promise<AgentRolePolicy>;
+/**
+ * Start one role child and return its durable id without waiting for the result.
+ * Resume state, steering, and the settlement notice belong to the host's
+ * continuation manager; this executor owns only role resolution.
+ */
+export declare function executeAgentRole(host: AgentRoleHost, listRoles: (parent?: unknown) => Promise<AgentRoleEntry[]>, agentName: string, prompt: string, parent: unknown, signal: AbortSignal, diagnose?: (message: string) => void): Promise<{
+    subagentId: string;
 }>;
 /** Mount once after tools, llm and subagents are available; the returned disposer belongs to the plugin lifecycle. */
 export declare function mountAgentRoleTool(ctx: Context, listRoles: (parent?: unknown) => Promise<AgentRoleEntry[]>, t?: HostTranslate): () => void;
-export {};

package/lib/types/runtime/deadline.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Bounded waits for work this plugin cannot cancel.
+ *
+ * Every wait here is a race against a timer: the caller stops waiting and the
+ * underlying work keeps running. That is the only safe shape for a mount and
+ * for the change pipeline that drives it — a spawned server process or a
+ * browser authorization the user is completing must not be abandoned just
+ * because nobody is waiting for it any more.
+ *
+ * @module runtime/deadline
+ */
+/**
+ * Resolve `true` once `work` settles, or `false` when `deadlineMs` elapses.
+ *
+ * A rejection counts as settled: this helper only reports timing, so callers
+ * that need the failure attach their own handler to `work`.
+ */
+export declare function settlesWithin(work: Promise<unknown>, deadlineMs: number): Promise<boolean>;

package/lib/types/runtime/feedback-tool.d.ts

@@ -5,13 +5,16 @@
  * default true), the model can call `report_market_issue` when it concludes a
  * problem it is looking at is caused by dsh-agent-plugins-market — a failed
  * install, a misdetected source, a market UI defect the user just described.
- * The tool files a GitHub issue on the plugin repository through the GitHub
- * REST API, or falls back to appending a local JSONL record under the plugin
- * data root when no repository host context is available.
+ *
+ * Filing happens in three steps, most preferred first: the `gh` CLI when it is
+ * installed and authenticated, the GitHub REST API when the process carries a
+ * `GITHUB_TOKEN` / `GH_TOKEN`, and otherwise nothing is filed — the caller
+ * gets the complete issue text plus a prefilled "new issue" URL that is opened
+ * in the browser and handed back to the user to submit.
  *
  * The tool is deliberately narrow: the title/body must describe the problem,
- * submissions are rate-limited, and the setting switch unregisters the tool
- * on the next reconcile pass.
+ * real submissions are rate-limited, and the setting switch unregisters the
+ * tool on the next reconcile pass.
  * @module runtime/feedback-tool
  */
 import type { Context } from '@deepseek-ai/cordis';
@@ -23,8 +26,13 @@ export declare const FEEDBACK_LABEL = "agent-feedback";
 /** One accepted or rejected submission outcome, mirrored to the model. */
 export interface FeedbackOutcome {
     ok: boolean;
-    /** Where the report went: the issue URL, or the local fallback path label. */
+    /**
+     * The created issue URL, or — when nothing could file it — the prefilled
+     * "new issue" URL the user opens to submit the report themselves.
+     */
     location?: string;
+    /** The complete issue title and body; present when nothing was filed automatically. */
+    issueText?: string;
     reason?: string;
 }
 /** A structured experience report the model composes. */
@@ -36,14 +44,28 @@ export interface FeedbackReport {
     /** What actually happened (errors, wrong state, broken flow). */
     actual?: string;
 }
+/** Injectable effects, so tests never reach the network or a real browser. */
+export interface FeedbackPorts {
+    /** File the issue through the `gh` CLI; undefined when gh is missing or refused. */
+    ghIssue?: (title: string, body: string) => Promise<string | undefined>;
+    /** Open the prefilled issue page; best effort. */
+    openPage?: (url: string) => Promise<void>;
+}
+/** The public "new issue" page for one report, prefilled with title and body. */
+export declare function newIssueUrl(title: string, body: string): string;
 /**
- * Submit one experience report. Tries the GitHub issue API first (works when
- * the deployment carries a GITHUB_TOKEN / GH_TOKEN with repo scope), then
- * falls back to the local JSONL spool under `<dataRoot>/feedback/`.
+ * Submit one experience report through `gh`, then the REST API, then a
+ * prefilled issue page the user submits themselves. Only a real submission
+ * advances the burst cooldown.
  */
-export declare function submitFeedback(dataRoot: string, report: FeedbackReport, now?: number): Promise<FeedbackOutcome>;
+export declare function submitFeedback(dataRoot: string, report: FeedbackReport, now?: number, ports?: FeedbackPorts): Promise<FeedbackOutcome>;
 /** Render the model's structured report into a deterministic issue body. */
 export declare function renderFeedbackBody(report: FeedbackReport): string;
 export declare const FEEDBACK_TOOL_NAME: "report_market_issue";
-/** Register the feedback tool; returns the disposer. Undefined when the host has no tools service. */
+/**
+ * Register the feedback tool; returns the disposer. Undefined when the host has
+ * no tools service to register on — the caller turns that into a mount-path
+ * diagnostic instead of an error, since the setting can simply have no effect
+ * on this host.
+ */
 export declare function mountFeedbackTool(hostCtx: Context, dataRoot: string, t: (key: string, params?: Record<string, string>) => string): (() => void) | undefined;

