dsh-agent-plugins-market 0.7.1 → 0.7.2

package/lib/runtime/mcp-config.js

@@ -4,14 +4,23 @@
  * The portable format is translated, not executed directly: stdio commands
  * resolve against the suite root (spec §7.2.1), `${PLUGIN_ROOT}` /
  * `${PLUGIN_DATA}` expand against the suite root and its data directory, and
- * every `${NAME}` — including ones inside a streamable-http `url` — expands
- * through the optional DSH credentials seam at mount time. Legacy HTTP+SSE
- * servers are supported by the market's own bridge (the host client had no
- * such transport); unrecognized shapes are still skipped with a per-server
- * reason.
+ * the child environment carries both variables (§9.1) with the data directory
+ * created before launch. Legacy HTTP+SSE servers are supported by the
+ * market's own bridge (the host client had no such transport); unrecognized
+ * shapes are still skipped with a per-server reason.
+ *
+ * Placeholder discipline follows the package's origin. A suite mounted from
+ * the portable v1 format (`portable: true`) is package data: §9.2 forbids any
+ * expansion beyond the two built-in variables, and per-server client policy
+ * (OAuth, tool lists, timeouts) comes from the `com.deepseek.harness`
+ * namespace instead of the `mcp.json` body. Dialect-native files and
+ * user-owned config keep the credential seam: every `${NAME}` — including
+ * ones inside a streamable-http `url` — expands through the optional DSH
+ * credentials resolver at mount time, and missing references fail closed per
+ * server instead of becoming empty strings.
  */
 import { createHash } from 'node:crypto';
-import { DEFAULT_TOOL_CALL_TIMEOUT_MS } from './mcp-client/config.js';
+import { DEFAULT_STARTUP_TIMEOUT_MS, DEFAULT_TOOL_CALL_TIMEOUT_MS } from './mcp-client/config.js';
 import { resolveCwd } from '../catalog/validate.js';
 import { qualifiedSuiteId, suiteDataDir } from '../catalog/paths.js';
 import { applyOverride } from './mcp-overrides.js';
@@ -21,26 +30,10 @@ const SERVER_NAME_MAX = 32;
 const PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
 const BUILTIN_PLACEHOLDERS = new Set([...PLUGIN_ROOT_VARIABLES, ...PLUGIN_DATA_VARIABLES]);
 /**
- * The effective view of one suite's `mcp.json` servers: the user's per-server
- * overrides applied, every row flagged with whether it is used at all, and each
- * row's credential references read off the effective shape. Mounting, status
- * and detail rendering read this one projection, so a server cannot be listed
- * as enabled while mounting something else.
- */
-export function effectiveMcpServers(suite, overrides = {}) {
-    const rows = [];
-    for (const [serverKey, source] of Object.entries(suite.mcp?.servers ?? {})) {
-        const override = overrides[serverKey];
-        const server = applyOverride(source, override);
-        rows.push({ serverKey, server, override, enabled: override?.enabled !== false, credentialRefs: credentialRefsInServer(server) });
-    }
-    return rows;
-}
-/**
- * Build one mount request per supported mcp.json server, resolving every
- * `${NAME}` through the credential resolver before a child process or HTTP
- * request is created. Missing references fail closed per server instead of
- * becoming empty strings.
+ * Build one mount request per supported mcp.json server, expanding built-in
+ * variables (and, for user-owned data, `${NAME}` credential references)
+ * before a child process or HTTP request is created. Missing references fail
+ * closed per server instead of becoming empty strings.
  *
  * @param overrides user-owned per-server overrides (url/headers/env/args
  *   replacement plus enable/disable); applied before mount. Disabled servers
@@ -74,6 +67,141 @@ export async function toMcpMounts(suite, pluginDataRoot, overrides = {}, resolve
     }
     return { mounts, failures, credentialRefs: [...credentialRefs] };
 }
+/**
+ * Whether a suite's MCP declarations are package data under the portable
+ * format. Installed v1 suites are; the user's own `~/.agents/mcp.json`,
+ * project-native config, and every dialect-native file are user-owned data
+ * where `${NAME}` credential references stay resolvable.
+ */
+export function isPortableMcp(suite) {
+    return suite.dimension !== 'user' && suite.manifest.layout === 'agent-plugin-v1';
+}
+/**
+ * The `com.deepseek.harness` policy declared for one portable server.
