@dsh-libing/mcp-manager 0.0.0-stage → 0.1.0

package/lib/shared.js

@@ -0,0 +1,151 @@
+/** Authenticated protocol. Paths and raw config are never browser identities. */
+import { z } from 'zod';
+export const API = '/api/libing-mcp-manager';
+export const MCP = '@deepseek-ai/dsh-mcp-client';
+const id = z.string().min(1).max(512);
+const revision = z.string().regex(/^[a-f0-9]{64}$/u);
+const short = z
+    .string()
+    .max(4096)
+    .refine((value) => !value.includes('\0'));
+export const selectionSchema = z
+    .object({ workspaceId: id.optional(), sessionId: id.optional() })
+    .strict();
+export const secretSchema = z.discriminatedUnion('action', [
+    z
+        .object({
+        key: z.string().regex(/^[A-Za-z_][A-Za-z0-9_-]{0,127}$/u),
+        action: z.literal('keep')
+    })
+        .strict(),
+    z
+        .object({
+        key: z.string().regex(/^[A-Za-z_][A-Za-z0-9_-]{0,127}$/u),
+        action: z.literal('remove')
+    })
+        .strict(),
+    z
+        .object({
+        key: z.string().regex(/^[A-Za-z_][A-Za-z0-9_-]{0,127}$/u),
+        action: z.literal('value'),
+        value: short
+    })
+        .strict(),
+    z
+        .object({
+        key: z.string().regex(/^[A-Za-z_][A-Za-z0-9_-]{0,127}$/u),
+        action: z.literal('env'),
+        value: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u)
+    })
+        .strict()
+]);
+export const configSchema = z
+    .object({
+    serverName: z.string().regex(/^[A-Za-z0-9_-]{1,32}$/u),
+    transport: z.enum(['stdio', 'streamable-http']),
+    command: short.default(''),
+    args: z.array(short).max(128).default([]),
+    cwd: short.default(''),
+    url: short.default(''),
+    secrets: z.array(secretSchema).max(64).default([]),
+    toolCallTimeoutMs: z.number().int().min(1000).max(300000).default(60000),
+    reconnect: z.boolean().default(true)
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.transport === 'stdio' && !value.command.trim())
+        context.addIssue({ code: 'custom', message: 'Executable required', path: ['command'] });
+    if (value.transport === 'streamable-http') {
+        try {
+            const url = new URL(value.url);
+            if (!['https:', 'http:'].includes(url.protocol) ||
+                url.username ||
+                url.password ||
+                url.search ||
+                url.hash)
+                throw new Error();
+        }
+        catch {
+            context.addIssue({
+                code: 'custom',
+                message: 'HTTP URL required; put credentials in headers',
+                path: ['url']
+            });
+        }
+    }
+    const keys = value.secrets.map((item) => item.key);
+    if (new Set(keys).size !== keys.length ||
+        keys.some((key) => ['__proto__', 'constructor', 'prototype'].includes(key)))
+        context.addIssue({
+            code: 'custom',
+            message: 'Duplicate or reserved credential key',
+            path: ['secrets']
+        });
+});
+export const mutationSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('create'), revision, config: configSchema }).strict(),
+    z.object({ kind: z.literal('update'), id, revision, config: configSchema }).strict(),
+    z.object({ kind: z.literal('delete'), id, revision, confirm: z.literal(true) }).strict(),
+    z.object({ kind: z.literal('enable'), id, revision, enabled: z.boolean() }).strict(),
+    z
+        .object({
+        kind: z.literal('policy'),
+        name: id,
+        revision,
+        enabled: z.boolean(),
+        selection: selectionSchema
+    })
+        .strict(),
+    z.object({ kind: z.literal('probe'), id, revision, confirm: z.literal(true) }).strict()
+]);
+export const toolSchema = z.object({
+    name: id,
+    description: z.string(),
+    parameters: z.record(z.string(), z.unknown()),
+    output: z.unknown().nullable(),
+    source: z.enum(['mcp', 'plugin', 'core', 'unknown']),
+    owner: z.string().nullable(),
+    visible: z.boolean().nullable(),
+    allowed: z.boolean(),
+    protected: z.boolean()
+});
+export const serverSchema = z.object({
+    id,
+    serverName: z.string(),
+    scope: z.string(),
+    origin: z.enum(['managed', 'profile', 'preset']),
+    transport: z.string(),
+    enabled: z.boolean(),
+    phase: z.string().nullable(),
+    toolCount: z.number().nullable(),
+    editable: z.boolean(),
+    toggleable: z.boolean(),
+    config: configSchema.nullable(),
+    credentialKeys: z.array(z.string()),
+    tested: z
+        .object({
+        ok: z.boolean(),
+        at: z.string(),
+        durationMs: z.number(),
+        toolCount: z.number().optional()
+    })
+        .nullable()
+});
+export const stateSchema = z.object({
+    profile: z.string(),
+    patchRevision: revision,
+    policyRevision: revision,
+    workspaceId: id,
+    workspaces: z.array(z.object({ id, title: z.string(), path: z.string() })),
+    sessions: z.array(z.object({ id, title: z.string(), cwd: z.string() })),
+    selectedSessionId: id.nullable(),
+    scopeKind: z.enum(['live', 'preset', 'global']),
+    presetId: z.string().nullable(),
+    tools: z.array(toolSchema),
+    servers: z.array(serverSchema),
+    notices: z.array(z.string())
+});
+export const outcomeSchema = z.object({
+    application: z.enum(['applied', 'restart-required', 'overridden', 'failed', 'tested']),
+    notice: z.string().optional()
+});

