dsh-desktop-kit 2.7.6 → 2.7.8

package/plugins/dsh-guardrails/client.js

@@ -0,0 +1,220 @@
+/**
+ * dsh-guardrails — Permissions settings page (read-only).
+ *
+ * The DSH permission picker remains the only way to change the mode. This page
+ * explains the effective preset and shows the kit's independent hard rules.
+ */
+window.__ModuleLoader__.load({
+  id: "dsh-guardrails",
+  factory: (require) => {
+    var module = { exports: {} };
+    var exports = module.exports;
+    Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+    const React = require("react");
+    const h = React.createElement;
+    const useEffect = React.useEffect;
+    const useState = React.useState;
+
+    const CSS = `
+      .pr-root{--pr-line:var(--dsw-alias-border-l1,rgba(20,40,36,.13));--pr-soft:var(--dsw-alias-bg-layer-1,#f4f7f5);--pr-panel:var(--dsw-alias-bg-layer-2,#fff);--pr-text:var(--dsw-alias-label-primary,#17231f);--pr-muted:var(--dsw-alias-label-secondary,#61706b);--pr-accent:var(--dsw-alias-brand-primary,#0f766e);display:flex;flex-direction:column;gap:20px;max-width:1040px;min-width:0;color:var(--pr-text)}
+      .pr-head{display:flex;align-items:flex-end;justify-content:space-between;gap:20px;flex-wrap:wrap}
+      .pr-eyebrow{margin:0 0 6px;font-size:11px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--pr-accent)}
+      .pr-title{margin:0;font-size:clamp(24px,2.6vw,32px);line-height:1.1;letter-spacing:-.025em;font-weight:680}
+      .pr-sub{margin:8px 0 0;max-width:68ch;color:var(--pr-muted);font-size:14px;line-height:1.5}
+      .pr-mode{padding:20px;border:1px solid var(--pr-line);border-radius:18px;background:linear-gradient(145deg,var(--pr-panel),var(--pr-soft));min-width:0}
+      .pr-mode-top{display:flex;justify-content:space-between;align-items:flex-start;gap:12px;flex-wrap:wrap}
+      .pr-mode h3{margin:0;font-size:24px;line-height:1.1;letter-spacing:-.03em}
+      .pr-chips{display:flex;gap:6px;flex-wrap:wrap}
+      .pr-chip{padding:3px 8px;border:1px solid var(--pr-line);border-radius:999px;background:var(--pr-panel);font-size:10px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--pr-muted);white-space:nowrap}
+      .pr-chip.sandbox{color:#0f766e;border-color:rgba(15,118,110,.25);background:rgba(15,118,110,.07)}
+      .pr-chip.approval{color:#9a3412;border-color:rgba(154,52,18,.22);background:rgba(154,52,18,.06)}
+      .pr-mode p{margin:8px 0 0;color:var(--pr-muted);font-size:13px;line-height:1.5;max-width:70ch}
+      .pr-note{display:flex;gap:8px;align-items:flex-start;margin-top:14px;padding:10px 12px;border:1px solid rgba(15,118,110,.16);border-radius:10px;background:rgba(15,118,110,.05);color:var(--pr-muted);font-size:12px;line-height:1.45}
+      .pr-note b{color:var(--pr-text);font-weight:650}
+      .pr-stats{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:10px}
+      .pr-stat{padding:14px 16px;border:1px solid var(--pr-line);border-radius:14px;background:var(--pr-panel);min-width:0}
+      .pr-stat b{display:block;font-size:24px;line-height:1.1;letter-spacing:-.03em;font-variant-numeric:tabular-nums}
+      .pr-stat span{display:block;margin-top:5px;color:var(--pr-muted);font-size:11px;font-weight:650;letter-spacing:.07em;text-transform:uppercase}
+      .pr-section{display:flex;flex-direction:column;gap:10px;min-width:0}
+      .pr-section h3{margin:0;font-size:15px;letter-spacing:-.01em}
+      .pr-section .pr-hint{margin:0;color:var(--pr-muted);font-size:12px;line-height:1.45}
+      .pr-presets{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px}
+      .pr-preset{padding:12px;border:1px solid var(--pr-line);border-radius:12px;background:var(--pr-panel);min-width:0}
+      .pr-preset.active{border-color:rgba(15,118,110,.35);background:rgba(15,118,110,.06)}
+      .pr-preset b{display:flex;justify-content:space-between;gap:8px;font-size:13px;align-items:center}
+      .pr-preset span{display:block;margin-top:4px;color:var(--pr-muted);font-size:11.5px;line-height:1.4}
+      .pr-preset em{font-style:normal;color:var(--pr-accent);font-size:10px;font-weight:700;letter-spacing:.08em;text-transform:uppercase}
+      .pr-list{display:flex;flex-direction:column;border:1px solid var(--pr-line);border-radius:14px;overflow:hidden;background:var(--pr-panel)}
+      .pr-row{display:flex;gap:10px;align-items:baseline;padding:9px 12px;border-top:1px solid var(--pr-line);font-size:12px;line-height:1.4;min-width:0}
+      .pr-row:first-child{border-top:0}
+      .pr-sev{flex:none;width:46px;font-size:9.5px;font-weight:750;letter-spacing:.08em;text-transform:uppercase}
+      .pr-sev.deny{color:#9f1239}.pr-sev.ask{color:#9a3412}
+      .pr-row code{flex:none;color:var(--pr-text);font:inherit;font-weight:650;white-space:nowrap}
+      .pr-row span{color:var(--pr-muted);overflow:hidden;text-overflow:ellipsis;min-width:0}