+ * Server keys in the namespace match the server's own name in `mcp.json`;
+ * `serverKey` is that name at discovery time.
+ */
+export function namespaceMcpPolicy(suite, serverKey) {
+    return suite.manifest.harness?.mcpServers?.[serverKey];
+}
+/**
+ * The effective view of one suite's `mcp.json` servers: the user's per-server
+ * overrides applied, every row flagged with whether it is used at all, and each
+ * row's credential references read off the effective shape. Mounting, status
+ * and detail rendering read this one projection, so a server cannot be listed
+ * as enabled while mounting something else.
+ *
+ * Portable v1 suites (`isPortableMcp`) carry package data: their credential
+ * reference list is empty by definition (§9.2 leaves unrecognized
+ * placeholder-like text literal), and client policy comes from the
+ * `com.deepseek.harness` namespace instead. Overrides applied by the user are
+ * user-owned data, so a reference a user typed into an override still
+ * resolves.
+ */
+export function effectiveMcpServers(suite, overrides = {}) {
+    const rows = [];
+    const portable = isPortableMcp(suite);
+    for (const [serverKey, source] of Object.entries(suite.mcp?.servers ?? {})) {
+        const override = overrides[serverKey];
+        const declared = namespaceMcpPolicy(suite, serverKey);
+        const policy = resolveMcpPolicy(declaredMcpPolicy(source, declared), override);
+        const connection = applyNamespaceAuth(applyOverride(source, override), declared);
+        const effective = applyMcpPolicy(connection, policy);
+        const credentialRefs = portable ? credentialRefsInServer(overrideValues(override)) : credentialRefsInServer(effective);
+        rows.push({ serverKey, server: effective, override, enabled: override?.enabled !== false, credentialRefs, policy });
+    }
+    return rows;
+}
+/** Credential references a user typed into their own override values. */
+function overrideValues(override) {
+    if (override === undefined)
+        return { type: 'stdio', command: '' };
+    return {
+        type: 'stdio',
+        command: '',
+        ...(override.args !== undefined ? { args: override.args } : {}),
+        ...(override.env !== undefined ? { env: override.env } : {}),
+        ...(override.headers !== undefined ? { headers: override.headers } : {}),
+        ...(override.url !== undefined ? { url: override.url, type: 'streamable-http' } : {})
+    };
+}
+/**
+ * The suite's declared per-server policy. The `com.deepseek.harness`
+ * namespace seat carries the policy a portable `mcp.json` has no room for and
+ * wins over an inline declaration; dialect-native files declare it inline.
+ */
+export function declaredMcpPolicy(server, policy) {
+    const enabledTools = policy?.enabledTools ?? server.enabledTools;
+    const disabledTools = policy?.disabledTools ?? server.disabledTools;
+    const startupTimeoutMs = policy?.startupTimeoutMs ?? server.startupTimeoutMs;
+    const toolCallTimeoutMs = policy?.toolCallTimeoutMs ?? server.toolCallTimeoutMs;
+    return {
+        ...(enabledTools === undefined ? {} : { enabledTools }),
+        ...(disabledTools === undefined ? {} : { disabledTools }),
+        ...(startupTimeoutMs === undefined ? {} : { startupTimeoutMs }),
+        ...(toolCallTimeoutMs === undefined ? {} : { toolCallTimeoutMs })
+    };
+}
+/**
+ * Bring the suite's declaration and the user's override together.
+ *
+ * A timeout is a plain override: the user's value wins, a declaration fills in
+ * when the user set none, and the built-in default stands behind both. Tool
+ * filtering only tightens: the effective deny list is the suite's entries
+ * unioned with the user's, and the suite's allow-list stands as declared, so a
+ * user cannot open a tool the suite left out.
