dsh-agent-plugins-market 0.6.2 → 0.7.1

package/lib/runtime/mcp-client/tools.js

@@ -9,10 +9,9 @@
  * to the DeepSeek function-name constraints. The raw name is only ever sent on
  * the wire (`tools/call`); the public name is never parsed to recover it.
  *
- * The host contract below (`ToolDefinition`, `ToolExecution`,
- * `ToolExecutionResult`) is a structural mirror of `@deepseek-ai/dsh-tools`
- * rc.2's registration surface — the runtime accepts the same object shape the
- * upstream bridge registers, so the model-facing behavior is identical.
+ * The registration surface this module targets is mirrored by
+ * `./host-contract.js`; MCP results are mapped into host content blocks by
+ * `./projection.js`.
  *
  * @module runtime/mcp-client/tools
  */
@@ -21,7 +20,7 @@ import { isDeepStrictEqual } from 'node:util';
 import { ListToolsResultSchema } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';
 import { assertSupportedJsonSchema } from './json-schema-subset.js';
-import { isImageAdmissionError } from './host-seams.js';
+import { containsImage, extractText, prepareImageProjection } from './projection.js';
 /**
  * DeepSeek function-name contract: at most 64 characters. Wire-protocol
  * constant, not configuration.
@@ -31,10 +30,6 @@ const MAX_PUBLIC_NAME_LENGTH = 64;
 const INVALID_NAME_CHARS = /[^A-Za-z0-9_-]/g;
 /** Hex chars of the SHA-256 identity hash appended on lossy normalization. */
 const HASH_LENGTH = 12;
-/** Raster formats supported by the durable attachment vocabulary. */
-const IMAGE_MEDIA_TYPES = ['image/png', 'image/jpeg', 'image/webp', 'image/gif'];
-/** Canonical RFC 4648 base64, excluding whitespace and URL-safe aliases. */
-const CANONICAL_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 /** Raw result record: the bridge owns JSON-value validation after transport. */
 const RawCallToolResultSchema = z.record(z.string(), z.unknown());
 /** List without mutating the SDK's per-page output-validator cache. */
@@ -253,183 +248,3 @@ function createExecutor(client, host, rawName, taskRequired, opts, projections)
         return value;
     };
 }
-/** Whether an untrusted MCP content array contains a declared image block. */
-function containsImage(content) {
-    return content.some(value => isRecord(value) && value.type === 'image');
-}
-/** Narrow one JSON value to a string-keyed object. */
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-/** Narrow a declared MIME string to the durable image vocabulary. */
-function isImageMediaType(value) {
-    return IMAGE_MEDIA_TYPES.includes(value);
-}
-/** Decode one untrusted MCP image block without accepting base64 aliases. */
-function decodeImage(block) {
-    if (block.mimeType === undefined || !isImageMediaType(block.mimeType)) {
-        throw new Error('the declared media type is not PNG, JPEG, WebP, or GIF');
-    }
-    if (block.data === undefined || !CANONICAL_BASE64.test(block.data)) {
-        throw new Error('the image data is not canonical base64');
-    }
-    const data = Buffer.from(block.data, 'base64');
-    if (data.toString('base64') !== block.data) {
-        throw new Error('the image data is not canonical base64');
-    }
-    return { data, mediaType: block.mimeType };
-}
-/**
- * Resolve the active model route and durable store for an image-bearing result.
- * @param host - bridge host with optional services.
- * @param exec - exact tool execution whose agent supplies the latest route.
- * @returns the attachment store after exact positive image-capability proof.