package/lib/types/runtime/hooks-mounts.d.ts

@@ -9,7 +9,7 @@ export declare class HooksMountRegistry {
     private readonly live;
     private readonly fingerprints;
     private readonly temporary;
-    private queue;
+    private readonly passes;
     constructor(ctx: Context);
     /** Mount/unmount one bridge per suite to match the enabled suites exactly. */
     reconcile(enabledSuites: Suite[]): Promise<HooksMountDiagnostic[]>;

package/lib/types/runtime/host-locale.d.ts

@@ -1,5 +1,5 @@
 /** Host runtime dictionary keys (mirrored for zh and en). */
-export type HostLocaleKey = 'subagentCatalogIntro' | 'subagentCatalogUpdated' | 'subagentCatalogEmpty' | 'subagentCatalogCall' | 'subagentCatalogInherit' | 'subagentCatalogDefaultEffort' | 'commandForwardTitle' | 'commandAcknowledged' | 'userCommandSourceLabel' | 'userCommandForwardTitle' | 'userCommandAcknowledged' | 'userSkillDescription' | 'feedbackToolCardTitle';
+export type HostLocaleKey = 'subagentCatalogIntro' | 'subagentCatalogUpdated' | 'subagentCatalogEmpty' | 'subagentCatalogCall' | 'commandAcknowledged' | 'userCommandSourceLabel' | 'feedbackToolCardTitle';
 export type HostTranslate = (key: HostLocaleKey, params?: Record<string, string>) => string;
 interface ResolvedLocale {
     t: HostTranslate;

package/lib/types/runtime/lsp-direct-config.d.ts

@@ -1,12 +1,12 @@
 import type { LspServerSpec } from '../model/types.js';
 /** The direct LSP server configuration file path. */
-export declare function lspServersPath(dataRoot: string): string;
+export declare function lspServersPath(agentsRoot: string): string;
 /** Load the user-configured LSP servers; unreadable or invalid files yield an empty table. */
-export declare function loadLspServers(dataRoot: string): Promise<{
+export declare function loadLspServers(agentsRoot: string): Promise<{
     servers: Record<string, LspServerSpec>;
     errors: string[];
 }>;
 /** Validate and persist the user-configured LSP servers; returns normalized specs. */
-export declare function saveLspServers(dataRoot: string, raw: unknown): Promise<{
+export declare function saveLspServers(agentsRoot: string, raw: unknown): Promise<{
     servers: Record<string, LspServerSpec>;
 }>;

