@weibaohui/experts-management 0.1.4 → 0.3.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@weibaohui/experts-management",
-  "version": "0.1.4",
-  "description": "dsh 插件 · 专家市场：管理 ntd 格式的专家与专家团队（plugin.json + Agent MD + 技能集），浏览/安装 50+ 内置专家市场；每个专家注册为「仅用户可调用」的技能，在对话输入框用 /expert-名称 即可以该专家的身份执行任务（宿主确定性注入角色定义与技能清单，不占用模型目录 token）。",
+  "version": "0.3.0",
+  "description": "dsh 插件 · 专家管理：管理 ntd 格式的专家与专家团队（plugin.json + Agent MD + 技能集），浏览/安装 50+ 内置专家市场；每个专家注册为「仅用户可调用」的技能，在对话输入框用 /expert-名称 即可以该专家的身份执行任务（宿主确定性注入角色定义与技能清单，不占用模型目录 token）。",
   "license": "MIT",
   "keywords": [
     "dsh",
@@ -44,6 +44,7 @@
     "node": ">=22.5"
   },
   "dependencies": {
+    "@weibaohui/dsh-plugin-kit": "^0.1.0",
     "yaml": "^2.9.0"
   },
   "devDependencies": {

package/src/index.js

@@ -5,8 +5,8 @@
  *
  * Manages ntd-format experts (WorkBuddy plugin.json + Agent MD + skills)
  * WITHOUT touching the ntd application's own directories:
- * - Market: ntd-resource's experts/ subtree via git sparse checkout into the
- *   plugin's own dir ($DSH_HOME/experts-management/market). Read-only shelf;
+ * - Builtin: ntd-resource's experts/ subtree via git sparse checkout into the
+ *   plugin's own dir ($DSH_HOME/experts-management/builtin). Read-only shelf;
  *   install copies into the user library.
  * - User library: $DSH_HOME/experts (writable, the only built-in source).
  *   Additional directories are opt-in via config.extraSources.
@@ -19,8 +19,9 @@
  */
 
 const { createReadStream } = require('node:fs')
-const { execFile } = require('node:child_process')
 const { randomUUID } = require('node:crypto')
+const { execFile } = require('node:child_process')
+const { createShareRunJob } = require('@weibaohui/dsh-plugin-kit')
 const fsP = require('node:fs/promises')
 const { basename, join, relative, resolve, sep } = require('node:path')
 const { homedir } = require('node:os')
@@ -46,9 +47,9 @@ function dshHome() {
   return process.env.DSH_HOME ? resolve(process.env.DSH_HOME) : join(homedir(), '.dsh')
 }
 
-const MARKET_SCAN_SKIP = new Set(['.git', 'node_modules'])
+const BUILTIN_SCAN_SKIP = new Set(['.git', 'node_modules'])
 const RANK_INSTALLED = 100
-const RANK_MARKET = 500
+const RANK_BUILTIN = 500
 const MAX_BODY_BYTES = 64 * 1024
 const DESCRIPTION_LIMIT = 140
 // 同款正则见 skill/skill/src/index.ts SKILL_NAME —— 不合规的候选会让 registry 抛错
@@ -226,7 +227,7 @@ async function scanExpertsRoot(root, sourceKey) {
   try { entries = await fsP.readdir(root, { withFileTypes: true }) } catch { return { experts, errors } }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue
-    if (MARKET_SCAN_SKIP.has(entry.name)) continue
+    if (BUILTIN_SCAN_SKIP.has(entry.name)) continue
     const dir = join(root, entry.name)
     try {
       experts.push(await readExpertDir(root, dir, sourceKey))
@@ -418,7 +419,7 @@ async function atomicWriteJs(file, content) {
   await fsP.rename(temp, file)
 }
 
-// ── Market git sync（与 skills-management 同款；稀疏检出 experts/ 子树）──
+// ── Builtin git sync（与 skills-management 同款管线；稀疏检出 experts/ 子树）──
 
 function gitExec(binary, args, cwd) {
   return new Promise((fulfil, reject) => {
@@ -481,7 +482,7 @@ async function gitSyncRepo(binary, url, branch, repoDir, token, sparsePaths) {
   return { isFirstClone: false, hasUpdates: before !== after, before, after }
 }
 
-const DEFAULT_MARKET_SYNC = {
+const DEFAULT_BUILTIN_SYNC = {
   url: 'https://gitcode.com/weibaohui/ntd-resource.git',
   branch: 'main',
   gitBinary: 'git',
@@ -489,11 +490,11 @@ const DEFAULT_MARKET_SYNC = {
   syncOnStartup: true,
 }
 // ntd-resource 同时携带 skills（~400MB），专家市场只稀疏检出 experts/ 子树
-const DEFAULT_MARKET_SPARSE_PATHS = ['experts']
+const DEFAULT_BUILTIN_SPARSE_PATHS = ['experts']
 
