dsh-agent-plugins-market 0.7.1 → 0.7.2

package/lib/application/catalog.js

@@ -226,13 +226,17 @@ export class Catalog {
     async addMcpServer(name, server) {
         await this.mcp.addServer(name, server);
     }
+    /** Import several pasted services in one write; each entry reports its own outcome. */
+    async importMcpServers(servers, overwrite) {
+        return this.mcp.importServers(servers, overwrite);
+    }
     /** Read effective service configuration without exposing credential literals. */
     async serverConfig(kind, id) {
         return this.mcp.serverConfig(kind, id);
     }
     /** Validate a complete replacement before writing; plugin checkouts remain untouched. */
-    async saveServerConfig(kind, id, config) {
-        await this.mcp.saveServerConfig(kind, id, config);
+    async saveServerConfig(kind, id, config, policy) {
+        await this.mcp.saveServerConfig(kind, id, config, policy);
     }
     /** One suite's persisted MCP overrides, addressed by qualified suite id. */
     async mcpOverrides(sourceId, suiteId) {
@@ -251,6 +255,14 @@ export class Catalog {
     async setMcpServerEnabled(suiteKey, serverKey, enabled) {
         await this.mcp.setServerEnabled(suiteKey, serverKey, enabled);
     }
+    /**
+     * Allow or deny one tool of a declared MCP server, addressed by the same
+     * source-qualified suite id its status row carries. The denial lands in the
+     * override record, so the suite's own `mcp.json` stays source-owned.
+     */
+    async setMcpServerToolEnabled(suiteKey, serverKey, tool, enabled) {
+        await this.mcp.setServerToolEnabled(suiteKey, serverKey, tool, enabled);
+    }
     /** Re-run the MCP reconcile pass without changing any catalog state. */
     async retryMounts() {
         await this.mcp.retryMounts();

package/lib/application/install-store.js

@@ -77,7 +77,7 @@ export class InstallStore {
             await this.context.notifyChanged(true);
         });
     }
-    /** Append config-seeded sources missing from user state and persist them. */
+    /** Append seeded sources missing from user state and persist them. */
     async mergeSources(sources) {
         const existing = new Set(this.context.state.sources.map(source => source.id));
         const additions = sources.filter(source => !existing.has(source.id));

package/lib/application/mcp-service.js

@@ -11,13 +11,17 @@ import { isDirectory } from '../catalog/fs-probes.js';
 import { discoverSuitesInSource } from '../catalog/suite-scanner.js';
 import { readLocalePreference } from '../runtime/host-locale.js';
 import { probeHostMcpClient } from '../runtime/mcp-backend.js';
+import { declaredMcpPolicy, namespaceMcpPolicy, resolveMcpPolicy } from '../runtime/mcp-config.js';
 import { loadLspServers, saveLspServers } from '../runtime/lsp-direct-config.js';
-import { addUserMcpServer, loadUserMcpSuite, USER_MCP_SOURCE, USER_MCP_SUITE } from '../runtime/mcp-direct-config.js';
-import { applyOverride, loadSuiteOverrides, mergeOverridePatch, saveSuiteOverrides } from '../runtime/mcp-overrides.js';
+import { addUserMcpServer, importUserMcpServers, loadUserMcpSuite, USER_MCP_SOURCE, USER_MCP_SUITE } from '../runtime/mcp-direct-config.js';
+import { applyOverride, loadSuiteOverrides, mergeOverridePatch, parseMcpPolicyPatch, saveSuiteOverrides, withoutPolicyFields } from '../runtime/mcp-overrides.js';
 import { redactMcpConfig, redactMcpOverrides } from '../runtime/mcp-redaction.js';
 import { buildMcpStatus } from '../runtime/mcp-status.js';
 import { resolveRegion } from '../runtime/regions.js';
 import { applyLspOverrides, lspConfig, restoreRedactedConfig, saveLspOverride, validateServerLsp, validateServerMcp } from '../runtime/server-config.js';
+/** The host compatibility client mounts servers without a startup timeout or tool filters. */
+const HOST_STARTUP_TIMEOUT_UNSUPPORTED = 'the host MCP backend cannot enforce a startup timeout; switch the MCP backend to the built-in client to set one';
+const HOST_TOOL_FILTER_UNSUPPORTED = 'the host MCP backend cannot enforce tool filters; switch the MCP backend to the built-in client to choose tools';
 export class McpService {
     context;
     ports;
@@ -39,7 +43,9 @@ export class McpService {
                 entry.kind = 'direct';
                 entry.managed = true;
             }
-        const oauthBackend = (await this.backend()) === 'builtin' && this.reauthorizeAvailable();
+        const backend = await this.backend();
+        payload.backend = backend;
+        const oauthBackend = backend === 'builtin' && this.reauthorizeAvailable();
         for (const entry of payload.entries) {
             const auth = entry.config?.auth;
             entry.canReauthorize =
@@ -58,21 +64,71 @@ export class McpService {
             await this.context.notifyChanged(true);
         });
     }
+    /**
+     * Import several pasted services in one write. Each entry is checked on its
+     * own and reports back with its own outcome, so a paste of many services
+     * never fails as a block.
