dsh-agent-plugins-market 0.9.0 → 0.9.2

package/lib/types/packages/market-runtime/src/runtime/host/command-name-allocator.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Unique call names for the commands this plugin registers.
+ *
+ * The host's command registry keys one name to one definition per layer:
+ * `NamedEntries.insert` throws `command "x" is already registered` when the
+ * name is taken, and the layer a registration lands in is chosen by the
+ * registry service's own context, never by the caller's. Two suites flattening
+ * to one call name, a host built-in such as `compact`, or a second mount
+ * registry feeding the same layer therefore collide — and a colliding
+ * definition is the one thing the slash menu drops, so the name has to be
+ * chosen before `register` is called. The layer's existing names cannot be
+ * enumerated from here, which leaves the refused registration as the only
+ * observable of a foreign occupant; {@link registerWithAllocatedName} retries
+ * with the next suffix.
+ *
+ * Allocation answers the preferred name while it is free and appends an
+ * increasing numeric suffix afterwards: the first conflict is `compact-1`,
+ * then `compact-2`. A name the host refused stays held as occupied, so the
+ * retry asks for the following suffix instead of repeating the name that just
+ * failed.
+ *
+ * @module runtime/command-name-allocator
+ */
+/** Suffixes one preferred name may spend before allocation gives up on it. */
+export declare const MAX_COMMAND_NAME_ATTEMPTS = 50;
+/**
+ * Whether the host refused a registration because that exact name is taken.
+ *
+ * `CommandRuntime.register` renders one sentence for the global layer
+ * (`command "x" is already registered (for a per-agent variant, ...)`) and a
+ * shorter one for a scoped layer (`... in this scope`); both open with the
+ * same clause, and an error carrying any other text is a real failure rather
+ * than a name collision.
+ * @param error - the value thrown by `register`.
+ * @returns whether re-claiming under another name can succeed.
+ */
+export declare function isDuplicateCommandName(error: unknown): boolean;
+/** Naming policy over one layer's occupancy. */
+export interface CommandNameAllocator {
+    /**
+     * Claim a unique call name: `preferred` when free, otherwise the first free
+     * `preferred-1`, `preferred-2`, ... suffix.
+     * @param preferred - the name the command uses undisturbed.
+     * @returns the name to register under.
+     * @throws when every suffix within {@link MAX_COMMAND_NAME_ATTEMPTS} is taken.
+     */
+    claim(preferred: string): string;
+    /**
+     * Release a previously claimed name so it can be reused. Releasing a name
+     * that was never claimed, or already released, is a no-op.
+     * @param name - the name returned by an earlier {@link CommandNameAllocator.claim}.
+     */
+    release(name: string): void;
+}
+/**
+ * Build a naming policy over `taken`.
+ *
+ * The allocator owns the names it hands out, which is what makes
+ * {@link CommandNameAllocator.release} meaningful; `taken` adds the names
+ * occupied outside it (another surface's registrations in the same layer, and
+ * the names the host has already refused).
+ * @param taken - every name currently unavailable to this allocator.
+ * @returns the allocator.
+ */
+export declare function createCommandNameAllocator(taken: () => ReadonlySet<string>): CommandNameAllocator;
+/**
+ * The names one command layer holds for this plugin.
+ *
+ * A mount registry keeps one of these for the lifetime of its layer seat: it
+ * spans every reconcile pass, so a name stays reserved exactly as long as the
+ * registration carrying it is live, and it dies with the seat — a recomposed
+ * layer starts from the host's own occupancy alone. Names the host refused are
+ * held too, so a rename never retries a name this layer just rejected.
+ *
+ * Occupancy is per layer, not per process, because that is the unit the host
+ * checks: two agents' scoped layers each hold their own `review`, and neither
+ * registration sees the other. A process-wide ledger would rename the second
+ * one for a collision the host never reports.
+ */
+export declare class CommandNameRegistry {
+    /** Names held by this plugin in the layer, whether registered or refused. */
+    private readonly held;
+    private readonly allocator;
+    /**
+     * Reserve the next free name for `preferred`.
+     * @param preferred - the name the command uses undisturbed.
+     * @returns the name to register under.
+     * @throws when every suffix within {@link MAX_COMMAND_NAME_ATTEMPTS} is taken.
+     */
+    claim(preferred: string): string;
+    /**
+     * Drop a name this plugin no longer registers, freeing it for a later claim.
+     * @param name - the name whose registration ended.
+     */
+    forget(name: string): void;
+    /**
+     * Hold a name the host refused, so it stays occupied without a registration.
+     * @param name - the refused call name.
+     */
+    refuse(name: string): void;
+    /**
+     * Every name this layer holds for the plugin.
+     * @returns the allocated and refused names, as one read-only view.
+     */
+    taken(): ReadonlySet<string>;
+}
+/** What one registration attempt settled as. */
+export type CommandNameRegistration<T> = {
+    kind: 'registered';
+    name: string;
+    disposer: T;
+} | {
+    kind: 'failed';
+    error: unknown;
+};
+/**
+ * Register under the first call name the layer accepts.
+ *
+ * The attempt loop is the only way past a foreign occupant: the layer's names
+ * are not enumerable, so a refusal is what moves allocation to the next
+ * suffix. A refusal is held on `names` before the retry, which is what makes
+ * the loop terminate — every iteration either registers or retires one
+ * candidate, and allocation itself fails once the suffix ceiling is reached.
+ * Any other failure ends the attempt immediately, because renaming around a
+ * malformed definition or an unavailable registry would report a rename
+ * instead of the bug that caused it.
+ * @param names - the layer's occupancy ledger.
+ * @param preferred - the name the command uses when nothing holds it.
+ * @param register - the host registration, called once per candidate name.
+ * @returns the accepted name and its registration, or the failure to diagnose.
+ */
+export declare function registerWithAllocatedName<T>(names: CommandNameRegistry, preferred: string, register: (name: string) => T): CommandNameRegistration<T>;

