dsh-agent-plugins-market 0.9.2 → 0.11.0

package/lib/packages/market-mcp/src/runtime/mcp/bridge/oauth.js

@@ -132,6 +132,14 @@ export class LoopbackOAuthClientProvider {
     expectedState;
     /** Resolves `true` when the leg saved tokens, `false` when it failed; undefined while no leg is open. */
     browserLegSettled;
+    /**
+     * Outcome of the most recently finished browser leg, `true` when the code
+     * exchange saved tokens. The pending-leg promise disappears when the leg
+     * settles, and a leg that finishes inside the `connect` that raised the
+     * `401` leaves nothing pending for a supervisor to observe — this field is
+     * how the supervisor still learns that the authorization succeeded.
+     */
+    lastLegOutcome;
     callbackServer;
     callbackTimer;
     boundPort;
@@ -149,7 +157,10 @@ export class LoopbackOAuthClientProvider {
     get redirectUrl() {
         // RFC 8252 §7.3: loopback redirects may vary the port per request, so the
         // bound port is filled in when the listener starts and registration
-        // metadata always reflects the current attempt's URL.
+        // metadata always reflects the current attempt's URL. The value must keep
+        // reading as the bound port until the code exchange finishes: the token
+        // request repeats this exact URL (RFC 6749 §4.1.3), and an authorization
+        // server that compares it with the authorization request rejects port `0`.
         return `http://127.0.0.1:${this.boundPort ?? this.storage.callbackPort ?? 0}/callback`;
     }
     get clientMetadata() {
@@ -214,6 +225,12 @@ export class LoopbackOAuthClientProvider {
             return;
         }
         finally {
+            // The loopback URL stays published until here. Clearing the port when
+            // the callback arrives would hand the token endpoint `redirect_uri =
+            // http://127.0.0.1:0/callback` while the authorization request carried
+            // the real port, which RFC 6749 §4.1.3 forbids and servers enforce.
+            this.boundPort = undefined;
+            this.lastLegOutcome = succeeded;
             this.browserLegSettled?.resolve(succeeded);
             this.browserLegSettled = undefined;
         }
@@ -232,6 +249,14 @@ export class LoopbackOAuthClientProvider {
     get browserLeg() {
         return this.browserLegSettled?.promise;
     }
+    /**
+     * The most recent finished leg's outcome; `undefined` until one finishes.
+     * The supervisor reads it after a failed attempt: a leg that settled inside
+     * the attempt itself leaves no pending {@link browserLeg} behind.
+     */
+    get lastBrowserLegOutcome() {
+        return this.lastLegOutcome;
+    }
     /**
      * Register the transport generation whose `finishAuth` completes the flow.
      * The transport calls `redirectToAuthorization` during `connect`; binding
@@ -420,7 +445,9 @@ export class LoopbackOAuthClientProvider {
         }
         this.clearCallbackTimer();
         this.callbackServer = undefined;
-        this.boundPort = undefined;
+        // The bound port deliberately survives this callback: the code exchange
+        // runs a moment later and must present the same `redirect_uri` the
+        // authorization request used. An aborted leg clears it in resetCallback.
         this.expectedState = undefined;
         if (oauthError !== null) {
             const description = redactErrorMessage(url.searchParams.get('error_description') ?? '');

