feat(plugins): MCP plugin management, agent injection, and custom MCP import

apps/daemon/src/__tests__/config.test.ts

@@ -1,6 +1,7 @@
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import type { PluginConfig } from '@linkcode/schema';
 import { noop } from 'foxts/noop';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
@@ -9,6 +10,7 @@ import {
   hqCredentialsPath,
   loadConfig,
   runtimeFilePath,
+  savePlugins,
 } from '../config';
 import { logger } from '../logger';
 import { telemetryConfigCachePath } from '../paths';
@@ -39,6 +41,12 @@ function writeAccountsConfig(accounts: unknown): void {
   writeFileSync(join(dir, 'config.json'), JSON.stringify({ accounts }));
 }
 
+function writeRawConfig(config: unknown): void {
+  const dir = join(process.env.HOME ?? '', '.linkcode');
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, 'config.json'), JSON.stringify(config));
+}
+
 const validAccount = {
   id: 'acc_1',
   label: 'Personal key',
@@ -169,3 +177,74 @@ describe('loadConfig accounts', () => {
     expect(errorSpy).not.toHaveBeenCalled();
   });
 });
+
+describe('loadConfig plugins', () => {
+  const connector = {
+    id: 'github-personal',
+    label: 'Personal GitHub',
+    service: 'github',
+    credential: { type: 'auth-token', secret: 'github-secret' },
+  } as const;
+
+  it('keeps valid entries and drops malformed entries independently', () => {
+    const warnSpy = vi.spyOn(logger, 'warn').mockImplementation(noop);
+    writeRawConfig({
+      plugins: {
+        units: [
+          { unitId: 'github-read', enabled: true },
+          { unitId: 'unknown-unit', enabled: true },
+        ],
+        serviceBindings: {
+          github: { type: 'local', connectorId: connector.id },
+          jira: { type: 'local', connectorId: 'stale' },
+        },
+        connectors: [connector, { id: 'bad', service: 'github' }],
+        customServers: [
+          { id: 'cs1', enabled: true, server: { type: 'stdio', name: 'local-fs', command: 'fs' } },
+          { id: 'bad', enabled: true, server: { type: 'stdio', name: 'x' } },
+        ],
+      },
+    });
+
+    expect(loadConfig().plugins).toEqual({
+      units: [{ unitId: 'github-read', enabled: true }],
+      serviceBindings: { github: { type: 'local', connectorId: connector.id } },
+      connectors: [connector],
+      customServers: [
+        { id: 'cs1', enabled: true, server: { type: 'stdio', name: 'local-fs', command: 'fs' } },
+      ],
+    });
+    expect(warnSpy).toHaveBeenCalledTimes(3);
+  });
+
+  it('round-trips credentials at mode 0600 without overwriting providers or accounts', () => {
+    writeRawConfig({ providers: { codex: { enabled: true } }, accounts: [validAccount] });
+    const plugins: PluginConfig = {
+      units: [],
+      serviceBindings: { github: { type: 'local', connectorId: connector.id } },
+      connectors: [connector],
+      customServers: [],
+    };
+
+    savePlugins(plugins);
+
+    expect(loadConfig()).toMatchObject({
+      providers: { codex: { enabled: true } },
+      accounts: [validAccount],
+      plugins,
+    });
+    expect(statSync(join(process.env.HOME ?? '', '.linkcode', 'config.json')).mode & 0o777).toBe(
+      0o600,
+    );
+  });
+
+  it('defaults an older config without a plugins section to empty state', () => {
+    writeRawConfig({ providers: {} });
+    expect(loadConfig().plugins).toEqual({
+      units: [],
+      serviceBindings: {},
+      connectors: [],
+      customServers: [],
+    });
+  });
+});

apps/daemon/src/__tests__/logger.test.ts

@@ -32,6 +32,9 @@ describe('daemon logger', () => {
         nested: { apiKey: 'nested-secret', token: 'nested-token' },
         providers: { codex: { apiKey: 'provider-secret' } },
         accounts: [{ credential: { key: 'account-secret' } }],
+        plugins: {
+          connectors: [{ credential: { type: 'auth-token', secret: 'plugin-secret' } }],
+        },
         sessionId: 'session-1',
       },
       'Session started',
@@ -48,6 +51,7 @@ describe('daemon logger', () => {
       nested: { apiKey: '[Redacted]', token: '[Redacted]' },
       providers: { codex: { apiKey: '[Redacted]' } },
       accounts: [{ credential: '[Redacted]' }],
+      plugins: { connectors: [{ credential: '[Redacted]' }] },
       sessionId: 'session-1',
     });
   });

apps/daemon/src/config.ts

@@ -1,12 +1,17 @@
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { daemonRuntimeFilePath } from '@linkcode/common/node';
-import type { Accounts, ProvidersConfig } from '@linkcode/schema';
+import type { Accounts, PluginConfig, ProvidersConfig } from '@linkcode/schema';
 import {
   AccountSchema,
   AgentKindSchema,
+  CustomMcpServerSchema,
   DAEMON_DEFAULT_PORT,
+  McpPluginServiceSchema,
+  PluginConnectorSchema,
+  PluginServiceBindingSchema,
+  PluginUnitStateSchema,
   ProviderConfigSchema,
 } from '@linkcode/schema';
 import { WORKSPACES_DIRNAME } from '@linkcode/schema/product';
@@ -29,6 +34,8 @@ export interface DaemonConfig {
   providers?: ProvidersConfig;
   /** Global account pool (data plane); undefined when nothing is configured. */
   accounts?: Accounts;
+  /** Global plugin enablement and daemon-local connector credentials. */
+  plugins?: PluginConfig;
 }
 
