dsh-my-config 1.7.1 → 1.8.0

package/README.md

@@ -4,12 +4,21 @@ DeepSeek Harness 插件：在 Web 侧边栏提供「我的技能 / 我的连接
 
 | 模块 | 能力 |
 |---|---|
-| 我的技能 | 创建 / 编辑 / 删除 / 导入技能；**ZIP 技能包导入**（多文件包）；**外部技能市场**（内置精选市场 + 任意 `github://owner/repo` 仓库 + JSON 索引市场）；分组管理 |
-| 我的连接器 | 创建 / 编辑（配置）/ 启停 / 删除 MCP 连接器（streamable-http 与 stdio），通过 `ctx.loader` 动态下发 `@deepseek-ai/dsh-mcp-client` 条目；分组管理 |
-| 我的智能体 | 创建 / 编辑 / 删除自定义 Agent 预设；**关联技能**（独立技能目录，精确限定该智能体可见的技能）与**关联连接器**（工具清单注入系统提示词）；分组管理 |
+| 我的技能 | 创建 / 编辑 / 删除 / 导入技能；**ZIP 技能包导入**（多文件包）；**外部技能市场**（内置精选市场 + 任意 `github://owner/repo` 仓库 + JSON 索引市场）；**全字段编辑**（license / compatibility / metadata / allowed-tools，对齐 Agent Skills 开放规范）；**规范校验**（保存/导入时逐字段拦截并定位错误）；分组管理 |
+| 我的连接器 | 创建 / 编辑（配置）/ 启停 / 删除 MCP 连接器（streamable-http 与 stdio），通过 `ctx.loader` 动态下发 `@deepseek-ai/dsh-mcp-client` 条目；**连接测试**（MCP 握手 + 工具清单预览）；**工具级授权**（白名单拦截 + 自动执行放行，经审批 answerer 实现）；**凭据脱敏**（env / headers 掩码显示，防误覆盖）；分组管理 |
+| 我的智能体 | 创建 / 编辑 / 删除自定义 Agent 预设；**关联技能**（独立技能目录，精确限定该智能体可见的技能）与**关联连接器**（工具清单注入系统提示词）；**模型绑定**（provider/model/reasoningEffort 记录与展示）；**工具组白名单**（文件 / 联网 / 终端 / 技能 四组粒度过滤预设组合）；分组管理 |
 
 三个页面统一布局：搜索框 + 分组筛选 + 刷新 + 新建。
 
+## 更新日志
+
+### v1.8.0
+
+- **技能**：编辑器支持 license / compatibility / metadata / allowed-tools 全字段（对齐 agentskills.io 规范）；保存与导入时执行规范校验，错误逐字段定位展示。
+- **连接器**：新增「测试连接」（stdio / streamable-http 真实 MCP 握手，返回工具清单与延迟）；工具级授权（允许使用白名单 + 自动执行列表，经 `approval/request` answerer 拦截/放行）；env / headers 密钥掩码显示与防误覆盖。
+- **智能体**：预设新增模型绑定（provider / model / reasoningEffort）与工具组白名单（文件 / 联网 / 终端 / 技能）。
+- 已知限制：审批拒绝原因经审计日志留痕（内核 outcome 词表无原因通道）；连接器密钥存储仍为本地明文（data.json），请妥善保管该文件。
+
 ## 安装
 
 ```bash

package/client.js

@@ -1,6 +1,6 @@
 /**
- * 管理中心 —— Web 客户端半区。
- * 注册侧边栏面板「管理中心」与 main 面板，包含技能 / 连接器 / 智能体 / 插件四个管理页。
+ * 我的配置 —— Web 客户端半区。
+ * 注册侧边栏面板「我的配置」与 main 面板，包含技能 / 连接器 / 智能体三个管理页。
  * Host 操作走同源 POST /manager-center/api；插件管理走 ctx.get('remote.pluginManager')。
  */
 window.__ModuleLoader__.load({
@@ -16,8 +16,8 @@ window.__ModuleLoader__.load({
     /* ───────────────────────── 文案 ───────────────────────── */
 
     const zh = {
-      panel: '管理中心',
-      title: '管理中心',
+      panel: '我的配置',
+      title: '我的配置',
       intro: '集中管理技能、连接器、智能体与插件',
       tabSkills: '技能',
       tabConnectors: '连接器',
@@ -102,6 +102,18 @@ window.__ModuleLoader__.load({
       skillReadonly: '只读',
       skillInvalid: 'frontmatter 无效',
       skillRoot: '存储目录',
+      skillLicense: '许可证（可选）',
+      skillCompatibility: '兼容性（可选）',
+      skillMetadata: '元数据（键值对，可选）',
+      skillMetadataKey: '键',
+      skillMetadataValue: '值',
+      skillMetadataAdd: '添加一行',
+      skillAllowedTools: '允许的工具（可选）',
+      skillAllowedToolsHint: '实验性功能：写入 frontmatter 的 allowed-tools，空格分隔的工具名',
+      skillErrName: '名称须为小写 kebab-case（字母/数字/连字符），不超过 64 字符',
+      skillErrDescEmpty: '描述不能为空',
+      skillErrDescLong: '描述不能超过 1024 字符',
+      skillErrCompatLong: '兼容性说明不能超过 500 字符',
       marketAdd: '添加市场',
       marketName: '市场名称',
       marketUrl: '市场索引地址（JSON）',
@@ -127,6 +139,16 @@ window.__ModuleLoader__.load({
       connectorLive: '运行中',
       connectorStopped: '未加载',
       connectorToolsHint: '连接后工具以 mcp__{serverName}__ 前缀注册',
+      connectorTest: '测试连接',
+      connectorUntested: '未测试',
+      connectorConnected: '已连接 {n} 个工具',
+      connectorTestFailed: '失败：{reason}',
+      connectorTools: '工具',
+      connectorToolsEmpty: '暂无工具清单，请先点击「测试连接」获取。',
+      connectorToolAllowed: '允许使用',
+      connectorToolAuto: '自动执行',
+      connectorApprovalNever: '当前审批策略为 never，自动执行不生效。',
+      connectorSecretHidden: '敏感值不可查看，如需修改请重新填写。',
       // 智能体
       expertCreate: '创建智能体',
       expertEdit: '编辑智能体',
@@ -139,6 +161,19 @@ window.__ModuleLoader__.load({
       expertDefault: '默认',
       expertBroken: '加载失败',
       expertHint: '自定义智能体注册为 Agent 预设，新会话可在预设选择器中选用。',
+      expertModel: '模型绑定（可选）',
+      expertModelProvider: '提供商（如 anthropic）',
+      expertModelName: '模型名（如 claude-sonnet-4）',
+      expertModelDefault: '跟随默认',
+      expertModelHint: '提供商与模型名均填写才生效；留空 = 跟随默认模型。',
+      expertModelPartial: '模型绑定须同时填写提供商与模型名，或留空。',
+      expertTools: '工具组（可选）',
+      expertToolFs: '文件读写检索',
+      expertToolWeb: '联网',
+      expertToolShell: '终端',
+      expertToolSkills: '技能',
+      expertToolsHint: '留空 = 全部可用。',
+      expertToolsSummary: '工具组',
       // 插件
       pluginInstall: '安装插件',
       pluginSpec: '包名 / Git 地址 / 本地目录',
@@ -157,8 +192,8 @@ window.__ModuleLoader__.load({
     };
 
     const en = {
-      panel: 'Manager',
