dsh-armory 2.4.1 → 2.4.2

package/README.en.md

@@ -5,7 +5,7 @@
 > **The all-in-one control board for DeepSeek Harness**: MCP servers · skills · experts · plugins · tool-usage ledger · four markets — browse, search, install and summon in one place.
 > Forked from [Imzl-zl/dsh-mcp-manager-ui](https://github.com/Imzl-zl/dsh-mcp-manager-ui) (MIT) and extended into a full armory.
 >
-> **New in v2.4.1**: SkillHub skill details now show the real name and full summary, "Source homepage" opens the public skill page instead of the 405 API endpoint, and the floating button can be hidden (it also steps aside while the board is open) — issue #4. See the [changelog](.github/release-notes/v2.4.1.md).
+> **New in v2.4.2**: documentation release — the README (both languages) now matches what actually ships: the three entry seats with six modes, how to hide the floating button, and the v2.4.1 SkillHub detail fixes. The runtime code is byte-identical to v2.4.1. See the [changelog](.github/release-notes/v2.4.2.md).
 
 <p align="center">
   <a href="https://github.com/2026heshao/dsh-armory/stargazers"><img src="https://img.shields.io/github/stars/2026heshao/dsh-armory?style=social" alt="stars"></a>
@@ -26,7 +26,7 @@ dsh plugin --profile web add dsh-armory
 dsh plugin --profile web add github:2026heshao/dsh-armory
 ```
 
-Restart DSH, then open **Skills · MCP · Experts** from the global panel list at the top of the sidebar (or the floating button bottom-right). Desktop users on the `desktop` profile: swap `--profile web` for `--profile desktop`.
+Restart DSH, then open **Big Fish Armory** from the global panel list at the top of the sidebar (next to "Plugins") — or use the floating button bottom-right, or the sidebar bottom entry. Desktop users on the `desktop` profile: swap `--profile web` for `--profile desktop`.
 
 ## What it solves
 
@@ -35,6 +35,9 @@ Restart DSH, then open **Skills · MCP · Experts** from the global panel list a
 | MCP config means hand-editing YAML with no feedback on whether it connects | Visual panel: status, tool schemas, enable/disable, reconnect — global & per-project scopes, project changes apply to live sessions instantly |
 | Installing skills means hunting for `SKILL.md` repos everywhere | **Direct markets**: SkillHub (190k+ skills), WorkBuddy connectors (316) — search, filter, one-click install with per-file sha256 verification |
 | You install a skill from the market, then cannot find it on the board or tell which one is new | **Recognisable installs**: cards show "installed …" with a 7-day highlight and relative time; the filter bar lays skills out newest-first as a "recently installed" timeline; when the board name differs from the market name, the original is shown |
+| The list card shows a summary, but opening the detail makes it blank and the title falls back to the slug | **Details read the right fields**: SkillHub puts the name and summary under the response's `skill` object (`displayName` / `summary_zh`); empty values from the detail endpoint never overwrite what is already on screen, and the list summary shows while loading |
+| The detail's "homepage" opens `api.skillhub.cn` — a JSON endpoint a browser cannot render (405) | **Links go where browsers can go**: API URLs are rewritten to the public page `https://skillhub.cn/<namespace>/<slug>`, and the button is not rendered at all when there is no browsable page |
+| The floating button sits on top of board content and offers no way to close it | **You own the entries**: right-click or long-press the button to hide it (with a hint on how to reopen), it steps aside while the board occupies the centre column, and the six entry modes guarantee you are never left with no way in |
 | Every MCP's tool descriptions eat context tokens; zero-use tools sit there for free | **Tool Tailor**: scans local session logs for per-tool call counts / errors / latency, plus a skill-level usage ledger; prune dead tools with one click |
 | Migrating from Claude/Cursor/VS Code means copying config by hand | Detects local configs from 11 clients and imports them with a preview |