-const MARKET_SETTINGS_NS = 'experts-management-market'
+const BUILTIN_SETTINGS_NS = 'experts-management-builtin'
 
-function marketSettingsSchema() {
+function builtinSettingsSchema() {
   if (!Schema) return null
   return Schema.object({
     url: Schema.string(),
@@ -507,15 +508,51 @@ function marketSettingsSchema() {
 }
 
 function baseSettings(config) {
-  const cfg = (config.marketSync && typeof config.marketSync === 'object') ? config.marketSync : {}
-  const base = { ...DEFAULT_MARKET_SYNC }
+  const cfg = (config.builtinSync && typeof config.builtinSync === 'object') ? config.builtinSync : {}
+  const base = { ...DEFAULT_BUILTIN_SYNC }
   for (const key of ['url', 'branch', 'gitBinary', 'autoSync', 'syncOnStartup']) {
     if (cfg[key] !== undefined) base[key] = cfg[key]
   }
-  if (config.marketRepoDir !== undefined) base.repoDir = resolve(String(config.marketRepoDir))
+  if (config.builtinRepoDir !== undefined) base.repoDir = resolve(String(config.builtinRepoDir))
   return base
 }
 
+// ── 编辑端点（v0.3）：只写 dsh 用户库；内置只读 ─────────────────────────
+const EDIT_BODY_MAX_BYTES = 8 * 1024 * 1024
+
+/** 魔数嗅探图片类型；非白名单格式返回 null。 */
+function sniffImage(buf) {
+  if (!buf || buf.length < 12) return null
+  if (buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) return { ext: 'png', type: 'image/png' }
+  if (buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return { ext: 'jpg', type: 'image/jpeg' }
+  const head = buf.slice(0, 12)
+  if (head.toString('latin1').startsWith('GIF8')) return { ext: 'gif', type: 'image/gif' }
+  if (head.toString('latin1').startsWith('RIFF') && head.toString('latin1').slice(8) === 'WEBP') return { ext: 'webp', type: 'image/webp' }
+  return null
+}
+
+const readRawBody = (req, cap) => new Promise((fulfil, reject) => {
+  let size = 0
+  const chunks = []
+  req.on('data', (chunk) => {
+    size += chunk.length
+    if (size > cap) { reject(new Error(`image exceeds ${cap} bytes`)); if (typeof req.destroy === 'function') req.destroy(); return }
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
+  })
+  req.on('end', () => fulfil(Buffer.concat(chunks)))
+  req.on('error', reject)
+})
+
+/** 编辑端点公共前置：只解析 dsh 用户库副本（内置只读）；名字围栏。 */
+async function locateEditable(locateExpert, name) {
+  if (typeof name !== 'string' || name === '') throw new Error('body must provide name')
+  const { expert } = await locateExpert(name, 'dsh')
+  if (!isSafeExpertName(expert.name)) throw new Error(`invalid expert name: ${expert.name}`)
+  return expert
+}
+
+const MD_MAX_CHARS = 512 * 1024
+
 // ── Module export ────────────────────────────────────────────────────────
 
 module.exports = {
@@ -561,43 +598,59 @@ module.exports = {
     // git 市场检出（稀疏 experts/ 子树）也是一路来源：root 运行期可变，按调用时解析
     const allSourceRows = () => [
       ...sourceRows,
-      { key: 'market', label: '专家市场', root: join(marketRootDir(), 'experts'), readOnly: true },
+      { key: 'builtin', label: '内置', root: join(builtinRootDir(), 'experts'), readOnly: true },
     ]
 
