dsh-agent-plugins-market 0.7.1 → 0.7.2

package/lib/runtime/agent-role-router.js

@@ -3,10 +3,9 @@ import { readFile } from 'node:fs/promises';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { parse as parseYaml } from 'yaml';
 import { mountSubagentCatalog } from './subagent-catalog.js';
-import { bindHostLocale } from './host-locale.js';
 import { namedAgentRoles } from './agent-role-names.js';
 import { expandPluginPaths } from '../catalog/plugin-variables.js';
-export const AGENT_ROLE_TOOL_NAME = 'subagent_run';
+export const AGENT_ROLE_TOOL_NAME = 'subagent_role';
 /**
  * Absolute delegation-depth cap applied to every role child. The host default is
  * the same value; keeping it explicit preserves the shipped recursion budget.
@@ -63,13 +62,17 @@ function parentRouteOf(parent) {
     return agent?.session?.requestHeader?.()?.config ?? agent?.options ?? {};
 }
 /**
- * Resolve the child LLM options one card may contribute.
+ * Resolve the child LLM options for one role call.
  *
- * A card route is advisory. Only an exact `provider` plus `model` pair is
- * applied, and only when the live LLM runtime accepts it; every other
- * declaration — a bare id, a Claude alias, a lone `provider`, an unsupported
- * effort — degrades to inheriting the parent route and reports a diagnostic.
- * @param policy - the card's parsed routing metadata.
+ * The call's own `provider` + `model` pair wins, and the role card supplies the
+ * default when the call names neither. Only an exact pair is applied, and only
+ * when the live LLM runtime accepts it; a bare id, a Claude alias, a lone
+ * `provider` or an unsupported effort degrades to inheriting the parent route
+ * and reports a diagnostic. An explicit route with no explicit effort uses the
+ * selected model's default, so a card's effort never leaks onto a route it was
+ * not written for.
+ * @param policy - the card's parsed routing metadata, used as the default route.
+ * @param requested - the route the call itself asked for.
  * @param parent - the calling Agent whose route an unusable declaration falls back to.
  * @param llm - live LLM runtime owning provider, model and effort validation.
  * @param signal - tool-call cancellation signal.
@@ -77,27 +80,34 @@ function parentRouteOf(parent) {
  * @param diagnose - diagnostic sink; degradation is reported, never silent.
  * @returns the options to send, or undefined for pure inheritance.
  */
-export async function resolveAgentOptions(policy, parent, llm, signal, subject, diagnose) {
-    // One value, so a half-specified route can never be forwarded downstream.
-    const requested = policy.provider === undefined || policy.model === undefined ? undefined : { provider: policy.provider, model: policy.model };
-    if (requested === undefined && (policy.provider !== undefined || policy.model !== undefined)) {
+export async function resolveAgentOptions(policy, requested, parent, llm, signal, subject, diagnose) {
+    const cardRoute = policy.provider !== undefined && policy.model !== undefined ? { provider: policy.provider, model: policy.model } : undefined;
+    if (cardRoute === undefined && (policy.provider !== undefined || policy.model !== undefined)) {
         const declared = [policy.provider, policy.model].filter(value => value !== undefined).join('/');
         diagnose(`agent "${subject}": route "${declared}" needs an exact provider and model pair; it is ignored and the child inherits the parent route`);
     }
-    const effort = policy.reasoningEffort;
-    if (effort === undefined && requested === undefined)
+    const callRoute = requested.provider !== undefined && requested.model !== undefined ? { provider: requested.provider, model: requested.model } : undefined;
+    if (callRoute === undefined && (requested.provider !== undefined || requested.model !== undefined)) {
+        const declared = [requested.provider, requested.model].filter(value => value !== undefined).join('/');
+        diagnose(`agent "${subject}": the call's route "${declared}" needs an exact provider and model pair; it is ignored`);
+    }
+    // One value, so a half-specified route can never be forwarded downstream.
