mixdog 1.1.2 → 1.2.1

package/src/session-runtime/mcp-glue/server-catalog.mjs

@@ -1,7 +1,9 @@
-// Effective MCP server set and its status projection: config entries folded
-// with plugin ownership, per-server config reads, and the live/failed rollup.
+// Effective MCP server set and its status projection: the user's configured
+// servers plus the servers registered plugins declare (resolved live, with
+// explicit owner metadata), per-server config reads, and the live/failed rollup.
 import { clean } from '../../runtime/agent/orchestrator/runtime-core/session-text.mjs';
 import { envFlag } from '../../runtime/shared/env.mjs';
+import { resolveMcpServerCatalog } from './plugin-servers.mjs';
 
 function mcpServerStatus(cfg, live, fail) {
   if (cfg?.enabled === false) return 'disabled';
@@ -9,7 +11,23 @@ function mcpServerStatus(cfg, live, fail) {
   return fail ? 'failed' : 'disconnected';
 }
 
-export function createMcpServerCatalog({ mcpClient, getConfig, getMcpScopeId, state }) {
+const EMPTY_CATALOG = { servers: {}, sources: {}, entries: {}, plugins: {}, warnings: [], adoption: null };
+
+// Internal markers on a resolved plugin config; never part of an editable config.
+function withoutMarkers(cfg) {
+  const { _mixdogStrictEnv, _mixdogRootsFollowScope, _mixdogPlugin, ...rest } = cfg || {};
+  return rest;
+}
+
+export function createMcpServerCatalog({
+  mcpClient,
+  getConfig,
+  getCurrentCwd = () => '',
+  getMcpScopeId,
+  getPluginDataDir = () => '',
+  listPlugins = () => [],
+  state,
+}) {
   function mcpTransportLabel(cfg = {}) {
     if (cfg.autoDetect) return `autoDetect:${cfg.autoDetect}`;
     try {
@@ -19,33 +37,59 @@ export function createMcpServerCatalog({ mcpClient, getConfig, getMcpScopeId, st
     }
   }
 
-  function resolveEffectiveMcpServers() {
-    // MCP is machine-global. Project `.mcp.json` files and per-project
-    // overrides are intentionally outside the runtime resolution chain.
-    if (envFlag('MIXDOG_DISABLE_MCP')) return { servers: {}, sources: {} };
-    const config = getConfig();
-    const configured = config?.mcpServers && typeof config.mcpServers === 'object' ? config.mcpServers : {};
-    const servers = {};
-    // A plugin-owned server is installed by enablePluginMcp and carries the
-    // plugin root in its env; it belongs to the plugin's own toggle and stays
-    // out of the standalone MCP list.
-    const sources = {};
-    for (const [name, cfg] of Object.entries(configured)) {
-      servers[name] = {
-        ...cfg,
-        ...(cfg?._mixdogPluginDisabled === true ? { enabled: false } : {}),
-      };
-      sources[name] = cfg?.env?.MIXDOG_PLUGIN_ROOT ? 'plugin' : 'config';
+  /** Everything this runtime would connect, resolved now. MCP is
+   *  machine-global: project `.mcp.json` files and per-project overrides stay
+   *  outside the chain; only plugin servers without a declared cwd follow this
+   *  runtime's session cwd. */
+  function resolveCatalog() {
+    if (envFlag('MIXDOG_DISABLE_MCP')) return EMPTY_CATALOG;
+    let plugins = [];
+    let registryWarning = null;
+    try {
+      plugins = listPlugins() || [];
+    } catch (error) {
+      registryWarning = { message: `plugin MCP servers unavailable: ${error?.message || String(error)}` };
     }
+    const catalog = resolveMcpServerCatalog({
+      config: getConfig() || {},
+      plugins,
+      cwd: clean(getCurrentCwd?.()),
+      dataDir: clean(getPluginDataDir?.()),
+    });
+    if (registryWarning) catalog.warnings.unshift(registryWarning);
+    return catalog;
+  }
+
+  function resolveEffectiveMcpServers() {
+    const { servers, sources } = resolveCatalog();
     return { servers, sources };
   }
 
