feat(plugins): plugins, MCP, and skills management on the provider-plugin model

apps/daemon/src/__tests__/config.test.ts

@@ -1,7 +1,7 @@
-import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import type { Account } from '@linkcode/schema';
+import type { Account, Accounts, CustomMcpServer } from '@linkcode/schema';
 import { DAEMON_DEFAULT_PORT, DAEMON_PORT_HUNT_SPAN, daemonBasePort } from '@linkcode/schema';
 import { noop } from 'foxts/noop';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
@@ -13,9 +13,11 @@ import {
   loadConfig,
   runtimeFilePath,
   saveAccounts,
+  saveCustomMcpServers,
 } from '../config';
 import { logger } from '../logger';
 import { daemonChannel, telemetryConfigCachePath } from '../paths';
+import { createProviderConfigStore } from '../provider-store';
 import type { InMemoryVault } from './fixtures/in-memory-vault';
 import { createInMemoryVault } from './fixtures/in-memory-vault';
 
@@ -62,7 +64,7 @@ const validAccount: Account = {
   label: 'Personal key',
   credential: { type: 'api-key', key: 'sk-test' },
   createdAt: 0,
-};
+} satisfies Accounts[number];
 
 describe('loadConfig providers', () => {
   it('keeps valid provider entries and drops an invalid one, logging the error', () => {
@@ -267,6 +269,76 @@ describe('loadConfig accounts', () => {
   });
 });
 
+describe('loadConfig custom MCP servers', () => {
+  const validServer = {
+    id: 'custom-1',
+    enabled: true,
+    server: {
+      type: 'stdio',
+      name: 'github',
+      command: 'gh-mcp',
+      env: { GITHUB_TOKEN: 'secret' },
+    },
+    createdAt: 1,
+  } as const satisfies CustomMcpServer;
+
+  function writeCustomMcpConfig(customMcpServers: unknown): void {
+    const dir = join(process.env.HOME ?? '', '.linkcode');
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'config.json'), JSON.stringify({ customMcpServers }));
+  }
+
+  it('keeps valid servers and drops an invalid one without blanking the rest', () => {
+    const errorSpy = vi.spyOn(logger, 'warn').mockImplementation(noop);
+    writeCustomMcpConfig([validServer, { id: 'broken', server: { type: 'stdio' } }]);
+
+    const config = loadConfig(vault);
+
+    expect(config.customMcpServers).toEqual([validServer]);
+    expect(errorSpy).toHaveBeenCalled();
+  });
+
+  it('round-trips through saveCustomMcpServers preserving other fields at mode 0600', () => {
+    writeCustomMcpConfig([]);
+    const path = join(process.env.HOME ?? '', '.linkcode', 'config.json');
+    writeFileSync(path, JSON.stringify({ providers: {}, customMcpServers: [] }));
+
+    saveCustomMcpServers([validServer]);
+
+    const written: unknown = JSON.parse(readFileSync(path, 'utf8'));
+    expect(written).toEqual({ providers: {}, customMcpServers: [validServer] });
+    expect(statSync(path).mode & 0o777).toBe(0o600);
+    expect(loadConfig(vault).customMcpServers).toEqual([validServer]);
+  });
+});
+
+describe('createProviderConfigStore', () => {
+  it('does not publish provider, account, or custom MCP state when persistence fails', () => {
+    const oldProviders = { codex: { enabled: true } } as const;
+    const oldAccounts: Accounts = [validAccount];
+    const oldCustomMcpServers: CustomMcpServer[] = [];
+    const store = createProviderConfigStore(vault, oldProviders, oldAccounts, oldCustomMcpServers);
+    writeFileSync(join(process.env.HOME ?? '', '.linkcode'), 'not a directory');
+
+    expect(() => store.set({ 'claude-code': { enabled: true } })).toThrow();
+    expect(() => store.setAccounts([])).toThrow();
+    expect(() =>
+      store.setCustomMcpServers([
+        {
+          id: 'custom-1',
+          enabled: true,
+          server: { type: 'stdio', name: 'test', command: 'test' },
+          createdAt: 1,
+        },
+      ]),
+    ).toThrow();
+
+    expect(store.get()).toBe(oldProviders);
+    expect(store.getAccounts()).toBe(oldAccounts);
+    expect(store.getCustomMcpServers()).toBe(oldCustomMcpServers);
+  });
+});
+
 // CODE-371: config.json used to hold provider api keys and account credentials in the clear. The
 // vault owns them now, and an upgrade has to move them without the user re-entering anything.
 describe('credential storage', () => {

