@max-null/dsh-skill-mcp-center 0.5.4 → 0.6.1

package/README.md

@@ -10,7 +10,7 @@ Skill 与 MCP 管理中心：在设置里管理 skills 与 MCP 服务器，右
 
 ## Features / 功能
 
-- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect. Also covers a plugin that mounts `@deepseek-ai/dsh-skill-filesystem` under an id of its own and points `bundledSkillDir` at its skills (e.g. `dsh-plugin-zhihu-search`), including when the patch computes that path with a `!!js` expression — such a path is read from the entry's fiber, where the Loader has already evaluated it.
+- **Skill management / Skill 管理** — browse every skill grouped by source (Global / Workspace / Built-in DSH official, plus one group per plugin that ships skills), toggle model invocation via the `disable-model-invocation` frontmatter (disk-backed skills only). Covers skills shipped **inside plugin packages** (e.g. `@max-null/dsh-skills`), not just the user-level roots — the host-level skill filesystem is disabled in web-app, so a plugin's own `skills/` directory would otherwise be invisible while its skills are loaded and in effect. Also covers a plugin that mounts `@deepseek-ai/dsh-skill-filesystem` under an id of its own and points `bundledSkillDir` at its skills (e.g. `dsh-plugin-zhihu-search`), including when the patch computes that path with a `!!js` expression — such a path is read from the entry's fiber, where the Loader has already evaluated it. **Deleting** a user-level or project-level skill is offered on the same rows, behind a confirmation that names the skill and its path; the entry is *moved* to `~/.dsh/.skill-trash/` rather than destroyed, so a mistaken deletion stays recoverable. Plugin and built-in skills stay read-only.
 - **MCP management / MCP 管理** — add / edit / remove `mcp-client` servers, enable/disable without deleting config, all **hot-applied** through `ctx.loader` (no restart).
 - **Live status / 实时状态** — a sidebar "MCP" tab (via `dsh-better-sidebar`) showing per-server connection state; **click a server row to expand its tools' names and descriptions** (collapsed by default — a server can expose dozens of them). Names come from `tools.schemas()`; the redundant `mcp__<server>__` prefix is hidden while the full name stays on hover. Polled while visible and following the session.
 - **Skin-compatible / 皮肤兼容** — every color uses `var(--dsw-*)` tokens.

package/client.js

@@ -81,6 +81,10 @@ var CSS = `
 .smc-toggle::after { content: ''; position: absolute; top: 3px; left: 3px; width: 16px; height: 16px; border-radius: 50%; background: #fff; transition: left .15s; }
 .smc-toggle.on::after { left: 21px; }
 .smc-toggle:disabled { opacity: 0.4; cursor: default; }
+.smc-skill-group { margin-bottom: 10px; }
+.smc-skill-group-head { display: flex; align-items: baseline; gap: 6px; padding: 6px 2px 4px; font-size: 11px; font-weight: 600; letter-spacing: .04em; color: var(--dsw-alias-label-caption); }
+.smc-skill-group-count { font-weight: 400; opacity: .7; }
+.smc-skill-group-note { padding: 0 2px 6px; font-size: 11px; line-height: 1.5; color: var(--dsw-alias-label-caption); }
 
