dsh-agent-plugins-market 0.9.0 → 0.9.2

package/lib/{application → packages/market-mcp/src/application}/mcp/mcp-config.js

@@ -21,15 +21,77 @@
  */
 import { createHash } from 'node:crypto';
 import { DEFAULT_STARTUP_TIMEOUT_MS, DEFAULT_TOOL_CALL_TIMEOUT_MS } from './mcp-bridge-config.js';
-import { resolveCwd } from '../../catalog/validate.js';
-import { qualifiedSuiteId, suiteDataDir } from '../../catalog/paths.js';
+import { resolveCwd } from '../../../../market-catalog/src/index.js';
+import { qualifiedSuiteId, suiteDataDir } from '../../../../market-catalog/src/index.js';
 import { applyOverride } from './mcp-overrides.js';
 import { isUserMcpSuite } from './mcp-direct-config.js';
-import { PLUGIN_ROOT_VARIABLES, PLUGIN_DATA_VARIABLES } from '../../model/layouts.js';
+import { PLUGIN_ROOT_VARIABLES, PLUGIN_DATA_VARIABLES } from '../../../../market-contracts/src/model/layouts.js';
 /** The max length the bridge accepts for a serverName. */
 const SERVER_NAME_MAX = 32;
-const PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
 const BUILTIN_PLACEHOLDERS = new Set([...PLUGIN_ROOT_VARIABLES, ...PLUGIN_DATA_VARIABLES]);
+function isPlaceholderNameStart(character) {
+    return (character >= 'A' && character <= 'Z') || (character >= 'a' && character <= 'z') || character === '_';
+}
+function isPlaceholderNamePart(character) {
+    return isPlaceholderNameStart(character) || (character >= '0' && character <= '9');
+}
+/**
+ * Find the next reference at or after `from`.
+ *
+ * Scanned rather than matched: a value arrives from a third-party suite, and
+ * the pattern that described this grammar let the engine retry the fallback
+ * body from every `$` it saw, so a value of many `${{A:-` runs cost time
+ * quadratic in its length. The cursor only moves forward.
+ */
+function nextPlaceholder(value, from) {
+    let cursor = from;
+    while (cursor < value.length) {
+        const start = value.indexOf('${', cursor);
+        if (start === -1)
+            return undefined;
+        const first = value[start + 2];
+        if (first === undefined || !isPlaceholderNameStart(first)) {
+            cursor = start + 2;
+            continue;
+        }
+        let at = start + 3;
+        while (at < value.length) {
+            const character = value[at];
+            if (character === undefined || !isPlaceholderNamePart(character))
+                break;
+            at += 1;
+        }
+        const name = value.slice(start + 2, at);
+        let fallback;
+        if (value[at] === ':' && value[at + 1] === '-') {
+            const close = value.indexOf('}', at + 2);
+            if (close === -1) {
+                cursor = start + 2;
+                continue;
+            }
+            fallback = value.slice(at + 2, close);
+            at = close;
+        }
+        if (value[at] !== '}') {
+            cursor = start + 2;
+            continue;
+        }
+        return { index: start, text: value.slice(start, at + 1), name, fallback };
+    }
+    return undefined;
+}
+/** Every reference in one value, in order. */
+function placeholderMatches(value) {
+    const matches = [];
+    let cursor = 0;
+    for (;;) {
+        const match = nextPlaceholder(value, cursor);
+        if (match === undefined)
+            return matches;
+        matches.push(match);
+        cursor = match.index + match.text.length;
+    }
+}
 /**
  * Build one mount request per supported mcp.json server, expanding built-in
  * variables (and, for user-owned data, `${NAME}` credential references)
