@daweifu/capability-menu 0.1.1 → 0.1.3

package/README.en.md

@@ -0,0 +1,238 @@
+<h1 align="center">dsh-capability-menu</h1>
+
+<p align="center">
+  <strong>One unified capability management surface for DeepSeek Harness: control the exposure level (context footprint) and execution of Tools and Skills</strong>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@daweifu/capability-menu"><img src="https://img.shields.io/npm/v/@daweifu/capability-menu.svg?style=flat-square&color=0969DA&labelColor=161b22&logo=npm&logoColor=white" alt="npm version"/></a>
+  <a href="https://www.npmjs.com/package/@daweifu/capability-menu"><img src="https://img.shields.io/npm/dt/@daweifu/capability-menu.svg?style=flat-square&color=0969DA&labelColor=161b22" alt="downloads"/></a>
+  <a href="https://github.com/PKUfudawei/dsh-capability-menu"><img src="https://img.shields.io/github/stars/PKUfudawei/dsh-capability-menu.svg?style=flat-square&color=dbab09&labelColor=161b22&logo=github&logoColor=white" alt="GitHub stars"/></a>
+  <a href="https://github.com/deepseek-ai/deepseek-harness"><img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.5--rc.2-4D6BFE.svg?style=flat-square&labelColor=161b22&logo=deepseek&logoColor=white" alt="DeepSeek Harness 0.1.5-rc.2"/></a>
+  <a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin"><img src="https://img.shields.io/badge/featured%20in-awesome--dsh--plugin-8250DF?style=flat-square&labelColor=161b22&logo=github&logoColor=white" alt="featured in awesome-dsh-plugin"/></a>
+  <a href="https://github.com/PKUfudawei/dsh-capability-menu/actions"><img src="https://img.shields.io/github/actions/workflow/status/PKUfudawei/dsh-capability-menu/ci.yml?branch=master&label=CI&style=flat-square&labelColor=161b22&logo=github&logoColor=white" alt="CI"/></a>
+</p>
+
+<p align="center">
+  <a href="./README.md">简体中文</a> · <strong>English</strong>
+</p>
+
+<br/>
+
+## Table of Contents
+
+- [Capability Overview](#capability-overview)
+- [Quick Install](#quick-install)
+- [Exposure Policy](#exposure-policy)
+- [Configuration](#configuration)
+
+---
+
+## Capability Overview
+
+dsh-capability-menu is a Cordis plugin for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). It builds a unified capability catalog (`ctx.capability`) over a large number of tools / skills (MCP tools and harness-native built-in tools) and manages their **exposure level and execution** in three tiers — **Resident / On-demand / Disabled** — so you can adjust the agent's capability boundary at any time, keep a flood of tools/skills out of a single request, and save tokens and context. Changes apply immediately without restarting, and the plugin composes into the Harness runtime purely through the Cordis plugin mechanism — no upstream source is modified. **Without this plugin (policy) mounted, everything stays visible as before; mounted with no rules at all, every capability defaults to Resident.**
+
+### Capability Model
+
+*Capability* is the umbrella concept introduced by this plugin: a Tool and a Skill are different *kinds* of capability.
+
+| kind | provides to the agent | action | notes |
+| --- | --- | --- | --- |
+| `tool` | executes an action (an MCP tool or a harness-native built-in tool) | `execute` | indexed by `ctx.tools` |
+| `skill` | the method / flow / knowledge for a class of tasks | `load` | indexed by `ctx.skills` |
+
+The model gets two meta tools:
+
+| tool | role | corresponding entry |
+| --- | --- | --- |
+| `meta_search` | search the capability catalog (Tool / Skill), list/detail dual mode | `@daweifu/capability-menu/search` |
+| `meta_invoke` | unified execution surface: really executes Tools (full `ctx.tools` pipeline) + loads Skills | `@daweifu/capability-menu/invoke` |
+
+### Capability Management
+
+<p align="center">
+  <img src="assets/screenshot-tools.png" alt="Tools tab" width="48%"/>
+  <img src="assets/screenshot-skills.png" alt="Skills tab" width="48%"/>
+</p>
+<p align="center">
+  <img src="assets/screenshot-policy.png" alt="Policy &amp; catalog · Policy (effective)" width="48%"/>
+  <img src="assets/screenshot-catalog.png" alt="Policy &amp; catalog · On-demand catalog" width="48%"/>
+</p>
+
+Once installed, a Capability Management tab appears under Settings → General Settings (between "Model" and "Plugins"). It lets you visualize and adjust the exposure policy; changes apply immediately, no restart needed:
+
+- **Tools / Skills tabs**: the top tab bar shows `Tools` and `Skills`, with per-tier counts, Refresh and Register capability on its right; the read-only Policy & catalog entry sits on the header's description row. The Tools tab groups by server and folds: MCP tools under their own server, harness-native tools together under the built-in group. Click a row for the tool's model-facing definition.
+- **Skills tab**: split into "Global skills" / "Project skills" sub-tabs, with the counts following the active one. Click a skill row to expand its directory tree; click a file to preview it.
+- **Three-state dot**: filled = Resident, half-filled ring = On-demand, ring with a slash (a no-entry sign) = Disabled. Click a dot or a tier count to cycle — native and MCP tools are equally manageable; if a higher-priority rule (a wildcard, say) overrides it, the UI reports that the classification did not apply.
+- **Policy &amp; catalog**: the button on the header's description row opens a read-only modal with two files — the effective policy in a semantic view, and the materialized On-demand catalog (`catalogFile`, On-demand capabilities only). Rules are changed by clicking on the page; a change is written back to this plugin's entry `config` (`patchFile`, the home layer's `~/.dsh/cordis.patch.yml` by default — see "Configuration").
+- **Register capability**: the top-right button opens a form with "MCP server" / "Skill directory" sub-tabs, defaulting to the tab you are on. The modal holds the form only — registered entries are in the list, each with its own Edit.
+  - **MCP server**: registering one writes an `@deepseek-ai/dsh-mcp-client` row into the patch file, **mounted natively by dsh** (this plugin never manages the connection) — the same file and the same table as hand-written entries, no restart needed. Fields: `serverName`, transport (the form picks `streamable-http` by default), stdio's command / args / cwd / env, http's URL / headers, and a timeout in seconds; the form explains what each field takes.
