dsh-skill-hub 0.3.13 → 0.3.14

package/lib/index.js

@@ -4510,11 +4510,10 @@ const Config = z.object({
 	statsScanMinutes: z.number().min(1).max(1440).default(HUB_CONFIG_DEFAULTS.statsScanMinutes)
 });
 /**
-* Settings namespace hosting the hub's runtime config. Since dsh rc.7 the
-* host serves every registered settings namespace to the web client (the
-* dsh-host-apiproxy allowlist is gone), so the browser card and the settings
-* page edit this namespace through the official settings transport, and the
-* plugin consumes the same resolved value — one source of truth.
+* Settings namespace hosting the hub's runtime config. The host serves every
+* registered settings namespace to the web client, so the browser card and the
+* settings page edit this namespace through the official settings transport,
+* and the plugin consumes the same resolved value — one source of truth.
 */
 const CONFIG_NAMESPACE = "dsh-skill-hub";
 /** Schema of the hub's settings namespace: the card's fields (booleans + optional dot colors). */

package/lib/types/client/SkillHubSettingsCard.d.ts

@@ -2,8 +2,10 @@
  * The dsh-skill-hub plugin settings card: bridges the hub's settings
  * namespace (bound through the official settings transport) onto the
  * family-style staged card form (enabled master switch + agent announcement).
- * Registered into the official `settings.plugin.item` slot keyed by that
- * namespace, so the plugin shows up in Settings → 插件 on dsh rc.7+.
+ * Registered into `plugins.bundle.config` under the bundle's package name, so
+ * the Plugins manager renders it on dsh-skill-hub's own page. That slot is
+ * dispatched with `view: 'page'` only, so the card always renders its full
+ * form (no `summary` one-liner variant).
  */
 import { type ReactElement } from 'react';
 import type { SnapshotStore } from '@deepseek-ai/dsh-client-store';
@@ -34,7 +36,7 @@ export interface SkillHubSettingsCardFace {
     resetField: (field: string) => void;
 }
 /** Props the slot renderer binds (locale copy + injected form actions). */
-export type SkillHubSettingsCardProps = PropsRuntime<'settings.plugin.item'> & PropsLocale<'dsh-skill-hub'> & InjectFace<SkillHubSettingsCardFace>;
+export type SkillHubSettingsCardProps = PropsRuntime<'plugins.bundle.config'> & PropsLocale<'dsh-skill-hub'> & InjectFace<SkillHubSettingsCardFace>;
 /** Bridges the hub's config scope onto the card's staged form. */
 export declare class SkillHubSettingsCardController {
     private readonly form;

package/lib/types/client/icons.d.ts

@@ -2,11 +2,10 @@
  * Vendored UI icons for dsh-skill-hub.
  *
  * These were originally imported from `@deepseek-ai/dsh-client-ui-primitives`.
- * That package is still published for the rc.7/rc.2 SDK families, but newer dsh
- * web builds no longer expose it as a standalone plugin module — they keep a
- * static compatibility module instead. Vendoring the few tiny outline icons the
- * hub uses makes the browser half self-contained and equally compatible with
- * older and newer dsh hosts.
+ * That package is not exposed as a standalone plugin module by the dsh web
+ * build this plugin targets — dsh keeps a static compatibility module instead.
+ * Vendoring the few tiny outline icons the hub uses keeps the browser half
+ * self-contained and independent of how that module is packaged.
  *
  * SVG paths are copied verbatim from dsh-client-ui-primitives (MIT licensed)
  * so the visuals remain pixel-identical to the dsh icon family.