package/lib/storage.d.ts

@@ -0,0 +1,23 @@
+import type { Document } from 'yaml';
+export declare const hash: (text: string) => string;
+export declare class ManagerError extends Error {
+    status: number;
+    constructor(message: string, status?: number);
+}
+export declare const message: (error: unknown) => string;
+export declare function readOwnedFile(file: string): Promise<string>;
+export declare function commit(file: string, before: string, after: string): Promise<void>;
+export declare const BEGIN = "# BEGIN dsh-libing MCP managed entries\n", END = "# END dsh-libing MCP managed entries\n";
+export declare function document(text: string): Document;
+/** Official YAML writes may move comments, so IDs determine ownership, not marker position. */
+export declare function patchBlock(text: string): {
+    before: string;
+    body: string;
+    after: string;
+    exists: boolean;
+};
+export declare function rowsIn(text: string): {
+    doc: Document<import("yaml").Node, true>;
+    rows: (import("yaml").Scalar<unknown> & import("yaml").YAMLSeq<unknown>) | undefined;
+};
+export declare function replaceBlock(text: string, body: string): string;

package/lib/storage.js

@@ -0,0 +1,106 @@
+/** Owned patch block preserves surrounding bytes, including foreign !!js expressions. */
+import { createHash } from 'node:crypto';
+import { lstat, readFile } from 'node:fs/promises';
+import { isMap, isSeq, parseDocument } from 'yaml';
+import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+export const hash = (text) => createHash('sha256').update(text).digest('hex');
+export class ManagerError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.status = status;
+    }
+}
+export const message = (error) => error instanceof ManagerError ? error.message : 'Operation failed; check local DSH diagnostics';
+export async function readOwnedFile(file) {
+    try {
+        const stat = await lstat(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024)
+            throw new ManagerError('Unsupported or oversized configuration file', 409);
+        return await readFile(file, 'utf8');
+    }
+    catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT')
+            return '';
+        throw error;
+    }
+}
+export async function commit(file, before, after) {
+    if ((await readOwnedFile(file)) !== before)
+        throw new ManagerError('Configuration changed; refresh and retry', 409);
+    if (before)
+        await writeFileAtomic(`${file}.libing-backup`, before, { mode: 0o600, dirMode: 0o700 });
+    if ((await readOwnedFile(file)) !== before)
+        throw new ManagerError('Configuration changed; refresh and retry', 409);
+    await writeFileAtomic(file, after, { mode: 0o600, dirMode: 0o700 });
+}
+export const BEGIN = '# BEGIN dsh-libing MCP managed entries\n', END = '# END dsh-libing MCP managed entries\n';
+export function document(text) {
+    const doc = parseDocument(text.trim() ? text : '[]\n', {
+        customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: (value) => value }]
+    });
+    if (doc.errors.length || !isSeq(doc.contents))
+        throw new ManagerError('Profile patch must be a valid YAML sequence', 409);
+    return doc;
+}
+/** Official YAML writes may move comments, so IDs determine ownership, not marker position. */
+export function patchBlock(text) {
+    const full = document(text);
+    if (!isSeq(full.contents))
+        throw new ManagerError('Invalid profile patch', 409);
+    const groups = full.contents.items.filter((node) => {
+        const rows = isMap(node) ? node.get('insert', true) : undefined;
+        return (isSeq(rows) &&
+            rows.items.some((row) => isMap(row) &&
+                typeof row.get('id') === 'string' &&
+                String(row.get('id')).startsWith('libing-mcp-')));
+    });
+    if (groups.length > 1)
+        throw new ManagerError('Multiple managed groups; edit at their source', 409);
+    const group = groups[0];
+    if (!group)
+        return { before: text, body: '[]\n', after: '', exists: false };
+    if (!isMap(group) || group.items.length !== 1 || !group.range)
+        throw new ManagerError('Unsupported managed group', 409);
+    const rows = group.get('insert', true);
+    if (!isSeq(rows) ||
+        rows.items.some((row) => !isMap(row) || !/^libing-mcp-[a-f0-9-]+$/u.test(String(row.get('id')))))
+        throw new ManagerError('Mixed ownership in managed group', 409);
+    const start = group.range[0] - 2, end = group.range[2];
+    if (text.slice(start, start + 2) !== '- ')
+        throw new ManagerError('Managed entries require a block sequence', 409);
+    return {
+        before: text.slice(0, start),
+        body: text.slice(start, end),
+        after: text.slice(end),
+        exists: true
+    };
+}
+export function rowsIn(text) {
+    const { body } = patchBlock(text), doc = document(body);
+    if (!isSeq(doc.contents))
+        throw new ManagerError('Invalid managed entries', 409);
+    const insert = doc.contents.items[0];
+    if (doc.contents.items.length > 1 ||
+        (insert && (!isMap(insert) || !isSeq(insert.get('insert', true)))))
+        throw new ManagerError('Unsupported managed block; edit manually', 409);
+    const rows = isMap(insert) ? insert.get('insert', true) : undefined;
+    return { doc, rows: isSeq(rows) ? rows : undefined };
+}
+export function replaceBlock(text, body) {
+    const block = patchBlock(text), parsed = document(body);
+    const first = isSeq(parsed.contents) ? parsed.contents.items[0] : undefined;
+    const rows = isMap(first) ? first.get('insert', true) : undefined;
+    if (block.exists) {
+        const next = `${block.before}${isSeq(rows) && rows.items.length ? body : ''}${block.after}`;
+        document(next);
+        return next;
+    }
+    // The empty flow sequence must give way to the first block-sequence row.
+    const before = block.before
+        .replace(/^\s*\[\]\s*$/gmu, '')
+        .replace(/^# (?:BEGIN|END) dsh-libing MCP managed entries(?:\n|$)/gmu, '');
+    const next = `${before}${before && !before.endsWith('\n') ? '\n' : ''}${BEGIN}${body}${END}${block.after}`;
+    document(next);
+    return next;
+}

package/lib/view.d.ts

@@ -0,0 +1,31 @@
+/** Real service/scope observation. Cold reads lease a preset, never create an Agent. */
+import { type Context } from '@deepseek-ai/cordis';
+import type ToolRuntime from '@deepseek-ai/dsh-tools';
+import { SessionId } from '@deepseek-ai/dsh-session';
+import type { ScopeKey } from '@deepseek-ai/dsh-scope';
+import type { Selection, State, ToolItem } from './shared.ts';
+import type { ToolPolicy } from './policy.ts';
+import type { ServerRecord } from './servers.ts';
+export declare function selectionView(ctx: Context, selection: Selection, signal: AbortSignal): Promise<{
+    workspaceId: string;
+    workspaces: {
+        id: string;
+        title: string;
+        path: string;
+    }[];
+    sessions: {
+        id: SessionId;
+        cwd: string;
+        title: string;
+    }[];
+    selectedSessionId: string | null;
+}>;
+export interface ToolView {
+    tools: ToolRuntime;
+    scope?: ScopeKey;
+    kind: State['scopeKind'];
+    presetId: string | null;
+}
+export declare function withToolView<T>(ctx: Context, sessionId: string | null, signal: AbortSignal, read: (view: ToolView) => Promise<T>): Promise<T>;
+/** Source annotations are conservative; undocumented ownership remains unknown. */
+export declare function directory(ctx: Context, view: ToolView, servers: ServerRecord[], policy: ToolPolicy): ToolItem[];

