docs: plan the Claude Code plugin and SimpleX channel of the MCP server (#8074)

* docs: plan the Claude Code plugin and SimpleX channel of the MCP server

* docs: MCP plan, adopting #7810 from its branch

* docs: MCP plan, one pull request from the branch of #7810

* docs: MCP plan, a group per session

* docs: MCP plan, mirroring the terminal conversation

* docs: MCP plan, Claude and User profiles, model and effort

* docs: MCP plan, sessions inside one group

* docs: MCP plan, sessions as subgroups

* docs: MCP plan, one Claude profile, decisions D8-D10

* docs: MCP plan, implementation goal

* docs: MCP plan, decisions 27-35 on mirroring and tool use

* docs: MCP plan, model and effort change outside the group

* plans: plugin launch from its own build, one session per process

* plans: hold prompts after a daemon start until the session attaches

* plans: publish the plugin with production dependencies only

* plan: resumed sessions, turn records, ordered prompts, lock check

* plan: quote once, refused quotes, lock wait, cut prompts

* plan: hold a new session's title until its server registers

* plan: late turn records, tag-only prompts, lock claims, held titles

* plan: delete groups of sessions closed 7 days; no group for claude -p

* plan: keep the approved mode in the session group, the link off /status

* plan: apply leaving, removal and demotion in the Main group to sessions

* plan: reply sends a file after an owner's approval when non-owners see it

* plan: the line count is an estimate; done is complete and tested

* plan: resumes after deletion, User's group, unattended runs, reply cards

* plan: trust model of the Main group; review-driven changes removed

Adds the Trust model section set by the user, rewrites decision 17, and marks decisions 60, 62, 63 and 64-66 as removed by the user's rule on reviews; the sections on closed sessions, runs without a group, the cascade of Main group changes and User's newest group are removed, and the reply section follows rule 5.

* plan: no group for claude -p kept, the unattended mark, the MCP era test

Decision 60 keeps the runs without a group, by the user's answer R1 B, with the amendment of the unattended mark; only the deletion of closed groups stays removed, with decisions 64 and 65. Decision 66 is restored, decision 69 records the test of the protocol revision, the section on runs that are not interactive returns with its diagrams, and the channel instructions follow the trust model.

* plan: //, /!, guest prompts, parts of a message, approve_guest_files

Decisions 70-73 record the user's answers: // and /! with the approved texts, Unknown command. as a placeholder, guests' prompts with approvals kept, the option approve_guest_files; decisions 17, 33, 41 and 53 are rewritten; the trust model, the mechanics, the diagrams and the pending texts follow.

* plan: large replies, User's commands, part search, reply size, marks

Decision 50 covers a post refused as largeMsg; decisions 74-77 record User's dropped commands, the search of a part within one message size, the reply's message size check and the removal of old unattended marks; the mechanics and diagrams follow.

* plan: a reset of the owners leaves the session groups as they are

Decision 78 records the user's decision by rule 4 of the trust model; the Groups section and its diagram follow.

* plan: the corrected trust model: every session member controls it

The trust model is replaced by the user's corrected one; decisions 79-83 record every member's control, the join post with /observer, the /observer command, files approved by owners of the Main group with approve_files, and the start notice pending; decision 71 takes the user's text; the mechanics, diagrams and the pending texts follow.

* plan: the role model of session groups

Rights in a session group follow the member's role there: admins and owners prompt, approve and send // and /!; moderators, members and authors prompt; /join N invites as admin; Claude posts the member's rights at each join and role change; files of reply are sent at once under the group's preference for files and media; session groups keep no invited records. Decisions 84-89, and proposal 90 for the profile kept from groupUpdated.

* plan: / commands from admins and owners, profile updates from the current profile

Decision 92 records that every message of a member who sends is a prompt except / commands, // and /!. Proposals 90, profile updates from the group's current profile, and 91, one refusal of the / commands of moderators, members and authors, wait for the user.

* plan: diagrams render whole on GitHub

Semicolons and # in sequence messages, notes and state transitions are written as #59; and #35;, and the second colon of a state note as #58;. All 26 diagrams of the plan render with GitHub's Mermaid viewer, each text in full.

* plan: /observer and profile updates after review round 7

Decisions 93-96: /observer reads the members again after the role change; it answers that a member who has not joined yet is no member; profile updates of a session group run one at a time; the code has no comments.

* plan: rights texts of the UX page's recommended branch

Decision 97: the rights texts name / commands, and the owner's post has no /observer command.

