@max-null/dsh-skill-mcp-center 0.5.4 → 0.6.0

package/README.md

@@ -10,7 +10,7 @@ Skill 与 MCP 管理中心：在设置里管理 skills 与 MCP 服务器，右
 
 ## Features / 功能
 
-- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect. Also covers a plugin that mounts `@deepseek-ai/dsh-skill-filesystem` under an id of its own and points `bundledSkillDir` at its skills (e.g. `dsh-plugin-zhihu-search`), including when the patch computes that path with a `!!js` expression — such a path is read from the entry's fiber, where the Loader has already evaluated it.
+- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect. Also covers a plugin that mounts `@deepseek-ai/dsh-skill-filesystem` under an id of its own and points `bundledSkillDir` at its skills (e.g. `dsh-plugin-zhihu-search`), including when the patch computes that path with a `!!js` expression — such a path is read from the entry's fiber, where the Loader has already evaluated it. **Deleting** a user-level or project-level skill is offered on the same rows, behind a confirmation that names the skill and its path; the entry is *moved* to `~/.dsh/.skill-trash/` rather than destroyed, so a mistaken deletion stays recoverable. Plugin and built-in skills stay read-only.
 - **MCP management / MCP 管理** — add / edit / remove `mcp-client` servers, enable/disable without deleting config, all **hot-applied** through `ctx.loader` (no restart).
 - **Live status / 实时状态** — a sidebar "MCP" tab (via `dsh-better-sidebar`) showing per-server connection state; **click a server row to expand its tools' names and descriptions** (collapsed by default — a server can expose dozens of them). Names come from `tools.schemas()`; the redundant `mcp__<server>__` prefix is hidden while the full name stays on hover. Polled while visible and following the session.
 - **Skin-compatible / 皮肤兼容** — every color uses `var(--dsw-*)` tokens.