package/lib/types/client/index.d.ts

@@ -6,10 +6,10 @@
  * surfaces, both through official slots (no DOM injection):
  *  - a plugin-management card in the `settings.plugin.item` slot (Settings →
  *    插件 → 可配置插件列表), keyed by the hub's settings namespace and bound
- *    through the official settings transport (dsh rc.7 serves every
- *    registered namespace to the web client, and the tab dispatches cards by
- *    namespace) — the family-bucket card pattern (PluginSettingsCard +
- *    CardForm vendored from dsh-task-board);
+ *    through the official settings transport (the Host serves every registered
+ *    namespace to the web client, and the tab dispatches cards by namespace) —
+ *    the family-bucket card pattern (PluginSettingsCard + CardForm vendored
+ *    from dsh-task-board);
  *  - a top-level Settings section (Settings → 技能) hosting the skill hub
  *    panel: catalog, search, enable/disable, diagnostics, new-skill form.
  *

package/lib/types/client/slash-dots.d.ts

@@ -2,14 +2,15 @@
  * Slash-menu skill dots: puts the invocation-status dot (model-callable blue /
  * user-only green) in front of every skill candidate in the chat `/` menu.
  *
- * Mechanism (mirrors how dsh-at-file fills the menu icon slot): the candidate
- * menu's rows already render an optional `icon` slot (`MenuView` renders
- * `item.icon` in a 16×16 leading span when it's defined), but the core `/skill`
- * source (`dsh-client-ui-skill`) returns candidates without `icon`. This module
- * wraps that source's `candidates` and stamps each row with a colored dot,
- * reusing the same settings (dotModelColor / dotUserColor) and the same
- * `modelInvocable` classification the panel legend uses — so the chat menu and
- * the Settings → 技能 panel stay in sync, and editing the color updates both.
+ * Mechanism: hooks the `/skill` source's `candidates` so the hub learns which
+ * rows are skill candidates and how each one classifies for model invocation,
+ * then injects the dot straight into the rendered option rows. The menu's
+ * `icon` slot is unusable for this — `MenuView` narrowed `icon` to an enum
+ * ('file' | 'folder' | 'session') and renders it through `ReferenceIcon`, so a
+ * custom element never reaches the DOM. Colors come from the same settings
+ * (dotModelColor / dotUserColor) and the same `modelInvocable` classification
+ * the panel legend uses — so the chat menu and the Settings → 技能 panel stay
+ * in sync, and editing the color updates both.
  *
  * The skill source is registered by the core plugin under the `name` "skill"
  * on the `/` trigger; re-registering the same name would throw, so this wraps
@@ -35,6 +36,14 @@ export declare function findSkillSource(service: InputTriggerServiceContract): I
  * catalog wins after reconnect; exported for deterministic unit tests.
  */
 export declare function resetModelCache(): void;
+/**
+ * Wrap the core skill source so every menu row carries the invocation dot.
+ * Exported for unit tests; production wiring goes through setupSkillSlashDots.
+ * @param source - the registered `/skill` source.
+ * @param api - hub browser API for the modelInvocable lookup.
+ * @param scope - hub settings scope for the dot colors.
+ * @returns a disposer restoring the original candidates.
+ */
 export declare function wrapSkillSource(source: InputTriggerSource, api: SkillHubApi, scope: SettingsScope<HubSettingsValue>): () => void;
 /**
  * Mount the slash-menu dots on the registered `/skill` source. Idempotent and