-      title: 'Manager Center',
+      panel: 'My Config',
+      title: 'My Config',
       intro: 'Manage skills, connectors, agents and plugins in one place',
       tabSkills: 'Skills',
       tabConnectors: 'Connectors',
@@ -242,6 +277,18 @@ window.__ModuleLoader__.load({
       skillReadonly: 'Read-only',
       skillInvalid: 'Invalid frontmatter',
       skillRoot: 'Storage directory',
+      skillLicense: 'License (optional)',
+      skillCompatibility: 'Compatibility (optional)',
+      skillMetadata: 'Metadata (key-value pairs, optional)',
+      skillMetadataKey: 'Key',
+      skillMetadataValue: 'Value',
+      skillMetadataAdd: 'Add row',
+      skillAllowedTools: 'Allowed tools (optional)',
+      skillAllowedToolsHint: 'Experimental: written to frontmatter as allowed-tools, space-separated tool names',
+      skillErrName: 'Name must be lowercase kebab-case (letters/digits/hyphens), max 64 characters',
+      skillErrDescEmpty: 'Description is required',
+      skillErrDescLong: 'Description must be at most 1024 characters',
+      skillErrCompatLong: 'Compatibility must be at most 500 characters',
       marketAdd: 'Add market',
       marketName: 'Market name',
       marketUrl: 'Market index URL (JSON)',
@@ -266,6 +313,16 @@ window.__ModuleLoader__.load({
       connectorLive: 'Live',
       connectorStopped: 'Not loaded',
       connectorToolsHint: 'Tools register with the mcp__{serverName}__ prefix once connected',
+      connectorTest: 'Test connection',
+      connectorUntested: 'Not tested',
+      connectorConnected: 'Connected: {n} tools',
+      connectorTestFailed: 'Failed: {reason}',
+      connectorTools: 'Tools',
+      connectorToolsEmpty: 'No tool list yet. Click "Test connection" to fetch it.',
+      connectorToolAllowed: 'Allow',
+      connectorToolAuto: 'Auto-run',
+      connectorApprovalNever: 'Current approval policy is "never"; auto-run has no effect.',
+      connectorSecretHidden: 'Secret values cannot be viewed. Re-enter to change them.',
       expertCreate: 'New agent',
       expertEdit: 'Edit agent',
       expertId: 'ID (lowercase letters/digits/hyphens)',
@@ -277,6 +334,19 @@ window.__ModuleLoader__.load({
       expertDefault: 'Default',
       expertBroken: 'Broken',
       expertHint: 'Custom agents register as agent presets and can be selected for new sessions.',
+      expertModel: 'Model binding (optional)',
+      expertModelProvider: 'Provider (e.g. anthropic)',
+      expertModelName: 'Model (e.g. claude-sonnet-4)',
+      expertModelDefault: 'Follow default',
+      expertModelHint: 'Both provider and model are required to take effect; empty = follow the default model.',
+      expertModelPartial: 'Model binding requires both provider and model, or leave empty.',
+      expertTools: 'Tool groups (optional)',
+      expertToolFs: 'File read/write & search',
+      expertToolWeb: 'Web access',
+      expertToolShell: 'Terminal',
+      expertToolSkills: 'Skills',
+      expertToolsHint: 'Empty = all available.',
+      expertToolsSummary: 'Tool groups',
       pluginInstall: 'Install plugin',
       pluginSpec: 'Package name / Git URL / local directory',
       pluginUninstall: 'Uninstall',
@@ -350,6 +420,7 @@ window.__ModuleLoader__.load({
 .mc-empty { color: var(--dsw-alias-label-secondary); padding: 48px 0; text-align: center; }
 .mc-error { color: var(--dsw-alias-state-error-primary); padding: 24px 0; text-align: center; display: flex; flex-direction: column; gap: 8px; align-items: center; }
 .mc-hint { font-size: 12px; color: var(--dsw-alias-label-secondary); line-height: 1.6; }
+.mc-field-error { color: var(--dsw-alias-state-error-primary); font-size: 12px; }
 .mc-section { margin-bottom: 20px; }
 .mc-section-title { font-size: 13px; font-weight: 600; margin: 0 0 10px; color: var(--dsw-alias-label-secondary); }
 .mc-row { display: flex; align-items: center; gap: 10px; padding: 10px 14px; background: var(--dsw-alias-bg-layer-1); border: 1px solid var(--dsw-alias-border-l1); border-radius: 10px; margin-bottom: 8px; }
@@ -450,7 +521,11 @@ window.__ModuleLoader__.load({
         clearTimeout(timer);
       }
       const data = await res.json().catch(() => ({ ok: false, message: `HTTP ${res.status} [${url}]` }));
-      if (!data.ok) throw new Error(data.message || `HTTP ${res.status}`);
+      if (!data.ok) {
+        const err = new Error(data.message || `HTTP ${res.status}`);
+        if (Array.isArray(data.errors)) err.fields = data.errors;