 | OAuth-protected or key-protected servers and plugins just fail, with no hint why | **Plugin market** (the DSH community list) with per-entry installability, **one-click MCP OAuth** (RFC 9728 → 8414 → 7591 → 7636 PKCE → 8707, three callback fallbacks ending at "paste a token"), and a **credential prompt before install** that fills `${...}` placeholders so the server works on first connect |
@@ -105,7 +108,7 @@ Experts (WorkBuddy expert center, 429 experts / 15 industries; category filter +
 - Filter by transport (HTTP/stdio) and status, search by name/command/URL
 - Enable, disable, reconnect, add, edit, remove; reveal masked credentials temporarily with the eye button and copy with one click
 - **Global + project scopes**: global servers live in the Web profile and are available to every project; project servers live in that project's `.dsh/mcp.json` and are visible only to its sessions. A project can also hide any global MCP
-- **Two entry points, one panel**: the draggable floating button (position remembered) and the official sidebar entry share the same state; the "Entry" control in the panel header can keep just one of them (never neither)
+- **Three entry seats, six modes**: the **Big Fish Armory** row in the global panel list at the top of the sidebar (the host's own mechanism, next to "Plugins"), the draggable floating button (position remembered) and the sidebar bottom entry all open the same panel. The "Entries" menu in the panel header switches between six combinations (two / one / three seats); **all three can never be off**, and the floating button cannot be hidden while it is your only entry (since 2.4.1 you can also right-click or long-press the button itself to hide it)
 - **WB Market (direct installs)**: a third board tab with two markets in one place —
   - **Connectors (MCP)**: reads the official WorkBuddy distribution ZIP (`static.workbuddy.cn`, the same source the WorkBuddy desktop app uses) on demand — 316 connectors, 242 installable (mostly streamable-http), while 74 CLI-based or WorkBuddy-token-dependent ones are honestly labeled "view only" with the reason. Installing = merging the connector's `mcpServers` into your MCP config through the same pipeline as "Import JSON" (admission, duplicate skip, entry-id reservation), in either global or project scope. The ZIP is ETag-cached under `~/.dsh/wb-market/` and decompressed with Node's built-in zlib — **zero new runtime dependencies**
   - **Skills (SkillHub)**: reads the public SkillHub API (`api.skillhub.cn`, 190k+ skills) with keyword search, four sort orders, and pagination; details include publisher verification and security-scan status. Installing = downloading file-by-file, verifying each against the manifest's sha256, and writing into `~/.agents/skills/` (the same discovery scope as the official skill subsystem) — effective immediately. Installed skills show an "installed" badge, support one-click uninstall, and reinstalling updates them. After an install or uninstall the **Skill** tab's count badge and board list realign with the new set immediately — no tab switch or panel reopen needed. Downloads sorting is now done **within the current page** (the upstream `sortBy=downloads` hangs), while the other sorts still go remote; each request gives up after 15s and reports a localized error
@@ -136,6 +139,8 @@ Experts (WorkBuddy expert center, 429 experts / 15 industries; category filter +
 - **Skill uninstall (new in 2.2.0)**: skills in user-level / project-level directories can be deleted from the detail pane (inline second confirmation, **permanent, no undo**), while skills shipped with DSH, registered at runtime, or living in custom directories stay read-only and say so. The host only exposes read endpoints, so removal is handled by this plugin's `removeSkill`: source allowlist → strict root containment → parent-directory realpath → symlinks unlinked without touching their targets → the folder must contain `SKILL.md` and stay under the root
