@xxxyz/dsh-mcp-manager 2.0.6 → 2.1.1

package/README.md

@@ -2,11 +2,11 @@
 
 <!-- Hero -->
 <div align="center">
-  <b style="font-size: 1.15em;">DeepSeek Harness 的 MCP 服务管理器：装没装、连没连、一页管完。</b><br /><br />
+  <b style="font-size: 1.15em;">DeepSeek Harness 的 MCP 服务与技能管理器：装没装、连没连、一页管完。</b><br /><br />
   <code>服务器列表</code> <code>新增 / 编辑 / 删除</code> <code>启用 / 停用</code> <code>重启</code> <code>工具数健康</code> <code>JSON 导出 / 导入</code><br />
-  <code>4 个模型工具</code> <code>HTTP API</code> <code>npx / npm / dsh plugin / 脚本</code><br /><br />
-  <b>设置 → MCP 管理</b> 管理项目级与全局 <code>cordis.patch.yml</code> 中的 <code>@deepseek-ai/dsh-mcp-client</code> 行——<br />
-  无需再手改配置文件，所有修改即改即生效（HMR 热应用），重启、升级后依然存在。
+  <code>Skills 浏览 / 搜索 / 停用</code> <code>4 个模型工具</code> <code>HTTP API</code> <code>dsh plugin 一条命令</code><br /><br />
+  <b>设置 → MCP 管理</b> 管理项目级与全局 <code>cordis.patch.yml</code> 中的 <code>@deepseek-ai/dsh-mcp-client</code> 行，<br />
+  <b>设置 → Skills 管理</b> 浏览并停用各来源的技能——无需再手改配置文件，所有修改即改即生效（HMR 热应用），重启、升级后依然存在。
 </div>
 
 <div align="center">
@@ -15,9 +15,15 @@
 [![License](https://img.shields.io/github/license/xxxyz/DeepSeekHarness-MCP-Manager?color=blue)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js)](package.json)
 [![GitHub](https://img.shields.io/badge/GitHub-xxxyz%2FDeepSeekHarness--MCP--Manager-181717?logo=github)](https://github.com/xxxyz/DeepSeekHarness-MCP-Manager)
+[![dsh.market](https://img.shields.io/badge/dsh.market-%E2%9C%93-3fb950)](https://dsh.market)
+[![awesome-dsh-plugin](https://img.shields.io/badge/awesome--dsh--plugin-%E5%BE%85%E5%90%88%E5%B9%B6-ffd93d)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/2078)
 
 </div>
 
+<div align="center">
+  🛒 已收录于 <a href="https://dsh.market"><b>dsh.market</b></a> · 已提交 <a href="https://awesome-dsh-plugin.com"><b>awesome-dsh-plugin.com</b></a> 官方列表收录（<a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/2078"><b>PR #2078</b></a> 待合并）
+</div>
+
 <div align="center">
   🌏 <a href="./README.md"><b>中文</b></a> · <a href="./README_EN.md">English</a>
 </div>
@@ -36,110 +42,65 @@
 - **🩺 健康检查**：每台服务器实时工具数与 loader 阶段，异常一目了然
 - **📦 备份 / 恢复**：JSON 导出 / 导入，合并新增、已存在自动跳过
 - **🤖 模型工具**：宿主注册 4 个 `mcp_manager_*` 工具，模型可直接查询与操作 MCP 服务
-- **🌐 HTTP API**：`POST /dsh-mcp-manager/api`（JSON `{op, args}` → `{ok, ...}`），供客户端与脚本调用
-- **📦 跨平台安装**：Windows / macOS / Linux 一条命令（npx / npm / `dsh plugin` / 脚本）
+- **🧠 技能管理**：**设置 → Skills 管理** 页列出 DSH 全部技能，按来源分组（项目级 / 运行时 / 自定义 / 用户级 / 内置 / 插件自带）并支持搜索与按 provider 折叠；一键停用 / 启用任意技能（rank-0 override provider，任何来源层级都可禁），状态持久化到 `dsh-skill-manager.json`，HMR 即时生效
+- **🌐 HTTP API**：`POST /dsh-mcp-manager/api`（JSON `{op, args}` → `{ok, ...}`），供客户端与脚本调用。带跨站（CSRF）防护：仅接受 POST、必须携带 `x-dsh-plugin: dsh-mcp-manager` 请求头、校验同源 Origin（curl 等本地脚本无需 Origin）
+- **📦 一键安装**：`dsh plugin --profile web add` 一条命令装包 + 自动挂载（Windows / macOS / Linux）
 
 ## 🚀 安装
 
-**前置**：DSH 已装好（`dsh web` 能正常运行），Node.js ≥ 18。
-
-### 方式一 · npx 一条命令（推荐）
-
-```sh
-npx -y @xxxyz/dsh-mcp-manager
-```
-
-所有参数照常透传：`npx -y @xxxyz/dsh-mcp-manager --dsh-home /path/.dsh --profile web --repair --port 3080`。
-
-### 方式二 · npm 全局安装（适合经常使用）
-
-```sh
-npm i -g @xxxyz/dsh-mcp-manager
-dsh-mcp-manager                  # 安装插件
-dsh-mcp-manager-uninstall        # 卸载插件
-npm i -g @xxxyz/dsh-mcp-manager@latest   # 升级
-```
-
-### 方式三 · dsh 命令安装（bundle 方式）
+**前置**：已装好 DSH（`dsh web` 能正常运行），Node.js ≥ 18、pnpm ≥ 9。
 
