@michengai/dsh-skills-manager 0.1.8 → 0.1.9

package/lib/client.js

@@ -9,9 +9,9 @@ window.__ModuleLoader__.load({
     var pickDirectory = null;
     var MUTATION_HEADERS = { "content-type": "application/json", "x-dsh-skills-manager": "1" };
 
-    // 词典命名空间：注册进 DSH locale 服务，渲染机制按该命名空间把 t 注入组件 props。
+    // 词典命名空间必须与 settings.section 的 locale 一致，宿主据此注入 t。
     var NS = "skills-manager";
-    // 双语词典：zh 与现有硬编码文案逐字一致，保证中文用户无感知；en 为通顺英文。
+    // 宿主支持运行时切换语言，所有用户可见文案必须同时维护 zh/en。
     var DICT = {
       zh: {
         "title": "技能",
@@ -71,7 +71,6 @@ window.__ModuleLoader__.load({
         "confirm.overwrite.desc": "将覆盖现有插件：{names}",
         "confirm.delete.title": "删除插件？",
         "confirm.delete.desc": "“{name}”将从 DSH 技能目录中永久删除，无法恢复。",
-        // Step 2 业务错误码：zh 值保持与 core 原有中文文案逐字一致（{action} 由 action.* 映射后替换）。
         "error.root.readonly": "公共 Agent 技能目录不允许{action}",
         "error.skill.notFound": "技能不存在: {name}",
         "error.skill.noFrontmatter": "技能缺少完整 frontmatter，无法{action}: {name}",
@@ -90,6 +89,7 @@ window.__ModuleLoader__.load({
         "error.proto.unknownAction": "未知操作",
         "error.proto.bodyTooLarge": "请求体过大",
         "error.proto.invalidJson": "请求体不是合法 JSON",
+        "error.proto.nonJson": "服务端返回非 JSON 响应（HTTP {status}）",
         "action.enable": "启用",
         "action.disable": "停用",
         "action.delete": "删除",
@@ -172,6 +172,7 @@ window.__ModuleLoader__.load({
         "error.proto.unknownAction": "Unknown action",
         "error.proto.bodyTooLarge": "Request body too large",
         "error.proto.invalidJson": "Invalid JSON request body",
+        "error.proto.nonJson": "Server returned a non-JSON response (HTTP {status})",
         "action.enable": "enable",
         "action.disable": "disable",
         "action.delete": "deleting",
@@ -197,36 +198,40 @@ window.__ModuleLoader__.load({
 `;
 
     function callApi(path, options) {
-      return fetch("/api/dsh-skills-manager" + path, options).then(function (response) {
-        return response.json().then(function (payload) {
-          if (!payload.ok) {
-            var error = new Error(payload.error || ("HTTP " + response.status));
-            // 透传业务错误码与失败明细，供 translateError 按词典翻译。
-            if (payload.code) error.code = payload.code;
-            if (payload.params) error.params = payload.params;
-            if (payload.failed) error.failed = payload.failed;
-            throw error;
-          }
-          return payload.data;
-        });
+      return fetch("/api/dsh-skills-manager" + path, options).then(parseApiResponse);
+    }
+
+    function parseApiResponse(response) {
+      return response.json().catch(function () {
+        var error = new Error("HTTP " + response.status + " returned a non-JSON response");
+        error.code = "error.proto.nonJson";
+        error.params = { status: response.status };
+        throw error;
+      }).then(function (payload) {
+        if (!payload.ok) {
+          var error = new Error(payload.error || ("HTTP " + response.status));
+          if (payload.code) error.code = payload.code;
+          if (payload.params) error.params = payload.params;
+          if (payload.failed) error.failed = payload.failed;
+          throw error;
+        }
+        return payload.data;
       });
     }
 
