From 09472fce3ee228ef910a607ee67910e2cfc4d9af Mon Sep 17 00:00:00 2001
From: zzcr <894103554@qq.com>
Date: Thu, 30 Jul 2026 16:18:29 +0800
Subject: [PATCH 1/5] =?UTF-8?q?feat:=20=E6=96=B0=E5=A2=9E=E5=8A=A8?=
 =?UTF-8?q?=E6=80=81=E6=B7=BB=E5=8A=A0=E7=BC=96=E8=BE=91mcpservers?=
 =?UTF-8?q?=E8=84=9A=E6=9C=AC=E5=8A=9F=E8=83=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/ai-extension/next-wxt.md                 |   77 +-
 packages/next-wxt/components.d.ts             |   25 +-
 packages/next-wxt/entrypoints/background.ts   |   44 +-
 .../background/inject-user-mcp-scripts.ts     |  132 ++
 packages/next-wxt/entrypoints/content.ts      |   38 +-
 .../next-wxt/entrypoints/options/Options.vue  |   11 +-
 .../entrypoints/options/UserMcpScriptsTab.vue | 1068 +++++++++++++++++
 packages/next-wxt/mcp-servers/types.d.ts      |    7 +
 packages/next-wxt/package.json                |    3 +
 .../next-wxt/public/vendor/user-mcp-exec.js   |   24 +
 .../REQ-20260730-user-mcp-scripts/design.md   |   86 ++
 .../requirements.md                           |   72 ++
 .../REQ-20260730-user-mcp-scripts/tasks.md    |   43 +
 .../user-mcp-scripts/csp-bridge-repro.test.ts |   29 +
 .../test/user-mcp-scripts/match.test.ts       |   58 +
 .../test/user-mcp-scripts/resolve.test.ts     |   90 ++
 .../test/user-mcp-scripts/storage.test.ts     |   79 ++
 .../next-wxt/user-mcp-scripts/exec-bridge.ts  |   19 +
 packages/next-wxt/user-mcp-scripts/index.ts   |   22 +
 packages/next-wxt/user-mcp-scripts/match.ts   |  135 +++
 packages/next-wxt/user-mcp-scripts/resolve.ts |   25 +
 packages/next-wxt/user-mcp-scripts/storage.ts |  165 +++
 .../next-wxt/user-mcp-scripts/template.ts     |   62 +
 packages/next-wxt/user-mcp-scripts/types.ts   |   26 +
 packages/next-wxt/vitest.config.ts            |   16 +
 packages/next-wxt/wxt.config.ts               |    8 +-
 26 files changed, 2326 insertions(+), 38 deletions(-)
 create mode 100644 packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
 create mode 100644 packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
 create mode 100644 packages/next-wxt/public/vendor/user-mcp-exec.js
 create mode 100644 packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
 create mode 100644 packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
 create mode 100644 packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
 create mode 100644 packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
 create mode 100644 packages/next-wxt/test/user-mcp-scripts/match.test.ts
 create mode 100644 packages/next-wxt/test/user-mcp-scripts/resolve.test.ts
 create mode 100644 packages/next-wxt/test/user-mcp-scripts/storage.test.ts
 create mode 100644 packages/next-wxt/user-mcp-scripts/exec-bridge.ts
 create mode 100644 packages/next-wxt/user-mcp-scripts/index.ts
 create mode 100644 packages/next-wxt/user-mcp-scripts/match.ts
 create mode 100644 packages/next-wxt/user-mcp-scripts/resolve.ts
 create mode 100644 packages/next-wxt/user-mcp-scripts/storage.ts
 create mode 100644 packages/next-wxt/user-mcp-scripts/template.ts
 create mode 100644 packages/next-wxt/user-mcp-scripts/types.ts
 create mode 100644 packages/next-wxt/vitest.config.ts

diff --git a/docs/ai-extension/next-wxt.md b/docs/ai-extension/next-wxt.md
index d4aa5483..07d42d71 100644
--- a/docs/ai-extension/next-wxt.md
+++ b/docs/ai-extension/next-wxt.md
@@ -4,7 +4,49 @@
 