apps/daemon/src/config.ts

@@ -1,11 +1,17 @@
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { daemonRuntimeFilePath } from '@linkcode/common/node';
-import type { Accounts, ProvidersConfig, SimulatorConsentState } from '@linkcode/schema';
+import type {
+  Accounts,
+  CustomMcpServer,
+  ProvidersConfig,
+  SimulatorConsentState,
+} from '@linkcode/schema';
 import {
   AccountSchema,
   AgentKindSchema,
+  CustomMcpServerSchema,
   daemonBasePort,
   ProviderConfigSchema,
   SimulatorConsentStateSchema,
@@ -37,6 +43,8 @@ export interface DaemonConfig {
   providers?: ProvidersConfig;
   /** Global account pool (data plane); undefined when nothing is configured. */
   accounts?: Accounts;
+  /** LinkCode-owned custom MCP servers (data plane); undefined when nothing is configured. */
+  customMcpServers?: CustomMcpServer[];
   /** Which simulators agents may drive, plus the global agent-tools switch (CODE-420). */
   simulatorConsent: SimulatorConsentState;
 }
@@ -49,6 +57,7 @@ interface ConfigFile {
   listeners?: unknown;
   providers?: unknown;
   accounts?: unknown;
+  customMcpServers?: unknown;
   simulatorConsent?: unknown;
 }
 
@@ -145,6 +154,7 @@ export function loadConfig(vault: SecretVault): DaemonConfig {
     ),
     providers: parsedProviders.value,
     accounts: parsedAccounts.value,
+    customMcpServers: parseCustomMcpServers(file.customMcpServers),
     simulatorConsent: parseSimulatorConsent(file.simulatorConsent),
   };
 }
@@ -202,6 +212,28 @@ function parseAccounts(store: SecretStore, raw: unknown): Parsed<Accounts> {
   return { value: accounts, migrated };
 }
 
+/**
+ * Parse element by element like {@link parseAccounts}: one invalid server is dropped and logged,
+ * never blanking the rest.
+ */
+function parseCustomMcpServers(raw: unknown): CustomMcpServer[] {
+  if (raw === undefined) return [];
+  if (!Array.isArray(raw)) {
+    logger.warn({ operation: 'config.load' }, 'Invalid custom MCP config: expected an array');
+    return [];
+  }
+  const servers: CustomMcpServer[] = [];
+  for (const value of raw) {
+    const server = CustomMcpServerSchema.safeParse(value);
+    if (!server.success) {
+      logger.warn({ operation: 'config.load' }, 'Dropping invalid custom MCP server config');
+      continue;
+    }
+    servers.push(server.data);
+  }
+  return servers;
+}
+
 /**
  * Parse field by field: an invalid entry is dropped and logged, never blanking the other entries —
  * `saveProviders` would persist that loss on the next write.
@@ -245,9 +277,14 @@ export function saveAccounts(vault: SecretVault, accounts: Accounts): void {
   writeConfigField('accounts', detachAccountSecrets(accountSecrets(vault), accounts));
 }
 