package/lib/types/packages/market-runtime/src/runtime/host/extension-progress.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Session progress for the extension window: whether a session carries work the
+ * user authored.
+ *
+ * The host folds this answer once per session through its projection registry and
+ * then advances it per committed event, so a window read no longer scans the whole
+ * event log. The wire meaning is unchanged: a started turn, or a user/inbox
+ * message this plugin did not author. A host that publishes no projection registry
+ * falls back to the historical log scan instead of answering a constant.
+ *
+ * @module runtime/host/extension-progress
+ */
+import { z } from 'zod';
+import type { Context } from '@deepseek-ai/cordis';
+import type { Session, SessionEvent } from '@deepseek-ai/dsh-session';
+/** The projection key this plugin owns; host-only, so it never reaches a client view. */
+export declare const EXTENSION_PROGRESS_KEY = "marketExtensionProgress";
+/** Folded progress state for one session. */
+export interface ExtensionProgressState {
+    readonly started: boolean;
+}
+declare module '@deepseek-ai/dsh-session-projection/types' {
+    interface SessionProjectionStateMap {
+        marketExtensionProgress: ExtensionProgressState;
+    }
+}
+/**
+ * Whether one committed event is authored progress.
+ *
+ * This is the definition the wire field has always carried: a started turn, or a
+ * user/inbox message whose source is not this plugin's own and carries no form.
+ * @param event - one committed session event.
+ * @returns true when the event proves the user started work.
+ */
+export declare function eventCarriesProgress(event: SessionEvent): boolean;
+/** The host fold this plugin registers: monotonic, because progress never un-happens. */
+export declare const extensionProgressProjection: {
+    key: "marketExtensionProgress";
+    stateVersion: number;
+    stateSchema: z.ZodObject<{
+        started: z.ZodBoolean;
+    }, z.core.$strip>;
+    init: () => ExtensionProgressState;
+    apply: (state: NoInfer<ExtensionProgressState>, event: SessionEvent) => ExtensionProgressState;
+};
+/**
+ * Read progress from the log itself.
+ *
+ * The compatibility fallback for a host without the projection registry. The
+ * synchronous full-log reader is deprecated host-side; this call carries the
+ * deferred-migration waiver the deprecation decision allows, and disappears when
+ * every supported host publishes the registry.
+ * @param session - session whose log is scanned.
+ * @returns true when the log carries authored progress.
+ */
+export declare function scanExtensionProgress(session: Session): boolean;
+/**
+ * Owns this plugin's projection registration and answers one session's progress.
+ *
+ * The injected callback re-runs whenever a required service changes, so the
+ * reader guards it with its own disposal flag and owns the injected fiber: a
+ * disposed reader never registers again, and an older effect cleanup never
+ * clears a newer registration pointer.
+ */
+export declare class ExtensionProgressReader {
+    private readonly ctx;
+    private unregister;
+    private injection;
+    private disposed;
+    /** Settles once the current registration attempt has run; production reads do not await it. */
+    readonly ready: PromiseLike<unknown>;
+    /**
+     * Register the projection for the lifetime of the calling context.
+     * @param ctx - context whose fiber owns the registration.
+     */
+    constructor(ctx: Context);
+    /** True while this plugin's projection is registered in the live registry. */
+    get registered(): boolean;
+    /**
+     * Whether one session carries authored progress.
+     * @param session - session to answer for.
+     * @returns the folded answer, or the log scan when no registry is published.
+     */
+    read(session: Session): boolean;
+    /**
+     * Unregister the projection and release the injected fiber, so a registry that
+     * arrives or cycles later cannot register this reader again.
+     * @returns after the injected fiber has unloaded.
+     */
+    dispose(): Promise<void>;
+}