     // ── Market sync state / settings（skills-management 同款管线）────────
-    const marketRootDir = () => {
-      const eff = marketSettings()
+    const builtinRootDir = () => {
+      const eff = builtinSettings()
       return resolve(typeof eff.repoDir === 'string' && eff.repoDir !== '' ? eff.repoDir
-        : config.marketRepoDir !== undefined ? resolve(String(config.marketRepoDir))
-        : join(dshHome(), 'experts-management', 'market'))
+        : config.builtinRepoDir !== undefined ? resolve(String(config.builtinRepoDir))
+        : join(dshHome(), 'experts-management', 'builtin'))
     }
-    const marketSparsePaths = () => config.marketSparsePaths === null
+    const builtinSparsePaths = () => config.builtinSparsePaths === null
       ? undefined
-      : (Array.isArray(config.marketSparsePaths) && config.marketSparsePaths.length > 0 ? config.marketSparsePaths.map(String) : DEFAULT_MARKET_SPARSE_PATHS)
-
-    const marketStateFile = join(dshHome(), 'experts-management', 'market-sync.json')
-    let marketState = { lastSyncAt: undefined, lastResult: undefined }
+      : (Array.isArray(config.builtinSparsePaths) && config.builtinSparsePaths.length > 0 ? config.builtinSparsePaths.map(String) : DEFAULT_BUILTIN_SPARSE_PATHS)
+
+        // v0.1 → v0.2 落盘迁移：market 命名 → builtin（检出目录 + 同步状态文件）
+    const migrateV1Layout = async () => {
+      const base = join(dshHome(), 'experts-management')
+      for (const [oldName, newName] of [['market', 'builtin'], ['market-sync.json', 'builtin-sync.json']]) {
+        const from = join(base, oldName)
+        const to = join(base, newName)
+        try {
+          await fsP.access(from)
+          try { await fsP.access(to); continue } catch {}
+          await fsP.rename(from, to)
+          ctx.logger.info && ctx.logger.info(`experts-management: migrated ${oldName} → ${newName}`)
+        } catch { /* 旧布局不存在：跳过 */ }
+      }
+    }
+    const builtinStateFile = join(dshHome(), 'experts-management', 'builtin-sync.json')
+    let builtinState = { lastSyncAt: undefined, lastResult: undefined }
     let settingsScope = null
     const settingsOverrides = {}  // fallback sheet when the settings service is absent
-    const marketStateLoaded = fsP.readFile(marketStateFile, 'utf8')
-      .then(raw => {
-        const parsed = JSON.parse(raw)
-        marketState = { lastSyncAt: parsed.lastSyncAt, lastResult: parsed.lastResult }
+    const builtinStateLoaded = migrateV1Layout()
+      .then(() => fsP.readFile(builtinStateFile, 'utf8'))
+      .then((raw) => {
+        let parsed
+        try { parsed = JSON.parse(raw) } catch { parsed = null }
+        if (parsed) builtinState = { lastSyncAt: parsed.lastSyncAt, lastResult: parsed.lastResult }
       })
       .catch(() => {})
     if (Schema && ctx.settings && typeof ctx.settings.register === 'function') {
       try {
-        settingsScope = ctx.settings.register(MARKET_SETTINGS_NS, marketSettingsSchema(), { base: baseSettings(config) })
+        settingsScope = ctx.settings.register(BUILTIN_SETTINGS_NS, builtinSettingsSchema(), { base: baseSettings(config) })
       } catch (e) { ctx.logger.warn(`experts-management: settings register: ${e && e.message}`) }
     }
-    const saveMarketState = async () => {
+    const saveBuiltinState = async () => {
       try {
-        await fsP.mkdir(join(marketStateFile, '..'), { recursive: true })
-        await atomicWriteJs(marketStateFile, JSON.stringify(marketState, null, 2))
-        await fsP.chmod(marketStateFile, 0o600)
+        await fsP.mkdir(join(builtinStateFile, '..'), { recursive: true })
+        await atomicWriteJs(builtinStateFile, JSON.stringify(builtinState, null, 2))
+        await fsP.chmod(builtinStateFile, 0o600)
       } catch {}
     }
-    const marketSettings = () => {
+    const builtinSettings = () => {
       if (settingsScope && typeof settingsScope.get === 'function') {
         const v = settingsScope.get()
         if (v && typeof v === 'object') return { ...baseSettings(config), ...v }
@@ -605,55 +658,55 @@ module.exports = {
       return { ...baseSettings(config), ...settingsOverrides }
     }
 
