dsh-prompt-customizer 0.9.2 → 2.1.2

package/scripts/smoke-host.mjs

@@ -112,13 +112,13 @@ need(paths.some(p => p.startsWith('/api/prompt-customizer')), 'prompt customizer
 need(listeners.has('agent/created'), 'agent/created hooked (预设层开关与遮蔽)')
 need(listeners.has('tools/change'), 'tools/change hooked (装配过滤失效重算)')
 need(listeners.has('system-prompt/assemble'), 'system-prompt/assemble hooked (提示词段覆盖)')
+need(listeners.has('session/event'), 'session/event hooked (阶段化工具目录按会话事件重算)')
 
 // 三个已移除的模块不得留下任何路由、工具或事件钩子。
 const leftovers = paths.filter(p => /^\/api\/(dsh-memory|usage-stats|triad-automation)/.test(p))
 need(leftovers.length === 0, `removed modules left no routes${leftovers.length > 0 ? `: ${leftovers.join(', ')}` : ''}`)
 need(tools.length === 0, `no model tools registered${tools.length > 0 ? `: ${tools.join(', ')}` : ''}`)
 need(!listeners.has('agent/pre-step'), 'agent/pre-step injection gone')
-need(!listeners.has('session/event'), 'session/event capture gone')
 
 const warns = logs.filter(([lvl]) => lvl === 'warn')
 if (warns.length > 0) {

package/scripts/verify-apply-all.mjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * 「应用到所有预设」跨预设实测：对多个预设写入 per-preset 覆盖 → 执行应用全部 → 断言全部被清空（继承全部/全局）。
+ * 覆盖 SKILL（resetPreset per preset）与 MCP（/api/triad/mcp-apply-all）。写入前备份、测后恢复。
+ */
+const argv = process.argv.slice(2)
+const arg = (n, d) => { const i = argv.indexOf(n); return i >= 0 && argv[i + 1] !== undefined ? argv[i + 1] : d }
+const TOKEN_URL = arg('--url'); if (!TOKEN_URL) { console.error('缺 --url'); process.exit(2) }
+const ORIGIN = new URL(TOKEN_URL).origin
+const results = []
+const rec = (name, ok, detail) => { results.push({ name, ok, detail }); console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? `  — ${detail}` : ''}`) }
+let cookie = ''
+async function handshake() { const r = await fetch(TOKEN_URL, { redirect: 'manual' }); const sc = r.headers.getSetCookie ? r.headers.getSetCookie() : []; cookie = sc.map((c) => c.split(';')[0]).join('; ') }
+async function req(method, p, body) { const h = { accept: 'application/json' }; if (cookie) h.cookie = cookie; if (body !== undefined) h['content-type'] = 'application/json'; const r = await fetch(ORIGIN + p, { method, headers: h, body: body === undefined ? undefined : JSON.stringify(body) }); let j = null; try { j = await r.json() } catch {} return { status: r.status, json: j } }
+
+async function main() {
+  await handshake()
+  const backup = (await req('GET', '/api/prompt-customizer/backup')).json
+  const presetList = (await req('GET', '/api/prompt-customizer/agent-presets')).json?.presets ?? []
+  const ids = presetList.filter((p) => !p.broken).map((p) => p.id).slice(0, 3)
+  const st0 = (await req('GET', '/api/skill-toggles/presets')).json ?? {}
+  const skillName = Object.keys((await req('GET', '/api/skill-toggles/status')).json?.skills ?? {})[0]
+  const mcp = (await req('GET', '/api/triad/mcp-status')).json ?? {}
+  const server = mcp.servers?.[0]?.serverName
+  console.log(`presets=${ids.join(',')} skill=${skillName} mcpServer=${server}`)
+  try {
+    // SKILL：给多个预设写单独开关
+    for (const id of ids) await req('PUT', `/api/skill-toggles/presets/${encodeURIComponent(id)}/skills/${encodeURIComponent(skillName)}`, { enabled: false })
+    let ov = (await req('GET', '/api/skill-toggles/presets')).json?.overrides ?? {}
+    const setCount = ids.filter((id) => ov[id]?.[skillName] === false).length
+    rec(`SKILL 多预设写入单独关闭 (${setCount}/${ids.length})`, setCount === ids.length)
+    // 应用全部 = 逐个 resetPreset（与 SKILL 按钮一致）
+    for (const id of ids) await req('POST', `/api/skill-toggles/presets/${encodeURIComponent(id)}/reset`)
+    ov = (await req('GET', '/api/skill-toggles/presets')).json?.overrides ?? {}
+    const remain = ids.filter((id) => ov[id]?.[skillName] === false).length
+    rec('SKILL 应用到所有预设后单预设开关被清空', remain === 0, `remaining=${remain}`)
+
+    // MCP：给多个预设写遮蔽 + 工具级覆盖
+    if (server) {
+      for (const id of ids) await req('PUT', `/api/triad/mcp-masks/${encodeURIComponent(id)}/${encodeURIComponent(server)}`, { enabled: false })
+      let s = (await req('GET', '/api/triad/mcp-status')).json ?? {}
+      const maskCount = ids.filter((id) => (s.masks?.[id]?.[server]) === false).length