* plan: session group description of the UX page's recommended branch

Decision 98: the session group's description, set at its creation.

* plan: Main group welcome and join post, approved as B1 and B2

* plan: Main group short description, T3 of the UX page

* plan: Main group reply to an unknown command, G6 of the UX page

* plan: reply answers the files refusal with its own text

* plan: Main group texts set at its creation, UX-F3 a

* plan: admins and owners in the texts outside the group, rule 3

* plan: no reply to commands of members past the one refusal, U2 a

* plan: expiry timers wait at most 60 s, review round 8 F1

* plan: text cards while media are off, review round 8 question 2 a

* plan: /forward while media are off, review round 8 question 3 a

* plan: decision 93 names when an observer's approvals count again

* plan: serve passes the 0.2 tests unchanged, review round 8 question 1 b

* plan: the UX page's new address

* plan: premises, and open decisions decided by judgement but UX-I1

* plan: decision 31 reads the effort level from every turn hook, as the code

* plan: decisions 107 and 109 state the behaviour exactly, round 9 N2 N3

* plan: one text names a refusing group preference; serve /give as 0.2

* plan: decision 76 without the card reply no longer has

* plan: decision 114, a refused outcome card leaves the action done

* plan: decision 114, a refused outcome card says the action was performed

* plan: decision 114, a refused prompt of User says it is not allowed for User

* plan: decision 114, a card refused after the decision names the outcome

* plan: decision 114, the one-period log line is the plugin's; serve keeps 0.2's

* plan: decision 113 b, the user's answer: reset-owners needs no approval

* plan: decision 116, the service, and root files no agent name can take

* plan: decision 117, the user's answer: // and /! are removed

* plan: decision 118, the user's answer: the plugin's skills are removed

* plan: decision 21 names the PreToolUse hook's plugin/allow.js

* plan: decision 119, the user's answer: bundled dependencies, no lockfile

* plan: decision 120, the user's answer: plugin-only README, shared settings

* plan: decision 31, the Stop hook sends the model of its answer

* docs: the MCP server's PLAN.md moves to plans/2026-10-19-mcp-server.md

* plan: decisions 121 and 122, typed prompts and the newest model

packages/simplex-chat-mcp/REFERENCE.md

@@ -15,7 +15,7 @@ What it isn't:
   - a Claude Code plugin or channel;
   - registration in other hosts.
 
-Status: v0.2. [`TESTING.md`](TESTING.md) describes a local build and test. The design, the tools and the scenarios are in [`PLAN.md`](PLAN.md).
+Status: v0.2. [`TESTING.md`](TESTING.md) describes a local build and test. The design, the tools and the scenarios are in the [design record](../../plans/2026-10-19-mcp-server.md).
 
 - [Requirements](#requirements)
 - [Quick start](#quick-start)
@@ -259,7 +259,7 @@ Commands:
 
 After `/leave #9`, or after the agent's `leave` of #9 is performed in either mode, when the chat's folder has files, the agent posts ``Files from business Ridgeline (#9) are kept in `/home/alice/.simplex-mcp/my-agent/files/group-9`: 3 files, 2.1 MB. /delete #9 files``. The files forwarded from #9 are deleted when the agent leaves it.
 
-`/pending`, `/list` and `/leave` are in the chat's command menu, and the cards carry the others. Tapping `/leave` in the menu puts `/leave <chat ID>` into the entry field: replace `<chat ID>` with the chat's ID from `/list`, such as `#9`, and send it. Each command includes its number, because the app sends a tapped command as a new message, without a quote. Every card form and reply is listed in [`PLAN.md`](PLAN.md), section "What the owner sees: the agent control chat".
+`/pending`, `/list` and `/leave` are in the chat's command menu, and the cards carry the others. Tapping `/leave` in the menu puts `/leave <chat ID>` into the entry field: replace `<chat ID>` with the chat's ID from `/list`, such as `#9`, and send it. Each command includes its number, because the app sends a tapped command as a new message, without a quote. Every card form and reply is listed in the [design record](../../plans/2026-10-19-mcp-server.md), section "What the owner sees: the agent control chat".
 
 ### Approval of all messages to a chat
 
@@ -315,7 +315,7 @@ An empty file is refused, and so is `as` without `file`. A message holds at most
 
 The server checks the file by its real path, after symbolic links, and refuses files under `~/.ssh` and `~/.gnupg`, files named `id_*`, `*.pem`, `*.key`, `*.p12` and `*.pfx`, and the files under its data folder and under `~/.simplex-mcp`, except those under `files/` of its own data folder; each folder is taken by its real path too. The card shows the real path. A file whose real path, size, inode or change time differs at the send from the request is not sent: the action fails.
 