 通过原生 `document.modelContext.registerTool` API，开发者可以极低成本地将前端页面的业务能力暴露给 AI 助手，实现"大模型直接操作业务后台"。
 
-## 一、工作原理
+有两条互补路径：
+
+| 路径 | 适用 | 说明 |
+|---|---|---|
+| **页面 MCP 脚本（推荐推广）** | 终端用户 / 快速适配新站 | Options →「页面 MCP 脚本」在线编辑，按 `@match` 匹配站点，保存后即时注入 |
+| **源码内置 mcp-servers** | 扩展维护者 / 随包分发 | 在 `packages/next-wxt/mcp-servers/<hostname>/` 编写 TS，构建期打成 IIFE |
+
+二者并行：默认同时生效；用户脚本勾选「覆盖内置」且匹配当前页时，跳过该页内置域名脚本。
+
+## 〇、页面 MCP 脚本（在线编辑）
+
+1. 打开扩展 Options（配置页）→ **页面 MCP 脚本**。
+2. 点击「新建脚本」，填写：
+   - **名称 / 描述**
+   - **@match**：每行一条，例如 `*://*.example.com/*`、`https://www.baidu.com/*`
+   - **源码**：纯 JS，在页面 MAIN world 调用 `document.modelContext.registerTool`
+   - **启用** / **覆盖内置**（可选）
+3. 保存后，匹配的标签页会自动刷新并注入脚本；工具出现在侧栏「浏览器内置工具」中。
+4. 支持 JSON 导入/导出备份。
+
+默认模板已包含幂等防护。示例片段：
+
+```javascript
+;(function () {
+  if (window.__userMcp_demo_registered) return
+  var ctx = document.modelContext
+  if (!ctx) return
+  ctx.registerTool({
+    name: 'demo_tool',
+    title: '示例',
+    description: '示例工具',
+    inputSchema: { type: 'object', properties: {} },
+    execute: async function () {
+      return { content: [{ type: 'text', text: document.title }] }
+    }
+  })
+  window.__userMcp_demo_registered = true
+})()
+```
+
+实现位于独立模块 `packages/next-wxt/user-mcp-scripts/`，与 Skills、远程 MCP 市场解耦。
+
+## 一、工作原理（源码内置）
 
 开发一个网站原生工具，整体流程是这样的：
 
@@ -16,7 +58,7 @@
 
 ![工具注入流程](../assets/images/mermaid/next-wxt-workflow.svg)
 
-## 二、开发步骤
+## 二、开发步骤（源码内置 mcp-servers）
 
 ### 1. 创建域名目录
 
@@ -32,8 +74,8 @@
 // packages/next-wxt/mcp-servers/example.com/index.ts
 
 /**
- * 此文件由 content script 通过 scripting.executeScript 注入到 example.com 的 JS 上下文中执行。
- * 拥有完整的页面执行权限，不受 CSP 限制。
+ * 此文件由 content script 经 <script src> 注入到 example.com 的 MAIN world。
+ * 拥有完整的页面执行权限。
  */
 
 if ((document as any).modelContext) {
@@ -69,35 +111,30 @@ if ((document as any).modelContext) {
 
 ### 3. 配置扩展元数据 (`meta.ts`)
 
-如果你需要定义此工具的辅助信息（如将其内置加入"插件市场"），可以在同目录下新建 `meta.ts`。
+域名注入门禁依赖同目录 `meta.ts`（文件夹名须与 `location.hostname` 完全一致）。可选字段示例：
 
 ```typescript
 // packages/next-wxt/mcp-servers/example.com/meta.ts
 export default {
-  // 如果你有专属的外部云端 Agent 或服务端 MCP，可以通过以下配置聚合到市场面板中
-  customMarketMcpServers: [
-    {
-      id: 'example-cloud-mcp',
-      name: 'Example 专属云端能力',
-      url: 'https://api.example.com/mcp/sse',
-      type: 'sse',
-      enabled: true
-    }
-  ]
+  name: 'example.com',
+  description: '示例站点专属工具'
 };
 ```
 
