@max-null/dsh-skill-mcp-center 0.5.3 → 0.6.0

package/README.md

@@ -10,7 +10,7 @@ Skill 与 MCP 管理中心：在设置里管理 skills 与 MCP 服务器，右
 
 ## Features / 功能
 
-- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect.
+- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect. Also covers a plugin that mounts `@deepseek-ai/dsh-skill-filesystem` under an id of its own and points `bundledSkillDir` at its skills (e.g. `dsh-plugin-zhihu-search`), including when the patch computes that path with a `!!js` expression — such a path is read from the entry's fiber, where the Loader has already evaluated it. **Deleting** a user-level or project-level skill is offered on the same rows, behind a confirmation that names the skill and its path; the entry is *moved* to `~/.dsh/.skill-trash/` rather than destroyed, so a mistaken deletion stays recoverable. Plugin and built-in skills stay read-only.
 - **MCP management / MCP 管理** — add / edit / remove `mcp-client` servers, enable/disable without deleting config, all **hot-applied** through `ctx.loader` (no restart).
 - **Live status / 实时状态** — a sidebar "MCP" tab (via `dsh-better-sidebar`) showing per-server connection state; **click a server row to expand its tools' names and descriptions** (collapsed by default — a server can expose dozens of them). Names come from `tools.schemas()`; the redundant `mcp__<server>__` prefix is hidden while the full name stays on hover. Polled while visible and following the session.
 - **Skin-compatible / 皮肤兼容** — every color uses `var(--dsw-*)` tokens.

package/client.js

@@ -248,7 +248,11 @@ var zhDict = {
   viewMd: "\u67E5\u770B SKILL.md",
   hideMd: "\u6536\u8D77",
   mdLoadFailed: "\u8BFB\u53D6\u5931\u8D25\uFF1A{e}",
-  refOpen: "\u6253\u5F00\u6587\u4EF6\u5F15\u7528"
+  refOpen: "\u6253\u5F00\u6587\u4EF6\u5F15\u7528",
+  deleteSkill: "\u5220\u9664\u6280\u80FD",
+  deleteConfirm: "\u5220\u9664\u6280\u80FD\u300C{name}\u300D\uFF1F\n\n{path}\n\n\u5B83\u4F1A\u88AB\u79FB\u5230\u56DE\u6536\u76EE\u5F55\uFF08~/.dsh/.skill-trash\uFF09\uFF0C\u9700\u8981\u65F6\u53EF\u4EE5\u624B\u52A8\u79FB\u56DE\u53BB\u3002",
+  skillDeleted: "\u5DF2\u5220\u9664 {name}\uFF0C\u79FB\u5230 {path}",
+  deleteFailed: "\u5220\u9664\u5931\u8D25\uFF1A{e}"
 };
 var enDict = {
   loading: "Loading\u2026",
@@ -303,7 +307,11 @@ var enDict = {
   viewMd: "View SKILL.md",
   hideMd: "Hide",
   mdLoadFailed: "Failed to read: {e}",
-  refOpen: "Open file reference"
+  refOpen: "Open file reference",
+  deleteSkill: "Delete skill",
+  deleteConfirm: 'Delete skill "{name}"?\n\n{path}\n\nIt will be moved to ~/.dsh/.skill-trash and can be moved back manually if needed.',
+  skillDeleted: "Deleted {name}, moved to {path}",
+  deleteFailed: "Delete failed: {e}"
 };
 var rpc = async () => {
   throw new Error("skill-mcp-center: rpc not wired");
@@ -432,6 +440,21 @@ function SkillView() {
       }
     );
   };
+  const remove = (s) => {
+    if (!window.confirm(t("deleteConfirm", { name: s.name, path: s.path }))) return;
+    setBusy(s.path);
+    void rpc("deleteSkill", { path: s.path }).then(
+      (v) => {
+        setBusy(null);
+        load();
+        showToast(t("skillDeleted", { name: s.name, path: v.trashPath }));
+      },
+      (e) => {
+        setBusy(null);
+        showToast(t("deleteFailed", { e: e instanceof Error ? e.message : String(e) }), "error");
+      }
+    );
+  };
   const openMd = (s) => {
     if (mdPath === s.path) {
       setMdPath(null);
@@ -508,7 +531,19 @@ function SkillView() {
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-spacer" }),
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "smc-btn", onClick: () => {
             openMd(s);
-          }, children: mdPath === s.path ? t("hideMd") : t("viewMd") })
+          }, children: mdPath === s.path ? t("hideMd") : t("viewMd") }),
+          s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "button",
+            {
+              type: "button",
+              className: "smc-btn danger",
+              disabled: busy === s.path,
+              onClick: () => {
+                remove(s);
+              },
+              children: t("deleteSkill")
+            }
+          )
         ] }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "smc-detail-row", children: [
           t("detailPath"),
@@ -829,6 +864,18 @@ function SidebarSkillTab({ visible, cwd }) {
     if (!visible) return;
     load();
   }, [visible, load]);
+  const removeSkill = (s) => {
+    if (!window.confirm(t("deleteConfirm", { name: s.name, path: s.path }))) return;
+    void rpc("deleteSkill", { path: s.path, cwd }).then(
+      (v) => {
+        load();
+        showToast(t("skillDeleted", { name: s.name, path: v.trashPath }));
+      },
+      (e) => {
+        showToast(t("deleteFailed", { e: e instanceof Error ? e.message : String(e) }), "error");
+      }
+    );
+  };
   const openMd = (path) => {
     if (mdPath === path) {
       setMdPath(null);
@@ -900,6 +947,19 @@ ${s.path}`, children: [
             children: mdPath === s.path ? t("hideMd") : "MD"
           }
         ),
+        s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "button",
+          {
+            type: "button",
+            className: "smc-btn danger",
+            style: { height: 20, padding: "0 6px", fontSize: 11 },
+            onClick: () => {
+              removeSkill(s);
+            },
+            "aria-label": t("deleteSkill"),
+            children: t("remove")
+          }
+        ),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
           "button",
           {

