@max-null/dsh-skill-mcp-center 0.4.2 → 0.5.1

package/README.md

@@ -1,6 +1,6 @@
 # dsh-skill-mcp-center
 
-本插件属于 **`@max-null/*` 插件系列**——这一系列共同构成 **[SSID（思灵 · Seek Soul in Darkness）](https://github.com/Max-Null/seek-soul-in-darkness)** 桌面体验。SSID 是整合它们的盒：`dsh-capture` · `dsh-chat-rail` · `dsh-chinese-thinking` · `dsh-draft-polish` · `dsh-guardian` · `dsh-habit` · `dsh-header-unify` · `dsh-memory` · `dsh-node-appearance` · `dsh-plugin-center` · `dsh-skill-mcp-center` · `dsh-ssid-panels` · `dsh-ssid-zh-ui`。
+本插件属于 **`@max-null/*` 插件系列**——这一系列共同构成 **[SSID（思灵 · Seek Soul in Darkness）](https://github.com/Max-Null/seek-soul-in-darkness)** 桌面体验。SSID 是整合它们的盒：`dsh-capture` · `dsh-chat-rail` · `dsh-chinese-thinking` · `dsh-draft-polish` · `dsh-guardian` · `dsh-habit` · `dsh-memory` · `dsh-node-appearance` · `dsh-plugin-center` · `dsh-quick-toolbar` · `dsh-skill-mcp-center` · `dsh-ssid-panels` · `dsh-ssid-zh-ui` · `dsh-achievements`。
 
 This plugin belongs to the **`@max-null/*` family** — a set of plugins that together form the **[SSID (思灵 · Seek Soul in Darkness)](https://github.com/Max-Null/seek-soul-in-darkness)** desktop experience.
 
@@ -10,11 +10,32 @@ Skill 与 MCP 管理中心：在设置里管理 skills 与 MCP 服务器，右
 
 ## Features / 功能
 
-- **Skill management / Skill 管理** — browse every skill by tier (system / user / workspace / runtime), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only).
+- **Skill management / Skill 管理** — browse every skill by tier (system / user / workspace / runtime), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect.
 - **MCP management / MCP 管理** — add / edit / remove `mcp-client` servers, enable/disable without deleting config, all **hot-applied** through `ctx.loader` (no restart).
-- **Live status / 实时状态** — a sidebar "MCP" tab (via `dsh-better-sidebar`) showing per-server connection state + tool count, polled while visible and following the session.
+- **Live status / 实时状态** — a sidebar "MCP" tab (via `dsh-better-sidebar`) showing per-server connection state; **click a server row to expand its tools' names and descriptions** (collapsed by default — a server can expose dozens of them). Names come from `tools.schemas()`; the redundant `mcp__<server>__` prefix is hidden while the full name stays on hover. Polled while visible and following the session.
 - **Skin-compatible / 皮肤兼容** — every color uses `var(--dsw-*)` tokens.
 
+## 截图
+
+### 设置页：集中管理
+
+装完后设置里多出「Skill & MCP」一项，可逐条控制各模型对 Skill/MCP 的可见性。**入口：** 设置 → Skill & MCP
+
+![设置 → Skill & MCP](docs/shots/skill-mcp-1.png)
+
+### 侧栏：Skill 一览
+
+搜索 + 命名空间筛选（全部 / 全局 / 工作区），每条带开关与 `MD`（查看 SKILL.md）。**插件包内自带的 skill 同样列出**，并标出来源插件——下图里 8 个 `ssid-*` 来自 `dsh-skills`，而用户级的 `ssid-release` 没有来源标签，这正是两者的区别：
+
+![侧栏 Skill 面板](docs/shots/sidebar-skills.png)
+
+### 侧栏：MCP 状态与工具
+
+每个 `mcp-client` 服务器的连接状态与工具数；**点服务器行展开**工具清单（默认收起，避免几十个工具占满面板）。工具名取自工具表、描述取自 `tools.schemas()`，冗余的 `mcp__<server>__` 前缀隐去（全名留在 hover）：
+
+![侧栏 MCP 面板](docs/shots/sidebar-mcp.png)
+
+
 ## Install / 安装
 
 ```sh

package/client.js

@@ -57,7 +57,7 @@ var CSS = `
 .smc-meta { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; margin-top: 10px; }
 .smc-spacer { flex: 1; }
 
-.smc-badge { display: inline-flex; align-items: center; padding: 1px 8px; border-radius: 999px; font-size: 11px; font-weight: 500; line-height: 17px; white-space: nowrap; background: var(--dsw-alias-bg-module-platform); color: var(--dsw-alias-label-secondary); }
+.smc-badge { display: inline-flex; align-items: center; flex: none; padding: 1px 8px; border-radius: 999px; font-size: 11px; font-weight: 500; line-height: 17px; white-space: nowrap; background: var(--dsw-alias-bg-module-platform); color: var(--dsw-alias-label-secondary); }
 .smc-badge.user { background: var(--dsw-alias-state-business-tertiary); color: var(--dsw-alias-state-business-primary); }
 .smc-badge.workspace { background: var(--dsw-alias-state-success-tertiary); color: var(--dsw-alias-state-success-primary); }
 .smc-badge.bundled { background: var(--dsw-alias-bg-module-platform); color: var(--dsw-alias-label-tertiary); }
@@ -100,11 +100,17 @@ var CSS = `
 .smc-search-sidebar { height: 28px; padding: 0 12px; border-radius: 18px; border: 1px solid var(--dsw-alias-border-l2); background: var(--dsw-alias-bg-base); color: var(--dsw-alias-label-primary); font-size: 13px; outline: none; width: 100%; font-family: inherit; box-sizing: border-box; }
