@xxxyz/dsh-mcp-manager 2.0.4 → 2.0.6

package/README.md

@@ -2,11 +2,11 @@
 
 <!-- Hero -->
 <div align="center">
-  <b style="font-size: 1.15em;">Manage every MCP server in DeepSeek Harness from one settings page — install, configure, monitor.</b><br /><br />
-  <code>server list</code> <code>add / edit / delete</code> <code>enable / disable</code> <code>restart</code> <code>tool-count health</code> <code>JSON export / import</code><br />
-  <code>4 model tools</code> <code>HTTP API</code> <code>npx / npm / dsh plugin / scripts</code><br /><br />
-  <b>Settings → MCP 管理</b> manages <code>@deepseek-ai/dsh-mcp-client</code> rows in your project-level and
-  global <code>cordis.patch.yml</code> — no hand-editing, every change applies live via HMR, survives restarts and upgrades.
+  <b style="font-size: 1.15em;">DeepSeek Harness 的 MCP 服务管理器：装没装、连没连、一页管完。</b><br /><br />
+  <code>服务器列表</code> <code>新增 / 编辑 / 删除</code> <code>启用 / 停用</code> <code>重启</code> <code>工具数健康</code> <code>JSON 导出 / 导入</code><br />
+  <code>4 个模型工具</code> <code>HTTP API</code> <code>npx / npm / dsh plugin / 脚本</code><br /><br />
+  <b>设置 → MCP 管理</b> 管理项目级与全局 <code>cordis.patch.yml</code> 中的 <code>@deepseek-ai/dsh-mcp-client</code> 行——<br />
+  无需再手改配置文件，所有修改即改即生效（HMR 热应用），重启、升级后依然存在。
 </div>
 
 <div align="center">
@@ -19,12 +19,12 @@
 </div>
 
 <div align="center">
-  🌏 <a href="./README.md"><b>English</b></a> · <a href="./README.zh-CN.md">中文</a>
+  🌏 <a href="./README.md"><b>中文</b></a> · <a href="./README_EN.md">English</a>
 </div>
 
 <br />
 
-<p align="center"><img src="show.png" alt="dsh-mcp-manager Settings → MCP 管理" /></p>
+<p align="center"><img src="show.png" alt="dsh-mcp-manager 设置 → MCP 管理 页面图例" /></p>
 