+      rec(`MCP 多预设写入遮蔽 (${maskCount}/${ids.length})`, maskCount === ids.length)
+      const applied = await req('POST', '/api/triad/mcp-apply-all')
+      rec('MCP 应用到所有预设接口 ok', applied.status === 200 && applied.json?.ok === true, JSON.stringify(applied.json))
+      s = (await req('GET', '/api/triad/mcp-status')).json ?? {}
+      const maskRemain = ids.filter((id) => (s.masks?.[id]?.[server]) === false).length
+      rec('MCP 应用到所有预设后多预设遮蔽被清空', maskRemain === 0, `remaining=${maskRemain}`)
+      const toolRemain = ids.filter((id) => Object.keys(s.toolDisabledByPreset?.[id] ?? {}).length > 0).length
+      rec('MCP 应用到所有预设后多预设工具覆盖被清空', toolRemain === 0, `remaining=${toolRemain}`)
+    } else {
+      rec('MCP 应用到所有预设（无 server 跳过）', true, 'no server')
+    }
+  } finally {
+    const restore = await req('POST', '/api/prompt-customizer/restore', { docs: backup?.docs ?? {}, catalog: backup?.catalog ?? {} })
+    rec('已恢复整库备份', restore.status === 200 && restore.json?.ok === true)
+  }
+}
+
+try { await main() } catch (e) { rec('主流程异常', false, e instanceof Error ? (e.stack ?? e.message) : String(e)) } finally {
+  const p = results.filter((r) => r.ok).length
+  console.log(`\n==== 跨预设应用全部: ${p}/${results.length} 通过, ${results.length - p} 失败 ====`)
+  process.exit(results.length - p === 0 ? 0 : 1)
+}

package/scripts/verify-effect.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+/**
+ * 行为级验证：隐藏/修改提示词、隐藏/启用工具，**是否真的改变模型最终收到的内容**。
+ *
+ * 依据：
+ *  - `/api/prompt-customizer/preview?phase=active&scope=<preset>`：真实跑该预设装配，
+ *    返回的 `text` 是最终系统提示词、`tools` 是最终交给模型的工具声明。
+ *  - `/api/prompt-customizer/session`：活动会话（含 agent 作用域 restrict）的真实视图。
+ *
+ * 用法：node scripts/verify-effect.mjs --url "http://127.0.0.1:PORT/?token=TOKEN"
+ * 写入前整库备份、结束后恢复。
+ *
+ * 状态（2.1.0）：本脚本的「替换段」仍用 1.4.0 已删除的 `replace` 字典，「工作区级
+ * 隐藏段 / 工具」仍用 2.0.0 已移除的 `level=workspace`，与当前 `/config/apply` 契约
+ * 不相容，不能直接当作 2.1.0 的验证结论。当前门禁是 `npm run check` 与
+ * `test/universal-prompt-takeover.test.mjs`（ADR-0005）。重跑前需把 `replace` 改为
+ * `replacements: [{name, phase, text}]`、去掉工作区级场景、隐藏名单改成 `{name, source}` 条目。
+ */
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+const argv = process.argv.slice(2)
+const arg = (n, d) => { const i = argv.indexOf(n); return i >= 0 && argv[i + 1] !== undefined ? argv[i + 1] : d }
+const TOKEN_URL = arg('--url')
+if (TOKEN_URL === undefined) { console.error('缺 --url'); process.exit(2) }
+const ORIGIN = new URL(TOKEN_URL).origin
+
+const results = []
+const rec = (name, ok, detail) => { results.push({ name, ok, detail }); console.log(`${ok ? 'PASS' : 'FAIL'}  ${name}${detail ? `  — ${detail}` : ''}`) }
+const names = (arr) => (Array.isArray(arr) ? arr.map((x) => (typeof x === 'string' ? x : x?.name)).filter(Boolean) : [])
+
+let cookie = ''
+async function handshake() {
+  const res = await fetch(TOKEN_URL, { redirect: 'manual' })
+  const sc = typeof res.headers.getSetCookie === 'function' ? res.headers.getSetCookie() : []
+  cookie = sc.map((c) => c.split(';')[0]).join('; ')
+}
+async function req(method, p, body) {
+  const headers = { accept: 'application/json' }
+  if (cookie) headers.cookie = cookie
+  if (body !== undefined) headers['content-type'] = 'application/json'
+  const r = await fetch(ORIGIN + p, { method, headers, body: body === undefined ? undefined : JSON.stringify(body) })
+  let j = null; try { j = await r.json() } catch {}
+  return { status: r.status, json: j }
+}
+const getPreview = async (phase, scope) => (await req('GET', `/api/prompt-customizer/preview?phase=${phase}&scope=${encodeURIComponent(scope)}`)).json
+const getSession = async () => (await req('GET', '/api/prompt-customizer/session')).json
+
+const serverOf = (full) => { const r = full.startsWith('mcp__') ? full.slice(5) : null; if (r === null) return null; const i = r.indexOf('__'); return i <= 0 ? null : r.slice(0, i) }
+
+async function main() {
+  await handshake()
+  const cfg = (await req('GET', '/api/prompt-customizer/config')).json
+  const currentWorkspace = cfg?.currentWorkspace
+  const presetList = (await req('GET', '/api/prompt-customizer/agent-presets')).json?.presets ?? []
+  const preset = presetList.find((p) => !p.broken)?.id ?? presetList[0]?.id ?? 'standard'