+    const route = callRoute ?? cardRoute;
+    const routeEffort = callRoute === undefined ? policy.reasoningEffort : undefined;
+    const effort = requested.reasoningEffort ?? routeEffort;
+    if (effort === undefined && route === undefined)
         return undefined;
     const inherited = parentRouteOf(parent);
-    const provider = requested?.provider ?? inherited.provider;
-    const model = requested?.model ?? inherited.model;
+    const provider = route?.provider ?? inherited.provider;
+    const model = route?.model ?? inherited.model;
     if (provider === undefined || model === undefined) {
         /* v8 ignore next 3 -- an effective route is always known once a parent Agent ran a request. */
         if (effort !== undefined)
             diagnose(`agent "${subject}": reasoning effort "${effort}" has no effective route to validate against; it is ignored`);
         return undefined;
     }
-    const routeChanged = provider !== inherited.provider || model !== inherited.model;
-    const effectiveEffort = effort ?? (routeChanged ? undefined : inherited.reasoningEffort);
+    // An explicit route choice starts from the selected model's default effort.
+    const effectiveEffort = effort ?? (route === undefined ? inherited.reasoningEffort : undefined);
     try {
         await llm.resolveCallConfig({ provider, model, ...(effectiveEffort === undefined ? {} : { reasoningEffort: effectiveEffort }) }, signal);
     }
@@ -109,7 +119,7 @@ export async function resolveAgentOptions(policy, parent, llm, signal, subject,
     // Cancellation raised during the adapter lookup must not create a child.
     signal.throwIfAborted();
     return {
-        ...(requested ?? {}),
+        ...(route ?? {}),
         ...(effort === undefined ? {} : { reasoningEffort: effort })
     };
 }
@@ -187,15 +197,16 @@ function sessionCwd(agent) {
     return typeof cwd === 'string' && cwd !== '' ? cwd : undefined;
 }
 /**
- * Start one role child and return its durable id without waiting for the result.
- * Resume state, steering, and the settlement notice belong to the host's
- * continuation manager; this executor owns only role resolution.
+ * Run one role child through the requested channel.
+ * @param host - the exact live seams this executor owns: tools, llm and subagents.
+ * @param mode - which channel the call asked for.
+ * @param jobs - the host jobs registry; only the `background` channel needs it.
  */
-export async function executeAgentRole(host, listRoles, agentName, prompt, parent, signal, diagnose = () => { }) {
+export async function executeAgentRole(host, listRoles, agentName, prompt, parent, requestedRoute, mode, signal, diagnose = () => { }, jobs) {
     if (parent === undefined)
-        throw new Error('subagent_run requires a calling agent');
+        throw new Error(`${AGENT_ROLE_TOOL_NAME} requires a calling agent`);
     if (prompt.trim() === '')
-        throw new Error('subagent_run requires a non-empty prompt');
+        throw new Error(`${AGENT_ROLE_TOOL_NAME} requires a non-empty prompt`);
     signal.throwIfAborted();
     const [entry, ...duplicates] = namedAgentRoles(await listRoles(parent)).filter(candidate => candidate.callName === agentName);
     if (entry === undefined || duplicates.length > 0)
@@ -205,51 +216,165 @@ export async function executeAgentRole(host, listRoles, agentName, prompt, paren
     const policy = await readAgentRole(entry, sessionCwd(parent));
     if (policy.disabled)
         throw new Error(`agent "${agentName}" is disabled`);
-    const agentOptions = await resolveAgentOptions(policy, parent, host.llm, signal, agentName, diagnose);
+    const agentOptions = await resolveAgentOptions(policy, requestedRoute, parent, host.llm, signal, agentName, diagnose);
     signal.throwIfAborted();
-    const started = await host.subagents.startContinuable({
-        provider: 'spawn',
-        label: agentName,
-        request: {
-            prompt: [{ type: 'text', text: prompt }],
-            parent,
-            maxDepth: MAX_AGENT_ROLE_DEPTH,
-            persona: policy.content,
-            ...(agentOptions === undefined ? {} : { agentOptions })
-        },
-        signal
-    });
-    return { subagentId: started.childId };
+    const request = {
+        prompt: [{ type: 'text', text: prompt }],
+        parent,
+        maxDepth: MAX_AGENT_ROLE_DEPTH,
+        persona: policy.content,
+        ...(agentOptions === undefined ? {} : { agentOptions })
+    };
+    if (mode === 'continuable') {
+        const started = await host.subagents.startContinuable({ provider: 'spawn', label: agentName, request, signal });
+        return { kind: 'continuable', subagentId: started.childId };
+    }
+    if (mode === 'background') {
+        if (jobs === undefined) {
+            throw new Error(`background role jobs unavailable: load @deepseek-ai/dsh-jobs and @deepseek-ai/dsh-tool-jobs, or call ${AGENT_ROLE_TOOL_NAME} with run_in_background false`);
+        }
+        // The run's own controller outlives `jobs.start`, which returns at
+        // registration: cancellation and disposal both go through the job's hooks.