package/lib/packages/market-mcp/src/runtime/mcp/bridge/transport.js

@@ -33,11 +33,11 @@ function hasStaticAuthorization(headers) {
  * when the config opts out or the headers already carry a static
  * Authorization.
  */
-function buildOAuthProvider(config, credentials, log) {
+function buildOAuthProvider(config, credentials, log, opener) {
     const auth = config.auth;
     if (auth?.enabled === false || hasStaticAuthorization(config.headers))
         return undefined;
-    return new LoopbackOAuthClientProvider(config.serverName, auth?.storage ?? {}, auth?.scope, log, credentials);
+    return new LoopbackOAuthClientProvider(config.serverName, auth?.storage ?? {}, auth?.scope, log, credentials, opener);
 }
 /**
  * Create an MCP transport from the resolved bridge config.
@@ -54,11 +54,14 @@ function buildOAuthProvider(config, credentials, log) {
  * @param credentials - The composition's credential store, when mounted; OAuth
  *   state persists only when it is.
  * @param log - Diagnostic sink for the human leg of the flow.
+ * @param opener - Browser opener for the OAuth human leg; the platform browser
+ *   by default. A caller that owns the human leg (a host surface, or a test
+ *   driving the authorization endpoint directly) passes its own.
  * @returns The transport plus its OAuth provider, when active — the
  *   supervisor queries the provider to hold the generation open while a
  *   browser leg is pending.
  */
-export function createTransport(config, credentials, log = () => { }) {
+export function createTransport(config, credentials, log = () => { }, opener) {
     switch (config.transport) {
         case 'stdio':
             return {
@@ -71,7 +74,7 @@ export function createTransport(config, credentials, log = () => { }) {
                 oauthProvider: undefined
             };
         case 'streamable-http': {
-            const oauthProvider = buildOAuthProvider(config, credentials, log);
+            const oauthProvider = buildOAuthProvider(config, credentials, log, opener);
             // The MCP SDK's StreamableHTTPClientTransport has optional callback
             // properties typed without `| undefined` (exactOptionalPropertyTypes
             // mismatch with the Transport interface); the SDK constructed the
@@ -86,7 +89,7 @@ export function createTransport(config, credentials, log = () => { }) {
             return { transport, oauthProvider };
         }
         case 'sse': {
-            const oauthProvider = buildOAuthProvider(config, credentials, log);
+            const oauthProvider = buildOAuthProvider(config, credentials, log, opener);
             // The legacy SSE transport negotiates a separate endpoint POST channel.
             // The SDK applies `requestInit.headers` to both the stream request and
             // every endpoint POST (its `_commonHeaders` merge), so no separate

package/lib/packages/market-runtime/src/runtime/agents/agent-role-router.js

@@ -6,6 +6,7 @@ import { isAbsentPath } from '../../application/fs-probe.js';
 import { namedAgentRoles } from './agent-role-names.js';
 import { expandPluginPaths } from '../../../../market-catalog/src/index.js';
 import { parseAgentRole } from '../../application/agent-roles.js';
+import { startContinuableChild } from './subagent-seam.js';
 export { parseAgentRole };
 export const AGENT_ROLE_TOOL_NAME = 'subagent_role';
 /**
@@ -217,7 +218,7 @@ export async function executeAgentRole(host, listRoles, agentName, prompt, paren
         ...(agentOptions === undefined ? {} : { agentOptions })
     };
     if (mode === 'continuable') {
-        const started = await host.subagents.startContinuable({ provider: 'spawn', label: agentName, request, signal });
+        const started = await startContinuableChild(host.subagents, { provider: 'spawn', label: agentName, request, signal });
         return { kind: 'continuable', subagentId: started.childId };
     }
     const run = await host.subagents.start('spawn', { ...request, signal });

package/lib/packages/market-runtime/src/runtime/agents/subagent-seam.js

@@ -0,0 +1,29 @@
+/**
+ * Start one continuable child on whichever start member the host exposes.
+ * @param seam - the live `ctx.subagents` service.
+ * @param input - provider, label, delegation request, and cancellation.
+ * @returns the child identity the host reserved.
+ * @throws when the host exposes neither start member.
+ */
+export function startContinuableChild(seam, input) {
+    if (typeof seam.startContinuable === 'function')
+        return seam.startContinuable(input);
+    if (typeof seam.startActivation === 'function')
+        return seam.startActivation({ ...input, delivery: 'parent' });
+    return Promise.reject(new Error('the host subagent service exposes neither startContinuable nor startActivation'));
+}
+/**
+ * Release selected resident continuable children on whichever drain member the
+ * host exposes.
+ * @param seam - the live `ctx.subagents` service.
+ * @param parent - exact live direct parent authorizing the release.
+ * @param childIds - durable direct-child ids to release when resident.
+ * @throws when the host exposes neither drain member.
+ */
+export function drainContinuableChildIds(seam, parent, childIds) {
+    if (typeof seam.drainContinuableChildren === 'function')
+        return seam.drainContinuableChildren(parent, childIds);
+    if (typeof seam.drainChildren === 'function')
+        return seam.drainChildren(parent, childIds);
+    return Promise.reject(new Error('the host subagent service exposes neither drainContinuableChildren nor drainChildren'));
+}