package/lib/types/packages/market-runtime/src/runtime/host/extension-runtime.d.ts

@@ -0,0 +1,77 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import { type ExtensionResource, type ExtensionSelection, type ExtensionPresetInput, type ExtensionWindowPayload, type ExtensionHooksOverview, type ExtensionHookRunInput, type ExtensionHookRunResult } from '../../../../market-contracts/src/contracts/extension-presets.js';
+import type { ExtensionRouteService } from '../../extension-service.js';
+import { ExtensionSessionState, type ExtensionApplyReceipt } from './extension-session-state.js';
+export interface ExtensionRuntimePorts {
+    dataRoot: string;
+    inventory(agent: Agent): Promise<ExtensionResource[]>;
+    applySelection(agent: Agent, selection: ExtensionSelection): Promise<void | ExtensionApplyReceipt>;
+    /** Whether this service governs one agent at all; absent governs every agent. */
+    eligible?(agent: Agent): boolean;
+    ready?(agent: Agent, source?: string): Promise<void>;
+    committed?(agent: Agent): void;
+    /** The sessionless Hooks overview the settings workspace renders; hook declarations belong to the user, not to a session. */
+    hooksOverview?(): Promise<ExtensionHooksOverview>;
+    /** Run one declared command hook as a dry run; the composition resolves the declaration and owns the shell. */
+    hookRun?(input: ExtensionHookRunInput): Promise<ExtensionHookRunResult>;
+}
+export declare function extensionWorkspace(agent: Agent): string;
+export declare class ExtensionRuntime implements ExtensionRouteService {
+    private readonly ctx;
+    private readonly ports;
+    readonly state: ExtensionSessionState;
+    private readonly store;
+    /** Folded session progress; the log scan is only the no-registry fallback. */
+    private readonly progress;
+    private readonly resources;
+    /** Agents whose cached inventory predates the current catalog; authorization fails closed until re-read. */
+    private readonly stale;
+    /** Bumped on every catalog change: a read that began earlier may not publish its answer. */
+    private epoch;
+    private readonly dirty;
+    /** Eligible inventory at the last successful rebuild; selection and current availability still gate every call. */
+    private readonly registeredIds;
+    private readonly appliedEpochs;
+    private readonly refreshing;
+    private readonly lifetime;
+    private disposed;
+    /** Per-agent read sequence: a slow earlier response must not overwrite a newer inventory. */
+    private readonly reads;
+    private readonly targets;
+    private readonly off;
+    constructor(ctx: Context, ports: ExtensionRuntimePorts);
+    start(): Promise<void>;
+    ready(agent: Agent): boolean;
+    allows(agent: Agent, resourceId: string, suiteId?: string): boolean;
+    private availableIds;
+    /** Registration alone may inspect a pending target; execution must call allows. */
+    registrationAllows(agent: Agent, resourceId: string, suiteId?: string): boolean;
+    private selected;
+    /**
+     * A catalog change can revoke a global resource at any moment, so every live
+     * agent's cached inventory is dropped and authorization denies until the
+     * inventory has been re-read from the new catalog. Callers never wait for a
+     * panel poll to observe a disable or uninstall.
+     */
+    invalidate(): void;
+    /** Re-read every live agent's inventory; an agent whose read fails stays denied. */
+    refreshAll(): Promise<void>;
+    private refreshAgent;
+    refreshInventory(agent: Agent): Promise<ExtensionResource[]>;
+    /** The settings Hooks tab: sessionless by design, so no agent is resolved and no session state is consulted. */
+    hooksOverview(): Promise<ExtensionHooksOverview>;
+    /** One declared hook's dry run: the composition resolves the command, this service only gates availability and forwards. */
+    hookRun(input: ExtensionHookRunInput): Promise<ExtensionHookRunResult>;
+    private agent;
+    private initialSelection;
+    window(sessionId: string): Promise<ExtensionWindowPayload>;
+    /** Recovery is an explicit, revision-checked act; it never invents a selection. */
+    recover(sessionId: string, revision: number): Promise<void>;
+    create(sessionId: string, revision: number, input: ExtensionPresetInput): Promise<void>;
+    update(sessionId: string, revision: number, id: string, input: ExtensionPresetInput): Promise<void>;
+    delete(sessionId: string, revision: number, id: string): Promise<void>;
+    setDefault(sessionId: string, revision: number, id: string | null): Promise<void>;
+    select(sessionId: string, revision: number, id: string | null): Promise<void>;
+    dispose(): Promise<void>;
+}

