dsh-mcp-skills 0.2.2 → 0.5.0

package/README.md

@@ -1,6 +1,6 @@
 # dsh-mcp-skills
 
-一个 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件，在网页设置面板中新增两个管理页面：
+一个 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件，在网页设置面板中新增一个 **「能力」** 页面，内含 **MCP** / **Skills** 两个标签：
 
 - **Skills** — 浏览、导入、删除、开关用户自有技能（存放于 `$DSH_HOME/skills`）。
 - **MCP** — 管理 MCP 服务器配置（stdio / Streamable HTTP），支持增删改与连接测试。启用的服务器写入当前 profile 的 `cordis.patch.yml`，重启后自动连接，工具注册为 `mcp__<server>__<tool>`。
@@ -9,11 +9,11 @@
 
 **Skills 页面**
 
-![Skills 页面](images/skills.png)
+<img src="images/skills.png" alt="Skills 页面" style="zoom:33%;" />
 
 **MCP 页面**
 
-![MCP 页面](images/mcp.png)
+<img src="images/mcp.png" alt="MCP 页面" style="zoom:33%;" />
 
 ## 安装
 
@@ -46,7 +46,7 @@ dsh --profile web
 
 ## 行为说明
 
-- MCP 服务器保存在 `$DSH_HOME/mcp-servers.yaml`；启用的服务器会被写入当前 profile 的 `cordis.patch.yml`，重启 dsh 后自动连接。插件只增删自己生成的 `mcp-*` 行，不改动该文件的其他内容：注释、锚点与 `!!js` 表达式都会原样保留，写入是原子的，并会保留一份 `.bak` 备份。
+- MCP 服务器**直接保存**在当前 profile 的 `cordis.patch.yml`（官方推荐位置），重启 dsh 后自动连接；没有额外的清单文件。插件只增删 `mcp-*` 行（以及被接管的外部行），不改动该文件的其他内容：注释、锚点与 `!!js` 表达式都会原样保留，写入是原子的，并会保留一份 `.bak` 备份。
 - 若 profile 的 `cordis.patch.yml` 存在语法错误，插件会拒绝改写并报错，而不是覆盖它。
 - 连接测试 15 秒超时，超时会关闭连接并回收子进程。测试与真实挂载使用同一套环境清洗规则：`*_KEY` / `*_PASSWORD` / `*_SECRET` / `*_TOKEN` 与 `DSH_*` 变量不会传给 MCP 子进程，需要凭据时请在服务器的环境变量里显式配置。
 - 技能存放在 `$DSH_HOME/skills`。zip 导入支持单个技能（根目录 `SKILL.md` 或 `<name>/SKILL.md`）或多个技能目录，`template/` 会被跳过，已存在的技能不会被覆盖（导入结果会显示跳过数量）。
@@ -58,7 +58,7 @@ dsh --profile web
 dsh plugin --profile web remove dsh-mcp-skills
 ```
 
-如不再需要，删除 profile `cordis.patch.yml` 中生成的 `mcp-*` 行及 `$DSH_HOME/mcp-servers.yaml`。
+如不再需要，删除 profile `cordis.patch.yml` 中生成的 `mcp-*` 行即可。
 
 
 

package/lib/client.js

@@ -33,7 +33,7 @@ window.__ModuleLoader__.load({
     // ── styles ────────────────────────────────────────────────────────────────
     var manageStylesId = 'dsh-mcp-skills/manage.module.css'
     var manageCss =
-      '.smg_section{box-sizing:border-box;flex-direction:column;gap:12px;width:100%;min-height:0;display:flex}.smg_toolbar{flex:none;justify-content:space-between;align-items:center;gap:8px;display:flex}.smg_actions{flex:none;align-items:center;gap:4px;display:flex}.smg_title{color:var(--dsw-alias-label-primary);font-size:15px;font-weight:500;line-height:22px}.smg_hint{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px}.smg_list{flex-direction:column;gap:8px;min-height:0;padding:2px;display:flex;overflow:auto}.smg_card{box-sizing:border-box;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;flex-direction:column;gap:6px;padding:10px 12px;display:flex}.smg_cardHead{flex:none;align-items:center;justify-content:space-between;gap:8px;min-width:0;display:flex}.smg_cardName{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:500;line-height:20px;white-space:nowrap;text-overflow:ellipsis;overflow:hidden}.smg_cardDesc{color:var(--dsw-alias-label-secondary);font-size:13px;line-height:19px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.smg_cardMeta{flex-wrap:wrap;gap:6px;align-items:center;display:flex}.smg_pill{box-sizing:border-box;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-interactive-bg-hover);border-radius:999px;padding:2px 8px;font-size:11px;line-height:16px;white-space:nowrap}.smg_field{flex-direction:column;gap:4px;min-width:0;display:flex}.smg_fieldLabel{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}.smg_input{box-sizing:border-box;width:100%;color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-base);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 8px;font-family:inherit;font-size:13px;line-height:20px}.smg_textarea{box-sizing:border-box;width:100%;min-height:110px;color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-base);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 