+      .pr-path{padding:9px 12px;border-top:1px solid var(--pr-line);font-size:12px;line-height:1.45;min-width:0}
+      .pr-path:first-child{border-top:0}
+      .pr-path b{display:block;font-size:12px}
+      .pr-path code{display:block;margin-top:3px;color:var(--pr-muted);font:11.5px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere}
+      .pr-error{padding:8px 10px;border:1px solid rgba(159,18,57,.16);border-radius:9px;background:rgba(159,18,57,.06);color:#9f1239;font-size:12px;line-height:1.4}
+      .pr-loading{color:var(--pr-muted);font-size:13px;padding:18px 0}
+      .pr-empty{padding:18px;border:1px dashed var(--pr-line);border-radius:14px;color:var(--pr-muted);font-size:12.5px;line-height:1.5;background:linear-gradient(160deg,var(--pr-soft),transparent 75%)}
+      .pr-foot{display:flex;justify-content:space-between;gap:12px;flex-wrap:wrap;color:var(--pr-muted);font-size:11px;line-height:1.4}
+      @media(max-width:860px){.pr-presets{grid-template-columns:1fr 1fr}.pr-stats{grid-template-columns:1fr 1fr}}
+      @media(max-width:520px){.pr-presets{grid-template-columns:1fr}.pr-stats{grid-template-columns:repeat(3,minmax(0,1fr));gap:8px}.pr-stat{padding:10px 12px}.pr-stat b{font-size:20px}.pr-stat span{font-size:9px;letter-spacing:.04em}.pr-root{gap:16px}.pr-mode{padding:16px}.pr-note{flex-direction:column;gap:4px}.pr-row{display:flex;flex-wrap:wrap;gap:4px 8px}.pr-row code{white-space:normal;overflow-wrap:anywhere}.pr-row span{flex-basis:100%;padding-left:0}}
+    `;
+
+    const SEVERITY_ORDER = { deny: 0, ask: 1 };
+
+    function currentSessionSelector(state) {
+      try {
+        const sessions = Object.values(state.byId || {});
+        const main = sessions.find((session) => session && session.retainedBy && (session.retainedBy.mainView || 0) > 0);
+        if (main) return main.id;
+        const ids = Array.isArray(state.ids) ? state.ids : [];
+        return ids.length > 0 ? ids[ids.length - 1] : undefined;
+      } catch { return undefined; }
+    }
+
+    async function call(ctx, operation, payload) {
+      let signal;
+      try { signal = AbortSignal.timeout(30000); } catch { signal = undefined; }
+      const result = await ctx.connection.rpc.call("/api", `dsh-guardrails/${operation}`, payload ?? {}, signal);
+      if (!result || result.ok !== true) throw new Error(result?.error?.message || "Ошибка RPC");
+      return result.value;
+    }
+
+    function errorOf(value) { return value instanceof Error ? value.message : String(value); }
+
+    function SandboxChip({ value }) {
+      const labels = {
+        "read-only": "Read only",
+        "workspace-write": "Workspace write",
+        "danger-full-access": "Full access",
+      };
+      return h("span", { className: "pr-chip sandbox" }, labels[value] || value || "sandbox");
+    }
+
+    function PermissionsSection(props) {
+      const [state, setState] = useState({ loading: true, error: null, data: null });
+      const useSessions = props && props.useSessions;
+      const useWorkspaces = props && props.useWorkspaces;
+      const sessionId = useSessions ? useSessions(currentSessionSelector) : undefined;
+      const workspaceSnapshot = useWorkspaces ? useWorkspaces((snapshot) => snapshot) : undefined;
+      const workspaces = Array.isArray(workspaceSnapshot?.items) ? workspaceSnapshot.items : [];
+      const workspace = workspaces.find((item) => Array.isArray(item.sessionIds) && item.sessionIds.includes(sessionId))
+        ?? workspaces.find((item) => Array.isArray(item.sessionIds) && item.sessionIds.length > 0)
+        ?? workspaces[0];
+      const cwd = typeof workspace?.path === "string" ? workspace.path : undefined;
+
+      useEffect(() => {
+        let cancelled = false;
+        (async () => {
+          try {
+            const data = await call(window.__DSH_GUARDRAILS_CTX__, "permissions", { sessionId, cwd });
+            if (!cancelled) setState({ loading: false, error: null, data });
+          } catch (error) {
+            if (!cancelled) setState({ loading: false, error: errorOf(error), data: null });
+          }
+        })();
+        return () => { cancelled = true; };
+      }, [sessionId, cwd]);
+
+      const preset = state.data?.preset;
+      const guard = state.data?.guard;
+      const options = Array.isArray(preset?.catalog?.options) ? preset.catalog.options : [];
+      const rules = Array.isArray(guard?.rules)
+        ? [...guard.rules].sort((a, b) => (SEVERITY_ORDER[a.severity] ?? 9) - (SEVERITY_ORDER[b.severity] ?? 9))
+        : [];
+      const protectedPaths = Array.isArray(guard?.protectedPaths) ? guard.protectedPaths : [];
+      const current = preset?.current || "custom";
+      const spec = preset?.spec;
+      const option = preset?.option;
+      const title = option?.name || current;
+
+      return h("section", { className: "pr-root", "aria-label": "Права и ограничения" },