@@ -216,10 +278,9 @@ export function credentialRefsInServer(server) {
     }
     const refs = new Set();
     for (const value of values) {
-        for (const match of value.matchAll(PLACEHOLDER)) {
-            const name = match[1];
-            if (name !== undefined && !BUILTIN_PLACEHOLDERS.has(name))
-                refs.add(name);
+        for (const match of placeholderMatches(value)) {
+            if (!BUILTIN_PLACEHOLDERS.has(match.name))
+                refs.add(match.name);
         }
     }
     return [...refs].sort();
@@ -343,13 +404,9 @@ function expander(suite, pluginData, resolver, portable) {
         let cursor = 0;
         let output = '';
         const missing = [];
-        for (const match of value.matchAll(PLACEHOLDER)) {
-            const index = match.index ?? 0;
-            const name = match[1];
-            if (name === undefined)
-                continue;
+        for (const match of placeholderMatches(value)) {
+            const { index, name, fallback } = match;
             output += value.slice(cursor, index);
-            const fallback = match[2];
             let replacement;
             if (PLUGIN_ROOT_VARIABLES.has(name))
                 replacement = suite.root;
@@ -366,11 +423,11 @@ function expander(suite, pluginData, resolver, portable) {
                 }
                 else {
                     // §9.2: unrecognized placeholder-like text stays literal.
-                    replacement = match[0];
+                    replacement = match.text;
                 }
             }
             output += replacement;
-            cursor = index + match[0].length;
+            cursor = index + match.text.length;
         }
         output += value.slice(cursor);
         return { value: output, missing };
@@ -405,12 +462,38 @@ function unique(values) {
 function joinInside(root, segment) {
     return `${root.replace(/[\\/]$/, '')}/${segment}`;
 }
-/** Sanitize one token into `[A-Za-z0-9_-]`. */
+/**
+ * Sanitize one token into `[A-Za-z0-9_-]`.
+ *
+ * One pass over the characters, collapsing any run of other characters into a
+ * single `_` and dropping leading and trailing ones. The previous chain of
+ * three patterns over input that arrives from a third-party suite made a
+ * separator-only token cost time quadratic in its length.
+ */
 function sanitizeToken(raw) {
-    const cleaned = raw
-        .replace(/[^A-Za-z0-9_-]+/g, '_')
-        .replace(/_+/g, '_')
-        .replace(/^_+|_+$/g, '');
+    const accepted = (character) => (character >= 'A' && character <= 'Z') || (character >= 'a' && character <= 'z') || (character >= '0' && character <= '9') || character === '-';
+    const parts = [];
+    let rejected = false;
+    for (const character of raw) {
+        if (character === '_' || accepted(character)) {
+            // `_` is both an accepted character and the replacement, so a run of them
+            // collapses to one, exactly as the `[^A-Za-z0-9_-]+` then `_+` pair did.
+            if (character === '_' && (rejected || parts[parts.length - 1] === '_'))
+                continue;
+            if (rejected && parts.length > 0)
+                parts.push('_');
+            rejected = false;
+            parts.push(character);
+        }
+        else {
+            rejected = true;
+        }
+    }
+    let cleaned = parts.join('');
+    while (cleaned.startsWith('_'))
+        cleaned = cleaned.slice(1);
+    while (cleaned.endsWith('_'))
+        cleaned = cleaned.slice(0, -1);
     return cleaned === '' ? 'server' : cleaned;
 }
 /**