 const DEFAULT_PORT = DAEMON_DEFAULT_PORT;
@@ -40,6 +47,7 @@ interface ConfigFile {
   listeners?: unknown;
   providers?: unknown;
   accounts?: unknown;
+  plugins?: unknown;
 }
 
 function configPath(): string {
@@ -101,9 +109,66 @@ export function loadConfig(): DaemonConfig {
     ),
     providers: parseProviders(file.providers),
     accounts: parseAccounts(file.accounts),
+    plugins: parsePlugins(file.plugins),
   };
 }
 
+function parsePlugins(raw: unknown): PluginConfig {
+  const empty: PluginConfig = { units: [], serviceBindings: {}, connectors: [], customServers: [] };
+  if (raw === undefined) return empty;
+  if (!isRecord(raw)) {
+    logger.warn({ operation: 'config.load' }, 'Invalid plugins config: expected an object');
+    return empty;
+  }
+  return {
+    units: parsePluginEntries(raw.units, PluginUnitStateSchema, 'unit'),
+    serviceBindings: parseServiceBindings(raw.serviceBindings),
+    connectors: parsePluginEntries(raw.connectors, PluginConnectorSchema, 'connector'),
+    customServers: parsePluginEntries(raw.customServers, CustomMcpServerSchema, 'custom server'),
+  };
+}
+
+/** Parse binding by binding: an invalid entry is dropped and logged, never blanking the map. */
+function parseServiceBindings(raw: unknown): PluginConfig['serviceBindings'] {
+  if (raw === undefined) return {};
+  if (!isRecord(raw)) {
+    logger.warn(
+      { operation: 'config.load' },
+      'Invalid plugin service bindings config: expected an object',
+    );
+    return {};
+  }
+  const bindings: PluginConfig['serviceBindings'] = {};
+  for (const service of McpPluginServiceSchema.options) {
+    if (!(service in raw)) continue;
+    const parsed = PluginServiceBindingSchema.safeParse(raw[service]);
+    if (parsed.success) bindings[service] = parsed.data;
+    else logger.warn({ operation: 'config.load' }, 'Dropping invalid plugin service binding');
+  }
+  return bindings;
+}
+
+function parsePluginEntries<T>(
+  raw: unknown,
+  schema: { safeParse(value: unknown): { success: true; data: T } | { success: false } },
+  entryType: string,
+): T[] {
+  if (raw === undefined) return [];
+  if (!Array.isArray(raw)) {
+    logger.warn(
+      { operation: 'config.load' },
+      `Invalid plugin ${entryType}s config: expected an array`,
+    );
+    return [];
+  }
+  return raw.flatMap((value) => {
+    const parsed = schema.safeParse(value);
+    if (parsed.success) return [parsed.data];
+    logger.warn({ operation: 'config.load' }, `Dropping invalid plugin ${entryType} config`);
+    return [];
+  });
+}
+
 /**
  * Parse element by element: an invalid account is dropped and logged, never blanking the pool —
  * `saveAccounts` would persist that loss on the next write. Mirrors {@link parseProviders}.
@@ -166,8 +231,13 @@ export function saveAccounts(accounts: Accounts): void {
   writeConfigField('accounts', accounts);
 }
 
+/** Persist plugin state and local credentials, preserving other config fields; `0600`. */
+export function savePlugins(plugins: PluginConfig): void {
+  writeConfigField('plugins', plugins);
+}
+
 /** Read-modify-write a single top-level field of config.json, preserving the rest; `0600`. */
-function writeConfigField(key: 'providers' | 'accounts', value: unknown): void {
+function writeConfigField(key: 'providers' | 'accounts' | 'plugins', value: unknown): void {
   const path = configPath();
   let file: Record<string, unknown> = {};
   try {
@@ -179,6 +249,7 @@ function writeConfigField(key: 'providers' | 'accounts', value: unknown): void {
   file[key] = value;
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+  chmodSync(path, 0o600);
 }
 
 function createDefaultSocketIoListener(file: ConfigFile): DaemonListenerConfig {

apps/daemon/src/index.ts

@@ -170,7 +170,11 @@ async function main(): Promise<void> {
   const EngineSubsystemLive = Layer.unwrap(
     Effect.gen(function* () {
       const { config, hub, previewRoutes } = yield* Shared;
-      const store = createProviderConfigStore(config.providers ?? {}, config.accounts ?? []);
+      const store = createProviderConfigStore(
+        config.providers ?? {},
+        config.accounts ?? [],
+        config.plugins ?? { units: [], serviceBindings: {}, connectors: [], customServers: [] },
+      );
       // Managed assets (CODE-111): GC superseded versions before anything can spawn, then feed the
       // store into spawn resolution — managed wins over detected as soon as an install lands.
       const assets = new AssetManager();

apps/daemon/src/provider-store.ts

@@ -1,6 +1,6 @@
 import type { ProviderConfigStore } from '@linkcode/engine';
-import type { Accounts, ProvidersConfig } from '@linkcode/schema';
-import { saveAccounts, saveProviders } from './config';
+import type { Accounts, PluginConfig, ProvidersConfig } from '@linkcode/schema';
+import { saveAccounts, savePlugins, saveProviders } from './config';
 
