@max-null/dsh-skill-mcp-center 0.5.0 → 0.5.2

package/README.md

@@ -10,7 +10,7 @@ Skill 与 MCP 管理中心：在设置里管理 skills 与 MCP 服务器，右
 
 ## Features / 功能
 
-- **Skill management / Skill 管理** — browse every skill by tier (system / user / workspace / runtime), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect.
+- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect.
 - **MCP management / MCP 管理** — add / edit / remove `mcp-client` servers, enable/disable without deleting config, all **hot-applied** through `ctx.loader` (no restart).
 - **Live status / 实时状态** — a sidebar "MCP" tab (via `dsh-better-sidebar`) showing per-server connection state; **click a server row to expand its tools' names and descriptions** (collapsed by default — a server can expose dozens of them). Names come from `tools.schemas()`; the redundant `mcp__<server>__` prefix is hidden while the full name stays on hover. Polled while visible and following the session.
 - **Skin-compatible / 皮肤兼容** — every color uses `var(--dsw-*)` tokens.

package/client.js

@@ -924,7 +924,18 @@ var inject = ["slots", "connection", "locale"];
 function apply(ctx) {
   injectCss();
   rpc = async (endpoint, payload = {}) => {
-    const result = await ctx.connection.rpc.call("/skill-mcp", endpoint, payload);
+    const response = await fetch("/api/skill-mcp", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ endpoint, payload })
+    });
+    if (response.status === 404) {
+      const legacy = await ctx.connection.rpc.call("/skill-mcp", endpoint, payload);
+      if (legacy.ok) return legacy.value;
+      throw new Error(legacy.error?.message ?? `skill-mcp-center: ${endpoint} failed`);
+    }
+    if (!response.ok) throw new Error(`skill-mcp-center: ${endpoint} failed (HTTP ${response.status})`);
+    const result = await response.json();
     if (result.ok) return result.value;
     throw new Error(result.error?.message ?? `skill-mcp-center: ${endpoint} failed`);
   };

package/dist/rpc.d.ts

@@ -1,11 +1,43 @@
 /**
- * `SkillMcpRpc` — a private loopback RPC channel exposing the engine to the
- * browser half (same seam the plugin center uses; the Typert Remote path is
- * closed to third parties).
+ * `SkillMcpRpc` — the host half of the browser's private RPC entry point.
+ *
+ * Transport (2026-09-17). Two host shapes are supported because the two
+ * compositions this plugin runs under differ:
+ *
+ * - **Newer hosts (0.1.5 line, e.g. the web source build)** expose
+ *   `connection.fetch.register(...)`. This route is used there because
+ *   `connection.rpc.handle('/skill-mcp', …)` ends at `owner.webServer.register()`
+ *   inside Connection (`client-connection/src/rpc-host.ts:179`) and the owning
+ *   fiber declares no `webServer` injection, so it throws
+ *   `cannot get property "webServer" without inject`; every channel registered
+ *   that way fails and the browser sees `HTTP 405` from the static fallback.
+ *   `fetch.register` only writes Connection's own route map, so one exact route
+ *   under the shared `/api` channel serves the same endpoints.
+ *
+ * - **Older hosts (e.g. the packaged SSiD kernel)** expose only the logical
+ *   channel registry, where `rpc.handle` works, so it stays as the fallback.
+ *
+ * `connection` is resolved with `ctx.inject` rather than a declared dependency:
+ * it activates after this plugin, and `ctx.plugin()` does not wait for
+ * dependencies.
  */
 import { Service, type Context } from '@deepseek-ai/cordis';
+/** Exact Fetch route serving this plugin's endpoints under the shared channel. */
+export declare const ROUTE = "/api/skill-mcp";
+/** Logical channel used on hosts without exact Fetch-route registration. */
+export declare const LEGACY_CHANNEL = "/skill-mcp";
+/** Body the browser half posts to {@link ROUTE}. */
+export interface SkillMcpRequest {
+    /** Endpoint name, e.g. `listSkills`. */
+    readonly endpoint: string;
+    /** Endpoint arguments. */
+    readonly payload?: unknown;
+}
 export declare class SkillMcpRpc extends Service {
     static inject: string[];
+    /**
+     * @param ctx - plugin context carrying the skill/MCP engine.
+     */
     constructor(ctx: Context);
 }
 export default SkillMcpRpc;