package/lib/types/index.d.ts

@@ -33,11 +33,10 @@ export interface Config {
 }
 export declare const Config: z<Config>;
 /**
- * Settings namespace hosting the hub's runtime config. Since dsh rc.7 the
- * host serves every registered settings namespace to the web client (the
- * dsh-host-apiproxy allowlist is gone), so the browser card and the settings
- * page edit this namespace through the official settings transport, and the
- * plugin consumes the same resolved value — one source of truth.
+ * Settings namespace hosting the hub's runtime config. The host serves every
+ * registered settings namespace to the web client, so the browser card and the
+ * settings page edit this namespace through the official settings transport,
+ * and the plugin consumes the same resolved value — one source of truth.
  */
 export declare const CONFIG_NAMESPACE: SettingsNamespace;
 /** Schema of the hub's settings namespace: the card's fields (booleans + optional dot colors). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {
@@ -61,19 +61,7 @@
     ],
     "compatibility": {
       "dshVersions": [
-        "0.1.0-rc.7",
-        "0.1.1-rc.2",
-        "0.1.2-alpha.2",
-        "0.1.2-alpha.3",
-        "0.1.2-alpha.4",
-        "0.1.2-alpha.5",
-        "0.1.2-rc.1",
-        "0.1.3-alpha.2",
-        "0.1.5-alpha.1",
-        "0.1.5-alpha.2",
-        "0.1.5-rc.1",
-        "0.1.5-rc.2",
-        "0.1.6-alpha.1"
+        "0.1.6-alpha.2"
       ]
     },
     "capability": {
@@ -95,19 +83,19 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-client-runtime": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-client-store": ">=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-host-webserver": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-session": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-session-query": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-settings": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-skill": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
-    "@deepseek-ai/dsh-system-prompt": ">=0.1.0-rc.7 <0.2.0-0 || >=0.1.1-rc.2 <0.2.0-0 || >=0.1.2-alpha.2 <0.2.0-0 || >=0.1.2-alpha.3 <0.2.0-0 || >=0.1.2-alpha.4 <0.2.0-0 || >=0.1.2-alpha.5 <0.2.0-0 || >=0.1.2-rc.1 <0.2.0-0 || >=0.1.3-alpha.2 <0.2.0-0 || >=0.1.5-alpha.1 <0.2.0-0 || >=0.1.5-alpha.2 <0.2.0-0 || >=0.1.5-rc.1 <0.2.0-0 || >=0.1.5-rc.2 <0.2.0-0 || >=0.1.6-alpha.1 <0.2.0-0",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-runtime": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-store": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-session": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-session-query": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-skill": ">=0.1.6-alpha.2 <0.2.0-0",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.6-alpha.2 <0.2.0-0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
@@ -121,19 +109,20 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-client-connection": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-store": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-session": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-session-query": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-settings": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-skill": "^0.1.6-alpha.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-store": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-session-query": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-skill": "^0.1.6-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.6-alpha.2",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",

package/src/client/SkillHubSettingsCard.tsx

@@ -2,8 +2,10 @@
  * The dsh-skill-hub plugin settings card: bridges the hub's settings
  * namespace (bound through the official settings transport) onto the
  * family-style staged card form (enabled master switch + agent announcement).
- * Registered into the official `settings.plugin.item` slot keyed by that
- * namespace, so the plugin shows up in Settings → 插件 on dsh rc.7+.
+ * Registered into `plugins.bundle.config` under the bundle's package name, so
+ * the Plugins manager renders it on dsh-skill-hub's own page. That slot is
+ * dispatched with `view: 'page'` only, so the card always renders its full
+ * form (no `summary` one-liner variant).
  */
 
 import { useEffect, useState, type ReactElement } from 'react'
@@ -54,7 +56,7 @@ export interface SkillHubSettingsCardFace {
 
 /** Props the slot renderer binds (locale copy + injected form actions). */
 export type SkillHubSettingsCardProps =
-  PropsRuntime<'settings.plugin.item'> & PropsLocale<'dsh-skill-hub'> & InjectFace<SkillHubSettingsCardFace>
+  PropsRuntime<'plugins.bundle.config'> & PropsLocale<'dsh-skill-hub'> & InjectFace<SkillHubSettingsCardFace>
 