+  /** Plugin owner of an effective server name, or null for a configured one. */
+  function pluginServer(name) {
+    const catalog = resolveCatalog();
+    const entry = catalog.entries[clean(name)];
+    return entry?.owner ? { ...entry, plugin: catalog.plugins[entry.owner.id] } : null;
+  }
+
   function getMcpServerConfig(name) {
     const serverName = clean(name);
     if (!serverName) throw new Error('MCP server name is required');
-    const { servers, sources } = resolveEffectiveMcpServers();
+    const { servers, sources, entries } = resolveCatalog();
     const effective = servers[serverName];
     if (!effective) throw new Error(`MCP server not configured: ${serverName}`);
+    // An unadopted plugin copy has an owner but stays the user's editable config.
+    const owner = sources[serverName] === 'plugin' ? entries[serverName]?.owner || null : null;
+    if (owner) {
+      return {
+        name: serverName,
+        source: 'plugin',
+        enabled: effective.enabled !== false,
+        owner,
+        readOnly: true,
+        config: withoutMarkers({ ...effective, enabled: undefined }),
+      };
+    }
     const raw = getConfig()?.mcpServers?.[serverName];
     if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
       throw new Error(`MCP server config is unavailable: ${serverName}`);
@@ -58,43 +102,88 @@ export function createMcpServerCatalog({ mcpClient, getConfig, getMcpScopeId, st
     };
   }
 
-  function mcpStatus() {
-    if (envFlag('MIXDOG_DISABLE_MCP')) {
-      return { servers: [], configuredCount: 0, connectedCount: 0, failedCount: 0 };
-    }
-    const { servers: configured, sources } = resolveEffectiveMcpServers();
+  function statusRows(catalog) {
+    const { servers: configured, sources, entries } = catalog;
     const connected = new Map((mcpClient.getMcpServerStatus?.(getMcpScopeId()) || []).map((row) => [row.name, row]));
     const failures = new Map((state.mcpFailures || []).map((row) => [row.name, row]));
     const servers = [];
     for (const [name, cfg] of Object.entries(configured)) {
       const live = connected.get(name);
-      const fail = failures.get(name);
-      servers.push({
+      // A registered server whose client reports it not alive (runtime
+      // failure after connect) is surfaced as failed, not connected.
+      const dead = live && (live.alive === false || live.connected === false);
+      const fail =
+        failures.get(name) || (dead ? { msg: live.error || live.lastError || 'MCP server is not alive' } : undefined);
+      const entry = entries[name] || {};
+      const row = {
         name,
         configured: true,
         enabled: cfg?.enabled !== false,
-        connected: Boolean(live),
-        status: mcpServerStatus(cfg, live, fail),
+        connected: Boolean(live) && !dead,
+        status: mcpServerStatus(cfg, live && !dead, fail),
         transport: mcpTransportLabel(cfg),
         toolCount: live?.toolCount || 0,
         tools: live?.tools || [],
         capabilities: live?.capabilities || { tools: false, prompts: false, resources: false },
         error: fail?.msg || null,
+        warnings: [...(entry.warnings || []), ...(live?.warnings || [])],
         source: sources[name] || 'config',
-      });
+      };
+      if (entry.owner) {
+        row.owner = entry.owner;
+        row.pluginEnabled = entry.pluginEnabled;
+        row.serverEnabled = entry.serverEnabled;
+        if (!entry.pluginEnabled) row.disabledReason = 'plugin disabled';
+        else if (!entry.serverEnabled) row.disabledReason = 'server disabled';
+      }
+      servers.push(row);
       connected.delete(name);
     }
     for (const live of connected.values()) {
       servers.push({ ...live, configured: false, status: 'connected' });
     }
     servers.sort((a, b) => String(a.name).localeCompare(String(b.name)));
+    return servers;
+  }
+
+  function mcpStatus() {
+    if (envFlag('MIXDOG_DISABLE_MCP')) {
+      return { servers: [], configuredCount: 0, connectedCount: 0, failedCount: 0 };
+    }
+    const catalog = resolveCatalog();
+    const servers = statusRows(catalog);
+    const declarationErrors = Object.values(catalog.plugins).flatMap((plugin) =>
+      plugin.errors.map((error) => ({ plugin: plugin.id, ...error }))
+    );
     return {
       servers,
-      configuredCount: Object.keys(configured).length,
+      configuredCount: Object.keys(catalog.servers).length,
       connectedCount: servers.filter((row) => row.connected).length,
       failedCount: servers.filter((row) => row.status === 'failed').length,
+      warnings: catalog.warnings,
+      declarationErrors,
     };
   }
 
