dsh-plugin-capabilities 0.1.6 → 0.2.1

package/lib/index.js

@@ -1,7 +1,7 @@
 // src/index.ts
-import { existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { existsSync as existsSync7 } from "node:fs";
+import { dirname as dirname4, join as join9 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/agents.ts
 import { existsSync, readFileSync } from "node:fs";
@@ -769,6 +769,9 @@ function profileDir(profile, dshHome = process.env.DSH_HOME) {
   return join2(home, "profiles", profile);
 }
 
+// src/routes.ts
+import { mkdirSync as mkdirSync6 } from "node:fs";
+
 // src/http.ts
 async function readJsonBody(request) {
   const chunks = [];
@@ -801,16 +804,452 @@ function sendJson(response, status, body) {
   response.end(payload);
 }
 
-// src/restart.ts
+// src/market.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { dirname, join as join3 } from "node:path";
+import { fileURLToPath } from "node:url";
+function marketIndexUrl(kind) {
+  return `https://raw.githubusercontent.com/qinyre/dsh-plugin-capabilities/main/market/${kind}.json`;
+}
+function bundledMarketPath(kind) {
+  return join3(dirname(fileURLToPath(import.meta.url)), "..", "market", `${kind}.json`);
+}
+var isString = (value) => typeof value === "string" && value !== "";
+var isStringArray = (value) => Array.isArray(value) && value.every(isString);
+function parseSkillsIndex(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const repos = parsed.repos;
+  if (!Array.isArray(repos)) return null;
+  const out = [];
+  for (const entry of repos) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const record = entry;
+    if (!isString(record.id) || !isString(record.name) || !isString(record.description) || !isString(record.url)) continue;
+    out.push({
+      id: record.id,
+      name: record.name,
+      ...isString(record.nameZh) ? { nameZh: record.nameZh } : {},
+      description: record.description,
+      ...isString(record.descriptionZh) ? { descriptionZh: record.descriptionZh } : {},
+      url: record.url,
+      ...isString(record.homepage) ? { homepage: record.homepage } : {},
+      ...typeof record.skillCount === "number" ? { skillCount: record.skillCount } : {}
+    });
+  }
+  return out.length > 0 ? out : null;
+}
+function parseMcpIndex(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const servers = parsed.servers;
+  if (!Array.isArray(servers)) return null;
+  const out = [];
+  for (const entry of servers) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const record = entry;
+    if (!isString(record.id) || !isString(record.name) || !isString(record.description) || !isString(record.homepage)) continue;
+    const transport = record.transport === "streamable-http" ? "streamable-http" : "stdio";
+    if (transport === "stdio" && !isString(record.command)) continue;
+    if (transport === "streamable-http" && !isString(record.url)) continue;
+    out.push({
+      id: record.id,
+      name: record.name,
+      ...isString(record.nameZh) ? { nameZh: record.nameZh } : {},
+      description: record.description,
+      ...isString(record.descriptionZh) ? { descriptionZh: record.descriptionZh } : {},
+      transport,
+      ...isString(record.command) ? { command: record.command } : {},
+      ...isStringArray(record.args) ? { args: record.args } : {},
+      ...isStringArray(record.envKeys) ? { envKeys: record.envKeys } : {},
+      ...isString(record.url) ? { url: record.url } : {},
+      homepage: record.homepage,
+      ...isString(record.category) ? { category: record.category } : {},
+      ...isString(record.runtime) ? { runtime: record.runtime } : {}
+    });
+  }
+  return out.length > 0 ? out : null;
+}
+async function loadMarketIndex(kind, options = {}) {
+  const doFetch = options.fetcher ?? fetch;
+  if (kind === "skills") {
+    const remote = await fetchIndex(doFetch, "skills", parseSkillsIndex, options);
+    if (remote !== null) return { source: "remote", skills: remote };
+  } else {
+    const remote = await fetchIndex(doFetch, "mcp", parseMcpIndex, options);
+    if (remote !== null) return { source: "remote", servers: remote };
+  }
+  const bundled = bundledMarketPath(kind);
+  if (!existsSync2(bundled)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync2(bundled, "utf8"));
+    if (kind === "skills") {
+      const skills = parseSkillsIndex(parsed);
+      return skills === null ? null : { source: "bundled", skills };
+    }
+    const servers = parseMcpIndex(parsed);
+    return servers === null ? null : { source: "bundled", servers };
+  } catch {
+    return null;
+  }
+}
+async function fetchIndex(doFetch, kind, parse2, options) {
+  try {