 .smc-search-sidebar:focus { border-color: var(--dsw-alias-state-business-primary); }
 .smc-search-sidebar::placeholder { color: var(--dsw-alias-label-caption); }
-.smc-srv { display: flex; align-items: center; gap: 8px; padding: 8px 10px; border-radius: 8px; }
+.smc-srv { display: flex; align-items: center; gap: 8px; padding: 8px 10px; border-radius: 8px; width: 100%; box-sizing: border-box; border: none; background: none; font: inherit; color: inherit; text-align: left; cursor: pointer; }
+.smc-srv .smc-chevron { margin: 0 2px 0 4px; }
 .smc-srv:hover { background: var(--dsw-alias-interactive-bg-hover); }
 .smc-srv-name { font-size: 13px; font-weight: 500; flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: var(--dsw-alias-label-primary); }
 .smc-srv-desc { font-size: 11px; color: var(--dsw-alias-label-tertiary); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; margin: 0 10px 4px 26px; flex: none; }
 .smc-srv-state { font-size: 11px; color: var(--dsw-alias-label-caption); padding: 0 10px 6px 26px; }
+.smc-tools { list-style: none; margin: 0 0 8px; padding: 0 10px 0 26px; display: flex; flex-direction: column; gap: 0; }
+.smc-tool { display: flex; flex-direction: column; gap: 1px; padding: 5px 0; border-top: 1px solid var(--dsw-alias-border-l1); }
+.smc-tool:first-child { border-top: none; }
+.smc-tool-name { font-size: 11.5px; font-weight: 500; color: var(--dsw-alias-label-secondary); font-family: ui-monospace, 'Cascadia Code', Consolas, monospace; word-break: break-all; }
+.smc-tool-desc { font-size: 11px; line-height: 1.5; color: var(--dsw-alias-label-tertiary); display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; }
 .smc-empty { padding: 24px; text-align: center; color: var(--dsw-alias-label-tertiary); font-size: 12.5px; }
 .smc-ns-bar { display: flex; gap: 4px; margin-bottom: 8px; }
 .smc-ns-btn { flex: 1; height: 26px; border: 1px solid var(--dsw-alias-border-l2); border-radius: 8px; background: none; color: var(--dsw-alias-label-secondary); font-size: 12px; cursor: pointer; font-family: inherit; }
@@ -496,7 +502,7 @@ function SkillView() {
             " \xB7 ",
             s.provider
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge", children: s.source }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge", children: sourceLabel(s.source) }),
           !s.modelInvocable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge disabled", children: t("modelDisabled") }),
           !s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge disabled", children: t("readOnlyBadge") }),
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-spacer" }),
@@ -721,6 +727,7 @@ function CenterPanel() {
 function McpSidebarTab({ visible }) {
   useLocale();
   const [items, setItems] = (0, import_react.useState)([]);
+  const [openIds, setOpenIds] = (0, import_react.useState)(() => /* @__PURE__ */ new Set());
   (0, import_react.useEffect)(() => {
     if (!visible) return;
     const tick = () => {
@@ -735,20 +742,50 @@ function McpSidebarTab({ visible }) {
       clearInterval(timer);
     };
   }, [visible]);
+  const toggle = (name) => {
+    setOpenIds((prev) => {
+      const next = new Set(prev);
+      if (next.has(name)) next.delete(name);
+      else next.add(name);
+      return next;
+    });
+  };
   if (items.length === 0) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-empty", children: t("noMcpServer") });
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-sidebar", children: items.map((s) => {
     const dotCls = s.fiberPhase === "failed" ? " failed" : s.connected ? "" : " idle";
     const state = s.fiberPhase === "failed" ? t("failed") : s.connected ? t("connected") : t("notSynced");
+    const expandable = s.tools.length > 0;
+    const open = expandable && openIds.has(s.serverName);
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "smc-srv", title: `fiber ${s.fiberPhase ?? "?"} \xB7 ${s.toolCount} tools (${s.statusSource})`, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `smc-dot${dotCls}` }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-srv-name", children: s.serverName }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "smc-srv-count", children: [
-          s.toolCount,
-          " tools"
-        ] })
-      ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-srv-state", children: state })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