- */
-async function resolveImageAdmission(host, exec) {
-    const attachments = host.getService?.('attachments');
-    if (attachments === undefined || typeof attachments.saveImages !== 'function') {
-        throw new Error('no attachment store is mounted');
-    }
-    const routed = exec.agent?.session?.requestHeader?.()?.config;
-    const provider = routed?.provider ?? exec.agent?.options?.provider;
-    const model = routed?.model ?? exec.agent?.options?.model;
-    const llm = host.getService?.('llm');
-    if (provider === undefined || model === undefined || llm === undefined) {
-        throw new Error('the current model route could not be resolved');
-    }
-    let info;
-    try {
-        info = await llm.resolveModelInfo(provider, model, exec.signal);
-    }
-    catch {
-        throw new Error('the current model route could not be verified');
-    }
-    if (info?.inputModalities === undefined || !info.inputModalities.includes('image')) {
-        throw new Error(`model "${model}" does not declare image input`);
-    }
-    if (exec.signal.aborted)
-        throw new Error('the tool call was canceled before image storage');
-    return attachments;
-}
-/** Stable diagnostic text for an image block that was not admitted. */
-function imageDiagnostic(block, reason) {
-    return `[image unavailable: ${block.mimeType ?? 'unknown media type'}; ${reason}; raw image data remains available to programmatic callers]`;
-}
-/**
- * Decode, preflight, and durably save one MCP result's ordered image batch.
- * Any refusal projects every image as text while retaining the canonical raw
- * value for programmatic callers.
- */
-async function prepareImageProjection(host, exec, content, toolName) {
-    const decoded = [];
-    const validationErrors = new Map();
-    const imageIndexes = [];
-    for (const [index, value] of content.entries()) {
-        if (!isRecord(value) || value.type !== 'image')
-            continue;
-        imageIndexes.push(index);
-        try {
-            decoded.push(decodeImage(value));
-        }
-        catch (error) {
-            // decodeImage owns every throw above and always produces Error.
-            validationErrors.set(index, error.message);
-        }
-    }
-    if (validationErrors.size > 0) {
-        return projectContent(content, toolName, (block, index) => ({
-            type: 'text',
-            text: imageDiagnostic(block, validationErrors.get(index) ?? 'another image in the same result was invalid')
-        }));
-    }
-    let attachments;
-    try {
-        attachments = await resolveImageAdmission(host, exec);
-    }
-    catch (error) {
-        // resolveImageAdmission contains provider failures and throws Error only.
-        const reason = error.message;
-        return projectContent(content, toolName, block => ({ type: 'text', text: imageDiagnostic(block, reason) }));
-    }
-    try {
-        const refs = await attachments.saveImages(decoded);
-        const byIndex = new Map(imageIndexes.map((index, offset) => [index, refs[offset]]));
-        return projectContent(content, toolName, (_block, index) => ({
-            type: 'image',
-            attachment: byIndex.get(index)
-        }));
-    }
-    catch (error) {
-        const reason = isImageAdmissionError(error) ? `image admission rejected the result: ${error.message}` : 'durable image storage rejected the result';
-        return projectContent(content, toolName, block => ({
-            type: 'text',
-            text: imageDiagnostic(block, reason)
-        }));
-    }
-}
-/**
- * Extract text from an MCP content array into a single string.
- * - text blocks: join with '\n'
- * - image/audio/resource blocks: replaced with a placeholder
- *
- * Defensive: fields that the MCP spec declares required (mimeType, text) are
- * guarded with fallbacks because this is a network trust boundary.
- */
-function extractText(mcpContent, toolName) {
-    const content = projectContent(mcpContent, toolName);
-    // The default image projector below also returns text, so this local call
-    // cannot produce a core image block.
-    return content.map(block => block.text).join('\n');
-}
-/**
- * Project ordered MCP blocks into the core content vocabulary.
- * Text-like runs are newline-coalesced; admitted images split those runs at
- * their original position.
