dsh-agent-plugins-market 0.7.1 → 0.7.2

package/lib/types/runtime/server-config.d.ts

@@ -1,7 +1,32 @@
 import type { LspServerSpec, Suite } from '../model/types.js';
+/** One rejected value, with the field it belongs to when the schema knows it. */
+export interface McpFieldError {
+    /** Dotted path inside the server object; empty for a problem with the document itself. */
+    field: string;
+    message: string;
+}
+/**
+ * A rejected MCP configuration. The message keeps the flat form the API has
+ * always returned, and `fields` carries the same reasons keyed by field so the
+ * editor can put each one beside its input.
+ */
+export declare class McpConfigError extends Error {
+    readonly fields: McpFieldError[];
+    constructor(fields: McpFieldError[]);
+}
 /** Restore only unchanged redacted leaves, rejecting invented masked values. */
 export declare function restoreRedactedConfig(input: unknown, original: unknown, redacted?: unknown): unknown;
-export declare function validateServerMcp(root: string, key: string, config: unknown): Promise<import("../model/types.js").McpServer>;
+/**
+ * Validate one service definition before it is stored.
+ *
+ * A service the user declared themselves is local data rather than a
+ * distributable package: keys this client does not know are kept as written
+ * instead of being rejected by the closed-set package schema, and the
+ * package-only rules (bare command names, plugin-relative paths) stay off.
+ */
+export declare function validateServerMcp(root: string, key: string, config: unknown, options?: {
+    userOwned?: boolean;
+}): Promise<import("../model/types.js").McpServer>;
 export declare function validateServerLsp(key: string, config: unknown): LspServerSpec;
 /** Public configuration excludes the parser's derived identity. */
 export declare function lspConfig(spec: LspServerSpec): Record<string, unknown>;

package/lib/types/runtime/subagent-catalog.d.ts

@@ -1,6 +1,5 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { type UserMessage } from '@deepseek-ai/dsh-llm';
-import type { HostTranslate } from './host-locale.js';
 export interface SubagentCatalogEntry {
     /** Exact execution identity, independent of the human-readable title. */
     name: string;
@@ -51,4 +50,17 @@ export type CatalogStepListener = (payload: {
 /** Register after the exact tool definition; teardown removes guidance before execution. */
 export declare function mountSubagentCatalog(ctx: Context, tool: {
     name: string;
-}, snapshot: (agent: CatalogAgent, signal: AbortSignal) => Promise<SubagentCatalogEntry[]>, t: HostTranslate): () => void;
+}, snapshot: (agent: CatalogAgent, signal: AbortSignal) => Promise<SubagentCatalogEntry[]>): () => void;
+/**
+ * Model-facing catalog text: the role list followed by the same guidance on
+ * first publication and on every update, so a replacement never arrives without
+ * the rules that govern it. The guidance covers how to brief a child, how to
+ * work with one while it runs, and when a role child is the wrong answer; the
+ * per-channel arbitration between the host's delegation tools stays in the tool
+ * descriptions the harness owns.
+ *
+ * Role lines carry a name and a description only. The configured route stays in
+ * the durable entries for execution and change detection; publishing it would
+ * tell the model which model each role runs on without changing what it does.
+ */
+export declare function renderCatalogText(entries: readonly SubagentCatalogEntry[], update: boolean): string;