-```sh
-dsh plugin --profile web add @xxxyz/dsh-mcp-manager
-# 或 GitHub 源（构建产物 lib/ 已入库，无需本地构建）
-dsh plugin --profile web add github:xxxyz/DeepSeekHarness-MCP-Manager
-```
+### 方式一 · dsh 命令安装（推荐）
 
-### 方式四 · 免 npm 账号：GitHub 直拉
+一条命令装包 + **自动挂载**（`dsh.bundle.patch` 机制，无需手动改任何配置文件）：
 
 ```sh
-npx -y github:xxxyz/DeepSeekHarness-MCP-Manager
+dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest
 ```
 
-<details>
-<summary><b>脚本安装</b>（源码方式：下载仓库后执行，幂等）</summary>
+装完**硬刷新浏览器**（Cmd/Ctrl+Shift+R）即可看到 **设置 → MCP 管理**（DSH 对 client 改动热加载，无需重启；仅 host 半更新时需要重启）。
 
-**Windows（PowerShell）**：
+### 方式二 · 让 DSH 自己装
 
-```powershell
-.\dsh-mcp-manager\install.ps1                     # 默认 ~/.dsh + web profile
-.\dsh-mcp-manager\install.ps1 -DshHome D:\path\.dsh -Profile web
-```
+把下面这段提示词发给任意一个 DSH 会话：
 
-**macOS / Linux（bash）**（无执行权限先 `chmod +x dsh-mcp-manager/install.sh`）：
-
-```sh
-./dsh-mcp-manager/install.sh                      # 默认 ~/.dsh + web profile
-./dsh-mcp-manager/install.sh --dsh-home /path/.dsh --profile web
+```text
+帮我安装 dsh-mcp-manager 插件（DSH MCP 服务管理器），步骤：
+1. 执行 dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest
+2. 完成后提醒我硬刷新浏览器（Cmd/Ctrl+Shift+R）
+遇到报错先查 https://github.com/xxxyz/DeepSeekHarness-MCP-Manager README 的常见问题表。
 ```
 
-**任何平台直接运行**：
+**更新**
 
 ```sh
-node dsh-mcp-manager/install.mjs [--dsh-home <path>] [--profile <name>] [--port <n>] [--repair] [--skip-patch]
+dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest
 ```
 
-安装脚本会：① 复制到 `local-packages/`（真源备份，DSH 升级不动它）② 复制到 `profiles/node_modules/`（普通复制而非软链接，保证 ESM 能解析 `@deepseek-ai/dsh-tools`）③ 幂等追加 loader 行（insert 块）。
-
-</details>
-
-装完**硬刷新浏览器**（Cmd/Ctrl+Shift+R），打开 **设置 → MCP 管理** 即可看到管理页。若未出现，重启一次 DSH（host 半首次挂载需要）。
+也可把 `~/.dsh/profiles/web/package.json` 里的版本号改高后 `pnpm install`。改完**硬刷新浏览器**（Cmd/Ctrl+Shift+R）即可（client 改动无需重启 DSH）。
 
 <details>
-<summary><b>卸载</b></summary>
-
-```sh
-dsh-mcp-manager-uninstall                          # 若用 npm -g 安装
-# 或：.\uninstall.ps1 | ./uninstall.sh | node uninstall.mjs [--dsh-home <path>] [--profile <name>]
-```
+<summary><b>常见问题</b></summary>
 
-然后重启 DSH。卸载删除部署副本、`local-packages` 真源，并清理 loader 行（补丁保持合法）。
+| 现象 | 原因与解决 |
+|---|---|
+| 装完设置里没有「MCP 管理」 | 硬刷新（Cmd/Ctrl+Shift+R）；仍没有就重启 DSH 一次。 |
+| 页面出现**两个 MCP 页签 / 工具重复** | 双挂载：同时存在旧的 loader 行与新的 bundle 条目。删掉 `cordis.patch.yml` 里的旧 loader 行，或 `dsh.profile.bundles` 里的条目，重启 DSH。 |
+| 之前用旧方式装过，现在想升级 | 新版 bundle 自带防双挂载 guard，直接 `dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest` 不会重复挂载。要切到新代码：删掉 `~/.dsh/profiles/web/cordis.patch.yml` 里的 `- id: mcp-manager` 行，再删 `local-packages/dsh-mcp-manager` 与 `profiles/node_modules/dsh-mcp-manager` 两个副本，重启 DSH。 |
+| 提示 `dsh: command not found` | 先安装 DSH；或直接用 `npx -y --package @deepseek-ai/dsh dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest`。 |
+| `npm view` 报 404 | 国内镜像（npmmirror）同步有延迟：加 `--registry=https://registry.npmjs.org` 或稍等再试。 |
+| 修改配置后未生效 | 所有修改走 HMR 热应用，等 1–2 秒自动刷新；页面会自动轮询。 |
 
 </details>
 
 <details>
-<summary><b>DSH 升级后：--repair</b></summary>
-
-DSH 升级（或 HMR 状态异常）后若 **设置里没有"MCP 管理"** 或 **`mcp_manager_*` 工具消失**，运行一次修复命令：重新部署 → 递增 loader 行 `config.version`（触发 HMR 重应用）→ 轮询 API 直到 `{ok:true}`（默认 30 秒）。
+<summary><b>卸载</b></summary>
 