 - **Live skill-set refresh (new in 2.2.0)**: installing or uninstalling from the market, and uninstalling from the board, all broadcast on a module-level change bus. The top **Skill** badge and the board list subscribe to the same bus and re-read the truth, with a sequence guard on the badge fetch so rapid toggles cannot roll the number back. The new set is reflected immediately — no tab switch or panel reopen
 - **Recognisable skill installs (new in 2.4.0)**: every Skill card / list row shows an "installed …" badge — green with relative time within 7 days ("installed 3 hours ago"), "N days ago" within 30 days, an absolute date beyond. The timestamp prefers the first-install time recorded in the install-state ledger, then the directory creation time, then its mtime; skills shipped with DSH or registered at runtime have no install event and show no badge. The filter bar adds a **recently installed** timeline (newest first), and when a board name (from `SKILL.md`'s `name:`) differs from the market name recorded in the ledger, the card carries a "from market: original name" badge and the detail pane adds an original-name row. Data comes from the new `skillInstallInfo` RPC (the host scans the standard skill roots and reads only the first 4KB of each `SKILL.md`); the host must be restarted once to register it, and the board says so explicitly instead of showing nothing
+- **Skill details and market homepage fixed (new in 2.4.1)**: SkillHub's detail endpoint keeps the name and summary under the `skill` object (`displayName` / `summary_zh`), while the old mapping only read the root — so the detail dialog showed the slug as the title and an empty body. Values now fall back through `skill.displayName → root name → slug` and `skill.summary_zh → skill.summary → legacy fields`, icon / created date / category / source / publisher come from the same place, and merging the response into the list entry **never lets empty strings overwrite what is already shown** (`0` and `false` still win). The summary from the list is visible while the detail loads. A `homepage` pointing at `api.skillhub.cn` (a JSON API that returns 405 in a browser) is rewritten to `https://skillhub.cn/<namespace>/<slug>`, with a second guard at render time, and feedback links prefer the GitHub repository when one can be resolved (issue #4)
+- **The floating button can be hidden, and it steps aside for the board (new in 2.4.1)**: right-click or long-press (about half a second, works with touch and stylus) opens a menu with **Hide floating button**, followed by a 6-second hint saying where to reopen it. When the board occupies the centre column the button collapses automatically instead of covering list and detail text, and returns when you leave the board — without changing your chosen mode. If the button is your only remaining entry the item is disabled and explains why: pick another mode in the "Entries" menu before hiding it, so you can never end up with an armory that cannot be opened
 - **Custom suites (new in 2.2.0)**: bundle skills you use together. The **Suites** button in the Skill board toolbar opens a manager: pick skills on the left, arrange them on the right (click **+** or drag one in, drag to reorder, delete with an inline confirmation), and one save overwrites the whole set into `~/.dsh/armory/suites.json` (staging + atomic rename; invalid input is rejected without touching the file). The composer's Skills submenu shows a suite group at the top — one click expands the suite in member order into multiple `/name` tokens in the draft. Limits: 100 suites, 40 members each; members count individually toward "recently used" rather than the suite name
 - **Marketplace registry (new in 2.0.0)**: market sources are no longer hard-coded — they live in `~/.dsh/armory/marketplaces.json` (`REGISTRY_VERSION = 1`), fall back to the built-in defaults when missing or corrupt, persist on first read, and can be added / edited / removed. Writes are staging + atomic rename
 - **Instant community list (new in 2.0.0)**: the last successful slim list is mirrored into `localStorage` (7 days / 4MB cap, older snapshot kept on quota errors), so the first paint renders the snapshot before the real result silently replaces it (zero network, zero IPC). When no source is reachable it says "showing the local cache" instead of an empty list