package/lib/types/runtime/tool-registry-observer.d.ts

@@ -4,14 +4,16 @@ import type { Context } from '@deepseek-ai/cordis';
 export interface McpToolSnapshot {
     name: string;
     description?: string;
+    /** The input schema the server advertised, when the host exposes it. */
+    parameters?: unknown;
 }
 /**
  * The MCP tools the host currently publishes to the model.
  *
  * Read through the tools service's own listing API rather than its internal
- * layer structure. `schemas()` deep-clones each tool's parameter schema, which
- * this snapshot has no use for, so a failure inside it degrades to an empty
- * observation instead of taking the status surface down.
+ * layer structure. `schemas()` deep-clones each tool's parameter schema, so a
+ * failure inside it degrades to an empty observation instead of taking the
+ * status surface down.
  * @param tools - the host tools service, when it is mounted.
  * @returns one entry per `mcp__`-namespaced tool.
  */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-agent-plugins-market",
   "description": "The standard way to install Claude Code / Codex / Cursor / Kimi plugin marketplace suites in DeepSeek Harness (DSH) — zero conversion, zero file copying. Skills, MCP servers, hooks and slash commands are injected into your dsh sessions at runtime.",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -108,15 +108,15 @@
     "fflate": "^0.8.3",
     "smol-toml": "^1.8.0",
     "yaml": "^2.7.0",
-    "zod": "^4.4.3"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@codemirror/commands": "^6.11.0",
+    "@codemirror/commands": "^6.11.1",
     "@codemirror/lang-json": "^6.0.2",
     "@codemirror/lang-markdown": "^6.5.2",
     "@codemirror/language": "^6.12.4",
-    "@codemirror/state": "^6.7.4",
-    "@codemirror/view": "^6.43.11",
+    "@codemirror/state": "^6.7.5",
+    "@codemirror/view": "^6.43.12",
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/dsh-attachment": "0.1.5-rc.2",
     "@deepseek-ai/dsh-client-store": "0.1.5-rc.2",
@@ -139,9 +139,9 @@
     "@vitest/coverage-v8": "^4.1.11",
     "anser": "^2.3.5",
     "clsx": "^2.1.1",
-    "dependency-cruiser": "^18.2.0",
+    "dependency-cruiser": "^18.4.0",
     "eslint": "^10.9.1",
-    "immer": "^10.2.0",
+    "immer": "^11.1.18",
     "jsdom": "^30.0.1",
     "katex": "^0.16.47",
     "mdast-util-from-markdown": "^2.0.3",
@@ -163,7 +163,7 @@
     "typescript": "^5.8.3",
     "typescript-eslint": "^8.67.0",
     "vitest": "^4.1.10",
-    "zustand": "~4.4.7"
+    "zustand": "~5.0.15"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"

package/schemas/1.0.0/mcp.schema.json

@@ -85,9 +85,6 @@
         },
         "headers": {
           "$ref": "#/$defs/headers"
-        },
-        "auth": {
-          "$ref": "#/$defs/oauth"
         }
       },
       "required": ["type", "url"],
@@ -107,30 +104,11 @@
         },
         "headers": {
           "$ref": "#/$defs/headers"
-        },
-        "auth": {
-          "$ref": "#/$defs/oauth"
         }
       },
       "required": ["type", "url"],
       "additionalProperties": false
     },
-    "oauth": {
-      "title": "OAuth 2.1 authorization",
-      "type": "object",
-      "description": "OAuth 2.1 authorization for servers that answer 401 with a challenge. The flow activates by default on the server's first 401; set enabled to false to opt out.",
-      "properties": {
-        "enabled": {
-          "type": "boolean",
-          "description": "Enable the OAuth flow (default true; set false to opt out explicitly)."
-        },
-        "scope": {
-          "type": "string",
-          "description": "Space-separated scope string requested during authorization."
-        }
-      },
-      "additionalProperties": false
-    },
     "headers": {
       "title": "HTTP headers",
       "type": "object",

package/schemas/1.1.0/mcp.schema.json

@@ -0,0 +1,120 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agent-plugins.org/schemas/1.1.0/mcp.schema.json",
+  "title": "Agent Plugins MCP Configuration",
+  "description": "Machine-readable schema for mcp.json in Agent Plugins 1.1.0. The Agent Plugins specification defines additional semantic and operational requirements.",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "const": "https://agent-plugins.org/schemas/1.1.0/mcp.schema.json",
+      "description": "Canonical identifier of the MCP configuration schema for the Agent Plugins version targeted by this document."
+    },
+    "mcpServers": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/$defs/server"
+      }
+    }
+  },
+  "required": ["$schema", "mcpServers"],
+  "additionalProperties": false,
+  "$defs": {
+    "server": {
+      "title": "MCP server",
+      "oneOf": [
+        {
+          "$ref": "#/$defs/stdioServer"
+        },
+        {
+          "$ref": "#/$defs/streamableHttpServer"
+        },
+        {
+          "$ref": "#/$defs/sseServer"
+        }
+      ]
+    },
+    "stdioServer": {
+      "title": "stdio MCP server",
+      "type": "object",
+      "properties": {
+        "type": {
+          "const": "stdio"
+        },
+        "command": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Executable token. Resolution rules are defined by the Agent Plugins specification."
+        },
+        "args": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "env": {
+          "type": "object",
+          "propertyNames": {
+            "not": {
+              "enum": ["PLUGIN_ROOT", "PLUGIN_DATA"]
+            }
+          },
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+        "cwd": {
+          "type": "string",
+          "pattern": "^(?:\\./|\\$\\{PLUGIN_ROOT\\}(?:/|$)|\\$\\{PLUGIN_DATA\\}(?:/|$))",
+          "description": "Plugin-relative, PLUGIN_ROOT-rooted, or PLUGIN_DATA-rooted working directory. Filesystem containment is validated separately."
+        }
+      },
+      "required": ["type", "command"],
+      "additionalProperties": false
+    },
+    "streamableHttpServer": {
+      "title": "Streamable HTTP MCP server",
+      "type": "object",
+      "properties": {
+        "type": {
+          "const": "streamable-http"
+        },
+        "url": {
+          "type": "string",
+          "minLength": 1,
+          "description": "MCP endpoint URL. URL semantics are defined by the Agent Plugins specification."
+        },
+        "headers": {
+          "$ref": "#/$defs/headers"
+        }
+      },
+      "required": ["type", "url"],
+      "additionalProperties": false
+    },
+    "sseServer": {
+      "title": "Legacy HTTP+SSE MCP server",
+      "type": "object",
+      "properties": {
+        "type": {
+          "const": "sse"
+        },
+        "url": {
+          "type": "string",
+          "minLength": 1,
+          "description": "MCP endpoint URL. URL semantics are defined by the Agent Plugins specification."
+        },
+        "headers": {
+          "$ref": "#/$defs/headers"
+        }
+      },
+      "required": ["type", "url"],
+      "additionalProperties": false
+    },
+    "headers": {
+      "title": "HTTP headers",
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      }
+    }
+  }
+}