+     */
+    async importServers(servers, overwrite) {
+        if (!Array.isArray(servers))
+            throw new Error('servers must be an array');
+        const entries = servers.map(entry => {
+            if (typeof entry !== 'object' || entry === null)
+                throw new Error('each server must be an object');
+            const { name, config } = entry;
+            if (typeof name !== 'string' || name === '')
+                throw new Error('each server needs a name');
+            return { name, server: config };
+        });
+        return this.context.enqueue(async () => {
+            const result = await importUserMcpServers(this.context.agentsRoot, entries, overwrite);
+            if (result.imported.length > 0)
+                await this.context.notifyChanged(true);
+            return result;
+        });
+    }
     /** Read effective service configuration without exposing credential literals. */
     async serverConfig(kind, id) {
         const config = await this.resolveServerConfig(kind, id);
-        return { kind, id, editable: true, config: redactMcpConfig(config.value) };
+        const payload = { kind, id, key: config.key, editable: true, config: redactMcpConfig(config.value) };
+        if (kind === 'mcp') {
+            payload.backend = await this.backend();
+            if (config.policy !== undefined)
+                payload.policy = serverPolicyPayload(config.policy, config.override, config.declaredAuth);
+        }
+        return payload;
     }
-    /** Validate a complete replacement before writing; plugin checkouts remain untouched. */
-    async saveServerConfig(kind, id, config) {
+    /**
+     * Validate a complete replacement before writing; plugin checkouts remain
+     * untouched. `policy` carries what the portable document has no seat for —
+     * the two timeouts, the user's tool denials and the OAuth opt-in; an absent
+     * field keeps its stored value, `null` clears it.
+     */
+    async saveServerConfig(kind, id, config, policy) {
         return this.context.enqueue(async () => {
             const current = await this.resolveServerConfig(kind, id);
             const value = restoreRedactedConfig(config, current.value);
             if (kind === 'mcp') {
-                const server = await validateServerMcp(current.root, current.key, value);
+                const backend = await this.backend();
+                const patch = parseMcpPolicyPatch(policy);
+                if (backend === 'host' && patch.startupTimeoutMs !== undefined && patch.startupTimeoutMs !== null)
+                    throw new Error(HOST_STARTUP_TIMEOUT_UNSUPPORTED);
+                if (backend === 'host' && patch.disabledTools !== undefined)
+                    throw new Error(HOST_TOOL_FILTER_UNSUPPORTED);
+                const server = await validateServerMcp(current.root, current.key, value, { userOwned: isUserOwnedMcp(current.suiteKey) });
                 const overrides = await loadSuiteOverrides(this.context.dataRoot, current.suiteKey);
-                const enabled = overrides[current.key]?.enabled;
-                overrides[current.key] = { config: server, ...(enabled === undefined ? {} : { enabled }) };
+                const existing = overrides[current.key] ?? {};
+                // The complete configuration already carries every connection input, so
+                // a leftover url/headers/env/args field would shadow what was just
+                // saved. Enablement and the policy fields the save did not touch survive.