+ */
+export function resolveMcpPolicy(declared, override) {
+    const enabledTools = dedupe(declared.enabledTools);
+    const suiteDisabledTools = dedupe(declared.disabledTools);
+    const disabledTools = dedupe([...(declared.disabledTools ?? []), ...(override?.disabledTools ?? [])]);
+    return {
+        ...(enabledTools === undefined ? {} : { enabledTools }),
+        ...(suiteDisabledTools === undefined ? {} : { suiteDisabledTools }),
+        ...(disabledTools === undefined ? {} : { disabledTools }),
+        toolCallTimeout: timeoutResolution(override?.toolCallTimeoutMs, declared.toolCallTimeoutMs, DEFAULT_TOOL_CALL_TIMEOUT_MS),
+        startupTimeout: timeoutResolution(override?.startupTimeoutMs, declared.startupTimeoutMs, DEFAULT_STARTUP_TIMEOUT_MS)
+    };
+}
+function timeoutResolution(user, suite, fallback) {
+    const effective = user ?? suite ?? fallback;
+    return {
+        user: user ?? null,
+        suite: suite ?? null,
+        effective,
+        source: user !== undefined ? 'user' : suite !== undefined ? 'suite' : 'default'
+    };
+}
+/** Apply one resolved policy onto a server, in the shape the bridge reads. */
+function applyMcpPolicy(server, policy) {
+    return {
+        ...server,
+        toolCallTimeoutMs: policy.toolCallTimeout.effective,
+        // An undeclared startup timeout stays absent: the built-in bridge applies
+        // its own default at connect time, and host compatibility mode, which
+        // cannot enforce one, keeps accepting the server.
+        ...(policy.startupTimeout.source === 'default' ? {} : { startupTimeoutMs: policy.startupTimeout.effective }),
+        ...(policy.enabledTools === undefined ? {} : { enabledTools: policy.enabledTools }),
+        ...(policy.disabledTools === undefined ? {} : { disabledTools: policy.disabledTools })
+    };
+}
+/**
+ * Apply the namespace policy's OAuth seat onto one server. A remote server
+ * keeps its OAuth opt-out from the namespace; a policy on a portable server
+ * also supplies the credential seam the portable file may not declare.
+ */
+function applyNamespaceAuth(server, policy) {
+    if (policy?.auth === undefined || server.type === 'stdio')
+        return server;
+    return { ...server, auth: { enabled: policy.auth.enabled, ...(policy.auth.scope === undefined ? {} : { scope: policy.auth.scope }) } };
+}
+/** Deduplicate a tool-name list, preserving declaration order; an empty result is absent. */
+function dedupe(values) {
+    if (values === undefined)
+        return undefined;
+    const names = [...new Set(values.filter(name => name !== ''))];
+    return names.length > 0 ? names : undefined;
+}
 /** Find external credential references used by one MCP server definition. */
 export function credentialRefsInServer(server) {
     const values = [];
@@ -96,9 +224,11 @@ export function credentialRefsInServer(server) {
     return [...refs].sort();
 }
 async function toResolvedMount(suite, serverKey, server, pluginDataRoot, resolver) {
+    const portable = isPortableMcp(suite);
+    const dataDir = suiteDataDir(pluginDataRoot, suite.sourceId, suite.id);
     if (server.type === 'sse') {
         // The market bridge supports the legacy HTTP+SSE transport natively.
-        const expand = expander(suite, suiteDataDir(pluginDataRoot, suite.sourceId, suite.id), resolver);
+        const expand = expander(suite, dataDir, resolver, portable);
         const url = await expand.one(server.url);
         const headers = await expand.map(server.headers ?? {});
         const missing = unique([...url.missing, ...headers.missing]);
@@ -115,7 +245,7 @@ async function toResolvedMount(suite, serverKey, server, pluginDataRoot, resolve
         };
         return { request: { suiteId: qualifiedSuiteId(suite.sourceId, suite.id), serverKey, config: sseConfig } };
     }
-    const expand = expander(suite, suiteDataDir(pluginDataRoot, suite.sourceId, suite.id), resolver);
+    const expand = expander(suite, dataDir, resolver, portable);
     const serverName = deriveServerName(suite.id, serverKey);
     if (server.type === 'stdio') {
         const args = await expand.all(server.args ?? []);
@@ -133,8 +263,10 @@ async function toResolvedMount(suite, serverKey, server, pluginDataRoot, resolve
                     serverName,
                     command: server.command.startsWith('./') ? joinInside(suite.root, server.command.slice(2)) : server.command,
                     args: args.values,
-                    env: env.values,
-                    cwd: resolveCwd(cwd.value, suite.root, suiteDataDir(pluginDataRoot, suite.sourceId, suite.id)),
+                    // §9.1: configured env overlays the base, then the client sets
+                    // PLUGIN_ROOT and PLUGIN_DATA, replacing same-name entries.
