dsh-agent-plugins-market 0.7.0 → 0.7.2

package/lib/types/runtime/agent-role-router.d.ts

@@ -1,7 +1,6 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { type SubagentCatalogEntry } from './subagent-catalog.js';
-import { type HostTranslate } from './host-locale.js';
-export declare const AGENT_ROLE_TOOL_NAME = "subagent_run";
+export declare const AGENT_ROLE_TOOL_NAME = "subagent_role";
 /** Panel identity is preserved so identically named cards from different suites remain addressable. */
 export interface AgentRoleEntry {
     name: string;
@@ -10,6 +9,10 @@ export interface AgentRoleEntry {
     disabled: boolean;
     title?: string;
     rawText?: string;
+    /** Suite checkout root the card's `${PLUGIN_ROOT}` variables resolve to; absent for project-native files. */
+    suiteRoot?: string;
+    /** The suite's `${PLUGIN_DATA}` directory; absent for project-native files. */
+    suiteData?: string;
 }
 /**
  * The executable part of one card. `tools` / `disallowedTools` stay in the file
@@ -41,6 +44,10 @@ export interface AgentRoleDelegation {
     persona: string;
     agentOptions?: AgentRoleOptions;
 }
+/** A one-shot foreground run carries its own cancellation signal on the request. */
+export interface AgentRoleRunRequest extends AgentRoleDelegation {
+    signal: AbortSignal;
+}
 export interface AgentRoleHost {
     tools: {
         register(definition: unknown): () => void;
@@ -62,18 +69,59 @@ export interface AgentRoleHost {
             childId: string;
             messageId: string;
         }>;
+        /** One-shot foreground run: the host settles it and hands back the child's output. */
+        start(provider: string, request: AgentRoleRunRequest): Promise<AgentRoleRun>;
     };
 }
+/**
+ * JSON value crossing the tool-result boundary. Declared locally so this plugin
+ * keeps its declared host surface: the registry performs the authoritative
+ * lossless snapshot of the child's content blocks on the way out.
+ */
+export type AgentRoleJson = null | boolean | number | string | AgentRoleJson[] | {
+    [key: string]: AgentRoleJson;
+};
+/** One settled foreground role run; `result` resolves with the child's terminal output. */
+export interface AgentRoleRun {
+    id: string;
+    result: Promise<{
+        output: unknown[];
+        stopReason: string;
+        diagnostic?: string;
+    }>;
+    dispose(): Promise<void>;
+}
+/** One tracked background role job as the host `jobs` registry sees it. */
+export interface AgentRoleJob {
+    cancel(reason?: string): void;
+    done: Promise<{
+        status: string;
+        detail?: string;
+    }>;
+}
+/** The host `jobs` registry seam, reached through `ctx.get('jobs')`. */
+export interface AgentRoleJobs {
+    start(spec: {
+        kind: string;
+        label: string;
+        owner?: unknown;
+        run(): AgentRoleJob;
+    }): string;
+}
 /** Strict YAML parsing prevents malformed routing metadata from silently inheriting wider privileges. */
 export declare function parseAgentRole(text: string): AgentRolePolicy;
 /**
- * Resolve the child LLM options one card may contribute.
+ * Resolve the child LLM options for one role call.
  *
- * A card route is advisory. Only an exact `provider` plus `model` pair is
- * applied, and only when the live LLM runtime accepts it; every other
- * declaration — a bare id, a Claude alias, a lone `provider`, an unsupported
- * effort — degrades to inheriting the parent route and reports a diagnostic.
- * @param policy - the card's parsed routing metadata.
+ * The call's own `provider` + `model` pair wins, and the role card supplies the
+ * default when the call names neither. Only an exact pair is applied, and only
+ * when the live LLM runtime accepts it; a bare id, a Claude alias, a lone
+ * `provider` or an unsupported effort degrades to inheriting the parent route
+ * and reports a diagnostic. An explicit route with no explicit effort uses the
+ * selected model's default, so a card's effort never leaks onto a route it was
+ * not written for.
+ * @param policy - the card's parsed routing metadata, used as the default route.
+ * @param requested - the route the call itself asked for.
  * @param parent - the calling Agent whose route an unusable declaration falls back to.
  * @param llm - live LLM runtime owning provider, model and effort validation.
  * @param signal - tool-call cancellation signal.