 ```sh
-node dsh-mcp-manager/install.mjs --repair --port 3080
-# PowerShell: .\install.ps1 -Repair -Port 3080    bash: ./install.sh --repair --port 3080
+dsh plugin --profile web remove @xxxyz/dsh-mcp-manager
 ```
 
-仍不恢复则重启一次 DSH（loader 启动时重新导入）。
-
-</details>
-
-<details>
-<summary><b>常见问题</b></summary>
-
-| 现象 | 原因与解决 |
-|---|---|
-| 装完设置里没有"MCP 管理" | 硬刷新（Cmd/Ctrl+Shift+R）；仍没有就重启 DSH 一次。 |
-| 页面出现**两个 MCP 页签 / 工具重复** | 双挂载：同时用了 install.mjs 与 `dsh plugin add` 两种方式。卸载其中一种（`dsh-mcp-manager-uninstall` 或删掉对应的 loader 行 / `dsh.profile.bundles` 条目）。 |
-| DSH 升级后工具消失 | 跑一次 `--repair`（见上）。 |
-| `npx` / `npm view` 报 404 | 国内镜像（npmmirror）同步有延迟：加 `--registry=https://registry.npmjs.org` 或稍等再试。 |
-| 安装脚本报错 `EPERM` | DSH 正在运行占用了文件：先退出 DSH 再装。 |
-| 修改配置后未生效 | 所有修改走 HMR 热应用，等 1–2 秒自动刷新；页面会自动轮询。 |
+然后重启 DSH。
 
 </details>
 
@@ -152,30 +113,35 @@ node dsh-mcp-manager/install.mjs --repair --port 3080
 - **备份 / 恢复**：一键导出 JSON，或粘贴 JSON 导入（合并新增，已存在自动跳过）。
 - 页面底部显示正在编辑的补丁文件路径。
 
+打开 **设置 → Skills 管理**：
+
+- **浏览 / 搜索**：列出 DSH 全部技能，按来源分组（项目级 / 运行时 / 自定义 / 用户级 / 内置 / 插件自带），组内按 provider 折叠；搜索框实时过滤。
+- **启用 / 停用**：一键切换任意技能的启用状态——通过 rank-0 override provider（`dsh-mcp-manager-override`）实现，任何来源层级（含项目级）都能禁用。
+- **持久化**：停用状态写入 `<profileDir>/dsh-skill-manager.json`，重启后保留；改动经 HMR 即时生效。
+
 ## ⚙️ 配置
 
 插件自身在 loader 行中的配置：
 
 | 字段 | 说明 |
 |---|---|
-| `version` | loader 行 `config.version`。`--repair` 会将其递增以强制 HMR 重应用，无需手动修改。 |
+| `version` | loader 行 `config.version`，仅用于触发 HMR 重应用；官方通道安装下由 bundle 自动管理，无需手动修改。 |
 
 loader 行必须为 **`insert` 块**形式（DSH patch 方言中普通 `- id:` 行只是对已存在条目的覆盖，无法新增插件）：
 