+    > **Headers** carry the credentials: one `Key: Value` per line, `Authorization: Bearer …` and the like. They are stored in **plain text** in `~/.dsh/cordis.patch.yml`, exactly as with hand-written entries.
+  - **Skill directory**: two locations — **Global** (`~/.dsh/skills/`, visible to every session) or **Project** (`<projectRoot>/.dsh/skills/`, visible only to sessions whose cwd sits inside that project). For a project you only supply any existing path inside it; the project root is derived the way dsh derives it, and the panel reports the path actually written. Either way it is a symlink, exactly matching dsh's own skill discovery. Registration validates the `SKILL.md` the way dsh's loader does and reports failures, so a directory can no longer register here and then be silently skipped by dsh. The skill's name is the one declared in `SKILL.md`; the directory name only names the symlink.
+- **Edit**: every MCP server group header in the Tools tab and every skill row with a manageable entry (project skills included) carries an Edit button that opens the current configuration prefilled, to change, save or remove. `serverName` is read-only when editing (it forms the `mcp__<serverName>__<tool>` prefix), and a skill's location cannot be changed — moving between roots is remove + register.
+- **Remove**: removal asks for confirmation first and states what this particular removal costs — an MCP server loses its patch row, while a skill's cost depends on whether the entry is a symlink or a real directory (the latter is deleted recursively and cannot be recovered). The built-in group has no Edit button, because it is not a real MCP server.
+- **Adopt**: for skills in user-level roots such as `~/.agents/skills` / `customSkillDirs`, the row offers Adopt; the confirmation names the directory the skill currently lives in, and confirming links it into `~/.dsh/skills/` (**content untouched**). Rows that cannot be adopted show their source instead — a specific directory, or a category such as "custom skill dirs" / "bundled with dsh"; the action and the source never both appear.
+- **Refresh**: the Refresh button rebuilds the capability catalog and re-pulls the list. Registering a source refreshes once automatically; the manual button is for when you changed a source outside dsh (edited the patch file by hand, linked a skill directory yourself).
+
+## Quick Install
+
+Prerequisites: Node.js and the dsh CLI installed (`dsh plugin` forwards to pnpm internally).
+
+### Install from npm (recommended)
+
+A single package ships both the server-side plugin and the front-end Capability Management tab; once installed it shows up under Settings → General Settings:
+
+```sh
+dsh plugin --profile web add @daweifu/capability-menu
+```
+
+### Install from source
+
+```sh
+git clone https://github.com/PKUfudawei/dsh-capability-menu.git
+cd dsh-capability-menu
+pnpm install                   # the prepare script builds lib/ (server) and lib/client.js (front-end)
+
+dsh plugin --profile web add ./dsh-capability-menu
+```
+
+### Verify the install
+
+```sh
+dsh --profile web --dump-config | grep -E 'capability-menu'
+```
+
+```
+# == @daweifu/capability-menu
+- id: capability-menu-registry
+  name: '@daweifu/capability-menu/registry'
+- id: capability-menu-search
+  name: '@daweifu/capability-menu/search'
+- id: capability-menu-invoke
+  name: '@daweifu/capability-menu/invoke'
+- id: capability-menu-policy
+  name: '@daweifu/capability-menu/policy'
+- id: capability-menu
+  name: '@daweifu/capability-menu'
+```
+
+### Uninstall
+
+```sh
+dsh plugin --profile web remove @daweifu/capability-menu
+```
+
+## Exposure Policy
+
+All capabilities (Tool and Skill) fall into three tiers by their **exposure level** (what the model sees in the context) and their **execution mode**:
+
+### Tools / Skills three-tier exposure and execution
+
+| tier | capability | exposure (model view) | discovery | execution |
+| --- | --- | --- | --- | --- |
+| **Resident** | tool | full schema in `assembly.tools` → the model's `tools` request payload, visible at every step | none (already resident) | model calls it directly; at runtime it goes through the full `ctx.tools` pipeline |
+| | skill | name + description in the `<available_skills>` catalog (body not in the catalog) | none (already resident) | the `skill` tool loads the body on demand (on-demand loading) |
+| **On-demand** | tool | not in the payload (zero context cost) | `meta_search` list / `grep` the materialized catalog YAML (`catalogFile`) | executed by `meta_invoke` (via `ctx.tools.execute`, full pipeline); or fetch the schema through detail and call it directly |
+| | skill | not in the `<available_skills>` catalog | `meta_search`, or `grep` the materialized catalog YAML (`catalogFile`) | `meta_invoke` loads the SKILL.md body (via `ctx.skills`) |
+| **Disabled** | tool | not in the payload | not returned by `meta_search`, not written to the catalog YAML | refused by `meta_invoke`; hallucinated direct calls are also hard-rejected in `tools/pre-execute` |
+| | skill | not in the `<available_skills>` catalog | not returned by `meta_search`, not written to the catalog YAML | refused by `meta_invoke`; the `skill` tool is hard-rejected in `tools/pre-execute` |
+
+> **Scope & reserved tools**:
+> - The tool tiers cover both `mcp__` cataloged tools and harness-native built-in tools (native tools are grouped under the reserved `built-in` server and are managed in all three tiers exactly like MCP tools). **Do not name a real MCP server `built-in`.**
+> - `meta_search`/`meta_invoke` are this plugin's control plane: always Resident, cannot be disabled (a rule that disables one fails at startup). `run_code` is the reserved Code Mode transport: it never enters the catalog, does not appear in Capability Management, and should not get tier rules.
+> - **Keep high-frequency core tools Resident**: an On-demand built-in tool leaves the model's resident view and needs a `meta_search` → `meta_invoke` two-hop call.