@@ -81,18 +129,48 @@ export declare function parseAgentRole(text: string): AgentRolePolicy;
  * @param diagnose - diagnostic sink; degradation is reported, never silent.
  * @returns the options to send, or undefined for pure inheritance.
  */
-export declare function resolveAgentOptions(policy: AgentRolePolicy, parent: unknown, llm: AgentRoleHost['llm'], signal: AbortSignal, subject: string, diagnose: (message: string) => void): Promise<AgentRoleOptions | undefined>;
+export declare function resolveAgentOptions(policy: AgentRolePolicy, requested: AgentRoleOptions, parent: unknown, llm: AgentRoleHost['llm'], signal: AbortSignal, subject: string, diagnose: (message: string) => void): Promise<AgentRoleOptions | undefined>;
 /** Stable summaries; invalid declarations are excluded and transient read failures abort publication. */
-export declare function agentRoleCatalog(entries: AgentRoleEntry[], signal: AbortSignal, diagnose?: (message: string) => void): Promise<SubagentCatalogEntry[]>;
+export declare function agentRoleCatalog(entries: AgentRoleEntry[], signal: AbortSignal, diagnose?: (message: string) => void, projectDir?: string): Promise<SubagentCatalogEntry[]>;
 /** Read the same declaration for catalog summaries and execution, including inline resources. */
-export declare function readAgentRole(entry: AgentRoleEntry): Promise<AgentRolePolicy>;
+export declare function readAgentRole(entry: AgentRoleEntry, projectDir?: string): Promise<AgentRolePolicy>;
 /**
- * Start one role child and return its durable id without waiting for the result.
- * Resume state, steering, and the settlement notice belong to the host's
- * continuation manager; this executor owns only role resolution.
+ * How one role call reaches a child, mirroring the host's own delegation tool.
+ *
+ * `continuable` is the default: the host establishes a durable child and this
+ * returns its id immediately, leaving resume state, steering and the settlement
+ * notice to the continuation manager. `foreground` starts a one-shot run and
+ * returns its report as this call's result, for a caller that needs the answer
+ * before its next action. `background` starts the same one-shot run as a tracked
+ * job, so the caller collects it later with `job_output` and can stop it with
+ * `job_kill` instead of holding the turn open.
  */
-export declare function executeAgentRole(host: AgentRoleHost, listRoles: (parent?: unknown) => Promise<AgentRoleEntry[]>, agentName: string, prompt: string, parent: unknown, signal: AbortSignal, diagnose?: (message: string) => void): Promise<{
+export type AgentRoleRunMode = 'continuable' | 'background' | 'foreground';
+/** One role call's outcome, discriminated so the tool can render each channel. */
+export type AgentRoleResult = {
+    kind: 'continuable';
     subagentId: string;
-}>;
-/** Mount once after tools, llm and subagents are available; the returned disposer belongs to the plugin lifecycle. */
-export declare function mountAgentRoleTool(ctx: Context, listRoles: (parent?: unknown) => Promise<AgentRoleEntry[]>, t?: HostTranslate): () => void;
+} | {
+    kind: 'background';
+    jobId: string;
+} | {
+    kind: 'foreground';
+    runId: string;
+    output: AgentRoleJson[];
+};
+/**
+ * Run one role child through the requested channel.
+ * @param host - the exact live seams this executor owns: tools, llm and subagents.
+ * @param mode - which channel the call asked for.
+ * @param jobs - the host jobs registry; only the `background` channel needs it.
+ */
+export declare function executeAgentRole(host: AgentRoleHost, listRoles: (parent?: unknown) => Promise<AgentRoleEntry[]>, agentName: string, prompt: string, parent: unknown, requestedRoute: AgentRoleOptions, mode: AgentRoleRunMode, signal: AbortSignal, diagnose?: (message: string) => void, jobs?: AgentRoleJobs): Promise<AgentRoleResult>;
+/**
+ * Mount once after tools, llm and subagents are available; the returned disposer belongs to the plugin lifecycle.
+ *
+ * The delegation contract lives here rather than in the injected catalog: a tool
+ * description is present in every request, while the catalog message is
+ * re-published whenever roles change, so guidance kept out of the catalog is
+ * sent once and stays readable through compaction.
+ */
+export declare function mountAgentRoleTool(ctx: Context, listRoles: (parent?: unknown) => Promise<AgentRoleEntry[]>): () => void;