package/lib/packages/market-runtime/src/runtime/agents/teammate-role-runtime.js

@@ -4,6 +4,7 @@ import { installModelSelection } from '@deepseek-ai/dsh-agent';
 import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { foldSubagentDescriptor } from '@deepseek-ai/dsh-subagent';
 import { z } from 'zod';
+import { drainContinuableChildIds } from './subagent-seam.js';
 const PROVIDER = 'market-role-team';
 export const TEAM_ROLE_SOURCE = 'teammate-role-binding';
 const routeSchema = z.object({ provider: z.string().min(1), model: z.string().min(1), reasoningEffort: z.string().min(1).optional() }).strict();
@@ -79,10 +80,15 @@ export class TeammateRoleRuntime {
         this.ctx = ctx;
         this.teams = ctx.get('agentTeams');
         this.subagents = ctx.get('subagents');
+        // The 0.2.1-alpha.4 host removed `toolFilter` and `persona` from the capability
+        // record and added `agentPreset`; the 0.2.0-rc.2 baseline types require the first
+        // two. One variable satisfies both shapes because the host reads only the flags
+        // it knows, while an object literal would fail the newer excess-property check.
+        const capabilities = { agentOptions: false, agentPreset: false, outputSchema: false, depthLimit: false, toolFilter: false, persona: false };
         this.registrations.push(this.subagents.registerProvider({
             name: PROVIDER,
             inheritsParentContext: false,
-            capabilities: { agentOptions: false, outputSchema: false, depthLimit: false, toolFilter: false, persona: false },
+            capabilities,
             start: () => Promise.reject(new Error('role teammates require Team continuation')),
             prepareContinuable: request => {
                 const pending = this.pending.getStore();
@@ -227,7 +233,7 @@ export class TeammateRoleRuntime {
                 byParent.set(parent, [...(byParent.get(parent) ?? []), agent.id]);
         }
         try {
-            await Promise.all([...byParent].map(([parent, ids]) => this.subagents.drainContinuableChildren(parent, ids)));
+            await Promise.all([...byParent].map(([parent, ids]) => drainContinuableChildIds(this.subagents, parent, ids)));
         }
         finally {
             for (const off of this.registrations.splice(0).reverse())

package/lib/packages/market-runtime/src/runtime/core/reconciler.js

@@ -111,6 +111,18 @@ export class RuntimeReconciler {
     mcpServerOwner(serverName) {
         return this.mcp.serverOwner(serverName);
     }
+    /**
+     * The suite/server pairs a live session's selection keeps mounted.
+     *
+     * This is the demand the mount pass merged in as `enabled: true`, so a server
+     * listed here stays live however its stored override reads. The MCP status
+     * surface needs it to tell a server its user switched off — kept mounted by
+     * that user's own preset — from one whose teardown genuinely failed.
+     * @returns the demanded pairs, in suite-then-server order.
+     */
+    demandedMcpMounts() {
+        return [...this.demandedMcp].flatMap(([suiteId, keys]) => [...keys].map(serverKey => ({ suiteId, serverKey })));
+    }
     /** Publish fresh immutable authority without mounting or waiting behind network work. */
     setCatalogAuthority(candidates, global) {
         if (this.disposed)

package/lib/packages/market-runtime/src/runtime/host/scoped-contributors.js

@@ -98,6 +98,10 @@ export class ScopedExtensionContributors {
             scope.systemPrompt.section({
                 name: 'agent-plugins:instructions',
                 order: 500,
+                // Suite-authored Markdown is literal text, never a template: the host
+                // interpolates by default and refuses an unknown `{{name}}`, so a suite
+                // that quotes `{{cwd}}` would fail prompt assembly before any request.
+                interpolate: false,
                 text: () => mount.active
                     ? mount.instructions
                         .filter(row => this.ports.allows(agent, row.parent) && this.ports.allows(agent, row.id))