-    // 翻译业务错误：payload.code 存在则查词典（params 替换占位符），词典 miss 回退原文。
-    // 兼容 { code, params, error }、Error 对象、纯字符串三种形态。
     function translateError(t, payload) {
+      // 调用方会传入 API payload、Error 和纯字符串，统一在此处兼容可避免漏翻译。
       if (payload && typeof payload === "object") {
         var code = payload.code;
         if (typeof code === "string" && code !== "") {
           var params = payload.params || {};
-          // {action} 占位符按当前语言映射（enable/disable/delete → 启用/停用/删除）。
+          // error.* 使用动作键，而动作名称必须随当前语言切换。
           if (params.action !== undefined) {
             var actionKey = "action." + params.action;
             var actionText = t(actionKey);
             if (actionText !== undefined && actionText !== actionKey) params = Object.assign({}, params, { action: actionText });
           }
           var translated = t(code, params);
-          // locale miss 时 t 返回 key 本身（或 undefined/null），此时回退原文。
           if (typeof translated === "string" && translated !== code) return translated;
         }
         if (payload.error !== undefined) return translateError(t, payload.error);
@@ -241,6 +246,25 @@ window.__ModuleLoader__.load({
       return typeof value === "string" && value !== key ? value : fallback;
     }
 
+    function isSkillEnabled(skill) {
+      return skill.invocationPolicyValid && skill.modelInvocable && skill.userInvocable;
+    }
+
+    function modalFocusable(modal) {
+      return Array.prototype.slice.call(modal.querySelectorAll("button:not(:disabled), [href], input:not([type=hidden]):not(:disabled), select:not(:disabled), textarea:not(:disabled), [tabindex]:not([tabindex=\"-1\"])"));
+    }
+
+    function trapModalFocus(modal, event) {
+      if (event.key !== "Tab") return;
+      var focusable = modalFocusable(modal);
+      if (focusable.length === 0) return;
+      var active = document.activeElement;
+      if (!modal.contains(active) || (event.shiftKey ? active === focusable[0] : active === focusable[focusable.length - 1])) {
+        event.preventDefault();
+        (event.shiftKey ? focusable[focusable.length - 1] : focusable[0]).focus();
+      }
+    }
+
     // 渲染机制按 register 的 locale 字段把命名空间绑定的 t 注入组件 props。
     function SkillManagerSection(props) {
       var t = props.t;
@@ -266,6 +290,7 @@ window.__ModuleLoader__.load({
       var confirmDelete = deleteState[0];
       var setConfirmDelete = deleteState[1];
       var inputRef = react.useRef(null);
+      var modalRef = react.useRef(null);
 
       function refresh() {
         setSnapshot({ loading: true, error: null, data: snapshot.data });
@@ -293,6 +318,16 @@ window.__ModuleLoader__.load({
         return function () { window.removeEventListener("keydown", closeTopModal, true); };
       }, [uploadOpen, confirmImport, confirmDelete]);
 
+      react.useEffect(function () {
+        var modal = modalRef.current;
+        if (!modal) return undefined;
+        var focusable = modalFocusable(modal);
+        (focusable[0] || modal).focus();
+        function trapFocus(event) { trapModalFocus(modal, event); }
+        modal.addEventListener("keydown", trapFocus);
+        return function () { modal.removeEventListener("keydown", trapFocus); };
+      }, [uploadOpen, confirmImport, confirmDelete]);
+
       function action(path, body) {
         if (busy) return;
         setBusy(path);
@@ -375,9 +410,9 @@ window.__ModuleLoader__.load({
       }
 