+                    env: { ...env.values, PLUGIN_ROOT: suite.root, PLUGIN_DATA: dataDir },
+                    cwd: resolveCwd(cwd.value, suite.root, dataDir),
                     ...bridgePolicy(server),
                     failOnStartupError: true
                 }
@@ -185,8 +317,16 @@ function bridgePolicy(server) {
         ...(server.disabledTools === undefined ? {} : { disabledTools: server.disabledTools })
     };
 }
-/** Per-mount expansion context; credential lookups are memoized per call. */
-function expander(suite, pluginData, resolver) {
+/**
+ * Per-mount expansion context.
+ *
+ * Portable package data (`portable: true`) honors §9.2: only the two built-in
+ * variables expand, single pass, and unrecognized placeholder-like text stays
+ * literal — the credential resolver is never consulted. User-owned data
+ * keeps the `${NAME}` seam, with `${NAME:-default}` fallbacks and missing
+ * references reported.
+ */
+function expander(suite, pluginData, resolver, portable) {
     // Promise-valued cache: concurrent expansions of the same reference share
     // one in-flight lookup, so a config using a token twice resolves it once.
     const inflight = new Map();
@@ -214,15 +354,19 @@ function expander(suite, pluginData, resolver) {
                 replacement = suite.root;
             else if (PLUGIN_DATA_VARIABLES.has(name))
                 replacement = pluginData;
-            else
+            else if (!portable)
                 replacement = (await lookup(name))?.value;
             if (replacement === undefined || replacement === '') {
                 if (fallback !== undefined && fallback !== '')
                     replacement = fallback;
-                else {
+                else if (!portable) {
                     missing.push(name);
                     replacement = '';
                 }
+                else {
+                    // §9.2: unrecognized placeholder-like text stays literal.
+                    replacement = match[0];
+                }
             }
             output += replacement;
             cursor = index + match[0].length;

package/lib/runtime/mcp-direct-config.js

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
-import { MCP_SCHEMA_ID, validateAgainstSchema, validateMcpJson } from '../catalog/validate.js';
+import { MCP_SCHEMA_ID, validateMcpJson } from '../catalog/validate.js';
 import { effectiveSurfaces } from '../model/types.js';
 export const USER_MCP_SOURCE = '@user-mcp';
 export const USER_MCP_SUITE = 'user-mcp';
@@ -44,13 +44,16 @@ export async function loadUserMcpSuite(agentsRoot) {
         errors
     };
 }
+/**
+ * The user's own declaration file is local data, not a distributable package:
+ * keys this client does not know ride along untouched rather than failing the
+ * whole file, and the closed-set rule the package schema applies to suites
+ * does not apply here.
+ */
 async function validateUserMcp(agentsRoot, raw) {
-    const errors = await validateAgainstSchema(MCP_SCHEMA_ID, raw);
-    if (errors.length > 0)
-        throw new Error(`invalid MCP configuration: ${errors.join('; ')}`);
-    const result = await validateMcpJson(agentsRoot, raw);
+    const result = await validateMcpJson(agentsRoot, raw, { packageRules: false });
     if (result.config === undefined || result.errors.length > 0)
-        throw new Error(result.errors.join('; '));
+        throw new Error(`invalid MCP configuration: ${result.errors.join('; ')}`);
     return result.config;
 }
 /** Add one service atomically; reject collisions and malformed config before writing. */
@@ -71,3 +74,43 @@ export async function addUserMcpServer(agentsRoot, name, server) {
 export function userMcpPath(agentsRoot) {
     return join(agentsRoot, 'mcp.json');
 }
+const SERVER_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+/**
+ * Import several pasted servers in one write.
+ *
+ * Every entry is judged on its own so one bad definition cannot take the rest
+ * of the paste with it, and an existing name is kept unless the caller asked to
+ * overwrite. The file is written once, after every entry has been checked, so a
+ * rejected entry never lands half-written beside the accepted ones.