package/lib/types/runtime/lsp-mounts.d.ts

@@ -4,11 +4,22 @@
  *
  * Mounts reconcile against the enabled-suite set exactly like the MCP mounts:
  * reconcile() unmounts rows whose suite was disabled or removed and mounts
- * rows that appeared. The host LSP package is optional at runtime — without
- * it, suites keep every other surface and the manager reports a one-line
- * `host-missing` diagnostic that does not enter the retry schedule (a missing
- * package is not a transient failure). Mount failures that can resolve after
- * user action (installing the language server executable) do retry.
+ * rows that appeared. The first wanted server also mounts the capability seam
+ * this plugin owns end to end — `ctx.lsp` and the model-facing `lsp` tool —
+ * because the dsh installation does not carry the LSP packages; the last one
+ * releases it, so a profile that never enables an LSP suite never grows the
+ * `lsp` tool.
+ *
+ * Provisioning is a property of the plugin, not of the profile: both mounts
+ * are unconditional and the version comes from this package's dependency
+ * declaration. Nothing probes whether the profile already carries a seam — a
+ * seam another layer registered comes back as a `seam-conflict` diagnostic
+ * naming the layer to remove, so the aligned copy is the only one that can run.
+ *
+ * A failure the plugin cannot fix itself (a package that is genuinely absent
+ * from the profile) reports a one-line `host-missing` diagnostic that does not
+ * enter the retry schedule. Mount failures that can resolve after user action
+ * (installing the language server executable) do retry.
  *
  * Provider identity: one `${suiteId}/${serverKey}` provider id per server, so
  * two suites declaring the same server key mount independently. Extension
@@ -17,7 +28,8 @@
  * user resolves it through per-suite surface toggles.
  */
 import type { Context } from '@deepseek-ai/cordis';
-import type { Suite } from '../model/types.js';
+import { type LegacyLspSeam } from './profile-seam.js';
+import { type Suite } from '../model/types.js';
 export interface LspMountDiagnostic {
     suiteId: string;
     serverKey: string;
@@ -42,34 +54,71 @@ export declare function toLspServerConfig(spec: {
     initializationOptions?: unknown;
     configuration?: unknown;
 }): LspStdioServerConfig;
-/** Minimal structural shape of the dynamically imported `dsh-lsp-stdio` module. */
-interface LspStdioModule {
+/** Minimal structural shape of a dynamically imported host plugin module. */
+interface HostModule {
     default?: unknown;
 }
 export declare class LspMountRegistry {
     private readonly ctx;
     private readonly live;
     /** Serialize mount and unmount passes so a disable cannot race an in-flight spawn. */
-    private reconcileQueue;
-    /** Pending retry timers keyed by mount key, so a teardown can cancel them. */
+    private readonly passes;
+    /** Delayed re-attempts for mounts that are not live yet. */
     private readonly retries;
-    /** Attempt count per mount key; reset whenever a retry succeeds. */
-    private readonly attempts;
     /** Snapshot of the last reconciled suite set, replayed by retry passes. */
     private lastEnabled;
     /** Host module loader; overridable for tests. */
     private loadHost;
+    /**
+     * Reads the profile files when a seam conflict needs explaining. Injectable
+     * because it touches the machine's own `$DSH_HOME`, so a test must not
+     * inherit whatever the developer running it happens to have configured.
+     */
+    private readonly locateSeams;
+    /** `ctx.lsp` seam loader, mounted only when the profile supplies no service. */
+    private loadService;
+    /** `lsp` tool loader, mounted only when the profile publishes no such tool. */
+    private loadTool;
+    /** Capability plugins this registry mounted, in mount order, disposed with the last server. */
+    private readonly capability;
+    /** Whether the capability seam was already resolved for the current wanted set. */
+    private capabilityReady;
+    /** Why the capability seam is unavailable; re-attempted on the next reconcile pass. */
+    private capabilityFailure;
     /** Latest diagnostic per suite id; cleared when its suite mounts or leaves the wanted set. */
     private readonly lastDiagnostics;
     /** Direct (user-configured) server provider; defaults to none. */
     private directProvider;
     private disabledProvider;
     private disabledSnapshot;
-    constructor(ctx: Context, loadHost?: () => Promise<LspStdioModule | undefined>);
+    constructor(ctx: Context, loadHost?: () => Promise<HostModule | undefined>, loadService?: () => Promise<HostModule | undefined>, loadTool?: () => Promise<HostModule | undefined>, locateSeams?: () => Promise<LegacyLspSeam[]>);
     /** Queue one reconciliation behind any in-flight mount/unmount pass. */
     reconcile(enabledSuites: Suite[]): Promise<LspMountDiagnostic[]>;
     /** Mount/unmount LSP servers to match the enabled suites plus direct config exactly. */
     private reconcileNow;
+    /**
+     * Mount the capability seam this plugin delivers end to end: `ctx.lsp`, then the model-facing
+     * `lsp` tool.
+     *
+     * The plugin never asks what the profile already carries. Its dependency declaration decides
+     * the version, so deferring to a seam another layer registered would silently run whatever
+     * version that layer picked. Both mounts are therefore unconditional; a seam that is already
+     * taken comes back as a `seam-conflict` diagnostic naming the layer to remove, which is the
+     * only way the aligned copy can own it.
+     * @returns the failure, or undefined when the seam is ready.
+     */
+    private ensureCapability;
+    /** Mount one capability plugin and remember it for teardown with the last server. */
+    private mountCapability;
+    /**
+     * Explain a taken seam, naming the profile layer to remove when one can be
+     * found on disk. Releases before the plugin provisioned LSP itself told users
+     * to add that layer by hand, so the message points at the exact file and rows
+     * rather than at "the profile" in general.
+     */
+    private seamConflictReason;
+    /** Dispose the capability seam this registry mounted, once no wanted server needs it. */
+    private releaseCapability;
     /** Install the direct (user-configured) server provider used at reconcile time. */
     setDirectProvider(provider: () => Promise<Record<string, import('../model/types.js').LspServerSpec>>): void;
     setDisabledProvider(provider: () => Promise<Set<string>>): void;
@@ -81,12 +130,6 @@ export declare class LspMountRegistry {
     /** Mount one suite's full server table as a single `dsh-lsp-stdio` instance. */
     private mountWith;
     private unmount;
-    /**
-     * Schedule a delayed re-attempt for a mount that still is not live. A
-     * `host-missing` failure passes no diagnostic and is never retried; the
-     * schedule is bounded and resets with every reconcile pass.
-     */
-    private scheduleRetry;
     /** Dispose every live mount after queued reconciliation passes settle. */
     disposeAll(): Promise<void>;
 }