 /** Bridges the hub's config scope onto the card's staged form. */
 export class SkillHubSettingsCardController {

package/src/client/icons.tsx

@@ -2,11 +2,10 @@
  * Vendored UI icons for dsh-skill-hub.
  *
  * These were originally imported from `@deepseek-ai/dsh-client-ui-primitives`.
- * That package is still published for the rc.7/rc.2 SDK families, but newer dsh
- * web builds no longer expose it as a standalone plugin module — they keep a
- * static compatibility module instead. Vendoring the few tiny outline icons the
- * hub uses makes the browser half self-contained and equally compatible with
- * older and newer dsh hosts.
+ * That package is not exposed as a standalone plugin module by the dsh web
+ * build this plugin targets — dsh keeps a static compatibility module instead.
+ * Vendoring the few tiny outline icons the hub uses keeps the browser half
+ * self-contained and independent of how that module is packaged.
  *
  * SVG paths are copied verbatim from dsh-client-ui-primitives (MIT licensed)
  * so the visuals remain pixel-identical to the dsh icon family.

package/src/client/index.tsx

@@ -6,10 +6,10 @@
  * surfaces, both through official slots (no DOM injection):
  *  - a plugin-management card in the `settings.plugin.item` slot (Settings →
  *    插件 → 可配置插件列表), keyed by the hub's settings namespace and bound
- *    through the official settings transport (dsh rc.7 serves every
- *    registered namespace to the web client, and the tab dispatches cards by
- *    namespace) — the family-bucket card pattern (PluginSettingsCard +
- *    CardForm vendored from dsh-task-board);
+ *    through the official settings transport (the Host serves every registered
+ *    namespace to the web client, and the tab dispatches cards by namespace) —
+ *    the family-bucket card pattern (PluginSettingsCard + CardForm vendored
+ *    from dsh-task-board);
  *  - a top-level Settings section (Settings → 技能) hosting the skill hub
  *    panel: catalog, search, enable/disable, diagnostics, new-skill form.
  *
@@ -29,14 +29,15 @@ import type {} from '@deepseek-ai/dsh-client-locale/client'
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
 // Type-only: pulls the LocaleNamespaceMap merge table.
 import type {} from '@deepseek-ai/dsh-client-ui-slots'
-// Type-only: pulls the settings-plugins SlotMap merge (settings.plugin.item).
-import type {} from '@deepseek-ai/dsh-client-ui-settings-plugins/client'
 // Type-only: pulls the Context merge for ctx.inputTriggers (slash-dots wiring).
 import type {} from '@deepseek-ai/dsh-client-ui-input-trigger/client'
+// Type-only: pulls the plugin-manager SlotMap merge (plugins.bundle.config).
+import type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
 // Type-only: pulls the connection/reset event.
 import type {} from '@deepseek-ai/dsh-client-connection/client'
 
-// 0.1.2-alpha.2: slots service moved to ui-renderer; provide local augmentation for build.
+// The slots service is owned by ui-renderer, which this build does not depend
+// on; augment the Context locally so the browser half typechecks.
 declare module '@deepseek-ai/cordis' {
   interface Context {
     slots: any
@@ -85,8 +86,8 @@ export function apply(ctx: ClientContext): void {
 
   // The card edits the hub's settings namespace through the official
   // settings transport — the configurable-plugins tab only dispatches cards
-  // whose key the Host serves, and the Host serves every registered namespace
-  // since rc.7, so this is what makes the card appear (and stay in sync).
+  // whose key the Host serves, and the Host serves every registered namespace,
+  // so this is what makes the card appear (and stay in sync).
   // Single scope instance reused for both the card and slash-dots to avoid
   // duplicate subscriptions (review #3).
   const scope = ctx.settingsScope.bind<HubSettingsValue>({ namespace: NS })
@@ -96,17 +97,18 @@ export function apply(ctx: ClientContext): void {
   // inject 含 inputTriggers 保证 fiber 就绪后再 wrap，slash-dots 内的 undefined 防御仅用于单元测试 mock
   ctx.effect(() => setupSkillSlashDots(ctx, api, scope), 'dsh-skill-hub: slash dots')
 