+    const response = await doFetch(marketIndexUrl(kind), { signal: AbortSignal.timeout(options.timeoutMs ?? 8e3) });
+    if (!response.ok) return null;
+    return parse2(await response.json());
+  } catch {
+    return null;
+  }
+}
+
+// src/opener.ts
 import { spawn } from "node:child_process";
+import { statSync } from "node:fs";
+function openDirectory(dir) {
+  try {
+    if (!statSync(dir).isDirectory()) return false;
+  } catch {
+    return false;
+  }
+  if (process.platform === "win32") {
+    dir = dir.split("/").join("\\");
+  }
+  const launcher = process.platform === "win32" ? "explorer" : process.platform === "darwin" ? "open" : "xdg-open";
+  try {
+    const child = spawn(launcher, [dir], { detached: true, stdio: "ignore" });
+    child.once("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/repos.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readdirSync, rmSync as rmSync2, statSync as statSync2, symlinkSync } from "node:fs";
+import { basename, join as join6, resolve } from "node:path";
+
+// src/state.ts
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, rmSync, writeFileSync } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join4 } from "node:path";
+import { randomBytes } from "node:crypto";
+function pluginStateDir(dshHome = process.env.DSH_HOME) {
+  return join4(dshHome ?? join4(homedir3(), ".dsh"), "dsh-plugin-capabilities");
+}
+function statePath(dshHome) {
+  return join4(pluginStateDir(dshHome), "state.json");
+}
+function emptyState() {
+  return { skillRoots: [] };
+}
+function loadState(dshHome) {
+  const path = statePath(dshHome);
+  if (!existsSync3(path)) return emptyState();
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    if (!Array.isArray(parsed.skillRoots)) return emptyState();
+    const roots = parsed.skillRoots.filter((entry) => typeof entry === "object" && entry !== null && typeof entry.id === "string" && Array.isArray(entry.roots));
+    return { skillRoots: roots };
+  } catch {
+    return emptyState();
+  }
+}
+function saveState(state, dshHome) {
+  const dir = pluginStateDir(dshHome);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(statePath(dshHome), JSON.stringify(state, null, 2) + "\n", "utf8");
+}
+function newEntryId(kind) {
+  return `${kind}-${randomBytes(4).toString("hex")}`;
+}
+function materialDirFor(entryId, dshHome) {
+  return join4(pluginStateDir(dshHome), "repos", entryId);
+}
+function addSkillRoot(entry, dshHome) {
+  const state = loadState(dshHome);
+  const stored = { ...entry, addedAt: Date.now() };
+  state.skillRoots.push(stored);
+  saveState(state, dshHome);
+  return stored;
+}
+function removeSkillRoot(id, dshHome) {
+  const state = loadState(dshHome);
+  const at = state.skillRoots.findIndex((entry) => entry.id === id);
+  if (at === -1) return false;
+  const [removed] = state.skillRoots.splice(at, 1);
+  saveState(state, dshHome);
+  if (removed.materialDir !== void 0) {
+    rmSync(removed.materialDir, { recursive: true, force: true, maxRetries: 2 });
+  }
+  return true;
+}
+function findRootByUrl(url, dshHome) {
+  return loadState(dshHome).skillRoots.find((entry) => entry.url === url);
+}
+
+// src/tar.ts
+import { gunzipSync } from "node:zlib";
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join5 } from "node:path";
+var LIMITS = {
+  /** Per-entry cap (a skill repo holds markdown and small assets). */
+  entryBytes: 64 * 1024 * 1024,
+  /** Whole-archive content cap. */
+  totalBytes: 256 * 1024 * 1024,
+  /** Entry count cap (also bounds loop time on corrupt input). */
+  entries: 2e4
+};
+function octal(block, offset, length) {
+  const raw = block.toString("utf8", offset, offset + length).replace(/[\0 ]+$/, "");
+  return raw === "" ? 0 : Number.parseInt(raw, 8);
+}
+function field(block, offset, length) {
+  const at = block.indexOf(0, offset);
+  return block.toString("utf8", offset, Math.min(at === -1 ? offset + length : at, offset + length));
+}
+function readHeader(block) {
+  if (block.every((byte) => byte === 0)) return null;
+  const checksum = octal(block, 148, 8);
+  let sum = 0;
+  for (let at = 0; at < 512; at++) sum += at >= 148 && at < 156 ? 32 : block[at];
+  if (sum !== checksum) return null;
+  const magic = block.toString("utf8", 257, 257 + 6);
+  let name2 = field(block, 0, 100);
+  if (magic.startsWith("ustar")) {
+    const prefix = field(block, 345, 155);
+    if (prefix !== "") name2 = `${prefix}/${name2}`;
+  }
+  return { name: name2, size: octal(block, 124, 12), type: block.toString("utf8", 156, 157) };
+}
+function safeJoin(target, name2) {
+  const normalized = name2.replace(/\\/g, "/");
+  if (normalized.startsWith("/") || /^[A-Za-z]:/.test(normalized)) return null;