+/** Persist custom MCP servers, preserving other fields; `0600` (env/headers may hold secrets). */
+export function saveCustomMcpServers(servers: CustomMcpServer[]): void {
+  writeConfigField('customMcpServers', servers);
+}
+
 /** Read-modify-write a single top-level field of config.json, preserving the rest; `0600`. */
 function writeConfigField(
-  key: 'providers' | 'accounts' | 'simulatorConsent',
+  key: 'providers' | 'accounts' | 'customMcpServers' | 'simulatorConsent',
   value: unknown,
 ): void {
   const path = configPath();
@@ -261,6 +298,9 @@ function writeConfigField(
   file[key] = value;
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+  // writeFileSync's mode only applies at creation — re-assert on a pre-existing file, which may
+  // have been created loose by hand and now holds secrets (accounts, custom MCP env/headers).
+  chmodSync(path, 0o600);
 }
 
 function createDefaultSocketIoListener(file: ConfigFile): DaemonListenerConfig {

apps/daemon/src/index.ts

@@ -179,7 +179,12 @@ async function main(): Promise<void> {
   const EngineSubsystemLive = Layer.unwrap(
     Effect.gen(function* () {
       const { config, hub, previewRoutes } = yield* Shared;
-      const store = createProviderConfigStore(vault, config.providers ?? {}, config.accounts ?? []);
+      const store = createProviderConfigStore(
+        vault,
+        config.providers ?? {},
+        config.accounts ?? [],
+        config.customMcpServers ?? [],
+      );
       const assets = new AssetManager();
       const consentedAgents = consentedManagedAgents(assets);
       const gc = assets.gcAtBoot();

apps/daemon/src/provider-store.ts

@@ -1,30 +1,38 @@
 import type { ProviderConfigStore } from '@linkcode/engine';
-import type { Accounts, ProvidersConfig } from '@linkcode/schema';
-import { saveAccounts, saveProviders } from './config';
+import type { Accounts, CustomMcpServer, ProvidersConfig } from '@linkcode/schema';
+import { saveAccounts, saveCustomMcpServers, saveProviders } from './config';
 import type { SecretVault } from './secrets';
 
 /**
- * Daemon-backed data-plane config store: in-memory providers + account pool seeded at boot, each
- * persisted to `~/.linkcode/config.json` on write. Injected into the Engine so `config.get` /
- * `config.set` and per-session provider defaults read and write the same persisted values.
+ * Daemon-backed data-plane config store: in-memory providers + account pool + custom MCP servers
+ * seeded at boot, each persisted to `~/.linkcode/config.json` on write. Injected into the Engine
+ * so `config.get` / `config.set` and per-session provider defaults read and write the same
+ * persisted values.
  */
 export function createProviderConfigStore(
   vault: SecretVault,
   initialProviders: ProvidersConfig,
   initialAccounts: Accounts,
+  initialCustomMcpServers: CustomMcpServer[] = [],
 ): ProviderConfigStore {
   let providers = initialProviders;
   let accounts = initialAccounts;
+  let customMcpServers = initialCustomMcpServers;
   return {
     get: () => providers,
     set(next) {
-      providers = next;
       saveProviders(vault, next);
+      providers = next;
     },
     getAccounts: () => accounts,
     setAccounts(next) {
-      accounts = next;
       saveAccounts(vault, next);
+      accounts = next;
+    },
+    getCustomMcpServers: () => customMcpServers,
+    setCustomMcpServers(next) {
+      saveCustomMcpServers(next);
+      customMcpServers = next;
     },
   };
 }

apps/daemon/src/sim/mcp-endpoint.ts

@@ -6,6 +6,7 @@ import type {
   SimulatorMcpProvider,
   SimulatorService,
 } from '@linkcode/engine';
+import { SIMULATOR_MCP_SERVER_NAME } from '@linkcode/engine';
 import type { McpServer as McpServerEntry, SessionId } from '@linkcode/schema';
 // eslint-disable-next-line import-x/no-unresolved -- the SDK's exports-map subpaths (./server/*.js) defeat the resolver; tsc resolves them fine
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -36,7 +37,7 @@ export interface SimulatorMcpNotifications {
   devicesChanged?: (devices: Awaited<ReturnType<SimulatorService['list']>>) => void;
 }
 
-const SERVER_NAME = 'linkcode-sim';
+const SERVER_NAME = SIMULATOR_MCP_SERVER_NAME;
 const RE_MCP_PATH = /^\/mcp\/([\w-]+)$/;
 