package/dist/rpc.js

@@ -100,6 +100,13 @@ async function dispatch(ctx, body) {
                 const cwd = p.cwd;
                 return { ok: true, value: await ctx.skillMcp.readSkill(path, typeof cwd === 'string' ? cwd : undefined) };
             }
+            case 'deleteSkill': {
+                const path = p.path;
+                if (typeof path !== 'string' || path === '')
+                    return internal('deleteSkill: path is required');
+                const cwd = p.cwd;
+                return { ok: true, value: await ctx.skillMcp.deleteSkill(path, typeof cwd === 'string' ? cwd : undefined) };
+            }
             case 'listMcpServers':
                 return { ok: true, value: await ctx.skillMcp.listMcpServers() };
             case 'createMcpServer':

package/dist/service.d.ts

@@ -83,13 +83,72 @@ export interface McpConfig {
  * @returns the skills this root contributes, in directory order.
  */
 export declare function scanSkillRoot(root: string, source: string, writable?: boolean, provider?: string): Promise<SkillView[]>;
+/** The loader-entry fields plugin skill discovery reads. */
+export interface SkillRootEntry {
+    readonly options: {
+        readonly id: string;
+        readonly name: string;
+    };
+    /** Absent while the entry is disabled, incompatible, or still loading. */
+    readonly fiber?: {
+        readonly config: unknown;
+    } | undefined;
+}
+/**
+ * Skill roots contributed by loaded plugin packages.
+ *
+ * Two declarations reach such a directory, and both are needed:
+ *
+ * - the entry's module specifier, i.e. `<node_modules>/<pkg>/skills` — how
+ *   `@max-null/dsh-skills` and `@max-null/dsh-plugin-center` ship theirs;
+ * - the entry's own `bundledSkillDir` config — the only way to see a plugin
+ *   that mounts the official `@deepseek-ai/dsh-skill-filesystem` under an id
+ *   of its own. `dsh-plugin-zhihu-search` is the live sample: it registers
+ *   `name: '@deepseek-ai/dsh-skill-filesystem'`, and its `skills/` sits in a
+ *   different `node_modules` tree than this plugin's.
+ *
+ * `bundledSkillDir` is read from the **fiber**, never from
+ * `entry.options.config`. A patch may compute the value with a `!!js`
+ * expression, and the Loader keeps that expression as a `{ __jsExpr }` node
+ * in the stored options while handing the owning fiber the evaluated copy —
+ * it interpolates on the `internal/config` waterfall and writes the raw node
+ * back on `internal/update` specifically so file write-back preserves the
+ * `!!js` form. The stored value is therefore an expression node rather than a
+ * path, and reading it can only miss.
+ *
+ * Only **loaded** entries are probed, so this costs a couple of existence
+ * checks per plugin instead of a scan of the whole `node_modules` tree.
+ * @param entries - loaded loader entries.
+ * @param nodeModules - this package's own `node_modules` tree, or null.
+ * @returns the skill roots that exist, deduplicated, in entry order.
+ */
+export declare function pluginSkillRoots(entries: Iterable<SkillRootEntry>, nodeModules: string | null): {
+    dir: string;
+    label: string;