 ```yaml
 - insert:
     - id: dsh-mcp-manager
-      name: dsh-mcp-manager
-      config:
-        version: 1
+      name: '@xxxyz/dsh-mcp-manager'
 ```
 
+> 无需手动写这行——`dsh plugin add` 的 bundle patch 会自动插入（见 `cordis.patch.yml`）。
+
 ## 🏗️ 架构
 
 - **宿主端**（`src/index.ts` → `lib/index.js`，对象形态 Cordis 插件 `{name, inject, apply}`）：`inject` 声明 `timer/fs/settings/sandboxPolicy/webServer/tools`，框架保证就绪并在依赖消失时自动重载——这是插件跨 DSH 升级存活的机制。注册 4 个模型工具（`ctx.tools.register(defineTool(...))`）与精确路由 `POST /dsh-mcp-manager/api`（`ctx.effect` 作用域化清理）；对 `cordis.patch.yml` 做行级 CRUD（迷你 YAML 解析 + 按文件写锁）。
 - **浏览器端**（`lib/client.js`，ModuleLoader CJS bundle）：注册 设置 → MCP 管理 页（`settings.section` 槽位，order 16），经同源 `fetch('/dsh-mcp-manager/api')` 与宿主通信，不直接访问文件系统。
-- **loader 行**：写入 profile 的 `cordis.patch.yml`，client-modules 服务扫描启用的条目并下发客户端 bundle。
-- **安装器**：`install.mjs`（跨平台核心）/ `install.ps1` / `install.sh` + 对应的 `uninstall.*`；npm 包 `@xxxyz/dsh-mcp-manager` 的 bin 直接执行安装器（`dsh-mcp-manager` / `dsh-mcp-manager-uninstall`）。
+- **loader 行**：由 `dsh plugin add` 的 bundle patch 自动插入，client-modules 服务扫描启用的条目并下发客户端 bundle。
 
 ## 🛠️ 开发
 

package/README_EN.md

@@ -2,11 +2,12 @@
 
 <!-- Hero -->
 <div align="center">
-  <b style="font-size: 1.15em;">Manage every MCP server in DeepSeek Harness from one settings page — install, configure, monitor.</b><br /><br />
+  <b style="font-size: 1.15em;">Manage every MCP server and skill in DeepSeek Harness from one settings page — install, configure, monitor.</b><br /><br />
   <code>server list</code> <code>add / edit / delete</code> <code>enable / disable</code> <code>restart</code> <code>tool-count health</code> <code>JSON export / import</code><br />
-  <code>4 model tools</code> <code>HTTP API</code> <code>npx / npm / dsh plugin / scripts</code><br /><br />
+  <code>Skills browse / search / disable</code> <code>4 model tools</code> <code>HTTP API</code> <code>dsh plugin one-command</code><br /><br />
   <b>Settings → MCP 管理</b> manages <code>@deepseek-ai/dsh-mcp-client</code> rows in your project-level and
-  global <code>cordis.patch.yml</code> — no hand-editing, every change applies live via HMR, survives restarts and upgrades.
+  global <code>cordis.patch.yml</code>; <b>Settings → Skills 管理</b> browses and disables skills from every
+  source — no hand-editing, every change applies live via HMR, survives restarts and upgrades.
 </div>
 
 <div align="center">
@@ -15,9 +16,15 @@
 [![License](https://img.shields.io/github/license/xxxyz/DeepSeekHarness-MCP-Manager?color=blue)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%3E%3D18-339933?logo=node.js)](package.json)
 [![GitHub](https://img.shields.io/badge/GitHub-xxxyz%2FDeepSeekHarness--MCP--Manager-181717?logo=github)](https://github.com/xxxyz/DeepSeekHarness-MCP-Manager)
+[![dsh.market](https://img.shields.io/badge/dsh.market-%E2%9C%93-3fb950)](https://dsh.market)
+[![awesome-dsh-plugin](https://img.shields.io/badge/awesome--dsh--plugin-pending-ffd93d)](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/2078)
 
 </div>
 
+<div align="center">
+  🛒 Listed on <a href="https://dsh.market"><b>dsh.market</b></a> · submitted to <a href="https://awesome-dsh-plugin.com"><b>awesome-dsh-plugin.com</b></a> (<a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/pull/2078"><b>PR #2078</b></a> pending merge)
+</div>
+
 <div align="center">
   🌏 <a href="./README.md">中文</a> · <a href="./README_EN.md"><b>English</b></a>
 </div>
@@ -36,110 +43,65 @@
 - **🩺 Health check** — live tool counts and loader phase per server, problems visible at a glance
 - **📦 Backup / Restore** — JSON export / import; merges new entries, skips existing ones
 - **🤖 Model tools** — four `mcp_manager_*` tools registered on the host, so the model can query and manage MCP servers directly
-- **🌐 HTTP API** — `POST /dsh-mcp-manager/api` (JSON `{op, args}` → `{ok, ...}`) for the client and scripts
-- **📦 Cross-platform install** — one command on Windows / macOS / Linux (npx / npm / `dsh plugin` / scripts)
+- **🧠 Skill management** — the **Settings → Skills 管理** page lists every DSH skill grouped by source (project / runtime / custom / user / built-in / plugin-bundled) with search and per-provider collapse; enable / disable any skill in one click (rank-0 override provider, so every source level including project-level is disable-able), persisted to `dsh-skill-manager.json`, applied live via HMR
+- **🌐 HTTP API** — `POST /dsh-mcp-manager/api` (JSON `{op, args}` → `{ok, ...}`) for the client and scripts. Cross-site (CSRF) protected: POST-only, requires the `x-dsh-plugin: dsh-mcp-manager` request header, and checks the Origin is same-origin (local scripts without an Origin are fine)
+- **📦 One-command install** — `dsh plugin --profile web add` installs and mounts automatically (Windows / macOS / Linux)
 
 ## 🚀 Install
 
-**Prerequisite**: DSH installed and running (`dsh web` works), Node.js ≥ 18.
-
-### Method 1 · One-shot npx (recommended)
-
-```sh
-npx -y @xxxyz/dsh-mcp-manager
-```
+**Prerequisite**: DSH installed and running (`dsh web` works), Node.js ≥ 18, pnpm ≥ 9.
 
-All flags pass through: `npx -y @xxxyz/dsh-mcp-manager --dsh-home /path/.dsh --profile web --repair --port 3080`.
+### Method 1 · dsh command (recommended)
 
-### Method 2 · Global npm install (for frequent use)
+One command installs the package and **auto-mounts** it (the `dsh.bundle.patch` mechanism — no manual config file edits needed):
 