+
+## Configuration
+
+Rules are declared under the `config` of this plugin's `capability-menu-policy` entry — by default in the home layer's `~/.dsh/cordis.patch.yml` (`$DSH_HOME` wins), and a profile's `cordis.patch.yml` can also amend it with an id-targeted override patch (the outer `- insert:` / `id` / `name` is Cordis patch boilerplate and has nothing to do with the rules):
+
+```yaml
+config:
+  tools:
+    resident:
+      - execute_cmd
+      - get_session_context
+      - search_kb
+      - 'mcp__gongfeng__*'    # wildcard: everything under this server is resident
+    on-demand:
+      - 'mcp__*'              # wildcard fallback
+      - 'server:km:*'         # bulk on-demand by server prefix
+    disabled:
+      - 'mcp__secret__*'      # disabled outranks everything, even resident
+  skills:
+    resident:
+      - debugging
+      - coding
+    on-demand:
+      - legacy_skill          # explicit on-demand (unlisted skills default to resident)
+    disabled:
+      - forbidden_skill
+  metaTools:
+    - meta_search             # always resident; cannot be disabled
+    - meta_invoke
+```
+
+> Config keys are the tier words themselves: `resident` (常驻) / `on-demand` (按需) / `disabled` (禁用).
+
+### All configuration options
+
+| Option | Entry | Default | Description |
+| --- | --- | --- | --- |
+| `tools` / `skills` / `metaTools` | `capability-menu-policy` | see above | Tier rules; UI changes are written back to this entry's `config` after the debounce |
+| `catalogFile` | `capability-menu-registry` | `~/.dsh/capability-catalog.yaml` | Materialized on-demand catalog path; empty disables it |
+| `refreshDebounceMs` | `capability-menu-registry` | `200` | Debounce window (ms) for change-event rebuilds; `0` disables debouncing |
+| `patchFile` | `capability-menu-policy` | `~/.dsh/cordis.patch.yml` (`$DSH_HOME` wins) | Patch file that MCP server registration writes to |
+| `skillsDir` | `capability-menu-policy` | `~/.dsh/skills` | Skill root used by skill directory registration |
+| `persistDebounceMs` | `capability-menu-policy` | `1500` | Debounce window (ms) before a clicked tier change is written back to the patch file |
+
+**Rule priority** (first match wins; within one tier, an exact rule beats a wildcard):
+
+| priority | rule | example | effect |
+| --- | --- | --- | --- |
+| 1 | `disabled` exact | `disabled: [forbidden_skill]` | hardest deny, overrides everything |
+| 2 | `disabled` wildcard | `disabled: ['mcp__secret__*']` | block a whole group |
+| 3 | `resident` exact | `resident: [bash]` | keep one capability resident |
+| 4 | `on-demand` exact | `on-demand: [legacy_skill]` | one capability on-demand (what a Capability Management click writes) |
+| 5 | `resident` wildcard | `resident: ['mcp__gongfeng__*']` | keep a whole group resident |
+| 6 | `on-demand` wildcard | `on-demand: ['mcp__*']` | bulk on-demand fallback |
+| default | no rule matched | — | resident |
+
+Key points:
+- **Exact rules win over wildcards (even across tiers)**: e.g. with `resident: ['mcp__gongfeng__*']` in place, clicking a tool to On-demand in the Capability Management writes an exact `on-demand` rule that takes effect instead of being pushed back by the wildcard (if a higher-priority rule still overrides it, the UI reports that the classification did not apply).
+
+> **Two kinds of change, both persisted**:
+>
+> - **Tier classification** changes memory first (so a click takes effect immediately) and is written back to this plugin's entry `config` (`patchFile`, the home layer's `~/.dsh/cordis.patch.yml` by default) once you stop for ~1.5s — writing that file makes dsh hot-reload this plugin and re-run the capability enumeration, so it cannot happen on every click. To batch-declare rules under version control, edit that same entry; no import/export buttons are needed.
+> - **Registered sources** (MCP servers, skill directories) hit disk as you click: MCP rows go into the same patch file (as `@deepseek-ai/dsh-mcp-client` entries), skill directories are linked into the skill root.
+
+### On-demand capability catalog (`catalogFile`, the single materialized catalog, searchable with `grep`)
+
+On-demand capabilities are materialized into **one auto-generated YAML file** the model can browse:
+
+- The file location is the `config.catalogFile` of the **registry entry** (`capability-menu-registry`): it defaults to `~/.dsh/capability-catalog.yaml` and an empty string disables emission. The registry rewrites it automatically on any tool/skill or classification change. When nothing is On-demand, the catalog pointer is not injected (saving context).
+- A skill must first be **registered in `ctx.skills`** (a skill provider — e.g. its SKILL.md under a user/project skills root or `customSkillDirs`) to show up automatically; there is **no separate user-maintained input file**.
+- The model browses the file with `grep`/`read` (or calls `meta_search`) to get an entry's id and `kind`, then calls `meta_invoke(id, kind)` to run/load it. Skill ids are the bare name (e.g. `frontend-design`); `kind` distinguishes tools from skills.
+
+```yaml
+# ~/.dsh/capability-catalog.yaml (auto-generated; contains only On-demand
+# capabilities — Resident ones are already resident and Disabled ones must not
+# be discoverable, so neither is written. Lists are emitted as `-` block
+# sequences, one item per line.)
+capabilities:
+  - id: mcp__km__search
+    kind: tool
+    name: mcp__km__search
+    description: Search the knowledge base
+    server: km
+  - id: legacy_skill
+    kind: skill
+    name: legacy_skill
+    description: A low-frequency skill for working on legacy code
+    whenToUse: Use when working on legacy projects
+```
+
+> The catalog file is written under the host's `~/.dsh` by default, so the sandbox of the model-side `bash`/`read` tools must be able to reach that path. If the sandbox isolates the host directory, explicitly configure `catalogFile` to a path the sandbox can see. The default path is shared across multiple dsh instances (last-write-wins); in multi-instance deployments, give each instance its own `catalogFile`.
+
+## License
+
+This project is licensed under the [Apache License 2.0](LICENSE).