@@ -188,13 +193,21 @@ Details, local development installs, and troubleshooting: [docs/installation.md]
 
 ### Opening the panel
 
-Two entry points, one panel:
+Three entry seats, one panel:
 
+- **The "Big Fish Armory" row in the global panel list** (top of the sidebar): the host's official panel list, right next to "Plugins" — the primary entry;
 - **Floating button (bottom-right)**: draggable, position remembered;
-- **Sidebar entry "Skills · MCP · Experts"**: above "Settings" when expanded, icon-only in the 56px rail.
+- **Sidebar bottom entry**: a 42px row (icon + label) when the sidebar is expanded, an icon button once it collapses into the rail.
 
 The panel floats above the session; closing it ("Close" or Esc) does not affect the conversation.
 
+Which seats stay is chosen in the panel header's **Entries** menu, six modes: `Global panel + floating button (recommended)` (default) / `Global panel only (top-left, next to "Plugins")` / `Global panel + sidebar bottom entry (no floating button)` / `Floating button only` / `Sidebar bottom entry only` / `All three entries`. **All three can never be off** — the panel opens only from those seats, so the menu is a "keep at least one" combination rather than three independent switches. The choice lives in `localStorage`, so a different browser or cleared storage means picking again.
+
+Two self-service rules for the floating button (since 2.4.1):
+
+- **Right-click or long-press it** (about half a second) for a menu with **Hide floating button** — no hunt for the Entries menu. A 6-second hint then says where to reopen it. If the button is the only entry left, that item is greyed out and points you to the Entries menu: keep another seat before losing this one.
+- **It auto-collapses while the board occupies the centre column**: the button is an overlay and would sit on the list and detail text; it comes back as soon as you leave the board, and your mode is untouched.
+
 ### Global vs project
 
 Tabs switch between "Global" and each project:
@@ -222,6 +235,9 @@ The detail pane lists the tools a server currently registers; expand one for its
 **The panel says a server is "disabled", but the model reports `unknown tool "mcp__xxx__..."`.**
 That server is disabled, so it registers no tools. Enable it in the panel.
 
+**I upgraded but the skill detail is still blank, or the floating button behaves as before.**
+Check two things. First, that the new package actually landed: after `dsh plugin --profile web update dsh-armory`, look at the version at the bottom of the panel. Second, **quit DSH completely and start it again** — the market field mapping lives in host-side modules (`lib/wb-market.js`, `lib/index.js`) that are loaded once at process start, so reloading the panel only refetches the UI bundle. If one specific skill still has no summary, post its slug in an issue and that response gets checked on its own.
+
 **How do I upgrade? Why did the panel not notify me?**
 GitHub tag-pinned installs never cross versions — re-add with the new tag (`github:2026heshao/dsh-armory#v1.9.0`). The banner only queries this repo's GitHub Releases, at most once a day, is dismissible, and never acts on its own.
 

package/README.md

@@ -5,7 +5,7 @@
 > **DeepSeek Harness 的一体化管理看板**：MCP · 技能 · 专家 · 插件 · 工具账本 · 四大市场，浏览、搜索、一键安装、一键召唤。
 > fork 自 [Imzl-zl/dsh-mcp-manager-ui](https://github.com/Imzl-zl/dsh-mcp-manager-ui)（MIT），现已扩展为完整军械库。
 >
-> **最新 v2.4.1**：修复 SkillHub 技能详情空白、标题退化成 slug、来源主页指向 405 接口，以及悬浮按钮无法隐藏并遮挡看板（issue #4）。详见 [更新日志](.github/release-notes/v2.4.1.md)。
+> **最新 v2.4.2**：文档版——README（中 / 英）与实机功能对齐：三个入口席位与六种档位、悬浮按钮怎么隐藏、看板打开时它如何自动让位，以及 v2.4.1 的 SkillHub 详情修正都写进来了；运行代码与 v2.4.1 完全相同。详见 [更新日志](.github/release-notes/v2.4.2.md)。
 
 <p align="center">
   <a href="https://github.com/2026heshao/dsh-armory/stargazers"><img src="https://img.shields.io/github/stars/2026heshao/dsh-armory?style=social" alt="stars"></a>
@@ -26,7 +26,7 @@ dsh plugin --profile web add dsh-armory
 dsh plugin --profile web add github:2026heshao/dsh-armory
 ```
 
