dsh-skill-picker 0.5.11 → 0.5.13

package/src/client/session-view.js

@@ -0,0 +1,68 @@
+/**
+ * Session identity and workspace cwd for the picker's two skill sources.
+ *
+ * Both values come from the slot's framework standard props: the picker seats
+ * itself in `conversation.input.right`, which is a Session-scoped slot, so the
+ * kernel hands the component a `sessionId` plus the global `useSessions`
+ * selector hook. This module keeps that contract in one testable place.
+ *
+ * Why not read them from `ctx.sessions.list` (as this plugin did before
+ * 0.5.13)? Because the Session list snapshot is not a "which Session is
+ * current" source any more: since the 0.1.7 client its state is
+ * `{ ids, byId, phase, projectionsBySession }`, with no `current` cursor. The
+ * old lookup therefore resolved to `undefined` on every 0.1.7 install, the
+ * picker fell back to the host scan, and that scan — sent without `?cwd=` —
+ * could only see user-level roots. Project-level skills
+ * (`<workspace>/.agents/skills`) silently disappeared from the panel while
+ * user-level ones kept showing.
+ *
+ * @module dsh-skill-picker/client/session-view
+ */
+
+/**
+ * The active Session's identity, or `undefined` outside a Session scope.
+ *
+ * `sessionId` is the current standard prop. `props.session` is the carrier the
+ * older client lines handed to slot components; it stays as a fallback so the
+ * panel keeps working on 0.1.2/0.1.5 kernels too.
+ *
+ * @param props - the slot component's framework props.
+ */
+export function sessionIdOf(props) {
+  return props?.sessionId ?? props?.session?.sessionId
+}
+
+/**
+ * Selector over the Session list state: the active Session's workspace cwd.
+ *
+ * Deliberately reads `byId[sessionId]` — the only shape every supported kernel
+ * publishes — and normalizes "no row yet" / "row without cwd" / a non-string
+ * cwd to `''`, which is what the host route treats as "no project root".
+ *
+ * @param sessionId - the active Session identity, if any.
+ * @returns a `useSessions` selector producing the cwd string (possibly empty).
+ */
+export function selectWorkspaceCwd(sessionId) {
+  return (state) => {
+    const cwd = sessionId === undefined ? undefined : state?.byId?.[sessionId]?.cwd
+    return typeof cwd === 'string' ? cwd : ''
+  }
+}
+
+/**
+ * Resolve the active Session's workspace cwd through the slot's global
+ * `useSessions` hook (framework seat owned by `ui-session`).
+ *
+ * The availability check is stable across renders — `props.useSessions` is a
+ * framework seat, never flipped per render — so the hook is either always
+ * called or never called for one mounted seat. A composition without the hook
+ * degrades to `''` (user-level scan) instead of failing the panel.
+ *
+ * @param props - the slot component's framework props.
+ * @returns the workspace cwd, or `''` when it cannot be resolved.
+ */
+export function useWorkspaceCwd(props) {
+  const useSessions = props?.useSessions
+  const cwd = typeof useSessions === 'function' ? useSessions(selectWorkspaceCwd(sessionIdOf(props))) : undefined
+  return typeof cwd === 'string' ? cwd : ''
+}

package/src/index.js

@@ -54,12 +54,18 @@ function userAgentsSkillsDir() {
   return path.join(agentsHome, 'skills')
 }
 
+/** The YAML frontmatter block of a SKILL.md body, or undefined when absent. */
+function frontmatterBlock(content) {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/)
+  return match === null ? undefined : match[1]
+}
+
 /** Parse a SKILL.md frontmatter block into a key/value map (flat YAML subset). */
 function parseFrontmatter(content) {
-  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/)
-  if (!match) return {}
+  const block = frontmatterBlock(content)
+  if (block === undefined) return {}
   const out = {}
-  for (const line of match[1].split(/\r?\n/)) {
+  for (const line of block.split(/\r?\n/)) {
     const kv = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/)
     if (!kv) continue
     const value = kv[2].trim().replace(/^["']|["']$/g, '')
@@ -68,6 +74,81 @@ function parseFrontmatter(content) {
   return out
 }
 