package/lib/types/runtime/commands-mounts.d.ts

@@ -3,12 +3,13 @@
  * register as dsh slash commands.
  *
  * A CC command is a prompt template the model executes (its body carries
- * `$ARGUMENTS` and execution rules), so the handler maps it onto the
- * harness's follow-up mechanism: the template with `$ARGUMENTS` substituted
- * becomes one durable user-role follow-up message on the receiving agent.
- * Registrations reconcile on every enable/disable/install/uninstall; a
- * broken command file or an unavailable `ctx.commands` is contained per
- * command and reported as a diagnostic.
+ * `$ARGUMENTS`, path variables and `` !`cmd` `` dynamic-context placeholders),
+ * so the handler maps it onto the harness's follow-up mechanism: the template
+ * with those placeholders resolved becomes one durable user-role follow-up
+ * message on the receiving agent. Registrations reconcile on every
+ * enable/disable/install/uninstall; a broken command file, a failed injected
+ * command, or an unavailable `ctx.commands` is contained per command and
+ * reported as a diagnostic.
  */
 import type { Context } from '@deepseek-ai/cordis';
 import type { Suite, SuiteMarkdownResource } from '../model/types.js';
@@ -23,13 +24,20 @@ interface CommandSpec {
     description: string;
     body: string;
     hint?: string;
+    /** Set when the command file belongs to a suite with a plugin root; absent for project-native files. */
+    suiteRoot?: string;
+    /** The suite's `${PLUGIN_DATA}` directory; absent for project-native files. */
+    suiteData?: string;
 }
 export declare class CommandMountRegistry {
     private readonly ctx;
     private readonly t;
+    private readonly dataRoot?;
     private readonly fingerprints;
     private readonly live;
-    constructor(ctx: Context, t?: HostTranslate);
+    constructor(ctx: Context, t?: HostTranslate, dataRoot?: string | undefined);
+    /** The live shell seam, when the profile has one; dynamic context stays literal without it. */
+    private shell;
     /** Register/unregister suite commands to match the enabled suites exactly. */
     reconcile(enabledSuites: Suite[]): Promise<CommandMountDiagnostic[]>;
     /** Dispose every registered command; used at plugin teardown. */

package/lib/types/runtime/deadline.d.ts

@@ -1,18 +1,17 @@
-/**
- * Bounded waits for work this plugin cannot cancel.
- *
- * Every wait here is a race against a timer: the caller stops waiting and the
- * underlying work keeps running. That is the only safe shape for a mount and
- * for the change pipeline that drives it — a spawned server process or a
- * browser authorization the user is completing must not be abandoned just
- * because nobody is waiting for it any more.
- *
- * @module runtime/deadline
- */
+/** Identifies this plugin's bounded waits inside a timeout reason. */
+export declare const MARKET_DEADLINE_CODE = "MARKET_DEADLINE";
 /**
  * Resolve `true` once `work` settles, or `false` when `deadlineMs` elapses.
  *
  * A rejection counts as settled: this helper only reports timing, so callers
  * that need the failure attach their own handler to `work`.
+ *
+ * A non-positive wait means "do not wait": the answer is simply whether the
+ * work had already settled. That is deliberately not the host primitive's own
+ * reading of a non-positive timeout, which is "arm no timer at all" — the floor
+ * below keeps the two from collapsing into opposite behaviors.
+ * @param work - the work to wait for; it is never cancelled, only stopped being awaited.
+ * @param deadlineMs - how long to wait, in milliseconds.
+ * @returns whether the work settled before the deadline.
  */
 export declare function settlesWithin(work: Promise<unknown>, deadlineMs: number): Promise<boolean>;