package/schemas/1.1.0/plugin.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agent-plugins.org/schemas/1.1.0/plugin.schema.json",
+  "title": "Agent Plugins Manifest",
+  "description": "Machine-readable schema for plugin.json in Agent Plugins 1.1.0. The Agent Plugins specification defines additional semantic and operational requirements.",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "const": "https://agent-plugins.org/schemas/1.1.0/plugin.schema.json",
+      "description": "Canonical identifier of the plugin manifest schema for the Agent Plugins version targeted by this document."
+    },
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^(?!.*(?:--|\\.\\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$",
+      "description": "Human-readable plugin name."
+    },
+    "version": {
+      "type": "string"
+    },
+    "description": {
+      "type": "string"
+    },
+    "author": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "email": {
+          "type": "string"
+        },
+        "url": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "homepage": {
+      "type": "string"
+    },
+    "repository": {
+      "type": "string"
+    },
+    "license": {
+      "type": "string"
+    },
+    "keywords": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "extensions": {
+      "type": "object",
+      "description": "Client-specific manifest data keyed by reverse-domain extension namespace. Agent Plugins assigns no semantics to namespace object contents.",
+      "additionalProperties": {
+        "type": "object"
+      }
+    }
+  },
+  "required": ["$schema", "name"],
+  "additionalProperties": false
+}

package/schemas/README.md

@@ -1,9 +1,10 @@
 # Plugin manifest and marketplace specifications
 
-This directory is the specification library for the plugin layouts this manager reads. It holds two kinds of files:
+This directory is the specification library for the plugin layouts this manager reads. It holds three kinds of files:
 
-1. **Vendored upstream schemas** in [`1.0.0/`](1.0.0/) — pinned copies of the official agent-plugins.org v1.0.0 schemas. These are bundled into the published package and loaded at runtime by [`src/catalog/validate.ts`](../src/catalog/validate.ts), because the specification requires clients to validate plugin packages without retrieving schemas at load time (§7.2.1: "Clients MUST NOT retrieve a schema while loading a plugin").
+1. **Vendored upstream schemas** in [`1.0.0/`](1.0.0/) and [`1.1.0/`](1.1.0/) — pinned copies of the official agent-plugins.org schemas (1.0.0 published, 1.1.0 the working draft this manager explicitly recognizes as compatible; the two releases' schemas differ only in the version string). These are bundled into the published package and loaded at runtime by [`src/catalog/validate.ts`](../src/catalog/validate.ts), because the specification requires clients to validate plugin packages without retrieving schemas at load time (§7.2.1: "Clients MUST NOT retrieve a schema while loading a plugin").
 2. **Reference contracts** in `<dialect>/` — an authored JSON Schema pair plus a `spec.md` for each layout the manager recognizes. **These are documentation, not runtime validators**: the scanner still applies the strategy-chain rules in `src/catalog/`. They exist so a dialect's field set, file locations, and evidence are pinned in one place.
+3. **The client extension namespace contract** in [`com.deepseek.harness/`](com.deepseek.harness/) — the authored schema and rules for this manager's own §8 namespace: manifest data under `extensions["com.deepseek.harness"]` and the top-level `com.deepseek.harness/` extension directory.
 
 Every authored schema records its provenance in a `$comment`, and every dialect's `spec.md` records the sources, the verification date, and the unresolved gaps.
 