 ```sh
-npm i -g @xxxyz/dsh-mcp-manager
-dsh-mcp-manager                  # install the plugin
-dsh-mcp-manager-uninstall        # uninstall the plugin
-npm i -g @xxxyz/dsh-mcp-manager@latest   # upgrade
+dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest
 ```
 
-### Method 3 · dsh command (bundle)
+After installing, **hard-refresh the browser** (Cmd/Ctrl+Shift+R) and open **Settings → MCP 管理** (DSH hot-reloads client changes; a full restart is only needed for host-half changes).
 
-```sh
-dsh plugin --profile web add @xxxyz/dsh-mcp-manager
-# or from GitHub (build artifacts are committed, no local build needed)
-dsh plugin --profile web add github:xxxyz/DeepSeekHarness-MCP-Manager
-```
+### Method 2 · Let DSH install it
 
-### Method 4 · No npm account: straight from GitHub
+Paste this prompt into any DSH conversation:
 
-```sh
-npx -y github:xxxyz/DeepSeekHarness-MCP-Manager
+```text
+Install the dsh-mcp-manager plugin (DSH MCP server manager):
+1. Run dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest
+2. When done, remind me to hard-refresh the browser (Cmd/Ctrl+Shift+R)
+If you hit an error, check https://github.com/xxxyz/DeepSeekHarness-MCP-Manager README's FAQ table.
 ```
 
-<details>
-<summary><b>Script install</b> (source checkout; idempotent)</summary>
-
-**Windows (PowerShell)**:
-
-```powershell
-.\dsh-mcp-manager\install.ps1                     # default: ~/.dsh, web profile
-.\dsh-mcp-manager\install.ps1 -DshHome D:\path\.dsh -Profile web
-```
-
-**macOS / Linux (bash)** (run `chmod +x dsh-mcp-manager/install.sh` if needed):
+**Update**
 
 ```sh
-./dsh-mcp-manager/install.sh                      # default: ~/.dsh, web profile
-./dsh-mcp-manager/install.sh --dsh-home /path/.dsh --profile web
+dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest
 ```
 
-**Any platform (direct)**:
-
-```sh
-node dsh-mcp-manager/install.mjs [--dsh-home <path>] [--profile <name>] [--port <n>] [--repair] [--skip-patch]
-```
-
-The installer ① copies the package to `local-packages/` (source of record, untouched by DSH upgrades) ② copies it into `profiles/node_modules/` (a plain copy, not a symlink, so ESM resolves `@deepseek-ai/dsh-tools`) ③ appends the loader row (an `insert` block, idempotent).
-
-</details>
-
-After installing, **hard-refresh the browser** (Cmd/Ctrl+Shift+R) and open **Settings → MCP 管理**. If the page is missing, restart DSH once (the host half needs a first mount).
+Or bump the version in `~/.dsh/profiles/web/package.json` and run `pnpm install`. Hard-refresh the browser afterwards (Cmd/Ctrl+Shift+R) — client changes are hot-reloaded; only host-half changes need a restart.
 
 <details>
-<summary><b>Uninstall</b></summary>
-
-```sh
-dsh-mcp-manager-uninstall                          # if installed via npm -g
-# or: .\uninstall.ps1 | ./uninstall.sh | node uninstall.mjs [--dsh-home <path>] [--profile <name>]
-```
+<summary><b>FAQ</b></summary>
 
-Then restart DSH. Uninstall removes the deployed copy, the `local-packages` source, and the loader row (the patch stays a valid array).
+| Symptom | Cause & fix |
+|---|---|
+| No "MCP 管理" in Settings after install | Hard-refresh (Cmd/Ctrl+Shift+R); if still missing, restart DSH once. |
+| **Two MCP tabs / duplicated tools** | Double mount: both a legacy loader row and the new bundle entry exist. Delete the old loader row from `cordis.patch.yml`, or the `dsh.profile.bundles` entry, then restart DSH. |
+| Upgrading from a legacy script install | The new bundle has a built-in double-mount guard — `dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest` won't crash. To actually switch to the new code: remove the old `- id: mcp-manager` row from `~/.dsh/profiles/web/cordis.patch.yml`, delete `local-packages/dsh-mcp-manager` and `profiles/node_modules/dsh-mcp-manager`, then restart DSH. |
+| `dsh: command not found` | Install DSH first, or use `npx -y --package @deepseek-ai/dsh dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest`. |
+| `npm view` reports 404 | Local mirror (npmmirror) sync lag: add `--registry=https://registry.npmjs.org` or wait a moment. |
+| Config changes don't take effect | All changes apply via HMR within 1–2 s; the page auto-polls. |
 
 </details>
 
 <details>
-<summary><b>After a DSH upgrade: --repair</b></summary>
-
-If a DSH upgrade (or a broken HMR state) leaves the settings page or the `mcp_manager_*` tools missing, run one repair command: redeploy → bump the loader row's `config.version` (forces an HMR re-apply) → poll the API until `{ok:true}` (default 30 s).
+<summary><b>Uninstall</b></summary>
 
 ```sh
-node dsh-mcp-manager/install.mjs --repair --port 3080
-# PowerShell: .\install.ps1 -Repair -Port 3080    bash: ./install.sh --repair --port 3080
+dsh plugin --profile web remove @xxxyz/dsh-mcp-manager
 ```
 