+                const next = { config: server };
+                if (existing.enabled !== undefined)
+                    next.enabled = existing.enabled;
+                applyAuth(next, patch.auth, existing.auth);
+                applyToolList(next, patch.disabledTools, existing.disabledTools);
+                applyTimeout(next, 'toolCallTimeoutMs', patch.toolCallTimeoutMs, existing.toolCallTimeoutMs);
+                applyTimeout(next, 'startupTimeoutMs', patch.startupTimeoutMs, existing.startupTimeoutMs);
+                overrides[current.key] = next;
                 await saveSuiteOverrides(this.context.dataRoot, current.suiteKey, overrides);
             }
             else {
@@ -104,6 +160,53 @@ export class McpService {
      * in the suite's parsed mcp.json.
      */
     async setOverride(sourceId, suiteId, serverKey, override) {
+        if (override !== null && (override.startupTimeoutMs !== undefined || override.disabledTools !== undefined) && (await this.backend()) === 'host')
+            throw new Error(override.startupTimeoutMs !== undefined ? HOST_STARTUP_TIMEOUT_UNSUPPORTED : HOST_TOOL_FILTER_UNSUPPORTED);
+        // Merge onto the stored record: the UI never receives literal secret
+        // values, so a verbatim write would drop keys it simply redacted.
+        await this.updateServerOverride(sourceId, suiteId, serverKey, current => (override === null ? null : mergeOverridePatch(current ?? {}, override)));
+    }
+    /**
+     * Enable or disable one declared server, addressed by the source-qualified
+     * suite id the status rows carry. The qualified id is split here rather than
+     * by callers so the separator stays a server-side detail.
+     */
+    async setServerEnabled(suiteKey, serverKey, enabled) {
+        const { sourceId, suiteId } = splitSuiteKey(suiteKey);
+        await this.setOverride(sourceId, suiteId, serverKey, { enabled });
+    }
+    /**
+     * Allow or deny one tool of a declared server, addressed by the
+     * source-qualified suite id the status rows carry. The stored record lists
+     * only the tools the user turned off, so a server with nothing denied
+     * carries no tool field at all.
+     */
+    async setServerToolEnabled(suiteKey, serverKey, tool, enabled) {
+        const { sourceId, suiteId } = splitSuiteKey(suiteKey);
+        if (tool === '')
+            throw new Error('tool name is required');
+        if ((await this.backend()) === 'host')
+            throw new Error(HOST_TOOL_FILTER_UNSUPPORTED);
+        await this.updateServerOverride(sourceId, suiteId, serverKey, current => {
+            const denied = new Set(current?.disabledTools ?? []);
+            if (enabled)
+                denied.delete(tool);
+            else
+                denied.add(tool);
+            const next = { ...(current ?? {}) };
+            if (denied.size === 0)
+                delete next.disabledTools;
+            else
+                next.disabledTools = [...denied];
+            return Object.keys(next).length === 0 ? null : next;
+        });
+    }
+    /**
+     * Rewrite one declared server's override record and remount it. The mutate
+     * callback receives the stored record — absent when none is persisted — and
+     * returns the replacement, or `null` to drop the record entirely.
+     */
+    async updateServerOverride(sourceId, suiteId, serverKey, mutate) {
         return this.context.enqueue(async () => {
             const suiteKey = qualifiedSuiteId(sourceId, suiteId);
             const source = this.context.state.sources.find(entry => entry.id === sourceId);
@@ -129,14 +232,11 @@ export class McpService {
             // Override files are keyed by the qualified id so two sources' same-named
             // suites never share one override record.
             const overrides = await loadSuiteOverrides(this.context.dataRoot, suiteKey);
-            if (override === null) {
+            const next = mutate(overrides[serverKey]);
+            if (next === null)
                 delete overrides[serverKey];
-            }
-            else {
-                // Merge onto the stored record: the UI never receives literal secret
-                // values, so a verbatim write would drop keys it simply redacted.
-                overrides[serverKey] = mergeOverridePatch(overrides[serverKey] ?? {}, override);
-            }
+            else
+                overrides[serverKey] = next;
             await saveSuiteOverrides(this.context.dataRoot, suiteKey, overrides);
             await this.context.notifyChanged(true);
             // The status surface reads the live tool registry, so an immediate read
@@ -147,17 +247,6 @@ export class McpService {
             await this.context.refreshSettled();
         });
     }
-    /**
-     * Enable or disable one declared server, addressed by the source-qualified
-     * suite id the status rows carry. The qualified id is split here rather than
-     * by callers so the separator stays a server-side detail.