+        "button",
+        {
+          type: "button",
+          className: "smc-srv",
+          title: `fiber ${s.fiberPhase ?? "?"} \xB7 ${s.toolCount} tools (${s.statusSource})`,
+          "aria-expanded": expandable ? open : void 0,
+          onClick: () => {
+            if (expandable) toggle(s.serverName);
+          },
+          children: [
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `smc-dot${dotCls}` }),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-srv-name", children: s.serverName }),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "smc-srv-count", children: [
+              s.toolCount,
+              " tools"
+            ] }),
+            expandable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `smc-chevron${open ? " open" : ""}` })
+          ]
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-srv-state", children: state }),
+      open && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: "smc-tools", children: s.tools.map((tool) => {
+        const short = tool.name.startsWith(`mcp__${s.serverName}__`) ? tool.name.slice(`mcp__${s.serverName}__`.length) : tool.name;
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: "smc-tool", title: tool.name, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-tool-name", children: short }),
+          tool.description !== "" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-tool-desc", children: tool.description })
+        ] }, tool.name);
+      }) })
     ] }, s.serverName);
   }) });
 }
@@ -757,9 +794,17 @@ function Toast() {
   if (toast === null) return null;
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: `smc-toast ${toast.kind}`, children: toast.message });
 }
+function sourceLabel(source, short = false) {
+  if (!source.startsWith("plugin:")) return source;
+  const pkg = source.slice("plugin:".length);
+  const name = pkg.split("/").pop() ?? pkg;
+  return short ? name : `plugin \xB7 ${name}`;
+}
 function skillInNamespace(s, ns) {
   if (ns === "all") return true;
-  if (ns === "global") return s.source === "user-dsh" || s.source === "user-agents";
+  if (ns === "global") {
+    return s.source === "user-dsh" || s.source === "user-agents" || s.source.startsWith("plugin:");
+  }
   return s.source === "project-dsh" || s.source === "project-agents";
 }
 function SidebarSkillTab({ visible, cwd }) {
@@ -840,8 +885,8 @@ function SidebarSkillTab({ visible, cwd }) {
 ${s.path}`, children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `smc-dot${s.modelInvocable ? "" : " idle"}` }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-srv-name", children: s.name }),
-        !s.modelInvocable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-srv-count", children: t("modelDisabled") }),
-        !s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-srv-count", children: t("readOnlyBadge") }),
+        !s.modelInvocable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge", children: t("modelDisabled") }),
+        !s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge", children: sourceLabel(s.source, true) }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
           "button",
           {
@@ -879,7 +924,18 @@ var inject = ["slots", "connection", "locale"];
 function apply(ctx) {
   injectCss();
   rpc = async (endpoint, payload = {}) => {
-    const result = await ctx.connection.rpc.call("/skill-mcp", endpoint, payload);
+    const response = await fetch("/api/skill-mcp", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ endpoint, payload })
+    });
+    if (response.status === 404) {
+      const legacy = await ctx.connection.rpc.call("/skill-mcp", endpoint, payload);
+      if (legacy.ok) return legacy.value;
+      throw new Error(legacy.error?.message ?? `skill-mcp-center: ${endpoint} failed`);
+    }
+    if (!response.ok) throw new Error(`skill-mcp-center: ${endpoint} failed (HTTP ${response.status})`);
+    const result = await response.json();
     if (result.ok) return result.value;
     throw new Error(result.error?.message ?? `skill-mcp-center: ${endpoint} failed`);
   };
@@ -914,7 +970,14 @@ function apply(ctx) {
     sidebarCtx.effect(() => service.registerTab({
       id: "@max-null/dsh-skill-mcp-center:mcp",
       title: () => "MCP",
-      icon: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("svg", { width: "15", height: "15", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [
+      // 图标风格对齐 DSH 原生右栏：彩色线性、22px（「开始」页的图标容器
+      // .geFEbW_entryIcon 是 26px、自带占位图标 22px，整列基准即 22 ——
+      // 2026-09-14 用户指「尺寸 14 不太对，其他都在 22 左右」）。
+      // **必须是返回 ReactNode 的函数**：DSH 原生右侧栏只认函数形式，直接传 JSX 元素
+      // 会被忽略并回落到它的占位图标（`geFEbW_placeholder`，22px 灰圆）——
+      // 2026-09-14 实测：同一份 icon 在 better-sidebar 自绘的底部工作台里正常显示，
+      // 在原生右栏「开始」页却是占位符，据此定位到形式差异。
+      icon: () => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("svg", { width: "22", height: "22", viewBox: "0 0 24 24", fill: "none", stroke: "#4d6bfe", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("rect", { x: "2", y: "2", width: "20", height: "8", rx: "2", ry: "2" }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("rect", { x: "2", y: "14", width: "20", height: "8", rx: "2", ry: "2" }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("line", { x1: "6", y1: "6", x2: "6.01", y2: "6" }),
@@ -927,7 +990,8 @@ function apply(ctx) {
     sidebarCtx.effect(() => service.registerTab({
       id: "@max-null/dsh-skill-mcp-center:skills",
       title: () => "Skill",
-      icon: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("svg", { width: "15", height: "15", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("path", { d: "M13 2 3 14h7l-1 8 10-12h-7l1-8z" }) }),
+      // 同上：必须是返回 ReactNode 的函数（DSH 原生右栏只认函数形式，传元素会回落占位图标）
+      icon: () => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("svg", { width: "22", height: "22", viewBox: "0 0 24 24", fill: "none", stroke: "#f59e0b", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("path", { d: "M13 2 3 14h7l-1 8 10-12h-7l1-8z" }) }),
       order: 71,
       single: true,
       component: (props) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SidebarSkillTab, { visible: props.visible, cwd: props.scope?.cwd })

package/dist/rpc.d.ts

@@ -1,11 +1,43 @@
 /**
- * `SkillMcpRpc` — a private loopback RPC channel exposing the engine to the
- * browser half (same seam the plugin center uses; the Typert Remote path is
- * closed to third parties).
+ * `SkillMcpRpc` — the host half of the browser's private RPC entry point.
+ *
+ * Transport (2026-09-17). Two host shapes are supported because the two
+ * compositions this plugin runs under differ:
+ *
+ * - **Newer hosts (0.1.5 line, e.g. the web source build)** expose
+ *   `connection.fetch.register(...)`. This route is used there because
+ *   `connection.rpc.handle('/skill-mcp', …)` ends at `owner.webServer.register()`
+ *   inside Connection (`client-connection/src/rpc-host.ts:179`) and the owning
+ *   fiber declares no `webServer` injection, so it throws
+ *   `cannot get property "webServer" without inject`; every channel registered
+ *   that way fails and the browser sees `HTTP 405` from the static fallback.
+ *   `fetch.register` only writes Connection's own route map, so one exact route
+ *   under the shared `/api` channel serves the same endpoints.
+ *
+ * - **Older hosts (e.g. the packaged SSiD kernel)** expose only the logical
+ *   channel registry, where `rpc.handle` works, so it stays as the fallback.
+ *
+ * `connection` is resolved with `ctx.inject` rather than a declared dependency:
+ * it activates after this plugin, and `ctx.plugin()` does not wait for
+ * dependencies.
  */
 import { Service, type Context } from '@deepseek-ai/cordis';
+/** Exact Fetch route serving this plugin's endpoints under the shared channel. */
+export declare const ROUTE = "/api/skill-mcp";
+/** Logical channel used on hosts without exact Fetch-route registration. */
+export declare const LEGACY_CHANNEL = "/skill-mcp";
+/** Body the browser half posts to {@link ROUTE}. */
+export interface SkillMcpRequest {
+    /** Endpoint name, e.g. `listSkills`. */
+    readonly endpoint: string;
+    /** Endpoint arguments. */
+    readonly payload?: unknown;
+}
 export declare class SkillMcpRpc extends Service {
     static inject: string[];
+    /**
+     * @param ctx - plugin context carrying the skill/MCP engine.
+     */
     constructor(ctx: Context);
 }
 export default SkillMcpRpc;

package/dist/rpc.js

@@ -1,58 +1,123 @@
 /**
- * `SkillMcpRpc` — a private loopback RPC channel exposing the engine to the
- * browser half (same seam the plugin center uses; the Typert Remote path is
- * closed to third parties).
+ * `SkillMcpRpc` — the host half of the browser's private RPC entry point.