+  const parts = [];
+  for (const part of normalized.split("/")) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") return null;
+    parts.push(part);
+  }
+  if (parts.length === 0) return null;
+  return join5(target, ...parts);
+}
+function paxRecords(content) {
+  const out = /* @__PURE__ */ new Map();
+  let cursor = 0;
+  while (cursor < content.length) {
+    const spaceAt = content.indexOf(" ", cursor);
+    if (spaceAt === -1) break;
+    const length = Number.parseInt(content.toString("utf8", cursor, spaceAt), 10);
+    if (!Number.isInteger(length) || length <= 0 || cursor + length > content.length) break;
+    const record = content.toString("utf8", spaceAt + 1, cursor + length).trimEnd();
+    const eq = record.indexOf("=");
+    if (eq > 0) out.set(record.slice(0, eq), record.slice(eq + 1));
+    cursor += length;
+  }
+  return out;
+}
+function extractTarGz(archive, target, options = {}) {
+  const tar = gunzipSync(archive);
+  const strip = options.stripComponents ?? 0;
+  let offset = 0;
+  let written = 0;
+  let total = 0;
+  let pendingLongName;
+  let pendingPath;
+  while (offset + 512 <= tar.length) {
+    const header = readHeader(tar.subarray(offset, offset + 512));
+    if (header === null) break;
+    offset += 512;
+    const contentEnd = offset + header.size;
+    if (contentEnd > tar.length) throw new Error("truncated tar entry");
+    const content = tar.subarray(offset, contentEnd);
+    offset += Math.ceil(header.size / 512) * 512;
+    if (header.size > LIMITS.entryBytes) throw new Error("tar entry too large");
+    total += header.size;
+    if (total > LIMITS.totalBytes) throw new Error("tar archive too large");
+    if (++written > LIMITS.entries) throw new Error("too many tar entries");
+    if (header.type === "L") {
+      pendingLongName = field(content, 0, content.length);
+      continue;
+    }
+    if (header.type === "x" || header.type === "X") {
+      pendingPath = paxRecords(content).get("path");
+      continue;
+    }
+    if (header.type === "g") continue;
+    let name2 = pendingLongName ?? pendingPath ?? header.name;
+    pendingLongName = void 0;
+    pendingPath = void 0;
+    const parts = name2.split("/");
+    if (parts.length <= strip) continue;
+    name2 = parts.slice(strip).join("/");
+    if (name2 === "" || name2 === "/") continue;
+    const isDir = header.type === "5" || (header.type === "0" || header.type === "\0") && name2.endsWith("/");
+    if (header.type !== "0" && header.type !== "\0" && header.type !== "5") continue;
+    const resolved = safeJoin(target, name2);
+    if (resolved === null) throw new Error(`unsafe tar entry name: ${name2}`);
+    if (isDir) {
+      mkdirSync2(resolved, { recursive: true });
+      continue;
+    }
+    mkdirSync2(dirname2(resolved), { recursive: true });
+    writeFileSync2(resolved, content);
+  }
+  return written;
+}
+
+// src/repos.ts
+var GITHUB_URL_RE = /^(?:https?:\/\/)?github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?(?:\/(?:tree|archive)\/([^/#?]+?)(?:\.tar\.gz)?)?(?:#([^/?#]+))?(?:[/?#].*)?$/;
+var GITHUB_SHORT_RE = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
+function parseGitHubSource(input) {
+  const trimmed = input.trim();
+  if (trimmed === "") return null;
+  let owner = "";
+  let repo = "";
+  let ref;
+  let match = GITHUB_URL_RE.exec(trimmed);
+  if (match !== null) {
+    const treeRef = match[3] !== void 0 ? match[3] : void 0;
+    const hashRef = match[4] !== void 0 ? match[4] : void 0;
+    owner = match[1];
+    repo = match[2];
+    ref = treeRef ?? hashRef;
+  } else {
+    match = GITHUB_SHORT_RE.exec(trimmed);
+    if (match === null) return null;
+    [, owner, repo] = match;
+    ref = void 0;
+  }
+  const decodedRef = ref !== void 0 ? decodeURIComponent(ref) : void 0;
+  const label = `${owner}/${repo}`;
+  const tarballUrl = `https://codeload.github.com/${owner}/${repo}/tar.gz/${decodedRef ?? "HEAD"}`;
+  return { owner, repo, ref: decodedRef, label, tarballUrl };
+}
+function looksLikeSkillFile(file) {
+  try {
+    return readFileSync4(file, "utf8").startsWith("---");
+  } catch {
+    return false;
+  }
+}
+function holdsSkills(dir) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return false;
+  }
+  if (existsSync4(join6(dir, "SKILL.md"))) return true;
+  for (const name2 of entries) {
+    if (name2.endsWith(".md") && looksLikeSkillFile(join6(dir, name2))) return true;
+  }
+  for (const name2 of entries) {
+    const child = join6(dir, name2);
+    try {
+      if (statSync2(child).isDirectory() && existsSync4(join6(child, "SKILL.md"))) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function detectSkillRoots(checkout) {