- */
-function projectContent(mcpContent, toolName, image = block => ({
-    type: 'text',
-    text: imageDiagnostic(block, 'this result was not admitted to durable model context')
-})) {
-    const projected = [];
-    const text = [];
-    const flushText = () => {
-        if (text.length === 0)
-            return;
-        projected.push({ type: 'text', text: text.splice(0).join('\n') });
-    };
-    for (const [index, value] of mcpContent.entries()) {
-        if (!isRecord(value)) {
-            text.push('[unsupported MCP content block: expected an object]');
-            continue;
-        }
-        const block = value;
-        switch (block.type) {
-            case 'text':
-                if (block.text !== undefined)
-                    text.push(block.text);
-                break;
-            case 'image':
-                flushText();
-                projected.push(image(block, index));
-                break;
-            case 'resource_link':
-                if (block.name === undefined || block.uri === undefined) {
-                    text.push('[resource link unavailable: the MCP block is missing its name or URI]');
-                }
-                else {
-                    text.push(`Resource link: ${block.name} (${block.uri})`);
-                }
-                break;
-            case 'audio':
-                text.push(`[audio result unsupported: ${block.mimeType ?? 'unknown media type'}; raw audio data remains available to programmatic callers]`);
-                break;
-            case 'resource':
-                text.push('[embedded resource unsupported; raw resource data remains available to programmatic callers]');
-                break;
-            default:
-                text.push(`[unsupported MCP content type: ${block.type}]`);
-        }
-    }
-    flushText();
-    return projected.length > 0 ? projected : [{ type: 'text', text: `(${toolName} returned no model-visible content)` }];
-}

package/lib/runtime/mcp-config.js

@@ -13,13 +13,29 @@
 import { createHash } from 'node:crypto';
 import { DEFAULT_TOOL_CALL_TIMEOUT_MS } from './mcp-client/config.js';
 import { resolveCwd } from '../catalog/validate.js';
-import { qualifiedSuiteId } from '../catalog/paths.js';
+import { qualifiedSuiteId, suiteDataDir } from '../catalog/paths.js';
 import { applyOverride } from './mcp-overrides.js';
 import { PLUGIN_ROOT_VARIABLES, PLUGIN_DATA_VARIABLES } from '../model/layouts.js';
 /** The max length the bridge accepts for a serverName. */
 const SERVER_NAME_MAX = 32;
 const PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
 const BUILTIN_PLACEHOLDERS = new Set([...PLUGIN_ROOT_VARIABLES, ...PLUGIN_DATA_VARIABLES]);
+/**
+ * The effective view of one suite's `mcp.json` servers: the user's per-server
+ * overrides applied, every row flagged with whether it is used at all, and each
+ * row's credential references read off the effective shape. Mounting, status
+ * and detail rendering read this one projection, so a server cannot be listed
+ * as enabled while mounting something else.
+ */
+export function effectiveMcpServers(suite, overrides = {}) {
+    const rows = [];
+    for (const [serverKey, source] of Object.entries(suite.mcp?.servers ?? {})) {
+        const override = overrides[serverKey];
+        const server = applyOverride(source, override);
+        rows.push({ serverKey, server, override, enabled: override?.enabled !== false, credentialRefs: credentialRefsInServer(server) });
+    }
+    return rows;
+}
 /**
  * Build one mount request per supported mcp.json server, resolving every
  * `${NAME}` through the credential resolver before a child process or HTTP
@@ -29,31 +45,34 @@ const BUILTIN_PLACEHOLDERS = new Set([...PLUGIN_ROOT_VARIABLES, ...PLUGIN_DATA_V
  * @param overrides user-owned per-server overrides (url/headers/env/args
  *   replacement plus enable/disable); applied before mount. Disabled servers
  *   are omitted entirely.
- * @returns mount requests plus per-server failures. serverName collisions are
- *   reported by the mount registry, not here.
+ * @returns mount requests, per-server failures, and the credential references
+ *   the effective servers need. serverName collisions are reported by the
+ *   mount registry, not here.