@@ -14,7 +15,11 @@ schemas/
 ├── 1.0.0/                     # vendored agent-plugins.org v1.0.0 (runtime-loaded)
 │   ├── plugin.schema.json
 │   └── mcp.schema.json
-├── agent-plugins/spec.md      # the published cross-vendor standard (schemas live in 1.0.0/)
+├── 1.1.0/                     # vendored agent-plugins.org v1.1.0 working draft (runtime-loaded)
+├── agent-plugins/spec.md      # the published cross-vendor standard (schemas live in 1.0.0/ and 1.1.0/)
+├── com.deepseek.harness/      # this manager's §8 client extension namespace
+│   ├── namespace.schema.json
+│   └── spec.md
 ├── skill-collection/spec.md   # manifest-less layout; nothing to validate
 └── <dialect>/
     ├── plugin.schema.json
@@ -34,7 +39,7 @@ This table records **upstream client conventions**, including their own fallback
 | [Kimi (kimi-code)](kimi/spec.md) | `kimi.plugin.json` → `.kimi-plugin/plugin.json` | `KIMI_CODE_PLUGIN_MARKETPLACE_URL`, default `https://code.kimi.com/kimi-code/plugins/marketplace.json` | None reachable; the declared URI serves HTML |
 | [Kimi (kimi-cli, legacy)](kimi/spec.md#kimi-cli-legacy-a-different-format) | `plugin.json` with a `tools` array | None | None |
 | [Universal `.plugin/`](universal/spec.md) | `.plugin/plugin.json` | `.plugin/marketplace.json` | None — an observed convention, not a specification |
-| [agent-plugins.org v1](agent-plugins/spec.md) | `plugin.json` (required) | Vendor-specific; not part of the standard | **Vendored 1.0.0** |
+| [agent-plugins.org v1](agent-plugins/spec.md) | `plugin.json` (required) | Vendor-specific; not part of the standard. This manager reads `.claude-plugin/marketplace.json`, root `marketplace.json`, or rooted discovery with no catalog | **Vendored 1.0.0 and 1.1.0** |
 | [Skill collection](skill-collection/spec.md) | None | None | n/a |
 | [ZCode](zcode/spec.md) | `.zcode-plugin/plugin.json` → `.claude-plugin/` → `.codex-plugin/` | `.claude-plugin/marketplace.json` → `marketplace.json` | None |
 | [Qoder CLI](qoder/spec.md) | `.qoder-plugin/plugin.json` → `.claude-plugin/plugin.json` | `.qoder-plugin/marketplace.json` → `.claude-plugin/` → `marketplace.json` | None |
@@ -44,19 +49,19 @@ This table records **upstream client conventions**, including their own fallback
 
 These are the points where the layouts actually differ; they cause the most silent failures.
 
-| Dialect              | MCP configuration                                                                     | Hooks                              |
-| -------------------- | ------------------------------------------------------------------------------------- | ---------------------------------- |
-| Claude Code          | `.mcp.json`; inline `mcpServers` is additive                                          | `hooks/hooks.json` or inline       |
-| Codex                | legacy: `.mcp.json` (validator rejects `mcp.json`); agent-plugins dialect: `mcp.json` | manifest `hooks` or `hooks/`       |
-| Cursor               | `mcp.json` (dot-file only via an explicit `mcpServers` field)                         | `hooks/hooks.json` or inline       |
-| Kimi (kimi-code)     | inline `mcpServers` only                                                              | inline `hooks` array               |
-| Universal `.plugin/` | `.mcp.json`, `.github/mcp.json`                                                       | `hooks.json` or `hooks/hooks.json` |
-| agent-plugins.org v1 | `mcp.json`, required and closed; inline is forbidden                                  | Not defined                        |
-| ZCode                | `.mcp.json` only                                                                      | `hooks/hooks.json`                 |
-| Qoder CLI            | `.mcp.json` → `mcp.json` (never merged)                                               | `hooks/hooks.json`                 |
-| GitHub Copilot CLI   | `.mcp.json`, `.github/mcp.json`                                                       | `hooks.json` or `hooks/hooks.json` |
+| Dialect              | MCP configuration                                                                      | Hooks                                                        |
+| -------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| Claude Code          | `.mcp.json`; inline `mcpServers` is additive                                           | `hooks/hooks.json` or inline                                 |
+| Codex                | legacy: `.mcp.json` (validator rejects `mcp.json`); agent-plugins dialect: `mcp.json`  | manifest `hooks` or `hooks/`                                 |
+| Cursor               | `mcp.json` (dot-file only via an explicit `mcpServers` field)                          | `hooks/hooks.json` or inline                                 |
+| Kimi (kimi-code)     | inline `mcpServers` only                                                               | inline `hooks` array                                         |
+| Universal `.plugin/` | `.mcp.json`, `.github/mcp.json`                                                        | `hooks.json` or `hooks/hooks.json`                           |
+| agent-plugins.org v1 | `mcp.json` (optional — a skills-only suite is conformant), closed; inline is forbidden | `com.deepseek.harness/hooks/hooks.json` (namespace contract) |
+| ZCode                | `.mcp.json` only                                                                       | `hooks/hooks.json`                                           |
+| Qoder CLI            | `.mcp.json` → `mcp.json` (never merged)                                                | `hooks/hooks.json`                                           |
+| GitHub Copilot CLI   | `.mcp.json`, `.github/mcp.json`                                                        | `hooks.json` or `hooks/hooks.json`                           |
 