 /**
  * Daemon-backed data-plane config store: in-memory providers + account pool seeded at boot, each
@@ -10,9 +10,11 @@ import { saveAccounts, saveProviders } from './config';
 export function createProviderConfigStore(
   initialProviders: ProvidersConfig,
   initialAccounts: Accounts,
+  initialPlugins: PluginConfig,
 ): ProviderConfigStore {
   let providers = initialProviders;
   let accounts = initialAccounts;
+  let plugins = initialPlugins;
   return {
     get: () => providers,
     set(next) {
@@ -24,5 +26,10 @@ export function createProviderConfigStore(
       accounts = next;
       saveAccounts(next);
     },
+    getPlugins: () => plugins,
+    setPlugins(next) {
+      savePlugins(next);
+      plugins = next;
+    },
   };
 }

apps/desktop/src/renderer/src/settings/plugins-tab.tsx

@@ -0,0 +1,6 @@
+import { PluginsSettingsPanel } from '@linkcode/workbench';
+
+/** Daemon-backed MCP tool settings, shared with the browser client. */
+export function PluginsTab(): React.ReactNode {
+  return <PluginsSettingsPanel />;
+}

apps/desktop/src/renderer/src/settings/settings-view.tsx

@@ -21,6 +21,7 @@ import {
   HistoryIcon,
   InfoIcon,
   KeyRoundIcon,
+  PlugIcon,
   SendIcon,
   SettingsIcon,
   SunMoonIcon,
@@ -41,6 +42,7 @@ import { GeneralTab } from './general-tab';
 import { HistoryImportTab } from './history-import-tab';
 import { ImChannelTab } from './im-channel-tab';
 import { NotificationsTab } from './notifications-tab';
+import { PluginsTab } from './plugins-tab';
 import { ProvidersTab } from './providers-tab';
 import type { SettingsCategory } from './store';
 import { useDesktopSettingsStore } from './store';
@@ -147,6 +149,14 @@ export function SettingsView(): React.ReactNode {
           active: category === 'providers',
           onClick: () => setCategory('providers'),
         },
+        {
+          key: 'plugins',
+          icon: <PlugIcon className="size-4" />,
+          label: t('tabs.plugins'),
+          keywords: searchKeywords.plugins,
+          active: category === 'plugins',
+          onClick: () => setCategory('plugins'),
+        },
         {
           key: 'imChannel',
           icon: <SendIcon className="size-4" />,
@@ -301,6 +311,8 @@ function renderSettingsPanel(
       return <ProvidersTab />;
     case 'agents':
       return <AgentsTab />;
+    case 'plugins':
+      return <PluginsTab />;
     case 'imChannel':
       return <ImChannelTab />;
     case 'history-import':

apps/desktop/src/renderer/src/settings/store.ts

@@ -13,6 +13,7 @@ export type SettingsCategory =
   | 'about'
   | 'providers'
   | 'agents'
+  | 'plugins'
   | 'imChannel'
   | 'history-import';
 

apps/webview/src/router.tsx

@@ -6,6 +6,7 @@ import { DeveloperSettings } from '@webview/routes/settings/developer';
 import { GeneralSettings } from '@webview/routes/settings/general';
 import { MessagingSettings } from '@webview/routes/settings/messaging';
 import { NotificationsSettings } from '@webview/routes/settings/notifications';
+import { PluginsSettings } from '@webview/routes/settings/plugins';
 import { ProvidersSettings } from '@webview/routes/settings/providers';
 import { SettingsLayout } from '@webview/routes/settings/settings-layout';
 import { TerminalSettings } from '@webview/routes/settings/terminal';
@@ -32,6 +33,7 @@ export function createWebviewRouter(
             { path: 'developer', element: <DeveloperSettings /> },
             { path: 'notifications', element: <NotificationsSettings /> },
             { path: 'providers', element: <ProvidersSettings /> },
+            { path: 'plugins', element: <PluginsSettings /> },
             { path: 'agents', element: <AgentsSettings /> },
             { path: 'messaging', element: <MessagingSettings /> },
           ],

apps/webview/src/routes/settings/plugins.tsx

@@ -0,0 +1,9 @@
+import { PluginsSettingsPanel } from '@linkcode/workbench';
+import { usePageTitle } from '@webview/hooks/use-page-title';
+import { useTranslations } from 'use-intl';
+
+export function PluginsSettings(): React.ReactNode {
+  const tTabs = useTranslations('settings.tabs');
+  usePageTitle(tTabs('plugins'));
+  return <PluginsSettingsPanel />;
+}