 .smc-input { height: 34px; padding: 0 12px; border-radius: 8px; border: 1px solid var(--dsw-alias-border-l2); background: var(--dsw-alias-bg-layer-3); color: var(--dsw-alias-label-primary); font-size: 13px; line-height: 1.5; outline: none; font-family: inherit; }
 .smc-input:focus { border-color: var(--dsw-alias-brand-primary); }
@@ -236,6 +240,11 @@ var zhDict = {
   groupGlobal: "\u5168\u5C40",
   groupWorkspace: "\u5DE5\u4F5C\u533A",
   groupBundled: "\u5185\u7F6E\uFF08DSH \u5B98\u65B9\uFF09",
+  groupProject: "\u9879\u76EE\u7EA7",
+  groupUser: "\u7528\u6237\u7EA7",
+  groupPlugin: "\u63D2\u4EF6\u81EA\u5E26",
+  groupRuntime: "\u4EE3\u7801\u6CE8\u518C",
+  groupRuntimeNote: "\u7531\u63D2\u4EF6\u5728\u8FD0\u884C\u65F6\u6CE8\u518C\uFF0C\u4E0D\u53EF\u5728\u6B64\u7981\u7528",
   readOnlyBadge: "\u5185\u7F6E\u53EA\u8BFB",
   noMatch: "\u6CA1\u6709\u5339\u914D\u7684 skill",
   detailPath: "\u8DEF\u5F84",
@@ -248,7 +257,11 @@ var zhDict = {
   viewMd: "\u67E5\u770B SKILL.md",
   hideMd: "\u6536\u8D77",
   mdLoadFailed: "\u8BFB\u53D6\u5931\u8D25\uFF1A{e}",
-  refOpen: "\u6253\u5F00\u6587\u4EF6\u5F15\u7528"
+  refOpen: "\u6253\u5F00\u6587\u4EF6\u5F15\u7528",
+  deleteSkill: "\u5220\u9664\u6280\u80FD",
+  deleteConfirm: "\u5220\u9664\u6280\u80FD\u300C{name}\u300D\uFF1F\n\n{path}\n\n\u5B83\u4F1A\u88AB\u79FB\u5230\u56DE\u6536\u76EE\u5F55\uFF08~/.dsh/.skill-trash\uFF09\uFF0C\u9700\u8981\u65F6\u53EF\u4EE5\u624B\u52A8\u79FB\u56DE\u53BB\u3002",
+  skillDeleted: "\u5DF2\u5220\u9664 {name}\uFF0C\u79FB\u5230 {path}",
+  deleteFailed: "\u5220\u9664\u5931\u8D25\uFF1A{e}"
 };
 var enDict = {
   loading: "Loading\u2026",
@@ -291,6 +304,11 @@ var enDict = {
   groupGlobal: "Global",
   groupWorkspace: "Workspace",
   groupBundled: "Built-in (DSH official)",
+  groupProject: "Project",
+  groupUser: "User",
+  groupPlugin: "Plugin-bundled",
+  groupRuntime: "Code-registered",
+  groupRuntimeNote: "Registered by a plugin at runtime; cannot be disabled here",
   readOnlyBadge: "built-in read-only",
   noMatch: "No matching skills",
   detailPath: "path",
@@ -303,7 +321,11 @@ var enDict = {
   viewMd: "View SKILL.md",
   hideMd: "Hide",
   mdLoadFailed: "Failed to read: {e}",
-  refOpen: "Open file reference"
+  refOpen: "Open file reference",
+  deleteSkill: "Delete skill",
+  deleteConfirm: 'Delete skill "{name}"?\n\n{path}\n\nIt will be moved to ~/.dsh/.skill-trash and can be moved back manually if needed.',
+  skillDeleted: "Deleted {name}, moved to {path}",
+  deleteFailed: "Delete failed: {e}"
 };
 var rpc = async () => {
   throw new Error("skill-mcp-center: rpc not wired");
@@ -432,6 +454,21 @@ function SkillView() {
       }
     );
   };
+  const remove = (s) => {
+    if (!window.confirm(t("deleteConfirm", { name: s.name, path: s.path }))) return;
+    setBusy(s.path);
+    void rpc("deleteSkill", { path: s.path }).then(
+      (v) => {
+        setBusy(null);
+        load();
+        showToast(t("skillDeleted", { name: s.name, path: v.trashPath }));
+      },
+      (e) => {
+        setBusy(null);
+        showToast(t("deleteFailed", { e: e instanceof Error ? e.message : String(e) }), "error");
+      }
+    );
+  };
   const openMd = (s) => {
     if (mdPath === s.path) {
       setMdPath(null);
@@ -508,7 +545,19 @@ function SkillView() {
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-spacer" }),
           /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { type: "button", className: "smc-btn", onClick: () => {
             openMd(s);
-          }, children: mdPath === s.path ? t("hideMd") : t("viewMd") })
+          }, children: mdPath === s.path ? t("hideMd") : t("viewMd") }),
+          s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "button",
+            {
+              type: "button",
+              className: "smc-btn danger",
+              disabled: busy === s.path,
+              onClick: () => {
+                remove(s);
+              },
+              children: t("deleteSkill")
+            }
+          )
         ] }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "smc-detail-row", children: [
           t("detailPath"),
@@ -800,6 +849,21 @@ function sourceLabel(source, short = false) {
   const name = pkg.split("/").pop() ?? pkg;
   return short ? name : `plugin \xB7 ${name}`;
 }
+var SKILL_GROUP_ORDER = ["project", "user", "plugin", "bundled", "runtime"];
+var SKILL_GROUP_LABEL = {
+  project: "groupProject",
+  user: "groupUser",
+  plugin: "groupPlugin",
+  bundled: "groupBundled",
+  runtime: "groupRuntime"
+};
+function skillGroupOf(source) {
+  if (source === "project-dsh" || source === "project-agents") return "project";
+  if (source === "user-dsh" || source === "user-agents") return "user";
+  if (source.startsWith("plugin:")) return "plugin";
+  if (source === "bundled") return "bundled";
+  return "runtime";
+}
 function skillInNamespace(s, ns) {
   if (ns === "all") return true;
   if (ns === "global") {
@@ -829,6 +893,18 @@ function SidebarSkillTab({ visible, cwd }) {
     if (!visible) return;
     load();
   }, [visible, load]);
+  const removeSkill = (s) => {
+    if (!window.confirm(t("deleteConfirm", { name: s.name, path: s.path }))) return;
+    void rpc("deleteSkill", { path: s.path, cwd }).then(
+      (v) => {
+        load();
+        showToast(t("skillDeleted", { name: s.name, path: v.trashPath }));
+      },
+      (e) => {
+        showToast(t("deleteFailed", { e: e instanceof Error ? e.message : String(e) }), "error");
+      }
+    );
+  };
   const openMd = (path) => {
     if (mdPath === path) {
       setMdPath(null);
@@ -880,44 +956,64 @@ function SidebarSkillTab({ visible, cwd }) {
         k