+ */
+export async function importUserMcpServers(agentsRoot, entries, overwrite = false) {
+    const suite = await loadUserMcpSuite(agentsRoot);
+    if (suite.errors.length > 0)
+        throw new Error(suite.errors.join('; '));
+    const servers = { ...suite.mcp.servers };
+    const imported = [];
+    const skipped = [];
+    for (const entry of entries) {
+        if (!SERVER_NAME_PATTERN.test(entry.name)) {
+            skipped.push({ name: entry.name, reason: 'invalid name' });
+            continue;
+        }
+        if (Object.hasOwn(servers, entry.name) && !overwrite) {
+            skipped.push({ name: entry.name, reason: 'already exists' });
+            continue;
+        }
+        try {
+            await validateUserMcp(agentsRoot, { $schema: MCP_SCHEMA_ID, mcpServers: { ...servers, [entry.name]: entry.server } });
+        }
+        catch (reason) {
+            skipped.push({ name: entry.name, reason: reason instanceof Error ? reason.message : String(reason) });
+            continue;
+        }
+        servers[entry.name] = entry.server;
+        imported.push(entry.name);
+    }
+    if (imported.length > 0) {
+        await writeFileAtomic(userMcpPath(agentsRoot), `${JSON.stringify({ $schema: MCP_SCHEMA_ID, mcpServers: servers }, null, 2)}\n`, { mode: 0o600, dirMode: 0o700 });
+    }
+    return { imported, skipped };
+}

package/lib/runtime/mcp-mounts.js

@@ -1,9 +1,11 @@
 import { createHash } from 'node:crypto';
+import { mkdir } from 'node:fs/promises';
 import * as mcpBridge from './mcp-client/bridge.js';
 import { toMcpMounts } from './mcp-config.js';
 import { mcpCredentialResolver } from './mcp-credentials.js';
 import { SerialPassQueue, RetryScheduler } from './mount-lifecycle.js';
-import { qualifiedSuiteId } from '../catalog/paths.js';
+import { qualifiedSuiteId, suiteDataDir } from '../catalog/paths.js';
+import { redactErrorMessage } from './mcp-redaction.js';
 export class McpMountRegistry {
     ctx;
     pluginDataRoot;
@@ -178,6 +180,16 @@ export class McpMountRegistry {
     }
     /** Mount one precomputed request (source config merged with overrides). */
     async mountWith(request) {
+        // §9.1: the client-managed PLUGIN_DATA directory must exist and be
+        // writable before any plugin subprocess starts. Created recursively and
+        // idempotently on every mount so an uninstalled-then-reinstalled suite
+        // starts over with a fresh directory while an update keeps its contents.
+        if (request.config.transport === 'stdio') {
+            const separator = request.suiteId.indexOf('/');
+            const sourceId = separator === -1 ? request.suiteId : request.suiteId.slice(0, separator);
+            const suiteId = separator === -1 ? request.suiteId : request.suiteId.slice(separator + 1);
+            await mkdir(suiteDataDir(this.pluginDataRoot, sourceId, suiteId), { recursive: true });
+        }
         const owner = this.serverOwner(request.config.serverName);
         if (owner !== undefined) {
             // Two sources shipping the same suite/server pair derive one serverName:
@@ -251,7 +263,7 @@ export class McpMountRegistry {
                     // Ignore teardown errors: the startup failure is the real signal.
                 }
             }
-            return { reason: `mount failed: ${error instanceof Error ? error.message : String(error)}`, code: 'mount-failed' };
+            return { reason: `mount failed: ${redactErrorMessage(error instanceof Error ? error.message : String(error))}`, code: 'mount-failed' };
         }
         this.live.set(mountKey(request.suiteId, request.serverKey), {
             suiteId: request.suiteId,
@@ -271,7 +283,7 @@ export class McpMountRegistry {
             return undefined;
         }
         catch (error) {
-            const reason = `unmount failed: ${error instanceof Error ? error.message : String(error)}`;
+            const reason = `unmount failed: ${redactErrorMessage(error instanceof Error ? error.message : String(error))}`;
             this.ctx.logger?.warn(`[dsh-agent-plugins-market] ${reason} (${live.suiteId}/${live.serverKey})`);
             return reason;
         }

package/lib/runtime/mcp-overrides.js

@@ -15,6 +15,8 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
 import { isSensitiveKey } from './mcp-redaction.js';
+/** The largest timeout a bridge config and the host timer can hold. */
+export const MAX_TIMEOUT_MS = 2_147_483_647;
 /** The overrides directory under the plugin data root. */
 export function overridesDir(dataRoot) {
     return join(dataRoot, 'overrides');
@@ -69,11 +71,41 @@ export function sanitizeOverrides(raw) {
         if (Array.isArray(record['args']) && record['args'].every(entry => typeof entry === 'string')) {
             override.args = record['args'];
         }
+        const toolCallTimeoutMs = timeoutMs(record['toolCallTimeoutMs']);
+        if (toolCallTimeoutMs !== undefined)
+            override.toolCallTimeoutMs = toolCallTimeoutMs;
+        const startupTimeoutMs = timeoutMs(record['startupTimeoutMs']);
+        if (startupTimeoutMs !== undefined)
+            override.startupTimeoutMs = startupTimeoutMs;
+        const disabledTools = toolNames(record['disabledTools']);
+        if (disabledTools !== undefined)
+            override.disabledTools = disabledTools;
         if (Object.keys(override).length > 0)
             result[serverKey] = override;
     }
     return result;
 }
+/**
+ * Keep a timeout that a millisecond count can hold. Anything else passes
+ * nothing through, so one malformed field cannot take the rest of the record
+ * with it.