package/client.js

@@ -248,7 +248,11 @@ var zhDict = {
   viewMd: "\u67E5\u770B SKILL.md",
   hideMd: "\u6536\u8D77",
   mdLoadFailed: "\u8BFB\u53D6\u5931\u8D25\uFF1A{e}",
-  refOpen: "\u6253\u5F00\u6587\u4EF6\u5F15\u7528"
+  refOpen: "\u6253\u5F00\u6587\u4EF6\u5F15\u7528",
+  deleteSkill: "\u5220\u9664\u6280\u80FD",
+  deleteConfirm: "\u5220\u9664\u6280\u80FD\u300C{name}\u300D\uFF1F\n\n{path}\n\n\u5B83\u4F1A\u88AB\u79FB\u5230\u56DE\u6536\u76EE\u5F55\uFF08~/.dsh/.skill-trash\uFF09\uFF0C\u9700\u8981\u65F6\u53EF\u4EE5\u624B\u52A8\u79FB\u56DE\u53BB\u3002",
+  skillDeleted: "\u5DF2\u5220\u9664 {name}\uFF0C\u79FB\u5230 {path}",
+  deleteFailed: "\u5220\u9664\u5931\u8D25\uFF1A{e}"
 };
 var enDict = {
   loading: "Loading\u2026",
@@ -303,7 +307,11 @@ var enDict = {
   viewMd: "View SKILL.md",
   hideMd: "Hide",
   mdLoadFailed: "Failed to read: {e}",
-  refOpen: "Open file reference"
+  refOpen: "Open file reference",
+  deleteSkill: "Delete skill",
+  deleteConfirm: 'Delete skill "{name}"?\n\n{path}\n\nIt will be moved to ~/.dsh/.skill-trash and can be moved back manually if needed.',
+  skillDeleted: "Deleted {name}, moved to {path}",
+  deleteFailed: "Delete failed: {e}"
 };
 var rpc = async () => {
   throw new Error("skill-mcp-center: rpc not wired");
@@ -432,6 +440,21 @@ function SkillView() {
       }
     );
   };
+  const remove = (s) => {
+    if (!window.confirm(t("deleteConfirm", { name: s.name, path: s.path }))) return;
+    setBusy(s.path);
+    void rpc("deleteSkill", { path: s.path }).then(
+      (v) => {
+        setBusy(null);
+        load();
+        showToast(t("skillDeleted", { name: s.name, path: v.trashPath }));
+      },
+      (e) => {
+        setBusy(null);
+        showToast(t("deleteFailed", { e: e instanceof Error ? e.message : String(e) }), "error");
+      }
+    );
+  };
   const openMd = (s) => {
     if (mdPath === s.path) {
       setMdPath(null);
@@ -508,7 +531,19 @@ function SkillView() {
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-spacer" }),
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "smc-btn", onClick: () => {
             openMd(s);
-          }, children: mdPath === s.path ? t("hideMd") : t("viewMd") })
+          }, children: mdPath === s.path ? t("hideMd") : t("viewMd") }),
+          s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "button",
+            {
+              type: "button",
+              className: "smc-btn danger",
+              disabled: busy === s.path,
+              onClick: () => {
+                remove(s);
+              },
+              children: t("deleteSkill")
+            }
+          )
         ] }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "smc-detail-row", children: [
           t("detailPath"),
@@ -829,6 +864,18 @@ function SidebarSkillTab({ visible, cwd }) {
     if (!visible) return;
     load();
   }, [visible, load]);
+  const removeSkill = (s) => {
+    if (!window.confirm(t("deleteConfirm", { name: s.name, path: s.path }))) return;
+    void rpc("deleteSkill", { path: s.path, cwd }).then(
+      (v) => {
+        load();
+        showToast(t("skillDeleted", { name: s.name, path: v.trashPath }));
+      },
+      (e) => {
+        showToast(t("deleteFailed", { e: e instanceof Error ? e.message : String(e) }), "error");
+      }
+    );
+  };
   const openMd = (path) => {
     if (mdPath === path) {
       setMdPath(null);
@@ -900,6 +947,19 @@ ${s.path}`, children: [
             children: mdPath === s.path ? t("hideMd") : "MD"
           }
         ),
+        s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "button",
+          {
+            type: "button",
+            className: "smc-btn danger",
+            style: { height: 20, padding: "0 6px", fontSize: 11 },
+            onClick: () => {
+              removeSkill(s);
+            },
+            "aria-label": t("deleteSkill"),
+            children: t("remove")
+          }
+        ),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
           "button",
           {

package/dist/rpc.js

@@ -100,6 +100,13 @@ async function dispatch(ctx, body) {
                 const cwd = p.cwd;
                 return { ok: true, value: await ctx.skillMcp.readSkill(path, typeof cwd === 'string' ? cwd : undefined) };
             }
+            case 'deleteSkill': {
+                const path = p.path;
+                if (typeof path !== 'string' || path === '')
+                    return internal('deleteSkill: path is required');
+                const cwd = p.cwd;
+                return { ok: true, value: await ctx.skillMcp.deleteSkill(path, typeof cwd === 'string' ? cwd : undefined) };
+            }
             case 'listMcpServers':
                 return { ok: true, value: await ctx.skillMcp.listMcpServers() };
             case 'createMcpServer':