-  // Plugin-management card: Settings → 插件 → 可配置插件列表.
-  // rc.7's slot contract declares this keyed slot with options `key`
-  // (the settings namespace the card edits), so registration is fully typed.
+  // Plugin configuration: the hub renders its own form on the bundle's page in
+  // the Plugins manager (sidebar → 插件 → dsh-skill-hub), keyed by the bundle's
+  // package name — the manager dispatches that key with `view: 'page'`.
+  // No extra settings tab is contributed.
   ctx.effect(
-    () => ctx.slots.inject('settings.plugin.item', () => ctx.slots.register({
-      name: 'settings.plugin.item',
-      key: NS,
+    () => ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({
+      name: 'plugins.bundle.config',
+      key: 'dsh-skill-hub',
       locale: NS,
       inject: () => settingsCard.inject(),
     }, SkillHubSettingsCard)),
-    'dsh-skill-hub: settings card',
+    'dsh-skill-hub: plugin config',
   )
 
   // Top-level Settings section: the skill management page.

package/src/client/slash-dots.test.ts

@@ -1,8 +1,10 @@
 /**
  * Slash-menu skill dots: source lookup + candidates wrapping. The wrapper's
  * contract is pure and injectable — fake api (catalog) and fake settings scope
- * (getSnapshot), no DOM — so it tests cleanly in the node vitest environment.
- * The module caches the catalog map; resetModelCache keeps tests independent.
+ * (getSnapshot) — so it tests cleanly in the node vitest environment. The dot
+ * itself is injected into the rendered DOM, which does not exist here, so these
+ * tests assert that candidate rows pass through untouched. The module caches
+ * the catalog map; resetModelCache keeps tests independent.
  */
 
 import { beforeEach, describe, expect, it } from 'vitest'
@@ -85,11 +87,10 @@ describe('findSkillSource', () => {
 })
 
 describe('wrapSkillSource', () => {
-  it('adds a model-colored dot to model-callable skills and a user-colored dot to user-only ones (old host, no drilled)', async () => {
+  it('leaves candidate rows untouched — the dot goes to the DOM, not the icon slot', async () => {
     const source = skillSource(async () => [
       { name: 'code-review', description: 'review code' },
       { name: 'personal-note', description: 'only me' },
-      { name: 'known-default', description: 'fallback unknown' },
     ])
     const api = apiWith([
       { name: 'code-review', modelInvocable: true },
@@ -99,16 +100,13 @@ describe('wrapSkillSource', () => {
 
     const restore = wrapSkillSource(source, api, scope)
     try {
-      // Old host: CandidateRequest 无 drilled 字段，注入彩色点
-      const rows = await source.candidates({ sessionId: 's1' as never }, { query: '', position: 'leading', signal: new AbortController().signal } as unknown as import('@deepseek-ai/dsh-client-ui-input-trigger/client').CandidateRequest)
-
-      expect(rows).toHaveLength(3)
-      // Model-callable → model color.
-      expect((rows[0].icon as unknown as { props: { style: { background: string } } }).props.style.background).toBe('#112233')
-      // User-only → user color.
-      expect((rows[1].icon as unknown as { props: { style: { background: string } } }).props.style.background).toBe('#445566')
-      // Unknown name → model default (still a dot, safer than no dot).
-      expect(rows[2].icon).toBeDefined()
+      const rows = await source.candidates({ sessionId: 's1' as never }, { query: '', position: 'leading', drilled: false, signal: new AbortController().signal })
+
+      expect(rows).toHaveLength(2)
+      // MenuView renders `icon` through ReferenceIcon (enum-narrowed), so a
+      // custom element would never show — rows must carry no icon at all.
+      expect(rows[0].icon).toBeUndefined()
+      expect(rows[1].icon).toBeUndefined()
       // Original fields pass through untouched.
       expect(rows[0].name).toBe('code-review')
       expect(rows[0].description).toBe('review code')
@@ -117,33 +115,18 @@ describe('wrapSkillSource', () => {
     }
   })
 