+  if (existsSync4(join6(checkout, "SKILL.md"))) return { roots: [], single: true };
+  const roots = [];
+  if (holdsSkills(checkout)) roots.push(checkout);
+  let entries;
+  try {
+    entries = readdirSync(checkout);
+  } catch {
+    return { roots, single: false };
+  }
+  for (const name2 of entries) {
+    if (name2.startsWith(".")) continue;
+    const child = join6(checkout, name2);
+    try {
+      if (!statSync2(child).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    if (existsSync4(join6(child, "SKILL.md"))) continue;
+    if (holdsSkills(child)) roots.push(child);
+  }
+  return { roots, single: false };
+}
+async function addLocalRepo(path, dshHome) {
+  const resolved = resolve(path.trim().replace(/^"|"$/g, ""));
+  if (!existsSync4(resolved) || !statSync2(resolved).isDirectory()) {
+    throw new Error(`not a directory: ${resolved}`);
+  }
+  const detected = detectSkillRoots(resolved);
+  if (!detected.single && detected.roots.length === 0) {
+    throw new Error("no SKILL.md found under that path (expected a skill folder or a folder of skill folders)");
+  }
+  if (detected.single) {
+    const id = newEntryId("local");
+    const material = materialDirFor(id, dshHome);
+    rmSync2(material, { recursive: true, force: true });
+    mkdirSync3(material, { recursive: true });
+    try {
+      symlinkSync(resolved, join6(material, "skill"), process.platform === "win32" ? "junction" : "dir");
+    } catch {
+      rmSync2(material, { recursive: true, force: true });
+      throw new Error("single-skill local folders need a directory link; try adding their parent folder instead");
+    }
+    return addSkillRoot({ id, kind: "local", label: basename(resolved), path: resolved, roots: [material], materialDir: material }, dshHome);
+  }
+  return addSkillRoot({ id: newEntryId("local"), kind: "local", label: basename(resolved), path: resolved, roots: detected.roots }, dshHome);
+}
+var TARBALL_MAX_BYTES = 256 * 1024 * 1024;
+async function addGitRepo(url, options = {}) {
+  const source = parseGitHubSource(url);
+  if (source === null) throw new Error("expected a GitHub repository URL or owner/repo");
+  const existing = findRootByUrl(source.label, options.dshHome);
+  if (existing !== void 0) throw new Error(`${source.label} is already registered`);
+  const doFetch = options.fetcher ?? fetch;
+  const response = await doFetch(source.tarballUrl, { signal: AbortSignal.timeout(6e4) });
+  if (!response.ok) throw new Error(`download failed (HTTP ${response.status}) for ${source.tarballUrl}`);
+  const archive = Buffer.from(await response.arrayBuffer());
+  if (archive.byteLength > TARBALL_MAX_BYTES) throw new Error("repository tarball too large");
+  const id = newEntryId("git");
+  const material = materialDirFor(id, options.dshHome);
+  rmSync2(material, { recursive: true, force: true });
+  const checkout = join6(material, "repo");
+  try {
+    mkdirSync3(checkout, { recursive: true });
+    extractTarGz(archive, checkout, { stripComponents: 1 });
+    const detected = detectSkillRoots(checkout);
+    if (!detected.single && detected.roots.length === 0) {
+      throw new Error("no SKILL.md found in that repository");
+    }
+    const roots = detected.single ? [material] : detected.roots;
+    return addSkillRoot(
+      { id, kind: "git", label: source.label, url: source.label, ref: source.ref, roots, materialDir: material },
+      options.dshHome
+    );
+  } catch (error) {
+    rmSync2(material, { recursive: true, force: true });
+    throw error;
+  }
+}
+function rootExists(path) {
+  try {
+    return statSync2(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+// src/restart.ts
+import { spawn as spawn2 } from "node:child_process";
 import { openSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, resolve } from "node:path";
+import { dirname as dirname3, resolve as resolve2 } from "node:path";
 function dshLaunch(argv = process.argv, execArgv = process.execArgv) {
   const entry = argv[1];
   if (entry !== void 0 && /[\\/](?:bin\.(?:js|ts)|dsh)$/.test(entry)) {
-    const abs = resolve(entry);
-    return { file: process.execPath, args: [...execArgv, abs, ...argv.slice(2)], cwd: dirname(abs), viaShell: false };
+    const abs = resolve2(entry);
+    return { file: process.execPath, args: [...execArgv, abs, ...argv.slice(2)], cwd: dirname3(abs), viaShell: false };
   }
   return { file: "dsh", args: [...argv.slice(2)], cwd: void 0, viaShell: process.platform === "win32" };
 }
@@ -818,7 +1257,7 @@ function scheduleRestart(launch) {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