       function skillRow(skill, root) {
-        var enabled = skill.modelInvocable && skill.userInvocable;
-        var policyValid = skill.invocationPolicyValid !== false;
-        var actionEnabled = policyValid && enabled;
+        var policyValid = skill.invocationPolicyValid;
+        var enabled = isSkillEnabled(skill);
+        var actionEnabled = enabled;
         return h("div", { key: skill.name, className: "dssm-row" },
           h("div", { className: "dssm-row-main" },
             h("div", { className: "dssm-row-id" },
@@ -394,7 +429,7 @@ window.__ModuleLoader__.load({
       if (snapshot.data) {
         var roots = snapshot.data.roots || [];
         var skills = roots.reduce(function (all, root) { return all.concat(root.skills || []); }, []);
-        var enabled = skills.filter(function (skill) { return skill.modelInvocable; }).length;
+        var enabled = skills.filter(isSkillEnabled).length;
         nodes.push(h("div", { key: "toolbar", className: "dssm-toolbar" },
           h("div", null, h("h2", { className: "dssm-title" }, t("title")), h("p", { className: "dssm-desc" }, t("desc"))),
           h("div", { className: "dssm-actions" },
@@ -438,7 +473,7 @@ window.__ModuleLoader__.load({
         nodes.push(h("div", { key: "import-result", className: isImportError || failedItems.length ? "dssm-error" : "dssm-note", role: "status" }, resultText));
       }
       if (uploadOpen) {
-        nodes.push(h("div", { key: "upload", className: "dssm-mask" }, h("div", { className: "dssm-modal", role: "dialog", "aria-modal": "true", "aria-labelledby": "dssm-upload-title" },
+        nodes.push(h("div", { key: "upload", className: "dssm-mask" }, h("div", { ref: modalRef, tabIndex: -1, className: "dssm-modal", role: "dialog", "aria-modal": "true", "aria-labelledby": "dssm-upload-title" },
           h("div", { className: "dssm-modal-head" }, h("h3", { id: "dssm-upload-title", className: "dssm-modal-title" }, t("upload.title")), h("button", { className: "dssm-icon-btn", "aria-label": t("upload.close"), onClick: function () { setUploadOpen(false); } }, "×")),
           h("input", { ref: inputRef, className: "dssm-hidden-input", type: "file", accept: ".md", onChange: function (event) { selectFile(event.target.files && event.target.files[0]); event.target.value = ""; } }),
           h("div", { className: "dssm-dropzone", tabIndex: 0, onClick: openNativePicker, onKeyDown: function (event) { if (event.key === "Enter" || event.key === " ") { event.preventDefault(); openNativePicker(); } }, onDragOver: function (event) { event.preventDefault(); }, onDrop: function (event) { event.preventDefault(); selectFile(event.dataTransfer.files && event.dataTransfer.files[0]); } }, h("span", { className: "dssm-dropzone-title" }, t("upload.drop.title")), h("span", { className: "dssm-dropzone-copy" }, t("upload.drop.copy"))),
@@ -448,10 +483,10 @@ window.__ModuleLoader__.load({
           h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: openNativePicker }, t("btn.file.pick")), pickDirectory ? h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: selectDirectory }, t("btn.dir.pick")) : null, h("button", { className: "dssm-btn", disabled: !selected || !!busy, onClick: installSelected }, busy === "import" || busy === "import-check" ? t("btn.uploading") : t("btn.upload.dsh"))))));
       }
       if (confirmImport) {