package/README.md

@@ -1,50 +1,78 @@
 <h1 align="center">dsh-capability-menu</h1>
 
 <p align="center">
-  <strong>为 DeepSeek Harness 提供统一的能力菜单管理 Tools 和 Skills 的暴露水平 (上下文占用大小) 和执行方式</strong>
+  <strong>为 DeepSeek Harness 统一管理 Tools 和 Skills 的暴露水平（上下文占用大小）与执行方式</strong>
 </p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@daweifu/capability-menu"><img src="https://img.shields.io/npm/v/@daweifu/capability-menu.svg?style=flat-square&color=0969DA&labelColor=161b22&logo=npm&logoColor=white" alt="npm version"/></a>
-  <a href="./LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-2EA44F?style=flat-square&labelColor=161b22" alt="license"/></a>
+  <a href="https://www.npmjs.com/package/@daweifu/capability-menu"><img src="https://img.shields.io/npm/dt/@daweifu/capability-menu.svg?style=flat-square&color=0969DA&labelColor=161b22" alt="downloads"/></a>
   <a href="https://github.com/PKUfudawei/dsh-capability-menu"><img src="https://img.shields.io/github/stars/PKUfudawei/dsh-capability-menu.svg?style=flat-square&color=dbab09&labelColor=161b22&logo=github&logoColor=white" alt="GitHub stars"/></a>
-  <a href="https://github.com/cordiverse/cordis"><img src="https://img.shields.io/badge/stack-Cordis%20bundle-7FBDF1.svg?style=flat-square&labelColor=161b22&logo=cardano&logoColor=white" alt="Cordis bundle"/></a>
-  <a href="https://github.com/deepseek-ai/deepseek-harness"><img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.1--rc.1-4D6BFE.svg?style=flat-square&labelColor=161b22&logo=deepseek&logoColor=white" alt="DeepSeek Harness 0.1.1-rc.1"/></a>
+  <a href="https://github.com/deepseek-ai/deepseek-harness"><img src="https://img.shields.io/badge/DeepSeek%20Harness-0.1.5--rc.2-4D6BFE.svg?style=flat-square&labelColor=161b22&logo=deepseek&logoColor=white" alt="DeepSeek Harness 0.1.5-rc.2"/></a>
+  <a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin"><img src="https://img.shields.io/badge/featured%20in-awesome--dsh--plugin-8250DF?style=flat-square&labelColor=161b22&logo=github&logoColor=white" alt="featured in awesome-dsh-plugin"/></a>
   <a href="https://github.com/PKUfudawei/dsh-capability-menu/actions"><img src="https://img.shields.io/github/actions/workflow/status/PKUfudawei/dsh-capability-menu/ci.yml?branch=master&label=CI&style=flat-square&labelColor=161b22&logo=github&logoColor=white" alt="CI"/></a>
 </p>
 
+<p align="center">
+  <strong>简体中文</strong> · <a href="./README.en.md">English</a>
+</p>
+
 <br/>
 
 ## 目录
 
-- [能力菜单](#能力菜单)
+- [能力总览](#能力总览)
 - [快速安装](#快速安装)
-- [能力模型](#能力模型)
 - [暴露策略](#暴露策略)
 - [配置文件](#配置文件)
 
 ---
 
-dsh-capability-menu 是 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的一个 Cordis 插件，为海量 MCP tools / skills 建立统一能力目录（`ctx.capability`），并以**常驻 / 按需 / 禁用**三档管理暴露程度和执行方式——随时调整 agent 的能力边界，避免海量 tools/skills 塞满一次请求、节省 token 和上下文：
+## 能力总览
+
+dsh-capability-menu 是 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的一个 Cordis 插件，为海量 tools / skills（MCP 工具与内置原生工具）建立统一能力目录（`ctx.capability`），并以**常驻 / 按需 / 禁用**三档管理暴露程度和执行方式——随时调整 agent 的能力边界，避免海量 tools/skills 塞满一次请求、节省 token 和上下文。调整即时生效、无需重启，纯插件机制组合进 Harness 运行时，不改上游源码。**不挂载本插件（policy）时一切照旧、全量可见；挂载但未配置任何规则时，所有能力默认常驻。**
+
+### 能力模型
+
+Capability 是本插件引入的上位概念：Tool / Skill 是不同类型的 capability。
+
+| kind | 对 Agent 提供 | action | 备注 |
+| --- | --- | --- | --- |
+| `tool` | 执行一个动作（MCP 工具或内置原生工具） | `execute` | 由 `ctx.tools` 索引 |
+| `skill` | 某类任务的方法/流程/知识 | `load` | 由 `ctx.skills` 索引 |
+
+模型获得两个元工具：
 
-- **统一能力目录**：编目所有 MCP 工具与 Skill，模型经 `meta_search` 检索、`meta_invoke` 执行。
-- **三档能力策略**：常驻 = 高频能力随叫随到；按需 = 低频能力归档进目录、用到才翻出来；禁用 = 明确禁止。这是你配置的驻留策略，不是按使用次数自动统计的标签。
-- **可视化配置**：「能力菜单」设置 tab（MCP tools / Skills 两栏，分类可点击循环切换），调整即时生效。
-- **零侵入**：不改上游源码，经 Cordis 插件机制与 Harness 组合进同一运行时。
+| 工具 | 作用 | 对应 entry |
+| --- | --- | --- |
+| `meta_search` | 检索能力目录（Tool / Skill），list/detail 双模式 | `@daweifu/capability-menu/search` |
+| `meta_invoke` | 统一执行面：Tool 真执行（走完整 `ctx.tools` 管线）+ Skill 加载 | `@daweifu/capability-menu/invoke` |
 
-## 能力菜单
+### 能力菜单
 
 <p align="center">
-  <img src="assets/screenshot-mcp-tools.png" alt="MCP tools tab" width="45%"/>
-  <img src="assets/screenshot-skills.png" alt="Skills tab" width="45%"/>
+  <img src="assets/screenshot-tools.png" alt="Tools 页" width="48%"/>
+  <img src="assets/screenshot-skills.png" alt="Skills 页" width="48%"/>
+</p>
+<p align="center">
+  <img src="assets/screenshot-policy.png" alt="策略与目录 · 三档策略配置" width="48%"/>
+  <img src="assets/screenshot-catalog.png" alt="策略与目录 · 按需能力目录" width="48%"/>
 </p>
 