       )) })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-sidebar-list", children: noWorkspace ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-empty", children: t("noWorkspace") }) : visibleItems.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-empty", children: q !== "" ? t("noMatch") : t("noSkills") }) : visibleItems.map((s) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "smc-srv", title: `${s.description}
-${s.path}`, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `smc-dot${s.modelInvocable ? "" : " idle"}` }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-srv-name", children: s.name }),
-        !s.modelInvocable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge", children: t("modelDisabled") }),
-        !s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge", children: sourceLabel(s.source, true) }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "button",
-          {
-            type: "button",
-            className: "smc-btn",
-            style: { height: 20, padding: "0 6px", fontSize: 11 },
-            onClick: () => {
-              openMd(s.path);
-            },
-            "aria-label": mdPath === s.path ? t("hideMd") : t("viewMd"),
-            children: mdPath === s.path ? t("hideMd") : "MD"
-          }
-        ),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "button",
-          {
-            type: "button",
-            className: `smc-toggle${s.modelInvocable ? " on" : ""}`,
-            title: t("toggleModelVisible"),
-            onClick: () => {
-              void rpc("toggleSkill", { path: s.path }).then(() => {
-                load();
-              });
-            },
-            "aria-label": s.modelInvocable ? t("disable") : t("enable")
-          }
-        )
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-sidebar-list", children: noWorkspace ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-empty", children: t("noWorkspace") }) : visibleItems.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-empty", children: q !== "" ? t("noMatch") : t("noSkills") }) : SKILL_GROUP_ORDER.map((kind) => ({ kind, items: visibleItems.filter((s) => skillGroupOf(s.source) === kind) })).filter((group) => group.items.length > 0).map((group) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "smc-skill-group", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "smc-skill-group-head", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t(SKILL_GROUP_LABEL[group.kind]) }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-skill-group-count", children: group.items.length })
       ] }),
-      s.description !== "" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-srv-desc", children: s.description }),
-      mdPath === s.path && (mdError !== null ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-md-err", children: t("mdLoadFailed", { e: mdError }) }) : mdText === null ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-md", children: t("loading") }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-md", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(MdWithRefs, { text: mdText }) }))
-    ] }, s.path)) })
+      group.kind === "runtime" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-skill-group-note", children: t("groupRuntimeNote") }),
+      group.items.map((s) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "smc-srv", title: `${s.description}
+${s.path}`, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: `smc-dot${s.modelInvocable ? "" : " idle"}` }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-srv-name", children: s.name }),
+          !s.modelInvocable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge", children: t("modelDisabled") }),
+          !s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "smc-badge", children: sourceLabel(s.source, true) }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "button",
+            {
+              type: "button",
+              className: "smc-btn",
+              style: { height: 20, padding: "0 6px", fontSize: 11 },
+              onClick: () => {
+                openMd(s.path);
+              },
+              "aria-label": mdPath === s.path ? t("hideMd") : t("viewMd"),
+              children: mdPath === s.path ? t("hideMd") : "MD"
+            }
+          ),
+          s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "button",
+            {
+              type: "button",
+              className: "smc-btn danger",
+              style: { height: 20, padding: "0 6px", fontSize: 11 },
+              onClick: () => {
+                removeSkill(s);
+              },
+              "aria-label": t("deleteSkill"),
+              children: t("remove")
+            }
+          ),
+          s.writable && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            "button",
+            {
+              type: "button",
+              className: `smc-toggle${s.modelInvocable ? " on" : ""}`,
+              title: t("toggleModelVisible"),
+              onClick: () => {
+                void rpc("toggleSkill", { path: s.path }).then(() => {
+                  load();
+                });
+              },
+              "aria-label": s.modelInvocable ? t("disable") : t("enable")
+            }
+          )
+        ] }),
+        s.description !== "" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-srv-desc", children: s.description }),
+        mdPath === s.path && (mdError !== null ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-md-err", children: t("mdLoadFailed", { e: mdError }) }) : mdText === null ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-md", children: t("loading") }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "smc-md", children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(MdWithRefs, { text: mdText }) }))
+      ] }, s.path === "" ? `runtime:${s.name}` : s.path))
+    ] }, group.kind)) })
   ] });
 }
 var inject = ["slots", "connection", "locale"];