 ## ✨ 功能一览
 

package/README_EN.md

@@ -0,0 +1,193 @@
+# dsh-mcp-manager
+
+<!-- Hero -->
+<div align="center">
+  <b style="font-size: 1.15em;">Manage every MCP server in DeepSeek Harness from one settings page — install, configure, monitor.</b><br /><br />
+  <code>server list</code> <code>add / edit / delete</code> <code>enable / disable</code> <code>restart</code> <code>tool-count health</code> <code>JSON export / import</code><br />
+  <code>4 model tools</code> <code>HTTP API</code> <code>npx / npm / dsh plugin / scripts</code><br /><br />
+  <b>Settings → MCP 管理</b> manages <code>@deepseek-ai/dsh-mcp-client</code> rows in your project-level and
+  global <code>cordis.patch.yml</code> — no hand-editing, every change applies live via HMR, survives restarts and upgrades.
+</div>
+
+<div align="center">
+
+[![npm version](https://img.shields.io/npm/v/@xxxyz/dsh-mcp-manager?logo=npm&color=cb3837)](https://www.npmjs.com/package/@xxxyz/dsh-mcp-manager)
+[![License](https://img.shields.io/github/license/xxxyz/DeepSeekHarness-MCP-Manager?color=blue)](LICENSE)
+[![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js)](package.json)
+[![GitHub](https://img.shields.io/badge/GitHub-xxxyz%2FDeepSeekHarness--MCP--Manager-181717?logo=github)](https://github.com/xxxyz/DeepSeekHarness-MCP-Manager)
+
+</div>
+
+<div align="center">
+  🌏 <a href="./README.md">中文</a> · <a href="./README_EN.md"><b>English</b></a>
+</div>
+
+<br />
+
+<p align="center"><img src="show.png" alt="dsh-mcp-manager Settings → MCP 管理 page" /></p>
+
+## ✨ Features
+
+- **📋 Server list** — every configured MCP server (`@deepseek-ai/dsh-mcp-client` instance): `serverName`, transport (`stdio` / `streamable-http`), URL / command, enabled state, live loader phase, registered tool count
+- **➕ Add / ➖ Delete** — form-based (env / headers / args supported) with format and duplicate-name validation; one-click delete
+- **🔌 Enable / Disable** — flip at any time, tools hot-connect / hot-disconnect
+- **🔄 Restart** — disable + re-enable, reconnect and re-sync tools automatically
+- **💾 Persistence** — written to the **project-level** (`profiles/<profile>/cordis.patch.yml`) or **global** (`~/.dsh/cordis.patch.yml`) patch file; survives restarts; the file path is shown at the bottom of the page
+- **🩺 Health check** — live tool counts and loader phase per server, problems visible at a glance
+- **📦 Backup / Restore** — JSON export / import; merges new entries, skips existing ones
+- **🤖 Model tools** — four `mcp_manager_*` tools registered on the host, so the model can query and manage MCP servers directly
+- **🌐 HTTP API** — `POST /dsh-mcp-manager/api` (JSON `{op, args}` → `{ok, ...}`) for the client and scripts
+- **📦 Cross-platform install** — one command on Windows / macOS / Linux (npx / npm / `dsh plugin` / scripts)
+
+## 🚀 Install
+
+**Prerequisite**: DSH installed and running (`dsh web` works), Node.js ≥ 18.
+
+### Method 1 · One-shot npx (recommended)
+
+```sh
+npx -y @xxxyz/dsh-mcp-manager
+```
+
+All flags pass through: `npx -y @xxxyz/dsh-mcp-manager --dsh-home /path/.dsh --profile web --repair --port 3080`.
+
+### Method 2 · Global npm install (for frequent use)
+
+```sh
+npm i -g @xxxyz/dsh-mcp-manager
+dsh-mcp-manager                  # install the plugin
+dsh-mcp-manager-uninstall        # uninstall the plugin
+npm i -g @xxxyz/dsh-mcp-manager@latest   # upgrade
+```
+
+### Method 3 · dsh command (bundle)
+
+```sh
+dsh plugin --profile web add @xxxyz/dsh-mcp-manager
+# or from GitHub (build artifacts are committed, no local build needed)
+dsh plugin --profile web add github:xxxyz/DeepSeekHarness-MCP-Manager
+```
+
+### Method 4 · No npm account: straight from GitHub
+
+```sh
+npx -y github:xxxyz/DeepSeekHarness-MCP-Manager
+```
+
+<details>
+<summary><b>Script install</b> (source checkout; idempotent)</summary>
+
+**Windows (PowerShell)**:
+
+```powershell
+.\dsh-mcp-manager\install.ps1                     # default: ~/.dsh, web profile
+.\dsh-mcp-manager\install.ps1 -DshHome D:\path\.dsh -Profile web
+```
+
+**macOS / Linux (bash)** (run `chmod +x dsh-mcp-manager/install.sh` if needed):
+
+```sh
+./dsh-mcp-manager/install.sh                      # default: ~/.dsh, web profile
+./dsh-mcp-manager/install.sh --dsh-home /path/.dsh --profile web
+```
+
+**Any platform (direct)**:
+
+```sh
+node dsh-mcp-manager/install.mjs [--dsh-home <path>] [--profile <name>] [--port <n>] [--repair] [--skip-patch]
+```
+
+The installer ① copies the package to `local-packages/` (source of record, untouched by DSH upgrades) ② copies it into `profiles/node_modules/` (a plain copy, not a symlink, so ESM resolves `@deepseek-ai/dsh-tools`) ③ appends the loader row (an `insert` block, idempotent).
+
+</details>
+
+After installing, **hard-refresh the browser** (Cmd/Ctrl+Shift+R) and open **Settings → MCP 管理**. If the page is missing, restart DSH once (the host half needs a first mount).