+}[];
+/**
+ * Resolve the entry one deletion removes, or reject the request.
+ *
+ * `path` is a SKILL.md path as `listSkills` reported it. A bundle
+ * (`<root>/<name>/SKILL.md`) is removed as its directory; a flat file
+ * (`<root>/<name>.md`) as itself.
+ *
+ * The entry must be a **direct child** of one of `roots`. Direct-child
+ * placement, rather than a prefix check, is what keeps this from being aimed
+ * at a root itself, at a nested reference file inside a skill, or at anything
+ * under a plugin package — those roots are not in the list to begin with.
+ * @param path - candidate SKILL.md path.
+ * @param roots - roots a deletion may target.
+ * @returns the absolute entry to remove.
+ * @throws {Error} `skill-not-found` when the path is not a skill entry sitting directly under an allowed root.
+ */
+export declare function deleteTargetOf(path: string, roots: readonly string[]): string;
 export declare class SkillMcpService extends Service {
     static inject: string[];
     private readonly officialSkillDirs;
     constructor(ctx: Context, config?: SkillConfig);
     /**
-     * Skill roots that live **inside loaded plugin packages**, i.e.
-     * `<node_modules>/<pkg>/skills`.
+     * Skill roots that live **inside loaded plugin packages**.
      *
      * The host-level skill filesystem is disabled in web-app (presets own
      * discovery), so a plugin that ships skills — `@max-null/dsh-skills` and
@@ -97,9 +156,6 @@ export declare class SkillMcpService extends Service {
      * package, where no user-level root can see them. Without this the
      * management surface showed 17 user skills while 8 plugin skills were loaded
      * and in effect (2026-09-14 用户报「skill 生效但不展示」).
-     *
-     * Only **loaded** entries are probed, so this costs one existence check per
-     * plugin rather than a scan of the whole node_modules tree.
      */
     private pluginSkillDirs;
     /**
@@ -115,6 +171,22 @@ export declare class SkillMcpService extends Service {
      * scans, so the RPC cannot be used to read arbitrary files.
      */
     readSkill(path: string, cwd?: string): Promise<string>;
+    /**
+     * Delete one user-level or project-level skill.
+     *
+     * The entry is **moved**, not unlinked: a mistaken deletion lands in
+     * `<home>/.dsh/.skill-trash/` and stays recoverable, and the destination is
+     * returned so the surface can tell the user where it went. Plugin packages
+     * and the official bundled roots are not candidates — see
+     * {@link deletableRoots}.
+     * @param path - absolute SKILL.md path, as `listSkills` reported it.
+     * @param cwd - session workspace, when the caller has one.
+     * @returns the trash path the skill was moved to.
+     * @throws {Error} `skill-not-found` when the path is not deletable; `skill-delete-failed` when the move fails.
+     */
+    deleteSkill(path: string, cwd?: string): Promise<{
+        trashPath: string;
+    }>;
     /** Every `mcp-client` loader entry as a server card. */
     listMcpServers(): Promise<McpServer[]>;
     /** Add one mcp-client entry — hot-connects (create → init) and persists. */