-  return { mcpTransportLabel, resolveEffectiveMcpServers, getMcpServerConfig, mcpStatus };
+  /** Per plugin id: declaration format/errors and its server status rows. */
+  function pluginMcpSummary() {
+    const catalog = resolveCatalog();
+    const rows = new Map(statusRows(catalog).map((row) => [row.name, row]));
+    return new Map(
+      Object.values(catalog.plugins).map((plugin) => [
+        plugin.id,
+        { format: plugin.format, errors: plugin.errors, servers: plugin.servers.map((name) => rows.get(name)) },
+      ])
+    );
+  }
+
+  return {
+    mcpTransportLabel,
+    resolveCatalog,
+    resolveEffectiveMcpServers,
+    pluginServer,
+    getMcpServerConfig,
+    mcpStatus,
+    pluginMcpSummary,
+  };
 }

package/src/session-runtime/mcp-glue/server-input.mjs

@@ -26,8 +26,37 @@ function coerceStringArray(value) {
   return Array.isArray(value) ? value.map((entry) => clean(entry)).filter(Boolean) : [];
 }
 
+function positiveNumber(value, label) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) throw new Error(`${label} must be a positive number`);
+  return n;
+}
+
+// Per-server timeouts, stored under the keys client-config.mjs already reads:
+// startupTimeoutSec/startupTimeoutMs and timeoutMs. A stored value (save
+// merges the existing entry into the input) round-trips unchanged unless the
+// setup-facing startupTimeoutSec/toolTimeoutSec overrides it.
+function timeoutFields(input) {
+  const out = {};
+  const startupSec = input.startupTimeoutSec ?? input.startup_timeout_sec;
+  if (startupSec != null && startupSec !== '') out.startupTimeoutSec = positiveNumber(startupSec, 'startupTimeoutSec');
+  else if (input.startupTimeoutMs != null && input.startupTimeoutMs !== '')
+    out.startupTimeoutMs = positiveNumber(input.startupTimeoutMs, 'startupTimeoutMs');
+  if (input.toolTimeoutSec != null && input.toolTimeoutSec !== '')
+    out.timeoutMs = Math.round(positiveNumber(input.toolTimeoutSec, 'toolTimeoutSec') * 1000);
+  else if (input.timeoutMs != null && input.timeoutMs !== '')
+    out.timeoutMs = Math.round(positiveNumber(input.timeoutMs, 'timeoutMs'));
+  return out;
+}
+
 export function createMcpServerInput({ mcpClient, getCurrentCwd }) {
   function normalizeMcpServerInput(input = {}) {
+    const result = normalizeTransport(input);
+    Object.assign(result.config, timeoutFields(input));
+    return result;
+  }
+
+  function normalizeTransport(input) {
     const currentCwd = getCurrentCwd();
     const name = clean(input.name)
       .toLowerCase()

package/src/session-runtime/mcp-glue.mjs

@@ -6,11 +6,28 @@ import { createMcpServerCatalog } from './mcp-glue/server-catalog.mjs';
 import { createMcpConnect } from './mcp-glue/connect.mjs';
 import { createMcpServerInput } from './mcp-glue/server-input.mjs';
 