8px;font-family:inherit;font-size:13px;line-height:20px;resize:vertical}.smg_form{background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;flex-direction:column;gap:10px;padding:12px;display:flex}.smg_formRow{flex:none;align-items:flex-end;gap:8px;display:flex}.smg_check{align-items:center;gap:6px;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:20px;display:flex}.smg_error{color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}.smg_notice{color:var(--dsw-alias-state-success-primary);font-size:12px;line-height:18px}'
+      '.smg_section{box-sizing:border-box;flex-direction:column;gap:12px;width:100%;min-height:0;display:flex}.smg_toolbar{flex:none;justify-content:space-between;align-items:center;gap:8px;display:flex}.smg_actions{flex:none;align-items:center;gap:4px;display:flex}.smg_title{color:var(--dsw-alias-label-primary);font-size:15px;font-weight:500;line-height:22px}.smg_hint{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px}.smg_list{flex-direction:column;gap:8px;min-height:0;padding:2px;display:flex;overflow:auto}.smg_card{box-sizing:border-box;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;flex-direction:column;gap:6px;padding:10px 12px;display:flex}.smg_cardHead{flex:none;align-items:center;justify-content:space-between;gap:8px;min-width:0;display:flex}.smg_cardName{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:500;line-height:20px;white-space:nowrap;text-overflow:ellipsis;overflow:hidden}.smg_cardDesc{color:var(--dsw-alias-label-secondary);font-size:13px;line-height:19px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.smg_cardMeta{flex-wrap:wrap;gap:6px;align-items:center;display:flex}.smg_pill{box-sizing:border-box;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-interactive-bg-hover);border-radius:999px;padding:2px 8px;font-size:11px;line-height:16px;white-space:nowrap}.smg_field{flex-direction:column;gap:4px;min-width:0;display:flex}.smg_fieldLabel{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}.smg_input{box-sizing:border-box;width:100%;color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-base);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 8px;font-family:inherit;font-size:13px;line-height:20px}.smg_textarea{box-sizing:border-box;width:100%;min-height:110px;color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-base);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 8px;font-family:inherit;font-size:13px;line-height:20px;resize:vertical}.smg_form{background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;flex-direction:column;gap:10px;padding:12px;display:flex}.smg_formRow{flex:none;align-items:flex-end;gap:8px;display:flex}.smg_check{align-items:center;gap:6px;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:20px;display:flex}.smg_error{color:var(--dsw-alias-state-error-primary);font-size:12px;line-height:18px}.smg_notice{color:var(--dsw-alias-state-success-primary);font-size:12px;line-height:18px}.smg_capabilities{box-sizing:border-box;display:flex;flex-direction:column;gap:12px;width:100%;height:100%;min-height:0}.smg_tabs{display:flex;gap:6px;flex:none;border-bottom:1px solid var(--dsw-alias-border-l2);padding-bottom:8px}.smg_tab{appearance:none;border:0;background:transparent;color:var(--dsw-alias-label-secondary);font:inherit;font-size:13px;line-height:20px;padding:4px 10px;border-radius:8px;cursor:pointer}.smg_tab:hover{background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary)}.smg_tabActive{background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary);font-weight:500}.smg_tabBody{display:flex;flex-direction:column;flex:1;min-height:0}'