   const logOut = `${tmpdir()}${tmpdir().endsWith("/") ? "" : "\\"}dsh-plugin-capabilities-restart-${stamp}.out.log`;
   const logErr = logOut.replace(".out.log", ".err.log");
-  const child = spawn(launch.file, launch.args, {
+  const child = spawn2(launch.file, launch.args, {
     cwd: launch.cwd,
     stdio: ["ignore", openSync(logOut, "a"), openSync(logErr, "a")],
     env: process.env,
@@ -848,12 +1287,12 @@ function restartOwnedByShell(env = process.env) {
 }
 
 // src/skills.ts
-import { existsSync as existsSync2, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync as rmSync3, statSync as statSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join7 } from "node:path";
 var SKILL_NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function userSkillsDir(dshHome = process.env.DSH_HOME) {
-  return join3(dshHome ?? join3(homedir3(), ".dsh"), "skills");
+  return join7(dshHome ?? join7(homedir4(), ".dsh"), "skills");
 }
 function quote(value) {
   return JSON.stringify(value);
@@ -883,40 +1322,51 @@ function validateSkillInput(input) {
   return null;
 }
 function skillDir(name2, dshHome) {
-  return join3(userSkillsDir(dshHome), name2);
+  return join7(userSkillsDir(dshHome), name2);
 }
 function writeSkill(input, dshHome) {
   const dir = skillDir(input.name, dshHome);
-  mkdirSync(dir, { recursive: true });
-  const file = join3(dir, "SKILL.md");
-  writeFileSync(file, serializeSkill(input), "utf8");
+  mkdirSync4(dir, { recursive: true });
+  const file = join7(dir, "SKILL.md");
+  writeFileSync3(file, serializeSkill(input), "utf8");
   return file;
 }
 function deleteSkill(name2, dshHome) {
   if (!SKILL_NAME_RE.test(name2)) return false;
   const dir = skillDir(name2, dshHome);
-  if (!existsSync2(dir) || !statSync(dir).isDirectory()) return false;
-  rmSync(dir, { recursive: true, force: true });
+  if (!existsSync5(dir) || !statSync3(dir).isDirectory()) return false;
+  rmSync3(dir, { recursive: true, force: true });
   return true;
 }
+function setSkillPolicy(file, enabled) {
+  const text = readFileSync5(file, "utf8");
+  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+  if (match === null) throw new Error("skill file has no frontmatter block");
+  const newline = text.includes("\r\n---") ? "\r\n" : "\n";
+  const body = text.slice(match[0].length);
+  const lines = match[1].split(/\r?\n/);
+  const kept = lines.filter((line) => !/^(disable-model-invocation|user-invocable):/.test(line));
+  if (!enabled) kept.push("disable-model-invocation: true", "user-invocable: false");
+  writeFileSync3(file, `---${newline}${kept.join(newline)}${newline}---${body}`, "utf8");
+}
 
 // src/mcp.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join8 } from "node:path";
 import { parseDocument, Document } from "yaml";
 var MCP_PLUGIN = "@deepseek-ai/dsh-mcp-client";
 var SERVER_NAME_RE = /^[A-Za-z0-9_-]{1,32}$/;
 function loadPatch(profileDirPath) {
-  const path = join4(profileDirPath, "cordis.patch.yml");
-  const text = existsSync3(path) ? readFileSync2(path, "utf8") : "[]";
+  const path = join8(profileDirPath, "cordis.patch.yml");
+  const text = existsSync6(path) ? readFileSync6(path, "utf8") : "[]";
   const doc = parseDocument(text);
   const contents = doc.contents;
   if (contents !== null && contents.flow === true && contents.items.length === 0) contents.flow = false;
   return doc;
 }
 function savePatch(profileDirPath, doc) {
-  mkdirSync2(profileDirPath, { recursive: true });
-  writeFileSync2(join4(profileDirPath, "cordis.patch.yml"), String(doc), "utf8");
+  mkdirSync5(profileDirPath, { recursive: true });
+  writeFileSync4(join8(profileDirPath, "cordis.patch.yml"), String(doc), "utf8");
 }
 function toNode(value) {
   return new Document(value).contents;
@@ -1079,6 +1529,13 @@ function removeMcp(profileDirPath, id) {
 
 // src/routes.ts
 var EDITABLE_SOURCE = "user-dsh";
+function toSkillRow(skill) {
+  const dir = skill.resourceBase?.kind === "directory" ? skill.resourceBase.path : void 0;
+  return { ...skill, editable: skill.source === EDITABLE_SOURCE, ...dir !== void 0 ? { dir } : {}, policyEditable: dir !== void 0 };
+}
+function toRootView(entry) {
+  return { ...entry, live: entry.roots.every((root) => rootExists(root)) };
+}
 function mountCapabilitiesRoutes(host, config) {
   const disposers = [
     host.webServer.register({
@@ -1092,9 +1549,7 @@ function mountCapabilitiesRoutes(host, config) {
         }
         try {
           const skills = await host.skills.list();
-          sendJson(response, 200, {
-            skills: skills.map((skill) => ({ ...skill, editable: skill.source === EDITABLE_SOURCE }))
-          });
+          sendJson(response, 200, { skills: skills.map(toSkillRow) });