+        h("div", { className: "pr-head" },
+          h("div", null,
+            h("p", { className: "pr-eyebrow" }, "Guardrails · effective permissions"),
+            h("h2", { className: "pr-title" }, "Права"),
+            h("p", { className: "pr-sub" }, "Что разрешено в этом чате и что kit запрещает в любом режиме. Режим переключается штатным picker DSH в композере — здесь только прозрачный срез."),
+          ),
+        ),
+        state.error ? h("div", { className: "pr-error", role: "alert" }, state.error) : null,
+        state.loading ? h("div", { className: "pr-loading" }, "Читаем эффективные права…") : null,
+        !state.loading && state.data ? h(React.Fragment, null,
+          h("div", { className: "pr-mode" },
+            h("div", { className: "pr-mode-top" },
+              h("div", null,
+                h("h3", null, title),
+                h("p", null, option?.description || spec?.description || "Эффективный режим этого чата."),
+              ),
+              h("div", { className: "pr-chips" },
+                h(SandboxChip, { value: spec?.sandbox }),
+                h("span", { className: "pr-chip approval" }, spec?.approval === "never" ? "approval never" : "approval ask"),
+              ),
+            ),
+            h("div", { className: "pr-note" },
+              h("b", null, "Не второй picker."),
+              h("span", null, "Смена режима — только в DSH. Эта страница не меняет разрешения и не хранит approvals; каждая карточка подтверждения остаётся в чате."),
+            ),
+          ),
+          h("div", { className: "pr-stats" },
+            h("div", { className: "pr-stat" }, h("b", null, rules.length), h("span", null, "жёстких правил")),
+            h("div", { className: "pr-stat" }, h("b", null, protectedPaths.length), h("span", null, "защищённых путей")),
+            h("div", { className: "pr-stat" }, h("b", null, options.length), h("span", null, "пресетов DSH")),
+          ),
+          h("div", { className: "pr-section" },
+            h("h3", null, "Пресеты DSH"),
+            h("p", { className: "pr-hint" }, "Доступны в композере. Текущий выделен; kit не дублирует переключатель."),
+            h("div", { className: "pr-presets" }, options.map((item) => h("div", { key: item.value, className: `pr-preset${item.value === current ? " active" : ""}` },
+              h("b", null, h("span", null, item.name || item.value), item.value === current ? h("em", null, "сейчас") : null),
+              h("span", null, item.description || "Без описания"),
+            ))),
+          ),
+          h("div", { className: "pr-section" },
+            h("h3", null, "Жёсткие правила kit"),
+            h("p", { className: "pr-hint" }, "Действуют даже в Full access. Отключаются только политикой guardrails, не режимом DSH."),
+            rules.length > 0 ? h("div", { className: "pr-list" }, rules.map((rule) => h("div", { className: "pr-row", key: rule.id },
+              h("span", { className: `pr-sev ${rule.severity}` }, rule.severity),
+              h("code", null, rule.id),
+              h("span", { title: rule.description }, rule.description || ""),
+            ))) : h("div", { className: "pr-empty" }, "Правила отключены политикой guardrails."),
+          ),
+          h("div", { className: "pr-section" },
+            h("h3", null, "Защищённые пути"),
+            h("p", { className: "pr-hint" }, "Запись, редактирование и удаление этих путей отклоняются до выполнения."),
+            protectedPaths.length > 0 ? h("div", { className: "pr-list" }, protectedPaths.map((entry) => h("div", { className: "pr-path", key: entry.id },
+              h("b", null, entry.id),
+              h("code", null, `${entry.match} /${entry.pattern}/`),
+            ))) : h("div", { className: "pr-empty" }, "Защищённые пути отключены."),
+          ),
+        ) : null,
+        h("div", { className: "pr-foot" },
+          h("span", null, guard?.policyPath ? `Политика: ${guard.policyPath}` : "Политика guardrails"),
+          h("span", null, guard ? (guard.enabled ? "hooks активны" : "hooks отключены") : ""),
+        ),
+      );
+    }
+
+    function apply(ctx) {
+      window.__DSH_GUARDRAILS_CTX__ = ctx;
+      ctx.effect(() => {
+        const style = document.createElement("style");
+        style.id = "dsh-guardrails";
+        style.textContent = CSS;
+        document.head.appendChild(style);
+        return () => style.remove();
+      }, "guardrails: styles");
+      ctx.effect(() => ctx.slots.inject("settings.section", () => ctx.slots.register({
+        name: "settings.section",
+        id: "guardrails",
+        order: 35,
+        label: () => "Права",
+      }, PermissionsSection)), "guardrails: settings");
+    }
+
+    exports.apply = apply;
+    exports.inject = ["slots", "connection"];
+    return module.exports;
+  },
+});