-Claude Code and Copilot (including the Universal convention) define usable LSP declarations. Qoder/ZCode record the field without native execution. Cursor, Codex, Kimi and agent-plugins do not define a native LSP surface; this manager's shared LSP extension must not be confused with an upstream feature.
+Claude Code and Copilot (including the Universal convention) define usable LSP declarations. Qoder/ZCode record the field without native execution. Cursor, Codex, Kimi and agent-plugins do not define a native LSP surface; this manager reads agent-plugins LSP declarations from the [`com.deepseek.harness` namespace](com.deepseek.harness/spec.md), its own §8 extension rather than an upstream feature.
 
 ## Executable coverage
 
@@ -64,10 +69,11 @@ All ten active layouts are covered by [offline README repository tests](../tests
 
 ## Provenance and update policy
 
-- `1.0.0/*.schema.json` are vendored. Replace both files from [`agentplugins/agent-plugins-spec`](https://github.com/agentplugins/agent-plugins-spec) at the pinned spec version and bump the spec-version references in `src/catalog/validate.ts`. Never edit them by hand.
+- `1.0.0/*.schema.json` and `1.1.0/*.schema.json` are vendored. Replace the files from [`agentplugins/agent-plugins-spec`](https://github.com/agentplugins/agent-plugins-spec) at the pinned spec versions and bump the spec-version references in `src/catalog/validate.ts`. Never edit them by hand.
 - `<dialect>/*.schema.json` and `spec.md` are authored here. They are **not** upstream copies and carry no upstream compatibility guarantee. When a cited source changes, re-verify and update the schema, the `spec.md`, and the `$comment` provenance line together.
-- `agent-plugins/spec.md` documents the published standard but deliberately keeps its schemas in `1.0.0/` so there is exactly one copy in the tree.
+- `agent-plugins/spec.md` documents the published standard but deliberately keeps its schemas in `1.0.0/` and `1.1.0/` so there is exactly one copy of each release in the tree.
+- `com.deepseek.harness/` is authored here and owned here: it defines this manager's own §8 namespace, so its evolution is governed by the namespace `schemaVersion`, not by upstream releases.
 
 ## Validation
 
-`tests/schemas.test.ts` compiles every schema with Ajv 2020-12, asserts `$id` uniqueness, pins the vendored ids to the runtime constants in `src/catalog/validate.ts`, and requires each dialect to keep a `spec.md` and a paired marketplace schema. Run `pnpm run test` after touching this directory; run `pnpm run format:check` for formatting.
+`tests/schemas.test.ts` compiles every schema with Ajv 2020-12, asserts `$id` uniqueness, pins the vendored ids to the runtime constants in `src/catalog/validate.ts`, and requires each dialect to keep a `spec.md` and a paired marketplace schema (the vendored release directories and the namespace contract keep their own documented shape instead). Run `pnpm run test` after touching this directory; run `pnpm run format:check` for formatting.

package/schemas/agent-plugins/spec.md

@@ -2,11 +2,11 @@
 
 The only published cross-vendor plugin format in this directory. Unlike the other dialects, its schemas are **vendored upstream** and loaded at runtime by this plugin.
 