package/dist/rpc.js

@@ -1,58 +1,123 @@
 /**
- * `SkillMcpRpc` — a private loopback RPC channel exposing the engine to the
- * browser half (same seam the plugin center uses; the Typert Remote path is
- * closed to third parties).
+ * `SkillMcpRpc` — the host half of the browser's private RPC entry point.
+ *
+ * Transport (2026-09-17). Two host shapes are supported because the two
+ * compositions this plugin runs under differ:
+ *
+ * - **Newer hosts (0.1.5 line, e.g. the web source build)** expose
+ *   `connection.fetch.register(...)`. This route is used there because
+ *   `connection.rpc.handle('/skill-mcp', …)` ends at `owner.webServer.register()`
+ *   inside Connection (`client-connection/src/rpc-host.ts:179`) and the owning
+ *   fiber declares no `webServer` injection, so it throws
+ *   `cannot get property "webServer" without inject`; every channel registered
+ *   that way fails and the browser sees `HTTP 405` from the static fallback.
+ *   `fetch.register` only writes Connection's own route map, so one exact route
+ *   under the shared `/api` channel serves the same endpoints.
+ *
+ * - **Older hosts (e.g. the packaged SSiD kernel)** expose only the logical
+ *   channel registry, where `rpc.handle` works, so it stays as the fallback.
+ *
+ * `connection` is resolved with `ctx.inject` rather than a declared dependency:
+ * it activates after this plugin, and `ctx.plugin()` does not wait for
+ * dependencies.
  */
 import { Service } from '@deepseek-ai/cordis';
-const CHANNEL = '/skill-mcp';
+/** Exact Fetch route serving this plugin's endpoints under the shared channel. */
+export const ROUTE = '/api/skill-mcp';
+/** Logical channel used on hosts without exact Fetch-route registration. */
+export const LEGACY_CHANNEL = '/skill-mcp';
 function internal(message) {
     return { ok: false, error: { code: 'internal', message, details: {} } };
 }
+/**
+ * Wrap one endpoint result as a JSON response.
+ * @param value - RPC result envelope.
+ * @returns response carrying the envelope.
+ */
+function jsonResponse(value) {
+    return new Response(JSON.stringify(value), { headers: { 'content-type': 'application/json' } });
+}
 export class SkillMcpRpc extends Service {
-    static inject = ['skillMcp', 'connection'];
+    static inject = ['skillMcp'];
+    /**
+     * @param ctx - plugin context carrying the skill/MCP engine.
+     */
     constructor(ctx) {
         super(ctx, 'skillMcpRpc');
-        ctx.connection.rpc.handle(CHANNEL, async (endpoint, payload) => {
-            try {
-                const p = (payload ?? {});
-                switch (endpoint) {
-                    case 'listSkills': {
-                        const cwd = p.cwd;
-                        return { ok: true, value: await ctx.skillMcp.listSkills(typeof cwd === 'string' ? cwd : undefined) };
-                    }
-                    case 'toggleSkill': {
-                        const path = p.path;
-                        if (typeof path !== 'string' || path === '')
-                            return internal('toggleSkill: path is required');
-                        return { ok: true, value: await ctx.skillMcp.toggleSkill(path) };
-                    }
-                    case 'readSkill': {
-                        const path = p.path;
-                        if (typeof path !== 'string' || path === '')
-                            return internal('readSkill: path is required');
-                        const cwd = p.cwd;
-                        return { ok: true, value: await ctx.skillMcp.readSkill(path, typeof cwd === 'string' ? cwd : undefined) };
-                    }
-                    case 'listMcpServers':
-                        return { ok: true, value: await ctx.skillMcp.listMcpServers() };
-                    case 'createMcpServer':
-                        return { ok: true, value: await ctx.skillMcp.createMcpServer(p.config) };
-                    case 'updateMcpServer':
-                        return { ok: true, value: await ctx.skillMcp.updateMcpServer(String(p.id), p.config) };
-                    case 'removeMcpServer':
-                        return { ok: true, value: await ctx.skillMcp.removeMcpServer(String(p.id)) };
-                    case 'setMcpServerEnabled':
-                        return { ok: true, value: await ctx.skillMcp.setMcpServerEnabled(String(p.id), p.enabled === true) };
-                    case 'mcpStatus':
-                        return { ok: true, value: await ctx.skillMcp.mcpStatus() };
-                    default:
-                        return internal(`unknown endpoint "${endpoint}"`);
-                }
+        ctx.inject(['connection'], (connectionCtx) => {
+            // Both reads are attempted: the published peer types predate the
+            // `connection` declaration on Context, so neither is typed here.
+            const surface = connectionCtx;