-安装后，「设置 / 通用设置」下出现「能力菜单」tab（位于「模型」与「插件」之间），用于可视化查看和调整暴露策略，改动即时生效、无需重启：
-
-- **两栏**：MCP 工具（按 server 分组、可折叠）与 Skills。
-- **三态圆点 + 统计**：每个能力带一个分类圆点（实心 = 常驻、半实心 = 按需、空心 = 禁用），栏顶部显示各档数量统计。
-- **点击循环切换**：点击能力旁的圆点或分类计数即可循环切换分类；MCP 工具还可以点击整行查看模型侧工具定义（name / description / parameters）。
-- **Skills 目录浏览**：展开某个 skill 可浏览其文件目录，点击文件预览 SKILL.md 等正文内容。
+安装后，「设置 / 通用设置」下出现「能力菜单」tab（位于「模型」与「插件」之间），用于可视化查看和调整暴露策略，改动即时生效、无需重启。
+
+- **Tools / Skills 页签**：顶部 Tab 栏为 `Tools` 与 `Skills`，右侧是各档数量统计、「刷新」与「注册能力」，只读的「策略与目录」入口在页头说明行右侧。Tools 页按 server 分组、可折叠：MCP 工具挂在各自 server 下，内置原生工具统一在「系统内置」组。点击某行查看模型侧的工具定义。
+- **Skills 页签**：内部分「全局技能 / 项目技能」两个子页签，数量统计跟随当前页签。点击技能行展开目录树，点文件预览正文。
+- **三态圆点**：实心 = 常驻、上半实心圆环 = 按需、圆环 + 斜杠（禁行标志）= 禁用。点圆点或分类计数即可循环切换，内置原生工具与 MCP 工具同等可管；被更高优先级规则（如通配）覆盖时，界面会提示「分类未生效」。
+- **策略与目录**：页头说明行右侧的按钮弹出只读弹层，含**生效策略的语义化视图**与**按需能力目录**（`catalogFile`，仅含按需能力）两份文件。改规则的入口是页面上点选，改动会在停手后自动写回本插件 entry 的 `config`（`patchFile`，默认 home 层的 `~/.dsh/cordis.patch.yml`，见「配置文件」）。
+- **注册能力**：右上角「注册能力」按钮弹出表单，内含「MCP 服务器 / Skill 目录」两个子页签，默认停在你当前所在的页签。弹窗里只放表单——已注册项在列表里，各带「编辑」。
+  - **MCP 服务器**：注册即写入 patch 文件里的 `@deepseek-ai/dsh-mcp-client` 条目，**由 dsh 原生挂载**（插件不自己管连接），与手写声明式条目同文件、同一张表，无需重启。字段含 `serverName`、传输方式（表单代为选定默认 `streamable-http`）、stdio 的命令 / 参数 / 工作目录 / 环境变量、http 的 URL / 请求头、超时（秒）；各字段的取用方式表单里有说明。
+    > **请求头**用于认证：每行 `Key: Value`，`Authorization: Bearer …` 等凭据填在这里。**明文**存入 `~/.dsh/cordis.patch.yml`（与手写条目一致）。
+  - **Skill 目录**：可选**全局**（`~/.dsh/skills/`，所有会话可见）或**项目**（`<项目根>/.dsh/skills/`，只对 cwd 落在该项目内的会话可见）。选项目时只需填项目内任意一个已存在的路径，项目根按 dsh 的规则确定，面板会回报实际写入的路径。两种情况都是建软链，与 dsh 原生的 skill 发现机制一致。注册前按 dsh 加载器的口径校验 `SKILL.md`，不合格直接报错，不会出现「注册成功但 dsh 静默不加载」。技能名以 `SKILL.md` 里声明的为准，目录名只决定软链名。
+- **编辑**：Tools 页的 MCP server 分组头、Skills 页上已有可管理条目的技能行（含项目技能）都有「编辑」，点开预填当前配置，可改、可存、可移除。`serverName` 编辑时只读（它构成 `mcp__<serverName>__<tool>` 前缀）；技能的位置不可改——换根等于「移除 + 重新注册」。
+- **移除**：移除前先确认，并说明这次移除的实际后果：MCP 是删除其 patch 行；Skill 视软链 / 真实目录而不同，后者连同文件递归删除、不可恢复。「系统内置」组没有「编辑」，因为它不是真实 MCP 服务器。
+- **纳入管理**：`~/.agents/skills`、`customSkillDirs` 这类用户级根里的技能，行上给「纳入管理」；确认框会写明它当前所在的目录，确认后在 `~/.dsh/skills/` 下建一条指向它的软链，**内容不动**。不能纳管的行改为显示来源——某个具体目录，或「自定义技能目录」「随 dsh 预置」这类归类；动作与来源只出现其一。
+- **刷新**：点「刷新」重建能力目录并重新拉取列表。注册来源后会自动刷新一次，手动刷新只用于你在 dsh 之外改动过来源（手改 patch 文件、手动软链 skill 目录）之后。
 