+        throw err;
+      }
       return data;
     }
 
@@ -509,17 +584,51 @@ window.__ModuleLoader__.load({
         group: skill?.group ?? '',
         userInvocable: skill?.userInvocable !== false,
         disableModelInvocation: skill?.disableModelInvocation === true,
+        license: skill?.license ?? '',
+        compatibility: skill?.compatibility ?? '',
+        metadata: Object.entries(skill?.metadata ?? {}).map(([key, value]) => ({ key, value: String(value ?? '') })),
+        allowedTools: skill?.allowedTools ?? '',
       });
       const [busy, setBusy] = useState(false);
-      const [error, setError] = useState('');
-      const set = (key) => (e) => setForm({ ...form, [key]: e.target.value });
+      const [error, setError] = useState(undefined); // { message, fields? }
+      const [errors, setErrors] = useState({}); // 本地校验：字段 → 错误文案
+      const validateForm = (f) => {
+        const errs = {};
+        if (f.name.length > 64 || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(f.name)) errs.name = t('skillErrName');
+        if (!f.description.trim()) errs.description = t('skillErrDescEmpty');
+        else if (f.description.length > 1024) errs.description = t('skillErrDescLong');
+        if (f.compatibility.length > 500) errs.compatibility = t('skillErrCompatLong');
+        return errs;
+      };
+      const set = (key) => (e) => {
+        const next = { ...form, [key]: e.target.value };
+        setForm(next);
+        if (Object.keys(errors).length > 0) setErrors(validateForm(next));
+      };
+      const setMetadata = (i, key) => (e) => {
+        const metadata = form.metadata.map((row, idx) => (idx === i ? { ...row, [key]: e.target.value } : row));
+        setForm({ ...form, metadata });
+      };
       const submit = async () => {
-        setBusy(true); setError('');
+        const errs = validateForm(form);
+        setErrors(errs);
+        if (Object.keys(errs).length > 0) return;
+        setBusy(true); setError(undefined);
         try {
-          await api(isEdit ? 'skills.update' : 'skills.create', form);
+          const metadata = {};
+          for (const row of form.metadata) {
+            const k = row.key.trim();
+            if (k) metadata[k] = row.value;
+          }
+          await api(isEdit ? 'skills.update' : 'skills.create', { ...form, metadata });
           onSaved();
-        } catch (err) { setError(err.message); } finally { setBusy(false); }
+        } catch (err) { setError({ message: err.message, fields: err.fields }); } finally { setBusy(false); }
       };
+      const renderServerError = (err) => err && h('div', { className: 'mc-diag' },
+        err.message,
+        (err.fields ?? []).length > 0 && h('ul', { style: { margin: '6px 0 0', paddingLeft: 18 } },
+          err.fields.map((f, i) => h('li', { key: i }, (f.field ? f.field + ': ' : '') + (f.message ?? '')))),
+      );
       return h(Modal, {
         title: isEdit ? t('skillEdit') : t('skillCreate'), onClose,
         footer: [
@@ -527,10 +636,28 @@ window.__ModuleLoader__.load({
           h(Button, { key: 's', kind: 'primary', disabled: busy || !form.name || !form.description, onClick: submit }, busy ? '…' : t('save')),
         ],
       },
-        error && h('div', { className: 'mc-diag' }, error),
-        h(Field, { label: t('skillName') }, h('input', { className: 'mc-input', value: form.name, disabled: isEdit, onChange: set('name'), placeholder: 'my-skill', autoFocus: !isEdit })),
-        h(Field, { label: t('skillDescription') }, h('input', { className: 'mc-input', value: form.description, onChange: set('description') })),
+        renderServerError(error),
+        h(Field, { label: t('skillName') },
+          h('input', { className: 'mc-input', value: form.name, disabled: isEdit, onChange: set('name'), placeholder: 'my-skill', autoFocus: !isEdit }),
+          errors.name && h('span', { className: 'mc-field-error' }, errors.name)),
+        h(Field, { label: t('skillDescription') },
+          h('input', { className: 'mc-input', value: form.description, onChange: set('description') }),
+          errors.description && h('span', { className: 'mc-field-error' }, errors.description)),
         h(Field, { label: t('skillWhenToUse') }, h('input', { className: 'mc-input', value: form.whenToUse, onChange: set('whenToUse') })),
+        h(Field, { label: t('skillCompatibility') },