+
+<details>
+<summary><b>Uninstall</b></summary>
+
+```sh
+dsh-mcp-manager-uninstall                          # if installed via npm -g
+# or: .\uninstall.ps1 | ./uninstall.sh | node uninstall.mjs [--dsh-home <path>] [--profile <name>]
+```
+
+Then restart DSH. Uninstall removes the deployed copy, the `local-packages` source, and the loader row (the patch stays a valid array).
+
+</details>
+
+<details>
+<summary><b>After a DSH upgrade: --repair</b></summary>
+
+If a DSH upgrade (or a broken HMR state) leaves the settings page or the `mcp_manager_*` tools missing, run one repair command: redeploy → bump the loader row's `config.version` (forces an HMR re-apply) → poll the API until `{ok:true}` (default 30 s).
+
+```sh
+node dsh-mcp-manager/install.mjs --repair --port 3080
+# PowerShell: .\install.ps1 -Repair -Port 3080    bash: ./install.sh --repair --port 3080
+```
+
+If the API still does not answer, restart DSH once (the loader re-imports at boot).
+
+</details>
+
+<details>
+<summary><b>FAQ</b></summary>
+
+| Symptom | Cause & fix |
+|---|---|
+| No "MCP 管理" in Settings after install | Hard-refresh (Cmd/Ctrl+Shift+R); if still missing, restart DSH once. |
+| **Two MCP tabs / duplicated tools** | Double mount: both install.mjs and `dsh plugin add` were used. Remove one (run `dsh-mcp-manager-uninstall`, or delete the extra loader row / `dsh.profile.bundles` entry). |
+| Tools missing after a DSH upgrade | Run `--repair` (see above). |
+| `npx` / `npm view` reports 404 | Local mirror (npmmirror) sync lag: add `--registry=https://registry.npmjs.org` or wait a moment. |
+| Installer fails with `EPERM` | DSH is running and holds the files: quit DSH before installing. |
+| Config changes don't take effect | All changes apply via HMR within 1–2 s; the page auto-polls. |
+
+</details>
+
+## 📖 Usage
+
+Open **Settings → MCP 管理**:
+
+- **Add a server**: enter `serverName` (unique, 1–32 chars of `[A-Za-z0-9_-]`), the transport and its fields (`streamable-http` → URL / headers; `stdio` → command / args / env), and the level (project / global). The form validates format and duplicate names.
+- Each card shows live status, the connection target and the tool count; you can **enable / disable**, **restart**, **edit** and **delete**.
+- **Backup / Restore**: export the configuration as JSON with one click, or paste JSON to import (merges new entries, skips existing ones).
+- The file path being edited is shown at the bottom of the page.
+
+## ⚙️ Configuration
+
+Configuration of the plugin itself on its loader row:
+
+| Field | Description |
+|---|---|
+| `version` | The loader row's `config.version`. `--repair` increments it to force an HMR re-apply; no manual edits needed. |
+
+The loader row must be an **`insert` block** (in DSH's patch dialect a plain `- id:` row only overrides existing entries and can never add a new plugin):
+
+```yaml
+- insert:
+    - id: dsh-mcp-manager
+      name: dsh-mcp-manager
+      config:
+        version: 1
+```
+
+## 🏗️ Architecture
+
+- **Host half** (`src/index.ts` → `lib/index.js`, an object-form Cordis plugin `{name, inject, apply}`): `inject` declares `timer/fs/settings/sandboxPolicy/webServer/tools` — the framework guarantees they are ready and reloads the plugin if one disappears, which is how the plugin survives DSH upgrades. Registers four model tools (`ctx.tools.register(defineTool(...))`) and the exact route `POST /dsh-mcp-manager/api` (scoped cleanup via `ctx.effect`); line-level CRUD on `cordis.patch.yml` (mini YAML parser + per-file write lock).
+- **Browser half** (`lib/client.js`, ModuleLoader CJS bundle): registers the Settings → MCP 管理 page (`settings.section` slot, order 16) and talks to the host through same-origin `fetch('/dsh-mcp-manager/api')` — it never touches the filesystem directly.
+- **Loader row**: written into the profile's `cordis.patch.yml`; the client-modules service scans enabled entries and serves the client bundle.
+- **Installers**: `install.mjs` (cross-platform core) / `install.ps1` / `install.sh`, plus matching `uninstall.*`; the npm package `@xxxyz/dsh-mcp-manager` exposes them as bins (`dsh-mcp-manager` / `dsh-mcp-manager-uninstall`).
+
+## 🛠️ Development
+
+```bash
+npm install
+npm run build        # tsc -p tsconfig.json → lib/index.js (host half)
+```
+
+- Host source: `src/index.ts`; browser bundle: `lib/client.js` (hand-written, no build step)
+- The package is pure JS, zero-dependency and cross-platform; building only needs the devDependencies (typescript, `@deepseek-ai/cordis`, `@deepseek-ai/dsh-tools`, `@types/node`)
+- Publishing: `npm version patch && npm publish` (`prepublishOnly` builds automatically; the scoped package has `publishConfig.access: public`)
+
+## License
+
+MIT