package/lib/view.js

@@ -0,0 +1,176 @@
+/** Real service/scope observation. Cold reads lease a preset, never create an Agent. */
+import { symbols } from '@deepseek-ai/cordis';
+import { SessionId } from '@deepseek-ai/dsh-session';
+import { livePresetMounts } from '@deepseek-ai/dsh-agent-preset-registry';
+import { scopeChainOf, scopeOf } from '@deepseek-ai/dsh-scope';
+import { basename, resolve } from 'node:path';
+import { realpath } from 'node:fs/promises';
+import { hash, ManagerError } from "./storage.js";
+import { protectedTool } from "./policy.js";
+import { declaresTool } from "./providers.js";
+const canonical = async (path) => await realpath(path).catch(() => resolve(path));
+export async function selectionView(ctx, selection, signal) {
+    const records = await ctx.sessionQuery.listSessions(signal), workspaces = (ctx.get('workspaceRegistry')?.list() ?? []).map((w) => ({
+        id: w.id,
+        path: w.path,
+        title: w.title
+    }));
+    const paths = new Map();
+    for (const session of records) {
+        if (!session.header.cwd)
+            continue;
+        const path = await canonical(session.header.cwd);
+        paths.set(session.header.id, path);
+        if (!workspaces.some((w) => w.path === path))
+            workspaces.push({
+                id: `cwd-${hash(path)}`,
+                path,
+                title: basename(path) || path
+            });
+    }
+    if (!workspaces.length) {
+        const path = await canonical(ctx.profileContext.cwd);
+        workspaces.push({
+            id: `cwd-${hash(path)}`,
+            path,
+            title: basename(path) || path
+        });
+    }
+    const selected = selection.workspaceId
+        ? workspaces.find((w) => w.id === selection.workspaceId)
+        : (workspaces.find((w) => w.path === paths.get(selection.sessionId ?? '')) ?? workspaces[0]);
+    if (!selected)
+        throw new ManagerError('Workspace no longer exists', 404);
+    const matching = records.filter((r) => paths.get(r.header.id) === selected.path);
+    if (selection.sessionId && !matching.some((r) => r.header.id === selection.sessionId))
+        throw new ManagerError('Session does not belong to this workspace', 409);
+    const titles = await ctx.sessionQuery.readTitleSnapshots(matching.map((r) => r.header.id), signal);
+    const sessions = matching.map((r) => {
+        const title = titles.find((t) => t.sessionId === r.header.id);
+        return {
+            id: r.header.id,
+            cwd: r.header.cwd ?? selected.path,
+            title: title?.status === 'fulfilled' ? (title.value.title?.title ?? '') : ''
+        };
+    });
+    return {
+        workspaceId: selected.id,
+        workspaces,
+        sessions,
+        selectedSessionId: selection.sessionId ?? sessions[0]?.id ?? null
+    };
+}
+export async function withToolView(ctx, sessionId, signal, read) {
+    signal.throwIfAborted();
+    const agent = sessionId ? ctx.get('agents')?.get(SessionId(sessionId)) : undefined, presets = ctx.get('agentPresets');
+    if (agent)
+        return await read({
+            tools: presets?.serviceFor(agent, 'tools') ?? agent.ctx.get('tools') ?? ctx.tools,
+            scope: agent,
+            kind: 'live',
+            presetId: presets?.composedPreset(agent.ctx) ?? null
+        });
+    if (!sessionId || !presets)
+        return await read({ tools: ctx.tools, kind: 'global', presetId: null });
+    const observation = await ctx.sessionQuery.observeSession(SessionId(sessionId), { signal });
+    try {
+        const preset = observation.projections?.values.agentPreset;
+        if (preset === undefined)
+            return await read({ tools: ctx.tools, kind: 'global', presetId: null });
+        const lease = await presets.acquireScope(preset ?? presets.defaultId).catch(() => {
+            signal.throwIfAborted();
+            return undefined;
+        });
+        if (!lease)
+            return await read({
+                tools: ctx.tools,
+                kind: 'global',
+                presetId: preset ?? presets.defaultId
+            });
+        try {