-export function createMcpGlue({ mcpClient, getConfig, getCurrentCwd, getMcpScopeId = () => null, state }) {
-  const catalog = createMcpServerCatalog({ mcpClient, getConfig, getMcpScopeId, state });
+export function createMcpGlue({
+  mcpClient,
+  getConfig,
+  getCurrentCwd,
+  getMcpScopeId = () => null,
+  getPluginDataDir,
+  listPlugins,
+  state,
+}) {
+  const catalog = createMcpServerCatalog({
+    mcpClient,
+    getConfig,
+    getCurrentCwd,
+    getMcpScopeId,
+    getPluginDataDir,
+    listPlugins,
+    state,
+  });
   const connect = createMcpConnect({
     mcpClient,
     getMcpScopeId,
+    getCurrentCwd,
     state,
     resolveEffectiveMcpServers: catalog.resolveEffectiveMcpServers,
     mcpStatus: catalog.mcpStatus,
@@ -19,6 +36,9 @@ export function createMcpGlue({ mcpClient, getConfig, getCurrentCwd, getMcpScope
 
   return {
     mcpStatus: catalog.mcpStatus,
+    resolveMcpCatalog: catalog.resolveCatalog,
+    pluginMcpServer: catalog.pluginServer,
+    pluginMcpSummary: catalog.pluginMcpSummary,
     getMcpServerConfig: catalog.getMcpServerConfig,
     connectConfiguredMcp: connect.connectConfiguredMcp,
     awaitInitialMcpConnect: connect.awaitInitialMcpConnect,

package/src/session-runtime/model-route/route-persist.mjs

@@ -52,6 +52,9 @@ export function createRoutePersistence(deps) {
       // A selection for the heir must not leak its tuning into the source model.
       if (!sessionUsesRoute(session, route)) return;
       session.fast = route.fast === true;
+      // Absent means on; only the off state is stored on the session.
+      if (route.autoEffort === false) session.autoEffort = false;
+      else delete session.autoEffort;
       session.effort = route.effectiveEffort || null;
       // The request path reads session.modelParameters; keep only serviceTier in step.
       const { serviceTier: _previous, ...otherParameters } = session.modelParameters || {};

package/src/session-runtime/model-route/set-route.mjs

@@ -55,12 +55,23 @@ async function resolveSelectedRoute(deps, next) {
     selectedRoute.effort,
     selectedRoute.modelParameters
   );
+  const contextState = resolveRouteContextState(selectedRoute, modelMeta);
+  // An exact selection is saved clamped, and not at all when it is the
+  // default window; an unknown window keeps it as requested.
+  const contextTokens =
+    contextState.contextDefaultPercent === undefined ? selectedRoute.contextTokens : contextState.contextTokens;
+  const { contextTokens: requestedTokens, ...routeFields } = selectedRoute;
+  // Tokens that land on the default window select the default, whatever
+  // percent travelled with them.
+  const tokensAtDefault = requestedTokens && !contextTokens && contextState.contextDefaultPercent !== undefined;
   return {
     selectedRoute: {
-      ...selectedRoute,
+      ...routeFields,
+      ...(tokensAtDefault ? { contextPercent: contextState.contextDefaultPercent } : {}),
       fast: fastCapable ? selectedRoute.fast === true : false,
       // Lets the saved model settings tell a chosen window from the default.
-      contextDefaultPercent: resolveRouteContextState(selectedRoute, modelMeta).contextDefaultPercent,
+      contextDefaultPercent: contextState.contextDefaultPercent,
+      ...(contextTokens ? { contextTokens } : {}),
     },
     fastCapable,
     modelMeta,
@@ -92,9 +103,11 @@ function updateSessionInPlace(deps, session, updateOptions) {
     provider: route.provider,
     model: route.model,
     fast: route.fast === true,
+    autoEffort: route.autoEffort !== false,
     effort: route.effectiveEffort || null,
     modelParameters: route.modelParameters || {},
     contextPercent: route.contextPercent,
+    contextTokens: route.contextTokens || null,
     selectedContextWindow: route.selectedContextWindow || null,
   };
   const updated = mgr.updateSessionRoute?.(session.id, fields, updateOptions);