+  console.log(`preset=${preset}  currentWorkspace=${currentWorkspace ?? '(none)'}`)
+
+  const backup = (await req('GET', '/api/prompt-customizer/backup')).json
+  const bfile = path.join(process.cwd(), 'scripts', '.verify-backup.json')
+  fs.writeFileSync(bfile, JSON.stringify(backup))
+  const RESTORE = async () => { await req('POST', '/api/prompt-customizer/restore', { docs: backup.docs ?? {}, catalog: backup.catalog ?? {} }) }
+
+  try {
+    // ── 预设级：真实装配前后对比（/preview phase=active，final text + tools）──
+    const p0 = await getPreview('active', preset)
+    const s0 = names(p0?.sections)
+    const t0 = names(p0?.tools)
+    console.log(`[baseline preview] sections=${s0.length} tools=${t0.length}; e.g. sections=${s0.slice(0, 5).join(',')} tools=${t0.slice(0, 5).join(',')}`)
+    const sectionName = s0[0]
+    const origText = String(p0?.text ?? '')
+    rec('preview 基线可用（有段与文本）', s0.length > 0 && origText !== '', `sections=${s0.length} textLen=${origText.length}`)
+
+    // 1) 隐藏段（预设级）
+    await req('POST', '/api/prompt-customizer/config/apply', { target: preset, patch: { sections: [sectionName] } })
+    const p1 = await getPreview('active', preset)
+    const s1 = names(p1?.sections)
+    rec(`隐藏段「${sectionName}」后真实装配不再包含该段`, !s1.includes(sectionName), `before=${s0.includes(sectionName)} after=${s1.includes(sectionName)}`)
+    rec(`隐藏段后最终提示词文本变短`, String(p1?.text ?? '').length < origText.length, `len ${origText.length} -> ${String(p1?.text ?? '').length}`)
+    await req('POST', '/api/prompt-customizer/config/apply', { target: preset, patch: { sections: null } })
+    const p1r = await getPreview('active', preset)
+    rec(`还原后该段回到真实装配`, names(p1r?.sections).includes(sectionName))
+
+    // 2) 修改段文本（预设级 replace）—— 最终文本里出现替换标记
+    const marker = '__E2E_MODIFIED_TEXT__'
+    await req('POST', '/api/prompt-customizer/config/apply', { target: preset, patch: { replace: { [sectionName]: marker } } })
+    const p2 = await getPreview('active', preset)
+    rec(`替换段「${sectionName}」文本后最终提示词含替换内容`, String(p2?.text ?? '').includes(marker))
+    await req('POST', '/api/prompt-customizer/config/apply', { target: preset, patch: { replace: null } })
+
+    // 3) 隐藏工具（预设级，MCP 工具级禁用）—— 最终工具声明里消失
+    let toolName = t0.find((n) => n.startsWith('mcp__'))
+    if (toolName !== undefined) {
+      const server = serverOf(toolName)
+      await req('PUT', `/api/triad/mcp-tools/${encodeURIComponent(server)}`, { enabled: false, tools: [toolName], preset, source: 'inherit' })
+      const p3 = await getPreview('active', preset)
+      const t3 = names(p3?.tools)
+      rec(`隐藏工具「${toolName}」后最终模型工具声明不再包含它`, !t3.includes(toolName), `before=${t0.includes(toolName)} after=${t3.includes(toolName)}`)
+      await req('PUT', `/api/triad/mcp-tools/${encodeURIComponent(server)}`, { enabled: true, tools: [toolName], preset, source: 'inherit' })
+      const p3r = await getPreview('active', preset)
+      rec(`还原后该工具回到最终工具声明`, names(p3r?.tools).includes(toolName))
+    } else {
+      rec('隐藏工具（当前预览无 mcp 工具可测，跳过）', true, 'no mcp tool in preview')
+    }
+
+    // ── 工作区级：真实活动会话前后对比（/session）──
+    if (currentWorkspace === undefined || currentWorkspace === null || currentWorkspace === '') {
+      rec('工作区级真实会话验证（无活动会话，跳过）', true, 'no currentWorkspace')
+      return
+    }
+    const sess0 = await getSession()
+    const ss0 = names(sess0?.baseSections)
+    const st0 = names(sess0?.tools)
+    const stext0 = String(sess0?.text ?? '')
+    console.log(`[baseline session] baseSections=${ss0.length} tools=${st0.length}`)
+    const wsSection = ss0.find((n) => n !== '') ?? ss0[0]
+    if (wsSection !== undefined) {
+      await req('POST', '/api/prompt-customizer/config/apply', { level: 'workspace', workspace: currentWorkspace, patch: { sections: [wsSection] } })
+      const sess1 = await getSession()
+      const ss1 = names(sess1?.baseSections)
+      const fs1 = names(sess1?.sections)
+      const gone = fs1.length > 0 ? !fs1.includes(wsSection) : (String(sess1?.text ?? '').length < stext0.length)
+      rec(`工作区隐藏段「${wsSection}」后活动会话最终提示词不再包含该段`, gone, `finalSections=${fs1.length} textLen ${stext0.length}->${String(sess1?.text ?? '').length}`)