-  it('falls back to the default colors when settings omit them and catalog fails (old host)', async () => {
+  it('still returns the rows when the catalog route is down', async () => {
     const source = skillSource(async () => [{ name: 'lonely', description: '' }])
     const api = { catalog: async () => { throw new Error('route down') } } as unknown as SkillHubApi
     const scope = scopeWith({ enabled: true, announceToAgent: true, showUseCount: true, showUseTime: true, showGroupSummary: true })
 
-    const restore = wrapSkillSource(source, api, scope)
-    try {
-      const rows = await source.candidates({ sessionId: 's1' as never }, { query: '', position: 'leading', signal: new AbortController().signal } as unknown as import('@deepseek-ai/dsh-client-ui-input-trigger/client').CandidateRequest)
-      // Catalog failed → unknown name → model default dot still renders.
-      expect(rows[0].icon).toBeDefined()
-      expect((rows[0].icon as unknown as { props: { style: { background: string } } }).props.style.background).toBe('#2f81f7')
-    } finally {
-      restore()
-    }
-  })
-
-  it('skips dot injection on new host (alpha.2, drilled present) for ReferenceIcon compat', async () => {
-    const source = skillSource(async () => [{ name: 'code-review', description: 'review code' }])
-    const api = apiWith([{ name: 'code-review', modelInvocable: true }])
-    const scope = scopeWith({ enabled: true, announceToAgent: true, showUseCount: true, showUseTime: true, showGroupSummary: true, dotModelColor: '#112233', dotUserColor: '#445566' })
-
     const restore = wrapSkillSource(source, api, scope)
     try {
       const rows = await source.candidates({ sessionId: 's1' as never }, { query: '', position: 'leading', drilled: false, signal: new AbortController().signal })
+      // A failed catalog only means no dots (unknown names are skipped); the
+      // menu itself must keep working.
       expect(rows).toHaveLength(1)
-      expect(rows[0].icon).toBeUndefined()
-      expect(rows[0].name).toBe('code-review')
+      expect(rows[0].name).toBe('lonely')
     } finally {
       restore()
     }

package/src/client/slash-dots.tsx

@@ -2,14 +2,15 @@
  * Slash-menu skill dots: puts the invocation-status dot (model-callable blue /
  * user-only green) in front of every skill candidate in the chat `/` menu.
  *
- * Mechanism (mirrors how dsh-at-file fills the menu icon slot): the candidate
- * menu's rows already render an optional `icon` slot (`MenuView` renders
- * `item.icon` in a 16×16 leading span when it's defined), but the core `/skill`
- * source (`dsh-client-ui-skill`) returns candidates without `icon`. This module
- * wraps that source's `candidates` and stamps each row with a colored dot,
- * reusing the same settings (dotModelColor / dotUserColor) and the same
- * `modelInvocable` classification the panel legend uses — so the chat menu and
- * the Settings → 技能 panel stay in sync, and editing the color updates both.
+ * Mechanism: hooks the `/skill` source's `candidates` so the hub learns which
+ * rows are skill candidates and how each one classifies for model invocation,
+ * then injects the dot straight into the rendered option rows. The menu's
+ * `icon` slot is unusable for this — `MenuView` narrowed `icon` to an enum
+ * ('file' | 'folder' | 'session') and renders it through `ReferenceIcon`, so a
+ * custom element never reaches the DOM. Colors come from the same settings
+ * (dotModelColor / dotUserColor) and the same `modelInvocable` classification
+ * the panel legend uses — so the chat menu and the Settings → 技能 panel stay
+ * in sync, and editing the color updates both.
  *
  * The skill source is registered by the core plugin under the `name` "skill"
  * on the `/` trigger; re-registering the same name would throw, so this wraps
@@ -24,8 +25,7 @@ import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client'
 import type {} from '@deepseek-ai/dsh-client-ui-input-trigger/client'
 // Type-only: pulls the connection/reset event.
 import type {} from '@deepseek-ai/dsh-client-connection/client'
-import type { InputTriggerCandidate, InputTriggerServiceContract, InputTriggerSource } from '@deepseek-ai/dsh-client-ui-input-trigger/client'
-import { createElement } from 'react'
+import type { InputTriggerServiceContract, InputTriggerSource } from '@deepseek-ai/dsh-client-ui-input-trigger/client'
 import type { HubSettingsValue } from '../protocol.ts'
 import type { SkillHubApi } from './api.ts'
 import { DEFAULT_DOT_MODEL_COLOR, DEFAULT_DOT_USER_COLOR } from './panel/format.ts'
@@ -92,37 +92,11 @@ async function modelInvocableMap(api: SkillHubApi): Promise<Map<string, boolean>
 }
 