-If the API still does not answer, restart DSH once (the loader re-imports at boot).
-
-</details>
-
-<details>
-<summary><b>FAQ</b></summary>
-
-| Symptom | Cause & fix |
-|---|---|
-| No "MCP 管理" in Settings after install | Hard-refresh (Cmd/Ctrl+Shift+R); if still missing, restart DSH once. |
-| **Two MCP tabs / duplicated tools** | Double mount: both install.mjs and `dsh plugin add` were used. Remove one (run `dsh-mcp-manager-uninstall`, or delete the extra loader row / `dsh.profile.bundles` entry). |
-| Tools missing after a DSH upgrade | Run `--repair` (see above). |
-| `npx` / `npm view` reports 404 | Local mirror (npmmirror) sync lag: add `--registry=https://registry.npmjs.org` or wait a moment. |
-| Installer fails with `EPERM` | DSH is running and holds the files: quit DSH before installing. |
-| Config changes don't take effect | All changes apply via HMR within 1–2 s; the page auto-polls. |
+Then restart DSH.
 
 </details>
 
@@ -152,30 +114,35 @@ Open **Settings → MCP 管理**:
 - **Backup / Restore**: export the configuration as JSON with one click, or paste JSON to import (merges new entries, skips existing ones).
 - The file path being edited is shown at the bottom of the page.
 
+Open **Settings → Skills 管理**:
+
+- **Browse / Search**: lists every DSH skill grouped by source (project / runtime / custom / user / built-in / plugin-bundled), collapsed per provider; the search box filters live.
+- **Enable / Disable**: toggle any skill in one click — implemented with a rank-0 override provider (`dsh-mcp-manager-override`), so every source level (including project-level) can be disabled.
+- **Persistence**: disabled state is written to `<profileDir>/dsh-skill-manager.json`, survives restarts, and applies live via HMR.
+
 ## ⚙️ Configuration
 
 Configuration of the plugin itself on its loader row:
 
 | Field | Description |
 |---|---|
-| `version` | The loader row's `config.version`. `--repair` increments it to force an HMR re-apply; no manual edits needed. |
+| `version` | The loader row's `config.version`, only used to trigger an HMR re-apply; auto-managed by the bundle channel — no manual edits needed. |
 
 The loader row must be an **`insert` block** (in DSH's patch dialect a plain `- id:` row only overrides existing entries and can never add a new plugin):
 
 ```yaml
 - insert:
     - id: dsh-mcp-manager
-      name: dsh-mcp-manager
-      config:
-        version: 1
+      name: '@xxxyz/dsh-mcp-manager'
 ```
 
+> You don't need to write this row manually — `dsh plugin add` inserts it automatically via the bundle patch (see `cordis.patch.yml`).
+
 ## 🏗️ Architecture
 
 - **Host half** (`src/index.ts` → `lib/index.js`, an object-form Cordis plugin `{name, inject, apply}`): `inject` declares `timer/fs/settings/sandboxPolicy/webServer/tools` — the framework guarantees they are ready and reloads the plugin if one disappears, which is how the plugin survives DSH upgrades. Registers four model tools (`ctx.tools.register(defineTool(...))`) and the exact route `POST /dsh-mcp-manager/api` (scoped cleanup via `ctx.effect`); line-level CRUD on `cordis.patch.yml` (mini YAML parser + per-file write lock).
 - **Browser half** (`lib/client.js`, ModuleLoader CJS bundle): registers the Settings → MCP 管理 page (`settings.section` slot, order 16) and talks to the host through same-origin `fetch('/dsh-mcp-manager/api')` — it never touches the filesystem directly.
-- **Loader row**: written into the profile's `cordis.patch.yml`; the client-modules service scans enabled entries and serves the client bundle.
-- **Installers**: `install.mjs` (cross-platform core) / `install.ps1` / `install.sh`, plus matching `uninstall.*`; the npm package `@xxxyz/dsh-mcp-manager` exposes them as bins (`dsh-mcp-manager` / `dsh-mcp-manager-uninstall`).
+- **Loader row**: inserted automatically by `dsh plugin add`'s bundle patch; the client-modules service scans enabled entries and serves the client bundle.
 