-        nodes.push(h("div", { key: "import-confirm", className: "dssm-mask" }, h("div", { className: "dssm-modal", role: "dialog", "aria-modal": "true" }, h("div", { className: "dssm-modal-head" }, h("h3", { className: "dssm-modal-title" }, t("confirm.overwrite.title"))), h("p", { className: "dssm-desc" }, t("confirm.overwrite.desc", { names: confirmImport.conflicts.map(function (item) { return item.name; }).join(t("sep.names")) })), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", onClick: function () { setConfirmImport(null); } }, t("btn.cancel")), h("button", { className: "dssm-btn", disabled: !!busy, onClick: function () { executeImport(confirmImport.source, "overwrite"); } }, t("btn.overwrite.upload"))))));
+        nodes.push(h("div", { key: "import-confirm", className: "dssm-mask" }, h("div", { ref: modalRef, tabIndex: -1, className: "dssm-modal", role: "dialog", "aria-modal": "true", "aria-labelledby": "dssm-import-title" }, h("div", { className: "dssm-modal-head" }, h("h3", { id: "dssm-import-title", className: "dssm-modal-title" }, t("confirm.overwrite.title"))), h("p", { className: "dssm-desc" }, t("confirm.overwrite.desc", { names: confirmImport.conflicts.map(function (item) { return item.name; }).join(t("sep.names")) })), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", onClick: function () { setConfirmImport(null); } }, t("btn.cancel")), h("button", { className: "dssm-btn", disabled: !!busy, onClick: function () { executeImport(confirmImport.source, "overwrite"); } }, t("btn.overwrite.upload"))))));
       }
       if (confirmDelete) {
-        nodes.push(h("div", { key: "delete-confirm", className: "dssm-mask" }, h("div", { className: "dssm-modal", role: "dialog", "aria-modal": "true" }, h("div", { className: "dssm-modal-head" }, h("h3", { className: "dssm-modal-title" }, t("confirm.delete.title"))), h("p", { className: "dssm-desc" }, t("confirm.delete.desc", { name: confirmDelete.name })), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: function () { setConfirmDelete(null); } }, t("btn.cancel")), h("button", { className: "dssm-btn dssm-btn-danger", disabled: !!busy, onClick: function () { setConfirmDelete(null); action("/delete", { name: confirmDelete.name }); } }, t("btn.delete.confirm"))))));
+        nodes.push(h("div", { key: "delete-confirm", className: "dssm-mask" }, h("div", { ref: modalRef, tabIndex: -1, className: "dssm-modal", role: "dialog", "aria-modal": "true", "aria-labelledby": "dssm-delete-title" }, h("div", { className: "dssm-modal-head" }, h("h3", { id: "dssm-delete-title", className: "dssm-modal-title" }, t("confirm.delete.title"))), h("p", { className: "dssm-desc" }, t("confirm.delete.desc", { name: confirmDelete.name })), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", disabled: !!busy, onClick: function () { setConfirmDelete(null); } }, t("btn.cancel")), h("button", { className: "dssm-btn dssm-btn-danger", disabled: !!busy, onClick: function () { setConfirmDelete(null); action("/delete", { name: confirmDelete.name }); } }, t("btn.delete.confirm"))))));
       }
       return h("section", { className: "dssm-section" }, nodes);
     }
@@ -470,6 +505,9 @@ window.__ModuleLoader__.load({
     // 导出词典与翻译函数供零依赖对齐测试读取（宿主只消费 apply/inject，不影响运行时）。
     module.exports.DICT = DICT;
     module.exports.translateError = translateError;
+    module.exports.isSkillEnabled = isSkillEnabled;
+    module.exports.parseApiResponse = parseApiResponse;
+    module.exports.trapModalFocus = trapModalFocus;
     return module.exports;
   }
 });