-     */
-    async setServerEnabled(suiteKey, serverKey, enabled) {
-        const separator = suiteKey.indexOf('/');
-        if (separator <= 0)
-            throw new Error(`invalid suite id "${suiteKey}"`);
-        await this.setOverride(suiteKey.slice(0, separator), suiteKey.slice(separator + 1), serverKey, { enabled });
-    }
     /**
      * Re-run the MCP reconcile pass: retries failed mounts and clears residual
      * tools, without changing any catalog state.
@@ -231,7 +320,11 @@ export class McpService {
         }
         return map;
     }
-    /** Resolve one editable server: its key, owning suite, root, and effective config. */
+    /**
+     * Resolve one editable server: its key, owning suite, root, and the service
+     * document the editor renders. An MCP document carries the portable shape
+     * only; the client policy behind it rides `policy`.
+     */
     async resolveServerConfig(kind, id) {
         if (kind === 'lsp' && id.startsWith('direct/')) {
             const key = id.slice(7);
@@ -247,8 +340,17 @@ export class McpService {
                 for (const [key, server] of Object.entries(suite.mcp?.servers ?? {})) {
                     if (id !== `plugin:${suiteKey}/${key}`)
                         continue;
-                    const overrides = await loadSuiteOverrides(this.context.dataRoot, suiteKey);
-                    return { key, suiteKey, root: suite.root, value: { ...applyOverride(server, overrides[key]) } };
+                    const override = (await loadSuiteOverrides(this.context.dataRoot, suiteKey))[key];
+                    const declared = namespaceMcpPolicy(suite, key);
+                    return {
+                        key,
+                        suiteKey,
+                        root: suite.root,
+                        value: { ...withoutPolicyFields(applyOverride(server, override)) },
+                        policy: resolveMcpPolicy(declaredMcpPolicy(server, declared), override),
+                        ...(override === undefined ? {} : { override }),
+                        ...(declared?.auth?.enabled === undefined ? {} : { declaredAuth: declared.auth.enabled })
+                    };
                 }
             }
             else {
@@ -261,3 +363,56 @@ export class McpService {
         throw new Error('service configuration is not managed by this plugin');
     }
 }
+/** Split one source-qualified suite id; the separator stays a server-side detail. */
+function splitSuiteKey(suiteKey) {
+    const separator = suiteKey.indexOf('/');
+    if (separator <= 0)
+        throw new Error(`invalid suite id "${suiteKey}"`);
+    return { sourceId: suiteKey.slice(0, separator), suiteId: suiteKey.slice(separator + 1) };
+}
+/** Project one resolved policy onto the wire shape the editor renders. */
+function serverPolicyPayload(policy, override, declaredAuth) {
+    const userDenied = override?.disabledTools ?? null;
+    const userAuth = override?.auth?.enabled ?? null;
+    const suiteAuth = declaredAuth ?? null;
+    return {
+        toolCallTimeout: policy.toolCallTimeout,
+        startupTimeout: policy.startupTimeout,
+        deniedTools: { user: userDenied, suite: policy.suiteDisabledTools ?? null, effective: policy.disabledTools ?? [] },
+        auth: { user: userAuth, suite: suiteAuth, effective: userAuth ?? suiteAuth ?? true }
+    };
+}
+/** The user-owned MCP declaration suite: its file is local data, not a package. */
+function isUserOwnedMcp(suiteKey) {
+    return suiteKey === `${USER_MCP_SOURCE}/${USER_MCP_SUITE}`;
+}
+/** Write the OAuth opt-in from a save: absent keeps the stored value, `null` clears it. */
+function applyAuth(target, patch, stored) {
+    if (patch === undefined) {
+        if (stored !== undefined)
+            target.auth = stored;
+        return;
+    }
+    if (patch !== null)
+        target.auth = patch;
+}
+/** Write the user's deny list: absent keeps it, `null` clears it, entries replace it. */
+function applyToolList(target, patch, stored) {
+    if (patch === undefined) {
+        if (stored !== undefined)
+            target.disabledTools = stored;
+        return;
+    }
+    if (patch !== null && patch.length > 0)
+        target.disabledTools = patch;
+}
+/** Write one timeout from a save: absent keeps the stored value, `null` clears it, a number sets it. */
+function applyTimeout(target, field, patch, stored) {
+    if (patch === undefined) {
+        if (stored !== undefined)
+            target[field] = stored;
+        return;
+    }
+    if (patch !== null)
+        target[field] = patch;
+}

package/lib/catalog/archive.js

@@ -43,6 +43,21 @@ export async function downloadArchive(url, tempFile, options = {}) {
     const response = await fetch(trimmed, { signal: AbortSignal.timeout(timeoutMs), redirect: 'follow' });
     if (!response.ok)
         throw new Error(`archive download failed: HTTP ${response.status} for ${trimmed}`);
+    // Fetch follows redirects. The origin was checked above, but the final URL
+    // must preserve the HTTPS-only policy as well; otherwise a trusted HTTPS URL
+    // could downgrade the payload request to plain HTTP.