+/**
+ * Whether the frontmatter carries `key` at all, whatever its value.
+ * `parseFrontmatter` drops empty values, so presence checks that must also
+ * see a bare `key:` line go through here instead.
+ */
+function hasFrontmatterKey(content, key) {
+  const block = frontmatterBlock(content)
+  if (block === undefined) return false
+  return block.split(/\r?\n/).some((line) => {
+    const kv = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/)
+    return kv !== null && kv[1] === key
+  })
+}
+
+/**
+ * Legacy invocation spellings the official `dsh-skill-filesystem` provider
+ * rejects outright (`rejectLegacyInvocationKey`) — a skill carrying one is
+ * dropped from every surface, so the picker must drop it too.
+ */
+const LEGACY_INVOCATION_KEYS = ['disableModelInvocation', 'modelInvocable', 'userInvocable']
+
+/**
+ * Read a frontmatter boolean with the official provider's semantics: YAML
+ * booleans plus the case-insensitive `true`/`false`, `yes`/`no`, `on`/`off`
+ * and `1`/`0` forms. An absent key yields undefined ("surface permitted").
+ */
+function frontmatterBoolean(meta, key) {
+  if (!Object.hasOwn(meta, key)) return undefined
+  const value = meta[key]
+  if (typeof value === 'boolean') return value
+  if (value === 1 || value === '1') return true
+  if (value === 0 || value === '0') return false
+  if (typeof value === 'string') {
+    switch (value.toLowerCase()) {
+      case 'true':
+      case 'yes':
+      case 'on':
+        return true
+      case 'false':
+      case 'no':
+      case 'off':
+        return false
+    }
+  }
+  throw new TypeError(`frontmatter field "${key}" must be a boolean`)
+}
+
+/**
+ * Whether a scanned skill may be offered by the picker, i.e. whether it is
+ * user-invocable. Mirrors `parseInvocationPolicy` in
+ * `@deepseek-ai/dsh-skill-filesystem`: `user-invocable: false` keeps the skill
+ * out of human-facing commands, a rejected spelling or a legacy invocation key
+ * drops it entirely.
+ *
+ * Why this exists (issue #10): the official `skills/list` Remote filters with
+ * `isUserInvocable` before answering, but this host's own fallback scan read
+ * name/description only — so the picker offered skills the official `/` menu
+ * hides, and picking one inserted a `/name` gesture that `dsh-tool-skill` then
+ * refused to load (a silent no-op).
+ *
+ * @param meta - parsed frontmatter map.
+ * @param content - the raw SKILL.md body (legacy keys are detected on it).
+ */
+function isUserInvocableSkill(meta, content) {
+  for (const legacy of LEGACY_INVOCATION_KEYS) {
+    if (hasFrontmatterKey(content, legacy)) return false
+  }
+  try {
+    // Omitted → permitted; only an explicit `false` hides the skill.
+    return frontmatterBoolean(meta, 'user-invocable') !== false
+  } catch {
+    return false
+  }
+}
+
 /** Scan one skill directory into the map; never throws (missing dir is a no-op). */
 async function scanSkillsDirInto(map, dir) {
   let entries
@@ -88,6 +169,13 @@ async function scanSkillsDirInto(map, dir) {
       continue
     }
     const meta = parseFrontmatter(content)
+    // The picker is a human-facing surface, so honour the invocation policy:
+    // `user-invocable: false` (and the legacy spellings the official provider
+    // rejects) must never be offered. The official `skills/list` Remote filters
+    // the same way — without this the fallback route listed skills that the
+    // official `/` menu hides and that the `/name` gesture then refuses to load
+    // (issue #10).
+    if (!isUserInvocableSkill(meta, content)) continue
     // Later writes win, so project-level skills override same-named user skills.
     map.set(meta.name ?? entry.name, {
       name: meta.name ?? entry.name,

package/src/patch-ui-skill.js

@@ -107,10 +107,98 @@ export function dshHome() {
   return process.env.DSH_HOME ?? path.join(os.homedir(), '.dsh')
 }
 