     if (typeof document !== 'undefined' && document.querySelector('style[data-plugin-css=' + JSON.stringify(manageStylesId) + ']') === null) {
       var tag = document.createElement('style')
       tag.dataset.plugin = 'dsh-mcp-skills'
@@ -63,6 +63,11 @@ window.__ModuleLoader__.load({
       check: 'smg_check',
       error: 'smg_error',
       notice: 'smg_notice',
+      capabilities: 'smg_capabilities',
+      tabs: 'smg_tabs',
+      tab: 'smg_tab',
+      tabActive: 'smg_tabActive',
+      tabBody: 'smg_tabBody',
     }
 
     var { useState: useManageState, useEffect: useManageEffect, useCallback: useManageCallback, useRef: useManageRef } = react
@@ -215,7 +220,7 @@ window.__ModuleLoader__.load({
         toolCallTimeoutMs: Number(draft.toolCallTimeoutMs) || MANAGE_DEFAULT_TIMEOUT_MS,
         failOnStartupError: draft.failOnStartupError,
         ...(draft.transport === 'stdio'
-          ? { command: draft.command, args: manageLines(draft.argsText), env: manageKeyValue(draft.envText), cwd: draft.cwd }
+          ? { command: draft.command, args: manageLines(draft.argsText), env: manageKeyValue(draft.envText) }
           : { url: draft.url, headers: manageHeaders(draft.headersText) }),
       }
     }
@@ -229,7 +234,6 @@ window.__ModuleLoader__.load({
         command: server.command ?? '',
         argsText: (server.args ?? []).join('\n'),
         envText: Object.entries(server.env ?? {}).map(([key, value]) => key + '=' + value).join('\n'),
-        cwd: server.cwd ?? '',
         url: server.url ?? '',
         headersText: Object.entries(server.headers ?? {}).map(([key, value]) => manageHeaderLine(key, value)).join('\n'),
         toolCallTimeoutMs: String(server.toolCallTimeoutMs ?? MANAGE_DEFAULT_TIMEOUT_MS),
@@ -762,16 +766,6 @@ window.__ModuleLoader__.load({
                               },
                             }),
                           }),
-                          react_jsx_runtime.jsx(ManageField, {
-                            label: t('mcp.form.cwd'),
-                            children: react_jsx_runtime.jsx('input', {
-                              className: manageStyles.input,
-                              value: draft.cwd,
-                              onChange: (event) => {
-                                setDraftField('cwd', event.target.value)
-                              },
-                            }),
-                          }),
                         ],
                       })
                     : react_jsx_runtime.jsxs(react_jsx_runtime.Fragment, {
@@ -900,10 +894,52 @@ window.__ModuleLoader__.load({
       })
     }
 
+    /**
+     * The "Capabilities" settings page: one nav entry, two tabs (MCP / Skills).
+     */
+    function CapabilitiesSection({ api, t }) {
+      var [tab, setTab] = useManageState('mcp')
+      var tabs = [
+        ['mcp', t('capabilities.tab.mcp')],
+        ['skills', t('capabilities.tab.skills')],
+      ]
+      return react_jsx_runtime.jsxs('div', {
+        className: manageStyles.capabilities,
+        children: [
+          react_jsx_runtime.jsx('div', {
+            className: manageStyles.tabs,
+            children: tabs.map((entry) =>
+              react_jsx_runtime.jsx(
+                'button',
+                {
+                  type: 'button',
+                  className: tab === entry[0] ? manageStyles.tab + ' ' + manageStyles.tabActive : manageStyles.tab,
+                  onClick: () => {
+                    setTab(entry[0])
+                  },
+                  children: entry[1],
+                },
+                entry[0],
