@morehao/dsh-skills-console 0.3.7 → 0.4.0

package/lib/core/visibility.js

@@ -0,0 +1,145 @@
+import path from 'node:path';
+import { scanSkillRoot } from './roots.js';
+
+/**
+ * 可见性判定：**扫描根里有什么 + 本地策略隐藏了哪一份**，而不是「链在不在」。
+ *
+ * 合并规则（与宿主 registry 对齐，见设计 §4.5）：
+ * 1. 同一个根内同名：取一个（本插件不做同根多候选）；
+ * 2. 跨根同名：rank 最小者胜（100 > 200 > 300 > 400 > 500 > 600 的优先级）；
+ * 3. winner 是 canonical 且被本地策略停用 → 对模型不可见；
+ * 4. winner 自己写着 `disable-model-invocation: true`（旧版遗留停用桩 / 别人写的同名
+ *    停用技能）→ 也不可见，避免把「假技能」当成真身；
+ * 5. 宿主 `snapshot()` 里的 bundled/插件技能作为 rank 600 的额外候选，
+ *    任何本地根的同名技能都盖过它。
+ */
+
+function samePath(left, right) {
+  if (!left || !right) return false;
+  return path.resolve(left) === path.resolve(right);
+}
+
+function isPolicyHidden(entry, policyHiddenPaths) {
+  for (const hidden of policyHiddenPaths) {
+    if (samePath(hidden, entry.path)) return true;
+  }
+  return false;
+}
+
+/**
+ * @param {object} options
+ * @param {Array}  options.roots              `roots.listRoots()` 的结果
+ * @param {Array}  options.hostSkills         `ctx.skills.snapshot()` 的技能
+ * @param {Set}    options.policyHiddenPaths  `enabled === false` 的 canonical 目录
+ * @returns {{byName: Map, roots: Array, complete: boolean, errors: Array}}
+ */
+export function resolveVisibility({ roots = [], hostSkills = [], policyHiddenPaths = new Set() }) {
+  const byName = new Map();
+  const errors = [];
+
+  const rootStats = roots.map((root) => {
+    const stat = { source: root.source, rank: root.rank, path: root.path, label: root.label, exists: root.exists, count: 0 };
+    if (!root.exists) return stat;
+    const scanned = scanSkillRoot(root.path, (error) => {
+      errors.push({ source: root.source, path: root.path, error: error.message || String(error) });
+    });
+    const { entries, ignored = [] } = scanned;
+    stat.count = entries.length;
+    if (ignored.length > 0) stat.ignored = ignored;
+    for (const entry of entries) {
+      const policyHidden = isPolicyHidden(entry, policyHiddenPaths);
+      const foreignHidden = entry.modelInvocable === false;
+      const candidate = {
+        source: root.source,
+        rank: root.rank,
+        path: entry.path,
+        dirName: entry.dirName || null,
+        kind: entry.kind,
+        hasSkillFile: entry.hasSkillFile,
+        linked: Boolean(entry.linked),
+        // `shadowed` 保留旧名字给 UI/诊断用：它现在表示「这一份对模型不可见」。
+        shadowed: policyHidden || foreignHidden,
+        policyHidden,
+        foreignHidden,
+        host: false,
+      };
+      push(byName, entry.name, candidate);
+    }
+    return stat;
+  });
+
+  for (const skill of hostSkills) {
+    if (!skill || typeof skill.name !== 'string' || !skill.name) continue;
+    push(byName, skill.name, {
+      source: 'bundled',
+      rank: 600,
+      path: skill.path || null,
+      kind: 'dir',
+      hasSkillFile: true,
+      linked: false,
+      shadowed: false,
+      policyHidden: false,
+      foreignHidden: false,
+      host: true,
+      provider: skill.provider || null,
+      hostSource: skill.source || null,
+    });
+  }
+
+  const resolved = new Map();
+  for (const [name, candidates] of byName) {
+    candidates.sort((left, right) => left.rank - right.rank);
+    const winner = candidates[0];
+    // 每个根里的状态，供 UI 解释「为什么看不见」
+    const sources = {};
+    for (const candidate of candidates) {
+      const state = candidate.shadowed ? 'shadowed' : 'present';
+      if (!sources[candidate.source] || state === 'shadowed') sources[candidate.source] = state;
+    }
+    // 同名但目录名不同 = 有一份「伪装成同名技能」的副本（如 `x.bak-2026…/`），
+    // 宿主按 frontmatter name 去重，所以它们真的会互相遮盖。这条必须让 UI 说出来。
+    const nameConflict = candidates.some(
+      (item) => item.dirName && winner.dirName && item.dirName !== winner.dirName,
+    );
+    resolved.set(name, {
+      name,
+      visible: !winner.shadowed,
+      shadowed: winner.shadowed,
+      policyHidden: Boolean(winner.policyHidden),
+      foreignHidden: Boolean(winner.foreignHidden),
+      hiddenBy: winner.shadowed
+        ? [{ kind: winner.policyHidden ? 'policy' : 'foreign', path: winner.path }]
+        : [],
+      winnerSource: winner.source,
+      winnerPath: winner.path,
+      winnerDirName: winner.dirName || null,
+      path: winner.path,
+      kind: winner.kind,
+      hasSkillFile: winner.hasSkillFile,
+      hostOnly: winner.host,
+      nameConflict,
+      // 同名多份里被盖住的那几份，UI 要能列出「它们没生效」
+      shadowedBy: nameConflict
+        ? candidates
+            .filter((item) => item !== winner)
+            .map((item) => ({
+              source: item.source,
+              rank: item.rank,
+              path: item.path,
+              dirName: item.dirName || null,
+              shadowed: item.shadowed,
+            }))
+        : [],
+      sources,
+      candidates,
+    });
+  }
+
+  return { byName: resolved, roots: rootStats, complete: errors.length === 0, errors };
+}
+
+function push(map, name, candidate) {
+  const list = map.get(name);
+  if (list) list.push(candidate);
+  else map.set(name, [candidate]);
+}