-    let marketSyncRun = null
-    const runMarketSync = async () => {
-      if (marketSyncRun !== null) return marketSyncRun
-      marketSyncRun = (async () => {
-        await marketStateLoaded
-        const eff = marketSettings()
+    let builtinSyncRun = null
+    const runBuiltinSync = async () => {
+      if (builtinSyncRun !== null) return builtinSyncRun
+      builtinSyncRun = (async () => {
+        await builtinStateLoaded
+        const eff = builtinSettings()
         const ok = await gitAvailable(eff.gitBinary)
         if (!ok) throw new Error('git is not available on PATH')
         const started = Date.now()
-        const repoDir = marketRootDir()
-        const result = await gitSyncRepo(eff.gitBinary, eff.url, eff.branch, repoDir, eff.token, marketSparsePaths())
-        marketState.lastSyncAt = new Date().toISOString()
-        marketState.lastResult = { ...result, at: marketState.lastSyncAt, durationMs: Date.now() - started }
-        await saveMarketState()
+        const repoDir = builtinRootDir()
+        const result = await gitSyncRepo(eff.gitBinary, eff.url, eff.branch, repoDir, eff.token, builtinSparsePaths())
+        builtinState.lastSyncAt = new Date().toISOString()
+        builtinState.lastResult = { ...result, at: builtinState.lastSyncAt, durationMs: Date.now() - started }
+        await saveBuiltinState()
         invalidate()
-        return { ...marketState.lastResult, url: eff.url, branch: eff.branch, dir: repoDir }
-      })().finally(() => { marketSyncRun = null })
-      return marketSyncRun
+        return { ...builtinState.lastResult, url: eff.url, branch: eff.branch, dir: repoDir }
+      })().finally(() => { builtinSyncRun = null })
+      return builtinSyncRun
     }
 
     // Startup + periodic auto-sync (fire-and-forget; failures only warn)
     ctx.effect(() => {
-      const eff = marketSettings()
+      const eff = builtinSettings()
       if (eff.syncOnStartup) {
-        marketStateLoaded.then(() => runMarketSync()).catch(e => ctx.logger.warn(`experts-management: startup market sync: ${e && e.message}`))
+        builtinStateLoaded.then(() => runBuiltinSync()).catch(e => ctx.logger.warn(`experts-management: startup builtin sync: ${e && e.message}`))
       }
       const timer = setInterval(() => {
-        const eff2 = marketSettings()
+        const eff2 = builtinSettings()
         if (!eff2.autoSync) return
-        const last = marketState.lastSyncAt ? Date.parse(marketState.lastSyncAt) : 0
+        const last = builtinState.lastSyncAt ? Date.parse(builtinState.lastSyncAt) : 0
         if (Date.now() - last > 24 * 3600 * 1000) {
-          runMarketSync().catch(e => ctx.logger.warn(`experts-management: auto market sync: ${e && e.message}`))
+          runBuiltinSync().catch(e => ctx.logger.warn(`experts-management: auto builtin sync: ${e && e.message}`))
         }
       }, 6 * 3600 * 1000)
       if (typeof timer.unref === 'function') timer.unref()
       return () => clearInterval(timer)
-    }, 'experts-management: market auto-sync')
+    }, 'experts-management: builtin auto-sync')
 
     // ── Discovery ────────────────────────────────────────────────────────
     async function discoverAll() {
-      const installed = [], market = []
+      const mine = [], builtin = []
       const errors = []
       for (const row of allSourceRows()) {
         const { experts, errors: errs } = await scanExpertsRoot(row.root, row.key)
         errors.push(...errs)
-        if (row.key === 'dsh') installed.push(...experts)
-        else market.push(...experts)
+        if (row.key === 'dsh') mine.push(...experts)
+        else builtin.push(...experts)
       }
-      return { installed, market, errors }
+      return { mine, builtin, errors }
     }
 
     async function locateExpert(name, sourceKey) {
@@ -681,7 +734,7 @@ module.exports = {
       return {
         name: providerName,
         async list() {
-          const { installed, market } = await discoverAll()
+          const { mine, builtin } = await discoverAll()
           const candidates = []
           const seen = new Set()
           // 专家一律 modelInvocable:false：不进模型目录（零 token 污染），
@@ -713,11 +766,11 @@ module.exports = {
               metadata: { expertType: e.expertType, profession: e.professionZh ?? e.professionEn, version: e.version },
             })
           }
-          for (const e of installed) push(e, 'user-installed', RANK_INSTALLED)
-          const installedNames = new Set(installed.map((e) => e.name))
-          for (const e of market) {
-            if (installedNames.has(e.name)) continue // 用户库覆盖市场同名专家
-            push(e, 'market', RANK_MARKET)
+          for (const e of mine) push(e, 'user-installed', RANK_INSTALLED)
+          const mineNames = new Set(mine.map((e) => e.name))
+          for (const e of builtin) {
+            if (mineNames.has(e.name)) continue // 用户库覆盖内置同名专家
+            push(e, 'builtin', RANK_BUILTIN)
           }
           return candidates
         },
@@ -758,6 +811,14 @@ module.exports = {
     })
 