package/dist/service.d.ts

@@ -126,6 +126,23 @@ export declare function pluginSkillRoots(entries: Iterable<SkillRootEntry>, node
     dir: string;
     label: string;
 }[];
+/**
+ * Resolve the entry one deletion removes, or reject the request.
+ *
+ * `path` is a SKILL.md path as `listSkills` reported it. A bundle
+ * (`<root>/<name>/SKILL.md`) is removed as its directory; a flat file
+ * (`<root>/<name>.md`) as itself.
+ *
+ * The entry must be a **direct child** of one of `roots`. Direct-child
+ * placement, rather than a prefix check, is what keeps this from being aimed
+ * at a root itself, at a nested reference file inside a skill, or at anything
+ * under a plugin package — those roots are not in the list to begin with.
+ * @param path - candidate SKILL.md path.
+ * @param roots - roots a deletion may target.
+ * @returns the absolute entry to remove.
+ * @throws {Error} `skill-not-found` when the path is not a skill entry sitting directly under an allowed root.
+ */
+export declare function deleteTargetOf(path: string, roots: readonly string[]): string;
 export declare class SkillMcpService extends Service {
     static inject: string[];
     private readonly officialSkillDirs;
@@ -154,6 +171,22 @@ export declare class SkillMcpService extends Service {
      * scans, so the RPC cannot be used to read arbitrary files.
      */
     readSkill(path: string, cwd?: string): Promise<string>;
+    /**
+     * Delete one user-level or project-level skill.
+     *
+     * The entry is **moved**, not unlinked: a mistaken deletion lands in
+     * `<home>/.dsh/.skill-trash/` and stays recoverable, and the destination is
+     * returned so the surface can tell the user where it went. Plugin packages
+     * and the official bundled roots are not candidates — see
+     * {@link deletableRoots}.
+     * @param path - absolute SKILL.md path, as `listSkills` reported it.
+     * @param cwd - session workspace, when the caller has one.
+     * @returns the trash path the skill was moved to.
+     * @throws {Error} `skill-not-found` when the path is not deletable; `skill-delete-failed` when the move fails.
+     */
+    deleteSkill(path: string, cwd?: string): Promise<{
+        trashPath: string;
+    }>;
     /** Every `mcp-client` loader entry as a server card. */
     listMcpServers(): Promise<McpServer[]>;
     /** Add one mcp-client entry — hot-connects (create → init) and persists. */

package/dist/service.js

@@ -8,9 +8,9 @@
  */
 import { Service } from '@deepseek-ai/cordis';
 import { existsSync } from 'node:fs';
-import { readdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { cp, mkdir, readdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { join, sep } from 'node:path';
+import { basename, dirname, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseSkillFrontmatter, setDisableModelInvocation } from "./frontmatter.js";
 /** Runtime mirror of cordis FiberState (a cross-package const enum). */
@@ -190,6 +190,45 @@ export function pluginSkillRoots(entries, nodeModules) {
     }
     return out;
 }
+/**
+ * Skill roots a deletion may target: the user-level roots plus the given
+ * workspace's, and nothing else.
+ *
+ * Deliberately narrower than the set `readSkill` accepts: plugin packages and
+ * the official bundled roots stay read-only by contract, so they are not
+ * candidates even though the surface lists them.
+ * @param cwd - session workspace, when the caller has one.
+ * @returns the roots a deletion may target.
+ */
+function deletableRoots(cwd) {
+    const roots = SKILL_ROOTS.map(root => root.path);
+    if (cwd !== undefined && cwd !== '') {
+        roots.push(join(cwd, '.agents', 'skills'), join(cwd, '.dsh', 'skills'));
+    }
+    return roots;
+}
+/**
+ * Resolve the entry one deletion removes, or reject the request.
+ *
+ * `path` is a SKILL.md path as `listSkills` reported it. A bundle
+ * (`<root>/<name>/SKILL.md`) is removed as its directory; a flat file
+ * (`<root>/<name>.md`) as itself.
+ *
+ * The entry must be a **direct child** of one of `roots`. Direct-child
+ * placement, rather than a prefix check, is what keeps this from being aimed
+ * at a root itself, at a nested reference file inside a skill, or at anything
+ * under a plugin package — those roots are not in the list to begin with.
+ * @param path - candidate SKILL.md path.
+ * @param roots - roots a deletion may target.
+ * @returns the absolute entry to remove.
+ * @throws {Error} `skill-not-found` when the path is not a skill entry sitting directly under an allowed root.
+ */
+export function deleteTargetOf(path, roots) {
+    const entry = basename(path) === 'SKILL.md' ? dirname(path) : path;
+    if (!roots.some(root => dirname(entry) === root))
+        throw new Error('skill-not-found');
+    return entry;
+}
 export class SkillMcpService extends Service {
     static inject = ['loader', 'tools'];
     officialSkillDirs;
@@ -282,6 +321,41 @@ export class SkillMcpService extends Service {
         }
         return text;
     }
+    /**
+     * Delete one user-level or project-level skill.
+     *
+     * The entry is **moved**, not unlinked: a mistaken deletion lands in
+     * `<home>/.dsh/.skill-trash/` and stays recoverable, and the destination is
+     * returned so the surface can tell the user where it went. Plugin packages
+     * and the official bundled roots are not candidates — see
+     * {@link deletableRoots}.
+     * @param path - absolute SKILL.md path, as `listSkills` reported it.
+     * @param cwd - session workspace, when the caller has one.
+     * @returns the trash path the skill was moved to.
+     * @throws {Error} `skill-not-found` when the path is not deletable; `skill-delete-failed` when the move fails.
+     */
+    async deleteSkill(path, cwd) {
+        const entry = deleteTargetOf(path, deletableRoots(cwd));
+        const trashRoot = join(homedir(), '.dsh', '.skill-trash');
+        const trashPath = join(trashRoot, `${Date.now()}-${basename(entry)}`);
+        try {
+            await mkdir(trashRoot, { recursive: true });
+            try {
+                await rename(entry, trashPath);
+            }
+            catch (error) {
+                // Renaming across volumes fails with EXDEV; copy then remove instead.
+                if (error.code !== 'EXDEV')
+                    throw error;
+                await cp(entry, trashPath, { recursive: true });
+                await rm(entry, { recursive: true, force: true });
+            }
+        }
+        catch {
+            throw new Error('skill-delete-failed');
+        }
+        return { trashPath };
+    }
     /** Every `mcp-client` loader entry as a server card. */
     async listMcpServers() {
         const servers = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@max-null/dsh-skill-mcp-center",
-  "version": "0.5.4",
+  "version": "0.6.0",
   "description": "Skill & MCP management center for DeepSeek Harness — manage skills and MCP servers in Settings, live MCP status in the sidebar",
   "license": "MIT",
   "publishConfig": {