package/lib/core.js

@@ -84,13 +84,17 @@ function pathsOverlap(a, b) {
 }
 
 /** 名称只允许一个普通路径段；不把既有技能名称限制为 kebab-case。 */
-function entryPath(root, name) {
-  if (typeof name !== "string" || name === "" || name === "." || name === ".." || /[\\/\0]/.test(name) || /[. ]$/.test(name) || WINDOWS_DEVICE_NAME_RE.test(name) || basename(name) !== name) return null;
+export function entryPath(root, name) {
+  if (typeof name !== "string" || name === "" || name === "." || name === ".." || /[\\/:*?"<>|\0]/.test(name) || /[. ]$/.test(name) || WINDOWS_DEVICE_NAME_RE.test(name) || basename(name) !== name) return null;
   const rootPath = resolve(root);
   const path = resolve(rootPath, name);
   return isSameOrDescendant(rootPath, path) && rootPath !== path ? path : null;
 }
 
+function isDshRoot(root) {
+  return typeof root === "string" && resolve(root) === resolve(dshRootPath());
+}
+
 // ── 命名规整 ────────────────────────────────────────────────────────────────
 
 /** 尽量把任意名称规整为 kebab-case；无法生成合法名称时返回空串。 */
@@ -259,13 +263,13 @@ export async function scanEntries(root) {
   const entries = [];
   for (const it of items) {
     try {
-      if (it.isDirectory()) {
+      if (it.isDirectory() && entryPath(root, it.name) !== null) {
         const docPath = join(root, it.name, "SKILL.md");
         const st = await fs.stat(docPath);
         if (!st.isFile()) continue;
         const doc = parseSkillDoc(await fs.readFile(docPath, "utf8"));
         entries.push(entryOf(it.name, "bundle", docPath, doc));
-      } else if (it.isFile() && it.name.toLowerCase().endsWith(".md") && it.name.toLowerCase() !== "skill.md") {
+      } else if (it.isFile() && it.name.toLowerCase().endsWith(".md") && it.name.toLowerCase() !== "skill.md" && entryPath(root, it.name.slice(0, -3)) !== null) {
         const docPath = join(root, it.name);
         const doc = parseSkillDoc(await fs.readFile(docPath, "utf8"));
         entries.push(entryOf(it.name.slice(0, -3), "flat", docPath, doc));
@@ -282,7 +286,7 @@ export async function scanEntries(root) {
 
 /** enabled=true 恢复模型与 / 手动调用；false 同时停用两种调用入口。 */
 export async function setSkillEnabled(root, name, enabled) {
-  if (root !== dshRootPath()) return readonlyError("toggle");
+  if (!isDshRoot(root)) return readonlyError("toggle");
   const resolved = await resolveEntry(root, name);
   if (resolved === null) return { ok: false, error: `技能不存在: ${name}`, code: "error.skill.notFound", params: { name } };
   const source = await fs.readFile(resolved.docPath, "utf8");
@@ -294,11 +298,19 @@ export async function setSkillEnabled(root, name, enabled) {
 
 /** 删除 DSH 根目录中的单个技能。调用方必须先向用户确认。 */
 export async function deleteSkill(root, name, log) {
-  if (root !== dshRootPath()) return readonlyError("delete");
+  if (!isDshRoot(root)) return readonlyError("delete");
   const resolved = await resolveEntry(root, name);
   if (resolved === null) return { ok: false, error: `技能不存在: ${name}`, code: "error.skill.notFound", params: { name } };
-  await fs.rm(resolved.entryPath, { recursive: resolved.kind === "bundle", force: true });
-  if (log) log("delete", `删除 ${resolved.entryPath}`);
+  const bundlePath = entryPath(root, name);
+  const alternatePath = resolved.kind === "bundle" ? resolve(root, `${name}.md`) : bundlePath;
+  const alternateDocPath = resolved.kind === "bundle" ? alternatePath : join(alternatePath, "SKILL.md");
+  const targets = [{ path: resolved.entryPath, recursive: resolved.kind === "bundle" }];
+  try {
+    const st = await fs.stat(alternateDocPath);
+    if (st.isFile()) targets.push({ path: alternatePath, recursive: resolved.kind !== "bundle" });
+  } catch {}
+  for (const target of targets) await fs.rm(target.path, { recursive: target.recursive, force: true });
+  if (log) log("delete", `删除 ${targets.map((target) => target.path).join("、")}`);
   return { name };
 }
 