+          h('input', { className: 'mc-input', value: form.compatibility, onChange: set('compatibility'), placeholder: 'node >= 18, macos' }),
+          errors.compatibility && h('span', { className: 'mc-field-error' }, errors.compatibility)),
+        h(Field, { label: t('skillLicense') }, h('input', { className: 'mc-input', value: form.license, onChange: set('license'), placeholder: 'MIT' })),
+        h(Field, { label: t('skillMetadata') },
+          form.metadata.map((row, i) => h('div', { key: i, style: { display: 'flex', gap: 6, alignItems: 'center' } },
+            h('input', { className: 'mc-input', style: { flex: 1 }, placeholder: t('skillMetadataKey'), value: row.key, onChange: setMetadata(i, 'key') }),
+            h('input', { className: 'mc-input', style: { flex: 2 }, placeholder: t('skillMetadataValue'), value: row.value, onChange: setMetadata(i, 'value') }),
+            h(Button, { className: 'link danger', kind: undefined, 'aria-label': t('delete'), onClick: () => setForm({ ...form, metadata: form.metadata.filter((_, idx) => idx !== i) }) }, '✕'),
+          )),
+          h(Button, { className: 'link', kind: undefined, onClick: () => setForm({ ...form, metadata: [...form.metadata, { key: '', value: '' }] }) }, '+ ' + t('skillMetadataAdd'))),
+        h(Field, { label: t('skillAllowedTools') },
+          h('input', { className: 'mc-input', value: form.allowedTools, onChange: set('allowedTools'), placeholder: 'tool-a tool-b' }),
+          h('span', { className: 'mc-hint' }, t('skillAllowedToolsHint'))),
         h(Field, { label: t('group') }, h('input', { className: 'mc-input', value: form.group, onChange: set('group'), placeholder: t('groupPlaceholder') })),
         h(Field, { label: t('skillContent') }, h('textarea', { className: 'mc-textarea', value: form.content, onChange: set('content'), placeholder: '# ...' })),
         h('label', { className: 'mc-checkbox' }, h('input', { type: 'checkbox', checked: form.userInvocable, onChange: (e) => setForm({ ...form, userInvocable: e.target.checked }) }), t('skillUserInvocable')),
@@ -636,7 +763,7 @@ window.__ModuleLoader__.load({
         setError(undefined);
         if (file.size > 30 * 1024 * 1024) {
           setFileName(''); setContent(''); setZipBase64('');
-          setError(t('importTooLarge'));
+          setError({ message: t('importTooLarge') });
           return;
         }
         setFileName(file.name);
@@ -647,12 +774,12 @@ window.__ModuleLoader__.load({
             let bin = '';
             for (let i = 0; i < buf.length; i += 0x8000) bin += String.fromCharCode.apply(null, buf.subarray(i, i + 0x8000));
             setZipBase64(btoa(bin));
-          } catch { setZipBase64(''); setError(t('importReadFailed')); }
+          } catch { setZipBase64(''); setError({ message: t('importReadFailed') }); }
         } else {
           setZipBase64('');
           const reader = new FileReader();
           reader.onload = () => setContent(String(reader.result ?? ''));
-          reader.onerror = () => setError(t('importReadFailed'));
+          reader.onerror = () => setError({ message: t('importReadFailed') });
           reader.readAsText(file);
         }
       };
@@ -682,7 +809,7 @@ window.__ModuleLoader__.load({
           await api('skills.import', params);
           onImported();
         } catch (err) {
-          setError(err.message);
+          setError({ message: err.message, fields: err.fields });
         } finally {
           setBusy(false);
         }
@@ -713,7 +840,10 @@ window.__ModuleLoader__.load({
         h('label', { style: { display: 'flex', alignItems: 'center', gap: 6, cursor: 'pointer' } },
           h('input', { type: 'checkbox', checked: overwrite, onChange: (e) => setOverwrite(e.target.checked) }),
           t('importOverwrite')),
-        error && h('div', { className: 'mc-error' }, error),
+        error && h('div', { className: 'mc-error' },
+          error.message,
+          (error.fields ?? []).length > 0 && h('ul', { style: { margin: '6px 0 0', paddingLeft: 18, textAlign: 'left' } },
+            error.fields.map((f, i) => h('li', { key: i }, (f.field ? f.field + ': ' : '') + (f.message ?? ''))))),
       );
     }
 
@@ -803,6 +933,8 @@ window.__ModuleLoader__.load({
       });
       const [busy, setBusy] = useState(false);
       const [error, setError] = useState('');
+      // 掩码值（'••••••'）不可查看明文；点击眼睛图标仅提示重新填写
+      const [secretHint, setSecretHint] = useState('');
       const set = (key) => (e) => setForm({ ...form, [key]: e.target.value });