-> **说明**：复杂的 `toolsJumpLinks` 或多页流程代理编排已不再推荐，建议将复杂流程直接下发到对应页面的单一 WebMCP 脚本中解决。
+> **说明**：复杂的 `toolsJumpLinks` 或多页流程代理编排已不再推荐，建议将复杂流程直接下发到对应页面的单一 WebMCP 脚本中解决。远程 SSE 市场条目（`customMarketMcpServers`）与本页注入工具无关。
 
 ## 三、调试与验证
 
 1. 在项目根目录运行 `pnpm dev:wxt`。
-2. 打开浏览器并刷新目标页面（`example.com`）。
-3. 页面加载完成后打开控制台，或连接远程 Cursor Agent。由于发送了 `notifications/tools/list_changed`，你将立刻看到新注册的 `claim-coupon` 工具。
-4. 尝试向 Agent 发送对话："帮我抢一张 50 元的优惠券"，观察 Agent 调用情况与页面状态变更。
+2. **用户脚本**：Options 保存后刷新匹配页；**内置脚本**：改源码后由构建插件重新产出并刷新目标页。
+3. 页面加载完成后打开控制台，或连接远程 Cursor Agent。由于发送了 `notifications/tools/list_changed`，你将立刻看到新注册的工具。
+4. 尝试向 Agent 发送对话，观察工具调用与页面状态变更。
 
 ## 四、最佳实践与注意事项
 
-1. **优先直接调用业务逻辑**：如果页面基于 React/Vue，你可以在 `index.ts` 中通过 Fiber 树搜索，或在业务代码中显式挂载 `window.__MyApp` 供扩展调用，避免使用脆弱的 `document.querySelector().click()` 模拟点击。
+1. **优先直接调用业务逻辑**：如果页面基于 React/Vue，你可以在脚本中通过 Fiber 树搜索，或在业务代码中显式挂载 `window.__MyApp` 供扩展调用，避免使用脆弱的 `document.querySelector().click()` 模拟点击。
 2. **做好错误处理**：`execute` 函数中必须捕获所有可能抛出的错误，并转换为合法的 `content` 返回给模型，否则会导致模型调用链中断。
 3. **参数描述要清晰**：`description` 与 `inputSchema` 是大模型判断是否使用工具以及如何传参的**唯一依据**，务必描述详尽。
+4. **宽泛 @match + 覆盖内置**：例如 `*://*/*` 且开启「覆盖内置」会跳过所有内置域名工具，请谨慎使用。
+5. **幂等注册**：重复注入时应用全局标记或同名覆盖策略，避免重复注册异常。
+6. **严格 CSP 站点**（如京东）：用户脚本经扩展桥 `vendor/user-mcp-exec.js` 执行，勿依赖页面内 `eval`；保存后请刷新目标页再查看「浏览器内置工具」。
diff --git a/packages/next-wxt/components.d.ts b/packages/next-wxt/components.d.ts
index d7ee1622..ca191ffe 100644
--- a/packages/next-wxt/components.d.ts
+++ b/packages/next-wxt/components.d.ts
@@ -9,16 +9,21 @@ declare module 'vue' {
   export interface GlobalComponents {
     RouterLink: typeof import('vue-router')['RouterLink']
     RouterView: typeof import('vue-router')['RouterView']
-    TinyButton: (typeof import('@opentiny/vue-button'))['default']
-    TinyFormItem: (typeof import('@opentiny/vue-form-item'))['default']
-    TinyInput: (typeof import('@opentiny/vue-input'))['default']
-    TinyModal: (typeof import('@opentiny/vue-modal'))['default']
-    TinyRadio: (typeof import('@opentiny/vue-radio'))['default']
-    TinySelect: (typeof import('@opentiny/vue-select'))['default']
-    TinySwitch: (typeof import('@opentiny/vue-switch'))['default']
-    TinyTabItem: (typeof import('@opentiny/vue-tab-item'))['default']
-    TinyTabs: (typeof import('@opentiny/vue-tabs'))['default']
-    TinyTree: (typeof import('@opentiny/vue-tree'))['default']
+    TinyAlert: typeof import('@opentiny/vue-alert')['default']
+    TinyButton: typeof import('@opentiny/vue-button')['default']
+    TinyCollapse: typeof import('@opentiny/vue-collapse')['default']
+    TinyCollapseItem: typeof import('@opentiny/vue-collapse-item')['default']
+    TinyFormItem: typeof import('@opentiny/vue-form-item')['default']
+    TinyInput: typeof import('@opentiny/vue-input')['default']
+    TinyModal: typeof import('@opentiny/vue-modal')['default']
+    TinyRadio: typeof import('@opentiny/vue-radio')['default']
+    TinySelect: typeof import('@opentiny/vue-select')['default']
+    TinySwitch: typeof import('@opentiny/vue-switch')['default']
+    TinyTabItem: typeof import('@opentiny/vue-tab-item')['default']
+    TinyTabs: typeof import('@opentiny/vue-tabs')['default']
+    TinyTag: typeof import('@opentiny/vue-tag')['default']
+    TinyTooltip: typeof import('@opentiny/vue-tooltip')['default']
+    TinyTree: typeof import('@opentiny/vue-tree')['default']
     VanIcon: typeof import('vant/es')['Icon']
   }
 }
diff --git a/packages/next-wxt/entrypoints/background.ts b/packages/next-wxt/entrypoints/background.ts
index fc612398..97a313ea 100644
--- a/packages/next-wxt/entrypoints/background.ts
+++ b/packages/next-wxt/entrypoints/background.ts
@@ -1,5 +1,10 @@
 import { useWebAgentServer, forceWebAgentReconnect } from './sidepanel/composable/useWebAgentServer'
 import { tabHistory } from './background/tab-history'
+import {
+  injectUserMcpScriptsForTab,
+  reloadTabsByMatchesSnapshot,
+  reinjectAfterUserMcpScriptsChange
+} from './background/inject-user-mcp-scripts'
 