+              ),
+            ),
+          }),
+          react_jsx_runtime.jsx('div', {
+            className: manageStyles.tabBody,
+            children:
+              tab === 'mcp'
+                ? react_jsx_runtime.jsx(McpSection, { api: api, t: t })
+                : react_jsx_runtime.jsx(SkillsSection, { api: api, t: t }),
+          }),
+        ],
+      })
+    }
+
     // ── copy dictionaries ──────────────────────────────────────────────────────
     var MANAGE_NS = 'settings-mcp-skills'
     var manageZh = {
-      'skills.nav': 'Skills',
+      'capabilities.nav': '能力',
+      'capabilities.tab.mcp': 'MCP',
+      'capabilities.tab.skills': 'Skills',
       'skills.title': 'Skills管理',
       'skills.refresh': '刷新',
       'skills.new': '导入技能',
@@ -917,7 +953,6 @@ window.__ModuleLoader__.load({
       'skills.importedNone': '未导入任何技能：{count} 个已存在或不支持。',
       'skills.removed': '已删除。',
       'skills.enabled': '允许模型调用',
-      'mcp.nav': 'MCP',
       'mcp.title': 'MCP 服务器',
       'mcp.refresh': '刷新',
       'mcp.new': '添加服务器',
@@ -938,7 +973,6 @@ window.__ModuleLoader__.load({
       'mcp.form.command': '命令',
       'mcp.form.args': '参数（每行一个）',
       'mcp.form.env': '环境变量（KEY=VALUE，每行一个）',
-      'mcp.form.cwd': '工作目录（可选）',
       'mcp.form.url': 'URL',
       'mcp.form.headers': '请求头（Name: Value，每行一个）',
       'mcp.form.timeout': '单次调用超时（毫秒）',
@@ -954,7 +988,9 @@ window.__ModuleLoader__.load({
       'mcp.removed': '已删除。',
     }
     var manageEn = {
-      'skills.nav': 'Skills',
+      'capabilities.nav': 'Capabilities',
+      'capabilities.tab.mcp': 'MCP',
+      'capabilities.tab.skills': 'Skills',
       'skills.title': 'Skills Management',
       'skills.refresh': 'Refresh',
       'skills.new': 'Import skill',
@@ -968,7 +1004,6 @@ window.__ModuleLoader__.load({
       'skills.importedNone': 'Nothing imported: {count} skill(s) already exist or are unsupported.',
       'skills.removed': 'Removed.',
       'skills.enabled': 'Model invocation',
-      'mcp.nav': 'MCP',
       'mcp.title': 'MCP Servers',
       'mcp.refresh': 'Refresh',
       'mcp.new': 'Add server',
@@ -989,7 +1024,6 @@ window.__ModuleLoader__.load({
       'mcp.form.command': 'Command',
       'mcp.form.args': 'Arguments (one per line)',
       'mcp.form.env': 'Environment (KEY=VALUE, one per line)',
-      'mcp.form.cwd': 'Working directory (optional)',
       'mcp.form.url': 'URL',
       'mcp.form.headers': 'Headers (Name: Value, one per line)',
       'mcp.form.timeout': 'Per-call timeout (ms)',
@@ -1041,26 +1075,12 @@ window.__ModuleLoader__.load({
           ctx.slots.register(
             {
               name: 'settings.section',
-              id: 'skills',
+              id: 'capabilities',
               order: 30,
-              label: () => t('skills.nav'),
-              locale: MANAGE_NS,
-            },
-            deliver(SkillsSection),
-          ),
-      )
-      ctx.slots.inject(
-        'settings.section',
-        () =>
-          ctx.slots.register(
-            {
-              name: 'settings.section',
-              id: 'mcp',
-              order: 40,
-              label: () => t('mcp.nav'),
+              label: () => t('capabilities.nav'),
               locale: MANAGE_NS,
             },
-            deliver(McpSection),
+            deliver(CapabilitiesSection),
           ),
       )
     }

package/lib/index.js

@@ -7,11 +7,12 @@
 // @deepseek-ai packages so out-of-tree resolution stays reliable (the modlens
 // precedent); `yaml` and `fflate` are runtime dependencies, and the MCP SDK is
 // an optional peer the host installation already provides (see loadMcpSdk).