package/install.mjs

@@ -273,7 +273,7 @@ async function pollApi(port, timeoutMs) {
     try {
       const res = await fetch(url, {
         method: 'POST',
-        headers: { 'content-type': 'application/json' },
+        headers: { 'content-type': 'application/json', 'x-dsh-plugin': 'dsh-mcp-manager' },
         body: JSON.stringify({ op: 'mcpm-list', args: {} }),
         signal: timeoutSignal(2000),
       })

package/lib/client.js

@@ -61,9 +61,12 @@ const factory = (require) => {
     }
 
     function apiCall(op, args) {
+      // `x-dsh-plugin` is the cross-site (CSRF) gate header the host half
+      // requires on every request; a cross-origin page cannot attach it
+      // without a CORS preflight that this route never answers.
       return fetch('/dsh-mcp-manager/api', {
         method: 'POST',
-        headers: { 'content-type': 'application/json' },
+        headers: { 'content-type': 'application/json', 'x-dsh-plugin': 'dsh-mcp-manager' },
         body: JSON.stringify({ op, args: args || {} }),
       }).then((r) => r.json()).catch((e) => ({ ok: false, error: String((e && e.message) || e) }))
     }

package/lib/index.js

@@ -936,6 +936,42 @@ export default {
                     kind: 'exact',
                     path: '/dsh-mcp-manager/api',
                     handler: async (req, res) => {
+                        // Cross-site (CSRF) gate. This route mutates config files, so it
+                        // must only be reachable from the DSH web UI (same origin) or
+                        // local tooling. A browser cross-site request cannot attach a
+                        // custom header without a CORS preflight, and this route never
+                        // answers preflights — requiring `x-dsh-plugin` is the primary
+                        // gate; POST-only and the Origin check are defense in depth.
+                        const hdr = (name) => {
+                            const v = req.headers?.[name];
+                            return Array.isArray(v) ? v[0] ?? '' : v ?? '';
+                        };
+                        if (String(req.method || 'POST').toUpperCase() !== 'POST') {
+                            res.writeHead(405, { 'content-type': 'application/json' });
+                            res.end(JSON.stringify({ ok: false, error: 'method not allowed' }));
+                            return;
+                        }
+                        if (hdr('x-dsh-plugin') !== 'dsh-mcp-manager') {
+                            res.writeHead(403, { 'content-type': 'application/json' });
+                            res.end(JSON.stringify({ ok: false, error: 'missing plugin gate header' }));
+                            return;
+                        }
+                        const origin = hdr('origin');
+                        if (origin) {
+                            let sameOrigin = false;
+                            try {
+                                const u = new URL(origin);
+                                const hostHdr = hdr('host') || '';
+                                sameOrigin =
+                                    /^(localhost|127\.0\.0\.1|\[::1\])$/i.test(u.hostname) || u.host === hostHdr;
+                            }
+                            catch (e) { /* unparseable origin → rejected below */ }
+                            if (!sameOrigin) {
+                                res.writeHead(403, { 'content-type': 'application/json' });
+                                res.end(JSON.stringify({ ok: false, error: 'cross-origin request rejected' }));
+                                return;
+                            }
+                        }
                         res.writeHead(200, { 'content-type': 'application/json' });
                         try {
                             let payload = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xxxyz/dsh-mcp-manager",
-  "version": "2.0.4",
+  "version": "2.0.6",
   "description": "DSH-standard MCP manager plugin: Settings UI + HTTP API + model-facing mcp_manager_* tools. Composed as a loader entry, survives restarts. Install via npx, PowerShell, bash or node.",
   "type": "module",
   "main": "lib/index.js",
@@ -23,7 +23,7 @@
     "uninstall.ps1",
     "uninstall.sh",
     "README.md",
-    "README.zh-CN.md",
+    "README_EN.md",
     "安装方式.md",
     "LICENSE"
   ],