package/lib/packages/market-runtime/src/runtime/surfaces/project-runtime.js

@@ -28,7 +28,10 @@ suiteAllowed) {
     return mountProjectSurface(ctx, catalog, 'systemPrompt', (scope, agent) => {
         let text = '';
         const host = scope;
-        const dispose = host.systemPrompt.section({ name: 'agent-plugins:instructions', order: 500, text: () => text });
+        // Suite-authored Markdown is literal text, never a template: the host
+        // interpolates by default and refuses an unknown `{{name}}`, so a suite that
+        // quotes `{{cwd}}` would fail prompt assembly before any model request.
+        const dispose = host.systemPrompt.section({ name: 'agent-plugins:instructions', order: 500, interpolate: false, text: () => text });
         return {
             async reconcile(projectSuites) {
                 const projectDir = agent.session.header.cwd;

package/lib/types/packages/market-bundle/src/application/catalog.d.ts

@@ -181,6 +181,12 @@ export declare class Catalog implements MarketService {
     mcpStatus(): Promise<McpStatusPayload>;
     /** Validate and persist a user-owned MCP service with optional policy before reconciling its mount. */
     addMcpServer(name: string, server: unknown, policy?: unknown): Promise<void>;
+    /**
+     * Remove one user-owned MCP service, its override record, and its OAuth
+     * grant. A server a suite declares is refused: that declaration is
+     * source-owned, so disabling it is the supported operation.
+     */
+    removeMcpServer(suiteKey: string, serverKey: string): Promise<void>;
     /**
      * Read a service without credential literals, or an unsaved template when
      * `create` is true. The two transports have separate owners, so this facade

package/lib/types/packages/market-bundle/src/index.d.ts

@@ -40,7 +40,7 @@ export interface Config {
     autoUpdateSources: Volatile<boolean | undefined>;
     /** UI translation switch; updated live through the host settings service. */
     translationEnabled: Volatile<boolean | undefined>;
-    /** Agent preset manager switch (experimental); updated live through the host settings service. */
+    /** Agent preset manager switch; updated live through the host settings service. */
     agentPresetsEnabled: Volatile<boolean | undefined>;
 }
 /**

package/lib/types/packages/market-bundle/src/platform/settings-namespace.d.ts

@@ -8,9 +8,7 @@
  * Every consumer reads through {@link MarketSettingsNamespace.settings} so
  * "the field is absent" has exactly one answer —
  * {@link resolveMarketSettings} — instead of each caller inventing its own
- * fallback for the window before the host applies its first value. That reader
- * also takes the interface language, because one field's default follows it
- * rather than a constant.
+ * fallback for the window before the host applies its first value.
  *
  * @module runtime/settings-namespace
  */
@@ -58,12 +56,6 @@ export declare class MarketSettingsNamespace {
     private readonly dataRoot;
     private readonly locale;
     private readonly host;
-    /**
-     * The host interface language, read per call. It is a reader rather than a
-     * captured string because a language switch must move the translation
-     * default without rebuilding this namespace.
-     */
-    private readonly localePreference;
     private readonly refs;
     private readonly watchers;
     private feedbackDisposer;
@@ -76,20 +68,14 @@ export declare class MarketSettingsNamespace {
     private feedbackMountState;
     constructor(ctx: Context, refs: MarketSettingRefs, dataRoot: string, locale: {
         t: HostTranslate;
-    }, host: SettingsNamespaceHost, 
-    /**
-     * The host interface language, read per call. It is a reader rather than a
-     * captured string because a language switch must move the translation
-     * default without rebuilding this namespace.
-     */
-    localePreference: () => string);
+    }, host: SettingsNamespaceHost);
     /** Subscribe the runtime reactions to live settings updates. */
     mount(): void;
     /** Release every watcher and unmount the feedback tool. */
     dispose(): void;
     /**
      * The resolved settings, from the volatile references the host updates in
-     * place and the interface language they resolve over.
+     * place. A field whose reference has no value yet takes the contract default.
      */
     private settings;
     /** The persisted MCP backend choice; the built-in client until the host applies a value. */
@@ -104,7 +90,7 @@ export declare class MarketSettingsNamespace {
     downloadRegion(): Promise<DownloadRegionSetting>;
     /**
      * Read the live translation switch: the stored preference while the user has
-     * one, the interface language's default otherwise.
+     * one, the plugin default (on) otherwise.
      */
     translationEnabled(): boolean;
     /**