package/lib/{application → packages/market-mcp/src/application}/mcp/mcp-direct-config.js

@@ -1,7 +1,7 @@
 import { join } from 'node:path';
-import { readJsonFile, writeJsonDocument } from '../json-file.js';
-import { MCP_SCHEMA_ID, validateMcpJson } from '../../catalog/validate.js';
-import { effectiveSurfaces } from '../../model/types.js';
+import { readJsonFile, writeJsonDocument } from '../../../../market-catalog/src/index.js';
+import { MCP_SCHEMA_ID, validateMcpJson } from '../../../../market-catalog/src/index.js';
+import { effectiveSurfaces } from '../../../../market-contracts/src/model/types.js';
 export const USER_MCP_SOURCE = '@user-mcp';
 export const USER_MCP_SUITE = 'user-mcp';
 /**
@@ -78,6 +78,14 @@ function isRecord(value) {
 }
 /** Add one service atomically; reject collisions and malformed config before writing. */
 export async function addUserMcpServer(agentsRoot, name, server) {
+    const publish = await prepareUserMcpServer(agentsRoot, name, server);
+    await publish();
+}
+/**
+ * Validate an addition without publishing it. Call the returned atomic write
+ * once, within the same serialized mutation, after any policy has been saved.
+ */
+export async function prepareUserMcpServer(agentsRoot, name, server) {
     if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(name))
         throw new Error('invalid MCP server name');
     const suite = await loadUserMcpSuite(agentsRoot);
@@ -87,7 +95,7 @@ export async function addUserMcpServer(agentsRoot, name, server) {
         throw new Error(`MCP server "${name}" already exists`);
     const document = { $schema: MCP_SCHEMA_ID, mcpServers: { ...suite.mcp.servers, [name]: server } };
     await validateUserMcp(agentsRoot, document);
-    await writeJsonDocument(userMcpPath(agentsRoot), document);
+    return () => writeJsonDocument(userMcpPath(agentsRoot), document);
 }
 /** The user's hand-written MCP declaration file: `<agentsRoot>/mcp.json`. */
 export function userMcpPath(agentsRoot) {

package/lib/{application → packages/market-mcp/src/application}/mcp/mcp-overrides.js

@@ -12,10 +12,10 @@
  * so keys never persist in plain text.
  */
 import { join } from 'node:path';
-import { readJsonFile, writeJsonDocument } from '../json-file.js';
-import { isSensitiveKey } from './mcp-redaction.js';
-/** The largest timeout a bridge config and the host timer can hold. */
-export const MAX_TIMEOUT_MS = 2_147_483_647;
+import { readJsonFile, writeJsonDocument } from '../../../../market-catalog/src/index.js';
+import { isSensitiveKey } from '../../../../market-contracts/src/redaction.js';
+export { MAX_TIMEOUT_MS } from '../../../../market-contracts/src/contracts/mcp-overrides.js';
+import { MAX_TIMEOUT_MS } from '../../../../market-contracts/src/contracts/mcp-overrides.js';
 /** The overrides directory under the plugin data root. */
 export function overridesDir(dataRoot) {
     return join(dataRoot, 'overrides');

package/lib/{application → packages/market-mcp/src/application}/mcp/mcp-status.js