 /**
- * One menu-row dot element. Inline span so it needs no CSS module; the
- * candidate menu centers it inside its 16×16 leading icon slot.
- * @param color - the dot's background color.
- * @returns a React node (memory-only, never crosses the Host boundary).
- */
-function dotIcon(color: string): InputTriggerCandidate['icon'] {
-  return createElement('span', {
-    'aria-hidden': true,
-    style: {
-      display: 'inline-block',
-      width: 6,
-      height: 6,
-      borderRadius: 3,
-      background: color,
-      flex: 'none',
-    },
-  }) as unknown as InputTriggerCandidate['icon']
-}
-
-/**
- * Wrap the core skill source so every menu row carries the invocation dot.
- * Exported for unit tests; production wiring goes through setupSkillSlashDots.
- * @param source - the registered `/skill` source.
- * @param api - hub browser API for the modelInvocable lookup.
- * @param scope - hub settings scope for the dot colors.
- * @returns a disposer restoring the original candidates.
- */
-/**
- * DOM 兜底：在 alpha.2 新版 MenuView（icon 仅枚举）下通过直接操作
- * 已渲染的 `[role="option"]` 列表注入彩色点，绕过 `icon` 限制。
- * 旧版仍走 `icon` 注入，此处仅为新版。
+ * 通过直接操作已渲染的 `[role="option"]` 列表注入彩色点，
+ * 绕过 MenuView 对 `icon` 的枚举限制。
+ * @param modelByName - 技能名 → 模型可调用性；不在表内的候选不注点。
+ * @param modelColor - 模型可调用技能的点色。
+ * @param userColor - 仅用户可调用技能的点色。
  */
 function injectDotsViaDOM(modelByName: Map<string, boolean>, modelColor: string, userColor: string): void {
   if (typeof document === 'undefined' || typeof requestAnimationFrame === 'undefined') return
@@ -145,7 +119,7 @@ function injectDotsViaDOM(modelByName: Map<string, boolean>, modelColor: string,
       // 仅对技能生效：非技能候选（/command、@file 等）不在 catalog，不注点
       if (!modelByName.has(name)) continue
       const color = (modelByName.get(name) ?? true) ? modelColor : userColor
-      // 复刻旧版 icon 槽：16×16 容器居中 6px 点，与升级前 `dotIcon` 在 `itemIcon` 内的效果一致
+      // 布局对齐菜单行原有的 icon 槽：16×16 容器居中 6px 点
       const wrapper = document.createElement('span')
       wrapper.setAttribute('data-skill-dot', '')
       wrapper.setAttribute('aria-hidden', 'true')
@@ -163,37 +137,33 @@ function injectDotsViaDOM(modelByName: Map<string, boolean>, modelColor: string,
       dot.style.background = color
       dot.style.flex = 'none'
       wrapper.appendChild(dot)
-      // 新版无 icon 槽，直接插在名称前，与旧版 `itemIcon` 位置一致
+      // 直接插在名称前，与菜单行原有 icon 槽的位置一致
       nameEl.parentElement?.insertBefore(wrapper, nameEl)
     }
   }
   requestAnimationFrame(() => setTimeout(run, 0))
 }
 