-- **Schemas:** [../1.0.0/plugin.schema.json](../1.0.0/plugin.schema.json), [../1.0.0/mcp.schema.json](../1.0.0/mcp.schema.json)
+- **Schemas:** [`../1.0.0/plugin.schema.json`](../1.0.0/plugin.schema.json), [`../1.0.0/mcp.schema.json`](../1.0.0/mcp.schema.json), [`../1.1.0/plugin.schema.json`](../1.1.0/plugin.schema.json), [`../1.1.0/mcp.schema.json`](../1.1.0/mcp.schema.json)
 - **Specification:** https://agent-plugins.org/specification
-- **Repository:** [`agentplugins/agent-plugins-spec`](https://github.com/agentplugins/agent-plugins-spec) (`spec/1.0.0.md`, `schemas/1.0.0/`)
-- **Status:** 1.0.0 published; 1.1.0 is a working draft whose plugin schema is currently byte-identical to 1.0.0.
-- **Runtime use:** `src/catalog/validate.ts` loads both 1.0.0 schemas through Ajv, and `src/catalog/manifests.ts` selects this dialect only when a root `plugin.json` declares a recognized `$schema`.
+- **Repository:** [`agentplugins/agent-plugins-spec`](https://github.com/agentplugins/agent-plugins-spec) (`spec/1.0.0.md`, `spec/1.1.0.md`, `schemas/1.0.0/`, `schemas/1.1.0/`)
+- **Status:** 1.0.0 published; 1.1.0 is a working draft whose schemas differ from 1.0.0 only in the version string (verified 2026-09-17 at upstream `ff8ab5e`); the spec text additionally renames two phrasings ("claiming conformance to Agent Plugins v1" → "claiming conformance", "Agent Plugins v1 defines no OAuth" → "This specification defines no OAuth"). This manager explicitly recognizes 1.1.0 as compatible (§5.2) and validates each version against its own vendored schemas.
+- **Runtime use:** `src/catalog/validate.ts` loads all four vendored schemas through Ajv and selects the validator by the manifest's declared `$schema`; `src/catalog/manifests.ts` selects this dialect only when a root `plugin.json` declares a recognized `$schema`. Client-specific behavior beyond the portable core lives in the [`com.deepseek.harness` namespace](../com.deepseek.harness/spec.md).
 
 ## Manifest location
 
@@ -14,11 +14,11 @@ Normative (§5.1): clients MUST check for a manifest at `plugin.json` in the plu
 
 ## Plugin manifest fields
 
-Closed schema: `additionalProperties: false`, `required: ["$schema", "name"]`, and no `default` keyword anywhere.
+Closed schema: `additionalProperties: false`, `required: ["$schema", "name"]`, and no `default` keyword anywhere. Per §5.2 an unknown top-level field is reported and ignored while the plugin keeps loading; any other schema violation is fatal.
 
 | Field | Type | Required | Constraints |
 | --- | --- | --- | --- |
-| `$schema` | string | yes | `const: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json` |
+| `$schema` | string | yes | `const`: the canonical id of one supported release (`1.0.0`, `1.1.0`) |
 | `name` | string | yes | 1–64 chars, `^(?!.*(?:--\|\.\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$` |
 | `version` | string | no | SemVer recommended, not enforced. |
 | `description` | string | no |  |
@@ -26,7 +26,7 @@ Closed schema: `additionalProperties: false`, `required: ["$schema", "name"]`, a
 | `homepage`, `repository` | string | no | Not URL-validated. |
 | `license` | string | no | SPDX recommended, not enforced. |
 | `keywords` | string[] | no | No `minItems`/`uniqueItems`. |
-| `extensions` | object of object | no | Client-specific data keyed by reverse-domain namespace; the specification assigns no semantics to namespace contents. |
+| `extensions` | object of object | no | Client-specific data keyed by reverse-domain namespace; the specification assigns no semantics to namespace contents. Violations inside this subtree are reported and ignored (§8.1). |
 
 ## Fixed component locations
 
@@ -37,7 +37,21 @@ Clients MUST discover each supported component type from its fixed location, and
 | Skills      | `skills/`  | Immediate subdirectories containing `SKILL.md` |
 | MCP servers | `mcp.json` | JSON configuration                             |
 