package/lib/types/packages/market-runtime/src/runtime/host/extension-session-state.d.ts

@@ -0,0 +1,242 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import '@deepseek-ai/dsh-session-query';
+import { z } from 'zod';
+import { type ExtensionSelection } from '../../../../market-contracts/src/contracts/extension-presets.js';
+export declare const EXTENSION_SESSION_SOURCE = "market-extension-selection";
+declare const bindingSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    ownerId: z.ZodString;
+    revision: z.ZodNumber;
+    phase: z.ZodEnum<{
+        pending: "pending";
+        committed: "committed";
+    }>;
+    requestRevision: z.ZodOptional<z.ZodNumber>;
+    selection: z.ZodObject<{
+        presetId: z.ZodNullable<z.ZodString>;
+        presetName: z.ZodNullable<z.ZodString>;
+        presetRevision: z.ZodNullable<z.ZodNumber>;
+        modified: z.ZodBoolean;
+        enabledIds: z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>;
+    }, z.core.$strict>;
+    recoveryOf: z.ZodOptional<z.ZodObject<{
+        ownerId: z.ZodString;
+        revision: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type Binding = z.infer<typeof bindingSchema>;
+/** The metadata marker that wakes a driver after a recovery; it never enters a request. */
+export declare const EXTENSION_SESSION_WAKE_SOURCE = "market-extension-wake";
+/** One durable request that becomes effective only at a safe boundary. */
+declare const intentSchema: z.ZodObject<{
+    ownerId: z.ZodString;
+    revision: z.ZodNumber;
+    selection: z.ZodObject<{
+        presetId: z.ZodNullable<z.ZodString>;
+        presetName: z.ZodNullable<z.ZodString>;
+        presetRevision: z.ZodNullable<z.ZodNumber>;
+        modified: z.ZodBoolean;
+        enabledIds: z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type Intent = z.infer<typeof intentSchema>;
+export declare const EXTENSION_INTENT_SOURCE = "market-extension-intent";
+declare module '@deepseek-ai/dsh-llm' {
+    interface MessageSourceMap {
+        'market-extension-selection': {
+            kind: 'market-extension-selection';
+            form: 'context';
+            binding: Binding;
+        };
+        'market-extension-wake': {
+            kind: 'market-extension-wake';
+            form: 'context';
+        };
+        'market-extension-intent': {
+            kind: 'market-extension-intent';
+            form: 'context';
+            intent: Intent;
+        };
+    }
+}
+export interface ExtensionSessionSnapshot {
+    revision: number;
+    selection: ExtensionSelection;
+}
+export interface ExtensionSessionStatus {
+    ready: boolean;
+    /** Latest attempted transaction, used as the recovery compare-and-swap revision. */
+    revision: number;
+    recoverable: boolean;
+    error?: string;
+    /** Recovery target when not ready; never an effective selection in that state. */
+    selection?: ExtensionSelection;
+}
+/**
+ * Optional lease on one applied selection.
+ *
+ * An adapter returns one when it applied an effect it can still undo: the state
+ * machine holds it until the committed binding is durable, then calls
+ * {@link ExtensionApplyReceipt.commit}. Every pre-durable failure calls
+ * {@link ExtensionApplyReceipt.rollback} instead, so an uncertain write never
+ * leaves a half-applied selection behind. Returning nothing keeps an adapter that
+ * owns its own rollback working unchanged.
+ */
+export interface ExtensionApplyReceipt {
+    /**
+     * Publish the applied effect. Synchronous by contract and must not throw: it runs
+     * inside the commit sequence after durability, where awaiting would reopen the
+     * window this transaction closes.
+     */
+    commit(): void;
+    /** Undo the applied effect. A rejection is a diagnostic, never a replacement for the original failure. */
+    rollback(): Promise<void>;
+}
+export interface ExtensionSessionStatePorts {
+    /** Use agent.session.header.cwd, never a client path. Legacy captures global choices, not a workspace default. */
+    initialSelection(agent: Agent, source?: string): Promise<ExtensionSelection>;
+    /**
+     * Replace the complete agent-local selection; resource gates must reject unavailable service state.
+     * Returns a receipt when the effect is still reversible, else nothing.
+     */
+    applySelection(agent: Agent, selection: ExtensionSelection): Promise<void | ExtensionApplyReceipt>;
+    /** Publish synchronous cache/schema invalidations after commit, before maintenance releases queued input. */
+    committed?(agent: Agent): void;
+    /**
+     * Whether this service governs one agent at all. Absent governs every agent,
+     * which is what a workspace-agnostic host and the service's own tests rely on.
+     * An agent the port rejects keeps its original host lifecycle: it is never
+     * tracked, never granted a selection, never cancelled, and its steps pass
+     * through untouched. An undecidable answer — the port throws — stays on the
+     * governed path, so an unknown agent is denied instead of silently allowed.
+     */
+    eligible?(agent: Agent): boolean;
+}
+/** Durable selections use known message envelopes; pending transactions reject replay after an uncertain failure. */
+export declare class ExtensionSessionState {
+    private readonly ctx;
+    private readonly ports;
+    private readonly states;
+    private readonly initializing;
+    private readonly checkpoints;
+    private readonly errors;
+    private readonly lifetime;
+    private readonly unavailable;
+    /** The capture classification each attempt used, so an explicit recovery replays it exactly. */
+    private readonly captureSources;
+    /** Durable requests waiting for a safe boundary; the last one received wins. */