       const submit = async () => {
         setBusy(true); setError('');
@@ -811,6 +943,14 @@ window.__ModuleLoader__.load({
           onSaved();
         } catch (err) { setError(err.message); } finally { setBusy(false); }
       };
+      const secretField = (label, value, key, placeholder) => h(Field, { label },
+        h('textarea', { className: 'mc-textarea', style: { minHeight: 72 }, value, onChange: set(key), placeholder }),
+        h('div', { style: { display: 'flex', alignItems: 'center', gap: 6 } },
+          h(Button, {
+            className: 'link', kind: undefined, 'aria-label': label,
+            onClick: () => setSecretHint(secretHint === key ? '' : key),
+          }, '👁'),
+          secretHint === key && h('span', { className: 'mc-hint' }, t('connectorSecretHidden'))));
       return h(Modal, {
         title: isEdit ? t('connectorEdit') : t('connectorCreate'), onClose,
         footer: [
@@ -829,10 +969,10 @@ window.__ModuleLoader__.load({
           ),
         ),
         form.transport === 'streamable-http' && h(Field, { label: t('connectorUrl') }, h('input', { className: 'mc-input', value: form.url, onChange: set('url'), placeholder: 'https://example.com/mcp' })),
-        form.transport === 'streamable-http' && h(Field, { label: t('connectorHeaders') }, h('textarea', { className: 'mc-textarea', style: { minHeight: 72 }, value: form.headers, onChange: set('headers'), placeholder: 'Authorization=Bearer …' })),
+        form.transport === 'streamable-http' && secretField(t('connectorHeaders'), form.headers, 'headers', 'Authorization=Bearer …'),
         form.transport === 'stdio' && h(Field, { label: t('connectorCommand') }, h('input', { className: 'mc-input', value: form.command, onChange: set('command'), placeholder: 'npx' })),
         form.transport === 'stdio' && h(Field, { label: t('connectorArgs') }, h('textarea', { className: 'mc-textarea', style: { minHeight: 72 }, value: form.args, onChange: set('args'), placeholder: '-y\n@modelcontextprotocol/server-github' })),
-        form.transport === 'stdio' && h(Field, { label: t('connectorEnv') }, h('textarea', { className: 'mc-textarea', style: { minHeight: 72 }, value: form.env, onChange: set('env'), placeholder: 'GITHUB_TOKEN=…' })),
+        form.transport === 'stdio' && secretField(t('connectorEnv'), form.env, 'env', 'GITHUB_TOKEN=…'),
         form.transport === 'stdio' && h(Field, { label: t('connectorCwd') }, h('input', { className: 'mc-input', value: form.cwd, onChange: set('cwd') })),
         h(Field, { label: t('group') }, h('input', { className: 'mc-input', value: form.group, onChange: set('group'), placeholder: t('groupPlaceholder') })),
       );
@@ -846,11 +986,33 @@ window.__ModuleLoader__.load({
       const [busyDelete, setBusyDelete] = useState(false);
       const [groupFilter, setGroupFilter] = useState('');
       const [q, setQ] = useState('');
+      const [expanded, setExpanded] = useState({});
+      // 测试连接结果（易失，不持久）：key → { status:'testing' } | { ok:true, latencyMs, tools } | { ok:false, error }
+      const [testResults, setTestResults] = useState({});
 
       const toggle = async (connector, enabled) => {
         try { await api('connectors.setEnabled', { key: connector.key, enabled }); reload(); }
         catch (err) { toast(err.message, true); }
       };
+      const test = async (connector) => {
+        const key = connector.key;
+        setTestResults((prev) => ({ ...prev, [key]: { status: 'testing' } }));
+        try {
+          const result = await api('connectors.test', { key });
+          setTestResults((prev) => ({ ...prev, [key]: { ok: true, latencyMs: result.latencyMs, tools: result.tools ?? [] } }));
+        } catch (err) {
+          setTestResults((prev) => ({ ...prev, [key]: { ok: false, error: err.message } }));
+        }
+      };
+      const setTools = async (connector, allowed, autoApprove) => {
+        const known = testResults[connector.key]?.tools ?? [];
+        const names = known.map((tool) => tool.name);
+        const mode = allowed.length >= names.length && names.length > 0 ? 'all' : 'whitelist';
+        try {
+          await api('connectors.setTools', { key: connector.key, mode, tools: allowed, autoApprove });
+          reload();
+        } catch (err) { toast(err.message, true); }
+      };
       const doDelete = async () => {
         setBusyDelete(true);
         try { await api('connectors.delete', { key: deleting.key }); toast(t('deleted')); setDeleting(undefined); reload(); }