+import { existsSync } from 'node:fs'
 import { access, copyFile, mkdir, readdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { isMap, isSeq, parse as parseYaml, parseDocument, stringify as stringifyYaml } from 'yaml'
+import { isMap, isSeq, parse as parseYaml, parseDocument } from 'yaml'
 import { unzipSync } from 'fflate/node'
 
 export const name = 'mcp-skills'
@@ -19,9 +20,11 @@ export const inject = []
 
 const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
 /** Kept in step with package.json (the smoke test reports it to the server). */
-const PLUGIN_VERSION = '0.2.2'
+const PLUGIN_VERSION = '0.5.0'
 const MCP_CONFIG_FILENAME = 'mcp-servers.yaml'
 const MCP_PROFILE_ROW_PREFIX = 'mcp-'
+/** The package every MCP row mounts, whether managed here or by another tool. */
+const MCP_CLIENT_PACKAGE = '@deepseek-ai/dsh-mcp-client'
 /** Same grammar as @deepseek-ai/dsh-mcp-client's SERVER_NAME_PATTERN. */
 const MCP_SERVER_NAME = /^[A-Za-z0-9_-]{1,32}$/
 const ROUTE_BASE = '/dsh-mcp-skills'
@@ -130,6 +133,24 @@ function isRecord(value) {
   return value !== null && typeof value === 'object' && !Array.isArray(value)
 }
 
+/**
+ * Resolve one skill-root entry to the file holding its definition.
+ *
+ * Entries are frequently symlinks (a skill linked from a shared directory such
+ * as `~/.cc-switch/skills`), and a Dirent does not follow links: `isDirectory()`
+ * and `isFile()` are both false for them. Decide by what is actually readable,
+ * so directory bundles, flat files, and either kind of link all resolve.
+ */
+async function resolveSkillFile(root, entry) {
+  const bundle = join(root, entry.name, 'SKILL.md')
+  if (await pathExists(bundle)) return bundle
+  if (entry.name.endsWith('.md') || entry.isSymbolicLink()) {
+    const flat = join(root, entry.name)
+    if (await pathExists(flat)) return flat
+  }
+  return undefined
+}
+
 /** Enumerate the user-owned skill catalog. */
 async function listUserSkills() {
   const root = skillsRoot()
@@ -143,17 +164,13 @@ async function listUserSkills() {
   const skills = []
   for (const entry of entries) {
     if (entry.name === '.system') continue
-    const path = entry.isDirectory()
-      ? join(root, entry.name, 'SKILL.md')
-      : entry.isFile() && entry.name.endsWith('.md')
-        ? join(root, entry.name)
-        : undefined
+    const path = await resolveSkillFile(root, entry)
     if (path === undefined) continue
     let raw
     try {
       raw = await readFile(path, 'utf8')
     } catch (error) {
-      if (error.code === 'ENOENT' || error.code === 'ENOTDIR') continue
+      if (error.code === 'ENOENT' || error.code === 'ENOTDIR' || error.code === 'EISDIR') continue
       throw error
     }
     const parsed = parseSkillFrontmatter(raw)
@@ -345,23 +362,39 @@ async function setSkillEnabled(name, enabled) {
   return name
 }
 
-/** Read the managed MCP server document; a missing file is an empty catalog. */
-async function readMcpServers() {
-  const path = join(dshHome(), MCP_CONFIG_FILENAME)
+/**
+ * Read every MCP client row from the profile patch — the single source of
+ * truth. Every such row is editable here, whichever tool wrote it.
+ */
+async function readMcpServers(ctx) {
+  const patchPath = join(profileDirectory(ctx), 'cordis.patch.yml')
+  let raw
   try {
-    const parsed = parseYaml(await readFile(path, 'utf8'))
-    if (!isRecord(parsed)) return []
-    return Array.isArray(parsed.servers) ? parsed.servers.filter(isRecord) : []
+    raw = await readFile(patchPath, 'utf8')
   } catch (error) {
     if (error.code === 'ENOENT') return []
     throw error
   }
+  const doc = parseDocument(raw, { logLevel: 'silent' })
+  if (doc.errors.length > 0 || !isSeq(doc.contents)) return []
+
+  const rows = []
+  const collect = (nodes) => {
+    for (const node of nodes) {
+      if (!isMap(node)) continue
+      const insert = node.get('insert')
+      if (isSeq(insert)) collect(insert.items)
+      else if (isMcpClientNode(node)) rows.push(node)
+    }
+  }
+  collect(doc.contents.items)