  */
 export async function toMcpMounts(suite, pluginDataRoot, overrides = {}, resolver = { resolve: async () => undefined }) {
     if (suite.mcp === undefined)
-        return { mounts: [], failures: [] };
+        return { mounts: [], failures: [], credentialRefs: [] };
     const mounts = [];
     const failures = [];
-    for (const [serverKey, source] of Object.entries(suite.mcp.servers)) {
-        const override = overrides[serverKey];
-        if (override?.enabled === false)
+    const credentialRefs = new Set();
+    for (const row of effectiveMcpServers(suite, overrides)) {
+        if (!row.enabled)
             continue;
-        const server = applyOverride(source, override);
+        for (const ref of row.credentialRefs)
+            credentialRefs.add(ref);
         try {
-            const result = await toResolvedMount(suite.mcp.root === undefined ? suite : { ...suite, root: suite.mcp.root }, serverKey, server, pluginDataRoot, resolver);
+            const target = suite.mcp.root === undefined ? suite : { ...suite, root: suite.mcp.root };
+            const result = await toResolvedMount(target, row.serverKey, row.server, pluginDataRoot, resolver);
             if (result.failure !== undefined)
                 failures.push(result.failure);
             if (result.request !== undefined)
                 mounts.push(result.request);
         }
         catch {
-            failures.push({ serverKey, code: 'credential-error', credentialRefs: credentialRefsInServer(server), reason: 'credential lookup failed' });
+            failures.push({ serverKey: row.serverKey, code: 'credential-error', credentialRefs: row.credentialRefs, reason: 'credential lookup failed' });
         }
     }
-    return { mounts, failures };
+    return { mounts, failures, credentialRefs: [...credentialRefs] };
 }
 /** Find external credential references used by one MCP server definition. */
 export function credentialRefsInServer(server) {
@@ -79,7 +98,7 @@ export function credentialRefsInServer(server) {
 async function toResolvedMount(suite, serverKey, server, pluginDataRoot, resolver) {
     if (server.type === 'sse') {
         // The market bridge supports the legacy HTTP+SSE transport natively.
-        const expand = expander(suite, joinInside(pluginDataRoot, qualifiedSuiteId(suite.sourceId, suite.id)), resolver);
+        const expand = expander(suite, suiteDataDir(pluginDataRoot, suite.sourceId, suite.id), resolver);
         const url = await expand.one(server.url);
         const headers = await expand.map(server.headers ?? {});
         const missing = unique([...url.missing, ...headers.missing]);
@@ -96,7 +115,7 @@ async function toResolvedMount(suite, serverKey, server, pluginDataRoot, resolve
         };
         return { request: { suiteId: qualifiedSuiteId(suite.sourceId, suite.id), serverKey, config: sseConfig } };
     }
-    const expand = expander(suite, joinInside(pluginDataRoot, qualifiedSuiteId(suite.sourceId, suite.id)), resolver);
+    const expand = expander(suite, suiteDataDir(pluginDataRoot, suite.sourceId, suite.id), resolver);
     const serverName = deriveServerName(suite.id, serverKey);
     if (server.type === 'stdio') {
         const args = await expand.all(server.args ?? []);
@@ -115,7 +134,7 @@ async function toResolvedMount(suite, serverKey, server, pluginDataRoot, resolve
                     command: server.command.startsWith('./') ? joinInside(suite.root, server.command.slice(2)) : server.command,
                     args: args.values,
                     env: env.values,
-                    cwd: resolveCwd(cwd.value, suite.root, joinInside(pluginDataRoot, qualifiedSuiteId(suite.sourceId, suite.id))),
+                    cwd: resolveCwd(cwd.value, suite.root, suiteDataDir(pluginDataRoot, suite.sourceId, suite.id)),
                     ...bridgePolicy(server),
                     failOnStartupError: true
                 }
@@ -158,6 +177,9 @@ function mapAuth(auth) {
 function bridgePolicy(server) {
     return {
         toolCallTimeoutMs: server.toolCallTimeoutMs ?? DEFAULT_TOOL_CALL_TIMEOUT_MS,
+        // Only a DECLARED startup timeout is a policy: host compatibility mode
+        // cannot enforce one, so an undeclared server stays enforceable there and
+        // the built-in bridge applies its own default at connect time.