@@ -863,6 +1025,8 @@ window.__ModuleLoader__.load({
       const connectors = allConnectors.filter((c) =>
         (!groupFilter || c.group === groupFilter) &&
         (!needle || (c.label + ' ' + c.serverName + ' ' + c.key + ' ' + (c.transport ?? '') + ' ' + (c.url || '') + ' ' + (c.command || '')).toLowerCase().includes(needle)));
+      // 审批策略：Host 若暴露则读取（列表级或行级），缺省视为非 never
+      const approvalNever = (state.data?.approvalPolicy ?? '') === 'never';
       return h('div', null,
         h('div', { className: 'mc-toolbar' },
           h('span', { className: 'mc-spacer' }),
@@ -877,26 +1041,80 @@ window.__ModuleLoader__.load({
         state.status === 'error' && h('div', { className: 'mc-error' }, t('loadFailed') + ': ' + state.error.message, h(Button, { onClick: reload }, t('retry'))),
         state.status !== 'error' && h('div', { className: 'mc-grid' },
           connectors.length === 0 && state.status === 'done' && h('div', { className: 'mc-empty' }, t('empty')),
-          connectors.map((connector) => h('div', { key: connector.key, className: 'mc-card' },
-            h('div', { className: 'mc-card-title' }, connector.label || connector.serverName,
-              connector.group && h(Badge, { tone: 'info' }, connector.group),
-              h(Badge, { tone: 'brand' }, connector.transport),
-              connector.external
-                ? h(Badge, null, t('connectorExternal'))
-                : connector.live
-                  ? h(Badge, { tone: connector.enabled === false ? undefined : 'success' }, connector.enabled === false ? t('disabled') : t('connectorLive'))
-                  : h(Badge, { tone: 'warn' }, t('connectorStopped')),
-            ),
-            h('div', { className: 'mc-card-meta' }, 'mcp__' + connector.serverName + '__*'),
-            h('div', { className: 'mc-card-desc' }, connector.transport === 'stdio'
-              ? [connector.command, ...(connector.args ?? [])].join(' ')
-              : connector.url),
-            !connector.external && h('div', { className: 'mc-card-actions' },
-              h(Switch, { checked: connector.enabled !== false, onChange: (v) => toggle(connector, v), title: connector.enabled !== false ? t('disable') : t('enable') }),
-              h(Button, { className: 'link', onClick: () => setEditing(connector) }, t('edit')),
-              h(Button, { className: 'link danger', onClick: () => setDeleting(connector) }, t('delete')),
-            ),
-          )),
+          connectors.map((connector) => {
+            const result = testResults[connector.key];
+            const testing = result?.status === 'testing';
+            const tools = result?.ok ? (result.tools ?? []) : [];
+            const policy = connector.toolPolicy ?? { mode: 'all', tools: [], autoApprove: [] };
+            const allowedSet = new Set(policy.mode === 'all' ? tools.map((tool) => tool.name) : (policy.tools ?? []));
+            const autoSet = new Set(policy.autoApprove ?? []);
+            const open = expanded[connector.key] === true;
+            const saveTools = (nextAllowed, nextAuto) =>
+              setTools(connector, tools.map((tool) => tool.name).filter((name) => nextAllowed.has(name)), tools.map((tool) => tool.name).filter((name) => nextAuto.has(name)));
+            return h('div', { key: connector.key, className: 'mc-card' },
+              h('div', { className: 'mc-card-title' }, connector.label || connector.serverName,
+                connector.group && h(Badge, { tone: 'info' }, connector.group),
+                h(Badge, { tone: 'brand' }, connector.transport),
+                connector.external
+                  ? h(Badge, null, t('connectorExternal'))
+                  : connector.live
+                    ? h(Badge, { tone: connector.enabled === false ? undefined : 'success' }, connector.enabled === false ? t('disabled') : t('connectorLive'))
+                    : h(Badge, { tone: 'warn' }, t('connectorStopped')),
+              ),
+              h('div', { className: 'mc-card-meta' }, 'mcp__' + connector.serverName + '__*'),
+              h('div', { className: 'mc-card-desc' }, connector.transport === 'stdio'
+                ? [connector.command, ...(connector.args ?? [])].join(' ')
+                : connector.url),
+              !connector.external && h('div', { className: 'mc-card-actions' },
+                h(Switch, { checked: connector.enabled !== false, onChange: (v) => toggle(connector, v), title: connector.enabled !== false ? t('disable') : t('enable') }),