+ *
+ * Transport (2026-09-17). Two host shapes are supported because the two
+ * compositions this plugin runs under differ:
+ *
+ * - **Newer hosts (0.1.5 line, e.g. the web source build)** expose
+ *   `connection.fetch.register(...)`. This route is used there because
+ *   `connection.rpc.handle('/skill-mcp', …)` ends at `owner.webServer.register()`
+ *   inside Connection (`client-connection/src/rpc-host.ts:179`) and the owning
+ *   fiber declares no `webServer` injection, so it throws
+ *   `cannot get property "webServer" without inject`; every channel registered
+ *   that way fails and the browser sees `HTTP 405` from the static fallback.
+ *   `fetch.register` only writes Connection's own route map, so one exact route
+ *   under the shared `/api` channel serves the same endpoints.
+ *
+ * - **Older hosts (e.g. the packaged SSiD kernel)** expose only the logical
+ *   channel registry, where `rpc.handle` works, so it stays as the fallback.
+ *
+ * `connection` is resolved with `ctx.inject` rather than a declared dependency:
+ * it activates after this plugin, and `ctx.plugin()` does not wait for
+ * dependencies.
  */
 import { Service } from '@deepseek-ai/cordis';
-const CHANNEL = '/skill-mcp';
+/** Exact Fetch route serving this plugin's endpoints under the shared channel. */
+export const ROUTE = '/api/skill-mcp';
+/** Logical channel used on hosts without exact Fetch-route registration. */
+export const LEGACY_CHANNEL = '/skill-mcp';
 function internal(message) {
     return { ok: false, error: { code: 'internal', message, details: {} } };
 }
+/**
+ * Wrap one endpoint result as a JSON response.
+ * @param value - RPC result envelope.
+ * @returns response carrying the envelope.
+ */
+function jsonResponse(value) {
+    return new Response(JSON.stringify(value), { headers: { 'content-type': 'application/json' } });
+}
 export class SkillMcpRpc extends Service {
-    static inject = ['skillMcp', 'connection'];
+    static inject = ['skillMcp'];
+    /**
+     * @param ctx - plugin context carrying the skill/MCP engine.
+     */
     constructor(ctx) {
         super(ctx, 'skillMcpRpc');
-        ctx.connection.rpc.handle(CHANNEL, async (endpoint, payload) => {
-            try {
-                const p = (payload ?? {});
-                switch (endpoint) {
-                    case 'listSkills': {
-                        const cwd = p.cwd;
-                        return { ok: true, value: await ctx.skillMcp.listSkills(typeof cwd === 'string' ? cwd : undefined) };
-                    }
-                    case 'toggleSkill': {
-                        const path = p.path;
-                        if (typeof path !== 'string' || path === '')
-                            return internal('toggleSkill: path is required');
-                        return { ok: true, value: await ctx.skillMcp.toggleSkill(path) };
-                    }
-                    case 'readSkill': {
-                        const path = p.path;
-                        if (typeof path !== 'string' || path === '')
-                            return internal('readSkill: path is required');
-                        const cwd = p.cwd;
-                        return { ok: true, value: await ctx.skillMcp.readSkill(path, typeof cwd === 'string' ? cwd : undefined) };
-                    }
-                    case 'listMcpServers':
-                        return { ok: true, value: await ctx.skillMcp.listMcpServers() };
-                    case 'createMcpServer':
-                        return { ok: true, value: await ctx.skillMcp.createMcpServer(p.config) };
-                    case 'updateMcpServer':
-                        return { ok: true, value: await ctx.skillMcp.updateMcpServer(String(p.id), p.config) };
-                    case 'removeMcpServer':
-                        return { ok: true, value: await ctx.skillMcp.removeMcpServer(String(p.id)) };
-                    case 'setMcpServerEnabled':
-                        return { ok: true, value: await ctx.skillMcp.setMcpServerEnabled(String(p.id), p.enabled === true) };
-                    case 'mcpStatus':
-                        return { ok: true, value: await ctx.skillMcp.mcpStatus() };
-                    default:
-                        return internal(`unknown endpoint "${endpoint}"`);
-                }
+        ctx.inject(['connection'], (connectionCtx) => {
+            // Both reads are attempted: the published peer types predate the
+            // `connection` declaration on Context, so neither is typed here.
+            const surface = connectionCtx;
+            const connection = surface.connection ?? surface.get?.('connection');
+            if (connection === undefined)
+                return;
+            if (typeof connection.fetch?.register === 'function') {
+                connection.fetch.register({
+                    path: ROUTE,
+                    methods: ['POST'],
+                    requestBody: 'buffered',
+                    fetch: async (request) => {
+                        let body;
+                        try {
+                            body = await request.json();
+                        }
+                        catch {
+                            return jsonResponse(internal('request body must be JSON'));
+                        }
+                        return jsonResponse(await dispatch(ctx, body));
+                    },
+                });
+                return;
+            }
+            connection.rpc.handle(LEGACY_CHANNEL, (endpoint, payload) => dispatch(ctx, { endpoint, payload }));
+        });
+    }
+}
+/**
+ * Run one endpoint against the engine.