+      rec(`工作区隐藏段后会话提示词文本变短`, String(sess1?.text ?? '').length < stext0.length, `${stext0.length} -> ${String(sess1?.text ?? '').length}`)
+      await req('POST', '/api/prompt-customizer/config/apply', { level: 'workspace', workspace: currentWorkspace, patch: { sections: null } })
+      const sess1r = await getSession()
+      rec(`工作区还原后该段回到会话视图`, names(sess1r?.baseSections).includes(wsSection))
+    }
+    const wsTool = st0.find((n) => n.startsWith('mcp__'))
+    if (wsTool !== undefined) {
+      await req('PUT', `/api/triad/mcp-workspace-scope/workspace/${encodeURIComponent(currentWorkspace)}/tools`, { name: wsTool, enabled: false })
+      const sess2 = await getSession()
+      const st2 = names(sess2?.tools)
+      rec(`工作区隐藏工具「${wsTool}」后活动会话真实工具集不再包含`, !st2.includes(wsTool), `before=${st0.includes(wsTool)} after=${st2.includes(wsTool)}`)
+      await req('PUT', `/api/triad/mcp-workspace-scope/workspace/${encodeURIComponent(currentWorkspace)}/tools`, { name: wsTool, enabled: true })
+      const sess2r = await getSession()
+      rec(`工作区还原后该工具回到会话工具集`, names(sess2r?.tools).includes(wsTool))
+    } else {
+      rec('工作区隐藏工具（会话无 mcp 工具可测，跳过）', true, 'no mcp tool in session')
+    }
+  } finally {
+    await RESTORE()
+    rec('已恢复整库备份', true)
+    try { fs.unlinkSync(bfile) } catch {}
+  }
+}
+
+try { await main() } catch (e) { rec('主流程异常', false, e instanceof Error ? (e.stack ?? e.message) : String(e)) } finally {
+  const passed = results.filter((r) => r.ok).length
+  console.log(`\n==== 行为级验证: ${passed}/${results.length} 通过, ${results.length - passed} 失败 ====`)
+  process.exit(results.length - passed === 0 ? 0 : 1)
+}

package/scripts/verify-mcp-edit-ext.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/** 预设专属 / 工作区 MCP 编辑实测（切换 standard/ptc；工作区用临时 .mcp.json）。 */
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+const argv = process.argv.slice(2)
+const arg = (n, d) => { const i = argv.indexOf(n); return i >= 0 && argv[i + 1] !== undefined ? argv[i + 1] : d }
+const TOKEN_URL = arg('--url'); if (!TOKEN_URL) { console.error('缺 --url'); process.exit(2) }
+const ORIGIN = new URL(TOKEN_URL).origin
+const results = []
+const rec = (n, ok, d) => { results.push({ n, ok }); console.log(`${ok ? 'PASS' : 'FAIL'}  ${n}${d ? `  — ${d}` : ''}`) }
+let cookie = ''
+async function handshake() { const r = await fetch(TOKEN_URL, { redirect: 'manual' }); const sc = r.headers.getSetCookie ? r.headers.getSetCookie() : []; cookie = sc.map((c) => c.split(';')[0]).join('; ') }
+async function req(method, p, body) { const h = { accept: 'application/json' }; if (cookie) h.cookie = cookie; if (body !== undefined) h['content-type'] = 'application/json'; const r = await fetch(ORIGIN + p, { method, headers: h, body: body === undefined ? undefined : JSON.stringify(body) }); let j = null; try { j = await r.json() } catch {} return { status: r.status, json: j } }
+
+async function main() {
+  await handshake()
+  // 工作区 .mcp.json 编辑（临时目录）
+  const ws = fs.mkdtempSync(path.join(os.tmpdir(), 'pc-mcp-edit-'))
+  const mcpFile = path.join(ws, '.mcp.json')
+  fs.writeFileSync(mcpFile, JSON.stringify({ mcpServers: { e2eprobe: { command: 'echo', args: ['a'] } } }, null, 2) + '\n')
+  const wg = await req('GET', `/api/triad/mcp-edit?source=workspace&workspace=${encodeURIComponent(ws)}&serverName=e2eprobe`)
+  rec('工作区 GET 读到 e2eprobe 配置', wg.status === 200 && wg.json?.ok === true && String(wg.json.text).includes('echo'))
+  const wp = await req('POST', '/api/triad/mcp-edit', { source: 'workspace', workspace: ws, serverName: 'e2eprobe', text: JSON.stringify({ command: 'echo', args: ['b'] }) })
+  rec('工作区 POST 保存成功', wp.status === 200 && wp.json?.ok === true, JSON.stringify(wp.json))
+  const wsDoc = JSON.parse(fs.readFileSync(mcpFile, 'utf8'))
+  rec('工作区 .mcp.json 已更新为 args=[b]', JSON.stringify(wsDoc.mcpServers.e2eprobe.args) === '["b"]')
+  rec('工作区 .mcp.json 生成了 .bak-last-toggle', fs.existsSync(mcpFile + '.bak-last-toggle'))
+  try { fs.rmSync(ws, { recursive: true, force: true }) } catch {}
+
+  // 预设专属 Server 编辑（standard / ptc 各一遍）
+  for (const preset of ['standard', 'ptc']) {