+            const connection = surface.connection ?? surface.get?.('connection');
+            if (connection === undefined)
+                return;
+            if (typeof connection.fetch?.register === 'function') {
+                connection.fetch.register({
+                    path: ROUTE,
+                    methods: ['POST'],
+                    requestBody: 'buffered',
+                    fetch: async (request) => {
+                        let body;
+                        try {
+                            body = await request.json();
+                        }
+                        catch {
+                            return jsonResponse(internal('request body must be JSON'));
+                        }
+                        return jsonResponse(await dispatch(ctx, body));
+                    },
+                });
+                return;
+            }
+            connection.rpc.handle(LEGACY_CHANNEL, (endpoint, payload) => dispatch(ctx, { endpoint, payload }));
+        });
+    }
+}
+/**
+ * Run one endpoint against the engine.
+ * @param ctx - plugin context carrying the skill/MCP engine.
+ * @param body - decoded request body.
+ * @returns the endpoint result, or an `internal` failure.
+ */
+async function dispatch(ctx, body) {
+    try {
+        const p = (body.payload ?? {});
+        switch (body.endpoint) {
+            case 'listSkills': {
+                const cwd = p.cwd;
+                return { ok: true, value: await ctx.skillMcp.listSkills(typeof cwd === 'string' ? cwd : undefined) };
             }
-            catch (error) {
-                return internal(error instanceof Error ? error.message : String(error));
+            case 'toggleSkill': {
+                const path = p.path;
+                if (typeof path !== 'string' || path === '')
+                    return internal('toggleSkill: path is required');
+                return { ok: true, value: await ctx.skillMcp.toggleSkill(path) };
             }
-        }, { authority: 'loopback' });
+            case 'readSkill': {
+                const path = p.path;
+                if (typeof path !== 'string' || path === '')
+                    return internal('readSkill: path is required');
+                const cwd = p.cwd;
+                return { ok: true, value: await ctx.skillMcp.readSkill(path, typeof cwd === 'string' ? cwd : undefined) };
+            }
+            case 'listMcpServers':
+                return { ok: true, value: await ctx.skillMcp.listMcpServers() };
+            case 'createMcpServer':
+                return { ok: true, value: await ctx.skillMcp.createMcpServer(p.config) };
+            case 'updateMcpServer':
+                return { ok: true, value: await ctx.skillMcp.updateMcpServer(String(p.id), p.config) };
+            case 'removeMcpServer':
+                return { ok: true, value: await ctx.skillMcp.removeMcpServer(String(p.id)) };
+            case 'setMcpServerEnabled':
+                return { ok: true, value: await ctx.skillMcp.setMcpServerEnabled(String(p.id), p.enabled === true) };
+            case 'mcpStatus':
+                return { ok: true, value: await ctx.skillMcp.mcpStatus() };
+            default:
+                return internal(`unknown endpoint "${body.endpoint}"`);
+        }
+    }
+    catch (error) {
+        return internal(error instanceof Error ? error.message : String(error));
     }
 }
 export default SkillMcpRpc;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@max-null/dsh-skill-mcp-center",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Skill & MCP management center for DeepSeek Harness — manage skills and MCP servers in Settings, live MCP status in the sidebar",
   "license": "MIT",
   "publishConfig": {
@@ -21,7 +21,10 @@
   "files": [
     "dist",
     "client.js",
-    "cordis.patch.yml", "docs/shots"],
+    "cordis.patch.yml",
+    "docs/shots",
+    "release-notes.md"
+  ],
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -64,18 +67,18 @@
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
-    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-skill": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.1.1-rc.1"
+    "@deepseek-ai/dsh-client-connection": ">=0.1.1-rc.1 <0.3.0",
+    "@deepseek-ai/dsh-host-apiproxy": ">=0.1.1-rc.1 <0.3.0",
+    "@deepseek-ai/dsh-skill": ">=0.1.1-rc.1 <0.3.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.1-rc.1 <0.3.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/cordis-plugin-loader": "^1.0.2",
-    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-skill": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.1-rc.1 <0.3.0",
+    "@deepseek-ai/dsh-host-apiproxy": ">=0.1.1-rc.1 <0.3.0",
+    "@deepseek-ai/dsh-skill": ">=0.1.1-rc.1 <0.3.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.1-rc.1 <0.3.0",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^26.2.0",
     "@types/react": "~18.3.1",