package/dist/rpc.js

@@ -100,6 +100,13 @@ async function dispatch(ctx, body) {
                 const cwd = p.cwd;
                 return { ok: true, value: await ctx.skillMcp.readSkill(path, typeof cwd === 'string' ? cwd : undefined) };
             }
+            case 'deleteSkill': {
+                const path = p.path;
+                if (typeof path !== 'string' || path === '')
+                    return internal('deleteSkill: path is required');
+                const cwd = p.cwd;
+                return { ok: true, value: await ctx.skillMcp.deleteSkill(path, typeof cwd === 'string' ? cwd : undefined) };
+            }
             case 'listMcpServers':
                 return { ok: true, value: await ctx.skillMcp.listMcpServers() };
             case 'createMcpServer':

package/dist/service.d.ts

@@ -126,6 +126,23 @@ export declare function pluginSkillRoots(entries: Iterable<SkillRootEntry>, node
     dir: string;
     label: string;
 }[];
+/**
+ * Resolve the entry one deletion removes, or reject the request.
+ *
+ * `path` is a SKILL.md path as `listSkills` reported it. A bundle
+ * (`<root>/<name>/SKILL.md`) is removed as its directory; a flat file
+ * (`<root>/<name>.md`) as itself.
+ *
+ * The entry must be a **direct child** of one of `roots`. Direct-child
+ * placement, rather than a prefix check, is what keeps this from being aimed
+ * at a root itself, at a nested reference file inside a skill, or at anything
+ * under a plugin package — those roots are not in the list to begin with.
+ * @param path - candidate SKILL.md path.
+ * @param roots - roots a deletion may target.
+ * @returns the absolute entry to remove.
+ * @throws {Error} `skill-not-found` when the path is not a skill entry sitting directly under an allowed root.
+ */
+export declare function deleteTargetOf(path: string, roots: readonly string[]): string;
 export declare class SkillMcpService extends Service {
     static inject: string[];
     private readonly officialSkillDirs;
@@ -146,6 +163,16 @@ export declare class SkillMcpService extends Service {
      * bundled inside loaded plugin packages, and any configured official roots.
      */
     listSkills(cwd?: string): Promise<SkillView[]>;
+    /**
+     * 补上「运行时注册」的 skill：`ctx.skills.register()` 注册的条目没有 SKILL.md，
+     * 磁盘扫描（本项目的主要取数方式）看不到它们——dsh-jubensha 的 DM 手册、office、
+     * genui 都属于这一类。用户因此报了「面板少了很多 skill」。
+     *
+     * skills 服务是**可选**的：web-app 宿主把它关掉（presets 拥有发现，没有全局层可列），
+     * 所以这里 feature-detect，拿不到就原样返回空，不改变既有行为。
+     * 这些条目没有可写的 SKILL.md，标成 `writable: false`——开关对它们没有意义。
+     */
+    private runtimeOnlySkills;
     /** Flip one disk-backed skill's model invocation by rewriting its SKILL.md frontmatter. */
     toggleSkill(path: string): Promise<SkillView>;
     /**
@@ -154,6 +181,22 @@ export declare class SkillMcpService extends Service {
      * scans, so the RPC cannot be used to read arbitrary files.
      */
     readSkill(path: string, cwd?: string): Promise<string>;
+    /**
+     * Delete one user-level or project-level skill.
+     *
+     * The entry is **moved**, not unlinked: a mistaken deletion lands in
+     * `<home>/.dsh/.skill-trash/` and stays recoverable, and the destination is
+     * returned so the surface can tell the user where it went. Plugin packages
+     * and the official bundled roots are not candidates — see
+     * {@link deletableRoots}.
+     * @param path - absolute SKILL.md path, as `listSkills` reported it.
+     * @param cwd - session workspace, when the caller has one.
+     * @returns the trash path the skill was moved to.
+     * @throws {Error} `skill-not-found` when the path is not deletable; `skill-delete-failed` when the move fails.
+     */
+    deleteSkill(path: string, cwd?: string): Promise<{
+        trashPath: string;
+    }>;
     /** Every `mcp-client` loader entry as a server card. */
     listMcpServers(): Promise<McpServer[]>;
     /** Add one mcp-client entry — hot-connects (create → init) and persists. */