package/src/session-runtime/new-session-config.mjs

@@ -21,7 +21,8 @@ export function createNewSessionConfig({
     await flushPendingSessionConfigWrites();
     await sharedCfgMod.pendingConfigWrites();
     sharedCfgMod.invalidateConfigReadCache();
-    const previousMcp = rt.config.mcpServers;
+    const mcpSettings = () => [rt.config.mcpServers, rt.config.pluginMcp];
+    const previousMcp = mcpSettings();
     // Headless callers inject a deliberately isolated config. Never replace
     // their explicit policy with the interactive profile on disk.
     if (!initialConfig || typeof initialConfig !== 'object') {
@@ -34,7 +35,7 @@ export function createNewSessionConfig({
     invalidatePreSessionToolSurface();
     invalidateSkills();
     await configureEmbedding(sharedCfgMod.readSection('memory')?.embedding || {});
-    if (!firstSession || !isDeepStrictEqual(previousMcp, rt.config.mcpServers)) {
+    if (!firstSession || !isDeepStrictEqual(previousMcp, mcpSettings())) {
       // Reused runtimes may still own old connections. This reset is scoped to
       // the runtime that is constructing the new session, not to its peers.
       await connectConfiguredMcp({ reset: true });

package/src/session-runtime/notification-bus.mjs

@@ -3,7 +3,10 @@
 // pending queue so the model sees it next turn. The delivered registry keeps
 // those two paths from double-injecting the same completion.
 import { modelVisibleToolCompletionMessage } from '../runtime/shared/tool-execution-contract.mjs';
-import { markCompletionEntry } from '../runtime/agent/orchestrator/session/manager/pending-messages.mjs';
+import {
+  PENDING_MODE_TASK_NOTIFICATION,
+  markCompletionEntry,
+} from '../runtime/agent/orchestrator/session/manager/pending-messages.mjs';
 import {
   isDeliveredCompletion,
   logDuplicateSkip,
@@ -29,7 +32,7 @@ function cleanSessionId(value) {
 // the wake would leave its durable entry parked until the next user message.
 // A completion whose owner is no longer the live session is still dropped (the
 // durable queue carries it into that session's next turn).
-export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi, getOwnerLifecycle }) {
+export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi, getOwnerLifecycle, beforeWake }) {
   // A closing/terminal owner never starts inference from a completion; the
   // check runs at request time and again inside the delayed callback.
   const ownerOpen = (sessionId) => {
@@ -55,6 +58,14 @@ export function createCompletionWakeScheduler({ getCurrentSessionId, getTurnApi,
               ` executionId=${executionId || 'unknown'} queuedMs=${delayMs}\n`
           );
         }
+        // Surface hook (idle auto-clear): compacts a cold-cache session before
+        // the wake sends it. A failing hook never blocks the wake.
+        if (typeof beforeWake === 'function') {
+          try {
+            await beforeWake(ownerSessionId);
+          } catch {}
+          if (cleanSessionId(getCurrentSessionId()) !== ownerSessionId || !ownerOpen(ownerSessionId)) return;
+        }
         // The wake continues the user turn that launched the worker, so its
         // review keeps that turn's Lead edits and worker diffs.
         await turnApi.ask('', { submittedAt: queuedAt, continueTurn: true });
@@ -136,7 +147,11 @@ export function createNotificationBus({ listeners, mgr, onCompletionQueued, getO
     if (!open) return false;
     if (typeof mgr.enqueuePendingMessage !== 'function') return false;
     try {
-      return mgr.enqueuePendingMessage(targetSessionId, content) > 0;
+      // A channel notification (webhook event rules, schedule injects, relays)
+      // is the runtime reporting, exactly as an attached TUI queues it: a
+      // task notification, so text inside it — fenced external webhook values
+      // included — never drives explicit skill selection.
+      return mgr.enqueuePendingMessage(targetSessionId, { content, mode: PENDING_MODE_TASK_NOTIFICATION }) > 0;
     } catch {
       return false;
     }