 ## 快速安装
 
@@ -94,22 +122,6 @@ dsh --profile web --dump-config | grep -E 'capability-menu'
 dsh plugin --profile web remove @daweifu/capability-menu
 ```
 
-## 能力模型
-
-Capability 是本插件引入的上位概念：Tool / Skill 是不同类型的 capability。
-
-| kind | 对 Agent 提供 | action | 备注 |
-| --- | --- | --- | --- |
-| `tool` | 执行一个动作（MCP 工具） | `execute` | 由 `ctx.tools` 索引 |
-| `skill` | 某类任务的方法/流程/知识 | `load` | 由 `ctx.skills` 索引 |
-
-模型获得两个元工具：
-
-| 工具 | 作用 | 对应 entry |
-| --- | --- | --- |
-| `meta_search` | 检索能力目录（Tool / Skill），list/detail 双模式 | `@daweifu/capability-menu/search` |
-| `meta_invoke` | 统一执行面：Tool 真执行（走完整 `ctx.tools` 管线）+ Skill 加载 | `@daweifu/capability-menu/invoke` |
-
 ## 暴露策略
 
 所有能力（Tool 与 Skill）按 **暴露程度**（模型在上下文中看到什么）与 **执行方式** 分为三档：
@@ -120,52 +132,104 @@ Capability 是本插件引入的上位概念：Tool / Skill 是不同类型的 c
 | --- | --- | --- | --- | --- |
 | **常驻** | tool | 完整 schema 进 `assembly.tools` → 模型请求 `tools` payload，每步可见 | 无需发现（已常驻） | 模型直接调用，运行时走完整 `ctx.tools` 管线 |
 | | skill | 名字+描述进 `<available_skills>` 目录（正文不在目录） | 无需发现（已常驻） | `skill` 工具按需加载正文（渐进加载） |
-| **按需** | tool | 不进 payload（零上下文成本） | `meta_search` list 返回 name+summary | `meta_invoke` 执行（走 `ctx.tools.execute`，管线完整）；或 detail 拿 schema 后直接调 |
-| | skill | 不进 `<available_skills>` 目录 | `meta_search` 检索（`progressiveSkillCatalog` 条目） | `meta_invoke` 按 `path` 加载 SKILL.md 正文 |
-| **禁用** | tool | 不进 payload | `meta_search` 不返回 | `meta_invoke` 拒绝，直接调用被投影排除 |
-| | skill | 不进目录 | `meta_search` 不返回 | `meta_invoke` 拒绝 |
+| **按需** | tool | 不进 payload（零上下文成本） | `meta_search` list / `grep` 检索物化目录 YAML（`catalogFile`） | `meta_invoke` 执行（走 `ctx.tools.execute`，管线完整）；或 detail 拿 schema 后直接调 |
+| | skill | 不进 `<available_skills>` 目录 | `meta_search` 检索 / `grep` 检索物化目录 YAML（`catalogFile`） | `meta_invoke` 加载 SKILL.md 正文（经 `ctx.skills`） |
+| **禁用** | tool | 不进 payload | `meta_search` 不返回、目录 YAML 不写入 | `meta_invoke` 拒绝；模型幻觉直调也在 `tools/pre-execute` 被硬拒绝 |
+| | skill | 不进 `<available_skills>` 目录 | `meta_search` 不返回、目录 YAML 不写入 | `meta_invoke` 拒绝；`skill` 工具在 `tools/pre-execute` 硬拒绝 |
 
-> 上表的 tool 档位均指 `mcp__` 编目工具；原生工具不参与三档管理，只能以 `tools.exposed` 保活可见性（见下方配置文件示例）。
+> **覆盖与保留**：
+> - `tool` 档同时覆盖 `mcp__` 编目工具与内置原生工具——原生工具统一以保留的 `built-in` server 归组，与 MCP 工具一样三档可管。**请勿把真实 MCP server 命名为 `built-in`。**
+> - `meta_search`/`meta_invoke` 是本插件的控制面：恒常驻、不可被禁用（在规则里禁用它们会在启动时报错）。`run_code` 是 Code Mode 保留传输层：不进目录、不在「能力菜单」出现，请勿为它配置三档规则。
+> - **不建议把高频核心工具设为按需**：按需的内置工具会退出模型常驻视野，使用时需要 `meta_search` → `meta_invoke` 两跳调用。
 
 ## 配置文件
 
-规则写在 profile 的 `cordis.patch.yml` 里 `capability-menu-policy` 插件 entry 的 `config` 下（外层 `- insert:` / `id` / `name` 是 Cordis patch 的挂载样板，与规则无关）：
+规则写在本插件 entry（`capability-menu-policy`）的 `config` 下，默认落在 home 层的 `~/.dsh/cordis.patch.yml`（`$DSH_HOME` 优先），也可以由任一 profile 的 `cordis.patch.yml` 用一条按 id 定位的覆盖补丁改写（外层 `- insert:` / `id` / `name` 是 Cordis patch 的挂载样板，与规则无关）。**手写和「能力菜单」里点选都可以**：点选只改内存（所以响应快），停手约 1.5s 后再自动写回这个 entry——因为写这个文件会让 dsh 热重载本插件并重跑一次能力枚举，所以不能每次点击都写。
 