package/release-notes.md

@@ -1,5 +1,29 @@
 # Release Notes — @max-null/dsh-skill-mcp-center
 
+## 0.6.0 (2026-10-06)
+
+### 新增
+
+- **删除用户级 / 项目级技能**。设置页与侧栏的技能行都多了一个「删除」按钮，只出现在
+  `writable` 的技能上 —— 也就是 `~/.dsh/skills`、`~/.agents/skills`，以及当前工作区的
+  `<cwd>/.agents/skills` 与 `<cwd>/.dsh/skills`。插件技能与 DSH 官方内置技能（`plugin:` /
+  `bundled` / `dsh-official`）保持只读，不出现该按钮。
+
+  点删除先弹确认，写明技能名与完整路径；确认后该技能从磁盘移除 —— 目录形态
+  （`<name>/SKILL.md`）删整个目录，平铺形态（`<name>.md`）删那个文件。
+
+  **不直接销毁**：条目被移到 `~/.dsh/.skill-trash/`，成功提示里给出具体位置，误删可手动
+  移回去。
+
+### 兼容性
+
+- 新增一个 RPC 端点 `deleteSkill`（`{ path, cwd? }`）；现有端点与请求信封不变。
+- 删除面**刻意窄于**查看面：`readSkill` 接受插件与内置根，删除只接受用户级与项目级根，
+  并且要求目标**正好是某个允许根的直接子项** —— 根自身、技能内部的嵌套文件、名字相近的
+  兄弟目录一律拒绝（`skill-not-found`）。
+- 新增 10 条测试：7 条覆盖删除目标的解析与拒绝面，3 条做真实文件操作（整目录 / 平铺 /
+  拒绝后文件原样不动）。
+
 ## 0.5.4 (2026-10-04)
 
 ### 修复