+    if (options.allowHttp !== true) {
+        const finalUrl = response.url === '' ? trimmed : response.url;
+        let finalProtocol;
+        try {
+            finalProtocol = new URL(finalUrl).protocol;
+        }
+        catch {
+            throw new Error('archive redirected to an invalid URL');
+        }
+        if (finalProtocol !== 'https:')
+            throw new Error('archive redirected to non-https URL');
+    }
     const declared = Number(response.headers.get('content-length') ?? '0');
     if (Number.isFinite(declared) && declared > ARCHIVE_MAX_BYTES) {
         throw new Error(`archive exceeds the ${ARCHIVE_MAX_BYTES} byte limit: ${declared}`);

package/lib/catalog/manifests.js

@@ -23,7 +23,8 @@ import { join } from 'node:path';
 import { sanitizeId } from './paths.js';
 import { isFile } from './fs-probes.js';
 import { isRecord } from './component-files.js';
-import { isRecognizedSchema, validatePluginManifest } from './validate.js';
+import { formatSchemaErrors, isRecognizedSchema, validatePluginManifest } from './validate.js';
+import { EXTENSION_NAMESPACE, NAMESPACE_SCHEMA_VERSIONS, V1_IGNORED_MANIFEST_KEYS } from '../model/layouts.js';
 import { PLUGIN_LAYOUTS, MANIFEST_ALIASES, MARKETPLACE_PATHS } from '../model/layouts.js';
 /**
  * Every manifest file a directory carries, in selection order: highest
@@ -65,14 +66,20 @@ export function componentDeclarations(record) {
  * go to `fallbacks`, so the winner stays usable while the caller can still
  * report why the higher-priority declaration was ignored. The winner's own
  * diagnostics stay in `errors` and remain fatal.
+ *
+ * `notes` carries the winner's non-fatal diagnostics — §5.2 unknown
+ * top-level fields, §8.1 extension data problems. Callers surface them
+ * without failing the suite.
  */
-export async function readManifest(root, errors, hint, fallbacks = []) {
+export async function readManifest(root, errors, hint, fallbacks = [], notes = []) {
     const candidates = await detectManifests(root);
     for (const [index, candidate] of candidates.entries()) {
         const attempt = [];
-        const manifest = await readOneManifest(root, candidate, attempt, hint);
+        const attemptNotes = [];
+        const manifest = await readOneManifest(root, candidate, attempt, hint, attemptNotes);
         if (manifest !== undefined) {
             errors.push(...attempt);
+            notes.push(...attemptNotes);
             return manifest;
         }
         if (index === candidates.length - 1)
@@ -83,7 +90,7 @@ export async function readManifest(root, errors, hint, fallbacks = []) {
     return undefined;
 }
 /** Parse one manifest candidate; undefined when this candidate is unusable. */
-async function readOneManifest(root, candidate, errors, hint) {
+async function readOneManifest(root, candidate, errors, hint, notes = []) {
     let raw;
     try {
         raw = JSON.parse(await readFile(candidate.path, 'utf8'));
@@ -130,21 +137,47 @@ async function readOneManifest(root, candidate, errors, hint) {
             }
         }
     }
-    const problems = kind === 'agent-plugin-v1' ? await validatePluginManifest(raw) : [];
-    if (problems.length > 0) {
-        errors.push(...problems.map(problem => `${candidate.path}: ${problem}`));
+    // v1 validation verdicts split per §5.2: fatal violations reject this
+    // candidate (the next one by priority is tried), ignored violations —
+    // unknown top-level fields and the whole `extensions` subtree — are
+    // reported through `notes` and the manifest keeps loading.