package/README.zh-CN.md

@@ -1,193 +0,0 @@
-# dsh-mcp-manager
-
-<!-- Hero -->
-<div align="center">
-  <b style="font-size: 1.15em;">DeepSeek Harness 的 MCP 服务管理器：装没装、连没连、一页管完。</b><br /><br />
-  <code>服务器列表</code> <code>新增 / 编辑 / 删除</code> <code>启用 / 停用</code> <code>重启</code> <code>工具数健康</code> <code>JSON 导出 / 导入</code><br />
-  <code>4 个模型工具</code> <code>HTTP API</code> <code>npx / npm / dsh plugin / 脚本</code><br /><br />
-  <b>设置 → MCP 管理</b> 管理项目级与全局 <code>cordis.patch.yml</code> 中的 <code>@deepseek-ai/dsh-mcp-client</code> 行——<br />
-  无需再手改配置文件，所有修改即改即生效（HMR 热应用），重启、升级后依然存在。
-</div>
-
-<div align="center">
-
-[![npm version](https://img.shields.io/npm/v/@xxxyz/dsh-mcp-manager?logo=npm&color=cb3837)](https://www.npmjs.com/package/@xxxyz/dsh-mcp-manager)
-[![License](https://img.shields.io/github/license/xxxyz/DeepSeekHarness-MCP-Manager?color=blue)](LICENSE)
-[![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js)](package.json)
-[![GitHub](https://img.shields.io/badge/GitHub-xxxyz%2FDeepSeekHarness--MCP--Manager-181717?logo=github)](https://github.com/xxxyz/DeepSeekHarness-MCP-Manager)
-
-</div>
-
-<div align="center">
-  🌏 <a href="./README.zh-CN.md"><b>中文</b></a> · <a href="./README.md">English</a>
-</div>
-
-<br />
-
-<p align="center"><img src="show.png" alt="dsh-mcp-manager 设置 → MCP 管理 页面图例" /></p>
-
-## ✨ 功能一览
-
-- **📋 服务器列表**：列出所有已配置的 MCP 服务器（`@deepseek-ai/dsh-mcp-client` 实例）——`serverName`、传输方式（`stdio` / `streamable-http`）、URL / 命令、启用状态、loader 实时加载阶段、已注册工具数
-- **➕ 新增 / ➖ 删除**：表单添加 MCP 服务器（支持 env / headers / args），带格式与重名校验；一键删除
-- **🔌 启用 / 停用**：随时切换，工具随之热连接 / 热断开
-- **🔄 重启**：disable + re-enable，自动重连并重新同步工具
-- **💾 持久化**：写入**项目级**（`profiles/<profile>/cordis.patch.yml`）或**全局**（`~/.dsh/cordis.patch.yml`），重启后保留；页面底部显示文件路径
-- **🩺 健康检查**：每台服务器实时工具数与 loader 阶段，异常一目了然
-- **📦 备份 / 恢复**：JSON 导出 / 导入，合并新增、已存在自动跳过
-- **🤖 模型工具**：宿主注册 4 个 `mcp_manager_*` 工具，模型可直接查询与操作 MCP 服务
-- **🌐 HTTP API**：`POST /dsh-mcp-manager/api`（JSON `{op, args}` → `{ok, ...}`），供客户端与脚本调用
-- **📦 跨平台安装**：Windows / macOS / Linux 一条命令（npx / npm / `dsh plugin` / 脚本）
-
-## 🚀 安装
-
-**前置**：DSH 已装好（`dsh web` 能正常运行），Node.js ≥ 18。
-
-### 方式一 · npx 一条命令（推荐）
-
-```sh
-npx -y @xxxyz/dsh-mcp-manager
-```
-
-所有参数照常透传：`npx -y @xxxyz/dsh-mcp-manager --dsh-home /path/.dsh --profile web --repair --port 3080`。