+ */
+function timeoutMs(raw) {
+    if (typeof raw !== 'number' || !Number.isFinite(raw) || raw <= 0 || raw > MAX_TIMEOUT_MS)
+        return undefined;
+    return raw;
+}
+/**
+ * Keep a tool-name list for a deny list: non-empty names, deduplicated, with
+ * the empty result reading as "nothing denied" so the field never persists as
+ * an empty array.
+ */
+function toolNames(raw) {
+    if (!Array.isArray(raw))
+        return undefined;
+    const names = [...new Set(raw.filter((entry) => typeof entry === 'string' && entry !== ''))];
+    return names.length > 0 ? names : undefined;
+}
 /** Keep a well-formed auth block; anything else passes nothing through. */
 function sanitizeAuth(raw) {
     if (typeof raw !== 'object' || raw === null)
@@ -94,6 +126,69 @@ export function sanitizeOverridePatch(patch) {
         return undefined;
     return sanitizeOverrides({ server: patch })['server'];
 }
+/**
+ * Validate one policy save as it arrives over the wire. An absent field leaves
+ * its stored value alone, `null` clears one back to inheritance, and a positive
+ * whole number of milliseconds within the timer range sets it; anything else
+ * rejects the save with a readable reason.
+ */
+export function parseTimeoutPatch(raw) {
+    if (raw === undefined)
+        return {};
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        throw new Error('policy must be an object');
+    const record = raw;
+    return {
+        ...(record['toolCallTimeoutMs'] === undefined ? {} : { toolCallTimeoutMs: timeoutField(record['toolCallTimeoutMs'], 'tool call timeout') }),
+        ...(record['startupTimeoutMs'] === undefined ? {} : { startupTimeoutMs: timeoutField(record['startupTimeoutMs'], 'startup timeout') })
+    };
+}
+/**
+ * Validate a client-supplied policy patch. An absent field keeps its stored
+ * value, `null` clears it back to the suite's declaration or the default, and
+ * any other shape is rejected with the reason it failed.
+ */
+export function parseMcpPolicyPatch(raw) {
+    if (raw === undefined)
+        return {};
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        throw new Error('policy must be an object');
+    const record = raw;
+    const patch = {};
+    if (record['toolCallTimeoutMs'] !== undefined)
+        patch.toolCallTimeoutMs = timeoutField(record['toolCallTimeoutMs'], 'tool call timeout');
+    if (record['startupTimeoutMs'] !== undefined)
+        patch.startupTimeoutMs = timeoutField(record['startupTimeoutMs'], 'startup timeout');
+    if (record['disabledTools'] !== undefined) {
+        if (record['disabledTools'] === null)
+            patch.disabledTools = null;
+        else {
+            const names = toolNames(record['disabledTools']);
+            if (names === undefined && record['disabledTools'].length > 0)
+                throw new Error('denied tools must be a list of tool names');
+            patch.disabledTools = names ?? [];
+        }
+    }
+    if (record['auth'] !== undefined) {
+        if (record['auth'] === null)
+            patch.auth = null;
+        else {
+            const auth = sanitizeAuth(record['auth']);
+            if (auth === undefined)
+                throw new Error('auth must be an object with a boolean "enabled"');
+            patch.auth = auth;
+        }
+    }
+    return patch;
+}
+function timeoutField(value, label) {
+    if (value === null)
+        return null;
+    if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0 || value > MAX_TIMEOUT_MS) {
+        throw new Error(`${label} must be a positive whole number of milliseconds no greater than ${MAX_TIMEOUT_MS}`);
+    }
+    return value;
+}
 /**
  * Merge one client patch into the override already on disk.