+
+  return rows.map(serverFromRow).filter((server) => server !== undefined)
 }
 
-/** Resolve one managed server by name. */
-async function findMcpServer(name) {
-  const servers = await readMcpServers()
-  return servers.find((s) => s.name === name)
+/** Resolve one server by name. */
+async function findMcpServer(ctx, name) {
+  return (await readMcpServers(ctx)).find((server) => server.name === name)
 }
 
 /** Validate one submitted server definition and normalize it for storage. */
@@ -394,34 +427,94 @@ function normalizeMcpServer(server) {
     toolCallTimeoutMs: Number.isFinite(timeout) && timeout > 0 ? timeout : DEFAULT_TOOL_CALL_TIMEOUT_MS,
     failOnStartupError: server.failOnStartupError === true,
     ...(server.transport === 'stdio'
-      ? { command: server.command, args: Array.isArray(server.args) ? server.args : [], env: isRecord(server.env) ? server.env : {}, cwd: typeof server.cwd === 'string' ? server.cwd : '' }
+      ? { command: server.command, args: Array.isArray(server.args) ? server.args : [], env: isRecord(server.env) ? server.env : {} }
       : { url: server.url, headers: isRecord(server.headers) ? server.headers : {} }),
   }
 }
 
 /** Persist the managed document and regenerate the profile patch rows. */
+/** Regenerate the profile patch rows for the given server list. */
 async function writeMcpServers(ctx, servers) {
-  const path = join(dshHome(), MCP_CONFIG_FILENAME)
-  await writeFileAtomic(path, stringifyYaml({ servers }, { lineWidth: 0 }))
   await syncMcpProfilePatch(ctx, servers)
 }
 
+/**
+ * One-time import of the retired `mcp-servers.yaml` manifest into the profile
+ * patch. Runs on activation and removes the file once its servers are in.
+ */
+async function migrateMcpManifest(ctx) {
+  const manifestPath = join(dshHome(), MCP_CONFIG_FILENAME)
+  let raw
+  try {
+    raw = await readFile(manifestPath, 'utf8')
+  } catch (error) {
+    if (error.code === 'ENOENT') return
+    throw error
+  }
+
+  let legacy = []
+  try {
+    const parsed = parseYaml(raw)
+    if (isRecord(parsed) && Array.isArray(parsed.servers)) legacy = parsed.servers.filter(isRecord)
+  } catch {
+    // An unreadable manifest is still removed; the patch remains the truth.
+  }
+
+  const existing = await readMcpServers(ctx)
+  const known = new Set(existing.map((server) => server.name))
+  const imported = []
+  for (const entry of legacy) {
+    if (typeof entry.name !== 'string' || known.has(entry.name)) continue
+    try {
+      imported.push(normalizeMcpServer(entry))
+    } catch {
+      // A malformed legacy entry is skipped rather than blocking the import.
+    }
+  }
+  if (imported.length > 0) await writeMcpServers(ctx, [...existing, ...imported])
+  await rm(manifestPath, { force: true })
+  console.log(`[mcp-skills] migrated ${imported.length} server(s) from mcp-servers.yaml into the profile patch`)
+}
+
+/** Executable directories a GUI-launched harness commonly lacks. */
+const EXTRA_PATH_DIRS = ['/usr/local/bin', '/opt/homebrew/bin', '/usr/bin', '/bin']
+
+/**
+ * The environment one stdio server is spawned with.
+ *
+ * MCP servers are spawned by `@deepseek-ai/dsh-mcp-client` from the harness
+ * process environment, and a harness launched from a desktop icon inherits a
+ * minimal PATH (macOS gives just `/usr/bin:/bin:/usr/sbin:/sbin`). A configured
+ * `npx` / `uvx` then fails with ENOENT even though the user's shell resolves it,
+ * so the well-known executable directories are prepended when they exist.
+ * An explicit `PATH` in the server config still wins.
+ */
+function serverEnv(env) {
+  const current = (process.env.PATH ?? '').split(':').filter((entry) => entry !== '')
+  const missing = EXTRA_PATH_DIRS.filter((dir) => existsSync(dir) && !current.includes(dir))
+  return { ...(missing.length > 0 ? { PATH: [...missing, ...current].join(':') } : {}), ...env }
+}
+
 /**
  * The transport-shaped fields of one managed server, shared by the generated
  * patch row and the connection smoke test so both always agree.