 ## 🛠️ Development
 

package/cordis.patch.yml

@@ -1,7 +1,32 @@
-# Bundle patch layer for `dsh plugin add` installs: pnpm installs the scoped
-# package as @xxxyz/dsh-mcp-manager, so the insert row names the scoped
-# package. The loader-entry installer (install.mjs) mounts the same plugin
-# under `dsh-mcp-manager` — both names are registered by the client bundle.
+# Bundle patch layer for the official CLI install:
+#
+#   dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest
+#
+# `dsh plugin add` reconciles `dsh.profile.bundles` against installed packages
+# and, seeing the `dsh.bundle.patch` declaration in package.json, appends
+# `@xxxyz/dsh-mcp-manager` to the bundle stack. The profile boot then merges
+# THIS patch (a single `insert` of the plugin row). No profile file edits
+# needed — one command installs and mounts.
+#
+# Double-mount guard: a legacy loader row (the removed install.mjs channel,
+# id `mcp-manager`, name `dsh-mcp-manager`) or an aggregate bundle may already
+# mount this plugin under a different entry id. Two mounts both register the
+# /dsh-mcp-manager/api route and fail the whole plugin tree at boot
+# ("duplicate prefix route"). The `!!js` disabled expression backs THIS row
+# off when another *enabled* entry already mounts the plugin; the existing
+# instance then owns the API. The loader evaluates the expression at entry
+# activation — the full entry tree is composed by then, so user-layer
+# (profile cordis.patch.yml) rows are visible too.
+#
+# ORDER MATTERS — do not move `!e.disabled` ahead of the id/name checks.
+# `Entry.disabled` is an uncached getter that re-evaluates the expression,
+# so touching `e.disabled` of THIS entry re-enters this very expression
+# (infinite recursion → "Maximum call stack size exceeded" at boot). The
+# `id !==` check short-circuits on our own row and the `name` check
+# short-circuits on every unrelated entry (e.g. dsh-better-sidebar's own
+# guard), so `!e.disabled` is only ever read on a genuinely matching
+# legacy/aggregate row (a plain boolean, no re-entry).
 - insert:
     - id: dsh-mcp-manager
       name: '@xxxyz/dsh-mcp-manager'
+      disabled: !!js "[...ctx.loader.entries()].some((e) => e.options.id !== 'dsh-mcp-manager' && (e.options.name === 'dsh-mcp-manager' || e.options.name === '@xxxyz/dsh-mcp-manager') && !e.disabled)"

package/lib/client.js

@@ -47,7 +47,10 @@ const factory = (require) => {
       '.mcpm-dialog{background:color-mix(in srgb, currentColor 8%, transparent);backdrop-filter:blur(14px) saturate(1.2);border:1px solid rgba(128,128,128,.5);border-radius:10px;padding:16px 18px;min-width:300px;max-width:440px;box-shadow:0 10px 34px rgba(0,0,0,.35);color:inherit}' +
       '.mcpm-dialog-title{font-size:14px;font-weight:600;margin-bottom:8px}' +
       '.mcpm-dialog-body{font-size:12px;opacity:.88;line-height:1.7;margin-bottom:16px;word-break:break-all}' +
-      '.mcpm-dialog-actions{display:flex;justify-content:flex-end;gap:8px}'
+      '.mcpm-dialog-actions{display:flex;justify-content:flex-end;gap:8px}' +
+      '.skm-search{font-size:12px;padding:5px 8px;border-radius:6px;border:1px solid rgba(128,128,128,.5);background:transparent;color:inherit;width:100%;box-sizing:border-box}' +
+      '.skm-group-title{font-size:12px;font-weight:600;opacity:.85;margin-top:4px;padding-bottom:2px;border-bottom:1px solid rgba(128,128,128,.25)}' +
+      '.skm-provider-title{font-size:12px;font-weight:600;cursor:pointer;user-select:none;margin-top:4px;opacity:.9}'
 