         ...(server.startupTimeoutMs === undefined ? {} : { startupTimeoutMs: server.startupTimeoutMs }),
         ...(server.enabledTools === undefined ? {} : { enabledTools: server.enabledTools }),
         ...(server.disabledTools === undefined ? {} : { disabledTools: server.disabledTools })

package/lib/runtime/mcp-direct-config.js

@@ -1,56 +1,73 @@
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import { MCP_SCHEMA_ID, validateAgainstSchema, validateMcpJson } from '../catalog/validate.js';
+import { effectiveSurfaces } from '../model/types.js';
 export const USER_MCP_SOURCE = '@user-mcp';
 export const USER_MCP_SUITE = 'user-mcp';
-/** User-created services reuse the owned bridge lifecycle without changing host configuration. */
-export async function loadUserMcpSuite(dataRoot) {
-    const path = join(dataRoot, 'mcp-servers.json');
+/**
+ * User-created services reuse the owned bridge lifecycle without changing host configuration.
+ *
+ * The declarations live in the shared Agent layout root
+ * (`~/.agents/mcp.json`), so a service the user adds by hand is ordinary
+ * `mcpServers` JSON in the same place other Agent tools look.
+ *
+ * The suite always carries an `mcp` document — an absent or malformed
+ * `mcp.json` leaves an empty one — so callers read `.mcp.servers` directly
+ * instead of re-checking the optional field.
+ */
+export async function loadUserMcpSuite(agentsRoot) {
+    const path = userMcpPath(agentsRoot);
     let mcp = { schema: MCP_SCHEMA_ID, servers: {} };
     const errors = [];
     try {
-        mcp = await validateUserMcp(dataRoot, JSON.parse(await readFile(path, 'utf8')));
+        mcp = await validateUserMcp(agentsRoot, JSON.parse(await readFile(path, 'utf8')));
     }
     catch (error) {
         if (error.code !== 'ENOENT')
-            errors.push(`mcp-servers.json: ${error instanceof Error ? error.message : String(error)}`);
+            errors.push(`mcp.json: ${error instanceof Error ? error.message : String(error)}`);
     }
     return {
         sourceId: USER_MCP_SOURCE,
         id: USER_MCP_SUITE,
-        root: dataRoot,
+        root: agentsRoot,
         manifest: { layout: 'agent-plugin-v1', path, id: USER_MCP_SUITE, name: USER_MCP_SUITE },
         skills: [],
         mcp,
         surfaces: { skills: 0, mcp: Object.keys(mcp.servers).length, commands: 0, agents: 0, hooks: 0, lsp: 0 },
         dimension: 'user',
         enabled: true,
+        // A user-created suite has no install entry and no overrides, so every
+        // surface keeps its enabled default.
+        activeSurfaces: effectiveSurfaces(undefined),
         installedAt: 'user',
         errors
     };
 }
-async function validateUserMcp(dataRoot, raw) {
+async function validateUserMcp(agentsRoot, raw) {
     const errors = await validateAgainstSchema(MCP_SCHEMA_ID, raw);
     if (errors.length > 0)
         throw new Error(`invalid MCP configuration: ${errors.join('; ')}`);
-    const result = await validateMcpJson(dataRoot, raw);
+    const result = await validateMcpJson(agentsRoot, raw);
     if (result.config === undefined || result.errors.length > 0)
         throw new Error(result.errors.join('; '));
     return result.config;
 }
 /** Add one service atomically; reject collisions and malformed config before writing. */
-export async function addUserMcpServer(dataRoot, name, server) {
+export async function addUserMcpServer(agentsRoot, name, server) {
     if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(name))
         throw new Error('invalid MCP server name');
-    const suite = await loadUserMcpSuite(dataRoot);
+    const suite = await loadUserMcpSuite(agentsRoot);
     if (suite.errors.length > 0)
         throw new Error(suite.errors.join('; '));
     if (Object.hasOwn(suite.mcp.servers, name))
         throw new Error(`MCP server "${name}" already exists`);
     const document = { $schema: MCP_SCHEMA_ID, mcpServers: { ...suite.mcp.servers, [name]: server } };
-    await validateUserMcp(dataRoot, document);
-    await mkdir(dataRoot, { recursive: true });
-    const path = join(dataRoot, 'mcp-servers.json');
-    await writeFile(`${path}.tmp`, `${JSON.stringify(document, null, 2)}\n`, { mode: 0o600 });
-    await rename(`${path}.tmp`, path);
+    await validateUserMcp(agentsRoot, document);
+    const path = userMcpPath(agentsRoot);
+    await writeFileAtomic(path, `${JSON.stringify(document, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
+}
+/** The user's hand-written MCP declaration file: `<agentsRoot>/mcp.json`. */
+export function userMcpPath(agentsRoot) {
+    return join(agentsRoot, 'mcp.json');
 }

package/lib/runtime/mcp-mounts.js

@@ -1,20 +1,12 @@
 import { createHash } from 'node:crypto';
 import * as mcpBridge from './mcp-client/bridge.js';
-import { applyOverride } from './mcp-overrides.js';
-import { credentialRefsInServer, deriveServerName, toMcpMounts } from './mcp-config.js';
+import { toMcpMounts } from './mcp-config.js';
 import { mcpCredentialResolver } from './mcp-credentials.js';
+import { SerialPassQueue, RetryScheduler } from './mount-lifecycle.js';
 import { qualifiedSuiteId } from '../catalog/paths.js';
-/**
- * Bounded retry schedule for a failed mount/unmount. A crash-looping or
- * permanently broken server must eventually stop consuming attempt budget, so
- * the schedule is capped and resets with every reconcile pass.