     // ── HTTP API ─────────────────────────────────────────────────────────
+    // 分享执行：进程内 agents 服务（web app 自身）可用则流式，否则 headless spawn
+    const shareRunJobs = new Map()
+    let shareServices = null
+    try {
+      if (ctx.inject && typeof ctx.inject === 'function') {
+        ctx.inject(['agents', 'agentDefaultModel', 'sessions'], (svcs) => { shareServices = svcs })
+      }
+    } catch {}
     ctx.effect(() => ctx.webServer.register({
       kind: 'prefix',
       path: '/experts-management/api',
@@ -767,10 +828,10 @@ module.exports = {
           const apiPath = url.pathname.replace(/\/+$/, '')
           const query = url.searchParams
 
-          // GET /experts-management/api → { sources, installed, market }
+          // GET /experts-management/api → { sources, mine, builtin }
           if (req.method === 'GET' && apiPath === '/experts-management/api') {
-            const { installed, market, errors } = await discoverAll()
-            const installedNames = new Set(installed.map((e) => e.name))
+            const { mine, builtin, errors } = await discoverAll()
+            const mineNames = new Set(mine.map((e) => e.name))
             const summarize = (e) => ({
               name: e.name,
               displayName: e.displayNameZh ?? e.displayNameEn ?? e.name,
@@ -780,13 +841,13 @@ module.exports = {
               tags: e.tags.filter((t) => t.zh || t.en).map((t) => t.zh || t.en),
               hasAvatar: e.avatar !== undefined,
               source: e.source,
-              installed: installedNames.has(e.name),
+              installed: mineNames.has(e.name),
               mtime: e.mtime,
             })
             sendJson(res, 200, {
               sources: allSourceRows().map((row) => ({ key: row.key, label: row.label, dir: displayPath(row.root), readOnly: row.readOnly })),
-              installed: installed.map(summarize),
-              market: market.map(summarize),
+              mine: mine.map(summarize),
+              builtin: builtin.map(summarize),
               errors,
             })
             return
@@ -797,9 +858,11 @@ module.exports = {
             const name = query.get('name') || ''
             const { expert, row } = await locateExpert(name, query.get('source') || undefined)
             const { fileCount, totalSize } = await countFilesAndSize(expert.dir)
+            const rawPluginText = await fsP.readFile(expert.pluginJsonPath, 'utf8')
             sendJson(res, 200, {
               ...expert,
-              plugin: parsePluginJson(await fsP.readFile(expert.pluginJsonPath, 'utf8')),
+              plugin: parsePluginJson(rawPluginText),
+              pluginJson: JSON.parse(rawPluginText),
               leadAgentFile: resolveLeadAgentFile(expert)?.name,
               dir: displayPath(expert.dir),
               sourceLabel: row.label,
@@ -854,7 +917,12 @@ module.exports = {
           if (req.method === 'POST' && apiPath.endsWith('/experts-management/api/install')) {
             const body = await readJsonBody(req)
             if (typeof body.name !== 'string' || body.name === '') { sendJson(res, 400, { error: 'body must provide name' }); return }
-            const { expert } = await locateExpert(body.name, typeof body.from === 'string' && body.from !== '' && body.from !== 'market' ? body.from : undefined)
+            // from 兼容 client 的 source 字段；'auto'/缺省一律钉死为 builtin——
+            // 若解析到 dsh 源，overwrite 会先 rm 自己再空拷（v0.2.0 数据丢失事故），此路彻底封死
+            const from = typeof body.from === 'string' && body.from !== '' ? body.from
+              : typeof body.source === 'string' && body.source !== '' ? body.source : 'builtin'
+            if (from === 'dsh') throw new Error('cannot install from the dsh library (it is the install destination)')
+            const { expert } = await locateExpert(body.name, from)
             if (!isSafeExpertName(expert.name)) throw new Error(`invalid expert name: ${expert.name}`)
             const target = join(installedDir, expert.name)
             if (body.overwrite !== true) {
@@ -883,11 +951,185 @@ module.exports = {
             return
           }
 