+    const add = await req('POST', `/api/triad/mcp-presets/${encodeURIComponent(preset)}/servers`, { format: 'json', text: JSON.stringify({ mcpServers: { e2eprobe: { command: 'echo', args: ['a'] } } }) })
+    if (!(add.status === 200 && add.json?.ok === true)) { rec(`预设 ${preset} 添加 e2eprobe`, false, JSON.stringify(add.json)); continue }
+    const g1 = await req('GET', `/api/triad/mcp-edit?source=preset&preset=${encodeURIComponent(preset)}&serverName=e2eprobe`)
+    rec(`预设 ${preset} GET 读到 e2eprobe 配置`, g1.status === 200 && g1.json?.ok === true && String(g1.json.text).includes('echo'))
+    const p1 = await req('POST', '/api/triad/mcp-edit', { source: 'preset', preset, serverName: 'e2eprobe', text: JSON.stringify({ command: 'echo', args: ['b'] }) })
+    rec(`预设 ${preset} 编辑保存成功`, p1.status === 200 && p1.json?.ok === true, JSON.stringify(p1.json))
+    const g2 = await req('GET', `/api/triad/mcp-edit?source=preset&preset=${encodeURIComponent(preset)}&serverName=e2eprobe`)
+    rec(`预设 ${preset} 编辑后读回 args=[b]`, g2.status === 200 && /"b"/.test(String(g2.json.text)))
+    await req('DELETE', `/api/triad/mcp-presets/${encodeURIComponent(preset)}/servers/e2eprobe`)
+  }
+}
+try { await main() } catch (e) { rec('主流程异常', false, e instanceof Error ? e.stack ?? e.message : String(e)) } finally {
+  const p = results.filter((r) => r.ok).length
+  console.log(`\n==== 预设/工作区 MCP 编辑实测: ${p}/${results.length} 通过 ====`)
+  process.exit(results.length - p === 0 ? 0 : 1)
+}

package/scripts/verify-mcp-edit.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/** MCP 编辑实测：对 codegraph 做「原样往返」编辑（改后再 .bak 还原），验证读写与还原正确。 */
+import fs from 'node:fs'
+import path from 'node:path'
+const argv = process.argv.slice(2)
+const arg = (n, d) => { const i = argv.indexOf(n); return i >= 0 && argv[i + 1] !== undefined ? argv[i + 1] : d }
+const TOKEN_URL = arg('--url'); if (!TOKEN_URL) { console.error('缺 --url'); process.exit(2) }
+const ORIGIN = new URL(TOKEN_URL).origin
+const PATCH = arg('--patch', path.join(process.env.USERPROFILE ?? '', '.dsh', 'profiles', 'web', 'cordis.patch.yml'))
+const results = []
+const rec = (n, ok, d) => { results.push({ n, ok }); console.log(`${ok ? 'PASS' : 'FAIL'}  ${n}${d ? `  — ${d}` : ''}`) }
+let cookie = ''
+async function handshake() { const r = await fetch(TOKEN_URL, { redirect: 'manual' }); const sc = r.headers.getSetCookie ? r.headers.getSetCookie() : []; cookie = sc.map((c) => c.split(';')[0]).join('; ') }
+async function req(method, p, body) { const h = { accept: 'application/json' }; if (cookie) h.cookie = cookie; if (body !== undefined) h['content-type'] = 'application/json'; const r = await fetch(ORIGIN + p, { method, headers: h, body: body === undefined ? undefined : JSON.stringify(body) }); let j = null; try { j = await r.json() } catch {} return { status: r.status, json: j } }
+
+async function main() {
+  await handshake()
+  const status = (await req('GET', '/api/triad/mcp-status')).json ?? {}
+  const target = (status.servers ?? []).find((s) => s?.config?.editable === true)?.serverName
+  if (!target) { rec('存在可编辑的全局 server', false, '无（跳过全局编辑实测）'); return }
+  rec('找到可编辑全局 server', true, target)
+  const SN = String(target)
+  const before = fs.existsSync(PATCH) ? fs.readFileSync(PATCH, 'utf8') : ''
+  const raw = await req('GET', `/api/triad/mcp-edit?serverName=${encodeURIComponent(SN)}`)
+  rec(`GET /mcp-edit 读到 ${SN} 当前配置原文`, raw.status === 200 && raw.json?.ok === true && typeof raw.json.text === 'string' && raw.json.text.includes(SN), `text=${JSON.stringify(raw.json?.text)?.slice(0, 140)}`)
+  // GET 现在直接返回 mcpServers 形态 YAML（含 codegraph 键），可直接回写。
+  const yaml = String(raw.json?.text ?? '')
+  const save = await req('POST', '/api/triad/mcp-edit', { serverName: SN, format: 'yaml', text: yaml, reload: false })
+  rec('POST /mcp-edit 保存（remove+append）成功', save.status === 200 && save.json?.ok === true, JSON.stringify(save.json))
+  const after = fs.existsSync(PATCH) ? fs.readFileSync(PATCH, 'utf8') : ''
+  rec('patch 文件仍包含该条目', new RegExp(`serverName:\\s*${SN}`).test(after))
+  rec('往返后 patch 结构仍有效（含该条目）', new RegExp(`serverName:\\s*${SN}`).test(after), after === before ? '字节不变' : `reformatted len ${before.length}->${after.length}`)