-v1 defines exactly these two component types. Commands, hooks, agents, rules, and LSP servers are explicitly outside the format "until their formats converge". MCP configuration MUST NOT be declared inline in `plugin.json`. The `mcp.json` schema is closed and requires `$schema` and `mcpServers` with no other top-level fields; every server requires `type` and must match exactly one closed variant.
+v1 defines exactly these two component types. Commands, hooks, agents, rules, and LSP servers are explicitly outside the format "until their formats converge". MCP configuration MUST NOT be declared inline in `plugin.json`. The `mcp.json` schema is closed and requires `$schema` and `mcpServers` with no other top-level fields; every server requires `type` and must match exactly one closed variant (§7.2.2 rule 3: a per-server violation skips that server only). `mcp.json` `$schema` MUST name the same release as `plugin.json` (§10.1). Skills discovery covers one level of `skills/` subdirectories and MUST NOT search deeper descendants (§7.1). `mcp.json` fixes a location, not a presence requirement: a suite carrying skills only is conformant, and an absent `mcp.json` contributes zero servers.
+
+## Marketplace catalogs
+
+The specification defines no marketplace format — catalogs of v1 suites are a vendor-side convention, and the standard assigns them no schema. This manager reads three catalog shapes over v1 suite roots, in the shared scan order:
+
+1. `.claude-plugin/marketplace.json` (Claude Code shape).
+2. Root `marketplace.json` — the fallback catalog for layouts without a dedicated one.
+3. No catalog at all — rooted discovery walks the checkout (up to four levels deep) and reads every directory carrying a v1 manifest, so a bare collection is scannable without any catalog file. The first-party collection [dsh-agent-plugins](https://github.com/Sivan757/dsh-agent-plugins) ships this shape: suites under `plugins/`, no catalog manifest.
+
+A catalog entry's `name`/`version`/`description` are fallbacks: a conformant suite's own `plugin.json` wins for every field it declares. Entries may add display metadata the portable manifest cannot express (`category`, `keywords`). Entry sources resolve relative to the catalog's checkout; with no `source`, each entry resolves against the catalog checkout's own containers.
+
+## Client extensions
+
+§8 gives every client a reverse-domain namespace: manifest data under `extensions`, files under a top-level directory of the same name. Other clients MUST ignore unimplemented namespaces without validating their contents. This manager's namespace is [`com.deepseek.harness`](../com.deepseek.harness/spec.md) — it carries the component types the portable format leaves out and the per-server client policy the closed `mcp.json` schema cannot hold.
 
 ## Governance and adoption
 
@@ -45,4 +59,4 @@ The technical steering committee is Amazon, Cursor, Microsoft, OpenAI, and Verce
 
 ## Update procedure
 
-Replace both files from the upstream repository at the pinned spec version and bump the spec-version references in `src/catalog/validate.ts`. Do not edit the vendored files by hand.
+Replace the vendored files from the upstream repository at the pinned spec versions and bump the spec-version references in `src/catalog/validate.ts`. Do not edit the vendored files by hand.

package/schemas/com.deepseek.harness/namespace.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://deepseek.com/schemas/dsh-agent-plugins-market/namespace.schema.json",
+  "$comment": "Authored contract for the com.deepseek.harness client extension namespace (Agent Plugins §8.1). Documentation-grade: the runtime applies the strategy-chain rules in src/catalog, not this file. The extension namespace is client-defined by specification; this schema records what this manager reads.",
+  "title": "com.deepseek.harness namespace extension data",
+  "type": "object",
+  "required": ["schemaVersion"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": {
+      "type": "string",
+      "const": "1.0.0",
+      "description": "Namespace contract version the suite was written against. Only 1.0.0 is implemented; any other value skips both namespace seats and keeps the portable core."
+    },
+    "mcpServers": {
+      "type": "object",
+      "description": "Per-server client policy keyed by the server's own name in the suite's portable mcp.json. Names without a matching server are reported and ignored.",
+      "additionalProperties": { "$ref": "#/$defs/serverPolicy" }
+    }
+  },
+  "$defs": {
+    "serverPolicy": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "auth": {
+          "type": "object",
+          "description": "OAuth 2.1 authorization for Streamable HTTP / SSE servers that answer 401 with a challenge; the flow activates on the server's first 401.",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": { "type": "boolean", "default": true, "description": "Enable the OAuth flow (default true; false opts out explicitly)." },
+            "scope": { "type": "string", "description": "Space-separated scope string requested during authorization." }
+          }
+        },
+        "enabledTools": { "type": "array", "items": { "type": "string" }, "description": "Allow-list of model-facing tool names; absent means all tools." },
+        "disabledTools": { "type": "array", "items": { "type": "string" }, "description": "Deny-list of model-facing tool names applied after the allow-list." },
+        "startupTimeoutMs": { "type": "number", "exclusiveMinimum": 0, "description": "Milliseconds allowed between spawn and a completed MCP handshake before the mount fails." },
+        "toolCallTimeoutMs": { "type": "number", "exclusiveMinimum": 0, "description": "Milliseconds allowed for one tool call before it is cancelled." }
+      }
+    }
+  }
+}