package/lib/types/runtime/dynamic-context.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Claude Code dynamic context injection: `` !`command` `` in a command body or
+ * skill body runs the command and the placeholder becomes its output.
+ *
+ * One pass over the original text recognizes both spellings — the inline
+ * `` !`cmd` `` (only at a line start or after whitespace, matching the authoring
+ * rule) and the multi-line ```` ```! ```` fence — and every command runs
+ * sequentially in the calling session's directory. Outputs are inserted as
+ * plain text and never re-read, so a command cannot emit another placeholder.
+ *
+ * Failure is contained per invocation rather than per placeholder: the caller
+ * aborts the whole invocation with the command's own output, so a model never
+ * reads half-injected text. Exit code 1 counts as a result for the commands
+ * whose benign outcome it is (`grep`, `rg`, `find`, `diff`, `test`, …).
+ *
+ * The shell service is reached structurally: {@link shellSeamOf} resolves it
+ * from any context, and a profile without one keeps the author's literal text.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** How long one injected command may run; the executor caps a larger request. */
+export declare const DYNAMIC_CONTEXT_TIMEOUT_MS = 120000;
+/** The requested forward cap for one injected command's stdout, in bytes. */
+export declare const DYNAMIC_CONTEXT_MAX_OUTPUT_BYTES: number;
+/** The slice of the host shell service this module uses. */
+export interface ShellSeam {
+    resolve(request: {
+        command: string;
+        workdir?: string;
+        timeoutMs?: number;
+        stdoutMaxBytes?: number;
+        signal?: AbortSignal;
+    }): unknown;
+    run(spec: unknown): Promise<ShellOutcome>;
+}
+/** The fields of one shell run this module reads. */
+export interface ShellOutcome {
+    exitCode: number | null;
+    timedOut: boolean;
+    aborted: boolean;
+    stdout: {
+        text: string;
+        truncated: boolean;
+        spillPath?: string;
+    };
+    stderr: {
+        text: string;
+        truncated: boolean;
+        spillPath?: string;
+    };
+}
+/**
+ * Resolve the host shell service from any context, whether or not the reading
+ * fiber injects `shell`.
+ *
+ * Cordis resolves `ctx.shell` by walking the reading fiber's ancestors, so a
+ * scope that does not inject the service throws `cannot get property "shell"
+ * without inject` even when a sibling fiber provides it. `ctx.get` reads the
+ * global service store instead and answers `undefined` in a profile that has
+ * no shell, which is what keeps the seam optional.
+ *
+ * @param ctx - the context the dynamic-context pass runs under.
+ * @returns the shell seam, or `undefined` when the profile provides none.
+ */
+export declare function shellSeamOf(ctx: Context): ShellSeam | undefined;
+export interface DynamicContextOptions {
+    shell: ShellSeam;
+    /** Session directory every injected command runs in. */
+    workdir?: string;
+    signal?: AbortSignal;
+}
+/**
+ * Run every placeholder's command and return the text the model receives.
+ *
+ * @param text - author text whose `${...}` variables and arguments are already resolved.
+ * @param options - the resolved shell seam, session directory and cancellation signal.
+ * @returns the text with each placeholder replaced by its command's output.
+ * @throws when a command fails, times out or is aborted, carrying the command and its output.
+ */
+export declare function injectDynamicContext(text: string, options: DynamicContextOptions): Promise<string>;
+/** Whether this command's exit status is a result rather than a failure. */
+export declare function benignExit(exitCode: number | null, command: string): boolean;

package/lib/types/runtime/host-locale.d.ts

@@ -1,13 +1,31 @@
 /** Host runtime dictionary keys (mirrored for zh and en). */
-export type HostLocaleKey = 'subagentCatalogIntro' | 'subagentCatalogUpdated' | 'subagentCatalogEmpty' | 'subagentCatalogCall' | 'commandAcknowledged' | 'userCommandSourceLabel' | 'feedbackToolCardTitle';
+export type HostLocaleKey = 'commandAcknowledged' | 'userCommandSourceLabel' | 'feedbackToolCardTitle';
 export type HostTranslate = (key: HostLocaleKey, params?: Record<string, string>) => string;
 interface ResolvedLocale {
     t: HostTranslate;
 }
 /** Resolve the active host language from settings; unknown values default to zh. */
 export declare function bindHostLocale(preference: string | undefined): HostTranslate;
-/** Read `locale.preference` from `$DSH_HOME/settings.yaml` (best effort). */
+/**
+ * Wire the host settings service as the primary locale source, replacing the
+ * `settings.yaml` fallback.
+ * @param read - reads `locale.preference` from the settings service.
+ */
+export declare function setHostLocaleSource(read: () => string | undefined): void;
+/**
+ * The persisted locale preference: the host settings document when the service
+ * is composed, else `$DSH_HOME/settings.yaml` (best effort).
+ */
 export declare function readLocalePreference(): Promise<string | undefined>;
 /** Bind a host translator against the persisted locale preference. */
 export declare function loadHostLocale(): Promise<ResolvedLocale>;
+/**
+ * Read `locale.preference` from the host settings service.
+ *
+ * The locale namespace is registered by the host's own client-locale plugin, so
+ * this reads `undefined` until that plugin mounts — which is why the caller
+ * re-binds when the service arrives rather than capturing the value once.
+ * @param settingsCtx - a context carrying the `settings` service.
+ */
+export declare function readHostLocalePreference(settingsCtx: unknown): string | undefined;
 export {};