-          // GET /experts-management/api/market/status
-          if (req.method === 'GET' && apiPath.endsWith('/experts-management/api/market/status')) {
-            await marketStateLoaded
-            const eff = marketSettings()
-            const repoDir = marketRootDir()
+          // ── 编辑端点（v0.3）：仅 dsh 用户库可编辑，内置只读 ──
+
+          // PUT /experts-management/api/agent-md {name, agent?, content} — 角色定义全文
+          if (req.method === 'PUT' && apiPath.endsWith('/experts-management/api/agent-md')) {
+            const body = await readJsonBody(req)
+            const expert = await locateEditable(locateExpert, body.name)
+            if (typeof body.content !== 'string' || body.content.trim() === '') throw new Error('content must be a non-empty string')
+            if (body.content.length > MD_MAX_CHARS) throw new Error(`content exceeds ${MD_MAX_CHARS} chars`)
+            const normRel = (p0) => String(p0 || '').replace(/^\.\//, '')
+            const agentFile = body.agent !== undefined && body.agent !== ''
+              ? expert.agentFiles.find((a) => a.name === body.agent || normRel(a.relPath) === normRel(body.agent) || basename(a.mdPath) === body.agent)
+              : resolveLeadAgentFile(expert)
+            if (agentFile === undefined) throw new Error(`agent not found in expert '${expert.name}'`)
+            const full = resolveWithin(expert.dir, agentFile.relPath)
+            if (full === undefined || resolve(full) !== resolve(agentFile.mdPath)) throw new Error('agent file path escaped the expert dir')
+            await atomicWriteJs(full, body.content)
+            invalidate()
+            sendJson(res, 200, { ok: true, agent: agentFile.name })
+            return
+          }
+
+          // PUT /experts-management/api/metadata {name, metadata} — plugin.json 展示字段（读-改-写保留未知键）
+          if (req.method === 'PUT' && apiPath.endsWith('/experts-management/api/metadata')) {
+            const body = await readJsonBody(req)
+            const meta = body.metadata
+            if (meta === null || typeof meta !== 'object' || Array.isArray(meta)) throw new Error('metadata must be an object')
+            const expert = await locateEditable(locateExpert, body.name)
+            const pluginJson = JSON.parse(await fsP.readFile(expert.pluginJsonPath, 'utf8'))
+            const normLocalized = (v) => ({ zh: typeof v.zh === 'string' ? v.zh : '', en: typeof v.en === 'string' ? v.en : '' })
+            for (const key of ['displayName', 'profession', 'displayDescription', 'defaultInitPrompt']) {
+              if (meta[key] === undefined) continue
+              const v = meta[key]
+              if (v === null || typeof v !== 'object' || Array.isArray(v)) throw new Error(`${key} must be an object`)
+              for (const lang of ['zh', 'en']) {
+                if (v[lang] !== undefined && (typeof v[lang] !== 'string' || v[lang].length > 2000)) throw new Error(`${key}.${lang} must be a string (≤2000 chars)`)
+              }
+              pluginJson[key] = normLocalized(v)
+            }
+            const listOfLocalized = (v, label) => {
+              if (!Array.isArray(v) || v.length > 20) throw new Error(`${label} must be an array (≤20)`)
+              return v.map((item) => {
+                if (item === null || typeof item !== 'object' || Array.isArray(item)) throw new Error(`${label} items must be objects`)
+                return { zh: typeof item.zh === 'string' ? item.zh.slice(0, 2000) : '', en: typeof item.en === 'string' ? item.en.slice(0, 2000) : '' }
+              }).filter((item) => item.zh !== '' || item.en !== '')
+            }
+            if (meta.tags !== undefined) pluginJson.tags = listOfLocalized(meta.tags, 'tags')
+            if (meta.quickPrompts !== undefined) pluginJson.quickPrompts = listOfLocalized(meta.quickPrompts, 'quickPrompts')
+            await atomicWriteJs(expert.pluginJsonPath, JSON.stringify(pluginJson, null, 2))
+            invalidate()
+            sendJson(res, 200, { ok: true, plugin: pluginJson })
+            return
+          }
+
+          // PUT /experts-management/api/expert-skills {name, attach?, detach?} — 技能副本同步
+          if (req.method === 'PUT' && apiPath.endsWith('/experts-management/api/expert-skills')) {
+            const body = await readJsonBody(req)
+            const attach = Array.isArray(body.attach) ? body.attach.map(String) : []
+            const detach = Array.isArray(body.detach) ? body.detach.map(String) : []
+            if (attach.length === 0 && detach.length === 0) throw new Error('attach and detach must not both be empty')
+            const kebab = (n) => /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(n)
+            for (const n of [...attach, ...detach]) {
+              if (!kebab(n)) throw new Error(`invalid skill name: ${n}`)
+            }
+            const expert = await locateEditable(locateExpert, body.name)
+            const pluginJson = JSON.parse(await fsP.readFile(expert.pluginJsonPath, 'utf8'))
+            // detach 先验后删（任一未附 → 整体拒绝，避免半套变更）
+            const detachDirs = []
+            for (const n of detach) {
+              const dir = resolveWithin(expert.dir, `./skills/${n}`)
+              if (dir === undefined) throw new Error(`skill '${n}' is not attached to expert '${expert.name}'`)
+              const st = await fsP.stat(dir).catch(() => undefined)
+              if (st === undefined || !st.isDirectory()) throw new Error(`skill '${n}' is not attached to expert '${expert.name}'`)
+              detachDirs.push({ n, dir })
+            }
+            // attach 全部先在用户技能库解析源目录（任一缺失整体拒绝）
+            const libRoot = join(dshHome(), 'skills')
+            const attachDirs = []
+            for (const n of attach) {
+              const from = join(libRoot, n)
+              const st = await fsP.stat(join(from, 'SKILL.md')).catch(() => undefined)
+              if (st === undefined || !st.isFile()) throw new Error(`skill '${n}' not found in the user skill library (${libRoot})`)
+              attachDirs.push({ n, from })
+            }
+            for (const d of detachDirs) await fsP.rm(d.dir, { recursive: true, force: true })
+            for (const a of attachDirs) {
+              const target = join(expert.dir, 'skills', a.n)
+              await fsP.rm(target, { recursive: true, force: true }) // 同名覆盖 = 技能库更新同步进专家
+              await copyDir(a.from, target)
+            }