package/lib/index.js

@@ -2,6 +2,7 @@ import { createInstaller } from './core/installer.js';
 import { createLogger } from './core/log.js';
 import { createPaths } from './core/paths.js';
 import { createRegistry } from './core/agents.js';
+import { createPolicyProvider, installPolicyProviders } from './core/policy.js';
 import { createService } from './core/service.js';
 import { StateStore } from './core/state.js';
 import { createRoutes, ROUTE_PREFIX } from './routes.js';
@@ -24,6 +25,20 @@ export function apply(ctx, config = {}) {
   const registry = createRegistry({ paths, getState: () => store.state });
   const installer = createInstaller({ paths, env, logger });
 
+  /**
+   * 本地策略 provider：只报告 `enabled === false` 的 canonical 技能，注册到**每个 live
+   * agent 自己的 scope**（agent scope 是 preset scope 的子层，层序比 rank 更近）。
+   * 必须在 service 之前建好：setMode 写完后要通过闭包调 `invalidate()`。
+   */
+  const policyProvider = createPolicyProvider({ paths, getState: () => store.state, logger });
+  const policies = installPolicyProviders(ctx, { provider: policyProvider, logger });
+
+  /**
+   * 宿主的技能快照。**注意**：不传 `scope`，只能看到 global 层的 provider —— 文件系统
+   * provider 挂在 agent preset 的 scope 层，所以这里拿到的多半只有 bundled/插件技能。
+   * 可见性以 `roots.js` 的本地扫描为准，这个快照只作 rank 600 的垫底候选。
+   * 等宿主提供可用的 scope 入口，再考虑把可见性整体委托给它（见 README「边界（明确不做）」）。
+   */
   const visibleProvider = async (cwd) => {
     const skills = ctx.get('skills');
     if (!skills) return { skills: [], complete: false };
@@ -69,9 +84,21 @@ export function apply(ctx, config = {}) {
     env,
     visibleProvider,
     workspacesProvider,
+    invalidatePolicies: () => policies.invalidate(),
+    policyStatus: () => policies.status(),
   });
 