- */
-const RETRY_SCHEDULE_MS = [1_500, 5_000, 15_000, 45_000, 120_000];
-const MAX_RETRY_ATTEMPTS = RETRY_SCHEDULE_MS.length;
 export class McpMountRegistry {
     ctx;
     pluginDataRoot;
-    namespace;
     live = new Map();
     names = new Map();
     credentialRefs = new Set();
@@ -24,11 +16,9 @@ export class McpMountRegistry {
     /** The active MCP mount backend ('builtin' bridge or host client compat mode). */
     backendProvider = async () => 'builtin';
     /** Serialize mount and unmount passes so a disable cannot race an in-flight spawn. */
-    reconcileQueue = Promise.resolve();
-    /** Pending retry timers keyed by mount key, so a teardown can cancel them. */
-    retries = new Map();
-    /** Attempt count per mount key; reset whenever a retry succeeds. */
-    attempts = new Map();
+    passes = new SerialPassQueue();
+    /** Delayed re-attempts for mounts that are not live yet. */
+    retries;
     /**
      * Mount keys flagged for an explicit rebuild (re-authorize): the next
      * reconcile must tear down and remount them even when the resolved config
@@ -37,10 +27,13 @@ export class McpMountRegistry {
     forcedRemounts = new Set();
     /** Snapshot of the last reconciled suite set, replayed by retry passes. */
     lastEnabled = [];
-    constructor(ctx, pluginDataRoot, namespace) {
+    constructor(ctx, pluginDataRoot) {
         this.ctx = ctx;
         this.pluginDataRoot = pluginDataRoot;
-        this.namespace = namespace;
+        this.retries = new RetryScheduler({
+            replay: () => this.reconcile(this.lastEnabled),
+            log: message => this.ctx.logger?.warn(`[dsh-agent-plugins-market] ${message}`)
+        });
     }
     /** Install the per-suite overrides provider (suiteId -> overrides). */
     setOverridesProvider(provider) {
@@ -71,6 +64,15 @@ export class McpMountRegistry {
     forceRemount(suiteId, serverKey) {
         this.forcedRemounts.add(mountKey(suiteId, serverKey));
     }
+    /**
+     * Flag every live mount for a rebuild on the next reconcile: the manual
+     * retry path. A bridge whose server died underneath it still matches its own
+     * config fingerprint, so nothing else would ever re-verify that mount.