+  const raw2 = await req('GET', `/api/triad/mcp-edit?serverName=${encodeURIComponent(SN)}`)
+  rec('再次读取仍能拿到该 server 配置', raw2.status === 200 && raw2.json?.ok === true && String(raw2.json.text).includes(SN))
+  // 还原
+  const bak = `${PATCH}.bak-last-toggle`
+  if (fs.existsSync(bak)) { fs.copyFileSync(bak, PATCH); rec('已用 .bak 还原 patch 文件', true) } else { rec('未找到 .bak，跳过还原', false) }
+  const restored = fs.existsSync(PATCH) ? fs.readFileSync(PATCH, 'utf8') : ''
+  rec('还原后 patch 与编辑前逐字一致', restored === before, restored === before ? '' : '不一致')
+}
+try { await main() } catch (e) { rec('主流程异常', false, e instanceof Error ? e.stack ?? e.message : String(e)) } finally {
+  const p = results.filter((r) => r.ok).length
+  console.log(`\n==== MCP 编辑实测: ${p}/${results.length} 通过 ====`)
+  process.exit(results.length - p === 0 ? 0 : 1)
+}

package/scripts/verify-panel-browser.mjs

@@ -0,0 +1,298 @@
+/**
+ * scripts/verify-panel-browser.mjs — 用真实 Chrome（CDP）点一遍「能力」面板。
+ *
+ * 为什么需要它：0.10.0 提交后回归过一次，只有真渲染才会暴露 ——
+ * MCP 页里 `import { IconFolderOutlineRegular } from '@deepseek-ai/dsh-client-ui-primitives'`，
+ * 而宿主根本没导出这个名字，JSX 组件是 `undefined`，React 抛
+ * `Element type is invalid`，MCP 页被 ErrorBoundary 摘掉：用户点 MCP tab 就
+ * **闪退回对话界面**。当时 `node --test` 全绿（构建、路由、host 逻辑都没问题），
+ * 因为没有任何单元测试会真的渲染这个组件树。
+ *
+ * 这个脚本补上那一步：开一个真 Chrome 窗口，加载 dsh Web UI，点「能力」入口 →
+ * MCP 页 → SKILL 页，断言没有未捕获异常、MCP 页真的渲染出来了、四个目录里的
+ * 技能/MCP 条目都出现在 DOM 里，并截图留证。
+ *
+ * Usage:
+ *   node scripts/verify-panel-browser.mjs --url "<带 token 的 GUI URL>" \
+ *     [--expect-skills a,b] [--expect-mcp x,y] [--out <截图目录>] [--headless]
+ *
+ * 依赖：本机装了 Chrome（默认 `%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe`，
+ * 可用 --chrome 指定）。脚本只用 Node 内建能力（fetch + WebSocket），无第三方依赖。
+ */
+
+import { spawn } from 'node:child_process'
+import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const DEFAULT_CHROME = join(process.env.LOCALAPPDATA ?? '', 'Google', 'Chrome', 'Application', 'chrome.exe')
+const PORT = 9333
+const CDP = `http://127.0.0.1:${String(PORT)}`
+
+/** 解析 `--key value` / `--flag` 形式的参数。 */
+function parseArgs(argv) {
+  const out = { headless: false }
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i]
+    if (!token.startsWith('--')) continue
+    const key = token.slice(2)
+    if (key === 'headless') { out.headless = true; continue }
+    const value = argv[i + 1]
+    if (value === undefined || value.startsWith('--')) continue
+    out[key] = value
+    i += 1
+  }
+  return out
+}
+
+const args = parseArgs(process.argv.slice(2))
+if (args.url === undefined) {
+  console.error('缺少 --url "<带 token 的 GUI URL>"')
+  process.exit(2)
+}
+const chromePath = args.chrome ?? DEFAULT_CHROME
+if (!existsSync(chromePath)) {
+  console.error(`找不到 Chrome：${chromePath}（用 --chrome 指定）`)
+  process.exit(2)
+}
+const expectSkills = (args['expect-skills'] ?? '').split(',').map((s) => s.trim()).filter(Boolean)
+const expectMcp = (args['expect-mcp'] ?? '').split(',').map((s) => s.trim()).filter(Boolean)
+
+const checks = []
+const consoleErrors = []
+const exceptions = []
+function check(name, pass, detail = '') {
+  checks.push({ name, pass, detail })
+  console.log(`${pass ? 'ok  ' : 'FAIL'}  ${name}${detail === '' ? '' : ` — ${detail}`}`)
+}
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+
+/* ── CDP 客户端（裸 WebSocket，无依赖） ──────────────────────────────────── */
+
+class Cdp {
+  constructor(socket) {
+    this.socket = socket
+    this.nextId = 1
+    this.pending = new Map()
+    socket.addEventListener('message', (event) => {
+      const message = JSON.parse(event.data)
+      if (message.id !== undefined) {
+        const entry = this.pending.get(message.id)
+        if (entry === undefined) return
+        this.pending.delete(message.id)
+        if (message.error !== undefined) entry.reject(new Error(JSON.stringify(message.error)))
+        else entry.resolve(message.result)
+        return
+      }
+      this.onEvent?.(message)
+    })
+  }
+
+  send(method, params = {}) {
+    const id = this.nextId++
+    return new Promise((resolve, reject) => {
+      this.pending.set(id, { resolve, reject })
+      this.socket.send(JSON.stringify({ id, method, params }))
+    })
+  }
+
+  /** 在页面里求值（返回 JSON 值）。 */