+/**
+ * Wrap the core skill source so every menu row carries the invocation dot.
+ * Exported for unit tests; production wiring goes through setupSkillSlashDots.
+ * @param source - the registered `/skill` source.
+ * @param api - hub browser API for the modelInvocable lookup.
+ * @param scope - hub settings scope for the dot colors.
+ * @returns a disposer restoring the original candidates.
+ */
 export function wrapSkillSource(source: InputTriggerSource, api: SkillHubApi, scope: SettingsScope<HubSettingsValue>): () => void {
   const original = source.candidates
   source.candidates = async (session, req) => {
     const items = await original(session, req)
     if (req.signal.aborted) return items
-    // Dual-compat: 0.1.2-alpha.2 的 MenuView 将 icon 收窄为 'file'|'folder'|'session'
-    // 并通过 ReferenceIcon 渲染，旧版的自定义 ReactElement 点已无法展示。
-    // 以 `drilled` 是否存在探测新版（alpha.2 必有，rc 无）。
-    const isNewHost = req !== null && typeof req === 'object' && 'drilled' in (req as unknown as Record<string, unknown>)
     const modelByName = await modelInvocableMap(api)
     if (req.signal.aborted) return items
     const snapshot = scope.getSnapshot()
     const modelColor = snapshot.value?.dotModelColor ?? DEFAULT_DOT_MODEL_COLOR
     const userColor = snapshot.value?.dotUserColor ?? DEFAULT_DOT_USER_COLOR
-    if (isNewHost) {
-      // 新版：不通过 icon（枚举限制），改为 DOM 注入
-      injectDotsViaDOM(modelByName, modelColor, userColor)
-      return items
-    }
-    // 旧版：保持原有 icon 注入
-    return items.map((item) => ({
-      ...item,
-      icon: dotIcon((modelByName.get(item.name) ?? true) ? modelColor : userColor),
-    }))
+    injectDotsViaDOM(modelByName, modelColor, userColor)
+    return items
   }
   return () => {
     source.candidates = original

package/src/index.ts

@@ -62,11 +62,10 @@ export const Config: z<Config> = z.object({
 })
 
 /**
- * Settings namespace hosting the hub's runtime config. Since dsh rc.7 the
- * host serves every registered settings namespace to the web client (the
- * dsh-host-apiproxy allowlist is gone), so the browser card and the settings
- * page edit this namespace through the official settings transport, and the
- * plugin consumes the same resolved value — one source of truth.
+ * Settings namespace hosting the hub's runtime config. The host serves every
+ * registered settings namespace to the web client, so the browser card and the
+ * settings page edit this namespace through the official settings transport,
+ * and the plugin consumes the same resolved value — one source of truth.
  */
 export const CONFIG_NAMESPACE = 'dsh-skill-hub' as SettingsNamespace
 
@@ -99,12 +98,11 @@ export const SKILL_HUB_GUIDANCE = [
  * @param config - resolved plugin config (schema defaults applied by the loader).
  */
 export function apply(ctx: Context, config?: Config): void {
-  // The hub's runtime configuration lives in dsh's own settings service:
-  // since rc.7 the host serves every registered settings namespace to the
-  // web client (dsh-host-apiproxy's allowlist is gone), so the browser card
-  // and the config route edit this namespace through the official settings
-  // transport, and the host consumes the very same resolved value — one
-  // source of truth. The cordis composition entry seeds the base layer; the
+  // The hub's runtime configuration lives in dsh's own settings service: the
+  // host serves every registered settings namespace to the web client, so the
+  // browser card and the config route edit this namespace through the official
+  // settings transport, and the host consumes the very same resolved value —
+  // one source of truth. The cordis composition entry seeds the base layer; the
   // sidecar config survives only as a one-time migration source below.
   const base = config ?? {}
   const settingsScope = ctx.settings.register(CONFIG_NAMESPACE, HubSettingsSchema, { base })