@max-null/dsh-skill-mcp-center 0.5.3 → 0.5.4

package/README.md

@@ -10,7 +10,7 @@ Skill 与 MCP 管理中心：在设置里管理 skills 与 MCP 服务器，右
 
 ## Features / 功能
 
-- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect.
+- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect. Also covers a plugin that mounts `@deepseek-ai/dsh-skill-filesystem` under an id of its own and points `bundledSkillDir` at its skills (e.g. `dsh-plugin-zhihu-search`), including when the patch computes that path with a `!!js` expression — such a path is read from the entry's fiber, where the Loader has already evaluated it.
 - **MCP management / MCP 管理** — add / edit / remove `mcp-client` servers, enable/disable without deleting config, all **hot-applied** through `ctx.loader` (no restart).
 - **Live status / 实时状态** — a sidebar "MCP" tab (via `dsh-better-sidebar`) showing per-server connection state; **click a server row to expand its tools' names and descriptions** (collapsed by default — a server can expose dozens of them). Names come from `tools.schemas()`; the redundant `mcp__<server>__` prefix is hidden while the full name stays on hover. Polled while visible and following the session.
 - **Skin-compatible / 皮肤兼容** — every color uses `var(--dsw-*)` tokens.

package/dist/service.d.ts

@@ -83,13 +83,55 @@ export interface McpConfig {
  * @returns the skills this root contributes, in directory order.
  */
 export declare function scanSkillRoot(root: string, source: string, writable?: boolean, provider?: string): Promise<SkillView[]>;
+/** The loader-entry fields plugin skill discovery reads. */
+export interface SkillRootEntry {
+    readonly options: {
+        readonly id: string;
+        readonly name: string;
+    };
+    /** Absent while the entry is disabled, incompatible, or still loading. */
+    readonly fiber?: {
+        readonly config: unknown;
+    } | undefined;
+}
+/**
+ * Skill roots contributed by loaded plugin packages.
+ *
+ * Two declarations reach such a directory, and both are needed:
+ *
+ * - the entry's module specifier, i.e. `<node_modules>/<pkg>/skills` — how
+ *   `@max-null/dsh-skills` and `@max-null/dsh-plugin-center` ship theirs;
+ * - the entry's own `bundledSkillDir` config — the only way to see a plugin
+ *   that mounts the official `@deepseek-ai/dsh-skill-filesystem` under an id
+ *   of its own. `dsh-plugin-zhihu-search` is the live sample: it registers
+ *   `name: '@deepseek-ai/dsh-skill-filesystem'`, and its `skills/` sits in a
+ *   different `node_modules` tree than this plugin's.
+ *
+ * `bundledSkillDir` is read from the **fiber**, never from
+ * `entry.options.config`. A patch may compute the value with a `!!js`
+ * expression, and the Loader keeps that expression as a `{ __jsExpr }` node
+ * in the stored options while handing the owning fiber the evaluated copy —
+ * it interpolates on the `internal/config` waterfall and writes the raw node
+ * back on `internal/update` specifically so file write-back preserves the
+ * `!!js` form. The stored value is therefore an expression node rather than a
+ * path, and reading it can only miss.
+ *
+ * Only **loaded** entries are probed, so this costs a couple of existence
+ * checks per plugin instead of a scan of the whole `node_modules` tree.
+ * @param entries - loaded loader entries.
+ * @param nodeModules - this package's own `node_modules` tree, or null.
+ * @returns the skill roots that exist, deduplicated, in entry order.
+ */
+export declare function pluginSkillRoots(entries: Iterable<SkillRootEntry>, nodeModules: string | null): {
+    dir: string;
+    label: string;
+}[];
 export declare class SkillMcpService extends Service {
     static inject: string[];
     private readonly officialSkillDirs;
     constructor(ctx: Context, config?: SkillConfig);
     /**
-     * Skill roots that live **inside loaded plugin packages**, i.e.
-     * `<node_modules>/<pkg>/skills`.
+     * Skill roots that live **inside loaded plugin packages**.
      *
      * The host-level skill filesystem is disabled in web-app (presets own
      * discovery), so a plugin that ships skills — `@max-null/dsh-skills` and
@@ -97,9 +139,6 @@ export declare class SkillMcpService extends Service {
      * package, where no user-level root can see them. Without this the
      * management surface showed 17 user skills while 8 plugin skills were loaded
      * and in effect (2026-09-14 用户报「skill 生效但不展示」).
-     *
-     * Only **loaded** entries are probed, so this costs one existence check per
-     * plugin rather than a scan of the whole node_modules tree.
      */
     private pluginSkillDirs;
     /**