 export default defineBackground(() => {
   // ─────────────────────────────────────────
@@ -18,7 +23,7 @@ export default defineBackground(() => {
   // ─────────────────────────────────────────
   // 消息处理（需要返回值的使用原生 onMessage）
   // ─────────────────────────────────────────
-  browser.runtime.onMessage.addListener((message, _sender, sendResponse) => {
+  browser.runtime.onMessage.addListener((message, sender, sendResponse) => {
     // Web Agent 手动重连
     // 注意：不依赖 initPromise，因为它可能已经 rejected（初始连接失败时），
     // rejected 的 Promise 状态永久不变，会导致重连请求直接走 catch 分支而不实际发起连接。
@@ -42,6 +47,43 @@ export default defineBackground(() => {
         .catch(() => sendResponse({ sessionId: '', status: 'error' }))
       return true
     }
+
+    // content：注入匹配的用户 MCP 脚本，并返回是否跳过内置 mcp-servers
+    if (message.type === 'inject-user-mcp-scripts') {
+      const tabId = message.tabId ?? sender.tab?.id
+      const url = message.url || sender.tab?.url
+      if (!tabId || !url) {
+        sendResponse({
+          success: false,
+          shouldSkipBuiltIn: false,
+          injectedCount: 0,
+          error: '缺少 tabId 或 url'
+        })
+        return true
+      }
+      injectUserMcpScriptsForTab(tabId, url)
+        .then((result) => sendResponse(result))
+        .catch((error) =>
+          sendResponse({
+            success: false,
+            shouldSkipBuiltIn: false,
+            injectedCount: 0,
+            error: error?.message || String(error)
+          })
+        )
+      return true
+    }
+
+    // Options：保存/删除后刷新匹配标签页
+    if (message.type === 'reinject-user-mcp-scripts') {
+      const run = message.matchesSnapshot
+        ? reloadTabsByMatchesSnapshot(message.matchesSnapshot)
+        : reinjectAfterUserMcpScriptsChange(message.scriptId)
+      run
+        .then((reloaded) => sendResponse({ success: true, reloaded }))
+        .catch((error) => sendResponse({ success: false, error: error?.message || String(error) }))
+      return true
+    }
   })
 