+                h(Button, { className: 'link', disabled: testing, onClick: () => test(connector) }, testing ? '…' : t('connectorTest')),
+                h(Badge, {
+                  tone: result?.ok ? 'success' : result?.ok === false ? 'error' : undefined,
+                  title: result?.ok ? result.latencyMs + ' ms' : (result?.error ?? ''),
+                }, testing
+                  ? '…'
+                  : result?.ok
+                    ? t('connectorConnected').replace('{n}', String(result.tools?.length ?? 0))
+                    : result?.ok === false
+                      ? t('connectorTestFailed').replace('{reason}', (result.error || '').slice(0, 60))
+                      : t('connectorUntested')),
+                h('span', { className: 'mc-spacer' }),
+                h(Button, { className: 'link', onClick: () => setExpanded({ ...expanded, [connector.key]: !open }) }, (open ? '▾ ' : '▸ ') + t('connectorTools')),
+                h(Button, { className: 'link', onClick: () => setEditing(connector) }, t('edit')),
+                h(Button, { className: 'link danger', onClick: () => setDeleting(connector) }, t('delete')),
+              ),
+              !connector.external && open && h('div', null,
+                tools.length === 0 && h('div', { className: 'mc-row-sub', style: { marginBottom: 6 } }, t('connectorToolsEmpty')),
+                tools.map((tool) => h('div', { key: tool.name, className: 'mc-row', style: { padding: '6px 10px', marginBottom: 6 } },
+                  h('div', { className: 'mc-row-main' },
+                    h('div', { className: 'mc-row-title' }, tool.name),
+                    tool.description && h('div', { className: 'mc-row-sub' }, tool.description),
+                  ),
+                  h('label', { className: 'mc-checkbox', style: { fontSize: 12 } },
+                    h('input', {
+                      type: 'checkbox', checked: allowedSet.has(tool.name),
+                      onChange: (e) => {
+                        const nextAllowed = new Set(allowedSet);
+                        const nextAuto = new Set(autoSet);
+                        if (e.target.checked) nextAllowed.add(tool.name);
+                        else { nextAllowed.delete(tool.name); nextAuto.delete(tool.name); }
+                        saveTools(nextAllowed, nextAuto);
+                      },
+                    }), t('connectorToolAllowed')),
+                  h('label', { className: 'mc-checkbox', style: { fontSize: 12 } },
+                    h('input', {
+                      type: 'checkbox', checked: autoSet.has(tool.name), disabled: !allowedSet.has(tool.name),
+                      onChange: (e) => {
+                        const nextAuto = new Set(autoSet);
+                        if (e.target.checked) nextAuto.add(tool.name); else nextAuto.delete(tool.name);
+                        saveTools(allowedSet, nextAuto);
+                      },
+                    }), t('connectorToolAuto')),
+                )),
+                approvalNever && h('div', { className: 'mc-hint' }, t('connectorApprovalNever')),
+              ),
+            );
+          }),
         ),
         editing && h(ConnectorEditModal, { t, connector: editing.key ? editing : undefined, onClose: () => setEditing(undefined), onSaved: () => { setEditing(undefined); toast(t('saved')); reload(); } }),
         deleting && h(ConfirmModal, { t, title: t('confirmDelete'), message: t('confirmDeleteBody').replace('{name}', deleting.label || deleting.serverName), busy: busyDelete, onClose: () => setDeleting(undefined), onConfirm: doDelete }),
@@ -957,14 +1175,29 @@ window.__ModuleLoader__.load({
         // undefined（旧数据）= 全部技能；编辑时显式化为全选列表
         skills: expert?.skills ?? (expert ? allSkills.map((s) => s.name) : []),
         connectors: expert?.connectors ?? [],
+        // 模型绑定：provider+model 均填写才提交；否则缺省不传（跟随默认）
+        modelProvider: expert?.model?.provider ?? '',
+        modelModel: expert?.model?.model ?? '',
+        modelReasoning: expert?.model?.reasoningEffort ?? '',
+        // 工具组白名单：空数组/缺省 = 全部可用
+        tools: expert?.tools ?? [],
       });
       const [busy, setBusy] = useState(false);
       const [error, setError] = useState('');
+      const modelError = (form.modelProvider && !form.modelModel) || (!form.modelProvider && form.modelModel)
+        ? t('expertModelPartial') : '';