  *
@@ -113,7 +208,18 @@ export function mergeOverridePatch(existing, patch) {
         ...(headers === undefined ? {} : { headers }),
         ...(env === undefined ? {} : { env }),
         ...(patch.args !== undefined ? { args: patch.args } : existing.args === undefined ? {} : { args: existing.args }),
-        ...(patch.auth !== undefined ? { auth: patch.auth } : existing.auth === undefined ? {} : { auth: existing.auth })
+        ...(patch.auth !== undefined ? { auth: patch.auth } : existing.auth === undefined ? {} : { auth: existing.auth }),
+        ...(patch.toolCallTimeoutMs !== undefined
+            ? { toolCallTimeoutMs: patch.toolCallTimeoutMs }
+            : existing.toolCallTimeoutMs === undefined
+                ? {}
+                : { toolCallTimeoutMs: existing.toolCallTimeoutMs }),
+        ...(patch.startupTimeoutMs !== undefined
+            ? { startupTimeoutMs: patch.startupTimeoutMs }
+            : existing.startupTimeoutMs === undefined
+                ? {}
+                : { startupTimeoutMs: existing.startupTimeoutMs }),
+        ...(patch.disabledTools !== undefined ? { disabledTools: patch.disabledTools } : existing.disabledTools === undefined ? {} : { disabledTools: existing.disabledTools })
     };
 }
 function mergeStringMap(existing, patch) {
@@ -156,22 +262,46 @@ function stringMap(value) {
 export function applyOverride(server, override) {
     if (override === undefined)
         return server;
+    const policy = policyFields(override);
     if (override.config !== undefined)
         server = override.config;
     if (server.type === 'stdio') {
         return {
             ...server,
+            ...policy,
             ...(override.args !== undefined ? { args: override.args } : {}),
             ...(override.env !== undefined ? { env: override.env } : {})
         };
     }
     return {
         ...server,
+        ...policy,
         ...(override.url !== undefined ? { url: override.url } : {}),
         ...(override.headers !== undefined ? { headers: override.headers } : {}),
         ...(override.auth !== undefined ? { auth: override.auth } : {})
     };
 }
+/** The user-owned policy fields of one override, in server shape. */
+function policyFields(override) {
+    return {
+        ...(override.toolCallTimeoutMs === undefined ? {} : { toolCallTimeoutMs: override.toolCallTimeoutMs }),
+        ...(override.startupTimeoutMs === undefined ? {} : { startupTimeoutMs: override.startupTimeoutMs }),
+        ...(override.disabledTools === undefined ? {} : { disabledTools: override.disabledTools })
+    };
+}
+/**
+ * One server with its client policy fields removed: the shape the portable
+ * `mcp.json` schema accepts. The service editor renders and saves this shape,
+ * so a timeout never reaches a document that has no seat for it.
+ */
+export function withoutPolicyFields(server) {
+    const portable = { ...server };
+    delete portable['enabledTools'];
+    delete portable['disabledTools'];
+    delete portable['startupTimeoutMs'];
+    delete portable['toolCallTimeoutMs'];
+    return portable;
+}
 function sanitizeFileName(raw) {
     return raw.replace(/[^A-Za-z0-9_-]+/g, '_');
 }

package/lib/runtime/mcp-redaction.js

@@ -45,6 +45,14 @@ export function redactUrl(raw) {
         .join('&');
     return safeQuery === '' ? base : `${base}?${safeQuery}`;
 }
+/**
+ * Redact every URL embedded in an error message before the message reaches a
+ * log line or a diagnostic: connection failures echo the server's endpoint,
+ * and endpoints carry credential-bearing queries.
+ */
+export function redactErrorMessage(raw) {
+    return raw.replace(/https?:\/\/[^\s"'<>]+/gi, value => redactUrl(value));
+}
 function splitOnce(value, separator) {
     const index = value.indexOf(separator);
     if (index === -1)