+        return {
+            kind: 'background',
+            jobId: jobs.start({
+                kind: 'subagent',
+                label: agentName,
+                owner: parent,
+                run: () => {
+                    const controller = new AbortController();
+                    return {
+                        cancel: (reason) => controller.abort(reason ?? 'background role job killed'),
+                        done: (async () => {
+                            const run = await host.subagents.start('spawn', { ...request, signal: controller.signal });
+                            try {
+                                const result = await run.result;
+                                return result.stopReason === 'completed' ? { status: 'completed' } : { status: 'failed', detail: result.diagnostic ?? result.stopReason };
+                            }
+                            finally {
+                                await run.dispose();
+                            }
+                        })()
+                    };
+                }
+            })
+        };
+    }
+    const run = await host.subagents.start('spawn', { ...request, signal });
+    try {
+        const result = await run.result;
+        if (result.stopReason !== 'completed') {
+            const detail = result.diagnostic === undefined ? '' : `: ${result.diagnostic}`;
+            throw new Error(`agent "${agentName}" did not complete (${result.stopReason})${detail}`);
+        }
+        // The registry performs the authoritative lossless snapshot of the child's
+        // output blocks on the way out, exactly as the host's own delegation tool does.
+        return { kind: 'foreground', runId: run.id, output: result.output };
+    }
+    finally {
+        await run.dispose();
+    }
 }
-/** Mount once after tools, llm and subagents are available; the returned disposer belongs to the plugin lifecycle. */
-export function mountAgentRoleTool(ctx, listRoles, t = bindHostLocale(undefined)) {
+/**
+ * Mount once after tools, llm and subagents are available; the returned disposer belongs to the plugin lifecycle.
+ *
+ * The delegation contract lives here rather than in the injected catalog: a tool
+ * description is present in every request, while the catalog message is
+ * re-published whenever roles change, so guidance kept out of the catalog is
+ * sent once and stays readable through compaction.
+ */
+export function mountAgentRoleTool(ctx, listRoles) {
     const host = ctx;
     const tool = defineTool({
         name: AGENT_ROLE_TOOL_NAME,
-        description: 'Delegate a self-contained task to a role from the current subagent catalog. The child starts without the parent conversation and runs ' +
-            'in the background: this returns a durable subagent id immediately. When the run settles the runtime sends you a notice carrying its ' +
-            "outcome and closing message, and send_message steers the child while it runs. The role's saved persona and model settings are applied automatically.",
+        description: "Delegate a task to a role child defined by an installed plugin: the named role's own instructions and its configured model apply, and the child starts without this conversation. This tool runs in " +
+            'the background by default, immediately returns a durable subagent id, and keeps the child available for later turns; when that run settles, the runtime sends the parent a notice carrying its outcome ' +
+            'and final reply. Set `run_in_background: false` only when your next action depends on receiving the result. A child usually runs for minutes, so while it works on the background path, continue with ' +
+            'independent work instead of waiting. `prompt` must stand alone, since the child cannot see this conversation and a question it asks while it runs goes unanswered. When the notice arrives, verify its ' +
+            "assertions against the files and relay the result to the user; the child's output is not visible to them. The current catalog lists the available roles and states the usage guidance; when no listed " +
+            "role matches, use the host's own `subagent` tools instead.",
         parameters: {
             agent: { type: 'string', required: true, description: 'Exact callable role name from the current subagent catalog.' },
-            prompt: { type: 'string', required: true, description: 'Complete task and context for the isolated child.' }
+            prompt: {
+                type: 'string',
+                required: true,
+                description: "The complete, self-contained task for the role child. It does not share this conversation's context, so include everything it needs: what the task is and why, the relevant files and known findings, the output you expect, and the boundaries of the task."
+            },
+            provider: {
+                type: 'string',
+                description: "LLM provider route for the child. Supply together with model to override the route the role card declares; omit both to use the card's route or inherit the parent route."