package/src/session-runtime/provider-auth/accounts.mjs

@@ -1,6 +1,10 @@
 // provider-auth/accounts.mjs — the per-provider account roster and account
 // switching, with the bounded background usage sweep that refreshes quotas.
-import { listProviderAccounts, updateProviderAccounts } from '../services/provider-admin.mjs';
+import {
+  listProviderAccounts,
+  materializeProviderAccounts,
+  updateProviderAccounts,
+} from '../services/provider-admin.mjs';
 import { getProvider } from '../../runtime/agent/orchestrator/providers/registry.mjs';
 import { fetchOAuthUsageSnapshot } from '../../runtime/agent/orchestrator/providers/oauth-usage.mjs';
 
@@ -11,21 +15,23 @@ export function createAccountApi(
   // One in-flight usage sweep per provider; a reopened picker reuses it.
   const accountUsageSweeps = new Map();
 
+  async function measureAccountUsage(providerId, provider, accounts, force = false) {
+    await awaitKeychainPrewarm();
+    for (let offset = 0; offset < accounts.length; offset += 4) {
+      await Promise.all(
+        accounts.slice(offset, offset + 4).map((account) => {
+          const target = { provider: providerId, accountId: account.id };
+          return fetchOAuthUsageSnapshot(target, provider.forAccount(account.id), () => {}, { force }).catch(
+            () => null
+          );
+        })
+      );
+    }
+  }
+
   async function sweepAccountUsage(providerId, provider, accounts) {
     try {
-      await awaitKeychainPrewarm();
-      for (let offset = 0; offset < accounts.length; offset += 4) {
-        await Promise.all(
-          accounts
-            .slice(offset, offset + 4)
-            .map((account) =>
-              fetchOAuthUsageSnapshot(
-                { provider: providerId, accountId: account.id },
-                provider.forAccount(account.id)
-              ).catch(() => null)
-            )
-        );
-      }
+      await measureAccountUsage(providerId, provider, accounts);
     } finally {
       accountUsageSweeps.delete(providerId);
     }
@@ -69,8 +75,20 @@ export function createAccountApi(
       return pool;
     },
     async updateProviderAccounts(providerId, change) {
+      // `{ refreshUsage: true }` re-measures every account now (the roster's
+      // "Refresh usage") and changes nothing else in the roster. The implicit
+      // signed-in account is stored first so its measurement has a row to land on.
+      if (change?.refreshUsage === true && Object.keys(change).length === 1) {
+        const provider = getProvider(providerId);
+        if (typeof provider?.forAccount === 'function') {
+          await awaitKeychainPrewarm();
+          const { accounts } = await materializeProviderAccounts(providerId);
+          await measureAccountUsage(providerId, provider, accounts, true);
+        }
+        return listProviderAccounts(providerId);
+      }
       await awaitKeychainPrewarm();
-      const result = updateProviderAccounts(providerId, change);
+      const result = await updateProviderAccounts(providerId, change);
       reloadFullConfig();
       invalidateProviderCaches();
       warmProviderModelCache();

package/src/session-runtime/provider-models/row-hydration.mjs

@@ -65,8 +65,10 @@ export function hydrateProviderModelRow(cfg, row) {
       ) || customAutoEffortCapable(row.provider, cfg?.providers?.[row.provider]?.protocol, row),
     savedEffort: saved.effort || null,
     savedFast: Object.hasOwn(saved, 'fast') ? saved.fast === true : undefined,
+    savedAutoEffort: Object.hasOwn(saved, 'autoEffort') ? saved.autoEffort !== false : undefined,
     savedModelParameters: saved.modelParameters || {},
     savedContextPercent: Number(saved.contextPercent) || undefined,
+    savedContextTokens: Number(saved.contextTokens) || undefined,
   };
 }
 