package/lib/types/packages/market-bundle/src/platform/settings-schema.d.ts

@@ -5,12 +5,12 @@ import z from '@deepseek-ai/schemastery';
  * belong to {@link MARKET_SETTINGS_DEFAULTS}; this schema states them, it does
  * not own them.
  *
- * `translationEnabled` deliberately declares no default. Its default follows
- * the interface language, and a declared default would be materialized into the
- * live config reference, where "the user never set this" and "the user turned it
- * off" would both read `false` — the distinction the derivation rests on. With
- * the field absent, the reference answers `undefined` until the user writes it,
- * and {@link resolveMarketSettings} fills the language's own default in.
+ * `translationEnabled` deliberately declares no default. A declared default
+ * would be materialized into the live config reference, where "the user never
+ * set this" and "the user turned it off" would both read the same boolean, and
+ * the card could no longer tell the two states apart. With the field absent,
+ * the reference answers `undefined` until the user writes it, and
+ * {@link resolveMarketSettings} answers the plugin default for that case.
  */
 export declare const MarketSettingsFields: {
     readonly mcpEnhanced: z<boolean, boolean, "defined">;

package/lib/types/packages/market-contracts/src/contracts/market.d.ts

@@ -8,6 +8,7 @@ export declare const MARKET_ROUTES: {
     readonly setSurfaceToggle: "/api/agent-plugins/surface-toggles/set";
     readonly mcpStatus: "/api/agent-plugins/mcp-status";
     readonly addMcpServer: "/api/agent-plugins/mcp-servers/add";
+    readonly removeMcpServer: "/api/agent-plugins/mcp-servers/remove";
     readonly lspStatus: "/api/agent-plugins/lsp-status";
     readonly lspServers: "/api/agent-plugins/lsp-servers";
     readonly addLspServer: "/api/agent-plugins/lsp-servers/add";

package/lib/types/packages/market-contracts/src/contracts/mcp-status.d.ts

@@ -21,10 +21,26 @@ export type McpStatusState = 'connected' | 'degraded' | 'failed' | 'needs-creden
 export type McpStatusCode = 'unsupported-transport' | 'missing-credential' | 'credential-error' | 'unmount-failed' | 'mount-failed' | 'foreign-mount' | 'duplicate-mount'
 /** Tools are still registered although the surface that declared them is gone. */
  | 'orphaned-tools'
+/** Switched off through an override record, and still mounted because the active session selection demands it. */
+ | 'preset-demand'
 /** Switched off through this plugin's own override record. */
  | 'disabled-override'
 /** A stored override changed the configuration the suite declares. */
  | 'modified-override';
+/**
+ * One MCP suite/server pair a live session's selection keeps mounted.
+ *
+ * The mount pass merges session demand into the overrides as `enabled: true`,
+ * so a pair listed here is live whatever its stored switch says. The status
+ * surface reads the list to name that cause instead of reporting orphaned
+ * tools.
+ */
+export interface McpDemandedMount {
+    /** Source-qualified suite id, as the status rows carry it. */
+    suiteId: string;
+    /** The server's key inside that suite's declaration. */
+    serverKey: string;
+}
 /** One MCP service row for the status surface. */
 export interface McpStatusEntry {
     id: string;