package/lib/types/runtime/lsp-status.d.ts

@@ -7,7 +7,8 @@
  * so a row's state is a declaration-and-diagnostic judgment: a suite whose
  * mount succeeded yields `mounted` (the seam guarantees registration), a
  * stored diagnostic yields its own state, and a declaration with neither
- * mounts nor diagnostics means the host packages are absent (`host-missing`).
+ * mounts nor diagnostics means the capability packages could not be loaded
+ * (`host-missing`).
  * Direct user-configured rows follow the same model under the sentinel suite
  * id `direct` (mirroring mcp-status's `plugin`/`direct` split).
  */

package/lib/types/runtime/mcp-auth-record.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The credential record one MCP server's OAuth grant lives under.
+ *
+ * `runtime/mcp-client/oauth.ts` writes those records; this module addresses
+ * the same key so a grant can be dropped without waking the transport that
+ * wrote it. The scope and the name fold must stay identical to that writer's,
+ * or the delete silently misses the record.
+ *
+ * @module runtime/mcp-auth-record
+ */
+import { type CredentialKey } from './mcp-client/host-seams.js';
+/** Credential-record scope for MCP OAuth state; per-server ids follow it. */
+export declare const MCP_AUTH_RECORD_SCOPE = "mcp-auth";
+/**
+ * Fold a `serverName` into a credential-key id segment. Server names carry
+ * `__` separators (e.g. `cloudflare__cloudflare-api`), and the key grammar
+ * admits only `[a-z0-9-]`, so non-conforming characters collapse to `-` —
+ * deterministic, so the same server always reads and writes one record.
+ */
+export declare function mcpAuthRecordId(serverName: string): string;
+/** The credential record key one MCP server's OAuth grant is stored under. */
+export declare function mcpAuthRecordKey(serverName: string): CredentialKey;
+/**
+ * Drop one MCP server's OAuth grant record so the next mount re-runs the
+ * browser authorization — the path for "I picked too narrow a scope".
+ * @param store - the host credentials service, when one is mounted.
+ * @throws when the credentials service is not mounted.
+ */
+export declare function deleteMcpAuthGrant(store: unknown, serverName: string): Promise<void>;

package/lib/types/runtime/mcp-backend.d.ts

@@ -16,28 +16,31 @@
 import z from '@deepseek-ai/schemastery';
 /** The MCP mount backend the market uses for suite servers. */
 export type McpBackend = 'builtin' | 'host';
-export declare const MCP_BACKENDS: readonly McpBackend[];
 /** Settings namespace this plugin registers; the key the plugin-config tab pairs our card by. */
 export declare const MCP_SETTINGS_NAMESPACE = "dsh-agent-plugins-market";
-/** Schema of the market settings namespace: the MCP enhancement switch, the download region, and the feedback tool switch. */
+/** Schema of the market settings namespace: the switches this plugin's config card serves. */
 export declare const MarketSettingsSchema: z<Schemastery.ObjectS<{
     /** ON (default) = the built-in bridge with OAuth and SSE; OFF = host client compat mode. */
     mcpEnhanced: z<boolean, boolean>;
-    /** Read native Agent layouts under the project root; default preserves existing discovery. */
+    /** Read native Agent layouts under the project root; OFF (default) scans configured sources only. */
     scanProjectLayouts: z<boolean, boolean>;
     /** Download region for GitHub acquisition; `auto` follows the interface language. */
     downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china">;
     /** ON (default) = the `report_market_issue` model tool is registered; OFF = unregistered. */
     feedbackEnabled: z<boolean, boolean>;
+    /** ON = refresh every configured source in the background; OFF (default) = never. */
+    autoUpdateSources: z<boolean, boolean>;
 }>, Schemastery.ObjectT<{
     /** ON (default) = the built-in bridge with OAuth and SSE; OFF = host client compat mode. */
     mcpEnhanced: z<boolean, boolean>;
-    /** Read native Agent layouts under the project root; default preserves existing discovery. */
+    /** Read native Agent layouts under the project root; OFF (default) scans configured sources only. */
     scanProjectLayouts: z<boolean, boolean>;
     /** Download region for GitHub acquisition; `auto` follows the interface language. */
     downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china">;
     /** ON (default) = the `report_market_issue` model tool is registered; OFF = unregistered. */
     feedbackEnabled: z<boolean, boolean>;
+    /** ON = refresh every configured source in the background; OFF (default) = never. */
+    autoUpdateSources: z<boolean, boolean>;
 }>>;
 /** Path of the legacy persisted settings file under the plugin data root. */
 export declare function marketSettingsPath(dataRoot: string): string;