+  async evaluate(expression) {
+    const result = await this.send('Runtime.evaluate', {
+      expression, returnByValue: true, awaitPromise: true,
+    })
+    if (result.exceptionDetails !== undefined) {
+      throw new Error(`页面求值抛错：${result.exceptionDetails.text ?? ''} ${JSON.stringify(result.exceptionDetails.exception?.description ?? '')}`)
+    }
+    return result.result?.value
+  }
+
+  /** 轮询直到表达式为真（或超时）。 */
+  async waitFor(expression, timeoutMs = 15000, label = expression) {
+    const started = Date.now()
+    let last
+    while (Date.now() - started < timeoutMs) {
+      try { last = await this.evaluate(expression) } catch (error) { last = `err:${String(error)}` }
+      if (last === true) return true
+      await sleep(200)
+    }
+    throw new Error(`等待超时（${label}），最后一次取值：${JSON.stringify(last)}`)
+  }
+}
+
+async function connect(wsUrl) {
+  const socket = new WebSocket(wsUrl)
+  await new Promise((resolve, reject) => {
+    socket.addEventListener('open', resolve, { once: true })
+    socket.addEventListener('error', () => { reject(new Error(`WebSocket 连接失败：${wsUrl}`)) }, { once: true })
+  })
+  return new Cdp(socket)
+}
+
+/* ── 主流程 ──────────────────────────────────────────────────────────────── */
+
+const profileDir = mkdtempSync(join(tmpdir(), 'pc-verify-chrome-'))
+const browser = spawn(chromePath, [
+  `--remote-debugging-port=${String(PORT)}`,
+  `--user-data-dir=${profileDir}`,
+  '--no-first-run', '--no-default-browser-check', '--disable-extensions',
+  '--window-size=1440,1000',
+  ...(args.headless ? ['--headless=new', '--disable-gpu'] : []),
+  'about:blank',
+], { stdio: 'ignore' })
+
+let cdp
+let failed = false
+try {
+  // 1. 等 DevTools 端点起来
+  const started = Date.now()
+  while (Date.now() - started < 30000) {
+    try {
+      const response = await fetch(`${CDP}/json/version`)
+      if (response.ok) break
+    } catch { /* 还没起来 */ }
+    await sleep(300)
+  }
+
+  // 2. 新开一个标签页（新版 Chrome 只接受 PUT）
+  const created = await fetch(`${CDP}/json/new?${encodeURIComponent(args.url)}`, { method: 'PUT' })
+  if (!created.ok) throw new Error(`开标签页失败：HTTP ${String(created.status)}`)
+  const target = await created.json()
+
+  cdp = await connect(target.webSocketDebuggerUrl)
+  cdp.onEvent = (message) => {
+    if (message.method === 'Runtime.exceptionThrown') {
+      exceptions.push(message.params?.exceptionDetails?.exception?.description
+        ?? message.params?.exceptionDetails?.text ?? 'unknown exception')
+    }
+    if (message.method === 'Runtime.consoleAPICalled' && message.params?.type === 'error') {
+      consoleErrors.push((message.params.args ?? []).map((arg) => arg.value ?? arg.description ?? '').join(' '))
+    }
+  }
+  await cdp.send('Runtime.enable')
+  await cdp.send('Page.enable')
+
+  // 3. 等前端外壳 + 本插件注入的侧栏入口
+  await cdp.waitFor("document.querySelector('.dsh-nav-btn') !== null", 30000, '侧栏「能力」入口出现')
+  check('侧栏「能力」入口已注入', true)
+
+  // 4. 打开面板
+  await cdp.evaluate(`(() => {
+    const button = [...document.querySelectorAll('.dsh-nav-btn')]
+      .find((node) => (node.getAttribute('aria-label') ?? node.textContent ?? '').includes('能力'))
+      ?? document.querySelector('.dsh-nav-btn')
+    button.click()
+    return true
+  })()`)
+  try {
+    // 面板是弹层：根容器是 .skm-hub（.skm-panel 是样式表里的旧键，组件已不用）。
+    await cdp.waitFor("document.querySelector('.skm-hub') !== null", 15000, '能力面板打开')
+  } catch (error) {
+    // 失败时把现场 dump 出来：类名、入口按钮、有没有 skm-* 容器，便于定位是
+    // 「面板没打开」还是「客户端插件没加载」还是「DOM 变了」。
+    const dump = await cdp.evaluate(`(() => ({
+      navButtons: [...document.querySelectorAll('.dsh-nav-btn')].map((n) => ({
+        label: n.getAttribute('aria-label'), open: n.getAttribute('data-open'), text: (n.textContent ?? '').slice(0, 20),
+      })),
+      skmClasses: [...new Set([...document.querySelectorAll('[class*=skm]')].map((n) => n.className))].slice(0, 20),
+      hasNavHost: document.querySelector('#dsh-prompt-customizer-nav-host') !== null,
+      bodyHead: (document.body.innerHTML ?? '').slice(0, 400),
+    }))()`)
+    const outDir = args.out ?? join(process.cwd(), 'verify-shots')
+    mkdirSync(outDir, { recursive: true })
+    const shot = await cdp.send('Page.captureScreenshot', { format: 'png' })