-装完**重启 DSH**，侧栏顶部「全局面板」里点 **技能 · MCP · 专家**（或右下角悬浮按钮）。桌面端装在 `desktop` profile 时把 `--profile web` 换成 `--profile desktop`。
+装完**重启 DSH**，侧栏顶部「全局面板」里点 **大肥鱼军械库**（或在右下角悬浮按钮、左侧栏底部入口，三个席位见下文）。桌面端装在 `desktop` profile 时把 `--profile web` 换成 `--profile desktop`。
 
 ## 它解决什么
 
@@ -35,6 +35,9 @@ dsh plugin --profile web add github:2026heshao/dsh-armory
 | MCP 配置要手改 YAML，改完不知道连没连上 | 可视化面板：状态、工具 Schema、启停、重连，全局与项目双作用域，项目级改完即对存活会话生效 |
 | 装技能要去各处翻 `SKILL.md` 仓库 | **市场直连**：SkillHub 19 万+ 技能、WorkBuddy 316 个连接器，搜索/筛选/一键安装，逐文件 sha256 校验 |
 | 在市场装了技能，回看板却找不到，也分不清哪个是刚装的 | **技能安装可辨识**：卡片标「装于 …」，7 天内高亮并给相对时间；筛选条按安装时间倒序成「最近安装」；看板名与市场原名不一致时标出「来自市场 原名」 |
+| 技能列表有两行摘要，点进详情反而整块空白，标题还退化成 slug | **详情读得到**：SkillHub 把名称与介绍放在接口的 `skill` 子对象（`displayName` / `summary_zh`），映射按此取值；详情回包里的空串不会覆盖已显示的内容，加载中也先给摘要 |
+| 详情里的「来源主页」跳过去是 `api.skillhub.cn`，浏览器只会拿到 405 | **链接点得开**：接口域名统一改写成 `https://skillhub.cn/<namespace>/<slug>` 公开页，渲染层再拦一道，拿不到可浏览主页就不渲染这个按钮 |
+| 右下角悬浮球盖住看板内容，又找不到关闭的地方 | **入口自己管**：右键 / 长按悬浮按钮即可隐藏（并提示从哪重开），看板占据中栏时自动让位；三个入口席位六档可切，不会出现「全关了自己开不了」 |
 | 每个 MCP 的工具描述都在吃上下文 token，零调用的工具白白占位 | **工具裁缝**：扫描本机会话日志统计每个工具的调用/错误/延迟，并给出技能维度的使用账本；死工具清单一键禁用 |
 | 从 Claude/Cursor/VS Code 迁移要逐条抄配置 | 自动检出 11 种客户端的本机配置，预览后一键导入 |
 | 插件散在宿主自带与社区清单两处，格式与可装性各不相同 | **插件页**：把 DSH 社区清单一并呈现并标明可装性（宿主自带组件单独标注），安装统一走宿主 `pluginManager`，装完明确提示需重启 |
@@ -91,7 +94,7 @@ dsh plugin --profile web add github:2026heshao/dsh-armory
 - 按传输方式（HTTP/stdio）与状态筛选，按名称/命令/URL 搜索
 - 启用、禁用、重连、添加、编辑、移除；需要时用眼睛临时揭示被掩码的凭据并一键复制
 - **全局 + 项目双作用域**：全局写 Web profile，一次注册所有项目可用；项目写该项目 `.dsh/mcp.json`，只该项目会话可见；项目里还能「屏蔽」某个全局 MCP
-- **两个入口，同一个面板**：右下角悬浮按钮（可拖拽、记忆位置）与官方侧栏入口（展开态在「设置」上方显示「MCP」，收起成 56px 轨道时只剩图标）共享同一开关状态；面板右上角「入口」可以把两者只留一个（不能都关）
+- **三个入口席位，六档可切**：左上角「全局面板」里的**大肥鱼军械库**一行（宿主官方机制，与「插件」同一套）、右下角悬浮按钮（可拖拽、记忆位置）、左侧栏底部入口（展开态 42px 行、收起成轨道时是圆钮）共用同一个面板；面板右上角「入口」菜单在六档之间切换（两个 / 一个 / 三个席位），**不能三个都关**，悬浮按钮若是唯一入口则不可单独隐藏（2.4.1 起还能右键 / 长按悬浮按钮直接隐藏它）
 - 导入本机其他客户端的 MCP 配置：自动检测 Claude Code、Codex（`config.toml`）、OpenCode（含 `.jsonc`）、pi、Claude Desktop、Cursor、Windsurf、VS Code、Gemini CLI、Roo Code 与跨工具的共享配置，逐个列出，点一条即导入；也能粘贴 Claude/Cursor/Cline/Roo 的 `mcpServers` 或 VS Code 的 `servers` JSON。写入前预览，支持「合并（同名更新）」与「替换」
 - 跟随 DSH 深色/浅色主题，适配窄屏与移动宽度