@@ -1,6 +1,6 @@
 import { credentialRefsInServer, effectiveMcpServers, deriveServerName } from './mcp-config.js';
-import { redactMcpConfig, redactUrl } from './mcp-redaction.js';
-import { qualifiedSuiteId } from '../../catalog/paths.js';
+import { redactMcpConfig, redactUrl } from '../../../../market-contracts/src/redaction.js';
+import { qualifiedSuiteId } from '../../../../market-catalog/src/index.js';
 /**
  * Whether one effective configuration supplies its own Authorization header.
  *
@@ -14,9 +14,35 @@ export function declaresAuthHeader(config) {
         return false;
     return Object.keys(headers).some(name => name.toLowerCase() === 'authorization');
 }
-/** Build status rows from discovered plugin MCP definitions and observed tool names. */
-export function buildMcpStatus(suites, diagnostics, observed, overrides = new Map()) {
+/**
+ * Build status rows from discovered plugin MCP definitions and observed tool names.
+ *
+ * Each tool's description is translated on the way out; a service name and a
+ * tool's own `name` are call identifiers and are never translated. The
+ * callback is optional: a caller that omits it gets the upstream text, which is
+ * what the contract's absent translated field means.
+ * @param suites - the discovered suites whose MCP declarations form the inventory.
+ * @param diagnostics - the latest mount diagnostics, keyed by suite and server.
+ * @param observed - the live host tool registry snapshot.
+ * @param overrides - persisted per-server overrides, keyed by qualified suite id.
+ * @param localization - the locale this whole inventory renders in and the
+ * resolver bound to it, when the deployment translates at all. Resolved once by
+ * the caller: a server and each of its tools is localized from this one value,
+ * never from a fresh read of the host preference.
+ * @returns the status payload with every translatable field carrying its translation.
+ */
+export function buildMcpStatus(suites, diagnostics, observed, overrides = new Map(), localization) {
     const entries = [];
+    // Counted so a caller can re-read until the translated text lands, exactly as
+    // the market overview reports its own pending count.
+    let translationPending = 0;
+    const localize = (id, fields) => {
+        if (localization === undefined)
+            return {};
+        const result = localization.localizeFields('mcp', id, fields, localization.locale);
+        translationPending += result.pending;
+        return result.fields;
+    };
     const claimedServers = new Set();
     const knownServerNames = new Set();
     const knownDefinitions = new Map();
@@ -87,7 +113,8 @@ export function buildMcpStatus(suites, diagnostics, observed, overrides = new Ma
                 transport: effective.type,
                 endpoint: endpointOf(effective),
                 config: redactMcpConfig(effective),
-                tools: disabled && !orphaned ? [] : observedTools(tools),
+                tools: disabled && !orphaned ? [] : observedTools(tools, serverName, localization === undefined ? undefined : localize),
+                ...(localization === undefined ? {} : localize(serverName, { name: serverName })),
                 advertisedTools: tools.length > 0,
                 retryable: diagnostic?.code === 'mount-failed' || diagnostic?.code === 'unmount-failed',
                 ...(effective.type === 'stdio' || effective.auth !== undefined ? {} : { oauthDefault: true }),
@@ -119,7 +146,8 @@ export function buildMcpStatus(suites, diagnostics, observed, overrides = new Ma
                 transport: stale.server.type,
                 endpoint: endpointOf(stale.server),
                 config: redactMcpConfig(stale.server),
-                tools: observedTools(tools),
+                tools: observedTools(tools, serverName, localization === undefined ? undefined : localize),
+                ...(localization === undefined ? {} : localize(serverName, { name: serverName })),
                 reason: 'MCP tools remain after this plugin was disabled or uninstalled',
                 code: 'orphaned-tools',
                 ...(staleRefs.length === 0 ? {} : { credentialRefs: staleRefs })
@@ -132,7 +160,8 @@ export function buildMcpStatus(suites, diagnostics, observed, overrides = new Ma
             kind: 'direct',
             state: 'connected',
             transport: 'observed',
-            tools: observedTools(tools)
+            tools: observedTools(tools, serverName, localization === undefined ? undefined : localize),
+            ...(localization === undefined ? {} : localize(serverName, { name: serverName }))
         });
     }
     const totals = {
@@ -145,15 +174,25 @@ export function buildMcpStatus(suites, diagnostics, observed, overrides = new Ma
         disabled: entries.filter(entry => entry.state === 'disabled').length,
         foreign: entries.filter(entry => entry.state === 'foreign').length
     };
-    return { entries, observedAt: new Date().toISOString(), totals, directObservationOnly: true };
+    return {
+        entries,
+        observedAt: new Date().toISOString(),
+        totals,
+        directObservationOnly: true,
+        ...(translationPending === 0 ? {} : { translationPending })
+    };
 }
 /** One tool projection for the status wire: the input schema rides along only while it stays small. */
 const MAX_SCHEMA_CHARS = 20_000;
-function observedTools(tools) {
+function observedTools(tools, serverId, localize) {
     return tools.map(tool => ({
         name: tool.name,
         ...(tool.description === undefined ? {} : { description: tool.description }),
-        ...(tool.parameters === undefined || JSON.stringify(tool.parameters).length > MAX_SCHEMA_CHARS ? {} : { parameters: tool.parameters })
+        ...(tool.parameters === undefined || JSON.stringify(tool.parameters).length > MAX_SCHEMA_CHARS ? {} : { parameters: tool.parameters }),
+        // One tool per `<serverId>#<toolName>`: two servers may advertise the same
+        // tool name with different descriptions, and the same server may describe
+        // one tool differently from another.
+        ...(localize === undefined ? {} : localize(`${serverId}#${tool.name}`, { description: tool.description }))
     }));
 }
 function groupObservedTools(observed, knownServerNames) {