package/lib/types/packages/market-contracts/src/contracts/settings.d.ts

@@ -9,11 +9,10 @@
  * resolved values off the settings snapshot it is handed. Changing a default is
  * therefore a one-line edit in this module.
  *
- * One default is not a constant: `translationEnabled` follows the interface
- * language, so its reader takes the language as an argument and
- * {@link interfaceLanguageTranslates} answers that default only. An explicit
- * preference is independent of language. {@link resolveTranslationTarget}
- * selects the language of displayed translations, including English.
+ * Every default is a plain boolean or word, so this module alone answers a
+ * section that says nothing. {@link resolveTranslationTarget} still selects the
+ * language translations are written in; that choice is independent of whether
+ * translations are displayed.
  *
  * @module contracts/settings
  */
@@ -33,13 +32,9 @@ export interface MarketSettings {
     feedbackEnabled: boolean;
     /** ON = every configured source refreshes in the background. */
     autoUpdateSources: boolean;
-    /**
-     * ON = suite, skill, command, agent, MCP and LSP text is localized for the
-     * host locale. The stored value while the user has one, the interface
-     * language's default otherwise.
-     */
+    /** ON = suite, skill, command, agent, MCP and LSP text is localized for the host locale. */
     translationEnabled: boolean;
-    /** ON = the composer carries the Agent preset manager entry (experimental). */
+    /** ON = the composer carries the Agent preset manager entry. */
     agentPresetsEnabled: boolean;
 }
 /**
@@ -48,14 +43,11 @@ export interface MarketSettings {
  * These are user-visible behavior: a flip here is a behavior change that ships
  * with its documentation, not a private implementation detail.
  *
- * `translationEnabled` is the one exception: the interface language decides it
- * (see {@link interfaceLanguageTranslates}), so this constant is not where its
- * effective default lives. It is what the browser store holds before the host
- * answers, and that pre-answer state deliberately withholds the translation
- * control rather than flashing it. The namespace schema declares no default for
- * the field at all, an absence that is load-bearing: a schema default would
- * reach the live config reference and erase the difference between "the user
- * never set this" and "the user turned it off".
+ * `translationEnabled` is the one field the namespace schema declares no
+ * default for. The field stays absent until the user writes it, which is what
+ * lets the card tell "never set" from an explicit value, and this constant
+ * answers the absent case. A schema default would reach the live config
+ * reference and erase that difference.
  */
 export declare const MARKET_SETTINGS_DEFAULTS: MarketSettings;
 /** Every field name the market's settings section carries. */
@@ -67,20 +59,6 @@ export type MarketSettingKey = keyof MarketSettings;
  * @param fallback - the value an unrecognized input reads as.
  */
 export declare function narrowDownloadRegion(value: unknown, fallback?: DownloadRegionSetting): DownloadRegionSetting;
-/**
- * Whether one interface language renders the market's Chinese dictionary.
- *
- * This is the host's own rule rather than a second reading of it:
- * `bindHostLocale` (`runtime/host/host-locale.ts`) answers every preference
- * that is not English with the Chinese dictionary, so as far as the interface is
- * concerned everything that is not English is Chinese — an absent preference
- * included, which the host reads as zh.
- *
- * This determines only the default display preference: Chinese starts on and
- * English starts off. It must not gate an explicitly enabled translation.
- * @param localePreference - the host `locale.preference`, or undefined while nothing supplies one.
- */
-export declare function interfaceLanguageTranslates(localePreference: string | undefined): boolean;
 /**
  * The language the interface renders, as the translation chain names it.
  *
@@ -111,11 +89,9 @@ export declare function resolveTranslationTarget(localePreference: string | unde
  * function is what keeps a second reading of "what does missing mean" from
  * growing somewhere else.
  *
- * A stored boolean always wins: the user's own answer is never overridden by
- * the language. Only a section that says nothing about the field takes the
- * language's answer, which is what makes a language switch move the default for
- * a user who never set the field and leave every other user alone.
+ * A stored value always wins: the user's own answer is never overridden by a
+ * default. Only a section that says nothing about the field takes the value in
+ * {@link MARKET_SETTINGS_DEFAULTS}.
  * @param section - the stored (or absent) namespace section, untrusted.
- * @param localePreference - the host `locale.preference` the language-derived default follows.
  */
-export declare function resolveMarketSettings(section: unknown, localePreference?: string): MarketSettings;
+export declare function resolveMarketSettings(section: unknown): MarketSettings;