package/dist/service.js

@@ -8,9 +8,9 @@
  */
 import { Service } from '@deepseek-ai/cordis';
 import { existsSync } from 'node:fs';
-import { readdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { cp, mkdir, readdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { join, sep } from 'node:path';
+import { basename, dirname, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseSkillFrontmatter, setDisableModelInvocation } from "./frontmatter.js";
 /** Runtime mirror of cordis FiberState (a cross-package const enum). */
@@ -139,6 +139,96 @@ export async function scanSkillRoot(root, source, writable = true, provider = 'f
     }
     return skills;
 }
+/**
+ * Skill roots contributed by loaded plugin packages.
+ *
+ * Two declarations reach such a directory, and both are needed:
+ *
+ * - the entry's module specifier, i.e. `<node_modules>/<pkg>/skills` — how
+ *   `@max-null/dsh-skills` and `@max-null/dsh-plugin-center` ship theirs;
+ * - the entry's own `bundledSkillDir` config — the only way to see a plugin
+ *   that mounts the official `@deepseek-ai/dsh-skill-filesystem` under an id
+ *   of its own. `dsh-plugin-zhihu-search` is the live sample: it registers
+ *   `name: '@deepseek-ai/dsh-skill-filesystem'`, and its `skills/` sits in a
+ *   different `node_modules` tree than this plugin's.
+ *
+ * `bundledSkillDir` is read from the **fiber**, never from
+ * `entry.options.config`. A patch may compute the value with a `!!js`
+ * expression, and the Loader keeps that expression as a `{ __jsExpr }` node
+ * in the stored options while handing the owning fiber the evaluated copy —
+ * it interpolates on the `internal/config` waterfall and writes the raw node
+ * back on `internal/update` specifically so file write-back preserves the
+ * `!!js` form. The stored value is therefore an expression node rather than a
+ * path, and reading it can only miss.
+ *
+ * Only **loaded** entries are probed, so this costs a couple of existence
+ * checks per plugin instead of a scan of the whole `node_modules` tree.
+ * @param entries - loaded loader entries.
+ * @param nodeModules - this package's own `node_modules` tree, or null.
+ * @returns the skill roots that exist, deduplicated, in entry order.
+ */
+export function pluginSkillRoots(entries, nodeModules) {
+    const out = [];
+    const seen = new Set();
+    const add = (dir, label) => {
+        if (seen.has(dir) || !existsSync(dir))
+            return;
+        seen.add(dir);
+        out.push({ dir, label });
+    };
+    for (const entry of entries) {
+        const name = entry.options.name;
+        if (nodeModules !== null && name !== '' && !name.startsWith('.') && !name.startsWith('/')) {
+            add(join(nodeModules, ...name.split('/'), 'skills'), `plugin:${name}`);
+        }
+        const config = entry.fiber?.config;
+        const declared = typeof config === 'object' && config !== null && 'bundledSkillDir' in config
+            ? config.bundledSkillDir
+            : undefined;
+        if (typeof declared === 'string')
+            add(declared, `plugin:${entry.options.id}`);
+    }
+    return out;
+}
+/**
+ * Skill roots a deletion may target: the user-level roots plus the given
+ * workspace's, and nothing else.
+ *
+ * Deliberately narrower than the set `readSkill` accepts: plugin packages and
+ * the official bundled roots stay read-only by contract, so they are not
+ * candidates even though the surface lists them.
+ * @param cwd - session workspace, when the caller has one.
+ * @returns the roots a deletion may target.
+ */
+function deletableRoots(cwd) {
+    const roots = SKILL_ROOTS.map(root => root.path);
+    if (cwd !== undefined && cwd !== '') {
+        roots.push(join(cwd, '.agents', 'skills'), join(cwd, '.dsh', 'skills'));
+    }
+    return roots;
+}
+/**
+ * Resolve the entry one deletion removes, or reject the request.
+ *
+ * `path` is a SKILL.md path as `listSkills` reported it. A bundle
+ * (`<root>/<name>/SKILL.md`) is removed as its directory; a flat file
+ * (`<root>/<name>.md`) as itself.
+ *
+ * The entry must be a **direct child** of one of `roots`. Direct-child
+ * placement, rather than a prefix check, is what keeps this from being aimed
+ * at a root itself, at a nested reference file inside a skill, or at anything
+ * under a plugin package — those roots are not in the list to begin with.
+ * @param path - candidate SKILL.md path.