package/lib/packages/market-mcp/src/application/mcp/validation.js

@@ -0,0 +1,63 @@
+/**
+ * MCP configuration validation: the schema checks and the redaction-restore
+ * step the save path runs before anything is persisted.
+ *
+ * A service the user declared themselves is local data rather than a
+ * distributable package: keys this client does not know are kept as written
+ * instead of being rejected by the closed-set package schema, and the
+ * package-only rules (bare command names, plugin-relative paths) stay off.
+ */
+import { MCP_SCHEMA_ID, validateAgainstSchema, validateMcpJson } from '../../../../market-catalog/src/index.js';
+/**
+ * The errors the closed-set package shape produces. A user-owned service does
+ * not obey that shape, and the per-transport checks still require what it needs.
+ */
+const PACKAGE_SHAPE_KEYWORDS = new Set(['additionalProperties', 'oneOf', 'required', 'const']);
+/**
+ * A rejected MCP configuration. The message keeps the flat form the API has
+ * always returned, and `fields` carries the same reasons keyed by field so the
+ * editor can put each one beside its input.
+ */
+export class McpConfigError extends Error {
+    fields;
+    constructor(fields) {
+        super(`invalid MCP configuration: ${fields.map(entry => (entry.field === '' ? entry.message : `${entry.field} ${entry.message}`)).join('; ')}`);
+        this.fields = fields;
+        this.name = 'McpConfigError';
+    }
+}
+export { restoreRedactedConfig } from '../../../../market-contracts/src/redaction.js';
+/**
+ * Validate one service definition before it is stored.
+ *
+ * A service the user declared themselves is local data rather than a
+ * distributable package: keys this client does not know are kept as written
+ * instead of being rejected by the closed-set package schema, and the
+ * package-only rules (bare command names, plugin-relative paths) stay off.
+ */
+export async function validateServerMcp(root, key, config, options) {
+    const userOwned = options?.userOwned === true;
+    const document = { $schema: MCP_SCHEMA_ID, mcpServers: { [key]: config } };
+    // A JSON pointer needs its own escapes so a server key containing `/` or `~`
+    // still yields the right prefix for the field paths below.
+    const pointer = `/mcpServers/${key.replaceAll('~', '~0').replaceAll('/', '~1')}`;
+    const structural = (await validateAgainstSchema(MCP_SCHEMA_ID, document))
+        .filter(error => error.instancePath === pointer || error.instancePath.startsWith(`${pointer}/`))
+        // The closed-set package shape reports `additionalProperties` plus the
+        // `oneOf`/`required` pair its failure produces; user-owned data does not
+        // obey it, and the per-transport checks below still require what it needs.
+        .filter(error => !(userOwned && PACKAGE_SHAPE_KEYWORDS.has(error.keyword)))
+        .map(error => ({
+        field: error.instancePath.slice(pointer.length).replace(/^\//, '').replaceAll('/', '.'),
+        message: error.message
+    }));
+    if (structural.length > 0)
+        throw new McpConfigError(structural);
+    const result = await validateMcpJson(root, document, userOwned ? { packageRules: false } : undefined);
+    if (result.config === undefined || result.errors.length > 0)
+        throw new McpConfigError(result.errors.map(message => ({ field: '', message })));
+    const server = result.config.servers[key];
+    if (server === undefined)
+        throw new McpConfigError([{ field: '', message: `server "${key}" was rejected` }]);
+    return server;
+}