+ * @param ctx - plugin context carrying the skill/MCP engine.
+ * @param body - decoded request body.
+ * @returns the endpoint result, or an `internal` failure.
+ */
+async function dispatch(ctx, body) {
+    try {
+        const p = (body.payload ?? {});
+        switch (body.endpoint) {
+            case 'listSkills': {
+                const cwd = p.cwd;
+                return { ok: true, value: await ctx.skillMcp.listSkills(typeof cwd === 'string' ? cwd : undefined) };
             }
-            catch (error) {
-                return internal(error instanceof Error ? error.message : String(error));
+            case 'toggleSkill': {
+                const path = p.path;
+                if (typeof path !== 'string' || path === '')
+                    return internal('toggleSkill: path is required');
+                return { ok: true, value: await ctx.skillMcp.toggleSkill(path) };
             }
-        }, { authority: 'loopback' });
+            case 'readSkill': {
+                const path = p.path;
+                if (typeof path !== 'string' || path === '')
+                    return internal('readSkill: path is required');
+                const cwd = p.cwd;
+                return { ok: true, value: await ctx.skillMcp.readSkill(path, typeof cwd === 'string' ? cwd : undefined) };
+            }
+            case 'listMcpServers':
+                return { ok: true, value: await ctx.skillMcp.listMcpServers() };
+            case 'createMcpServer':
+                return { ok: true, value: await ctx.skillMcp.createMcpServer(p.config) };
+            case 'updateMcpServer':
+                return { ok: true, value: await ctx.skillMcp.updateMcpServer(String(p.id), p.config) };
+            case 'removeMcpServer':
+                return { ok: true, value: await ctx.skillMcp.removeMcpServer(String(p.id)) };
+            case 'setMcpServerEnabled':
+                return { ok: true, value: await ctx.skillMcp.setMcpServerEnabled(String(p.id), p.enabled === true) };
+            case 'mcpStatus':
+                return { ok: true, value: await ctx.skillMcp.mcpStatus() };
+            default:
+                return internal(`unknown endpoint "${body.endpoint}"`);
+        }
+    }
+    catch (error) {
+        return internal(error instanceof Error ? error.message : String(error));
     }
 }
 export default SkillMcpRpc;

package/dist/service.d.ts

@@ -44,11 +44,23 @@ export interface McpServer {
     disabled: boolean;
     fiberPhase: string | null;
 }
+/** One tool a server contributes, as the management surface lists it. */
+export interface McpToolView {
+    name: string;
+    description: string;
+}
 /** Runtime status of one MCP server (sidebar polling). */
 export interface McpServerStatus {
     serverName: string;
     fiberPhase: string | null;
     toolCount: number;
+    /**
+     * The tools themselves. A bare count says nothing about what the server
+     * actually offers, so the surface lists names and descriptions too
+     * (2026-09-14 用户：MCP 的 tools 信息太少了，最好有名称和介绍）。
+     * Names come from `tools.schemas()`, which whitelists name/description.
+     */
+    tools: McpToolView[];
     connected: boolean;
     statusSource: 'seam' | 'derived';
 }
@@ -66,7 +78,25 @@ export declare class SkillMcpService extends Service {
     static inject: string[];
     private readonly officialSkillDirs;
     constructor(ctx: Context, config?: SkillConfig);
-    /** User-level skills plus, when a workspace is given, its project-level skills. */
+    /**
+     * Skill roots that live **inside loaded plugin packages**, i.e.
+     * `<node_modules>/<pkg>/skills`.
+     *
+     * The host-level skill filesystem is disabled in web-app (presets own
+     * discovery), so a plugin that ships skills — `@max-null/dsh-skills` and
+     * `@max-null/dsh-plugin-center` both do — keeps them on disk inside its own
+     * package, where no user-level root can see them. Without this the
+     * management surface showed 17 user skills while 8 plugin skills were loaded
+     * and in effect (2026-09-14 用户报「skill 生效但不展示」).
+     *
+     * Only **loaded** entries are probed, so this costs one existence check per
+     * plugin rather than a scan of the whole node_modules tree.
+     */
+    private pluginSkillDirs;
+    /**
+     * User-level skills, project-level skills for the given workspace, skills
+     * bundled inside loaded plugin packages, and any configured official roots.