package/lib/types/runtime/lsp-mounts.d.ts

@@ -29,6 +29,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import { type LegacyLspSeam } from './profile-seam.js';
+import { type PluginPathContext } from '../catalog/plugin-variables.js';
 import { type Suite } from '../model/types.js';
 export interface LspMountDiagnostic {
     suiteId: string;
@@ -54,6 +55,8 @@ export declare function toLspServerConfig(spec: {
     initializationOptions?: unknown;
     configuration?: unknown;
 }): LspStdioServerConfig;
+/** Resolve author-written paths in one declaration before the host spawns the server. */
+export declare function expandLspServerConfig(config: LspStdioServerConfig, context: PluginPathContext): LspStdioServerConfig;
 /** Minimal structural shape of a dynamically imported host plugin module. */
 interface HostModule {
     default?: unknown;
@@ -87,6 +90,8 @@ export declare class LspMountRegistry {
     private capabilityFailure;
     /** Latest diagnostic per suite id; cleared when its suite mounts or leaves the wanted set. */
     private readonly lastDiagnostics;
+    /** Plugin storage root holding each suite's `${PLUGIN_DATA}` directory; unset leaves the variable verbatim. */
+    private pluginDataRoot?;
     /** Direct (user-configured) server provider; defaults to none. */
     private directProvider;
     private disabledProvider;
@@ -119,6 +124,8 @@ export declare class LspMountRegistry {
     private seamConflictReason;
     /** Dispose the capability seam this registry mounted, once no wanted server needs it. */
     private releaseCapability;
+    /** Install the plugin storage root per-suite data directories resolve against. */
+    setPluginDataRoot(root: string): void;
     /** Install the direct (user-configured) server provider used at reconcile time. */
     setDirectProvider(provider: () => Promise<Record<string, import('../model/types.js').LspServerSpec>>): void;
     setDisabledProvider(provider: () => Promise<Set<string>>): void;

package/lib/types/runtime/mcp-backend.d.ts

@@ -4,8 +4,8 @@
  * and legacy SSE) or through the host's `@deepseek-ai/dsh-mcp-client`
  * (compatibility mode: no OAuth, no SSE, but the host-native implementation).
  *
- * The choice is a host settings namespace (`dsh-agent-plugins-market`,
- * `mcpEnhanced: boolean`, default true) registered by the plugin's node half:
+ * The choice is the `mcpEnhanced` field of the market's host settings
+ * namespace (see `contracts/settings.ts`) registered by the plugin's node half:
  * the registration is what makes the host 插件配置 tab serve our card, the
  * client card binds it for state, and the node half watches it to remount
  * servers when the switch flips. `readMcpBackend` remains only as the
@@ -16,30 +16,23 @@
 import z from '@deepseek-ai/schemastery';
 /** The MCP mount backend the market uses for suite servers. */
 export type McpBackend = 'builtin' | 'host';
-/** Settings namespace this plugin registers; the key the plugin-config tab pairs our card by. */
-export declare const MCP_SETTINGS_NAMESPACE = "dsh-agent-plugins-market";
-/** Schema of the market settings namespace: the switches this plugin's config card serves. */
+/**
+ * Schema of the market settings namespace: the switches this plugin's config
+ * card serves, with the defaults declared to the host. The values themselves
+ * belong to {@link MARKET_SETTINGS_DEFAULTS}; this schema states them, it does
+ * not own them.
+ */
 export declare const MarketSettingsSchema: z<Schemastery.ObjectS<{
-    /** ON (default) = the built-in bridge with OAuth and SSE; OFF = host client compat mode. */
     mcpEnhanced: z<boolean, boolean>;
-    /** Read native Agent layouts under the project root; OFF (default) scans configured sources only. */
     scanProjectLayouts: z<boolean, boolean>;
-    /** Download region for GitHub acquisition; `auto` follows the interface language. */
     downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china">;
-    /** ON (default) = the `report_market_issue` model tool is registered; OFF = unregistered. */
     feedbackEnabled: z<boolean, boolean>;
-    /** ON = refresh every configured source in the background; OFF (default) = never. */
     autoUpdateSources: z<boolean, boolean>;
 }>, Schemastery.ObjectT<{
-    /** ON (default) = the built-in bridge with OAuth and SSE; OFF = host client compat mode. */
     mcpEnhanced: z<boolean, boolean>;
-    /** Read native Agent layouts under the project root; OFF (default) scans configured sources only. */
     scanProjectLayouts: z<boolean, boolean>;
-    /** Download region for GitHub acquisition; `auto` follows the interface language. */
     downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china">;
-    /** ON (default) = the `report_market_issue` model tool is registered; OFF = unregistered. */
     feedbackEnabled: z<boolean, boolean>;
-    /** ON = refresh every configured source in the background; OFF (default) = never. */
     autoUpdateSources: z<boolean, boolean>;
 }>>;
 /** Path of the legacy persisted settings file under the plugin data root. */