@@ -385,6 +397,7 @@ async function copyToTemporary(source, target, isDir) {
     await assertNoSymbolicLinks(source);
     if (isDir) await fs.cp(source, temp, { recursive: true, dereference: false });
     else await fs.copyFile(source, temp);
+    await assertNoSymbolicLinks(temp);
     return temp;
   } catch (error) {
     await fs.rm(temp, { recursive: true, force: true }).catch(() => undefined);
@@ -405,7 +418,20 @@ async function replaceWithCopy(source, dest, isDir, existing = []) {
     await fs.rename(stage, dest);
   } catch (error) {
     await fs.rm(stage, { recursive: true, force: true }).catch(() => undefined);
-    for (const item of backups.reverse()) await fs.rename(item.backup, item.path).catch(() => undefined);
+    const rollbackFailures = [];
+    for (const item of backups.reverse()) {
+      try {
+        await fs.rename(item.backup, item.path);
+      } catch (rollbackError) {
+        rollbackFailures.push(`${item.backup}（${String(rollbackError && rollbackError.message ? rollbackError.message : rollbackError)}）`);
+      }
+    }
+    if (rollbackFailures.length) {
+      const restoreError = new Error(`${String(error && error.message ? error.message : error)}；覆盖导入回滚失败，备份保留在: ${rollbackFailures.join("、")}`);
+      if (error && error.code) restoreError.code = error.code;
+      if (error && error.params) restoreError.params = error.params;
+      throw restoreError;
+    }
     throw error;
   }
   const warnings = [];
@@ -453,7 +479,7 @@ export async function importSkill(source, log, options = {}) {
 
   const nameCount = new Map();
   for (const candidate of candidates) {
-    if (candidate.kebab && KEBAB_RE.test(candidate.kebab)) nameCount.set(candidate.kebab, (nameCount.get(candidate.kebab) || 0) + 1);
+    if (candidate.kebab && KEBAB_RE.test(candidate.kebab) && entryPath(targetRoot, candidate.kebab) !== null) nameCount.set(candidate.kebab, (nameCount.get(candidate.kebab) || 0) + 1);
   }
 
   function failureResult() {
@@ -470,7 +496,7 @@ export async function importSkill(source, log, options = {}) {
   }
 
   for (const c of candidates) {
-    if (!c.kebab || !KEBAB_RE.test(c.kebab)) {
+    if (!c.kebab || !KEBAB_RE.test(c.kebab) || entryPath(targetRoot, c.kebab) === null) {
       failed.push({ source: c.source, error: `无法生成合法 kebab-case 名称（原始名: ${c.rawName || basename(c.source)}）`, code: "error.import.invalidName", params: { name: c.rawName || basename(c.source) } });
       continue;
     }
@@ -494,6 +520,8 @@ export async function importSkill(source, log, options = {}) {
     pending.push({ name: c.kebab, source: c.source, isDir: c.isDir, dest });
   }
 
+  if (pending.length === 0 && conflicts.length === 0) return failureResult();
+
   if (dryRun) {
     if (failed.length && pending.length === 0 && conflicts.length === 0) return failureResult();
     return { kind: analysis.kind, pending, conflicts, failed };

package/lib/index.js

@@ -74,6 +74,8 @@ function readBody(req, limit = 1 << 20) {
 
 /** 自定义请求头使跨站 fetch 必须预检；本地接口不提供 CORS 响应。 */
 function validateMutationRequest(req) {
+  const host = String(req.headers.host || "").toLowerCase();
+  if (!/^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(host)) return { statusCode: 403, code: "error.proto.forbidden", error: "forbidden host" };
   if (req.headers[CLIENT_MARKER_HEADER] !== "1") return { statusCode: 403, code: "error.proto.forbidden", error: "forbidden mutation request" };
   const contentType = String(req.headers["content-type"] || "").split(";", 1)[0].trim().toLowerCase();
   if (contentType !== "application/json") return { statusCode: 415, code: "error.proto.contentType", error: "content-type must be application/json" };
@@ -90,8 +92,8 @@ function json(res, code, payload) {
 }
 