-Incognito: the core creates a random profile for that one chat, so peers of different chats can't link them. The tools' inputs, results and errors are in [`PLAN.md`](PLAN.md), section "What the agent sees: tools", and the call sequences of the scenarios in section "Sequence diagrams".
+Incognito: the core creates a random profile for that one chat, so peers of different chats can't link them. The tools' inputs, results and errors are in the [design record](../../plans/2026-10-19-mcp-server.md), section "What the agent sees: tools", and the call sequences of the scenarios in section "Sequence diagrams".
 
 ## Waiting for approval in Claude Code
 

packages/simplex-chat-mcp/spec/README.md

@@ -2,7 +2,7 @@
 
 > Technical specification of `@simplex-chat/mcp` 0.2.0 in `packages/simplex-chat-mcp`. Statements are checked against the source at commit `937a975a6`, and each section links to the code.
 >
-> Related: [README](../README.md) (user manual) | [PLAN](../PLAN.md) (design record) | [TESTING](../TESTING.md) (local build and test)
+> Related: [README](../README.md) (user manual) | [PLAN](../../../plans/2026-10-19-mcp-server.md) (design record) | [TESTING](../TESTING.md) (local build and test)
 
 ## Table of contents
 

packages/simplex-chat-mcp/spec/api.md

@@ -478,7 +478,7 @@ Command lines ([`commandsLine`](../src/control.ts#L603-L616)):
 | `download` | `/'receive CHAT N', /'receive CHAT N all', /'forward CHAT N' or /'reject CHAT N'`, without `/'receive CHAT N all'` for unknown servers |
 | `leave` | `/'approve CHAT N' or /'reject CHAT N'` |
 
-The app shows `/'approve N'` as the tappable command `/approve N` ([PLAN, What the owner sees](../PLAN.md#what-the-owner-sees-the-agent-control-chat)).
+The app shows `/'approve N'` as the tappable command `/approve N` ([PLAN, What the owner sees](../../../plans/2026-10-19-mcp-server.md#what-the-owner-sees-the-agent-control-chat)).
 
 An action performed without a card, in mode `host` or under a standing approval, gets its outcome as a new message; a `download` without a card gets none ([control.ts:145-152](../src/control.ts#L145-L152), [:495-497](../src/control.ts#L495-L497)).
 

packages/simplex-chat-mcp/spec/architecture.md

@@ -3,7 +3,7 @@
 > System structure, modules, state, process lifecycle, approval model and security boundaries of `@simplex-chat/mcp` 0.2.0.
 >
 > Related specs: [README](README.md) | [Flows](flows.md) | [API](api.md)
-> Related docs: [README](../README.md) | [Reference](../REFERENCE.md) | [PLAN](../PLAN.md)
+> Related docs: [README](../README.md) | [Reference](../REFERENCE.md) | [PLAN](../../../plans/2026-10-19-mcp-server.md)
 
 **Source:** [`cli.ts`](../src/cli.ts) | [`serve.ts`](../src/serve.ts) | [`http.ts`](../src/http.ts) | [`tools.ts`](../src/tools.ts) | [`actions.ts`](../src/actions.ts) | [`control.ts`](../src/control.ts) | [`messages.ts`](../src/messages.ts) | [`files.ts`](../src/files.ts) | [`register.ts`](../src/register.ts) | [`log.ts`](../src/log.ts)
 
@@ -622,7 +622,7 @@ The server writes the tappable form `/'...'` only in the card's command line ([c
 
 - The join link is a group link of the control chat with role `member`, or `observer` with `--owners`; it is printed with a QR code on stdout and deleted at the first join event ([control.ts:406-416](../src/control.ts#L406-L416), [:372](../src/control.ts#L372), [:381](../src/control.ts#L381)).
 - At every start the server sets private message routing: `smpProxyMode` `always`, `smpProxyFallback` `allowProtected` ([serve.ts:91-92](../src/serve.ts#L91-L92)).
-- With `incognito: true` the join methods connect incognito ([tools.ts:721](../src/tools.ts#L721)); the core then uses a random profile for that chat ([PLAN, Participants](../PLAN.md#participants)).
+- With `incognito: true` the join methods connect incognito ([tools.ts:721](../src/tools.ts#L721)); the core then uses a random profile for that chat ([PLAN, Participants](../../../plans/2026-10-19-mcp-server.md#participants)).
 
 ---