+            },
+            model: {
+                type: 'string',
+                description: "Model id interpreted by provider. Supply together with provider to override the route the role card declares; omit both to use the card's route or inherit the parent route."
+            },
+            reasoning_effort: {
+                type: 'string',
+                description: "Adapter-owned reasoning effort for the effective child route. Omit to use the card's effort on the card's route, or the selected model's default after an explicit route change."
+            },
+            run_in_background: {
+                type: 'boolean',
+                description: "Which channel runs the child. Omit for the default: a continuable child whose durable subagent id comes back at once, with steering and a settlement notice. Set true for a tracked background job that returns a job id collected with `job_output` and stopped with `job_kill`. Set false for one foreground child whose report comes back as this call's result."
+            }
         },
         output: {
             schema: {
-                type: 'object',
-                additionalProperties: false,
-                properties: { subagentId: { type: 'string', required: true } }
+                oneOf: [
+                    {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: {
+                            kind: { type: 'string', required: true, const: 'continuable' },
+                            subagentId: { type: 'string', required: true }
+                        }
+                    },
+                    {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: {
+                            kind: { type: 'string', required: true, const: 'background' },
+                            jobId: { type: 'string', required: true }
+                        }
+                    },
+                    {
+                        type: 'object',
+                        additionalProperties: false,
+                        properties: {
+                            kind: { type: 'string', required: true, const: 'foreground' },
+                            runId: { type: 'string', required: true },
+                            output: { type: 'array', required: true, items: { type: 'json' } }
+                        }
+                    }
+                ]
             },
-            render: (_args, value) => [{ type: 'text', text: `started subagent ${value.subagentId}` }]
+            render: (_args, value) => [
+                {
+                    type: 'text',
+                    text: value.kind === 'continuable'
+                        ? `started subagent ${value.subagentId}`
+                        : value.kind === 'background'
+                            ? `started background subagent job ${value.jobId}`
+                            : `subagent ${value.runId} finished`
+                }
+            ]
         },
         isConcurrencySafe: () => true,
         async execute(args, exec) {
-            return executeAgentRole(host, listRoles, args.agent, args.prompt, exec.agent, exec.signal, message => ctx.logger?.warn(message));
+            // The parameter keeps the host tool's name and boolean shape while this
+            // tool owns three channels: omitting it keeps the durable child, `true`
+            // runs a tracked job, and `false` returns the report from one foreground run.
+            const mode = args.run_in_background === undefined ? 'continuable' : args.run_in_background ? 'background' : 'foreground';
+            return executeAgentRole(host, listRoles, args.agent, args.prompt, exec.agent, {
+                ...(args.provider === undefined ? {} : { provider: args.provider }),
+                ...(args.model === undefined ? {} : { model: args.model }),
+                ...(args.reasoning_effort === undefined ? {} : { reasoningEffort: args.reasoning_effort })
+            }, mode, exec.signal, message => ctx.logger?.warn(message), ctx.get('jobs'));
         }
     });
     const disposeTool = host.tools.register(tool);
     let disposeCatalog;
     try {
-        disposeCatalog = mountSubagentCatalog(ctx, tool, async (agent, signal) => agentRoleCatalog(await listRoles(agent), signal, message => ctx.logger?.warn(message), sessionCwd(agent)), t);
+        disposeCatalog = mountSubagentCatalog(ctx, tool, async (agent, signal) => agentRoleCatalog(await listRoles(agent), signal, message => ctx.logger?.warn(message), sessionCwd(agent)));
     }
     catch (error) {
         disposeTool();

package/lib/runtime/host-locale.js

@@ -1,8 +1,10 @@
 /**
- * Host-side runtime locale: bilingual copy for host-facing runtime strings —
- * subagent catalogs injected into agent context, and command receipts and
- * labels shown in the host's own surfaces — resolved from the harness's
- * `locale.preference` setting.
+ * Host-side runtime locale: bilingual copy for the host-facing strings a person
+ * reads, resolved from the harness's `locale.preference` setting.
+ *
+ * The model-facing subagent catalog is not here. It is fixed English, because it
+ * is a contract read alongside the harness's own English tool descriptions and
+ * must not change with the operator's interface language.