 ```yaml
 config:
   tools:
-    exposed: [execute_cmd, get_session_context, search_kb, 'mcp__gongfeng__*']   # 通配：该 server 下全部常驻
-    progressive: ['mcp__*', 'server:km:*']                                        # 通配兜底 + 按 server 前缀批量按需
-    blocked: ['mcp__secret__*']                                                   # 禁用优先级最高，压过常驻
+    resident:
+      - execute_cmd
+      - get_session_context
+      - search_kb
+      - 'mcp__gongfeng__*'    # 通配：该 server 下全部常驻
+    on-demand:
+      - 'mcp__*'              # 通配兜底
+      - 'server:km:*'         # 按 server 前缀批量按需
+    disabled:
+      - 'mcp__secret__*'      # 禁用优先级最高，压过常驻
   skills:
-    exposed: [debugging, coding]
-    progressive: [legacy_skill]          # 显式按需（未列出即默认常驻）
-    blocked: [forbidden_skill]
-  metaTools: [meta_search, meta_invoke]  # 恒常驻，不可被禁用
-  progressiveSkillCatalog: ~/.dsh/progressive-skills.yaml
+    resident:
+      - debugging
+      - coding
+    on-demand:
+      - legacy_skill          # 显式按需（未列出即默认常驻）
+    disabled:
+      - forbidden_skill
+  metaTools:
+    - meta_search             # 恒常驻，不可被禁用
+    - meta_invoke
 ```
 
-**规则优先级**（命中即停，同级内精确匹配先于通配）：`blocked` > `exposed` > `progressive`，未命中任何规则默认 Exposed；`blocked` 是最硬的控制（压过 `exposed`），meta 工具（`meta_search`/`meta_invoke`）恒为 Exposed 且不可被 blocked。`tools.exposed` 里列原生工具名（`execute_cmd` 等）是**保活**：原生工具不进能力编目、只受投影链裁剪可见性，列在这里保持模型可见可调——一旦被 progressive/blocked 覆盖，模型就看不到也调不到。
+> 配置键即档位英文词：`resident`（常驻）/ `on-demand`（按需）/ `disabled`（禁用）。
+
+### 全部配置项
+
+| 配置项 | 归属 entry | 默认值 | 说明 |
+| --- | --- | --- | --- |
+| `tools` / `skills` / `metaTools` | `capability-menu-policy` | 见上 | 三档分类规则；能力菜单的改动会（防抖后）自动写回本 entry 的 `config` |
+| `catalogFile` | `capability-menu-registry` | `~/.dsh/capability-catalog.yaml` | 按需能力目录物化路径，置空禁用 |
+| `refreshDebounceMs` | `capability-menu-registry` | `200` | 变更事件的重建防抖窗口（ms）；`0` 关闭防抖 |
+| `patchFile` | `capability-menu-policy` | `~/.dsh/cordis.patch.yml`（`$DSH_HOME` 优先） | 注册 MCP 服务器写入的 patch 文件 |
+| `skillsDir` | `capability-menu-policy` | `~/.dsh/skills` | 注册 Skill 目录的技能根 |
+| `persistDebounceMs` | `capability-menu-policy` | `1500` | 点选改动写回 patch 文件前的防抖窗口（ms）|
+
+**规则优先级**（从上到下命中即停；同档内精确规则优先于通配）：
 
-> 「能力菜单」tab 的改动只写入运行时内存、不落盘；要持久化（随 profile 生效、可版本管理/批量声明），编辑 profile 的 `cordis.patch.yml` 即可——这就是持久化入口，无需额外的导入/导出按钮。
+| 优先级 | 规则 | 示例 | 效果 |
+| --- | --- | --- | --- |
+| 1 | `disabled` 精确 | `disabled: [forbidden_skill]` | 最硬禁用，压过一切 |
+| 2 | `disabled` 通配 | `disabled: ['mcp__secret__*']` | 整组禁用 |
+| 3 | `resident` 精确 | `resident: [bash]` | 单个能力显式常驻 |
+| 4 | `on-demand` 精确 | `on-demand: [legacy_skill]` | 单个能力显式按需（能力菜单点击写入的就是这类） |
+| 5 | `resident` 通配 | `resident: ['mcp__gongfeng__*']` | 整组常驻 |
+| 6 | `on-demand` 通配 | `on-demand: ['mcp__*']` | 兜底批量按需 |
+| 默认 | 未命中任何规则 | — | 常驻 |
+
+要点：
+- **精确规则优先于通配（跨档也成立）**：例如存在 `resident: ['mcp__gongfeng__*']` 时，在「能力菜单」把某工具点成按需会写入一条精确 `on-demand` 规则并生效，不会被通配压回；若仍被更高优先级规则覆盖，界面提示「分类未生效」。
+
+> **两类改动，落盘位置不同**：
+>
+> - **三档分类**先只改内存（所以点击即时生效），停手约 1.5s 后自动写回本插件 entry 的 `config`（`patchFile`，默认 home 层的 `~/.dsh/cordis.patch.yml`）——写这个文件会让 dsh 热重载本插件并重跑一次能力枚举，所以不能每次点击都写。要在版本管理里批量声明规则，直接编辑同一条 entry 即可，无需额外的导入/导出按钮。
+> - **注册的来源**（MCP 服务器、Skill 目录）在点击当下就落盘：MCP 写进同一个 patch 文件（`@deepseek-ai/dsh-mcp-client` 条目），Skill 在技能根下建软链。
 
-### 渐进技能目录（`progressiveSkillCatalog`）
+### 按需能力目录（`catalogFile`，唯一物化目录，grep 可检索）
 
-按需（Progressive）技能不进固定上下文，也可能根本没注册进 `ctx.skills`。为了让它们仍可被发现，用一份独立 YAML 存 name + description + path，由 registry 索引、`meta_search` 检索；完整 SKILL.md 由 `meta_invoke` 按需加载（`ctx.skills` 未注册时按 YAML 的 `path` 读取）：
+On-demand 能力自动物化成**一个 YAML 文件**给模型检索（改档位只重写这个文件——库存没变，不需要重新枚举工具与各 agent preset 的技能层）：
+
+- 文件位置在 **registry entry（`capability-menu-registry`）** 的 `config.catalogFile`，默认 `~/.dsh/capability-catalog.yaml`，置空禁用；工具/技能变更或分类调整后自动重写。没有任何按需能力时不注入目录指引，省上下文。
+- 技能必须**已注册进 `ctx.skills`**（SKILL.md 放用户/项目技能根或挂 `customSkillDirs`）才会自动出现；无独立手写输入清单。
+- 模型用 `grep`/`read` 浏览该文件（或调 `meta_search`）拿到条目的 id 与 `kind`，再调 `meta_invoke(id, kind)` 执行/加载。技能 id 即裸名（`frontend-design`），tool/skill 由 `kind` 区分。
 