 - 更新提示与**一键升级**：有新版时在面板顶部显示可关闭的提示条（每天最多查一次，可用 `DSH_ARMORY_DISABLE_UPDATE_CHECK` 关闭）。点了「升级」才动，**不会自动升级**；升级由 DSH 官方的 pluginManager 执行，装完提示重启宿主生效。用 `link:` / `file:` / `github:` 装的本地开发副本不给按钮（那会把链接换成 npm 包）
@@ -127,6 +130,8 @@ dsh plugin --profile web add github:2026heshao/dsh-armory
 - **技能卸载（2.2.0 新增）**：用户级 / 项目级目录里的 skill 可在详情里直接卸载（就地二次确认、**永久删除且不可撤销**）；随 DSH 分发、运行时注册与自定义目录的 skill 只读，并说明不在可卸载范围内。宿主本身只提供读取接口，卸载由本插件的 `removeSkill` 完成：来源白名单 → 根目录严格包含性 → 父目录 realpath → 符号链接只 unlink 不碰目标 → 目录必须含 `SKILL.md` 且在根内
 - **技能集合实时刷新（2.2.0 新增）**：市场安装 / 卸载技能、看板自己卸载，三处都会向模块级变更总线广播；顶部 **Skill** 数量角标与看板列表订阅同一条总线，各自重读真值，角标重取带序号守卫，快速连点也不会被乱序回包回滚。装完 / 卸完立刻对新集合，不必切页或重开面板
 - **技能安装可辨识（2.4.0 新增）**：Skill 看板每张卡片 / 列表行显示「装于 …」——7 天内绿色高亮并给相对时间（「3 小时前装」），30 天内显示「N 天前装」，更早给绝对日期。时间优先取安装状态账本登记的首次安装时间，其次目录创建时间，最后目录修改时间；随 DSH 分发 / 运行时注册的技能没有安装事件，不显示徽标。筛选条新增「最近安装」时间线，按安装时间倒序平铺；看板名（取自 `SKILL.md` 的 `name:`）与账本登记的市场名不一致时，卡片出现「来自市场 原名」徽标，详情面板新增「市场原名」行。数据由新增 RPC `skillInstallInfo` 提供（宿主自扫标准技能根目录、只读每个 `SKILL.md` 头部 4KB 解析 `name:`），宿主需重启一次才注册；未注册时看板显式提示，不静默
+- **技能详情与市场主页修正（2.4.1 新增）**：SkillHub 的详情接口把名称与介绍放在 `skill` 子对象（`displayName` / `summary_zh`），旧映射只读根层，于是详情弹层标题退化成 slug、介绍整块空白。现在按 `skill.displayName → 根层 name → slug`、`skill.summary_zh → skill.summary → 旧字段` 逐级回退，图标 / 上架时间 / 分类 / 来源 / 发布方名也从 `skill` 与 `owner` 取；列表项与详情回包合并时**空串不再覆盖已显示的内容**（`0` 与 `false` 照旧保留），加载中就先显示列表里的摘要，不等接口。`homepage` 落在 `api.skillhub.cn`（浏览器打开是 405）时统一改写成 `https://skillhub.cn/<namespace>/<slug>` 公开页，渲染层再拦一道，接口地址不会再被当成网页交出去；能解析到 GitHub 仓库的，反馈链接优先指向仓库（issue #4）
+- **悬浮按钮可隐藏、看板打开时自动让位（2.4.1 新增）**：右键或长按（约半秒，触屏与手写笔同样可用）悬浮按钮弹出菜单，可直接「隐藏悬浮按钮」，隐藏后有一条 6 秒提示说明从哪儿重新打开；看板占据中栏时按钮自动收起，回到会话再出现，不再压在列表与详情文字上。若悬浮按钮是当前唯一入口，菜单里那一项会置灰并说明原因，先到「入口」换档位再隐藏——避免出现「按钮没了、面板也开不了」的死局。档位一览见下面的「打开面板」
 - **自定义套件（2.2.0 新增）**：把常一起用的 skill 打包成「套件」——Skill 看板工具栏的「套件」打开管理窗，左侧挑技能、右侧编排（点 **+** 或拖入添加，拖拽排序，删除就地二次确认），一次保存即整集合覆盖落盘到 `~/.dsh/armory/suites.json`（staging + rename 原子写，坏数据拒绝且原文件不动）。输入框召唤菜单的「技能」子菜单顶部会出现套件分组，点一次就按成员顺序把多个 `/name` 一并插进草稿。上限 100 个套件 / 每套 40 个成员；成员按各自的技能名进「最近使用」，不会把套件名记成一条孤立记录
 - **多市场注册表（2.0.0 新增）**：市场源不再硬编码，落 `~/.dsh/armory/marketplaces.json`（`REGISTRY_VERSION = 1`），缺失或损坏回落内置默认项、首读即落盘，支持增删改；写盘一律 staging + rename 原子替换
 - **社区目录秒开（2.0.0 新增）**：上次成功的精简清单镜像进浏览器 `localStorage`（7 天 / 4MB 上限，超配额保留旧快照），首屏先渲染快照再被真实结果静默替换（0 网络 0 IPC）；源不可达时明说「显示的是本地缓存」而非给空列表
@@ -169,14 +174,20 @@ dsh plugin --profile web remove dsh-armory
 