package/schemas/com.deepseek.harness/spec.md

@@ -0,0 +1,52 @@
+# com.deepseek.harness namespace contract
+
+The client extension namespace of this manager under the [Agent Plugins specification](https://agent-plugins.org/specification) §8. The namespace has two seats, which the specification leaves entirely to the owning client:
+
+1. **Manifest data** — `plugin.json` → `extensions["com.deepseek.harness"]`, validated against [`namespace.schema.json`](namespace.schema.json).
+2. **Extension directory** — the top-level `com.deepseek.harness/` directory.
+
+Both seats open only when the manifest data declares `"schemaVersion": "1.0.0"`. A suite that ships the directory without the declaration, or with an unsupported version, contributes its portable core only (`skills/`, `mcp.json`) and the directory is ignored with a scan note.
+
+## Extension directory layout
+
+| Path                                    | Surface                                                           |
+| --------------------------------------- | ----------------------------------------------------------------- |
+| `com.deepseek.harness/commands/*.md`    | Slash commands                                                    |
+| `com.deepseek.harness/agents/*.md`      | Agent roles                                                       |
+| `com.deepseek.harness/hooks/hooks.json` | Command hooks (Claude Code event-table shape)                     |
+| `com.deepseek.harness/lsp.json`         | LSP server declarations (`lspServers` table or a bare server map) |
+
+## What the namespace carries
+
+Everything a portable suite cannot express because the v1 format fixes its component set to Agent Skills and MCP, and closes the manifest:
+
+- **Commands, agent roles, hooks, LSP declarations.** The specification records these component types as outside the format "until their formats converge"; the namespace is where they live for this client.
+- **Per-server client policy** (`extensions["com.deepseek.harness"].mcpServers`): OAuth authorization, tool allow/deny lists, and timeout policies for servers declared in the portable `mcp.json`. The portable file stays schema-clean; client-specific fields ride the namespace, keyed by the server's own name.
+
+Namespace values are the suite's defaults rather than a ceiling the user cannot reach. A stored user override may set either timeout, and that value wins over the declaration; a user may add tool names to the deny list, while the allow-list and the suite's own deny entries stay in force. Tool filtering only ever tightens. The override record lives outside the suite checkout, so a package refresh never clobbers it and the namespace file stays source-owned. The host compatibility client (`@deepseek-ai/dsh-mcp-client`) enforces neither the tool lists nor a startup timeout, so a server mounted through it carries no such value; the built-in bridge is where those take effect.
+
+## User-owned declarations
+
+`~/.agents/mcp.json` is local data rather than a distributable package. Keys this client does not know are stored back exactly as written, and the package-only rules — a closed server shape, bare command names, plugin-relative paths — do not apply to it. A suite's packaged `mcp.json` keeps every one of them, because a package carrying fields this client cannot honour is one it cannot promise to mount.
+
+The editor reads the same two seats a suite declares, for one server at a time: the portable definition under `mcpServers` and this client's policy under `com.deepseek.harness`. The form writes only the half it owns, so a field it has no control for — a key another client introduced, a policy entry the form does not show — survives both a form edit and a JSON edit. Only the policy entries the user changed are sent on save; an entry the document drops asks for inheritance.
+
+## Failure behavior
+
+| Situation                                               | Behavior                                                    |
+| ------------------------------------------------------- | ----------------------------------------------------------- |
+| Namespace value is not an object                        | Reported, ignored; plugin keeps loading                     |
+| `schemaVersion` missing or unsupported                  | Reported; both namespace seats skipped; portable core loads |
+| Directory exists but the manifest declares no namespace | Directory not read; scan note records it                    |
+| One command / agent / hook / LSP entry invalid          | That entry skipped with a diagnostic; the rest load         |
+| Namespace path resolves outside the plugin root         | That path rejected (§4.1)                                   |
+
+## Placeholder rules
+
+Values inside the namespace seats expand `${PLUGIN_ROOT}`, `${PLUGIN_DATA}`, and `${NAME}` credential references — the namespace is client-owned data, so the credential seam the portable `mcp.json` forbids (§9.2) is available here. Missing credential references fail that surface closed with a diagnostic.
+
+## Provenance
+
+- Sources: [Agent Plugins specification](https://agent-plugins.org/specification) §8 (client extensions), §9.2 (placeholder expansion), and the runtime behavior of `src/catalog/manifests.ts` (manifest seat) and `src/catalog/scan-resolvers.ts` (directory seat).
+- Verified: 2026-09-17 against `agentplugins/agent-plugins-spec` `ff8ab5e` (1.0.0 published, 1.1.0 working draft).
+- Unresolved: none. The specification assigns no semantics to namespace contents, so every rule above is this client's own contract and can evolve by bumping `schemaVersion`.