 /** 成功统一包成 { ok: true, data }；核心返回 { ok:false, error } 时透传为 400。 */
-function run(res, p, afterSuccess) {
-  p.then((r) => {
+function run(res, task, afterSuccess) {
+  return Promise.resolve().then(task).then((r) => {
     if (r && r.ok === false) json(res, 400, r);
     else {
       try {
@@ -103,7 +105,11 @@ function run(res, p, afterSuccess) {
     }
   }).catch((e) => {
     try {
-      json(res, 500, { ok: false, error: String(e && e.message ? e.message : e) });
+      json(res, Number.isInteger(e && e.statusCode) ? e.statusCode : 500, {
+        ok: false,
+        ...(e && e.code ? { code: e.code } : {}),
+        error: String(e && e.message ? e.message : e),
+      });
     } catch {
       /* response already closed */
     }
@@ -115,6 +121,12 @@ function apply(ctx) {
   const roots = userRoots();
   const rootByKey = Object.fromEntries(roots.map((r) => [r.key, r.path]));
   let invalidateSkills = () => {};
+  let mutationQueue = Promise.resolve();
+  const enqueueMutation = (task) => {
+    const queued = mutationQueue.then(task, task);
+    mutationQueue = queued.catch(() => undefined);
+    return queued;
+  };
   ctx.effect(() => ctx.skills.registerProvider((control) => {
     invalidateSkills = control.invalidate;
     return {
@@ -132,8 +144,7 @@ function apply(ctx) {
       const path = u.pathname.replace(/\/+$/, "");
       try {
         if (req.method === "GET" && path === "/api/dsh-skills-manager/state") {
-          run(res, state());
-          return;
+          return run(res, state);
         }
         if (req.method !== "POST") {
           json(res, 405, { ok: false, code: "error.proto.method", error: `method not allowed: ${req.method}` });
@@ -141,32 +152,27 @@ function apply(ctx) {
         }
         const requestError = validateMutationRequest(req);
         if (requestError) {
-          json(res, requestError.statusCode, { ok: false, error: requestError.error });
+          json(res, requestError.statusCode, { ok: false, code: requestError.code, error: requestError.error });
           return;
         }
         const body = await readBody(req);
-        switch (path) {
-          case "/api/dsh-skills-manager/enable": {
-            run(res, setSkillEnabled(rootByKey[String(body.root || "dsh")], String(body.name || ""), true), invalidateSkills);
-            return;
-          }
-          case "/api/dsh-skills-manager/disable": {
-            run(res, setSkillEnabled(rootByKey[String(body.root || "dsh")], String(body.name || ""), false), invalidateSkills);
-            return;
+        return enqueueMutation(() => {
+          switch (path) {
+            case "/api/dsh-skills-manager/enable":
+              return run(res, () => setSkillEnabled(rootByKey[String(body.root || "dsh")], String(body.name || ""), true), invalidateSkills);
+            case "/api/dsh-skills-manager/disable":
+              return run(res, () => setSkillEnabled(rootByKey[String(body.root || "dsh")], String(body.name || ""), false), invalidateSkills);
+            case "/api/dsh-skills-manager/delete":
+              return run(res, () => deleteSkill(rootByKey.dsh, String(body.name || ""), log), invalidateSkills);
+            case "/api/dsh-skills-manager/import":
+              return run(res, () => importSkill(String(body.source || ""), log, {
+                conflict: body.conflict === "overwrite" ? "overwrite" : "skip",
+                dryRun: body.dryRun === true,
+              }), body.dryRun === true ? undefined : invalidateSkills);
+            default:
+              json(res, 404, { ok: false, code: "error.proto.unknownAction", error: `unknown action: ${path}` });
           }
-          case "/api/dsh-skills-manager/delete": {
-            run(res, deleteSkill(rootByKey.dsh, String(body.name || ""), log), invalidateSkills);
-            return;
-          }
-          case "/api/dsh-skills-manager/import":
-            run(res, importSkill(String(body.source || ""), log, {
-              conflict: body.conflict === "overwrite" ? "overwrite" : "skip",
-              dryRun: body.dryRun === true,
-            }), body.dryRun === true ? undefined : invalidateSkills);
-            return;
-          default:
-            json(res, 404, { ok: false, code: "error.proto.unknownAction", error: `unknown action: ${path}` });
-        }
+        });
       } catch (e) {
         json(res, Number.isInteger(e && e.statusCode) ? e.statusCode : 500, {
           ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-skills-manager",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "NPM-installable DSH Web plugin for managing local skills and viewing shared Agent skills safely.",
   "license": "Apache-2.0",
   "repository": {