       const set = (key) => (e) => setForm({ ...form, [key]: e.target.value });
       const submit = async () => {
+        if (modelError) return;
         setBusy(true); setError('');
         try {
-          await api(isEdit ? 'experts.update' : 'experts.create', form);
+          const { modelProvider, modelModel, modelReasoning, ...rest } = form;
+          const payload = { ...rest };
+          if (modelProvider && modelModel) {
+            payload.model = { provider: modelProvider, model: modelModel };
+            if (modelReasoning) payload.model.reasoningEffort = modelReasoning;
+          }
+          await api(isEdit ? 'experts.update' : 'experts.create', payload);
           onSaved();
         } catch (err) { setError(err.message); } finally { setBusy(false); }
       };
@@ -981,6 +1214,25 @@ window.__ModuleLoader__.load({
         h(Field, { label: t('expertDescription') }, h('input', { className: 'mc-input', value: form.description, onChange: set('description') })),
         h(Field, { label: t('group') }, h('input', { className: 'mc-input', value: form.group, onChange: set('group'), placeholder: t('groupPlaceholder') })),
         h(Field, { label: t('expertPrefix') }, h('textarea', { className: 'mc-textarea', value: form.prefix, onChange: set('prefix'), placeholder: 'You are …' })),
+        h(Field, { label: t('expertModel') },
+          h('div', { style: { display: 'flex', gap: 6, flexWrap: 'wrap' } },
+            h('input', { className: 'mc-input', style: { flex: 1, minWidth: 140 }, placeholder: t('expertModelProvider'), value: form.modelProvider, onChange: set('modelProvider') }),
+            h('input', { className: 'mc-input', style: { flex: 1, minWidth: 140 }, placeholder: t('expertModelName'), value: form.modelModel, onChange: set('modelModel') }),
+            h('select', { className: 'mc-select', value: form.modelReasoning, onChange: set('modelReasoning'), title: 'reasoningEffort' },
+              h('option', { value: '' }, t('expertModelDefault')),
+              ['low', 'medium', 'high'].map((v) => h('option', { key: v, value: v }, v)))),
+          h('span', { className: 'mc-hint' }, t('expertModelHint')),
+          modelError && h('span', { className: 'mc-field-error' }, modelError)),
+        h(Field, { label: t('expertTools') },
+          h('div', { style: { display: 'flex', gap: 12, flexWrap: 'wrap' } },
+            [['fs', t('expertToolFs')], ['web', t('expertToolWeb')], ['shell', t('expertToolShell')], ['skills', t('expertToolSkills')]].map(([value, labelText]) =>
+              h('label', { key: value, className: 'mc-checkbox', style: { fontSize: 12 } },
+                h('input', {
+                  type: 'checkbox', checked: form.tools.includes(value),
+                  onChange: (e) => setForm({ ...form, tools: e.target.checked ? [...form.tools, value] : form.tools.filter((v) => v !== value) }),
+                }),
+                labelText))),
+          h('span', { className: 'mc-hint' }, t('expertToolsHint'))),
         h(LinkPicker, {
           t, title: t('expertSkills'), items: allSkills,
           selected: form.skills.filter((n) => allSkills.some((s) => s.name === n)),
@@ -1040,9 +1292,14 @@ window.__ModuleLoader__.load({
               expert.custom ? h(Badge, { tone: 'brand' }, t('expertCustom')) : h(Badge, null, t('expertBuiltin')),
               expert.isDefault && h(Badge, { tone: 'success' }, t('expertDefault')),
               expert.broken && h(Badge, { tone: 'error' }, t('expertBroken')),
+              expert.model && h(Badge, { tone: 'brand' }, expert.model.provider + '/' + expert.model.model),
             ),
             h('div', { className: 'mc-card-desc' }, expert.description || '—'),
             h('div', { className: 'mc-card-meta' }, expert.id + (expert.broken ? ' · ' + expert.broken : '')),
+            expert.custom && (expert.tools ?? []).length > 0 && h('div', { className: 'mc-card-meta' },
+              t('expertToolsSummary') + ': ' + expert.tools
+                .map((v) => ({ fs: t('expertToolFs'), web: t('expertToolWeb'), shell: t('expertToolShell'), skills: t('expertToolSkills') }[v] ?? v))
+                .join(', ')),
             expert.custom && (expert.skills !== undefined || expert.connectors !== undefined) && h('div', { className: 'mc-card-meta' },
               t('expertLinkedMeta')
                 .replace('{skills}', expert.skills === undefined ? t('expertSkillsAll') : expert.skills.length)