package/release-notes.md

@@ -0,0 +1,57 @@
+# Release Notes — @max-null/dsh-skill-mcp-center
+
+## 0.5.2 (2026-09-29)
+
+### 变更
+
+- 放宽 `@deepseek-ai/dsh-*` 的版本范围：`peerDependencies` 与 `devDependencies` 中的
+  `dsh-client-connection`、`dsh-host-apiproxy`、`dsh-skill`、`dsh-tools` 由 `^0.1.1-rc.1`
+  改为 `>=0.1.1-rc.1 <0.3.0` —— 保留下限、只放宽上界，旧内核（0.1.7-rc.2）仍然满足。
+
+### 为什么
+
+- 内核侧逐个检查插件 `peerDependencies` 里的每个 `@deepseek-ai/*` 声明，判据是标准 semver：
+  `semver.satisfies(runtimeVersion, requirement, { includePrerelease: true })`。
+- `^0.1.1-rc.1` 展开为 `>=0.1.1-rc.1 <0.2.0-0`，对 `0.2.0-rc.1` 判 **false**；判定失败的插件
+  会被**静默跳过**——不进 fiber graph，也不出现在「did not activate」列表里，用户侧的表现
+  是「插件装了却毫无反应」，没有任何日志可查。
+- `>=0.1.1-rc.1 <0.3.0` 在 semver 7.7.4 下对 `0.1.7-rc.2` 与 `0.2.0-rc.1` 均判 true（已实测）。
+
+### 兼容性
+
+- 无运行时行为变更：端点集合、请求体、响应信封与代码路径均未改，只是依赖声明放宽。
+- 面板端与宿主端仍需同版本（传输策略见 0.5.1）。
+
+## 0.5.1 (2026-09-17)
+
+### 修复
+
+- 修正 web 环境下设置面板的「加载失败：transport failure for /skill-mcp/listSkills: HTTP 405」。
+  根因在宿主侧：`ctx.connection.rpc.handle()` 注册逻辑通道时会访问 `client-connection`
+  未声明的 `webServer` 注入，cordis 属性代理抛错后注册静默失败（DSH 源码形态特有；
+  打包内核形态不受影响）。上游报告：deepseek-ai/deepseek-harness discussions #6880。
+
+### 变更
+
+- 传输层改为双路径自适应：
+  - 宿主提供 `connection.fetch.register` → 注册 `POST /api/skill-mcp` 精确路由
+    （只写 Connection 自己的路由表，不触碰 `owner.webServer`）；
+  - 宿主只提供逻辑通道注册表（老打包内核）→ 自动回退 `/skill-mcp`；
+  - 浏览器侧先试新路由，**收到 404 才回退**（新路由未注册时 `/api/*` 是 404，根路径才是 405）。
+- `connection` 服务改用 `ctx.inject(['connection'], cb)` 获取：它在插件 apply 时尚未就绪，
+  且 `ctx.plugin(P)` 不等待依赖。
+
+### 兼容性
+
+- 无 API 变更：端点集合、请求体、响应信封（RpcResult）与 peer 依赖均未变。
+- 面板端与宿主端需同版本升级（浏览器侧的传输策略随之切换）。
+
+### 测试
+
+- 新增 `tests/rpc-transport.test.ts`（8 条）：传输层选择、服务晚到时不抢先注册、
+  路由派发、JSON 解析失败与引擎异常收敛为 `internal` 信封。
+- 全量 18 条通过；`npm run typecheck` 无错。
+
+### 验证
+
+- web（源码形态）实测：`POST /api/skill-mcp` → 200，面板恢复，控制台 0 errors。