-
-### 方式二 · npm 全局安装（适合经常使用）
-
-```sh
-npm i -g @xxxyz/dsh-mcp-manager
-dsh-mcp-manager                  # 安装插件
-dsh-mcp-manager-uninstall        # 卸载插件
-npm i -g @xxxyz/dsh-mcp-manager@latest   # 升级
-```
-
-### 方式三 · dsh 命令安装（bundle 方式）
-
-```sh
-dsh plugin --profile web add @xxxyz/dsh-mcp-manager
-# 或 GitHub 源（构建产物 lib/ 已入库，无需本地构建）
-dsh plugin --profile web add github:xxxyz/DeepSeekHarness-MCP-Manager
-```
-
-### 方式四 · 免 npm 账号：GitHub 直拉
-
-```sh
-npx -y github:xxxyz/DeepSeekHarness-MCP-Manager
-```
-
-<details>
-<summary><b>脚本安装</b>（源码方式：下载仓库后执行，幂等）</summary>
-
-**Windows（PowerShell）**：
-
-```powershell
-.\dsh-mcp-manager\install.ps1                     # 默认 ~/.dsh + web profile
-.\dsh-mcp-manager\install.ps1 -DshHome D:\path\.dsh -Profile web
-```
-
-**macOS / Linux（bash）**（无执行权限先 `chmod +x dsh-mcp-manager/install.sh`）：
-
-```sh
-./dsh-mcp-manager/install.sh                      # 默认 ~/.dsh + web profile
-./dsh-mcp-manager/install.sh --dsh-home /path/.dsh --profile web
-```
-
-**任何平台直接运行**：
-
-```sh
-node dsh-mcp-manager/install.mjs [--dsh-home <path>] [--profile <name>] [--port <n>] [--repair] [--skip-patch]
-```
-
-安装脚本会：① 复制到 `local-packages/`（真源备份，DSH 升级不动它）② 复制到 `profiles/node_modules/`（普通复制而非软链接，保证 ESM 能解析 `@deepseek-ai/dsh-tools`）③ 幂等追加 loader 行（insert 块）。
-
-</details>
-
-装完**硬刷新浏览器**（Cmd/Ctrl+Shift+R），打开 **设置 → MCP 管理** 即可看到管理页。若未出现，重启一次 DSH（host 半首次挂载需要）。
-
-<details>
-<summary><b>卸载</b></summary>
-
-```sh
-dsh-mcp-manager-uninstall                          # 若用 npm -g 安装
-# 或：.\uninstall.ps1 | ./uninstall.sh | node uninstall.mjs [--dsh-home <path>] [--profile <name>]
-```
-
-然后重启 DSH。卸载删除部署副本、`local-packages` 真源，并清理 loader 行（补丁保持合法）。
-
-</details>
-
-<details>
-<summary><b>DSH 升级后：--repair</b></summary>
-
-DSH 升级（或 HMR 状态异常）后若 **设置里没有"MCP 管理"** 或 **`mcp_manager_*` 工具消失**，运行一次修复命令：重新部署 → 递增 loader 行 `config.version`（触发 HMR 重应用）→ 轮询 API 直到 `{ok:true}`（默认 30 秒）。
-
-```sh
-node dsh-mcp-manager/install.mjs --repair --port 3080
-# PowerShell: .\install.ps1 -Repair -Port 3080    bash: ./install.sh --repair --port 3080
-```
-
-仍不恢复则重启一次 DSH（loader 启动时重新导入）。
-
-</details>
-
-<details>
-<summary><b>常见问题</b></summary>
-
-| 现象 | 原因与解决 |
-|---|---|
-| 装完设置里没有"MCP 管理" | 硬刷新（Cmd/Ctrl+Shift+R）；仍没有就重启 DSH 一次。 |
