feat: add resolve_mcp_server_headers hook + @extensible on set_settings (local PR-B+C shape)

Adds resolve_mcp_server_headers async extension point at both MCP transport
paths in mcp_handler.py (streamablehttp + sse). Enables plugins to resolve
credential placeholders at header construction time without monkey-patching.

Adds @extensible to set_settings() and set_settings_delta() in settings.py.
Enables plugins to intercept settings writes for credential scanning.

Local patch shape for upstream PR-B+C submission.
Ref: deimos_openbao_secrets IMPLEMENTATION_PLAN.md Step 1

Author: Deimos-Agent

helpers/mcp_handler.py

@@ -42,6 +42,7 @@
 from helpers import dirty_json
 from helpers.print_style import PrintStyle
 from helpers.tool import Tool, Response
+from helpers.extension import call_extensions_async
 
 
 def normalize_name(name: str) -> str:
@@ -1105,10 +1106,21 @@ async def _create_stdio_transport(
         # Check if this is a streaming HTTP type
         if _is_streaming_http_type(server.type):
             # Use streamable HTTP client
+            # Before passing headers to httpx, allow extensions to resolve placeholders
+            resolved_headers = await call_extensions_async(
+                "resolve_mcp_server_headers",
+                agent=None,
+                server_name=server.name,
+                headers=dict(server.headers or {}),
+            )
+            if resolved_headers is not None:
+                headers_to_use = resolved_headers
+            else:
+                headers_to_use = server.headers
             transport_result = await current_exit_stack.enter_async_context(
                 streamablehttp_client(
                     url=server.url,
-                    headers=server.headers,
+                    headers=headers_to_use,
                     timeout=timedelta(seconds=init_timeout),
                     sse_read_timeout=timedelta(seconds=tool_timeout),
                     httpx_client_factory=client_factory,
@@ -1123,10 +1135,21 @@ async def _create_stdio_transport(
             return read_stream, write_stream
         else:
             # Use traditional SSE client (default behavior)
+            # Before passing headers to httpx, allow extensions to resolve placeholders
+            resolved_headers = await call_extensions_async(
+                "resolve_mcp_server_headers",
+                agent=None,
+                server_name=server.name,
+                headers=dict(server.headers or {}),
+            )
+            if resolved_headers is not None:
+                headers_to_use = resolved_headers
+            else:
+                headers_to_use = server.headers
             stdio_transport = await current_exit_stack.enter_async_context(
                 sse_client(
                     url=server.url,
-                    headers=server.headers,
+                    headers=headers_to_use,
                     timeout=init_timeout,
                     sse_read_timeout=tool_timeout,
                     httpx_client_factory=client_factory,

helpers/settings.py

@@ -14,6 +14,7 @@
 from helpers.secrets import get_default_secrets_manager
 from helpers import dirty_json
 from helpers.notification import NotificationManager, NotificationType, NotificationPriority
+from helpers.extension import extensible
 
 
 T = TypeVar('T')
@@ -312,6 +313,7 @@ def set_runtime_settings_snapshot(settings: Settings) -> None:
     _runtime_settings_snapshot = settings.copy()
 
 
+@extensible
 def set_settings(settings: Settings, apply: bool = True):
     global _settings
     previous = _settings
@@ -322,6 +324,7 @@ def set_settings(settings: Settings, apply: bool = True):
     return reload_settings()
 
 
+@extensible
 def set_settings_delta(delta: dict, apply: bool = True):
     current = get_settings()
     new = {**current, **delta}