@xxxyz/dsh-mcp-manager 2.2.0 → 2.2.2

package/lib/client.js

@@ -404,6 +404,11 @@ const factory = (require) => {
                     collapsed ? null : pItems.map((s) => {
                       const overridden = s.provider === 'dsh-mcp-manager-override'
                       const available = !!(s.invocation && s.invocation.modelInvocable)
+                      // User-level filesystem skills are view-only: they live in
+                      // the scoped layer which a global-layer override cannot
+                      // shadow, and the plugin sandbox blocks writing their
+                      // SKILL.md — so no enable/disable button is offered.
+                      const userLevel = s.source === 'user-dsh' || s.source === 'user-agents'
                       return React.createElement('div', { className: 'mcpm-row', key: s.name },
                         React.createElement('div', { className: 'mcpm-row-head' },
                           React.createElement('span', { className: 'mcpm-name' }, s.name),
@@ -412,7 +417,9 @@ const factory = (require) => {
                           React.createElement('span', { className: 'mcpm-chip live' }, s.provider)),
                         React.createElement('div', { className: 'mcpm-sub' }, s.description || ''),
                         React.createElement('div', { className: 'mcpm-row-actions' },
-                          React.createElement('button', { className: 'mcpm-btn', disabled: busy === s.name, onClick: () => toggle(s) }, overridden ? '启用' : '禁用')))
+                          userLevel
+                            ? React.createElement('span', { className: 'mcpm-note' }, '仅查看（由 DSH 文件系统管理）')
+                            : React.createElement('button', { className: 'mcpm-btn', disabled: busy === s.name, onClick: () => toggle(s) }, overridden ? '启用' : '禁用')))
                     }))
                 }))
             }))

package/lib/index.js

@@ -115,14 +115,26 @@ export default {
             for (const name of await readState()) {
                 if (overrideSkills.has(name))
                     continue;
-                const def = (await ctx.skills.get(name)) || (await findUserSkill(name));
+                // Pre-2.2.2 migration: user-level skills are view-only now. Drop any
+                // stale state entry without touching the file — the sandbox blocks
+                // writing ~/.dsh/skills from a profile plugin, and an override could
+                // never shadow the scoped-layer filesystem entry anyway.
+                const userDef = await findUserSkill(name);
+                if (userDef) {
+                    changed = true;
+                    continue;
+                }
+                const def = await ctx.skills.get(name);
                 if (!def)
                     continue;
                 overrideSkills.set(name, { ...def, provider: OVERRIDE_PROVIDER, invocation: { modelInvocable: false, userInvocable: false } });
                 changed = true;
             }
-            if (changed && skillProviderControl)
-                skillProviderControl.invalidate();
+            if (changed) {
+                await saveState([...overrideSkills.keys()]);
+                if (skillProviderControl)
+                    skillProviderControl.invalidate();
+            }
         }
         ;
         ctx.on('skills/change', () => { void ensureRestored(); });
@@ -130,11 +142,15 @@ export default {
         // dsh-skill-filesystem in the agent-preset SCOPED layer, which a scope-less
         // ctx.skills.snapshot({}) (global layer only) never reaches — so the
         // management page would silently hide them. Scan the directory ourselves
-        // and merge into skill-list. Toggling still goes through the rank-0
-        // override above: it shadows by NAME, so it works across layers — but
-        // ctx.skills.get(name) is also scope-less, hence the scan fallback when
-        // synthesizing the override definition. DSH_MCP_MANAGER_SKILLS_DIR
-        // overrides the directory (used by tests).
+        // and merge into skill-list.
+        //
+        // Disable/enable is NOT offered for user skills: (a) a rank-0 override in
+        // the global layer cannot shadow the scoped layer's filesystem entry
+        // (collectFresh merges layers; the nearest layer wins); (b) writing the
+        // SKILL.md frontmatter is blocked by the fs sandbox (profile plugin,
+        // workspace-write mode — ~/.dsh/skills is outside its scope). Users
+        // disable such skills by editing `user-invocable: false` in the file
+        // directly. DSH_MCP_MANAGER_SKILLS_DIR overrides the directory for tests.
         function userSkillsDir(home, sep) {
             const env = process.env.DSH_MCP_MANAGER_SKILLS_DIR;
             return env && env.trim() ? env.trim() : home + sep + 'skills';
@@ -275,6 +291,18 @@ export default {
             const skills = snap.skills.concat(extra).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
             return { ok: true, skills, complete: snap.complete !== false };
         }
+        // User-level skills (~/.dsh/skills) are VIEW-ONLY in this page. They are
+        // discovered by dsh-skill-filesystem in the agent-preset SCOPED layer; a
+        // scope-less snapshot({}) (global layer only) never sees them, so we scan
+        // the directory and merge rows into skill-list. Disable/enable is NOT
+        // supported for them: (a) the rank-0 override provider lives in the global
+        // layer and a scoped read merges the scope chain with the scoped entry
+        // winning the duplicate name outright (collectFresh last-wins), so an
+        // override cannot hide them from the / menu; (b) rewriting the SKILL.md
+        // frontmatter is blocked by the fs sandbox (profile plugin, workspace-write
+        // mode — ~/.dsh/skills is outside its scope). Users disable such skills by
+        // editing `user-invocable: false` in the file directly.
+        const USER_SKILL_VIEW_ONLY_ERROR = '用户级技能由 DSH 文件系统管理，仅支持查看；如需禁用请直接编辑 SKILL.md 的 user-invocable 字段';
         async function skillToggle(args) {
             const name = String(args.name || '').trim();
             if (!name)
@@ -284,6 +312,17 @@ export default {
             await ensureRestored();
             const enabled = args.enabled !== false;
             return withWriteLock(async () => {
+                const userDef = await findUserSkill(name);
+                if (userDef) {
+                    // Drop any stale override row created by older versions (pre-2.2.2
+                    // migration) — it can never shadow the scoped entry anyway, and the
+                    // toggle for user skills is not supported.
+                    if (overrideSkills.delete(name)) {
+                        await saveState([...overrideSkills.keys()]);
+                        skillProviderControl?.invalidate();
+                    }
+                    return { ok: false, error: USER_SKILL_VIEW_ONLY_ERROR };
+                }
                 if (enabled) {
                     if (overrideSkills.delete(name)) {
                         await saveState([...overrideSkills.keys()]);
@@ -292,7 +331,7 @@ export default {
                 }
                 else {
                     if (!overrideSkills.has(name)) {
-                        const def = (await ctx.skills.get(name)) || (await findUserSkill(name));
+                        const def = await ctx.skills.get(name);
                         if (!def)
                             return { ok: false, error: '技能不存在: ' + name };
                         overrideSkills.set(name, { ...def, provider: OVERRIDE_PROVIDER, invocation: { modelInvocable: false, userInvocable: false } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xxxyz/dsh-mcp-manager",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "DSH-standard MCP manager plugin: Settings UI + HTTP API + model-facing mcp_manager_* tools. Install with one command: dsh plugin --profile web add @xxxyz/dsh-mcp-manager@latest",
   "type": "module",
   "main": "lib/index.js",