         } catch (error) {
           sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) });
         }
@@ -1113,6 +1568,10 @@ function mountCapabilitiesRoutes(host, config) {
         const name2 = url.searchParams.get("name") ?? "";
         try {
           const definition = await host.skills.get(name2);
+          if (definition === void 0) {
+            sendJson(response, 404, { error: "skill not found" });
+            return;
+          }
           sendJson(response, 200, { name: definition.name, content: definition.content });
         } catch (error) {
           sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) });
@@ -1177,6 +1636,292 @@ function mountCapabilitiesRoutes(host, config) {
         }
       }
     }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/skill/policy",
+      handler: async (request, response) => {
+        if (request.method !== "POST") {
+          response.writeHead(405, { allow: "POST" });
+          response.end();
+          return;
+        }
+        if (!sameOrigin(request)) {
+          sendJson(response, 403, { error: "untrusted origin" });
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          if (typeof body.name !== "string" || typeof body.enabled !== "boolean") {
+            sendJson(response, 400, { error: "name and enabled are required" });
+            return;
+          }
+          const definition = await host.skills.get(body.name);
+          if (definition === void 0) {
+            sendJson(response, 404, { error: "skill not found" });
+            return;
+          }
+          if (definition.path === void 0) {
+            sendJson(response, 422, { error: "skill has no file on disk (runtime-registered)" });
+            return;
+          }
+          setSkillPolicy(definition.path, body.enabled);
+          sendJson(response, 200, { ok: true });
+        } catch (error) {
+          sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) });
+        }
+      }
+    }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/open",
+      handler: async (request, response) => {
+        if (request.method !== "POST") {
+          response.writeHead(405, { allow: "POST" });
+          response.end();
+          return;
+        }
+        if (!sameOrigin(request)) {
+          sendJson(response, 403, { error: "untrusted origin" });
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          if (typeof body.target !== "string") {
+            sendJson(response, 400, { error: "target is required" });
+            return;
+          }
+          let dir;
+          if (body.target === "user-skills") {
+            dir = userSkillsDir();
+            mkdirSync6(dir, { recursive: true });
+          } else if (body.target === "plugin-state") {
+            dir = pluginStateDir();
+            mkdirSync6(dir, { recursive: true });
+          } else if (body.target === "skill") {
+            if (typeof body.name !== "string") {
+              sendJson(response, 400, { error: "name is required" });
+              return;
+            }
+            const definition = await host.skills.get(body.name);
+            if (definition === void 0) {
+              sendJson(response, 404, { error: "skill not found" });
+              return;
+            }
+            dir = definition.path !== void 0 ? definition.path.replace(/[/\\]SKILL\.md$/, "").replace(/[/\\][^/\\]+\.md$/, "") : definition.resourceBase?.kind === "directory" ? definition.resourceBase.path : void 0;
+          } else if (body.target === "root") {
+            if (typeof body.id !== "string") {
+              sendJson(response, 400, { error: "id is required" });
+              return;
+            }
+            const entry = loadState().skillRoots.find((row) => row.id === body.id);
+            if (entry === void 0) {
+              sendJson(response, 404, { error: "repository not found" });
+              return;
+            }
+            dir = entry.materialDir ?? entry.path ?? entry.roots[0];
+          } else {
+            sendJson(response, 400, { error: "unknown target" });
+            return;
+          }
+          if (dir === void 0 || !openDirectory(dir)) {
+            sendJson(response, 422, { error: "directory is not available on disk" });
+            return;
+          }
+          sendJson(response, 200, { ok: true });
+        } catch (error) {
+          sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) });
+        }
+      }
+    }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/roots",
+      handler: async (request, response) => {
+        if (request.method !== "GET") {