-| 页面出现**两个 MCP 页签 / 工具重复** | 双挂载：同时用了 install.mjs 与 `dsh plugin add` 两种方式。卸载其中一种（`dsh-mcp-manager-uninstall` 或删掉对应的 loader 行 / `dsh.profile.bundles` 条目）。 |
-| DSH 升级后工具消失 | 跑一次 `--repair`（见上）。 |
-| `npx` / `npm view` 报 404 | 国内镜像（npmmirror）同步有延迟：加 `--registry=https://registry.npmjs.org` 或稍等再试。 |
-| 安装脚本报错 `EPERM` | DSH 正在运行占用了文件：先退出 DSH 再装。 |
-| 修改配置后未生效 | 所有修改走 HMR 热应用，等 1–2 秒自动刷新；页面会自动轮询。 |
-
-</details>
-
-## 📖 使用说明
-
-打开 **设置 → MCP 管理**：
-
-- **添加服务器**：填写 `serverName`（唯一，1–32 位 `[A-Za-z0-9_-]`）、传输方式及对应字段（`streamable-http` 填 URL / headers；`stdio` 填 command / args / env），选择级别（项目级 / 全局）。面板做格式与重名校验。
-- 每张卡片显示实时状态、连接目标与工具数；可 **启用 / 停用**、**重启**、**编辑**、**删除**。
-- **备份 / 恢复**：一键导出 JSON，或粘贴 JSON 导入（合并新增，已存在自动跳过）。
-- 页面底部显示正在编辑的补丁文件路径。
-
-## ⚙️ 配置
-
-插件自身在 loader 行中的配置：
-
-| 字段 | 说明 |
-|---|---|
-| `version` | loader 行 `config.version`。`--repair` 会将其递增以强制 HMR 重应用，无需手动修改。 |
-
-loader 行必须为 **`insert` 块**形式（DSH patch 方言中普通 `- id:` 行只是对已存在条目的覆盖，无法新增插件）：
-
-```yaml
-- insert:
-    - id: dsh-mcp-manager
-      name: dsh-mcp-manager
-      config:
-        version: 1
-```
-
-## 🏗️ 架构
-
-- **宿主端**（`src/index.ts` → `lib/index.js`，对象形态 Cordis 插件 `{name, inject, apply}`）：`inject` 声明 `timer/fs/settings/sandboxPolicy/webServer/tools`，框架保证就绪并在依赖消失时自动重载——这是插件跨 DSH 升级存活的机制。注册 4 个模型工具（`ctx.tools.register(defineTool(...))`）与精确路由 `POST /dsh-mcp-manager/api`（`ctx.effect` 作用域化清理）；对 `cordis.patch.yml` 做行级 CRUD（迷你 YAML 解析 + 按文件写锁）。
-- **浏览器端**（`lib/client.js`，ModuleLoader CJS bundle）：注册 设置 → MCP 管理 页（`settings.section` 槽位，order 16），经同源 `fetch('/dsh-mcp-manager/api')` 与宿主通信，不直接访问文件系统。
-- **loader 行**：写入 profile 的 `cordis.patch.yml`，client-modules 服务扫描启用的条目并下发客户端 bundle。
-- **安装器**：`install.mjs`（跨平台核心）/ `install.ps1` / `install.sh` + 对应的 `uninstall.*`；npm 包 `@xxxyz/dsh-mcp-manager` 的 bin 直接执行安装器（`dsh-mcp-manager` / `dsh-mcp-manager-uninstall`）。
-
-## 🛠️ 开发
-
-```bash
-npm install
-npm run build        # tsc -p tsconfig.json → lib/index.js（宿主端）
-```
-
-- 宿主插件源码：`src/index.ts`；浏览器 bundle：`lib/client.js`（手写，无需构建）
-- 包本身纯 JS、零依赖、跨平台；构建只需 devDependencies（typescript、`@deepseek-ai/cordis`、`@deepseek-ai/dsh-tools`、`@types/node`）
-- 发布：`npm version patch && npm publish`（`prepublishOnly` 自动构建；scoped 包已配置 `publishConfig.access: public`）
-
-## 许可证
-
-MIT