+    const verdict = kind === 'agent-plugin-v1' ? await validatePluginManifest(raw) : undefined;
+    if (verdict !== undefined && verdict.fatal.length > 0) {
+        errors.push(...formatSchemaErrors(verdict.fatal).map(problem => `${candidate.path}: ${problem}`));
         return undefined;
     }
+    const ignored = verdict === undefined ? [] : formatSchemaErrors(verdict.ignored);
+    if (kind === 'agent-plugin-v1') {
+        // §5.2 / §6.1: the portable manifest carries no component configuration
+        // and no client semantics beyond `extensions`; every inline key this
+        // manager would otherwise read is an unknown top-level field here.
+        for (const key of V1_IGNORED_MANIFEST_KEYS) {
+            if (raw[key] !== undefined)
+                ignored.push(`${key}: not part of the portable manifest; ignored`);
+        }
+    }
+    notes.push(...ignored.map(problem => `${candidate.path}: ${problem}`));
+    const harness = kind === 'agent-plugin-v1' ? parseHarnessExtension(record['extensions'], notes) : undefined;
     const name = pickString(record.name) ?? hint?.name ?? syntheticManifestName(root);
     const version = pickString(record.version) ?? hint?.version;
     const description = pickString(record.description) ?? hint?.description;
     const author = record.author;
     return {
-        components: { ...componentDeclarations(hint ?? {}), ...fallbackComponents, ...componentDeclarations(raw) },
-        ...(typeof raw.skillInstructions === 'string' ? { skillInstructions: raw.skillInstructions } : {}),
-        ...(typeof raw.systemPrompt === 'string' ? { systemPrompt: raw.systemPrompt } : {}),
-        ...(typeof raw.systemPromptPath === 'string' ? { systemPromptPath: raw.systemPromptPath } : {}),
-        ...(typeof raw.sessionStart?.skill === 'string'
+        components: {
+            ...(kind === 'agent-plugin-v1' ? {} : componentDeclarations(hint ?? {})),
+            ...fallbackComponents,
+            ...(kind === 'agent-plugin-v1' ? {} : componentDeclarations(raw))
+        },
+        ...(typeof raw.skillInstructions === 'string' && kind !== 'agent-plugin-v1'
+            ? { skillInstructions: raw.skillInstructions }
+            : {}),
+        ...(typeof raw.systemPrompt === 'string' && kind !== 'agent-plugin-v1'
+            ? { systemPrompt: raw.systemPrompt }
+            : {}),
+        ...(typeof raw.systemPromptPath === 'string' && kind !== 'agent-plugin-v1'
+            ? { systemPromptPath: raw.systemPromptPath }
+            : {}),
+        ...(kind !== 'agent-plugin-v1' && typeof raw.sessionStart?.skill === 'string'
             ? { startupSkill: raw.sessionStart.skill }
             : {}),
         layout: kind,
@@ -161,9 +194,87 @@ async function readOneManifest(root, candidate, errors, hint) {
                     ? { author: pickString(record.homepage) }
                     : {}),
         keywords: Array.isArray(record.keywords) ? record.keywords.filter((entry) => typeof entry === 'string') : [],
-        ...(isRecognizedSchema(record.$schema) ? { schemaVersion: record.$schema } : {})
+        ...(isRecognizedSchema(record.$schema) ? { schemaVersion: record.$schema } : {}),
+        ...(harness === undefined ? {} : { harness })
     };
 }
+/**
+ * Read this client's §8.1 extension data from a v1 manifest's `extensions`
+ * object. Unknown namespaces are ignored without validating their contents
+ * (§8.1); our own namespace is validated against the namespace contract, and
+ * an unusable value is reported through `notes` instead of failing the
+ * plugin.