+    private readonly intents;
+    /** The turn each pending request was made in: a boundary only exists in a later turn. */
+    private readonly intentTurns;
+    /** Per-agent order for requests and promotions, so no two of them interleave. */
+    private readonly requests;
+    /** The turn each agent last entered, so a request can record the turn it came from. */
+    private readonly currentTurns;
+    /** Single-flight promotion per agent: one turn boundary promotes once. */
+    private readonly promoting;
+    private readonly operations;
+    private readonly off;
+    private disposed;
+    private disposal?;
+    constructor(ctx: Context, ports: ExtensionSessionStatePorts);
+    /** Whether this service governs one agent; an undecidable answer stays governed. */
+    private governs;
+    /** Attach idle agents independently; busy agents remain denied until their current activity ends. */
+    start(): Promise<void>;
+    private attach;
+    /** Return diagnostics without exposing an unavailable snapshot as effective state. */
+    status(agent: Agent): ExtensionSessionStatus;
+    read(agent: Agent): ExtensionSessionSnapshot | undefined;
+    initialize(agent: Agent, source?: string, signal?: AbortSignal): Promise<void>;
+    private replay;
+    /** Run one capture through the adapter and commit it as revision 1. */
+    private capture;
+    private initializeOnce;
+    /**
+     * Recover only the validated last committed choice, or the original initial attempt.
+     *
+     * Never recapture defaults, with one exception: a capture that failed before it
+     * recorded anything has no record to protect, so an explicit recovery re-runs that
+     * capture with the classification the original attempt used.
+     */
+    recover(agent: Agent, expectedRevision: number): Promise<ExtensionSessionSnapshot>;
+    change(agent: Agent, expectedRevision: number, selection: ExtensionSelection, requestRevision?: number): Promise<ExtensionSessionSnapshot>;
+    /**
+     * Accept one selection request.
+     *
+     * An idle agent commits immediately through the ordinary transaction. While a
+     * turn owns the agent the request is only written durably: the effective
+     * selection, every gate and every mount keep reading the committed snapshot
+     * until a safe boundary promotes it, so nothing is staged or swapped while the
+     * current turn's tools are live.
+     * @param agent - the agent the selection belongs to.
+     * @param expectedRevision - the revision the caller believes is current: the committed revision or the pending request's revision.
+     * @param selection - the requested selection.
+     * @returns whether it applied now, and the revision a caller compares against next.
+     */
+    requestSelection(agent: Agent, expectedRevision: number, selection: ExtensionSelection): Promise<{
+        applied: boolean;
+        revision: number;
+    }>;
+    /** Join the current selection writer, not the active user turn; failures remain visible through status. */
+    whenSelectionSettled(agent: Agent): Promise<void>;
+    /** Public compare-and-swap token, independent of the sequential binding journal. */
+    selectionRevision(agent: Agent): number;
+    /** The pending request, for a caller that shows the intended selection. */
+    intended(agent: Agent): {
+        selection: ExtensionSelection;
+        revision: number;
+    } | undefined;
+    /**
+     * Make the pending request effective: durable request first, then the effect,
+     * then the committed twin and the published snapshot, exactly like a change.
+     * Single-flight per agent, so one boundary promotes once.
+     * @param agent - the agent whose pending request becomes effective.
+     */
+    promote(agent: Agent): Promise<void>;
+    private promoteNow;
+    /**
+     * Promote from the idle phase, for a turn that never reached a clean stop and a
+     * request that raced the boundary. Re-wakes parked input so the same request
+     * re-runs under the promoted selection.
+     */
+    private promoteAfterIdle;
+    /**
+     * Whether the host reports this agent idle. The call keeps the answer opaque to
+     * control-flow narrowing, which a direct property comparison cannot.
+     */
+    private isIdle;
+    /**
+     * Run one task at a time per agent. Each task starts after the previous settled,
+     * whether it succeeded or failed, so a rejected write never blocks the next one.
+     */
+    private serialize;
+    private persistIntent;
+    private maintenance;
+    private track;
+    /**
+     * Start the driver for input stranded while this service denied the session.
+     *
+     * The stranded messages are already queued, so the wake carries no payload: the
+     * marker is plugin metadata the same pre-step guard filters, and `steer` is the
+     * published way to start a driver without cancelling live work (published
+     * semantics: a wake during maintenance latches and replays at convergence).
+     * Callers run it only after a committed recovery or a successful busy retry, and
+     * this guard makes that common: an unavailable or disposed session must never
+     * open a turn, so the check here is the single place that decides.
+     */
+    private wake;
+    private fail;
+    private persist;
+    private commit;
+    /**
+     * Undo an applied-but-not-durable effect. A cleanup failure is reported as a
+     * diagnostic: the original error is what the caller acts on, so it is never
+     * replaced by whatever went wrong while unwinding.
+     */
+    private rollbackApplied;
+    dispose(): Promise<void>;
+    private finishDisposal;
+}
+export {};