+            signal.throwIfAborted();
+            const mount = livePresetMounts(ctx.root.fiber).find((m) => m.key === lease.key);
+            const supplied = mount
+                ? [...mount.tree.entries()]
+                    .find((e) => e.options.name === '@deepseek-ai/dsh-tools')
+                    ?.fiber?.ctx.get('tools')
+                : undefined;
+            return await read({
+                tools: supplied ?? ctx.tools,
+                scope: lease.key,
+                kind: 'preset',
+                presetId: preset ?? presets.defaultId
+            });
+        }
+        finally {
+            await lease[Symbol.asyncDispose]();
+        }
+    }
+    finally {
+        observation[Symbol.dispose]();
+    }
+}
+/** Source annotations are conservative; undocumented ownership remains unknown. */
+export function directory(ctx, view, servers, policy) {
+    const visible = view.tools.schemas(view.scope), global = ctx.tools.schemas(), schemas = new Map([...global, ...visible].map((tool) => [tool.name, tool]));
+    const entries = [
+        ...new Set([
+            ...ctx.loader.entries(),
+            ...livePresetMounts(ctx.root.fiber).flatMap((mount) => [...mount.tree.entries()])
+        ])
+    ].filter((entry) => entry.fiber?.state === 2);
+    const chain = scopeChainOf(view.scope);
+    return [...schemas.values()]
+        .map((tool) => {
+        const resolved = view.tools.get(tool.name, view.scope) ?? ctx.tools.get(tool.name);
+        const candidates = servers.filter((s) => tool.name.startsWith(`mcp__${s.item.serverName}__`) &&
+            (s.item.scope === 'profile' ||
+                s.scopeKey === view.scope ||
+                (s.scopeKey !== undefined && chain.includes(s.scopeKey))));
+        const mcp = candidates.length === 1 ? candidates[0] : undefined;
+        // rc.2 definitions carry no generic owner metadata. Match the versioned
+        // declared contract to an active entry resolving the same service and
+        // exact definition from its own scope (reject unrelated presets/shadows).
+        const providers = new Set(entries
+            .filter((entry) => {
+            if (!declaresTool(entry.options.name, entry.fiber?.config ?? entry.options.config, tool.name) ||
+                !entry.fiber ||
+                !resolved)
+                return false;
+            const ownerScope = scopeOf(entry.fiber.ctx);
+            if (ownerScope !== undefined && !chain.includes(ownerScope))
+                return false;
+            const runtime = entry.fiber.ctx.get('tools');
+            const selectedRuntime = view.tools.get(tool.name, view.scope) ? view.tools : ctx.tools;
+            return (runtime !== undefined &&
+                (Reflect.get(runtime, symbols.original) ?? runtime) ===
+                    (Reflect.get(selectedRuntime, symbols.original) ?? selectedRuntime) &&
+                runtime.get(tool.name, ownerScope) === resolved);
+        })
+            .map((entry) => entry.options.name));
+        const provider = providers.size === 1 ? [...providers][0] : undefined;
+        const builtin = provider?.startsWith('@deepseek-ai/dsh-') ?? false;
+        return {
+            name: tool.name,
+            description: tool.description ?? '',
+            parameters: tool.parameters ?? {},
+            output: resolved?.output?.schema ?? null,
+            source: mcp
+                ? 'mcp'
+                : builtin
+                    ? 'core'
+                    : provider
+                        ? 'plugin'
+                        : protectedTool(tool.name)
+                            ? 'core'
+                            : 'unknown',
+            owner: mcp
+                ? `MCP · ${mcp.item.serverName}`
+                : (provider ?? (tool.name === 'run_code' ? '@deepseek-ai/dsh-tools' : null)),
+            visible: view.kind === 'global' ? null : visible.some((v) => v.name === tool.name),
+            allowed: policy.allowed(tool.name),
+            protected: protectedTool(tool.name)
+        };
+    })
+        .sort((a, b) => a.name.localeCompare(b.name));
+}