+  // 迁移必须尽早跑：GUI 一打开就该是「停用 = 真不可见」，而不是等用户点到某一行才发现。
+  // 失败只记日志：插件仍要能加载（读路径降级、写路径返回带原因的 409）。
+  try {
+    const migrated = service.ensureMigrated();
+    if (migrated?.migrated) logger('plugin.migrate', { report: migrated.report });
+  } catch (error) {
+    logger('plugin.migrate.failed', { message: error?.message, code: error?.code });
+  }
+
   const handler = createRoutes({ service, logger });
   ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: ROUTE_PREFIX, handler }), 'dsh-skills-console:routes');
+  ctx.effect(() => () => policies.dispose(), 'dsh-skills-console:policy');
   logger('plugin.apply', { stateDir: paths.stateDir, canonical: paths.canonical, readOnly: store.readOnly });
 }

package/lib/routes.js

@@ -60,6 +60,8 @@ function matchRoute(method, pathname) {
   if (segments.length === 1 && segments[0] === 'state' && method === 'GET') return { name: 'state' };
   if (segments.length === 1 && segments[0] === 'agents' && method === 'GET') return { name: 'agents' };
   if (segments.length === 1 && segments[0] === 'settings' && method === 'POST') return { name: 'settings' };
+  // `/links` 是 v1 名字，留一份 minor 的别名；新代码只认 `/exports`
+  if (segments.length === 1 && segments[0] === 'exports' && method === 'POST') return { name: 'exports' };
   if (segments.length === 1 && segments[0] === 'links' && method === 'POST') return { name: 'links' };
   if (segments.length === 1 && segments[0] === 'install' && method === 'POST') return { name: 'install' };
   if (segments.length === 1 && segments[0] === 'probe' && method === 'POST') return { name: 'probe' };
@@ -138,7 +140,8 @@ export function createRoutes({ service, logger }) {
         return;
       }
       if (error instanceof ServiceError) {
-        sendJson(res, 400, { ok: false, code: error.code, message: error.message, detail: error.detail ?? null });
+        // 默认 400；policy-unavailable / shadow-locked 等能力或状态冲突带 409。
+        sendJson(res, error.status || 400, { ok: false, code: error.code, message: error.message, detail: error.detail ?? null });
         return;
       }
       logger('route.error', { message: error?.message, stack: String(error?.stack || '').slice(0, 800) });
@@ -157,8 +160,10 @@ async function dispatch(route, { body, query, service }) {
       return { ok: true, all: service.registry.all(), detected: service.registry.detected() };
     case 'settings':
       return service.setSettings(body);
+    case 'exports':
+      return service.setExports(body);
     case 'links':
-      return service.setLinks(body);
+      return service.setExports(body);
     case 'install':
       return service.install(body);
     case 'probe':
@@ -172,7 +177,12 @@ async function dispatch(route, { body, query, service }) {
     case 'skill.adopt':
       return service.adopt({ name: route.params.name });
     case 'skill.mode':
-      return service.setMode({ name: route.params.name, mode: body.mode });
+      return service.setMode({
+        name: route.params.name,
+        mode: body.mode,
+        scope: body.scope,
+        projectRoot: body.projectRoot,
+      });
     case 'skill.remove':
       return service.remove({ name: route.params.name });
     case 'subscriptions.add':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-skills-console",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "description": "统一管理本地技能的安装、更新、删除与接入，让同一份技能在多个 Agent 间复用。A skill manager for DeepSeek Harness: install, update, remove, link and toggle agent skills.",
   "license": "MIT",
   "author": "morehao <morehao@qq.com>",
@@ -52,7 +52,8 @@
     "build:client": "node scripts/build-client.mjs",
     "dev:client": "node scripts/build-client.mjs --watch",
     "check:client": "node scripts/build-client.mjs --check",
-    "check": "node scripts/check-syntax.mjs && node scripts/build-client.mjs --check && node scripts/check-naming.mjs && node scripts/check-pack.mjs && node scripts/smoke-release-notes.mjs",
+    "check:cycles": "node scripts/check-cycles.mjs",
+    "check": "node scripts/check-syntax.mjs && node scripts/check-cycles.mjs && node scripts/build-client.mjs --check && node scripts/check-naming.mjs && node scripts/check-pack.mjs && node scripts/smoke-release-notes.mjs",
     "check:syntax": "node scripts/check-syntax.mjs",
     "check:naming": "node scripts/check-naming.mjs",
     "check:pack": "node scripts/check-pack.mjs",