package/lib/types/runtime/mcp-client/config.d.ts

@@ -12,6 +12,14 @@ import type { ReconnectConfig } from './connection.js';
 import type { McpServerPolicy } from '../../model/types.js';
 /** Default timeout for individual MCP tool calls (ms). */
 export declare const DEFAULT_TOOL_CALL_TIMEOUT_MS = 60000;
+/**
+ * How long one connection attempt may spend initializing (ms). A server that
+ * never answers would otherwise hold its process, transport and browser leg
+ * until the SDK's own 60-second request default expired; a working server
+ * handshakes well under a second, and a genuinely slow one can declare its own
+ * `startupTimeoutMs`.
+ */
+export declare const DEFAULT_STARTUP_TIMEOUT_MS = 10000;
 /** Valid `serverName`, kept below the public tool-name budget. */
 export declare const SERVER_NAME_PATTERN: RegExp;
 /**

package/lib/types/runtime/mcp-client/host-seams.d.ts

@@ -1,55 +1,25 @@
 /**
- * Local ports of the tiny host seams the self-built MCP client needs.
+ * The host seams the self-built MCP client consumes, re-exported from the
+ * packages that own them.
  *
- * The market plugin must stay self-contained at runtime: it cannot import
- * host-internal packages that are not published at compatible versions, and
- * every one of these seams is a small pure function or constant. Each port
- * below is copied verbatim (semantics, not prose) from the harness source at
- * `0.1.1-rc.2` and carries the upstream reference it came from, so a future
- * host change can be re-diffed against `~/workspace/deepseek-harness`.
+ * These are small pure functions and constants, but each one encodes a rule
+ * this plugin must obey rather than a choice it gets to make: which credential
+ * keys the host accepts, how long a timer may be, which environment names never
+ * reach a child process, and which image failures a caller can correct. Reading
+ * them from the host keeps one owner per rule, so a host change reaches this
+ * plugin instead of leaving a copy behind.
  *
- * Anything larger than a handful of lines (the JSON Schema subset validator)
- * lives in its own module.
+ * The OAuth provider and attachment admission reach their services through the
+ * optional `credentials` / `attachments` seams at runtime, so the service types
+ * here stay structural — only the rules are imported.
  *
  * @module runtime/mcp-client/host-seams
  */
-/**
- * The largest delay `setTimeout` accepts without overflowing to a 1ms clamp
- * (2^31 - 1). Shared guard for reconnect and callback timers.
- */
-export declare const MAX_TIMER_DELAY_MS = 2147483647;
-/** `DSH_*` environment namespace owned by the harness. */
-export declare const DSH_ENV_PREFIX: "DSH_";
-/**
- * Credential-shaped environment names are NOT forwarded to MCP server child
- * processes (the harness's own `DEEPSEEK_API_KEY`/secrets must not leak into a
- * spawned server implicitly). Deliberately supplied env entries survive
- * because the config's explicit env merges after the scrub.
- */
-export declare const SENSITIVE_ENV_PATTERN: RegExp;
-/**
- * The ambient parent environment minus credential-shaped names and minus all
- * `DSH_*` names — the canonical base every harness child starts from. `PATH`,
- * `HOME`, locale, and proxy variables survive, so child CLIs run normally;
- * harness identity never leaks implicitly. Both scrubs match case-insensitively:
- * Windows environment names are case-insensitive, so a parent `dsh_*` entry
- * would otherwise survive and read back as `$env:DSH_*` in the child.
- * @returns a fresh environment object safe to hand to a child spawn.
- */
-export declare function scrubbedParentEnv(): Record<string, string>;
-/** A credential record key: `<scope>/<id>` with both segments in the grammar below. */
-declare const credentialKeyBrand: unique symbol;