package/package.json

@@ -1,6 +1,127 @@
 {
   "name": "@dsh-libing/mcp-manager",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "MCP 管理中心：连接配置、统一工具目录与 profile 调用规则",
+  "type": "module",
+  "icon": "icon.svg",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/client-types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "icon.svg",
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "license": "UNLICENSED",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitcode.com/LiBing-DSH/dsh-libing.git",
+    "directory": "plugins/mcp-manager"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "3.18.4",
+    "@modelcontextprotocol/client": "2.0.0",
+    "yaml": "2.9.1",
+    "zod": "4.4.3"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/dsh-client-connection": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-session-query": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-agent": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-agent-preset-registry": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-workspace": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-session": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-app-boot": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-hmr": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.5",
+    "@deepseek-ai/dsh-plugin-manager": "0.2.0-rc.2"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/dsh-client-connection": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-session-query": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-agent": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-agent-preset-registry": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-workspace": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-session": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-app-boot": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-atomic-write": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-hmr": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.5",
+    "@deepseek-ai/dsh-plugin-manager": "0.2.0-rc.2"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-sidebar",
+        "@deepseek-ai/dsh-client-ui-session"
+      ]
+    },
+    "market": {
+      "displayName": {
+        "zh": "MCP 管理中心",
+        "en": "MCP Center"
+      },
+      "category": "utilities",
+      "icon": "icon.svg",
+      "maintainers": [
+        "@lujinxing"
+      ],
+      "compatibility": {
+        "dsh": "0.2.0-rc.2"
+      },
+      "allowedBuilds": []
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.client.build.json && node --import tsx/esm ../../scripts/build-client.ts mcp-manager",
+    "typecheck:client": "tsc -p tsconfig.client.json --noEmit"
+  }
 }