package/dist/service.js

@@ -8,9 +8,9 @@
  */
 import { Service } from '@deepseek-ai/cordis';
 import { existsSync } from 'node:fs';
-import { readdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { cp, mkdir, readdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { join, sep } from 'node:path';
+import { basename, dirname, join, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parseSkillFrontmatter, setDisableModelInvocation } from "./frontmatter.js";
 /** Runtime mirror of cordis FiberState (a cross-package const enum). */
@@ -190,6 +190,45 @@ export function pluginSkillRoots(entries, nodeModules) {
     }
     return out;
 }
+/**
+ * Skill roots a deletion may target: the user-level roots plus the given
+ * workspace's, and nothing else.
+ *
+ * Deliberately narrower than the set `readSkill` accepts: plugin packages and
+ * the official bundled roots stay read-only by contract, so they are not
+ * candidates even though the surface lists them.
+ * @param cwd - session workspace, when the caller has one.
+ * @returns the roots a deletion may target.
+ */
+function deletableRoots(cwd) {
+    const roots = SKILL_ROOTS.map(root => root.path);
+    if (cwd !== undefined && cwd !== '') {
+        roots.push(join(cwd, '.agents', 'skills'), join(cwd, '.dsh', 'skills'));
+    }
+    return roots;
+}
+/**
+ * Resolve the entry one deletion removes, or reject the request.
+ *
+ * `path` is a SKILL.md path as `listSkills` reported it. A bundle
+ * (`<root>/<name>/SKILL.md`) is removed as its directory; a flat file
+ * (`<root>/<name>.md`) as itself.
+ *
+ * The entry must be a **direct child** of one of `roots`. Direct-child
+ * placement, rather than a prefix check, is what keeps this from being aimed
+ * at a root itself, at a nested reference file inside a skill, or at anything
+ * under a plugin package — those roots are not in the list to begin with.
+ * @param path - candidate SKILL.md path.
+ * @param roots - roots a deletion may target.
+ * @returns the absolute entry to remove.
+ * @throws {Error} `skill-not-found` when the path is not a skill entry sitting directly under an allowed root.
+ */
+export function deleteTargetOf(path, roots) {
+    const entry = basename(path) === 'SKILL.md' ? dirname(path) : path;
+    if (!roots.some(root => dirname(entry) === root))
+        throw new Error('skill-not-found');
+    return entry;
+}
 export class SkillMcpService extends Service {
     static inject = ['loader', 'tools'];
     officialSkillDirs;
@@ -229,8 +268,48 @@ export class SkillMcpService extends Service {
         for (const dir of this.officialSkillDirs) {
             skills.push(...await scanSkillRoot(dir, 'bundled', false, 'dsh-official'));
         }
+        skills.push(...await this.runtimeOnlySkills(skills));
         return skills;
     }
+    /**
+     * 补上「运行时注册」的 skill：`ctx.skills.register()` 注册的条目没有 SKILL.md，
+     * 磁盘扫描（本项目的主要取数方式）看不到它们——dsh-jubensha 的 DM 手册、office、
+     * genui 都属于这一类。用户因此报了「面板少了很多 skill」。
+     *
+     * skills 服务是**可选**的：web-app 宿主把它关掉（presets 拥有发现，没有全局层可列），
+     * 所以这里 feature-detect，拿不到就原样返回空，不改变既有行为。
+     * 这些条目没有可写的 SKILL.md，标成 `writable: false`——开关对它们没有意义。
+     */
+    async runtimeOnlySkills(diskBacked) {
+        const skills = this.ctx.get('skills');
+        if (skills === undefined)
+            return [];
+        let catalog;
+        try {
+            catalog = await skills.list();
+        }
+        catch {
+            // 目录服务不可用不该让整个面板失败——磁盘那部分仍然有价值。
+            return [];
+        }
+        const known = new Set(diskBacked.map(skill => skill.name));
+        const extra = [];
+        for (const entry of catalog) {
+            if (known.has(entry.name))
+                continue;
+            extra.push({
+                name: entry.name,
+                description: entry.description,
+                source: 'runtime',
+                provider: entry.provider,
+                modelInvocable: entry.invocation.modelInvocable,
+                userInvocable: entry.invocation.userInvocable,
+                writable: false,
+                path: '',
+            });
+        }
+        return extra;
+    }
     /** Flip one disk-backed skill's model invocation by rewriting its SKILL.md frontmatter. */
     async toggleSkill(path) {
         let text;
@@ -282,6 +361,41 @@ export class SkillMcpService extends Service {
         }
         return text;
     }
+    /**
+     * Delete one user-level or project-level skill.
+     *
+     * The entry is **moved**, not unlinked: a mistaken deletion lands in
+     * `<home>/.dsh/.skill-trash/` and stays recoverable, and the destination is
+     * returned so the surface can tell the user where it went. Plugin packages
+     * and the official bundled roots are not candidates — see
+     * {@link deletableRoots}.
+     * @param path - absolute SKILL.md path, as `listSkills` reported it.
+     * @param cwd - session workspace, when the caller has one.
+     * @returns the trash path the skill was moved to.
+     * @throws {Error} `skill-not-found` when the path is not deletable; `skill-delete-failed` when the move fails.
+     */
+    async deleteSkill(path, cwd) {
+        const entry = deleteTargetOf(path, deletableRoots(cwd));
+        const trashRoot = join(homedir(), '.dsh', '.skill-trash');
+        const trashPath = join(trashRoot, `${Date.now()}-${basename(entry)}`);
+        try {
+            await mkdir(trashRoot, { recursive: true });
+            try {
+                await rename(entry, trashPath);
+            }
+            catch (error) {
+                // Renaming across volumes fails with EXDEV; copy then remove instead.
+                if (error.code !== 'EXDEV')
+                    throw error;
+                await cp(entry, trashPath, { recursive: true });
+                await rm(entry, { recursive: true, force: true });
+            }
+        }
+        catch {
+            throw new Error('skill-delete-failed');
+        }
+        return { trashPath };
+    }
     /** Every `mcp-client` loader entry as a server card. */
     async listMcpServers() {
         const servers = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@max-null/dsh-skill-mcp-center",
-  "version": "0.5.4",
+  "version": "0.6.1",
   "description": "Skill & MCP management center for DeepSeek Harness — manage skills and MCP servers in Settings, live MCP status in the sidebar",
   "license": "MIT",
   "publishConfig": {