+ *
+ * @returns the parsed namespace data, or undefined when the suite declares
+ *   none; diagnostics land in `notes`.
+ */
+function parseHarnessExtension(extensions, notes) {
+    if (!isRecord(extensions) || extensions[EXTENSION_NAMESPACE] === undefined)
+        return undefined;
+    return parseHarnessNamespace(extensions[EXTENSION_NAMESPACE], notes);
+}
+/** Validate one namespace value against the namespace contract; diagnostics go to `notes`. */
+function parseHarnessNamespace(value, notes) {
+    if (!isRecord(value)) {
+        notes.push(`extensions.${EXTENSION_NAMESPACE}: value must be an object; ignored`);
+        return undefined;
+    }
+    const schemaVersion = value['schemaVersion'];
+    if (typeof schemaVersion !== 'string' || !NAMESPACE_SCHEMA_VERSIONS.has(schemaVersion)) {
+        notes.push(`extensions.${EXTENSION_NAMESPACE}: unsupported or missing schemaVersion ${JSON.stringify(schemaVersion)}; supported: ${[...NAMESPACE_SCHEMA_VERSIONS].join(', ')}; namespace extensions are ignored`);
+        return undefined;
+    }
+    const policies = Object.create(null);
+    const rawPolicies = value['mcpServers'];
+    if (rawPolicies !== undefined) {
+        if (!isRecord(rawPolicies)) {
+            notes.push(`extensions.${EXTENSION_NAMESPACE}.mcpServers: value must be an object; ignored`);
+            return { schemaVersion, mcpServers: policies };
+        }
+        for (const [name, policy] of Object.entries(rawPolicies)) {
+            if (!isRecord(policy)) {
+                notes.push(`extensions.${EXTENSION_NAMESPACE}.mcpServers.${name}: policy must be an object; ignored`);
+                continue;
+            }
+            const auth = policy['auth'];
+            if (auth !== undefined &&
+                (!isRecord(auth) || (auth['enabled'] !== undefined && typeof auth['enabled'] !== 'boolean') || (auth['scope'] !== undefined && typeof auth['scope'] !== 'string'))) {
+                notes.push(`extensions.${EXTENSION_NAMESPACE}.mcpServers.${name}.auth: invalid auth declaration; ignored`);
+                continue;
+            }
+            const enabledTools = optionalStringArray(policy['enabledTools'], `extensions.${EXTENSION_NAMESPACE}.mcpServers.${name}.enabledTools`, notes);
+            const disabledTools = optionalStringArray(policy['disabledTools'], `extensions.${EXTENSION_NAMESPACE}.mcpServers.${name}.disabledTools`, notes);
+            const startupTimeoutMs = optionalPositiveNumber(policy['startupTimeoutMs'], `extensions.${EXTENSION_NAMESPACE}.mcpServers.${name}.startupTimeoutMs`, notes);
+            const toolCallTimeoutMs = optionalPositiveNumber(policy['toolCallTimeoutMs'], `extensions.${EXTENSION_NAMESPACE}.mcpServers.${name}.toolCallTimeoutMs`, notes);
+            policies[name] = {
+                ...(enabledTools === undefined ? {} : { enabledTools }),
+                ...(disabledTools === undefined ? {} : { disabledTools }),
+                ...(startupTimeoutMs === undefined ? {} : { startupTimeoutMs }),
+                ...(toolCallTimeoutMs === undefined ? {} : { toolCallTimeoutMs }),
+                ...(auth === undefined || !isRecord(auth) ? {} : { auth: { enabled: auth['enabled'] !== false, ...(typeof auth['scope'] === 'string' ? { scope: auth['scope'] } : {}) } })
+            };
+        }
+    }
+    return { schemaVersion, mcpServers: policies };
+}
+function optionalStringArray(value, label, notes) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || !value.every(entry => typeof entry === 'string')) {
+        notes.push(`${label}: must be an array of strings; ignored`);
+        return undefined;
+    }
+    return value;
+}
+function optionalPositiveNumber(value, label, notes) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) {
+        notes.push(`${label}: must be a positive number; ignored`);
+        return undefined;
+    }
+    return value;
+}
 function pickString(value) {
     return typeof value === 'string' && value !== '' ? value : undefined;
 }