package/src/session-runtime/provider-models/web-search-catalog.mjs

@@ -38,7 +38,11 @@ export function createWebSearchCatalog({
     try {
       let models = null;
       if (forceRefresh && typeof provider._refreshModelCache === 'function') {
-        models = await provider._refreshModelCache();
+        try {
+          models = await provider._refreshModelCache();
+        } catch {
+          models = null; // fall back to listModels below
+        }
       }
       if (!Array.isArray(models)) models = await provider.listModels();
       if (!Array.isArray(models)) return [];

package/src/session-runtime/provider-readiness.mjs

@@ -67,16 +67,17 @@ export function createProviderReadiness({ rt, keychain, getReg, getWarmProviderM
     await awaitKeychainPrewarm();
     if (rt.closeRequested) throw new Error('runtime is closing');
     const initKey = providerInitCacheKey(providerConfig);
-    const existing = providerInitPromises.get(initKey);
-    if (existing) return await existing;
     // Provider initialization is idempotent for one normalized config. Keep
     // the fulfilled promise, not only the in-flight one: session resume used
     // to rerun registry/keychain setup on every click even though neither the
     // provider config nor the registry had changed. Auth/config mutations call
     // invalidateProviderCaches(), which clears this gate and preserves the
     // existing refresh semantics.
-    const providerInitPromise = Promise.resolve().then(() => getReg().initProviders(providerConfig));
-    providerInitPromises.set(initKey, providerInitPromise);
+    let providerInitPromise = providerInitPromises.get(initKey);
+    if (!providerInitPromise) {
+      providerInitPromise = Promise.resolve().then(() => getReg().initProviders(providerConfig));
+      providerInitPromises.set(initKey, providerInitPromise);
+    }
     let result;
     try {
       result = await providerInitPromise;
@@ -84,13 +85,18 @@ export function createProviderReadiness({ rt, keychain, getReg, getWarmProviderM
       if (providerInitPromises.get(initKey) === providerInitPromise) providerInitPromises.delete(initKey);
       throw error;
     }
-    if (!rt.startupProviderCatalogRefreshStarted && !rt.closeRequested) {
-      rt.startupProviderCatalogRefreshStarted = true;
-      rt.startupProviderCatalogRefreshPending = true;
+    if (!rt.closeRequested) {
       try {
-        void Promise.resolve(getReg().refreshProviderCatalogsOnStartup())
+        // The registry memoizes the refresh per catalog epoch; a provider set
+        // change yields a new promise, which gets its own completion handling.
+        const refresh = getReg().refreshProviderCatalogsOnStartup();
+        if (refresh === rt.startupProviderCatalogRefreshObserved) return result;
+        rt.startupProviderCatalogRefreshObserved = refresh;
+        rt.startupProviderCatalogRefreshPending = true;
+        const isLatest = () => rt.startupProviderCatalogRefreshObserved === refresh;
+        void Promise.resolve(refresh)
           .then(() => {
-            rt.startupProviderCatalogRefreshPending = false;
+            if (isLatest()) rt.startupProviderCatalogRefreshPending = false;
             if (rt.closeRequested) return;
             // Fresh catalog rows invalidate model-derived caches, but the
             // already initialized provider registry remains valid.
@@ -103,7 +109,7 @@ export function createProviderReadiness({ rt, keychain, getReg, getWarmProviderM
             bootProfile('provider-catalogs:refresh-ready');
           })
           .catch((error) => {
-            rt.startupProviderCatalogRefreshPending = false;
+            if (isLatest()) rt.startupProviderCatalogRefreshPending = false;
             bootProfile('provider-catalogs:refresh-failed', { error: error?.message || String(error) });
           });
         bootProfile('provider-catalogs:refresh-started');

