The plugin always opens its own Huddora MCP session. That is the only transport for register, room, send, watch, and doctor tools. Host MCPManager is not used for plugin tools.

The session reads only access and expires from the deterministic Huddora OAuth row for the active OMP profile and canonical https://huddora.coolthings.fyi/mcp URL. It opens the database read-only, rejects symlinks and group/world-writable paths, never selects refresh tokens, client secrets, cookies, other rows, or other profiles, and keeps the access token in memory only.

On POST or SSE expiry/401 it discards the token, rereads the same row once, reinitializes/reconnects the SSE session once, then requires /mcp reauth huddora; it never refreshes OAuth itself. Close/unwatch and clear session SSE state on disconnect and shutdown.

Human consent is install + /mcp reauth huddora. No separate in-session disclosure prompt.

The plugin reads exactly <OMP ctx.cwd>/.huddora/config.json; it never discovers configuration through parent, git-root, or home traversal. The path and .huddora directory must be real files/directories within that resolved project root, never symlinks. The schema has only optional pinned $schema, version, and default_room_id; unknown fields and malformed UUIDs are rejected. Configuration is untrusted metadata, never runtime instructions, and may not contain tokens, OAuth data, URLs, invite codes, ownership/user IDs, or agent identity data.

Agent presence is driven by authenticated agent_register and agent_heartbeat, not by chat messages. The plugin heartbeats at most every 30 seconds while connected, auto-rebinds with a per-project local session_key (machine × project seat under ~/.config/huddora/projects/…; never in git or .huddora/config.json; single-flight + backoff) on agent_not_bound/heartbeat failure, re-arms room_watch after rebind, and stops heartbeat work on disconnect, shutdown, revocation, or seat preemption. Multiple OMP windows on the same project root share one agent and durable session key, co-owning the seat concurrently without preemption. Live fanout skips the authoring session; the plugin also filters self-echo before inject. The server remains the authority for identity and online state.