package/plugins/dsh-guardrails/index.js

@@ -21,6 +21,7 @@ import fs from "node:fs";
 import path from "node:path";
 
 import { createGuard, createHookState, registerHooks } from "./lib/hooks.js";
+import { registerPermissionsApi } from "./lib/api.js";
 import { resolveMode } from "./lib/modes.js";
 import {
   DEFAULT_COMMAND_RULES,
@@ -385,5 +386,10 @@ export function apply(ctx) {
   };
 
   ctx.tools.register(tool);
+  try {
+    ctx.inject(["connection"], (child) => registerPermissionsApi(child));
+  } catch (error) {
+    logger?.warn?.(`[guardrails] permissions UI skipped: ${messageOf(error)}`);
+  }
   logger?.info?.(`[guardrails] tool ready (policy: ${policyPath(env)})`);
 }

package/plugins/dsh-guardrails/lib/api.js

@@ -0,0 +1,103 @@
+/**
+ * Read-only Permissions RPC.
+ *
+ * DSH owns the permission picker and the approval card. This endpoint only
+ * reports the effective preset plus the kit's independent hard rules, so the
+ * Settings page never becomes a second source of truth.
+ */
+import { loadPolicy } from "./policy.js";
+
+export const RPC_NAMESPACE = "dsh-guardrails";
+const ROUTE_BASE = "/api/dsh-guardrails";
+
+function ok(rpcId, value) {
+  return Response.json({ type: "server-response", rpcId, result: { ok: true, value } });
+}
+
+function fail(rpcId, message) {
+  return Response.json({ type: "server-response", rpcId, result: { ok: false, error: { code: "guardrails/bad-request", message, details: {} } } });
+}
+
+async function envelope(request) {
+  const body = await request.json();
+  if (!body || body.type !== "client-request" || typeof body.rpcId !== "string" || typeof body.method !== "string") {
+    throw new Error("bad Connection envelope");
+  }
+  return { rpcId: body.rpcId, method: body.method, payload: body.payload ?? {} };
+}
+
+function liveSession(ctx, payload) {
+  const sessions = ctx.get?.("sessions");
+  if (payload?.sessionId) {
+    const direct = sessions?.get?.(payload.sessionId);
+    if (direct) return direct;
+  }
+  const live = typeof sessions?.list === "function" ? sessions.list() : [];
+  return live.length > 0 ? live[live.length - 1] : undefined;
+}
+
+function presetSnapshot(ctx, session) {
+  const service = ctx.get?.("permissionPresets");
+  if (!service) return { available: false, current: null, spec: null, option: null, catalog: { options: [], defaultPreset: null } };
+  let catalog = { options: [], defaultPreset: null };
+  try { catalog = service.catalog(); } catch { /* optional service */ }
+  let name = null;
+  try { name = session ? service.current(session) : null; } catch { name = null; }
+  let spec = null;
+  let option = null;
+  if (name) {
+    try { spec = service.resolve(name); } catch { spec = null; }
+    try { option = service.optionOf(name); } catch { option = null; }
+  }
+  return { available: true, current: name, spec, option, catalog };
+}
+
+function guardSnapshot(env) {
+  const loaded = loadPolicy({ env });
+  const rules = loaded.policy.rules
+    .filter((rule) => rule.enabled !== false)
+    .map((rule) => ({ id: rule.id, severity: rule.severity, description: rule.description }));
+  const protectedPaths = loaded.policy.protectedPaths
+    .filter((entry) => entry.enabled !== false)
+    .map((entry) => ({ id: entry.id, match: entry.match, pattern: entry.pattern, description: entry.description }));
+  return {
+    enabled: loaded.enabled,
+    killSwitch: loaded.killSwitch,
+    policyPath: loaded.path,
+    loadedFromFile: loaded.loadedFromFile,
+    error: loaded.error,
+    warnings: loaded.warnings,
+    rules,
+    protectedPaths,
+    hooks: loaded.policy.hooks,
+  };
+}
+
+export function registerPermissionsApi(ctx) {
+  const route = {
+    path: `${ROUTE_BASE}/permissions`,
+    methods: ["POST"],
+    requestBody: "buffered",
+    fetch: async (request) => {
+      let rpcId = "invalid-request";
+      try {
+        const value = await envelope(request);
+        rpcId = value.rpcId;
+        if (value.method !== `${RPC_NAMESPACE}/permissions`) throw new Error("endpoint/method mismatch");
+        const session = liveSession(ctx, value.payload);
+        const preset = presetSnapshot(ctx, session);
+        return ok(rpcId, {
+          project: session?.header?.cwd ?? null,
+          preset,
+          guard: guardSnapshot(process.env),
+        });
+      } catch (error) {
+        return fail(rpcId, error instanceof Error ? error.message : String(error));
+      }
+    },
+  };
+  ctx.effect(() => {
+    const dispose = ctx.connection.fetch.register(route);
+    return () => { try { void Promise.resolve(dispose()).catch(() => {}); } catch { /* unloading */ } };
+  }, "guardrails: permissions route");
+}