 ### 打开面板
 
-两个入口，同一个面板：
+三个入口席位，同一个面板：
 
+- **左上角「全局面板」里的「大肥鱼军械库」一行**：走宿主官方的面板列表，在「插件」旁边，是主入口；
 - **右下角悬浮按钮**：可拖拽移动，位置会被记住；
-- **侧栏「技能 · MCP · 专家」**：展开态在「设置」上方，侧栏收起成 56px 轨道时只剩图标。
+- **左侧栏底部入口**：展开态是 42px 的一行（图标 + 文字），侧栏收起成轨道时只剩一个圆钮。
 
 面板浮在会话之上，关掉它（右上角「关闭」或 Esc）不会影响会话。
 
-两个入口都能单独关掉：面板右上角「入口」里选 `悬浮按钮 + 侧栏入口`（默认）/ `仅悬浮按钮` / `仅侧栏入口`。**不能两个都关**——面板只能从这两个入口打开，所以这是一个三选一，而不是两个独立的开关。选择存在浏览器本地（localStorage），换浏览器或清缓存要重选一次。
+席位怎么留由面板右上角的「入口」菜单决定，共六档：`全局面板 + 悬浮按钮（推荐，默认）` / `仅全局面板（左上角，"插件"旁）` / `全局面板 + 侧栏底部入口（无悬浮按钮）` / `仅悬浮按钮` / `仅侧栏底部入口` / `三个入口全开`。**三个不能全关**——面板只能从这三个席位打开，所以它是「至少留一个」的组合，而不是三个互不相干的开关。选择存在浏览器本地（localStorage），换浏览器或清缓存要重选一次。
+
+悬浮按钮另外两条自助规则（2.4.1 起）：
+
+- **右键或长按（约半秒）它**弹出菜单，可直接「隐藏悬浮按钮」——不必再去面板里找「入口」；隐藏后有 6 秒提示说明从哪儿重新打开。若它是当前唯一入口，这一项会置灰并指路到「入口」菜单：先留好别的入口，再关这一个。
+- **看板占据中栏时它自动收起**：悬浮按钮是浮层，看板打开时正好盖住列表与详情的文字；离开看板页它就回来，不改变你选的档位。
 
 ### 全局 vs 项目
 
@@ -237,6 +248,9 @@ dsh plugin --profile web remove dsh-armory
 **项目行那些状态文案分别是什么意思？**
 它们把两件独立的事分开说：**连接在不在** —— `已连接 · 当前无会话使用（连接保留，下次直接用）`（最后一个会话结束了，连接按空闲策略留着）/ `已连接 · N 个会话在用 · M 工具` / `连接中…` / `连接失败` / `尚未建立连接（新会话自动挂载）`；**几个会话在用** —— 就是那句里的 `N 个会话在用`。旧版本的「待会话挂载」正是把这两件事压成一句，所以容易被读成"还没连上"。
 
+**升级后技能详情页还是空的，或者悬浮按钮的行为没变？**
+两步确认。先确认新包真装上去了：`dsh plugin --profile web update dsh-armory` 之后看面板底部的版本号。再**完全退出 DSH 重新启动**——市场的字段映射在宿主侧模块（`lib/wb-market.js`、`lib/index.js`）里，只在进程启动时加载一次，面板里刷新只会重取界面 JS，宿主那份映射仍是旧的。若只有某个具体技能的介绍仍然缺，欢迎把它的 slug 发到 issue 里，按那条响应单独对一次。
+
 **怎么升级？为什么面板没提示？**
 从 npm 装的直接 `dsh plugin --profile web update dsh-armory` 就会升小版本，也可以直接点面板提示条上的「升级」（同一件事，免去敲命令）。面板的提示条只查 GitHub Releases、每天最多一次、可关闭、不会自己动；固定 tag 安装的用户不会自动跨版本，需要用新 tag 重新 `add`（见 [安装与升级](docs/installation.md)）。
 
@@ -270,14 +284,14 @@ dsh plugin --profile web remove dsh-armory
 
 ```sh
 npm install --no-save yaml@2 eslint@9   # 测试与风格检查的唯一裸依赖（运行依赖全部由宿主提供）
-npm test                                # 全 42 套件（与 CI / 发版门槛同一条）
+npm test                                # 全 54 套件（与 CI / 发版门槛同一条）
 npm run lint                            # ESLint：no-undef / no-unused-vars / no-empty 等
 npm run test:e2e                        # 可选：用宿主补丁算法验证专家预设进入组合树
 dsh --profile web --dump-config         # 看 profile 的有效配置
 dsh web                                 # 起 Web 做真实操作验证
 ```
 
-`npm test` 跑的是 `test/run-all.mjs`，依次执行 **42** 个独立套件（各自是独立 node 进程，任一非零退出即整体失败）。套件是显式白名单而非 `node --test` 自动发现——`test/` 下还有带副作用的迁移脚本与需要宿主模块的端到端脚本，自动发现会误跑。
+`npm test` 跑的是 `test/run-all.mjs`，依次执行 **54** 个独立套件（各自是独立 node 进程，任一非零退出即整体失败）。套件是显式白名单而非 `node --test` 自动发现——`test/` 下还有带副作用的迁移脚本与需要宿主模块的端到端脚本，自动发现会误跑。
 