+ * @param roots - roots a deletion may target.
+ * @returns the absolute entry to remove.
+ * @throws {Error} `skill-not-found` when the path is not a skill entry sitting directly under an allowed root.
+ */
+export function deleteTargetOf(path, roots) {
+    const entry = basename(path) === 'SKILL.md' ? dirname(path) : path;
+    if (!roots.some(root => dirname(entry) === root))
+        throw new Error('skill-not-found');
+    return entry;
+}
 export class SkillMcpService extends Service {
     static inject = ['loader', 'tools'];
     officialSkillDirs;
@@ -147,8 +237,7 @@ export class SkillMcpService extends Service {
         this.officialSkillDirs = config.officialSkillDirs ?? [];
     }
     /**
-     * Skill roots that live **inside loaded plugin packages**, i.e.
-     * `<node_modules>/<pkg>/skills`.
+     * Skill roots that live **inside loaded plugin packages**.
      *
      * The host-level skill filesystem is disabled in web-app (presets own
      * discovery), so a plugin that ships skills — `@max-null/dsh-skills` and
@@ -156,24 +245,9 @@ export class SkillMcpService extends Service {
      * package, where no user-level root can see them. Without this the
      * management surface showed 17 user skills while 8 plugin skills were loaded
      * and in effect (2026-09-14 用户报「skill 生效但不展示」).
-     *
-     * Only **loaded** entries are probed, so this costs one existence check per
-     * plugin rather than a scan of the whole node_modules tree.
      */
     pluginSkillDirs() {
-        const nm = ownNodeModules();
-        if (nm === null)
-            return [];
-        const out = [];
-        for (const entry of this.ctx.loader.entries()) {
-            const name = entry.options.name;
-            if (typeof name !== 'string' || name === '' || name.startsWith('.') || name.startsWith('/'))
-                continue;
-            const dir = join(nm, ...name.split('/'), 'skills');
-            if (existsSync(dir))
-                out.push({ dir, label: `plugin:${name}` });
-        }
-        return out;
+        return pluginSkillRoots(this.ctx.loader.entries(), ownNodeModules());
     }
     /**
      * User-level skills, project-level skills for the given workspace, skills
@@ -247,6 +321,41 @@ export class SkillMcpService extends Service {
         }
         return text;
     }
+    /**
+     * Delete one user-level or project-level skill.
+     *
+     * The entry is **moved**, not unlinked: a mistaken deletion lands in
+     * `<home>/.dsh/.skill-trash/` and stays recoverable, and the destination is
+     * returned so the surface can tell the user where it went. Plugin packages
+     * and the official bundled roots are not candidates — see
+     * {@link deletableRoots}.
+     * @param path - absolute SKILL.md path, as `listSkills` reported it.
+     * @param cwd - session workspace, when the caller has one.
+     * @returns the trash path the skill was moved to.
+     * @throws {Error} `skill-not-found` when the path is not deletable; `skill-delete-failed` when the move fails.
+     */
+    async deleteSkill(path, cwd) {
+        const entry = deleteTargetOf(path, deletableRoots(cwd));
+        const trashRoot = join(homedir(), '.dsh', '.skill-trash');
+        const trashPath = join(trashRoot, `${Date.now()}-${basename(entry)}`);
+        try {
+            await mkdir(trashRoot, { recursive: true });
+            try {
+                await rename(entry, trashPath);
+            }
+            catch (error) {
+                // Renaming across volumes fails with EXDEV; copy then remove instead.
+                if (error.code !== 'EXDEV')
+                    throw error;
+                await cp(entry, trashPath, { recursive: true });
+                await rm(entry, { recursive: true, force: true });
+            }
+        }
+        catch {
+            throw new Error('skill-delete-failed');
+        }
+        return { trashPath };
+    }
     /** Every `mcp-client` loader entry as a server card. */
     async listMcpServers() {
         const servers = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@max-null/dsh-skill-mcp-center",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "description": "Skill & MCP management center for DeepSeek Harness — manage skills and MCP servers in Settings, live MCP status in the sidebar",
   "license": "MIT",
   "publishConfig": {