-export type CredentialKey = string & {
-    readonly [credentialKeyBrand]: true;
-};
-/**
- * Brand a scope and an id as a {@link CredentialKey}.
- * @param scope - the owning plugin's registered name (here: the `mcp-auth` record scope).
- * @param id - the plugin's own addressing unit (here: the folded serverName).
- * @returns the branded key.
- * @throws TypeError when either segment is not a lowercase hyphenated identifier.
- */
-export declare function credentialKey(scope: string, id: string): CredentialKey;
+import type { CredentialKey } from '@deepseek-ai/dsh-credentials';
+import type { SaveImageAttachment } from '@deepseek-ai/dsh-attachment';
+export { MAX_TIMER_DELAY_MS } from '@deepseek-ai/dsh-timeout';
+export { scrubbedParentEnv } from '@deepseek-ai/dsh-subprocess';
+export { credentialKey, type CredentialKey } from '@deepseek-ai/dsh-credentials';
 /**
  * Structural mirror of the host `CredentialProvider` record surface the OAuth
  * provider needs. Typed structurally because the store arrives via the
@@ -64,26 +34,12 @@ export interface CredentialRecordStore {
     readRecord(key: CredentialKey): Promise<unknown>;
     modifyRecord(key: CredentialKey, mutate: (current: unknown) => Promise<unknown>): Promise<unknown>;
 }
+export { isImageAdmissionError, type ImageMediaType, type SaveImageAttachment } from '@deepseek-ai/dsh-attachment';
 /**
- * Distinguish caller-correctable image admission failures from storage faults,
- * so an admission refusal projects text diagnostics while a storage fault is
- * reported as such.
- */
-export declare function isImageAdmissionError(error: unknown): boolean;
-/** Raster formats supported by the durable attachment vocabulary. */
-export type ImageMediaType = 'image/png' | 'image/jpeg' | 'image/webp' | 'image/gif';
-/** One decoded image handed to the host attachment store. */
-export interface SaveImageAttachment {
-    data: Buffer;
-    mediaType: ImageMediaType;
-}
-/**
- * Structural mirror of the host `AttachmentStore.saveImages` surface. The
- * returned refs are opaque host values that ride inside `ContentBlock`
- * image blocks; typed `unknown` here and narrowed by the model content
- * contract at the projection site.
+ * Structural mirror of the host attachment store surface this plugin writes
+ * through. The service is resolved off the tool host at call time, so its
+ * concrete class is deliberately not imported.
  */
 export interface AttachmentStoreLike {
     saveImages(images: readonly SaveImageAttachment[]): Promise<readonly unknown[]>;
 }
-export {};

package/lib/types/runtime/mcp-client/oauth.d.ts

@@ -63,6 +63,8 @@ export declare class LoopbackOAuthClientProvider implements OAuthClientProvider
     private providerState;
     /** The transport generation whose `finishAuth` completes the browser leg. */
     private activeTransport;
+    /** One process-local OAuth state value for the current browser leg. */
+    private expectedState;
     /** Resolves `true` when the leg saved tokens, `false` when it failed; undefined while no leg is open. */
     private browserLegSettled;
     private callbackServer;
@@ -73,6 +75,8 @@ export declare class LoopbackOAuthClientProvider implements OAuthClientProvider
     constructor(serverName: string, storage: OAuthStorageConfig, scope: string | undefined, log: (message: string) => void, store: unknown, opener?: BrowserOpener);
     get redirectUrl(): string;
     get clientMetadata(): OAuthClientMetadata;
+    /** Issue one unpredictable state value for the SDK's authorization request. */
+    state(): string;
     clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
     saveClientInformation(clientInformation: OAuthClientInformationMixed): Promise<void>;
     tokens(): Promise<OAuthTokens | undefined>;