+/** Subpath of the official skill UI inside any installation tree. */
+const UI_SKILL_SUBPATH = ['node_modules', '@deepseek-ai', 'dsh-client-ui-skill', 'lib', 'client.js']
+
+/** Whether a path exists (any type). Never throws. */
+async function pathExists(candidate) {
+  try {
+    await access(candidate)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Where the *running desktop build* keeps its own copy of the official skill UI.
+ *
+ * A packaged DSH Desktop ships that UI in one of two shapes (issue #9):
+ *
+ *   - `resources/app/node_modules/…` — an **unpacked** build. The app is the
+ *     installation-scoped owner, so this file is what gets served, and it is an
+ *     ordinary writable file.
+ *   - `resources/app.asar/dsh/node_modules/…` — a **packed** build. Electron's
+ *     `fs` shim can *read* through the archive but cannot write into it, so this
+ *     path is evidence for diagnosis only and is never a patch target.
+ *
+ * `process.resourcesPath` only exists inside Electron; a plain `dsh` CLI or web
+ * run returns empty lists and nothing changes for it.
+ * @returns {{writable: string[], packed: string[]}} candidate paths.
+ */
+export function desktopUiSkillPaths() {
+  const resources = process.resourcesPath
+  if (typeof resources !== 'string' || resources === '') return { writable: [], packed: [] }
+  return {
+    writable: [path.join(resources, 'app', ...UI_SKILL_SUBPATH)],
+    packed: [path.join(resources, 'app.asar', 'dsh', ...UI_SKILL_SUBPATH)],
+  }
+}
+
+/**
+ * Whether a profile manifest redirects the official skill UI to its own copy.
+ *
+ * This is the switch that decides which copy a desktop build serves: without a
+ * declared dependency the profile resolves the package from the installation
+ * (`resources/app` or `app.asar`), and every profile-local copy is dead weight.
+ * @param profileDir - absolute profile directory.
+ * @returns true when the manifest declares `@deepseek-ai/dsh-client-ui-skill`.
+ */
+async function profileRedirectsUiSkill(profileDir) {
+  try {
+    const manifest = JSON.parse(await readFile(path.join(profileDir, 'package.json'), 'utf8'))
+    const declared = { ...manifest?.dependencies, ...manifest?.devDependencies }
+    return typeof declared['@deepseek-ai/dsh-client-ui-skill'] === 'string'
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Explain why the patch targets found (or not found) may not be what the host
+ * actually serves, for a packed desktop build (issue #9).
+ *
+ * Silence here was the worst part of #9: patching a stale profile copy looks
+ * exactly like success, so the `/` menu kept its official matcher with no
+ * signal at all.
+ * @returns a sentence to append to a warning, or '' when there is nothing to say.
+ */
+async function packedDesktopNote() {
+  const { packed } = desktopUiSkillPaths()
+  if (packed.length === 0 || !(await pathExists(packed[0]))) return ''
+  const profilesDir = path.join(dshHome(), 'profiles')
+  let redirected = false
+  try {
+    for (const entry of await readdir(profilesDir, { withFileTypes: true })) {
+      if (entry.name === 'node_modules') continue
+      if (await profileRedirectsUiSkill(path.join(profilesDir, entry.name))) {
+        redirected = true
+        break
+      }
+    }
+  } catch {
+    /* unreadable profile list: report the pessimistic case */
+  }
+  if (redirected) return ''
+  return ' This desktop build keeps the official skill UI inside `app.asar`, which cannot be written in place,'
+    + ' and no profile redirects the package to a local copy — so the served `/` menu keeps the official matcher.'
+    + ' Install a profile-local override (`"@deepseek-ai/dsh-client-ui-skill": "link:…"`) or run DSH from the CLI.'
+}
+
 /**
  * Enumerate every installed ui-skill `lib/client.js` across all profiles.
  *
- * Three layouts are covered (deduplicated by real path):
+ * Four layouts are covered (deduplicated by real path):
  *   1. the **shared core root** `profiles/node_modules/@deepseek-ai/…` — used by
  *      a global `npm i -g @deepseek-ai/dsh`, where the official package is NOT
  *      below any single profile (issue #7 — missing this made the whole patch
@@ -118,7 +206,11 @@ export function dshHome() {
  *   2. the user's local patched copy (`profiles/<p>/local/dsh-client-ui-skill`)
  *      — that is what a linked profile actually loads;
  *   3. the plain npm install inside a profile
- *      (`profiles/<p>/node_modules/@deepseek-ai/…`).
+ *      (`profiles/<p>/node_modules/@deepseek-ai/…`);
+ *   4. the **running desktop build's own unpacked tree**
+ *      (`resources/app/node_modules/@deepseek-ai/…`) — issue #9: a desktop
+ *      install owns the package at installation scope, so its copy is the one
+ *      served whenever no profile redirects the name.
  *
  * As a defensive extra, each profile is also asked through Node's own resolver
  * (`createRequire().resolve()`), so a layout we did not enumerate still works.
@@ -131,7 +223,9 @@ export async function uiSkillClientPaths() {
   try {
     profiles = await readdir(profilesDir, { withFileTypes: true })
   } catch {
-    return []
+    // A desktop build can still be patchable through its own resource tree
+    // even when $DSH_HOME/profiles is absent or unreadable.
+    profiles = []
   }
   const seen = new Set()
   const found = []
@@ -162,6 +256,10 @@ export async function uiSkillClientPaths() {
   // 1. shared core root (global installs) — see the doc comment above.
   await collect(path.join(profilesDir, 'node_modules', '@deepseek-ai', 'dsh-client-ui-skill', 'lib', 'client.js'))
 