+    writeFileSync(join(outDir, 'panel-open-failed.png'), Buffer.from(shot.data, 'base64'))
+    throw new Error(`${error instanceof Error ? error.message : String(error)}\n诊断：${JSON.stringify(dump, null, 2)}`)
+  }
+  check('「能力」面板已打开', true)
+
+  // 5. 点 MCP tab —— 这一步就是历史上闪退的地方
+  const openedMcp = await cdp.evaluate(`(() => {
+    const tab = [...document.querySelectorAll('[role="tab"]')].find((n) => (n.textContent ?? '').trim() === 'MCP')
+    if (tab === undefined) return false
+    tab.click()
+    return true
+  })()`)
+  check('找到并点击 MCP tab', openedMcp === true)
+  await sleep(1200)
+
+  // MCP 页没有独立的根容器（样式表里的 skm-mcp-view-root 组件并未使用）；
+  // 「还挂着」的判据是：MCP tab 处于选中态 + 面板仍在 + 面板里能看到 MCP 文案。
+  const mcpActive = await cdp.evaluate(`(() => {
+    const tab = [...document.querySelectorAll('[role="tab"]')].find((n) => (n.textContent ?? '').trim() === 'MCP')
+    return tab?.getAttribute('aria-selected') === 'true'
+  })()`)
+  check('MCP tab 处于选中态（点击生效，没有闪退回对话界面）', mcpActive === true)
+
+  const panelStillThere = await cdp.evaluate("document.querySelector('.skm-hub') !== null")
+  check('面板没有被 ErrorBoundary 摘掉', panelStillThere === true)
+
+  const mcpVisible = await cdp.evaluate(`(() => {
+    const hub = document.querySelector('.skm-hub')
+    return (hub?.textContent ?? '').includes('MCP')
+  })()`)
+  check('MCP 页渲染出内容', mcpVisible === true)
+
+  // 6. mcps 目录分组里的 server 都在 DOM 里
+  const mcpText = await cdp.evaluate("document.querySelector('.skm-hub')?.textContent ?? ''")
+  for (const name of expectMcp) {
+    check(`MCP 列表出现 ${name}`, mcpText.includes(name))
+  }
+  if (expectMcp.length > 0) {
+    check('mcps 目录分组标题出现', mcpText.includes('mcps 目录'))
+  }
+
+  // 7. SKILL tab：四个目录里的技能都要在，且同名时 .dsh 胜出（描述来自 .dsh 那份）
+  const openedSkill = await cdp.evaluate(`(() => {
+    const tab = [...document.querySelectorAll('[role="tab"]')].find((n) => (n.textContent ?? '').trim() === 'SKILL')
+    if (tab === undefined) return false
+    tab.click()
+    return true
+  })()`)
+  check('找到并点击 SKILL tab', openedSkill === true)
+  await sleep(1200)
+  // 散装技能区块默认折叠：先展开它，技能名才会进 DOM（不展开时只有计数）。
+  const expandedLoose = await cdp.evaluate(`(() => {
+    const header = [...document.querySelectorAll('.skm-bundle-row')]
+      .find((node) => (node.textContent ?? '').includes('散装技能'))
+    if (header === undefined) return false
+    if (header.closest('[data-open="true"]') === null) header.click()
+    return true
+  })()`)
+  check('找到散装技能区块并展开', expandedLoose === true)
+  await sleep(800)
+  const skillText = await cdp.evaluate("document.querySelector('.skm-hub')?.textContent ?? ''")
+  for (const name of expectSkills) {
+    check(`技能列表出现 ${name}`, skillText.includes(name))
+  }
+  if (args['expect-dup-winner'] !== undefined) {
+    check(`同名技能采用 ${args['expect-dup-winner']} 那份（.dsh 优先）`,
+      skillText.includes(args['expect-dup-winner']))
+  }
+
+  // 8. 截图留证
+  const outDir = args.out ?? join(process.cwd(), 'verify-shots')
+  mkdirSync(outDir, { recursive: true })
+  const shot = await cdp.send('Page.captureScreenshot', { format: 'png' })
+  const shotPath = join(outDir, 'panel-skill.png')
+  writeFileSync(shotPath, Buffer.from(shot.data, 'base64'))
+  check('截图已保存', existsSync(shotPath), shotPath)
+
+  // 9. 全程无未捕获异常 / console.error（过滤掉与本页无关的资源噪声）
+  const realExceptions = exceptions.filter((text) => !text.includes('ResizeObserver'))
+  check('浏览器无未捕获异常', realExceptions.length === 0, realExceptions.slice(0, 3).join(' | '))
+  check('MCP 页没有 Element type is invalid（历史上就是它导致闪退）',
+    !exceptions.some((text) => text.includes('Element type is invalid')))
+} catch (error) {
+  check('验证流程执行完成', false, error instanceof Error ? error.message : String(error))
+} finally {
+  failed = checks.some((item) => !item.pass)
+  try { await cdp?.send('Browser.close') } catch { /* 忽略 */ }
+  await sleep(500)
+  browser.kill()
+}
+
+console.log(`\n${failed ? 'PANEL BROWSER VERIFY FAILED' : 'PANEL BROWSER VERIFY PASSED'}（${checks.filter((c) => c.pass).length}/${checks.length}）`)
+if (consoleErrors.length > 0) console.log(`（console.error ${consoleErrors.length} 条，首条：${consoleErrors[0].slice(0, 200)}）`)
+process.exit(failed ? 1 : 0)