+     */
     listSkills(cwd?: string): Promise<SkillView[]>;
     /** Flip one disk-backed skill's model invocation by rewriting its SKILL.md frontmatter. */
     toggleSkill(path: string): Promise<SkillView>;

package/dist/service.js

@@ -7,9 +7,11 @@
  * `ctx.mcpStatus` seam with a derived fallback.
  */
 import { Service } from '@deepseek-ai/cordis';
+import { existsSync } from 'node:fs';
 import { readdir, readFile, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { parseSkillFrontmatter, setDisableModelInvocation } from "./frontmatter.js";
 /** Runtime mirror of cordis FiberState (a cross-package const enum). */
 const FIBER_PHASE = {
@@ -48,6 +50,21 @@ const SKILL_ROOTS = [
     { path: join(homedir(), '.dsh', 'skills'), source: 'user-dsh' },
     { path: join(homedir(), '.agents', 'skills'), source: 'user-agents' },
 ];
+/**
+ * This package's own `node_modules` directory — the tree every loaded plugin
+ * was resolved from.
+ *
+ * Derived from the module URL instead of assuming
+ * `$DSH_HOME/profiles/<p>/node_modules`: the profile layout and even the
+ * directory name vary, while this module is always inside that tree.
+ * @returns the node_modules path, or null when the module is not under one.
+ */
+function ownNodeModules() {
+    const here = fileURLToPath(import.meta.url);
+    const marker = `${sep}node_modules${sep}`;
+    const at = here.lastIndexOf(marker);
+    return at < 0 ? null : here.slice(0, at + marker.length - 1);
+}
 /** Absolute SKILL.md path for one directory/file entry, or null. */
 function skillPathFor(root, name, isDirectory) {
     if (isDirectory)
@@ -100,7 +117,39 @@ export class SkillMcpService extends Service {
         super(ctx, 'skillMcp');
         this.officialSkillDirs = config.officialSkillDirs ?? [];
     }
-    /** User-level skills plus, when a workspace is given, its project-level skills. */
+    /**
+     * Skill roots that live **inside loaded plugin packages**, i.e.
+     * `<node_modules>/<pkg>/skills`.
+     *
+     * The host-level skill filesystem is disabled in web-app (presets own
+     * discovery), so a plugin that ships skills — `@max-null/dsh-skills` and
+     * `@max-null/dsh-plugin-center` both do — keeps them on disk inside its own
+     * package, where no user-level root can see them. Without this the
+     * management surface showed 17 user skills while 8 plugin skills were loaded
+     * and in effect (2026-09-14 用户报「skill 生效但不展示」).
+     *
+     * Only **loaded** entries are probed, so this costs one existence check per
+     * plugin rather than a scan of the whole node_modules tree.
+     */
+    pluginSkillDirs() {
+        const nm = ownNodeModules();
+        if (nm === null)
+            return [];
+        const out = [];
+        for (const entry of this.ctx.loader.entries()) {
+            const name = entry.options.name;
+            if (typeof name !== 'string' || name === '' || name.startsWith('.') || name.startsWith('/'))
+                continue;
+            const dir = join(nm, ...name.split('/'), 'skills');
+            if (existsSync(dir))
+                out.push({ dir, label: `plugin:${name}` });
+        }
+        return out;
+    }
+    /**
+     * User-level skills, project-level skills for the given workspace, skills
+     * bundled inside loaded plugin packages, and any configured official roots.
+     */
     async listSkills(cwd) {
         const skills = [];
         for (const root of SKILL_ROOTS) {
@@ -110,6 +159,9 @@ export class SkillMcpService extends Service {
             skills.push(...await scanSkillRoot(join(cwd, '.agents', 'skills'), 'project-agents'));
             skills.push(...await scanSkillRoot(join(cwd, '.dsh', 'skills'), 'project-dsh'));
         }
+        for (const plugin of this.pluginSkillDirs()) {
+            skills.push(...await scanSkillRoot(plugin.dir, plugin.label, false, 'plugin'));
+        }
         for (const dir of this.officialSkillDirs) {
             skills.push(...await scanSkillRoot(dir, 'bundled', false, 'dsh-official'));
         }
@@ -150,6 +202,8 @@ export class SkillMcpService extends Service {
         if (cwd !== undefined && cwd !== '') {
             roots.push(join(cwd, '.agents', 'skills'), join(cwd, '.dsh', 'skills'));
         }
+        for (const plugin of this.pluginSkillDirs())
+            roots.push(plugin.dir);
         roots.push(...this.officialSkillDirs);
         // Segment-boundary prefix check: a sibling directory like `skills-notes`
         // must not satisfy a `skills` root. join(root, '') normalizes to root.