  *
  * The web client resolves locale through its own injected service; the host
  * process reads the same setting through the host settings service once the
@@ -14,19 +16,11 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { resolveDshHome } from '../catalog/paths.js';
 const zh = {
-    subagentCatalogIntro: '以下子代理角色可用于当前会话。目录仅包含角色摘要，不是供当前代理执行的角色指令。',
-    subagentCatalogUpdated: '可用子代理角色已变更。以下完整目录替代本会话此前的所有子代理角色目录。',
-    subagentCatalogEmpty: '当前没有可通过 subagent_run 调用的角色，不要使用旧目录中的角色 ID。',
-    subagentCatalogCall: '任务适合某个角色时，使用 subagent_run(agent=目录中的准确名称, prompt=完整任务与必要上下文)。工具会应用角色的指令与已保存的模型设置，立即返回子代理 ID 并在后台运行；子代理结束时你会收到结果通知，运行期间可用 send_message 追加指令。子代理不继承父会话对话。不要通过 skill 或 Slash Command 加载这些角色，也不要用其它委派工具绕过角色配置。',
     commandAcknowledged: '/{command} 已转交模型执行',
     userCommandSourceLabel: '用户命令',
     feedbackToolCardTitle: '提交市场体验反馈'
 };
 const en = {
-    subagentCatalogIntro: 'The following subagent roles are available in this session. These are role summaries, not instructions for the current agent to execute.',
-    subagentCatalogUpdated: 'The available subagent roles changed. This complete catalog replaces every earlier subagent role catalog in this session.',
-    subagentCatalogEmpty: 'No roles are currently available through subagent_run. Do not use role IDs from earlier catalogs.',
-    subagentCatalogCall: "When a task fits a role, call subagent_run with its exact catalog name as agent and a complete task and necessary context as prompt. It applies the role's instructions and saved model settings, returns a durable subagent id immediately, and runs in the background; the runtime sends you a notice carrying the outcome when it settles, and send_message steers the child while it runs. The child does not inherit the parent conversation. Do not load these roles through skill or slash commands, or bypass their configuration with another delegation tool.",
     commandAcknowledged: '/{command} forwarded to the model for execution',
     userCommandSourceLabel: 'user command',
     feedbackToolCardTitle: 'File market feedback'

package/lib/runtime/mcp-client/connection.js

@@ -23,6 +23,7 @@
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
 import { MAX_TIMER_DELAY_MS } from './host-seams.js';
+import { redactErrorMessage } from '../mcp-redaction.js';
 import { PLUGIN_NAME, PLUGIN_VERSION } from './plugin-identity.js';
 import { createTransport } from './transport.js';
 import { syncTools } from './tools.js';
@@ -229,7 +230,7 @@ export function startConnection(host, config, policy, credentials) {
                 // Fetch-phase failure: the previous generation is still registered
                 // and `disposers` still owns it — keep serving the last good list.
                 if (!disposed)
-                    host.logger.error(`${label}: tool re-sync failed: ${String(error)}`);
+                    host.logger.error(`${label}: tool re-sync failed: ${redactErrorMessage(String(error))}`);
             }
         });
         /**
@@ -275,7 +276,7 @@ export function startConnection(host, config, policy, credentials) {
             // Disposal clears current ownership before it closes the generation, so
             // only a live supervisor reports an attempt failure.
             if (isCurrent(generation))
-                host.logger.warn(`${label}: connection attempt failed: ${String(error)}`);
+                host.logger.warn(`${label}: connection attempt failed: ${redactErrorMessage(String(error))}`);
             // A pending browser leg outlives the initialize timeout: the human is
             // mid-approval. Hold this generation open — transport and loopback
             // listener stay alive — until the leg settles; abandoning it would

package/lib/runtime/mcp-client/oauth.js

@@ -28,7 +28,10 @@
  * @module runtime/mcp-client/oauth
  */
 import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
 import { credentialKey, scrubbedParentEnv } from './host-seams.js';
+import { redactErrorMessage, redactUrl } from '../mcp-redaction.js';
 import { PLUGIN_NAME, PLUGIN_VERSION } from './plugin-identity.js';
 /** OAuth client identity presented during dynamic registration. */
 const CLIENT_NAME = `DeepSeek Harness (${PLUGIN_NAME})`;
@@ -65,6 +68,18 @@ function asMcpAuthRecord(record) {
         ...(payload.tokens === undefined ? {} : { tokens: payload.tokens })
     };
 }
+/**
+ * Merge one locally changed durable field without overwriting a concurrent
+ * process's update. If the value read before the mutation no longer matches
+ * the store's locked current value, the current value wins conservatively.
