@xxxyz/dsh-mcp-manager 2.2.0 → 2.2.1

package/lib/index.js

@@ -115,14 +115,27 @@ export default {
             for (const name of await readState()) {
                 if (overrideSkills.has(name))
                     continue;
-                const def = (await ctx.skills.get(name)) || (await findUserSkill(name));
+                // Migrate pre-fix state entries: user-level skills are file-driven now
+                // (the scoped layer ignores global overrides), so rewrite the SKILL.md
+                // frontmatter and drop the stale state entry instead of creating an
+                // override that cannot shadow them.
+                const userDef = await findUserSkill(name);
+                if (userDef) {
+                    await editUserSkillInvocation(name, false);
+                    changed = true;
+                    continue;
+                }
+                const def = await ctx.skills.get(name);
                 if (!def)
                     continue;
                 overrideSkills.set(name, { ...def, provider: OVERRIDE_PROVIDER, invocation: { modelInvocable: false, userInvocable: false } });
                 changed = true;
             }
-            if (changed && skillProviderControl)
-                skillProviderControl.invalidate();
+            if (changed) {
+                await saveState([...overrideSkills.keys()]);
+                if (skillProviderControl)
+                    skillProviderControl.invalidate();
+            }
         }
         ;
         ctx.on('skills/change', () => { void ensureRestored(); });
@@ -275,6 +288,38 @@ export default {
             const skills = snap.skills.concat(extra).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
             return { ok: true, skills, complete: snap.complete !== false };
         }
+        // Toggle a USER-LEVEL filesystem skill by editing its SKILL.md frontmatter.
+        // This is the only mechanism that works: the rank-0 override provider lives
+        // in the global layer, but ctx.skills reads merge the viewing scope's chain
+        // and the scoped layer's filesystem entry WINS the duplicate name outright
+        // (collectFresh does `merged.set(name, entry)` per layer, last wins) — so an
+        // override can never hide a user skill from the / menu. Editing the source
+        // file makes the real dsh-skill-filesystem provider (which hot-reloads via
+        // its watcher) return the disabled invocation on every scope.
+        async function editUserSkillInvocation(name, enabled) {
+            const def = await findUserSkill(name);
+            if (!def || !def.path)
+                return { ok: false, error: '技能不存在: ' + name };
+            const raw = await fs.readText(await fs.resolve(def.path)).catch(() => '');
+            if (!raw)
+                return { ok: false, error: '无法读取技能文件: ' + def.path };
+            // Strip any existing invocation flags from the frontmatter block, then
+            // re-append the ones matching the requested state. Everything else —
+            // body content and other frontmatter keys — is preserved verbatim.
+            const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
+            if (!fmMatch)
+                return { ok: false, error: '技能文件缺少 frontmatter: ' + def.path };
+            const fmLines = fmMatch[1].split(/\r?\n/);
+            const rest = raw.slice(fmMatch[0].length);
+            const stripped = fmLines.filter((line) => !/^(user-invocable|disable-model-invocation):/i.test(line.trim()));
+            if (!enabled) {
+                stripped.push('user-invocable: false');
+                stripped.push('disable-model-invocation: true');
+            }
+            const next = '---\n' + stripped.join('\n') + '\n---' + rest;
+            await fs.writeText(await fs.resolve(def.path), next);
+            return { ok: true };
+        }
         async function skillToggle(args) {
             const name = String(args.name || '').trim();
             if (!name)
@@ -284,6 +329,18 @@ export default {
             await ensureRestored();
             const enabled = args.enabled !== false;
             return withWriteLock(async () => {
+                // User-level skills bypass the override provider entirely — editing the
+                // SKILL.md frontmatter is what makes the real provider (and thus the
+                // / menu) see the change.
+                const userDef = await findUserSkill(name);
+                if (userDef) {
+                    // Also drop a stale override row if one was created pre-fix.
+                    if (overrideSkills.delete(name)) {
+                        await saveState([...overrideSkills.keys()]);
+                        skillProviderControl?.invalidate();
+                    }
+                    return editUserSkillInvocation(name, enabled);
+                }
                 if (enabled) {
                     if (overrideSkills.delete(name)) {
                         await saveState([...overrideSkills.keys()]);
@@ -292,7 +349,7 @@ export default {
                 }
                 else {
                     if (!overrideSkills.has(name)) {
-                        const def = (await ctx.skills.get(name)) || (await findUserSkill(name));
+                        const def = await ctx.skills.get(name);
                         if (!def)
                             return { ok: false, error: '技能不存在: ' + name };
                         overrideSkills.set(name, { ...def, provider: OVERRIDE_PROVIDER, invocation: { modelInvocable: false, userInvocable: false } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xxxyz/dsh-mcp-manager",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "DSH-standard MCP manager plugin: Settings UI + HTTP API + model-facing mcp_manager_* tools. Install with one command: dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest",
   "type": "module",
   "main": "lib/index.js",