  */
 function serverConnection(server) {
   return server.transport === 'stdio'
-    ? { command: server.command, args: server.args ?? [], env: server.env ?? {}, cwd: server.cwd || process.cwd() }
+    ? { command: server.command, args: server.args ?? [], env: serverEnv(server.env ?? {}) }
     : { url: server.url, headers: server.headers ?? {} }
 }
 
 /** The cordis row that mounts one server as an mcp-client instance. */
 function mcpPatchRow(server) {
   return {
-    id: `${MCP_PROFILE_ROW_PREFIX}${server.name}`,
-    name: '@deepseek-ai/dsh-mcp-client',
+    // A row written by another tool keeps its id; a new row gets the plugin's
+    // own `mcp-<name>` id.
+    id: server.id ?? `${MCP_PROFILE_ROW_PREFIX}${server.name}`,
+    name: MCP_CLIENT_PACKAGE,
+    ...(server.enabled === false ? { disabled: true } : {}),
     config: {
+      ...(isRecord(server.config) ? server.config : {}),
       transport: server.transport,
       serverName: server.name,
       toolCallTimeoutMs: server.toolCallTimeoutMs ?? DEFAULT_TOOL_CALL_TIMEOUT_MS,
@@ -444,15 +537,46 @@ function profileDirectory(ctx) {
   }
 }
 
-/** Whether one parsed YAML node is a row this plugin owns. */
-function isMcpRowNode(node) {
-  if (!isMap(node)) return false
-  const id = node.get('id')
-  return typeof id === 'string' && id.startsWith(MCP_PROFILE_ROW_PREFIX)
+/** Whether one parsed YAML node mounts an MCP client (managed or external). */
+function isMcpClientNode(node) {
+  return isMap(node) && node.get('name') === MCP_CLIENT_PACKAGE
+}
+
+/** One MCP client row as a flat server record. */
+function serverFromRow(row) {
+  const config = row.get('config')
+  // `cwd` is not configurable here: MCP children inherit the harness directory.
+  const { cwd: _cwd, ...values } = isMap(config) ? config.toJSON() : {}
+  const name = typeof values.serverName === 'string' && values.serverName !== '' ? values.serverName : undefined
+  if (name === undefined) return undefined
+  const id = typeof row.get('id') === 'string' ? row.get('id') : undefined
+  return {
+    ...(id !== undefined ? { id } : {}),
+    name,
+    enabled: row.get('disabled') !== true,
+    // The raw config is kept so fields this UI does not expose (reconnect,
+    // maxInstructionBytes, …) survive an edit round trip.
+    config: values,
+    transport: values.transport,
+    toolCallTimeoutMs: typeof values.toolCallTimeoutMs === 'number' ? values.toolCallTimeoutMs : DEFAULT_TOOL_CALL_TIMEOUT_MS,
+    failOnStartupError: values.failOnStartupError === true,
+    ...(values.transport === 'stdio'
+      ? {
+          command: typeof values.command === 'string' ? values.command : '',
+          args: Array.isArray(values.args) ? values.args : [],
+          env: isRecord(values.env) ? values.env : {},
+        }
+      : { url: typeof values.url === 'string' ? values.url : '', headers: isRecord(values.headers) ? values.headers : {} }),
+  }
 }
 
 /**
- * Rewrite the profile's `cordis.patch.yml`, replacing every `mcp-*` row.
+ * Rewrite the profile's `cordis.patch.yml`, regenerating every row that mounts
+ * an MCP client.
+ *
+ * Every such row is managed here, whatever tool wrote it: the plugin is the
+ * single editor for this slice of the patch. Row ids are preserved, so a row
+ * owned by another tool keeps its identity while its config follows the list.
  *
  * The profile patch is user-owned and boot-critical, so this edits the parsed
  * document node by node instead of re-serializing a plain object: comments,
@@ -477,18 +601,22 @@ async function syncMcpProfilePatch(ctx, servers) {
   if (doc.contents === null) doc.contents = doc.createNode([])
   if (!isSeq(doc.contents)) throw new ManageError('profile-patch-invalid', 'the profile patch is expected to be a top-level YAML array')
 
-  // Drop every row this plugin owns, both as a bare entry and inside an
-  // `insert` list. Walking backwards keeps the indices valid.
+  // Rows this pass owns: every row that mounts an MCP client, whatever tool
+  // wrote it. The plugin is the single editor for this slice of the patch.
+  const owned = (node) => isMcpClientNode(node)
+
+  // Drop those rows, both as bare entries and inside an `insert` list.