+     */
+    forceRemountAll() {
+        for (const key of this.live.keys())
+            this.forcedRemounts.add(key);
+    }
     /** The mount key owning one derived serverName; undefined when not mounted here. */
     serverOwner(serverName) {
         const owner = this.names.get(serverName);
@@ -82,15 +84,13 @@ export class McpMountRegistry {
         return { suiteId: owner.slice(0, separator), serverKey: owner.slice(separator + 1) };
     }
     /** Queue one reconciliation behind any in-flight mount/unmount pass. */
-    async reconcile(enabledSuites) {
-        const run = this.reconcileQueue.then(() => this.reconcileNow(enabledSuites));
-        this.reconcileQueue = run.then(() => undefined, () => undefined);
-        return run;
+    reconcile(enabledSuites) {
+        return this.passes.run(() => this.reconcileNow(enabledSuites));
     }
     /** Mount/unmount MCP servers to match the enabled suites exactly. */
     async reconcileNow(enabledSuites) {
         this.lastEnabled = [...enabledSuites];
-        const active = enabledSuites.filter(suite => suite.activeSurfaces?.mcp !== false);
+        const active = enabledSuites.filter(suite => suite.activeSurfaces.mcp !== false);
         const overrides = await this.overridesProvider();
         const resolver = mcpCredentialResolver(this.ctx);
         const wanted = new Map();
@@ -98,15 +98,11 @@ export class McpMountRegistry {
         this.credentialRefs.clear();
         for (const suite of active) {
             const suiteOverrides = overrides.get(qualifiedSuiteId(suite.sourceId, suite.id));
-            for (const [serverKey, source] of Object.entries(suite.mcp?.servers ?? {})) {
-                const override = suiteOverrides?.[serverKey];
-                if (override?.enabled === false)
-                    continue;
-                const effective = applyOverride(source, override);
-                for (const ref of credentialRefsInServer(effective))
-                    this.credentialRefs.add(ref);
-            }
-            const { mounts, failures } = await toMcpMounts(suite, this.pluginDataRoot, suiteOverrides, resolver);
+            const { mounts, failures, credentialRefs } = await toMcpMounts(suite, this.pluginDataRoot, suiteOverrides, resolver);
+            // The references ride the same effective view the mounts are built from,
+            // so the credentials panel cannot show one the mounts never use.
+            for (const ref of credentialRefs)
+                this.credentialRefs.add(ref);
             for (const failure of failures) {
                 diagnostics.push({
                     suiteId: qualifiedSuiteId(suite.sourceId, suite.id),
@@ -117,9 +113,10 @@ export class McpMountRegistry {
                 });
             }
             for (const mount of mounts) {
-                // Bridge namespaces are reserved app-wide, even when tools are agent-scoped.
-                if (this.namespace !== undefined)
-                    mount.config.serverName = deriveServerName(mount.config.serverName, this.namespace);
+                // One derived serverName per suite/server, whatever the dimension: the
+                // host keeps an agent's registrations in that agent's own scope and lets
+                // them shadow globals, so suffixing a per-session id would only fork the
+                // server's identity — including its stored OAuth grant — per session.
                 wanted.set(mountKey(mount.suiteId, mount.serverKey), { suite, serverKey: mount.serverKey, request: mount });
             }
         }
@@ -164,67 +161,30 @@ export class McpMountRegistry {
                 // next full reconcile re-checks them anyway, so the self-heal path
                 // is intact.
                 const informational = failure.code === 'foreign-mount' || failure.code === 'duplicate-mount';
-                this.scheduleRetry(key, entry.suite.id, entry.serverKey, informational ? undefined : failure.reason);
+                this.retries.schedule({ key, label: `${entry.suite.id}/${entry.serverKey}`, ...(informational ? {} : { reason: failure.reason }) });
             }
         }
         return diagnostics.filter(diagnostic => diagnostic.reason !== 'unmounted');
     }
-    /**
-     * Schedule a delayed re-attempt for a mount that still is not live.
-     *
-     * Mounts are retried because a remote endpoint or a credential may become
-     * available slightly after the suite is enabled. The schedule is bounded, and
-     * a server that keeps failing simply stops retrying until the next reconcile.