package/plugins/dsh-guardrails/package.json

@@ -7,11 +7,13 @@
   "main": "index.js",
   "exports": {
     ".": "./index.js",
+    "./client": "./client.js",
     "./lib": "./lib/scan.js",
     "./package.json": "./package.json"
   },
   "files": [
     "index.js",
+    "client.js",
     "lib/**",
     "tools/**",
     "cordis.patch.yml",

package/plugins/dsh-mcp-manager/README.md

@@ -1,6 +1,6 @@
 # dsh-mcp-manager
 
-MCP-серверы для DSH без SDK-зависимости: stdio и streamable HTTP, tools, resources, trust-гейт и премиальный экран в Settings.
+MCP-серверы для DSH без SDK-зависимости: stdio и streamable HTTP, tools, resources, prompts, trust-гейт и премиальный экран в Settings.
 
 ![MCP Settings](screenshots/settings-1440.png)
 
@@ -12,6 +12,7 @@ MCP-серверы для DSH без SDK-зависимости: stdio и stream
 - переключатели «Включён» и «Доверен»;
 - «Проверить» — переподключение и health;
 - «Tools» — список инструментов с описаниями;
+- «Prompts» — промпты сервера: аргументы, запуск и копирование результата;
 - «Добавить сервер» — пресеты GitHub / PostgreSQL / Filesystem или ручная форма;
 - токен сохраняется в `~/.dsh/mcp.secrets.json` (0600), а в `mcp.json` остаётся только `${secret:…}`;
 - новые tools появляются в **новом чате** после подключения.
@@ -20,6 +21,14 @@ MCP-серверы для DSH без SDK-зависимости: stdio и stream
 
 <p><img src="screenshots/settings-390.png" alt="MCP Settings на 390px" width="390"> <img src="screenshots/modal-390.png" alt="Форма добавления MCP-сервера" width="390"></p>
 
+### Prompts
+
+Промпт — это готовый запрос с аргументами, который отдаёт сам MCP-сервер. Нажмите **Prompts**, заполните поля и получите текст. Результат можно скопировать одной кнопкой.
+
+![MCP Prompts](screenshots/prompts-1440.png)
+
+<img src="screenshots/prompts-390.png" alt="MCP Prompts на 390px" width="390">
+
 ## Конфиг
 
 `~/.dsh/mcp.json` — глобальные серверы, стартуют автоматически при `trusted: true`.
@@ -61,6 +70,8 @@ MCP-серверы для DSH без SDK-зависимости: stdio и stream
 /mcp init
 /mcp list
 /mcp tools github
+/mcp prompts github
+/mcp prompt github review {"target":"src/app.js"}
 /mcp call github search_repositories {"query":"dsh-desktop-kit"}
 /mcp resources postgres
 /mcp read postgres postgres://schema
@@ -72,7 +83,6 @@ MCP-серверы для DSH без SDK-зависимости: stdio и stream
 ## Ограничения
 