+ */
+function mergeDurableField(base, desired, current) {
+    if (isDeepStrictEqual(base, desired))
+        return current;
+    if (isDeepStrictEqual(base, current))
+        return desired;
+    return current;
+}
 /**
  * Error thrown when the human leg fails or is abandoned: the browser never
  * returned, the callback carried an OAuth error, or no browser could open.
@@ -89,7 +104,7 @@ export const platformBrowserOpener = async (authorizationUrl, serverName, log) =
         detached: platform !== 'win32'
     });
     child.once('error', error => {
-        log(`${serverName}: could not open a browser automatically (${String(error)}); open this URL manually: ${authorizationUrl.toString()}`);
+        log(`${serverName}: could not open a browser automatically (${redactErrorMessage(String(error))}); open this URL manually: ${redactUrl(authorizationUrl.toString())}`);
     });
     child.once('spawn', () => {
         child.unref();
@@ -113,6 +128,8 @@ export class LoopbackOAuthClientProvider {
     providerState = {};
     /** The transport generation whose `finishAuth` completes the browser leg. */
     activeTransport;
+    /** One process-local OAuth state value for the current browser leg. */
+    expectedState;
     /** Resolves `true` when the leg saved tokens, `false` when it failed; undefined while no leg is open. */
     browserLegSettled;
     callbackServer;
@@ -148,6 +165,12 @@ export class LoopbackOAuthClientProvider {
             software_version: PLUGIN_VERSION
         };
     }
+    /** Issue one unpredictable state value for the SDK's authorization request. */
+    state() {
+        const state = randomBytes(32).toString('base64url');
+        this.expectedState = state;
+        return state;
+    }
     async clientInformation() {
         return (await this.load()).clientInformation;
     }
@@ -177,6 +200,11 @@ export class LoopbackOAuthClientProvider {
         if (transport === undefined) {
             throw new AuthorizationAbortedError(`${this.serverName}: no active transport to complete authorization into`);
         }
+        // The SDK normally calls state() before this hook. Keep a defensive path
+        // for direct callers too, and overwrite any caller-supplied value with the
+        // state issued by this provider.
+        const state = this.expectedState ?? this.state();
+        authorizationUrl.searchParams.set('state', state);
         this.browserLegSettled = Promise.withResolvers();
         let succeeded = false;
         try {
@@ -222,6 +250,7 @@ export class LoopbackOAuthClientProvider {
         this.callbackServer?.close(() => undefined);
         this.callbackServer = undefined;
         this.boundPort = undefined;
+        this.expectedState = undefined;
     }
     saveCodeVerifier(codeVerifier) {
         // The verifier only needs to survive the browser leg; keeping it out of
@@ -287,17 +316,41 @@ export class LoopbackOAuthClientProvider {
     async mutate(mutator) {
         const run = this.writeChain.then(async () => {
             await this.load();
+            const base = {
+                clientInformation: this.providerState.clientInformation,
+                tokens: this.providerState.tokens
+            };
             mutator(this.providerState);
             if (this.store === undefined)
                 return;
-            const record = {
-                kind: 'grant',
-                payload: {
-                    ...(this.providerState.clientInformation === undefined ? {} : { clientInformation: this.providerState.clientInformation }),
-                    ...(this.providerState.tokens === undefined ? {} : { tokens: this.providerState.tokens })
-                }
+            const desired = {
+                clientInformation: this.providerState.clientInformation,
+                tokens: this.providerState.tokens
+            };
+            const saved = await this.store.modifyRecord(this.recordKey, async (current) => {
+                const currentPayload = asMcpAuthRecord(current);
+                // Never replace a record owned by another credential provider just
+                // because this process raced it; the next read will observe it as
+                // absent and the caller can decide what to do.