+          response.writeHead(405, { allow: "GET" });
+          response.end();
+          return;
+        }
+        sendJson(response, 200, { roots: loadState().skillRoots.map(toRootView) });
+      }
+    }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/roots/add",
+      handler: async (request, response) => {
+        if (request.method !== "POST") {
+          response.writeHead(405, { allow: "POST" });
+          response.end();
+          return;
+        }
+        if (!sameOrigin(request)) {
+          sendJson(response, 403, { error: "untrusted origin" });
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          if (body.kind !== "local" && body.kind !== "git") {
+            sendJson(response, 400, { error: "kind must be local or git" });
+            return;
+          }
+          const entry = body.kind === "local" ? typeof body.path === "string" && body.path.trim() !== "" ? await addLocalRepo(body.path) : void 0 : typeof body.url === "string" && body.url.trim() !== "" ? await addGitRepo(body.url) : void 0;
+          if (entry === void 0) {
+            sendJson(response, 400, { error: body.kind === "local" ? "path is required" : "url is required" });
+            return;
+          }
+          await config.remountProvider();
+          sendJson(response, 200, { ok: true, root: toRootView(entry) });
+        } catch (error) {
+          sendJson(response, 400, { error: error instanceof Error ? error.message : String(error) });
+        }
+      }
+    }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/roots/remove",
+      handler: async (request, response) => {
+        if (request.method !== "POST") {
+          response.writeHead(405, { allow: "POST" });
+          response.end();
+          return;
+        }
+        if (!sameOrigin(request)) {
+          sendJson(response, 403, { error: "untrusted origin" });
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          if (typeof body.id !== "string") {
+            sendJson(response, 400, { error: "id is required" });
+            return;
+          }
+          const ok = removeSkillRoot(body.id);
+          if (!ok) {
+            sendJson(response, 404, { error: "repository not found" });
+            return;
+          }
+          await config.remountProvider();
+          sendJson(response, 200, { ok: true });
+        } catch (error) {
+          sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) });
+        }
+      }
+    }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/market/skills",
+      handler: async (request, response) => {
+        if (request.method !== "GET") {
+          response.writeHead(405, { allow: "GET" });
+          response.end();
+          return;
+        }
+        const index = await loadMarketIndex("skills");
+        if (index === null) {
+          sendJson(response, 502, { error: "market index unavailable (offline?)" });
+          return;
+        }
+        sendJson(response, 200, {
+          source: index.source,
+          repos: (index.skills ?? []).map((repo) => ({ ...repo, installedId: findRootByUrl(repo.url)?.id ?? null }))
+        });
+      }
+    }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/market/mcp",
+      handler: async (request, response) => {
+        if (request.method !== "GET") {
+          response.writeHead(405, { allow: "GET" });
+          response.end();
+          return;
+        }
+        const index = await loadMarketIndex("mcp");
+        if (index === null) {
+          sendJson(response, 502, { error: "market index unavailable (offline?)" });
+          return;
+        }
+        const existing = new Set(listMcp(config.profileDirPath).map((row) => row.serverName));
+        sendJson(response, 200, {
+          source: index.source,
+          servers: (index.servers ?? []).map((server) => ({ ...server, installed: existing.has(server.id) }))
+        });
+      }
+    }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/market/skills/install",
+      handler: async (request, response) => {
+        if (request.method !== "POST") {
+          response.writeHead(405, { allow: "POST" });
+          response.end();
+          return;
+        }
+        if (!sameOrigin(request)) {
+          sendJson(response, 403, { error: "untrusted origin" });
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          if (typeof body.url !== "string") {
+            sendJson(response, 400, { error: "url is required" });
+            return;
+          }
+          const entry = await addGitRepo(body.url);
+          await config.remountProvider();
+          sendJson(response, 200, { ok: true, root: toRootView(entry) });