-     */
-    scheduleRetry(key, suiteId, serverKey, reason) {
-        const pending = this.retries.get(key);
-        if (pending !== undefined)
-            clearTimeout(pending);
-        this.retries.delete(key);
-        if (reason === undefined) {
-            this.attempts.delete(key);
-            return;
-        }
-        const attempt = (this.attempts.get(key) ?? 0) + 1;
-        this.attempts.set(key, attempt);
-        if (attempt > MAX_RETRY_ATTEMPTS) {
-            this.ctx.logger?.warn(`[dsh-agent-plugins-market] ${suiteId}/${serverKey}: giving up after ${MAX_RETRY_ATTEMPTS} attempts — ${reason}`);
-            return;
-        }
-        const delay = RETRY_SCHEDULE_MS[attempt - 1] ?? RETRY_SCHEDULE_MS[RETRY_SCHEDULE_MS.length - 1];
-        const timer = setTimeout(() => {
-            this.retries.delete(key);
-            // Re-run against the last known suite set: a retry must not resurrect a
-            // server that has since been disabled or uninstalled.
-            void this.reconcile(this.lastEnabled).catch(() => { });
-        }, delay);
-        timer.unref?.();
-        this.retries.set(key, timer);
-    }
     /** Dispose every live mount after queued reconciliation passes settle. */
     async disposeAll() {
-        const run = this.reconcileQueue.then(async () => {
+        await this.passes.run(async () => {
             for (const [key, live] of [...this.live]) {
                 await this.unmount(key, live);
             }
         });
-        this.reconcileQueue = run.then(() => undefined, () => undefined);
-        await run;
-        for (const timer of this.retries.values())
-            clearTimeout(timer);
         this.retries.clear();
-        this.attempts.clear();
         this.credentialRefs.clear();
     }
     /** Mount one precomputed request (source config merged with overrides). */
     async mountWith(request) {
-        const owner = this.names.get(request.config.serverName);
+        const owner = this.serverOwner(request.config.serverName);
         if (owner !== undefined) {
             // Two sources shipping the same suite/server pair derive one serverName:
             // the model only needs one copy, so later arrivals skip with an
             // informational diagnostic instead of double-registering.
             return {
-                reason: `server "${request.config.serverName}" is already mounted from ${owner} — this suite's copy is redundant and was skipped`,
+                reason: `server "${request.config.serverName}" is already mounted from ${owner.suiteId} — this suite's copy is redundant and was skipped`,
                 code: 'duplicate-mount'
             };
         }

package/lib/runtime/mcp-overrides.js

@@ -11,8 +11,9 @@
  * resolved by the Host credentials service (or launch-environment fallback)
  * so keys never persist in plain text.
  */
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import { isSensitiveKey } from './mcp-redaction.js';
 /** The overrides directory under the plugin data root. */
 export function overridesDir(dataRoot) {
@@ -35,11 +36,10 @@ export async function loadSuiteOverrides(dataRoot, suiteId) {
         return {};
     }
 }
-/** Persist one suite's overrides atomically-ish (single writer, small file). */
+/** Persist one suite's overrides through the harness atomic write. */
 export async function saveSuiteOverrides(dataRoot, suiteId, overrides) {
     const path = suiteOverridePath(dataRoot, suiteId);
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, `${JSON.stringify(overrides, null, 2)}\n`, { mode: 0o600 });
+    await writeFileAtomic(path, `${JSON.stringify(overrides, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
 }
 /** Keep only recognized fields with correct shapes; drop everything else. */
 export function sanitizeOverrides(raw) {

package/lib/runtime/mcp-redaction.js

@@ -13,7 +13,8 @@ const SENSITIVE_KEY = /(authorization|auth|bearer|token|secret|password|passwd|c
  * walk descends into it and the per-value checks apply instead.
  */
 const STRUCTURE_KEY = /^auth$/i;
-const PLACEHOLDER = /\$\{[^}]+\}/g;
+/** A `${NAME}` credential reference. Deliberately not global: it is only ever probed with `test`. */
+const PLACEHOLDER = /\$\{[^}]+\}/;
 export function redactMcpConfig(value) {
     return redactValue(value);
 }
@@ -76,7 +77,7 @@ function redactValue(value, key = '') {
     }
     if (isSensitiveKey(key)) {
         if (typeof value === 'string' && PLACEHOLDER.test(value))
-            return value.replace(PLACEHOLDER, match => match);
+            return value;
         return '[redacted]';
     }
     if (key === 'url' && typeof value === 'string')