+            // plugin.json.skills = 声明同步：原序保留存活项 + 追加新 attach（以 skills/ 目录实况为准）
+            const skillRoot = join(expert.dir, 'skills')
+            const present = new Set()
+            try {
+              for (const ent of await fsP.readdir(skillRoot, { withFileTypes: true })) if (ent.isDirectory()) present.add(ent.name)
+            } catch { /* 无 skills 目录 */ }
+            const oldNames = (Array.isArray(pluginJson.skills) ? pluginJson.skills : []).map((r) => String(r).replace(/^\.\/skills\//, '').replace(/^\.\//, ''))
+            const finalNames = []
+            for (const n of [...oldNames, ...attach]) {
+              if (present.has(n) && !finalNames.includes(n)) finalNames.push(n)
+            }
+            pluginJson.skills = finalNames.map((n) => `./skills/${n}`)
+            await atomicWriteJs(expert.pluginJsonPath, JSON.stringify(pluginJson, null, 2))
+            invalidate()
+            sendJson(res, 200, { ok: true, skills: pluginJson.skills })
+            return
+          }
+
+          // POST /experts-management/api/avatar?name= — 原始图片体（魔数嗅探）
+          if (req.method === 'POST' && apiPath.endsWith('/experts-management/api/avatar')) {
+            const expert = await locateEditable(locateExpert, query.get('name') || '')
+            const imgBody = await readRawBody(req, EDIT_BODY_MAX_BYTES)
+            const img = sniffImage(imgBody)
+            if (img === null) throw new Error('unsupported image (png/jpg/gif/webp only)')
+            const rel = `avatars/expert.${img.ext}`
+            await atomicWriteJs(join(expert.dir, rel), imgBody)
+            const pluginJson = JSON.parse(await fsP.readFile(expert.pluginJsonPath, 'utf8'))
+            pluginJson.avatar = rel
+            await atomicWriteJs(expert.pluginJsonPath, JSON.stringify(pluginJson, null, 2))
+            invalidate()
+            sendJson(res, 200, { ok: true, avatar: rel })
+            return
+          }
+
+          // GET /experts-management/api/available-skills — 技能关联选择器数据源：
+          // 用户技能库（~/.dsh/skills）目录直读。刻意不走 skills 注册表——那会把
+          // 市场货架库存（5900+ 条）漏进来；也不附 bundled/项目级技能。
+          if (req.method === 'GET' && apiPath.endsWith('/experts-management/api/available-skills')) {
+            const libRoot = join(dshHome(), 'skills')
+            const list = []
+            let libEntries = []
+            try { libEntries = await fsP.readdir(libRoot, { withFileTypes: true }) } catch { /* 无技能库 */ }
+            for (const ent of libEntries) {
+              if (!ent.isDirectory() || !isSafeExpertName(ent.name)) continue
+              let content
+              try { content = await fsP.readFile(join(libRoot, ent.name, 'SKILL.md'), 'utf8') } catch { continue }
+              const parsed = parseSkillMd(content)
+              const description = String(parsed.descriptionZh ?? parsed.descriptionEn ?? parsed.description ?? '').slice(0, 200)
+              list.push({ name: ent.name, description })
+            }
+            list.sort((a, b) => a.name.localeCompare(b.name))
+            sendJson(res, 200, { skills: list })
+            return
+          }
+
+          // GET /experts-management/api/share/status — 分享弹窗数据（settings 真实路径）
+          if (req.method === 'GET' && apiPath.endsWith('/experts-management/api/share/status')) {
+            sendJson(res, 200, { settingsFile: join(dshHome(), 'settings.yaml') })
+            return
+          }
+
+          // POST /experts-management/api/share/run {prompt, dir} → 真实 agent 会话执行
+          if (req.method === 'POST' && apiPath.endsWith('/experts-management/api/share/run')) {
+            const body = await readJsonBody(req)
+            if (typeof body.prompt !== 'string' || body.prompt.trim() === '') { sendJson(res, 400, { error: 'body must provide prompt' }); return }
+            if (typeof body.dir !== 'string' || body.dir === '') { sendJson(res, 400, { error: 'body must provide dir' }); return }
+            // 支持 ~ 前缀（client 传的是 displayPath 折叠过的路径）
+            const dir = resolve(String(body.dir).startsWith('~') ? join(homedir(), String(body.dir).slice(2)) : body.dir)
+            const stat = await fsP.stat(dir).catch(() => undefined)
+            if (stat === undefined || !stat.isDirectory()) { sendJson(res, 400, { error: `dir not found: ${displayPath(dir)}` }); return }
+            const binary = process.env.EXPERTS_DSH_BIN || 'dsh'
+            const job = createShareRunJob({ binary, prompt: body.prompt, dir, jobs: shareRunJobs, logger: ctx.logger, services: shareServices })
+            sendJson(res, 202, { jobId: job.id, status: job.status })
+            return
+          }
+
+          // GET /experts-management/api/share/run?id= → 任务状态/输出
+          if (req.method === 'GET' && apiPath.endsWith('/experts-management/api/share/run')) {
+            const id = query.get('id') || ''
+            const job = shareRunJobs.get(id)
+            if (job === undefined) { sendJson(res, 404, { error: 'job not found' }); return }
+            sendJson(res, 200, { ...job, output: job.output.slice(-32 * 1024) })
+            return
+          }
+
+          // GET /experts-management/api/builtin/status
+          if (req.method === 'GET' && apiPath.endsWith('/experts-management/api/builtin/status')) {
+            await builtinStateLoaded
+            const eff = builtinSettings()
+            const repoDir = builtinRootDir()
             const repoExists = await fsP.access(join(repoDir, '.git')).then(() => true).catch(() => false)
             const ok = await gitAvailable(eff.gitBinary)
             const [localCommit, remoteCommit] = repoExists && ok
@@ -898,28 +1140,28 @@ module.exports = {
               gitAvailable: ok, repoExists,
               localCommit, remoteCommit,
               needsUpdate: localCommit !== undefined && remoteCommit !== undefined ? localCommit !== remoteCommit : undefined,
-              lastSyncAt: marketState.lastSyncAt, lastResult: marketState.lastResult,
+              lastSyncAt: builtinState.lastSyncAt, lastResult: builtinState.lastResult,
               autoSync: eff.autoSync, syncOnStartup: eff.syncOnStartup,
               hasToken: typeof eff.token === 'string' && eff.token !== '',
-              syncing: marketSyncRun !== null,
-              sparsePaths: marketSparsePaths() ?? null,
+              syncing: builtinSyncRun !== null,
+              sparsePaths: builtinSparsePaths() ?? null,
             })
             return
           }
 