+        } catch (error) {
+          sendJson(response, 400, { error: error instanceof Error ? error.message : String(error) });
+        }
+      }
+    }),
+    host.webServer.register({
+      kind: "exact",
+      path: "/dsh-plugin-capabilities/market/mcp/install",
+      handler: async (request, response) => {
+        if (request.method !== "POST") {
+          response.writeHead(405, { allow: "POST" });
+          response.end();
+          return;
+        }
+        if (!sameOrigin(request)) {
+          sendJson(response, 403, { error: "untrusted origin" });
+          return;
+        }
+        try {
+          const body = await readJsonBody(request);
+          if (typeof body.id !== "string") {
+            sendJson(response, 400, { error: "id is required" });
+            return;
+          }
+          const index = await loadMarketIndex("mcp");
+          const server = index?.servers?.find((row) => row.id === body.id);
+          if (server === void 0) {
+            sendJson(response, 404, { error: "server not found in the market index" });
+            return;
+          }
+          if (listMcp(config.profileDirPath).some((row) => row.serverName === server.id)) {
+            sendJson(response, 409, { error: "already installed" });
+            return;
+          }
+          const input = {
+            id: "",
+            serverName: server.id,
+            transport: server.transport,
+            ...server.transport === "stdio" ? { command: server.command, args: server.args, env: void 0 } : { url: server.url }
+          };
+          const invalid = validateMcpInput(input);
+          if (invalid !== null) {
+            sendJson(response, 400, { error: invalid });
+            return;
+          }
+          const id = upsertMcp(config.profileDirPath, input);
+          sendJson(response, 200, { ok: true, id, restartNeeded: true });
+        } catch (error) {
+          sendJson(response, 500, { error: error instanceof Error ? error.message : String(error) });
+        }
+      }
+    }),
     host.webServer.register({
       kind: "exact",
       path: "/dsh-plugin-capabilities/mcp",
@@ -1364,25 +2109,56 @@ function mountCapabilitiesRoutes(host, config) {
 // src/index.ts
 var name = "dsh-plugin-capabilities";
 function packagedSkillsDir() {
-  return join5(dirname2(fileURLToPath(import.meta.url)), "..", "skills");
+  return join9(dirname4(fileURLToPath2(import.meta.url)), "..", "skills");
 }
 var inject = ["webServer", "skills"];
 function apply(ctx, config) {
   const profile = config?.profile ?? argvProfile() ?? "web";
   ctx.inject(["webServer", "skills"], (hostCtx) => {
-    void (async () => {
-      try {
-        const mod = await import("@deepseek-ai/dsh-skill-filesystem");
-        const plugin = mod.default ?? mod;
-        const roots = [packagedSkillsDir(), ...agentSkillRoots()].filter((dir) => existsSync4(dir));
-        hostCtx.plugin(plugin, roots.length > 0 ? { customSkillDirs: roots } : {});
-      } catch {
-      }
-    })();
-    ctx.effect(
-      () => mountCapabilitiesRoutes(hostCtx, { profileDirPath: profileDir(profile) }),
-      "dsh-plugin-capabilities: http routes"
-    );
+    let providerFiber;
+    let disposed = false;
+    ctx.effect(() => {
+      const disposer = () => {
+        disposed = true;
+      };
+      let chain = Promise.resolve();
+      const remountProvider = () => {
+        chain = chain.then(async () => {
+          if (disposed) return;
+          const mod = await import("@deepseek-ai/dsh-skill-filesystem");
+          const plugin = mod.default ?? mod;
+          if (providerFiber !== void 0) {
+            const old = providerFiber;
+            providerFiber = void 0;
+            try {
+              await old.dispose();
+            } catch {
+            }
+          }
+          if (disposed) return;
+          const roots = [
+            packagedSkillsDir(),
+            ...loadState().skillRoots.flatMap((entry) => entry.roots),
+            ...agentSkillRoots()
+          ].filter((dir) => existsSync7(dir));
+          try {
+            providerFiber = hostCtx.plugin(plugin, roots.length > 0 ? { customSkillDirs: roots } : {});
+          } catch {
+          }
+        });
+        chain = chain.catch(() => void 0);
+        return chain;
+      };
+      void remountProvider();
+      ctx.effect(
+        () => mountCapabilitiesRoutes(hostCtx, {
+          profileDirPath: profileDir(profile),
+          remountProvider
+        }),
+        "dsh-plugin-capabilities: http routes"
+      );
+      return disposer;
+    }, "dsh-plugin-capabilities: skill provider");
   });
 }
 export {