   // ─────────────────────────────────────────
diff --git a/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts b/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
new file mode 100644
index 00000000..5ad3fc58
--- /dev/null
+++ b/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
@@ -0,0 +1,132 @@
+/**
+ * Background 侧：将用户 MCP 脚本注入目标 tab 的 MAIN world
+ * 业务匹配逻辑全部来自 user-mcp-scripts，本文件仅做 chrome.scripting 适配
+ *
+ * 注意：不可在 executeScript 回调内直接 new Function(源码)——会受页面 CSP 拦截
+ * （复现：京东等站只剩 page-agent-tool）。须调用 chrome-extension 桥。
+ */
+
+import {
+  getUserMcpScriptsStore,
+  resolveMatchingScripts,
+  shouldSkipBuiltIn,
+  matchAny,
+  USER_MCP_EXEC_BRIDGE_NAME,
+  type UserMcpScript,
+  type BridgeExecResult
+} from '@/user-mcp-scripts'
+
+export type InjectUserMcpResult = {
+  success: boolean
+  shouldSkipBuiltIn: boolean
+  injectedCount: number
+  error?: string
+}
+
+/**
+ * 通过扩展脚本桥在 MAIN world 执行用户源码（绕过页面 CSP 对 eval 的限制）
+ */
+async function executeUserSourceInMainWorld(tabId: number, source: string): Promise<BridgeExecResult> {
+  const bridgeName = USER_MCP_EXEC_BRIDGE_NAME
+  const results = await browser.scripting.executeScript({
+    target: { tabId },
+    world: 'MAIN',
+    args: [source, bridgeName],
+    func: (code: string, name: string) => {
+      const run = (window as any)[name]
+      if (typeof run !== 'function') {
+        console.warn('[user-mcp-scripts] 执行桥未就绪:', name)
+        return { ok: false, error: 'bridge missing: ' + name }
+      }
+      return run(code)
+    }
+  })
+  const value = results?.[0]?.result as BridgeExecResult | undefined
+  if (!value) return { ok: false, error: 'empty executeScript result' }
+  return value
+}
+
+/**
+ * 按 URL 解析并注入匹配的启用脚本
+ */
+export async function injectUserMcpScriptsForTab(
+  tabId: number,
+  url: string
+): Promise<InjectUserMcpResult> {
+  try {
+    const store = await getUserMcpScriptsStore()
+    const skip = shouldSkipBuiltIn(store, url)
+    const scripts = resolveMatchingScripts(store, url)
+    let injectedCount = 0
+    const errors: string[] = []
+    for (const script of scripts) {
+      const result = await executeUserSourceInMainWorld(tabId, script.source)
+      if (result.ok) {
+        injectedCount++
+      } else {
+        errors.push(`${script.name}: ${result.error}`)
+        console.warn(`[user-mcp-scripts] 脚本「${script.name}」执行失败:`, result.error)
+      }
+    }
+    return {
+      success: errors.length === 0,
+      shouldSkipBuiltIn: skip,
+      injectedCount,
+      error: errors.length ? errors.join('; ') : undefined
+    }
+  } catch (error: any) {
+    console.warn('[user-mcp-scripts] 注入失败:', error)
+    return {
+      success: false,
+      shouldSkipBuiltIn: false,
+      injectedCount: 0,
+      error: error?.message || String(error)
+    }
+  }
+}
+
+/**
+ * 按 matches 列表刷新匹配的 http(s) 标签页（删除脚本时由 Options 传入快照）
+ */
+export async function reloadTabsByMatchesSnapshot(matchesList: string[][]): Promise<number> {
+  const flatPatterns = matchesList.flat().filter(Boolean)
+  if (!flatPatterns.length) return 0
+  const tabs = await browser.tabs.query({})
+  let count = 0
+  for (const tab of tabs) {
+    if (!tab.id || !tab.url) continue
+    if (!/^https?:/i.test(tab.url)) continue
+    if (!matchAny(flatPatterns, tab.url)) continue
+    try {
+      await browser.tabs.reload(tab.id)
+      count++
+    } catch {
+      // 忽略无法刷新的 tab
+    }
+  }
+  return count
+}
+
+async function reloadTabsByMatchList(scripts: UserMcpScript[]): Promise<number> {
+  return reloadTabsByMatchesSnapshot(scripts.map((s) => s.matches || []))
+}
+
+/**
+ * 保存后：对匹配指定脚本的 http(s) 标签页重新加载，确保工具列表干净
+ */
+export async function reloadTabsMatchingScripts(scripts: UserMcpScript[]): Promise<number> {
+  return reloadTabsByMatchList(scripts)
+}
+
+/**
+ * Options 保存后：按 scriptId 刷新匹配页（脚本仍在 store 中）
+ */
+export async function reinjectAfterUserMcpScriptsChange(scriptId?: string): Promise<number> {
+  const store = await getUserMcpScriptsStore()
+  if (scriptId) {
+    const one = store[scriptId]
+    if (!one) return 0
+    return reloadTabsMatchingScripts([one])
+  }
+  return reloadTabsMatchingScripts(Object.values(store))
+}
diff --git a/packages/next-wxt/entrypoints/content.ts b/packages/next-wxt/entrypoints/content.ts
index fb5b0ee5..4442dc39 100644
--- a/packages/next-wxt/entrypoints/content.ts
+++ b/packages/next-wxt/entrypoints/content.ts
@@ -29,13 +29,16 @@ export default defineContentScript({
     //    页面操作已由 MAIN world 的 registerPageAgentTool（内置 WebMCP）承担
     initContentReadyPing()
 