package/release-notes.md

@@ -1,5 +1,54 @@
 # Release Notes — @max-null/dsh-skill-mcp-center
 
+## 0.6.0 (2026-10-06)
+
+### 新增
+
+- **删除用户级 / 项目级技能**。设置页与侧栏的技能行都多了一个「删除」按钮，只出现在
+  `writable` 的技能上 —— 也就是 `~/.dsh/skills`、`~/.agents/skills`，以及当前工作区的
+  `<cwd>/.agents/skills` 与 `<cwd>/.dsh/skills`。插件技能与 DSH 官方内置技能（`plugin:` /
+  `bundled` / `dsh-official`）保持只读，不出现该按钮。
+
+  点删除先弹确认，写明技能名与完整路径；确认后该技能从磁盘移除 —— 目录形态
+  （`<name>/SKILL.md`）删整个目录，平铺形态（`<name>.md`）删那个文件。
+
+  **不直接销毁**：条目被移到 `~/.dsh/.skill-trash/`，成功提示里给出具体位置，误删可手动
+  移回去。
+
+### 兼容性
+
+- 新增一个 RPC 端点 `deleteSkill`（`{ path, cwd? }`）；现有端点与请求信封不变。
+- 删除面**刻意窄于**查看面：`readSkill` 接受插件与内置根，删除只接受用户级与项目级根，
+  并且要求目标**正好是某个允许根的直接子项** —— 根自身、技能内部的嵌套文件、名字相近的
+  兄弟目录一律拒绝（`skill-not-found`）。
+- 新增 10 条测试：7 条覆盖删除目标的解析与拒绝面，3 条做真实文件操作（整目录 / 平铺 /
+  拒绝后文件原样不动）。
+
+## 0.5.4 (2026-10-04)
+
+### 修复
+
+- **插件用 `bundledSkillDir` 注册的技能扫不到**。面板原先只认一种形态：拿 loader
+  entry 的 `name` 当包名，去拼 `<node_modules>/<包名>/skills`。插件若把官方
+  `@deepseek-ai/dsh-skill-filesystem` 挂在自己的 id 下、用 `bundledSkillDir` 指向
+  自带 `skills/`（活样本 `dsh-plugin-zhihu-search`），说明符就是**另一个包名**，
+  拼出的路径不存在；而它的技能往往还在**另一棵** `node_modules` 树里。
+
+  真正的判据比「拼错了包名」更深一层：`bundledSkillDir` 在 `entry.options.config`
+  里保留的是 `!!js` 表达式节点（`{ __jsExpr }`），**不是路径**——Loader 只把求值后的
+  副本交给 entry 的 fiber，存下来的那份要留着让文件写回保住 `!!js` 写法。所以照
+  options 去拼路径必然落空，且**不报错**（静默漏掉）。
+
+  修法：该配置**从 fiber 读**，两条声明都探，并对同一目录去重。
+
+### 兼容性
+
+- 无接口变更：`listSkills()` 的出入参、端点集合与请求信封均未改，只是发现来源多了
+  一条。插件技能仍是只读展示（`writable: false`），未开放开关。
+- 新增 12 条测试：10 条覆盖根发现（含「options 里的表达式节点不被当路径采信」这一
+  关键回归），2 条用真 cordis + 真 Loader 坐实「options 上是节点、fiber 上是求值后
+  的路径」。后者会在上游改变该行为时变红。
+
 ## 0.5.3 (2026-10-02)
 
 ### 修复