 - Нет OAuth: только env/headers. Токены кладите в переменные окружения.
-- Нет UI: управление через `/mcp` и JSON-файлы.
-- Нет prompts и sampling; поддержаны tools/resources.
+- Нет sampling: сервер не может запросить генерацию у модели.
 - HTTP-транспорт поддерживает JSON и простой SSE-ответ; интерактивный SSE-стрим с серверными запросами не реализован.
 - MCP-сервер — произвольный процесс. Доверяйте только своим конфигам.

package/plugins/dsh-mcp-manager/client.js

@@ -64,6 +64,12 @@ window.__ModuleLoader__.load({
       .mcp-tool{display:flex;gap:8px;align-items:baseline;font-size:12px;line-height:1.45;min-width:0}
       .mcp-tool code{color:var(--mcp-accent);font:inherit;font-weight:650;white-space:nowrap}
       .mcp-tool span{color:var(--mcp-muted);overflow:hidden;text-overflow:ellipsis}
+      .mcp-prompt-list{display:flex;flex-direction:column;gap:8px}
+      .mcp-prompt-card{text-align:left;border:1px solid var(--mcp-line);background:var(--mcp-panel);border-radius:12px;padding:11px 12px;cursor:pointer;font:inherit;color:inherit;min-height:44px}
+      .mcp-prompt-card:hover{border-color:rgba(15,118,110,.4);background:var(--mcp-accent-soft)}
+      .mcp-prompt-card b{display:block;font-size:13px}
+      .mcp-prompt-card span{display:block;color:var(--mcp-muted);font-size:12px;line-height:1.4;margin-top:3px}
+      .mcp-prompt-output{margin:0;padding:12px;border:1px solid var(--mcp-line);border-radius:10px;background:var(--mcp-soft);color:var(--mcp-text);font:12px/1.55 ui-monospace,SFMono-Regular,Consolas,monospace;white-space:pre-wrap;overflow-wrap:anywhere;max-height:38vh;overflow:auto}
       .mcp-empty{border:1px dashed var(--mcp-line);border-radius:18px;padding:26px;background:linear-gradient(160deg,var(--mcp-soft),transparent 75%);display:flex;flex-direction:column;gap:12px;align-items:flex-start}
       .mcp-empty h3{margin:0;font-size:18px;letter-spacing:-.015em}
       .mcp-empty p{margin:0;color:var(--mcp-muted);font-size:13px;line-height:1.5;max-width:60ch}
@@ -118,7 +124,7 @@ window.__ModuleLoader__.load({
       );
     }
 
-    function ServerCard({ server, busy, onToggle, onTest, onTools, onRemove, tools }) {
+    function ServerCard({ server, busy, onToggle, onTest, onTools, onPrompts, onRemove, tools }) {
       const [open, setOpen] = useState(false);
       const connected = server.connected;
       const status = connected ? "on" : (server.error ? "err" : "off");
@@ -141,6 +147,7 @@ window.__ModuleLoader__.load({
           h(Toggle, { checked: server.trusted, label: "Доверен", disabled: busy, onChange: (value) => onToggle(server.id, { trusted: value }) }),
           h("div", { className: "mcp-actions" },
             h("button", { className: "mcp-btn ghost", disabled: busy, onClick: () => onTest(server.id) }, "Проверить"),
+            h("button", { className: "mcp-btn ghost", disabled: busy, onClick: () => onPrompts(server.id) }, "Prompts"),
             h("button", { className: "mcp-btn ghost", disabled: busy, onClick: () => { setOpen(!open); if (!open) onTools(server.id); } }, open ? "Скрыть" : "Tools"),
             h("button", { className: "mcp-btn danger ghost", disabled: busy, onClick: () => onRemove(server.id) }, "Удалить"),
           ),
@@ -156,6 +163,58 @@ window.__ModuleLoader__.load({
       );
     }
 