+                if (current !== undefined && currentPayload === undefined)
+                    return current;
+                const payload = currentPayload ?? {};
+                const clientInformation = mergeDurableField(base.clientInformation, desired.clientInformation, payload.clientInformation);
+                const tokens = mergeDurableField(base.tokens, desired.tokens, payload.tokens);
+                const merged = {
+                    kind: 'grant',
+                    payload: {
+                        ...(clientInformation === undefined ? {} : { clientInformation }),
+                        ...(tokens === undefined ? {} : { tokens })
+                    }
+                };
+                return merged;
+            });
+            const savedPayload = asMcpAuthRecord(saved);
+            this.providerState = {
+                ...(savedPayload ?? {}),
+                ...(this.providerState.codeVerifier === undefined ? {} : { codeVerifier: this.providerState.codeVerifier })
             };
-            await this.store.modifyRecord(this.recordKey, () => Promise.resolve(record));
         });
         // A failed write must not poison the chain; the caller's rejection is the
         // signal, and the next write re-reads whatever is durable now.
@@ -317,7 +370,7 @@ export class LoopbackOAuthClientProvider {
             });
             server.on('error', error => {
                 this.clearCallbackTimer();
-                reject(new AuthorizationAbortedError(`${this.serverName}: loopback callback server failed: ${String(error)}`));
+                reject(new AuthorizationAbortedError(`${this.serverName}: loopback callback server failed: ${redactErrorMessage(String(error))}`));
             });
             server.listen(this.storage.callbackPort ?? 0, '127.0.0.1', () => {
                 const address = server.address();
@@ -343,19 +396,34 @@ export class LoopbackOAuthClientProvider {
         const url = new URL(request.url ?? '/', 'http://127.0.0.1');
         const oauthError = url.searchParams.get('error');
         const code = url.searchParams.get('code');
-        const respond = (status, message) => {
+        const respond = (status, message, closeServer = true) => {
             // Drain the request, then answer with a plain page the user can close.
             request.resume();
             request.socket.end(`HTTP/1.1 ${status} ${status === 200 ? 'OK' : 'Bad Request'}\r\n` + 'content-type: text/plain; charset=utf-8\r\nconnection: close\r\n\r\n' + `${message}\n`);
-            request.on('close', () => {
-                server.close(() => undefined);
-            });
+            if (closeServer) {
+                request.on('close', () => {
+                    server.close(() => undefined);
+                });
+            }
         };
+        // Keep the listener alive for malformed or forged callbacks so the real
+        // browser redirect can still complete the same authorization leg.
+        if (url.pathname !== '/callback') {
+            respond(404, 'Not an OAuth callback endpoint.', false);
+            return;
+        }
+        const expectedState = this.expectedState;
+        const callbackState = url.searchParams.get('state');
+        if (expectedState === undefined || callbackState !== expectedState) {
+            respond(400, 'Authorization callback carried an invalid state.', false);
+            return;
+        }
         this.clearCallbackTimer();
         this.callbackServer = undefined;
         this.boundPort = undefined;
+        this.expectedState = undefined;
         if (oauthError !== null) {
-            const description = url.searchParams.get('error_description') ?? '';
+            const description = redactErrorMessage(url.searchParams.get('error_description') ?? '');
             respond(400, `Authorization failed: ${oauthError}${description === '' ? '' : ` — ${description}`}`);
             reject(new AuthorizationAbortedError(`${this.serverName}: the authorization server returned "${oauthError}"${description === '' ? '' : ` (${description})`}`));
             return;

package/lib/runtime/mcp-client/tools.js

@@ -21,6 +21,7 @@ import { ListToolsResultSchema } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';
 import { assertSupportedJsonSchema } from './json-schema-subset.js';
 import { containsImage, extractText, prepareImageProjection } from './projection.js';
+import { redactErrorMessage } from '../mcp-redaction.js';
 /**
  * DeepSeek function-name contract: at most 64 characters. Wire-protocol
  * constant, not configuration.
@@ -122,7 +123,7 @@ export async function syncTools(client, host, opts, previous) {
         // sees either the full generation or none of it — never a partial set.
         for (const dispose of disposers.values())
             dispose();
-        host.logger.error(`mcp-client(${opts.serverName}): tool registration failed, no tools registered: ${String(error)}`);
+        host.logger.error(`mcp-client(${opts.serverName}): tool registration failed, no tools registered: ${redactErrorMessage(String(error))}`);
         if (opts.registrationFailure === 'throw')
             throw error;
         return new Map();