 ```yaml
-# ~/.dsh/progressive-skills.yaml
-skills:
-  - name: legacy_skill            # 对应 skills.progressive 里的规则名
-    description: 旧版迁移技能，低频使用
+# ~/.dsh/capability-catalog.yaml（自动生成；仅含 On-demand 能力，
+# Resident 已常驻、Disabled 不可发现，均不写入；列表以 `-` 每项一行的 block 序列写出）
+capabilities:
+  - id: mcp__km__search
+    kind: tool
+    name: mcp__km__search
+    description: 搜索知识库
+    server: km
+  - id: legacy_skill
+    kind: skill
+    name: legacy_skill
+    description: 处理旧工程的低频技能
     whenToUse: 处理旧工程时使用
-    path: /path/to/legacy_skill   # 含 SKILL.md 的目录
 ```
 
-### 默认（不配置 policy）
-
-- 不挂 `capability-menu-policy` → 全部工具/技能照旧可见（不投影）。
-- 挂了 policy 但没有任何规则 → 全部能力默认 Exposed（`classify` 兜底），不投影、不隐藏。需要把低频能力归档进目录时，显式配置 `progressive`（或 `blocked`）规则把它们从模型视野中移出。
+> 目录文件默认写在宿主 `~/.dsh`，需要模型侧 `bash`/`read` 工具的沙箱能访问该路径；若沙箱隔离宿主目录，请把 `catalogFile` 显式配置到沙箱可见的路径。默认路径在多个 dsh 实例间共享（last-write-wins），多实例部署时请为每个实例配置独立的 `catalogFile`。
 
 ## License
 

package/cordis.patch.yml

@@ -16,51 +16,41 @@
 #   - id: capability-menu-policy
 #     name: '@daweifu/capability-menu/policy'
 #       config:
-#         tools:
-#           exposed:
-#             - execute_cmd
-#             - get_session_context
-#             - search_kb
-#             - 'mcp__gongfeng__*'
-#           progressive:
-#             - 'mcp__*'
-#             - 'server:km:*'
-#           blocked: []
-#         skills:
-#           exposed:
-#             - debugging
-#             - coding
-#         metaTools:
-#           - meta_search
-#           - meta_invoke
-#         progressiveSkillCatalog: ~/.dsh/progressive-skills.yaml
+#         # Rule syntax — tier keys `resident` / `on-demand` / `disabled`
+#         # (exact names, `*` globs, or `server:<name>:*`), plus `metaTools` —
+#         # and the priority order are documented in the README「配置文件」
+#         # section; the shipped defaults live in the insert block below.
 #
 # - `capability-menu-registry` (P0): builds/indexes the capability catalog and
 #   exposes the `ctx.capability` service (search/get/getDetail/refresh). It registers
-#   no model-facing tool itself. Indexes the GLOBAL registry (no visibility
-#   filter) and additionally indexes Progressive skills from
-#   `progressiveSkillCatalog` (§7.2).
+#   no model-facing tool itself. Indexes every visible tool — MCP tools by their
+#   server and harness-native tools (bash/read/write/…) under the reserved
+#   `built-in` pseudo-server — plus skills from the global layer and every
+#   mountable preset's standing scope. The single on-demand catalog is emitted to
+#   `catalogFile` (default `~/.dsh/capability-catalog.yaml`) for grep/read.
 # - `capability-menu-search` (P1): registers the `meta_search` tool (list + detail).
 # - `capability-menu-invoke` (P2): registers the `meta_invoke` tool (unified
-#   execution of MCP tools and skill loading). Executes on the GLOBAL view
-#   (no agent) so Progressive tools stay runnable; dedups already-loaded skills.
-#   Rejects Blocked capabilities.
-# - `capability-menu-policy` (P3): Exposed/Progressive/Blocked projection
-#   strategy + 能力管理 surface. Reads explicit exposed/progressive/blocked
+#   execution of tools — MCP or native — and skill loading). Executes on the GLOBAL
+#   view (no agent) so On-demand tools stay runnable; dedups already-loaded skills.
+#   Rejects Disabled capabilities.
+# - `capability-menu-policy` (P3): Resident/On-demand/Disabled projection
+#   strategy + 能力菜单 surface. Reads explicit resident/on-demand/disabled
 #   rules (exact name + glob + server:<name>:*) and filters `assembly.tools` at
-#   `system-prompt/assemble` to Exposed + meta tools only. The execution chain
-#   (`ctx.tools.execute`) is untouched, so Progressive tools remain executable
-#   via `meta_invoke`. Exposes `ctx.capabilityPolicy` with
-#   `classifyAll`/`getConfig`/`updateConfig` for the frontend 能力菜单 tab
-#   (Exposed/Progressive/Blocked rules + click-to-cycle classification +
-#   read-only list), plus skill file browsing (`getDetail`/`listSkillDir`/
-#   `readSkillFile`) via the Typert gateway.
+#   `system-prompt/assemble` to Resident + meta tools only. The execution chain
+#   (`ctx.tools.execute`) is untouched, so On-demand capabilities remain executable
+#   via `meta_invoke`. Exposes `ctx.capabilityPolicy` to the 能力菜单 tab through
+#   the Typert gateway: the tier surface (`classifyAll`/`getConfig`/
+#   `updateConfig`), the registered-location surface (`listLocations`/`addLocation`/
+#   `updateLocation`/`removeLocation` and `listSkillLocations`/`addSkillLocation`/
+#   `updateSkillLocation`/`removeSkillLocation`/`adoptSkillLocation`), the
+#   read-only catalog docs (`getCatalogDocs`), a rebuild trigger (`refresh`), and
+#   skill browsing (`getDetail`/`listSkillDir`/`readSkillFile`). Tier clicks land
+#   in this entry's own `config` after `persistDebounceMs`; registered MCP servers
+#   land in `patchFile` and skill directories as links under `skillsDir`.
 #
-# Default (policy present but no config): every capability is Exposed — the
-# `classify` fallback, nothing is hidden. Add explicit `progressive`/`blocked`
-# rules to pull capabilities out of the model surface. This bundle ships the
-# harness-native coding tools under `tools.exposed` so the model keeps direct
-# bash/file access.
+# Default (policy present but no config): every capability is Resident — the
+# `classify` fallback, nothing is hidden. Add explicit `on-demand`/`disabled`
+# rules to pull capabilities out of the model surface.
 - insert:
     - id: capability-menu-registry
       name: '@daweifu/capability-menu/registry'
@@ -71,15 +61,16 @@
     - id: capability-menu-policy
       name: '@daweifu/capability-menu/policy'
       config:
-        # Harness-native coding tools stay context-resident (Exposed) so the
-        # model can call them directly. meta_invoke only dispatches MCP `mcp__*`
-        # tools, so native tools (bash/read/write/edit/glob/grep) MUST stay
-        # Exposed — listing them Progressive/Blocked would make them neither
-        # visible nor invocable. The default (unlisted) class is Exposed; add
-        # explicit `progressive`/`blocked` rules to pull MCP servers and skills
-        # out of the model surface.
+        # Native coding tools are cataloged under the reserved `built-in`
+        # pseudo-server and are fully manageable like MCP tools. Unlisted
+        # capabilities default to Resident; list them under `on-demand`/
+        # `disabled` to pull MCP servers, native tools, or skills out of the
+        # model surface. On-demand native tools stay invocable through
+        # `meta_search` → `meta_invoke`. The `meta_search`/`meta_invoke`
+        # control-plane tools and the reserved `run_code` transport never enter
+        # the catalog. Do not name a real MCP server `built-in`.
         tools:
-          exposed:
+          resident:
             - bash
             - read
             - write