package/lib/types/packages/market-contracts/src/ports/ports.d.ts

@@ -14,6 +14,7 @@ import type { MenuRowSource } from '../contracts/market.js';
 export type { McpBackendInfo } from '../contracts/market.js';
 import type { DownloadRegionSetting } from '../contracts/settings.js';
 import type { McpBackend } from '../contracts/mcp.js';
+import type { McpDemandedMount } from '../contracts/mcp-status.js';
 import type { LspMountDiagnostic } from '../contracts/lsp.js';
 import type { DocumentTranslation, TranslationFields, TranslationProvider, TranslationSurfaceKind } from '../contracts/translation.js';
 /**
@@ -135,6 +136,16 @@ export interface CatalogPorts {
         suiteId: string;
         serverKey: string;
     } | undefined;
+    /**
+     * The suite/server pairs a live session's selection keeps mounted.
+     *
+     * Session demand is merged into the mount pass as `enabled: true`, so these
+     * servers stay live whatever their stored override says. The status surface
+     * reads them to report such a server as disabled and demanded rather than as
+     * tools left behind by a failed teardown. Optional: a composition with no
+     * session layer demands nothing, and the status reads exactly as before.
+     */
+    mcpDemandedMounts?: (() => readonly McpDemandedMount[]) | undefined;
     /** Latest LSP mount diagnostics. */
     lspStatusSource: LspMountStatusSource;
     /** The persisted MCP mount backend choice. */

package/lib/types/packages/market-contracts/src/ports/queries.d.ts

@@ -43,6 +43,8 @@ export interface MarketQueries {
 export interface MarketMutations {
     saveServerConfig(kind: 'mcp' | 'lsp', id: string, config: unknown, policy?: unknown): Promise<void>;
     addMcpServer(name: string, server: unknown, policy?: unknown): Promise<void>;
+    /** Remove one user-owned MCP server declaration; a suite-owned server is refused. */
+    removeMcpServer(suiteKey: string, serverKey: string): Promise<void>;
     addLspServer(name: string, config: unknown): Promise<void>;
     addSource(input: SourceInput): Promise<SourceRef>;
     updateSource(sourceId: string, patch: SourcePatch): Promise<void>;

package/lib/types/packages/market-mcp/src/application/mcp/mcp-direct-config.d.ts

@@ -27,5 +27,17 @@ export declare function addUserMcpServer(agentsRoot: string, name: string, serve
  * once, within the same serialized mutation, after any policy has been saved.
  */
 export declare function prepareUserMcpServer(agentsRoot: string, name: string, server: unknown): Promise<() => Promise<void>>;
+/**
+ * Validate a removal without publishing it. Call the returned atomic write once,
+ * within the same serialized mutation, after the plan is settled.
+ *
+ * The file is re-read rather than rebuilt from the parsed suite: rebuilding
+ * would drop top-level keys this client does not model and rewrite the other
+ * declarations into the parsed shape, while a removal must change exactly one
+ * key. A file the loader rejected is refused here for the same reason creation
+ * refuses it — the write would otherwise discard a declaration nothing could
+ * read.
+ */
+export declare function prepareUserMcpServerRemoval(agentsRoot: string, name: string): Promise<() => Promise<void>>;
 /** The user's hand-written MCP declaration file: `<agentsRoot>/mcp.json`. */
 export declare function userMcpPath(agentsRoot: string): string;

package/lib/types/packages/market-mcp/src/application/mcp/mcp-status.d.ts

@@ -1,5 +1,5 @@
 import type { McpSuiteOverrides } from './mcp-overrides.js';
-import type { McpStatusCode, McpStatusPayload } from '../../../../market-contracts/src/contracts/mcp-status.js';
+import type { McpDemandedMount, McpStatusCode, McpStatusPayload } from '../../../../market-contracts/src/contracts/mcp-status.js';
 import type { Localization, McpToolSnapshot } from '../../../../market-contracts/src/ports/ports.js';
 import type { Suite } from '../../../../market-contracts/src/model/types.js';
 export type { McpStatusEntry, McpStatusPayload, McpStatusKind, McpStatusState } from '../../../../market-contracts/src/contracts/mcp-status.js';
@@ -35,6 +35,12 @@ export declare function declaresAuthHeader(config: Record<string, unknown> | und
  * resolver bound to it, when the deployment translates at all. Resolved once by
  * the caller: a server and each of its tools is localized from this one value,
  * never from a fresh read of the host preference.
+ * @param demanded - the suite/server pairs a live session's selection keeps
+ * mounted. The mount pass merged them in as `enabled: true`, so a stored
+ * `enabled: false` beside live tools has two possible causes: this demand, or
+ * a teardown that failed. Only the caller knows the demand, so it travels
+ * here; an omitted list means nothing is demanded and every such row keeps
+ * reading as an orphan.
  * @returns the status payload with every translatable field carrying its translation.
  */
-export declare function buildMcpStatus(suites: Suite[], diagnostics: McpDiagnostic[], observed: readonly McpToolSnapshot[], overrides?: Map<string, McpSuiteOverrides>, localization?: Localization): McpStatusPayload;
+export declare function buildMcpStatus(suites: Suite[], diagnostics: McpDiagnostic[], observed: readonly McpToolSnapshot[], overrides?: Map<string, McpSuiteOverrides>, localization?: Localization, demanded?: readonly McpDemandedMount[]): McpStatusPayload;