package/dist/service.js

@@ -139,6 +139,57 @@ export async function scanSkillRoot(root, source, writable = true, provider = 'f
     }
     return skills;
 }
+/**
+ * Skill roots contributed by loaded plugin packages.
+ *
+ * Two declarations reach such a directory, and both are needed:
+ *
+ * - the entry's module specifier, i.e. `<node_modules>/<pkg>/skills` — how
+ *   `@max-null/dsh-skills` and `@max-null/dsh-plugin-center` ship theirs;
+ * - the entry's own `bundledSkillDir` config — the only way to see a plugin
+ *   that mounts the official `@deepseek-ai/dsh-skill-filesystem` under an id
+ *   of its own. `dsh-plugin-zhihu-search` is the live sample: it registers
+ *   `name: '@deepseek-ai/dsh-skill-filesystem'`, and its `skills/` sits in a
+ *   different `node_modules` tree than this plugin's.
+ *
+ * `bundledSkillDir` is read from the **fiber**, never from
+ * `entry.options.config`. A patch may compute the value with a `!!js`
+ * expression, and the Loader keeps that expression as a `{ __jsExpr }` node
+ * in the stored options while handing the owning fiber the evaluated copy —
+ * it interpolates on the `internal/config` waterfall and writes the raw node
+ * back on `internal/update` specifically so file write-back preserves the
+ * `!!js` form. The stored value is therefore an expression node rather than a
+ * path, and reading it can only miss.
+ *
+ * Only **loaded** entries are probed, so this costs a couple of existence
+ * checks per plugin instead of a scan of the whole `node_modules` tree.
+ * @param entries - loaded loader entries.
+ * @param nodeModules - this package's own `node_modules` tree, or null.
+ * @returns the skill roots that exist, deduplicated, in entry order.
+ */
+export function pluginSkillRoots(entries, nodeModules) {
+    const out = [];
+    const seen = new Set();
+    const add = (dir, label) => {
+        if (seen.has(dir) || !existsSync(dir))
+            return;
+        seen.add(dir);
+        out.push({ dir, label });
+    };
+    for (const entry of entries) {
+        const name = entry.options.name;
+        if (nodeModules !== null && name !== '' && !name.startsWith('.') && !name.startsWith('/')) {
+            add(join(nodeModules, ...name.split('/'), 'skills'), `plugin:${name}`);
+        }
+        const config = entry.fiber?.config;
+        const declared = typeof config === 'object' && config !== null && 'bundledSkillDir' in config
+            ? config.bundledSkillDir
+            : undefined;
+        if (typeof declared === 'string')
+            add(declared, `plugin:${entry.options.id}`);
+    }
+    return out;
+}
 export class SkillMcpService extends Service {
     static inject = ['loader', 'tools'];
     officialSkillDirs;
@@ -147,8 +198,7 @@ export class SkillMcpService extends Service {
         this.officialSkillDirs = config.officialSkillDirs ?? [];
     }
     /**
-     * Skill roots that live **inside loaded plugin packages**, i.e.
-     * `<node_modules>/<pkg>/skills`.
+     * Skill roots that live **inside loaded plugin packages**.
      *
      * The host-level skill filesystem is disabled in web-app (presets own
      * discovery), so a plugin that ships skills — `@max-null/dsh-skills` and
@@ -156,24 +206,9 @@ export class SkillMcpService extends Service {
      * package, where no user-level root can see them. Without this the
      * management surface showed 17 user skills while 8 plugin skills were loaded
      * and in effect (2026-09-14 用户报「skill 生效但不展示」).
-     *
-     * Only **loaded** entries are probed, so this costs one existence check per
-     * plugin rather than a scan of the whole node_modules tree.
      */
     pluginSkillDirs() {
-        const nm = ownNodeModules();
-        if (nm === null)
-            return [];
-        const out = [];
-        for (const entry of this.ctx.loader.entries()) {
-            const name = entry.options.name;
-            if (typeof name !== 'string' || name === '' || name.startsWith('.') || name.startsWith('/'))
-                continue;
-            const dir = join(nm, ...name.split('/'), 'skills');
-            if (existsSync(dir))
-                out.push({ dir, label: `plugin:${name}` });
-        }
-        return out;
+        return pluginSkillRoots(this.ctx.loader.entries(), ownNodeModules());
     }
     /**
      * User-level skills, project-level skills for the given workspace, skills

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@max-null/dsh-skill-mcp-center",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Skill & MCP management center for DeepSeek Harness — manage skills and MCP servers in Settings, live MCP status in the sidebar",
   "license": "MIT",
   "publishConfig": {

package/release-notes.md

@@ -1,5 +1,30 @@
 # Release Notes — @max-null/dsh-skill-mcp-center
 
+## 0.5.4 (2026-10-04)
+
+### 修复
+
+- **插件用 `bundledSkillDir` 注册的技能扫不到**。面板原先只认一种形态：拿 loader
+  entry 的 `name` 当包名，去拼 `<node_modules>/<包名>/skills`。插件若把官方
+  `@deepseek-ai/dsh-skill-filesystem` 挂在自己的 id 下、用 `bundledSkillDir` 指向
+  自带 `skills/`（活样本 `dsh-plugin-zhihu-search`），说明符就是**另一个包名**，
+  拼出的路径不存在；而它的技能往往还在**另一棵** `node_modules` 树里。
+
+  真正的判据比「拼错了包名」更深一层：`bundledSkillDir` 在 `entry.options.config`
+  里保留的是 `!!js` 表达式节点（`{ __jsExpr }`），**不是路径**——Loader 只把求值后的
+  副本交给 entry 的 fiber，存下来的那份要留着让文件写回保住 `!!js` 写法。所以照
+  options 去拼路径必然落空，且**不报错**（静默漏掉）。
+
+  修法：该配置**从 fiber 读**，两条声明都探，并对同一目录去重。
+
+### 兼容性
+
+- 无接口变更：`listSkills()` 的出入参、端点集合与请求信封均未改，只是发现来源多了
+  一条。插件技能仍是只读展示（`writable: false`），未开放开关。
+- 新增 12 条测试：10 条覆盖根发现（含「options 里的表达式节点不被当路径采信」这一
+  关键回归），2 条用真 cordis + 真 Loader 坐实「options 上是节点、fiber 上是求值后
+  的路径」。后者会在上游改变该行为时变红。
+
 ## 0.5.3 (2026-10-02)
 
 ### 修复