+    function PromptModal({ state, onClose, onPick, onBack, onArg, onRun, onCopy }) {
+      if (!state) return null;
+      const prompt = state.prompt;
+      const args = Array.isArray(prompt?.arguments) ? prompt.arguments : [];
+      return h("div", { className: "mcp-overlay", onClick: onClose },
+        h("div", {
+          className: "mcp-modal",
+          role: "dialog",
+          "aria-modal": "true",
+          "aria-labelledby": "mcp-prompts-title",
+          onClick: (event) => event.stopPropagation(),
+        },
+          h("div", { className: "mcp-modal-head" },
+            h("div", null,
+              h("h2", { id: "mcp-prompts-title" }, prompt ? (prompt.title || prompt.name) : "Prompts"),
+              h("p", null, prompt ? (prompt.description || "Промпт MCP-сервера") : `Промпты сервера «${state.serverId}».`),
+            ),
+            h("button", { className: "mcp-btn ghost", type: "button", onClick: onClose, "aria-label": "Закрыть" }, "Закрыть"),
+          ),
+          state.error ? h("div", { className: "mcp-error", role: "alert" }, state.error) : null,
+          !prompt ? h("div", { className: "mcp-prompt-list" },
+            state.prompts.length === 0 ? h("div", { className: "mcp-meta" }, "У сервера нет prompts.") : state.prompts.map((item) => h("button", {
+              key: item.name,
+              type: "button",
+              className: "mcp-prompt-card",
+              onClick: () => onPick(item),
+            }, h("b", null, item.name), h("span", null, item.description || "Без описания"))),
+          ) : h("div", { className: "mcp-form" },
+            args.map((arg, index) => h("div", { className: `mcp-field${String(arg.description || "").length > 40 ? " wide" : ""}`, key: arg.name },
+              h("label", { htmlFor: `mcp-prompt-arg-${index}` }, arg.name, arg.required ? " *" : ""),
+              h("input", {
+                id: `mcp-prompt-arg-${index}`,
+                value: state.args[arg.name] ?? "",
+                placeholder: arg.description || "",
+                onChange: (event) => onArg(arg.name, event.target.value),
+              }),
+            )),
+            args.length === 0 ? h("p", { className: "mcp-note", style: { gridColumn: "1/-1" } }, "У промпта нет аргументов.") : null,
+            state.result ? h("div", { className: "mcp-field wide" },
+              h("label", null, "Результат"),
+              h("pre", { className: "mcp-prompt-output" }, state.result),
+            ) : null,
+            h("div", { className: "mcp-form-actions", style: { gridColumn: "1/-1" } },
+              state.prompts.length > 1 ? h("button", { className: "mcp-btn ghost", type: "button", onClick: onBack }, "Назад") : null,
+              state.result ? h("button", { className: "mcp-btn ghost", type: "button", onClick: onCopy }, "Копировать") : null,
+              h("button", { className: "mcp-btn primary", type: "button", disabled: state.busy, onClick: onRun }, state.busy ? "Запрашиваем…" : "Получить"),
+            ),
+          ),
+        ),
+      );
+    }
+
     function ServerForm({ initial, busy, onCancel, onSave }) {
       const [form, setForm] = useState(initial);
       const set = (patch) => setForm((current) => ({ ...current, ...patch }));
@@ -235,6 +294,7 @@ window.__ModuleLoader__.load({
       const [form, setForm] = useState(null);
       const [tools, setTools] = useState({});
       const [toast, setToast] = useState("");
+      const [promptModal, setPromptModal] = useState(null);
 
       const load = async () => {
         try {
@@ -262,6 +322,72 @@ window.__ModuleLoader__.load({
         }
       };
 
+      const openPrompts = async (id) => {
+        setBusy(true);
+        setError(null);
+        try {
+          const result = await call(window.__DSH_MCP_CTX__, "prompts", { id });
+          setPromptModal({
+            serverId: id,
+            prompts: Array.isArray(result.prompts) ? result.prompts : [],
+            prompt: null,
+            args: {},
+            result: "",
+            busy: false,
+            error: result.error || "",
+          });
+        } catch (cause) {
+          setError(cause instanceof Error ? cause.message : String(cause));
+        } finally {
+          setBusy(false);
+        }
+      };
+
+      const pickPrompt = (prompt) => {
+        setPromptModal((current) => current ? {
+          ...current,
+          prompt,
+          args: Object.fromEntries((prompt.arguments ?? []).map((arg) => [arg.name, ""])),
+          result: "",
+          error: "",
+        } : current);
+      };
+
+      const runPrompt = async () => {
+        const current = promptModal;
+        if (!current?.prompt) return;
+        setPromptModal({ ...current, busy: true, error: "", result: "" });
+        try {
+          const result = await call(window.__DSH_MCP_CTX__, "prompt", {
+            id: current.serverId,
+            name: current.prompt.name,
+            arguments: current.args,
+          });
+          setPromptModal((latest) => latest ? {
+            ...latest,
+            busy: false,
+            result: result.text || "",
+            error: result.text ? "" : "Сервер вернул пустой промпт",
+          } : latest);
+        } catch (cause) {
+          setPromptModal((latest) => latest ? {
+            ...latest,
+            busy: false,
+            error: cause instanceof Error ? cause.message : String(cause),
+          } : latest);
+        }
+      };
+
+      const copyPrompt = async () => {
+        try {
+          await navigator.clipboard.writeText(promptModal?.result ?? "");
+          setToast("Промпт скопирован");
+          setTimeout(() => setToast(""), 2500);
+        } catch {
+          setError("Не удалось скопировать — выделите текст вручную");
+        }
+      };
+
       const presets = PRESETS;
       const openPreset = (preset) => setForm({
         edit: false,
@@ -333,11 +459,21 @@ window.__ModuleLoader__.load({
               if (result.error) setError(result.error);
             } catch (cause) { setError(cause instanceof Error ? cause.message : String(cause)); }
           },
+          onPrompts: openPrompts,
           onRemove: (id) => {
             if (window.confirm(`Удалить MCP-сервер «${id}»?`)) void run("remove", { id }, "Сервер удалён");
           },
         }))) : null,
         servers.length > 0 ? h("p", { className: "mcp-note" }, `Секреты: ${data?.secretsFile || "~/.dsh/mcp.secrets.json"} · новые tools появятся в новом чате после подключения.`) : null,
+        h(PromptModal, {
+          state: promptModal,
+          onClose: () => setPromptModal(null),
+          onPick: pickPrompt,
+          onBack: () => setPromptModal((current) => current ? { ...current, prompt: null, args: {}, result: "", error: "" } : current),
+          onArg: (name, value) => setPromptModal((current) => current ? { ...current, args: { ...current.args, [name]: value } } : current),
+          onRun: runPrompt,
+          onCopy: copyPrompt,
+        }),
         form ? h(ServerForm, {
           initial: form,
           busy,