package/lib/types/packages/market-runtime/src/runtime/host/extension-tool-gates.d.ts

@@ -0,0 +1,38 @@
+import type { Agent } from '@deepseek-ai/dsh-agent';
+export interface ExtensionToolResource {
+    resourceId: string;
+    suiteId?: string;
+}
+export interface ExtensionMcpTool extends ExtensionToolResource {
+    name: string;
+    /** Exact object supplied to ToolRuntime.register, not an inferred public-name prefix. */
+    definition: {
+        readonly name: string;
+    };
+    /** Registration scope; undefined is global. Own-scope visibility is controlled by the mount owner. */
+    scope: object | undefined;
+}
+export interface ExtensionLspProvider extends ExtensionToolResource {
+    extensions: readonly string[];
+}
+export interface ExtensionToolOwnership {
+    mcpTools(): readonly ExtensionMcpTool[];
+    lspProviders(): readonly ExtensionLspProvider[];
+    ownsLspTool(): boolean;
+}
+export interface ExtensionToolPolicy {
+    ready(agent: Agent): boolean;
+    allows(agent: Agent, resourceId: string, suiteId?: string): boolean;
+}
+export interface ExtensionToolGates {
+    /** Refresh presentation after acknowledged selection changes or provider reconciliation. */
+    refresh(): void;
+    /** Release only this agent's restrictions, guards and listener; shared servers remain untouched. */
+    dispose(): void;
+}
+/**
+ * Filter inherited extension tools and guard Native/PTC execution using the public rc.2 runtime.
+ * Policy errors and unready sessions deny owned capabilities. Project MCP mounts in the agent's
+ * own scope must also filter their wanted rows: host restrictions do not hide own-scope tools.
+ */
+export declare function attachExtensionToolGates(agent: Agent, ownership: ExtensionToolOwnership, policy: ExtensionToolPolicy): ExtensionToolGates;