-          // POST /experts-management/api/market/sync
-          if (req.method === 'POST' && apiPath.endsWith('/experts-management/api/market/sync')) {
+          // POST /experts-management/api/builtin/sync
+          if (req.method === 'POST' && apiPath.endsWith('/experts-management/api/builtin/sync')) {
             try {
-              const result = await runMarketSync()
+              const result = await runBuiltinSync()
               sendJson(res, 200, result)
             } catch (e) { sendJson(res, 400, { error: String(e && e.message || e) }) }
             return
           }
 
-          // PUT /experts-management/api/market/settings {url?, branch?, repoDir?, token?, autoSync?, syncOnStartup?}
-          if (req.method === 'PUT' && apiPath.endsWith('/experts-management/api/market/settings')) {
+          // PUT /experts-management/api/builtin/settings {url?, branch?, repoDir?, token?, autoSync?, syncOnStartup?}
+          if (req.method === 'PUT' && apiPath.endsWith('/experts-management/api/builtin/settings')) {
             const body = await readJsonBody(req)
-            await marketStateLoaded
+            await builtinStateLoaded
             const patch = {}
             for (const key of ['url', 'branch', 'gitBinary']) {
               if (typeof body[key] === 'string' && body[key] !== '') patch[key] = body[key]
@@ -935,7 +1177,7 @@ module.exports = {
             } else {
               Object.assign(settingsOverrides, patch)
             }
-            const eff = marketSettings()
+            const eff = builtinSettings()
             const { token, ...safe } = eff  // token 只写不回读
             sendJson(res, 200, { settings: safe, hasToken: typeof token === 'string' && token !== '' })
             return