+  // Walking backwards keeps the indices valid.
   const items = doc.contents.items
   for (let index = items.length - 1; index >= 0; index -= 1) {
     const entry = items[index]
     if (!isMap(entry)) continue
     const insert = entry.get('insert')
     if (!isSeq(insert)) {
-      if (isMcpRowNode(entry)) doc.delete(index)
+      if (owned(entry)) doc.delete(index)
       continue
     }
-    const kept = insert.items.filter((row) => !isMcpRowNode(row))
+    const kept = insert.items.filter((row) => !owned(row))
     if (kept.length === 0) doc.delete(index)
     else if (kept.length !== insert.items.length) insert.items = kept
   }
@@ -653,24 +781,35 @@ function routes(ctx) {
     [`${ROUTE_BASE}/skill.install`]: async (payload) => ({ value: await importUserSkills(payload) }),
     [`${ROUTE_BASE}/skill.remove`]: async (payload) => ({ value: { removed: true, name: await removeUserSkill(payload.name) } }),
     [`${ROUTE_BASE}/skill.enable`]: async (payload) => ({ value: { name: await setSkillEnabled(payload.name, payload.enabled === true) } }),
-    [`${ROUTE_BASE}/mcp.list`]: async () => ({ value: { servers: await readMcpServers(), file: join(dshHome(), MCP_CONFIG_FILENAME) } }),
+    [`${ROUTE_BASE}/mcp.list`]: async () => {
+      return { value: { servers: await readMcpServers(ctx) } }
+    },
     [`${ROUTE_BASE}/mcp.upsert`]: async (payload) => {
       const server = normalizeMcpServer(payload.server)
-      const existing = await readMcpServers()
-      const index = existing.findIndex((s) => s.name === server.name)
-      const next = index === -1 ? [...existing, server] : existing.map((s, i) => (i === index ? server : s))
+      const existing = await readMcpServers(ctx)
+      const previous = existing.find((entry) => entry.name === server.name)
+      // Keep the row id and any config field this form does not expose.
+      const merged = previous === undefined
+        ? server
+        : {
+            ...previous,
+            ...server,
+            config: { ...(isRecord(previous.config) ? previous.config : {}), ...(isRecord(server.config) ? server.config : {}) },
+          }
+      const index = existing.findIndex((entry) => entry.name === server.name)
+      const next = index === -1 ? [...existing, merged] : existing.map((entry, i) => (i === index ? merged : entry))
       await writeMcpServers(ctx, next)
       return { value: { name: server.name } }
     },
     [`${ROUTE_BASE}/mcp.remove`]: async (payload) => {
-      const servers = await readMcpServers()
-      const next = servers.filter((s) => s.name !== payload.name)
-      if (next.length === servers.length) throw new ManageError('mcp-not-found', `MCP server "${payload.name}" not found`)
+      const existing = await readMcpServers(ctx)
+      const next = existing.filter((entry) => entry.name !== payload.name)
+      if (next.length === existing.length) throw new ManageError('mcp-not-found', `MCP server "${payload.name}" not found`)
       await writeMcpServers(ctx, next)
       return { value: { removed: true } }
     },
     [`${ROUTE_BASE}/mcp.test`]: async (payload) => {
-      const server = await findMcpServer(payload.name)
+      const server = await findMcpServer(ctx, payload.name)
       if (server === undefined) throw new ManageError('mcp-not-found', `MCP server "${payload.name}" not found`)
       const tools = await testMcpConnection(server)
       return { value: { ok: true, tools } }
@@ -734,6 +873,8 @@ function dispatch(ctx) {
  */
 export function apply(ctx) {
   if (typeof ctx.inject !== 'function') return
+  // One-time: fold the retired manifest file into the profile patch.
+  void migrateMcpManifest(ctx).catch((error) => console.error(`[mcp-skills] manifest migration skipped: ${error}`))
   ctx.inject(['webServer'], (scope) => {
     try {
       scope.webServer.register({ kind: 'prefix', path: ROUTE_BASE, handler: dispatch(ctx) })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-skills",
-  "version": "0.2.2",
+  "version": "0.5.0",
   "description": "DeepSeek Harness web plugin: settings pages for managing user skills and MCP servers",
   "type": "module",
   "repository": {