 /** HID keyboard usages (page 7) for the keys an agent cannot express as text. Decimal because

apps/desktop/src/renderer/src/settings/plugins-tab.tsx

@@ -0,0 +1,7 @@
+import { PluginsSettingsPanel } from '@linkcode/workbench';
+
+// A transport-backed workbench container: reachable above the connection gate, degrading to
+// loading while the daemon is unreachable — same posture as the providers tab.
+export function PluginsTab(): React.ReactNode {
+  return <PluginsSettingsPanel />;
+}

apps/desktop/src/renderer/src/settings/settings-view.tsx

@@ -21,6 +21,7 @@ import {
   HistoryIcon,
   InfoIcon,
   KeyRoundIcon,
+  PuzzleIcon,
   SendIcon,
   SettingsIcon,
   SunMoonIcon,
@@ -41,6 +42,7 @@ import { GeneralTab } from './general-tab';
 import { HistoryImportTab } from './history-import-tab';
 import { ImChannelTab } from './im-channel-tab';
 import { NotificationsTab } from './notifications-tab';
+import { PluginsTab } from './plugins-tab';
 import { ProvidersTab } from './providers-tab';
 import type { SettingsCategory } from './store';
 import { useDesktopSettingsStore } from './store';
@@ -147,6 +149,14 @@ export function SettingsView(): React.ReactNode {
           active: category === 'providers',
           onClick: () => setCategory('providers'),
         },
+        {
+          key: 'plugins',
+          icon: <PuzzleIcon className="size-4" />,
+          label: t('tabs.plugins'),
+          keywords: searchKeywords.plugins,
+          active: category === 'plugins',
+          onClick: () => setCategory('plugins'),
+        },
         {
           key: 'imChannel',
           icon: <SendIcon className="size-4" />,
@@ -299,6 +309,8 @@ function renderSettingsPanel(
       return <AboutTab />;
     case 'providers':
       return <ProvidersTab />;
+    case 'plugins':
+      return <PluginsTab />;
     case 'agents':
       return <AgentsTab />;
     case 'imChannel':

apps/desktop/src/renderer/src/settings/store.ts

@@ -14,6 +14,7 @@ export type SettingsCategory =
   | 'providers'
   | 'agents'
   | 'imChannel'
+  | 'plugins'
   | 'history-import';
 
 /**

apps/webview/src/router.tsx

@@ -6,6 +6,7 @@ import { DeveloperSettings } from '@webview/routes/settings/developer';
 import { GeneralSettings } from '@webview/routes/settings/general';
 import { MessagingSettings } from '@webview/routes/settings/messaging';
 import { NotificationsSettings } from '@webview/routes/settings/notifications';
+import { PluginsSettings } from '@webview/routes/settings/plugins';
 import { ProvidersSettings } from '@webview/routes/settings/providers';
 import { SettingsLayout } from '@webview/routes/settings/settings-layout';
 import { TerminalSettings } from '@webview/routes/settings/terminal';
@@ -32,6 +33,7 @@ export function createWebviewRouter(
             { path: 'developer', element: <DeveloperSettings /> },
             { path: 'notifications', element: <NotificationsSettings /> },
             { path: 'providers', element: <ProvidersSettings /> },
+            { path: 'plugins', element: <PluginsSettings /> },
             { path: 'agents', element: <AgentsSettings /> },
             { path: 'messaging', element: <MessagingSettings /> },
           ],

apps/webview/src/routes/settings/plugins.tsx

@@ -0,0 +1,10 @@
+import { PluginsSettingsPanel } from '@linkcode/workbench';
+import { usePageTitle } from '@webview/hooks/use-page-title';
+import { useTranslations } from 'use-intl';
+
+/** The shared plugins page lives in `@linkcode/workbench`; webview only adds the page title. */
+export function PluginsSettings(): React.ReactNode {
+  const tTabs = useTranslations('settings.tabs');
+  usePageTitle(tTabs('plugins'));
+  return <PluginsSettingsPanel />;
+}