+  // 4. the running desktop build's own unpacked tree (issue #9): this is the
+  //    copy a packaged Electron app serves when no profile redirects the name.
+  for (const candidate of desktopUiSkillPaths().writable) await collect(candidate)
+
   for (const entry of profiles) {
     // `node_modules` is a sibling of the profiles, not a profile itself.
     if (entry.name === 'node_modules') continue
@@ -242,10 +340,17 @@ export async function healUiSkillPatches() {
   // Loud on the empty case. Silence here was the most confusing part of
   // issue #7: "found 0 targets" and "everything already applied" used to print
   // identically, so nobody could tell the patch had never run at all.
+  const note = await packedDesktopNote()
   if (files.length === 0) {
     console.warn('[dsh-skill-picker] ui-skill patch: 0 target client.js found under '
-      + `${path.join(dshHome(), 'profiles')} — fuzzy+pinyin matching will NOT be applied. `
-      + 'See https://github.com/a735624258/dsh-skill-picker/issues/7')
+      + `${path.join(dshHome(), 'profiles')} — fuzzy+pinyin matching will NOT be applied.`
+      + `${note} See https://github.com/a735624258/dsh-skill-picker/issues/9`)
+  } else if (note !== '') {
+    // Targets existed, so the old code stayed silent — but none of them is the
+    // copy the host serves. That is issue #9's silent failure: a "successful"
+    // patch run that changes nothing the user can see.
+    console.warn(`[dsh-skill-picker] ui-skill patch: patched ${files.length} profile copy/copies,`
+      + ` but none of them is the one this host serves.${note}`)
   }
   return { files: filesReport, errors }
 }