 | 分组 | 套件 | 覆盖 |
 | --- | --- | --- |
@@ -285,6 +299,7 @@ dsh web                                 # 起 Web 做真实操作验证
 | 契约与入口 | `contract-consistency` `client-entry` `host-import-sources` | 面板可调方法必须在 typert 声明 / client 契约数组 / 宿主方法集三处同时存在；三个入口「全关」不可表达；VS Code `${input:}` 降级 |
 | 客户端质量 | `client-i18n` `i18n-coverage` `whats-new-i18n` `error-boundary-copy` `persona-truncate` `tailor-window` | 中文皆包 `t()`；en-US 字典双向差集与 zh/非 zh 回落；更新日志英文覆盖逐条对齐（含缺译文回落）；崩溃详情可复制；persona 4000 预览阈值；工具裁缝时间窗四档 |
 | 工具裁缝趋势（2.2.0） | `tailor-timeline` `tailor-tax-ui` `tailor-cache-line` | 真实下发税的时间维度与跨度归因（无线上数据必须为 null 而非 0）；裁缝新字段在界面上的接线（vm 真跑源码片段）；账本缓存行只剩读数（「清空缓存」按钮已删，钉住不许复活） |
+| SkillHub 修正（2.4.1） | `skillhub-detail-fix` `skillhub-ux-fix` | 详情字段回退链与目录 / 详情映射（fetch 全替身，逐条对上 issue #4 的响应形状）；`skillhubHomepage` 域名改写与缺字段兜底；合并时空值不得覆盖、`0`/`false` 必须保留；`browsableHomepageUrl` 拦住接口域名；悬浮按钮订阅 / 看板激活自动收起 / 右键与长按菜单 / 唯一入口置灰 / 卸载清理（hooks 替身真渲染） |
 | 自定义套件（2.2.0） | `suites-registry` `suites-client` | 整集合覆盖 / 幂等 / 拒绝与截断两态；id 归属契约（保存后不分裂）、引用套件展开为多个 `/name`、三级写通道降级 |
 | 技能集合（2.2.0） | `skill-remove` `skill-refresh` | 卸载来源白名单与路径边界（根自身 / `..` 穿越 / 跨来源根 / 符号链接只删链接）；装 / 卸后角标与看板实时刷新、乱序回包守卫 |
 | 专家与团队 | `run-expert-manual` `session-persona` `team-bridge` `expert-card-actions` `recent-sort-regression` | 专家市场写链（真网目录 + 人设 + patch 往返，33 条断言）；会话级挂/换/摘；团队桥接；卡片按钮真值表；「最近使用」排序 |

package/lib/whats-new-en.js

@@ -448,6 +448,16 @@ export const WHATS_NEW_EN = {
       where: 'Floating button / Panel -> Entries',
     },
   ],
+  '2.4.2': [
+    {
+      text: '**Documentation release**: the README (Chinese and English) now matches what actually ships — the three entry seats with six modes, hiding the floating button by right-click or long-press, how it steps aside while the board occupies the centre column, and the 2.4.1 SkillHub detail fixes. Runtime code is identical to 2.4.1; nothing changes in behaviour',
+      where: 'Project README',
+    },
+    {
+      text: '**A new FAQ entry**: if the detail dialog is still blank after upgrading, confirm the installed package version and then quit DSH completely and start it again — the market field mapping lives in host-side modules loaded once at process start, so reloading the panel is not enough',
+      where: 'README -> FAQ',
+    },
+  ],
 };
 
 /**

package/lib/whats-new.js

@@ -516,4 +516,17 @@ export const WHATS_NEW = [
       },
     ],
   },
+  {
+    version: '2.4.2',
+    items: [
+      {
+        text: '**文档版**：README（中 / 英）与实机功能对齐——三个入口席位与六档切换、悬浮按钮右键 / 长按隐藏、看板占据中栏时自动让位，以及 2.4.1 的 SkillHub 详情修正都写进了说明；运行代码与 2.4.1 完全相同，本次没有任何行为变化',
+        where: '项目主页 README',
+      },
+      {
+        text: '**新增一条常见问题**：升级后详情页仍空白时，先确认已安装的包版本，再完全退出 DSH 重新启动——市场的字段映射在宿主侧模块里，只在进程启动时加载一次，只刷新面板不会生效',
+        where: 'README → 常见问题',
+      },
+    ],
+  },
 ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-armory",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "Unified Skill + MCP + Expert + Plugin board for DeepSeek Harness (desktop app and Web GUI) — custom skill suites, skill install/uninstall with live refresh, global panel page, JSON import, WorkBuddy connector & SkillHub & Expert & DSH community plugin market installs, MCP OAuth authorization, tool-usage tailor with wire-tax trends, and profile-backed Host Remote management.",
   "repository": {
     "type": "git",