package/lib/types/{runtime → packages/market-runtime/src/runtime}/host/host-locale.d.ts

@@ -13,7 +13,7 @@
  * active, no preference written, a value that is not a string — means zh.
  */
 /** Host runtime dictionary keys (mirrored for zh and en). */
-export type HostLocaleKey = 'commandAcknowledged' | 'userCommandSourceLabel' | 'feedbackToolCardTitle';
+export type HostLocaleKey = 'commandAcknowledged' | 'commandNotSelected' | 'userCommandSourceLabel' | 'feedbackToolCardTitle';
 export type HostTranslate = (key: HostLocaleKey, params?: Record<string, string>) => string;
 /**
  * The settings entry the harness locale plugin owns. The web bundle patch

package/lib/types/packages/market-runtime/src/runtime/host/menu-row-identities.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The `/` menu's row identities: which rows this plugin owns, and the panel
+ * entry each one translates as.
+ *
+ * Two halves have to meet, and neither can see the other. The runtime command
+ * registries know the call name a command actually got — allocation may have
+ * suffixed it — but nothing about translation. The panels own the id and the
+ * authored text a translation is cached under, because they are what queued it.
+ *
+ * The join happens here, on the panel's own output: a registration names the
+ * panel id it belongs to, and this looks that entry up and copies the text the
+ * panel handed the translator. Deriving the text again would risk a different
+ * spelling than the one the cache key was built from, which shows up as the
+ * same prose translated — and paid for — twice.
+ *
+ * The skill half needs no registry: a skill's menu name is the name the panel
+ * lists it under, so the panel read is the whole answer.
+ * @module runtime/host/menu-row-identities
+ */
+import type { MenuRowIdentity } from '../../../../market-contracts/src/ports/ports.js';
+import type { PanelResourceStore } from '../../application/panel-resources.js';
+/** One live command registration: the menu row's call name and the panel entry behind it. */
+export interface MenuRowRegistration {
+    /** The call name the `/` menu row carries. */
+    readonly name: string;
+    /** The panel identity the same document is listed and translated under. */
+    readonly id: string;
+}
+/** What the join reads. */
+export interface MenuRowIdentitySource {
+    /** The panels whose entries back the menu rows (the same stores the panel UI reads). */
+    readonly panels: {
+        skills: PanelResourceStore;
+        commands: PanelResourceStore;
+    };
+    /** Every live command registration, from the user and suite registries. */
+    readonly commands: readonly MenuRowRegistration[];
+}
+/**
+ * Pair the installed and user-authored entries this plugin owns with the menu
+ * rows they appear as.
+ *
+ * A command whose registration has no panel entry is skipped rather than
+ * guessed at: without the panel's own text there is no id to share and no
+ * translation to show. A skill the panel lists contributes whatever translation
+ * the panel already resolved for it.
+ * @param source - the panels to read and the live command registrations to match.
+ * @returns one identity per owned menu row.
+ */
+export declare function collectMenuRowIdentities(source: MenuRowIdentitySource): Promise<MenuRowIdentity[]>;

package/lib/types/{runtime → packages/market-runtime/src/runtime}/host/model-catalog.d.ts

@@ -1,4 +1,4 @@
-import type { ModelCatalogPayload } from '../../contracts/market.js';
+import type { ModelCatalogPayload } from '../../../../market-contracts/src/contracts/market.js';
 interface ModelCatalogHost {
     get?(name: string): unknown;
 }