package/release-notes.md

@@ -1,5 +1,29 @@
 # Release Notes — @max-null/dsh-skill-mcp-center
 
+## 0.6.0 (2026-10-06)
+
+### 新增
+
+- **删除用户级 / 项目级技能**。设置页与侧栏的技能行都多了一个「删除」按钮，只出现在
+  `writable` 的技能上 —— 也就是 `~/.dsh/skills`、`~/.agents/skills`，以及当前工作区的
+  `<cwd>/.agents/skills` 与 `<cwd>/.dsh/skills`。插件技能与 DSH 官方内置技能（`plugin:` /
+  `bundled` / `dsh-official`）保持只读，不出现该按钮。
+
+  点删除先弹确认，写明技能名与完整路径；确认后该技能从磁盘移除 —— 目录形态
+  （`<name>/SKILL.md`）删整个目录，平铺形态（`<name>.md`）删那个文件。
+
+  **不直接销毁**：条目被移到 `~/.dsh/.skill-trash/`，成功提示里给出具体位置，误删可手动
+  移回去。
+
+### 兼容性
+
+- 新增一个 RPC 端点 `deleteSkill`（`{ path, cwd? }`）；现有端点与请求信封不变。
+- 删除面**刻意窄于**查看面：`readSkill` 接受插件与内置根，删除只接受用户级与项目级根，
+  并且要求目标**正好是某个允许根的直接子项** —— 根自身、技能内部的嵌套文件、名字相近的
+  兄弟目录一律拒绝（`skill-not-found`）。
+- 新增 10 条测试：7 条覆盖删除目标的解析与拒绝面，3 条做真实文件操作（整目录 / 平铺 /
+  拒绝后文件原样不动）。
+
 ## 0.5.4 (2026-10-04)
 
 ### 修复