package/lib/types/packages/market-mcp/src/application/mcp-service.d.ts

@@ -24,6 +24,18 @@ export declare class McpService {
      * the previous override; the two files are not a cross-file transaction.
      */
     addServer(name: string, server: unknown, policy?: unknown): Promise<void>;
+    /**
+     * Remove one user-owned server from the declaration file and drop everything
+     * the plugin stored about it: the override record (edited config, enablement,
+     * policy) and the OAuth grant. Only the user's own declaration may be removed
+     * — a suite's `mcp.json` is source-owned, so a refresh would restore a server
+     * deleted from it, and disabling is the supported operation there.
+     *
+     * The declaration is written first. An interruption can then leave an inert
+     * override or grant record behind, never a live server whose stored policy was
+     * silently dropped.
+     */
+    removeServer(suiteKey: string, serverKey: string): Promise<void>;
     /** Read one MCP service without credential literals, or an unsaved creation template. */
     serverConfig(id: string, create?: boolean): Promise<ServerConfigPayload>;
     /**

package/lib/types/packages/market-mcp/src/runtime/mcp/bridge/connection.d.ts

@@ -20,6 +20,7 @@
  *
  * @module runtime/mcp-client/connection
  */
+import type { BrowserOpener } from './oauth.js';
 import type { ToolHost } from './tools.js';
 import type { Config } from '../../../application/mcp/mcp-bridge-config.js';
 /** Automatic reconnect policy for one MCP server connection. */
@@ -69,6 +70,8 @@ export interface ConnectionHandle {
  * @param policy - Resolved reconnect policy from {@link resolveReconnectPolicy}.
  * @param credentials - The composition's credential store, when mounted; OAuth
  *   state persists only when it is.
+ * @param opener - Browser opener for the OAuth human leg; the platform browser
+ *   by default.
  * @returns Handle with a `ready` promise for startup-await and a `dispose` for teardown.
  */
-export declare function startConnection(host: ToolHost, config: Config, policy: ResolvedReconnectPolicy, credentials?: unknown): ConnectionHandle;
+export declare function startConnection(host: ToolHost, config: Config, policy: ResolvedReconnectPolicy, credentials?: unknown, opener?: BrowserOpener): ConnectionHandle;

package/lib/types/packages/market-mcp/src/runtime/mcp/bridge/oauth.d.ts

@@ -67,6 +67,14 @@ export declare class LoopbackOAuthClientProvider implements OAuthClientProvider
     private expectedState;
     /** Resolves `true` when the leg saved tokens, `false` when it failed; undefined while no leg is open. */
     private browserLegSettled;
+    /**
+     * Outcome of the most recently finished browser leg, `true` when the code
+     * exchange saved tokens. The pending-leg promise disappears when the leg
+     * settles, and a leg that finishes inside the `connect` that raised the
+     * `401` leaves nothing pending for a supervisor to observe — this field is
+     * how the supervisor still learns that the authorization succeeded.
+     */
+    private lastLegOutcome;
     private callbackServer;
     private callbackTimer;
     private boundPort;
@@ -98,6 +106,12 @@ export declare class LoopbackOAuthClientProvider implements OAuthClientProvider
      * settles.
      */
     get browserLeg(): Promise<boolean> | undefined;
+    /**
+     * The most recent finished leg's outcome; `undefined` until one finishes.
+     * The supervisor reads it after a failed attempt: a leg that settled inside
+     * the attempt itself leaves no pending {@link browserLeg} behind.
+     */
+    get lastBrowserLegOutcome(): boolean | undefined;
     /**
      * Register the transport generation whose `finishAuth` completes the flow.
      * The transport calls `redirectToAuthorization` during `connect`; binding