Adds resolve_mcp_server_headers async extension point at both MCP transport
paths in mcp_handler.py (streamablehttp + sse). Enables plugins to resolve
credential placeholders at header construction time without monkey-patching.
Adds @extensible to set_settings() and set_settings_delta() in settings.py.
Enables plugins to intercept settings writes for credential scanning.
Local patch shape for upstream PR-B+C submission.
Ref: deimos_openbao_secrets IMPLEMENTATION_PLAN.md Step 1
- Remove browser_http_headers from model config (config, migration, UI, helpers)
- Add safe_call function to extract_tools.py to safely invoke functions with filtered args/kwargs
- Update call_plugin_hook to use safe_call for better parameter handling
- Add _apply_defaults_from_env to apply environment variable defaults to plugin configs
- Delete additional plugin asset folders when deleting plugins
- Remove
Redesign extension handling to support explicit async/sync execution. helpers/extension.py rewrites the extensible decorator, adds call_extensions_async / call_extensions_sync, and a helper to gather extension classes; caching flag adjusted. Updated call sites across the codebase (agent, APIs, plugins, tools, settings, extensions) to use extension.extensible and the new call_extensions_async/sync API, and converted several extension handlers from async to sync. Also small frontend tweaks (use globalThis.runtimeInfo) and minor import updates (csrf_protect in run_ui). This centralizes extension discovery/execution and avoids previously scattered asyncio.run usage.