@@ -211,29 +265,40 @@ export class SkillMcpService extends Service {
     /** Runtime status per server: upstream `mcpStatus` seam when present, else derived. */
     async mcpStatus() {
         const servers = await this.listMcpServers();
+        // Tool identity always comes from the mounted tool table — `schemas()`
+        // whitelists name/description, which is exactly what the surface needs.
+        // The seam, when present, only refines the count and connection facts.
+        const schemas = this.ctx.tools.schemas();
+        const toolsOf = (serverName) => {
+            const prefix = `mcp__${serverName}__`;
+            return schemas
+                .filter(s => s.name.startsWith(prefix))
+                .map(s => ({ name: s.name, description: s.description ?? '' }));
+        };
         const seam = this.ctx.get('mcpStatus');
         if (seam !== undefined) {
             const byName = new Map(seam.list().map(s => [s.serverName, s]));
             return servers.map(s => {
                 const st = byName.get(s.serverName);
+                const tools = toolsOf(s.serverName);
                 return {
                     serverName: s.serverName,
                     fiberPhase: s.fiberPhase,
-                    toolCount: st?.toolCount ?? 0,
+                    toolCount: st?.toolCount ?? tools.length,
+                    tools,
                     connected: st?.phase === 'connected',
                     statusSource: 'seam',
                 };
             });
         }
-        const toolNames = this.ctx.tools.schemas().map(s => s.name);
         return servers.map(s => {
-            const prefix = `mcp__${s.serverName}__`;
-            const toolCount = toolNames.filter(n => n.startsWith(prefix)).length;
+            const tools = toolsOf(s.serverName);
             return {
                 serverName: s.serverName,
                 fiberPhase: s.fiberPhase,
-                toolCount,
-                connected: !s.disabled && s.fiberPhase === 'active' && toolCount > 0,
+                toolCount: tools.length,
+                tools,
+                connected: !s.disabled && s.fiberPhase === 'active' && tools.length > 0,
                 statusSource: 'derived',
             };
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@max-null/dsh-skill-mcp-center",
-  "version": "0.4.2",
+  "version": "0.5.1",
   "description": "Skill & MCP management center for DeepSeek Harness — manage skills and MCP servers in Settings, live MCP status in the sidebar",
   "license": "MIT",
   "publishConfig": {
@@ -21,7 +21,9 @@
   "files": [
     "dist",
     "client.js",
-    "cordis.patch.yml"
+    "cordis.patch.yml",
+    "docs/shots",
+    "release-notes.md"
   ],
   "dsh": {
     "bundle": {

package/release-notes.md

@@ -0,0 +1,35 @@
+# Release Notes — @max-null/dsh-skill-mcp-center
+
+## 0.5.1 (2026-09-17)
+
+### 修复
+
+- 修正 web 环境下设置面板的「加载失败：transport failure for /skill-mcp/listSkills: HTTP 405」。
+  根因在宿主侧：`ctx.connection.rpc.handle()` 注册逻辑通道时会访问 `client-connection`
+  未声明的 `webServer` 注入，cordis 属性代理抛错后注册静默失败（DSH 源码形态特有；
+  打包内核形态不受影响）。上游报告：deepseek-ai/deepseek-harness discussions #6880。
+
+### 变更
+
+- 传输层改为双路径自适应：
+  - 宿主提供 `connection.fetch.register` → 注册 `POST /api/skill-mcp` 精确路由
+    （只写 Connection 自己的路由表，不触碰 `owner.webServer`）；
+  - 宿主只提供逻辑通道注册表（老打包内核）→ 自动回退 `/skill-mcp`；
+  - 浏览器侧先试新路由，**收到 404 才回退**（新路由未注册时 `/api/*` 是 404，根路径才是 405）。
+- `connection` 服务改用 `ctx.inject(['connection'], cb)` 获取：它在插件 apply 时尚未就绪，
+  且 `ctx.plugin(P)` 不等待依赖。
+
+### 兼容性
+
+- 无 API 变更：端点集合、请求体、响应信封（RpcResult）与 peer 依赖均未变。
+- 面板端与宿主端需同版本升级（浏览器侧的传输策略随之切换）。
+
+### 测试
+
+- 新增 `tests/rpc-transport.test.ts`（8 条）：传输层选择、服务晚到时不抢先注册、
+  路由派发、JSON 解析失败与引擎异常收敛为 `internal` 信封。
+- 全量 18 条通过；`npm run typecheck` 无错。
+
+### 验证
+
+- web（源码形态）实测：`POST /api/skill-mcp` → 200，面板恢复，控制台 0 errors。