package/src/session-runtime/resource-extension-sync.mjs

@@ -28,17 +28,33 @@ export function createExtensionSync({
     }
   }
 
-  async function refreshState(kind) {
+  // Apply per-server MCP changes in order, then reconcile: a configured server
+  // added, renamed or removed can move a plugin server to another name, and
+  // only the reconcile connects it there and drops the stale name. Servers
+  // whose resolved config is unchanged stay untouched.
+  async function applyMcpChanges(changes) {
+    for (const { name, enabled } of changes) await connectConfiguredMcp({ only: name, enabled });
+    return connectConfiguredMcp({ reconcile: true });
+  }
+
+  async function refreshState(kind, detail = null) {
     reloadFullConfig?.();
     if (kind === 'skills' || kind === 'plugins') invalidateSkills?.();
-    if (kind === 'mcp' || kind === 'plugins') {
+    const mcpChanges = kind === 'mcp' ? detail?.mcpChanges : null;
+    if (Array.isArray(mcpChanges)) {
+      await applyMcpChanges(mcpChanges);
+    } else if (kind === 'plugins') {
+      // Plugin servers are derived from the registry: connect what is new or
+      // changed, drop what is gone or disabled, leave the rest connected.
+      await connectConfiguredMcp({ reconcile: true });
+    } else if (kind === 'mcp') {
       await connectConfiguredMcp({ reset: true });
     }
     await refreshSurface(kind);
   }
 
   const subscription = subscribeGlobalExtensionChanges(refreshState);
-  const publish = (kind) => publishGlobalExtensionChange(kind, subscription.id);
+  const publish = (kind, detail = null) => publishGlobalExtensionChange(kind, subscription.id, detail);
 
   function scheduleMcpToggle(serverName, enabled) {
     const chain = mcpToggleChains.get(serverName) || { desired: enabled, running: null };
@@ -65,25 +81,47 @@ export function createExtensionSync({
 
   /** Skills/plugins invalidate the skill cache; every kind rebuilds the
    *  pre-session surface and notifies the other runtimes. */
-  async function announce(kind, { invalidate = kind !== 'mcp' } = {}) {
+  async function announce(kind, { invalidate = kind !== 'mcp', detail = null } = {}) {
     if (invalidate) invalidateSkills?.();
     await refreshSurface(kind);
-    await publish(kind);
+    await publish(kind, detail);
   }
 
-  /** Reconnect every configured MCP server after a config write, then announce. */
-  async function reconnectMcpAndAnnounce() {
+  /** Reconnect MCP after a config write, then announce. With `only`, just that
+   *  server is (re)connected (or disconnected when `enabled` is false) and
+   *  `drop` names (e.g. a renamed/removed server) are disconnected; every other
+   *  server stays untouched. Without `only`, every configured server reconnects. */
+  async function reconnectMcpAndAnnounce({ only = null, enabled = true, drop = [] } = {}) {
+    if (only || drop.length > 0) {
+      // Other runtimes receive the same scoped change list, not a full reset.
+      const mcpChanges = [
+        ...drop.map((name) => ({ name, enabled: false })),
+        ...(only ? [{ name: only, enabled }] : []),
+      ];
+      const status = await applyMcpChanges(mcpChanges);
+      await announce('mcp', { detail: { mcpChanges } });
+      return status;
+    }
     const status = await connectConfiguredMcp({ reset: true });
     await announce('mcp');
     return status;
   }
 
+  /** After a plugin registry change: reconcile this runtime's MCP connections
+   *  with the derived server set first, then let peers do the same. */
+  async function reconcilePluginsAndAnnounce() {
+    const status = await connectConfiguredMcp({ reconcile: true });
+    await announce('plugins');
+    return status;
+  }
+
   return {
     refreshSurface,
     publish,
     scheduleMcpToggle,
     announce,
     reconnectMcpAndAnnounce,
+    reconcilePluginsAndAnnounce,
     dispose: () => subscription.unsubscribe(),
   };
 }