     function ensureCss() {
       if (typeof document === 'undefined') return
@@ -297,15 +300,97 @@ const factory = (require) => {
           { name: 'settings.section', id: 'mcp-manager', order: 16, label: 'MCP 管理' },
           () => React.createElement(MCPPage)
         ))
+
+        // Grouping: the registry's built-in providers are "filesystem"
+        // (project/user/custom/bundled roots) and "runtime" (register());
+        // any other provider name means a plugin-provided skill
+        // (e.g. superpowers-dsh). skmLevelOf is mutually exclusive.
+        function skmLevelOf(s) {
+          if (s.source === 'project-dsh' || s.source === 'project-agents') return '项目级'
+          if (s.source === 'runtime') return '运行时'
+          if (s.source === 'user-dsh' || s.source === 'user-agents') return '用户级'
+          if (s.source === 'bundled') return '内置'
+          if (s.source === 'custom' && s.provider === 'filesystem') return '自定义'
+          return '插件自带'
+        }
+        const SKM_GROUPS = ['项目级', '运行时', '自定义', '用户级', '内置', '插件自带']
+        function SkillPage() {
+          const [state, setState] = React.useState({ loading: true, error: null, skills: [] })
+          const [q, setQ] = React.useState('')
+          const [busy, setBusy] = React.useState(null)
+          const [msg, setMsg] = React.useState(null)
+          const [hidden, setHidden] = React.useState({})
+          const toggleGroup = (key) => setHidden((h) => ({ ...h, [key]: !h[key] }))
+          const refresh = () => {
+            apiCall('skill-list', {}).then((res) => {
+              setState({ loading: false, error: res && res.ok ? null : ((res && res.error) || '加载失败'), skills: (res && res.skills) || [] })
+            }).catch((e) => setState({ loading: false, error: String((e && e.message) || e), skills: [] }))
+          }
+          React.useEffect(() => { refresh() }, [])
+          React.useEffect(() => ctx.interval(() => refresh(), 5000), [])
+          React.useEffect(() => { if (!msg) return; return ctx.timeout(() => setMsg(null), 3000) }, [msg])
+          const toggle = (skill) => {
+            const enabled = skill.provider === 'dsh-mcp-manager-override'
+            setBusy(skill.name)
+            apiCall('skill-toggle', { name: skill.name, enabled }).then((res) => {
+              if (res && res.ok) { setMsg({ kind: 'ok', text: (enabled ? '已启用 ' : '已禁用 ') + skill.name }); refresh() }
+              else setMsg({ kind: 'err', text: (res && res.error) || '操作失败' })
+            }).catch((e) => setMsg({ kind: 'err', text: String((e && e.message) || e) })).then(() => setBusy(null))
+          }
+          const query = q.trim().toLowerCase()
+          const visible = state.skills.filter((s) => !query || (s.name + ' ' + (s.description || '')).toLowerCase().includes(query))
+          return React.createElement('div', { className: 'mcpm-wrap' },
+            React.createElement('h2', null, 'Skills 管理'),
+            React.createElement('div', { className: 'mcpm-sub' }, '查看与启停 DSH 技能（按层级分组，禁用即时生效，无需重启）'),
+            msg && React.createElement('div', { className: 'mcpm-msg ' + msg.kind }, msg.text),
+            React.createElement('input', { className: 'skm-search', placeholder: '搜索技能名称或描述…', value: q, onChange: (e) => setQ(e.target.value) }),
+            state.loading ? React.createElement('div', { className: 'mcpm-sub' }, '加载中…') :
+            state.error ? React.createElement('div', { className: 'mcpm-msg err' }, state.error) :
+            SKM_GROUPS.map((key) => {
+              const items = visible.filter((s) => skmLevelOf(s) === key)
+              if (!items.length) return null
+              // within a level, sub-group by provider (collapsible)
+              const byProvider = {}
+              items.forEach((s) => { const p = s.provider || 'unknown'; (byProvider[p] = byProvider[p] || []).push(s) })
+              const providerKeys = Object.keys(byProvider).sort()
+              return React.createElement(React.Fragment, { key },
+                React.createElement('div', { className: 'skm-group-title' }, key + '（' + items.length + '）'),
+                providerKeys.map((pk) => {
+                  const pItems = byProvider[pk]
+                  const collapsed = !query && !!hidden[pk]
+                  return React.createElement(React.Fragment, { key: pk },
+                    React.createElement('div', { className: 'skm-provider-title', onClick: () => toggleGroup(pk), title: '点击折叠/展开' },
+                      (collapsed ? '▸ ' : '▾ ') + pk + '（' + pItems.length + '）'),
+                    collapsed ? null : pItems.map((s) => {
+                      const overridden = s.provider === 'dsh-mcp-manager-override'
+                      const available = !!(s.invocation && s.invocation.modelInvocable)
+                      return React.createElement('div', { className: 'mcpm-row', key: s.name },
+                        React.createElement('div', { className: 'mcpm-row-head' },
+                          React.createElement('span', { className: 'mcpm-name' }, s.name),
+                          React.createElement('span', { className: 'mcpm-chip ' + (available ? 'on' : 'off') }, available ? '可用' : '禁用'),
+                          overridden && React.createElement('span', { className: 'mcpm-chip warn' }, '手动禁用'),
+                          React.createElement('span', { className: 'mcpm-chip live' }, s.provider)),
+                        React.createElement('div', { className: 'mcpm-sub' }, s.description || ''),
+                        React.createElement('div', { className: 'mcpm-row-actions' },
+                          React.createElement('button', { className: 'mcpm-btn', disabled: busy === s.name, onClick: () => toggle(s) }, overridden ? '启用' : '禁用')))
+                    }))
+                }))
+            }))
+        }
+
+        slots.inject('settings.section', () => slots.register(
+          { name: 'settings.section', id: 'skill-manager', order: 17, label: 'Skills 管理' },
+          () => React.createElement(SkillPage)
+        ))
       },
     }
     return module.exports
   }
 
-  // Register the client bundle under both names: the loader-entry install
-  // (install.mjs) mounts it as `dsh-mcp-manager`, while `dsh plugin add`
-  // (via the dsh.bundle patch) installs the scoped npm package and mounts it
-  // as `@xxxyz/dsh-mcp-manager`. The boot graph row id must match the id the
-  // bundle registers, so both are registered — the unused one is inert.
+  // Register the client bundle under both names: the official CLI mounts the
+  // bundle under the loader entry id `dsh-mcp-manager` (cordis.patch.yml
+  // insert row), and the scoped npm package is `@xxxyz/dsh-mcp-manager`. The
+  // boot graph row id must match the id the bundle registers, so both are
+  // registered — the unused one is inert.
   window.__ModuleLoader__.load({ id: 'dsh-mcp-manager', factory })
   window.__ModuleLoader__.load({ id: '@xxxyz/dsh-mcp-manager', factory })