package/plugins/dsh-mcp-manager/index.js

@@ -47,8 +47,8 @@ function commandCwd(ctx) {
 function registerCommand(ctx, manager) {
   ctx.commands.register({
     name: "mcp",
-    description: "MCP-серверы: список, инструменты, вызов, resources, reload",
-    input: { hint: "list | trust | untrust | tools [server] | call <server> <tool> [json] | resources <server> | read <server> <uri> | reload | init" },
+    description: "MCP-серверы: список, инструменты, prompts, resources, reload",
+    input: { hint: "list | trust | untrust | tools [server] | prompts [server] | prompt <server> <name> [json] | call <server> <tool> [json] | resources <server> | read <server> <uri> | reload | init" },
     recordInput: false,
     async handler({ rawInput }) {
       const input = String(rawInput ?? "").trim();
@@ -87,10 +87,10 @@ function registerCommand(ctx, manager) {
           return { kind: "success", text: `MCP reload: ${results.filter((r) => r.status === "fulfilled" && r.value.client).length}/${results.length} подключено.\n${formatStatus(manager)}` };
         }
         const server = config.servers.find((item) => item.id === rest[0]);
-        if (["tools", "call", "resources", "read"].includes(action) && !rest[0]) {
+        if (["tools", "call", "resources", "read", "prompts", "prompt"].includes(action) && !rest[0]) {
           return { kind: "error", text: `/mcp ${action}: укажите сервер` };
         }
-        if (["tools", "call", "resources", "read"].includes(action) && !server) {
+        if (["tools", "call", "resources", "read", "prompts", "prompt"].includes(action) && !server) {
           return { kind: "error", text: `MCP-сервер не найден: ${rest[0]}` };
         }
         if (!server.trusted) return { kind: "error", text: `MCP ${server.id}: trusted=false; включите доверие в mcp.json` };
@@ -111,6 +111,29 @@ function registerCommand(ctx, manager) {
           const text = await manager.call(server.id, toolName, args);
           return { kind: "success", text: text || "(пустой результат)" };
         }
+        if (action === "prompts") {
+          const prompts = await manager.prompts(server.id);
+          return {
+            kind: "success",
+            text: prompts.length
+              ? prompts.map((prompt) => {
+                const args = Array.isArray(prompt.arguments) ? prompt.arguments.map((arg) => `${arg.name}${arg.required ? "*" : ""}`).join(", ") : "";
+                return `- ${prompt.name}${prompt.description ? ` — ${prompt.description}` : ""}${args ? ` [${args}]` : ""}`;
+              }).join("\n")
+              : "У сервера нет prompts.",
+          };
+        }
+        if (action === "prompt") {
+          const name = rest[1];
+          if (!name) return { kind: "error", text: "/mcp prompt: укажите name" };
+          const args = rest[2] ? JSON.parse(rest.slice(2).join(" ")) : {};
+          const result = await manager.prompt(server.id, name, args);
+          const text = (Array.isArray(result?.messages) ? result.messages : [])
+            .map((message) => typeof message.content === "string" ? message.content : message.content?.text ?? "")
+            .filter(Boolean)
+            .join("\n");
+          return { kind: "success", text: text || "(пустой prompt)" };
+        }
         if (action === "resources") {
           const resources = await manager.resources(server.id);
           return { kind: "success", text: resources.length ? resources.map((item) => `- ${item.uri}${item.name ? ` — ${item.name}` : ""}`).join("\n") : "Нет resources." };