-    // 4. 注入 vendor/runtime.js + 注册 page-agent-tool；再注入域名专属工具
+    // 4. 注入 vendor/runtime.js + 注册 page-agent-tool
+    //    → 用户 MCP 脚本（background MAIN）→（可选）内置 mcp-servers
     //    全部完成后再发一次 page-tools-injected，避免侧边栏过早同步拿到不完整工具列表
     await injectRuntimeAndRegister()
 
+    const skipBuiltIn = await requestInjectUserMcpScripts(tabId)
+
     const hostname = window.location.hostname
     const meta = getMcpMetaInfo(hostname)
-    if (meta) {
+    if (meta && !skipBuiltIn) {
       await injectMcpServerTools(hostname)
     }
 
@@ -81,8 +84,8 @@ function injectScript(path: string): Promise<void> {
 }
 
 /**
- * 注入 vendor/runtime.js，再注入 register-page-agent-tool.js 完成注册。
- * 二者都走 <script src="chrome-extension://...">，与百度等严格 CSP 页面兼容。
+ * 注入 vendor/runtime.js，再注入 register-page-agent-tool.js 与用户脚本执行桥。
+ * 全部走 <script src="chrome-extension://...">，与百度/京东等严格 CSP 页面兼容。
  * 注意：勿在 content script 调用 browser.scripting（该 API 仅 background/扩展页可用）。
  */
 let runtimeInjected: Promise<void> | null = null
@@ -91,11 +94,38 @@ async function injectRuntimeAndRegister(): Promise<void> {
     runtimeInjected = (async () => {
       await injectScript('vendor/runtime.js')
       await injectScript('vendor/register-page-agent-tool.js')
+      // 用户 MCP 脚本执行桥：须在 scripting.executeScript 调用前就绪
+      await injectScript('vendor/user-mcp-exec.js')
     })()
   }
   await runtimeInjected
 }
 
+/**
+ * 请求 background 注入匹配当前 URL 的用户 MCP 脚本。
+ * 返回是否应跳过内置 mcp-servers（replacesBuiltIn）。
+ * 匹配/存储逻辑在 user-mcp-scripts；content 只做薄钩子。
+ */
+async function requestInjectUserMcpScripts(tabId: number): Promise<boolean> {
+  try {
+    const res = await browser.runtime.sendMessage({
+      type: 'inject-user-mcp-scripts',
+      tabId,
+      url: location.href
+    })
+    if (res?.injectedCount > 0) {
+      console.log(`[next-wxt] 已注入 ${res.injectedCount} 条用户 MCP 脚本`)
+    }
+    if (res?.error) {
+      console.warn('[next-wxt] 用户 MCP 脚本执行异常:', res.error)
+    }
+    return Boolean(res?.shouldSkipBuiltIn)
+  } catch (error) {
+    console.warn('[next-wxt] 请求注入用户 MCP 脚本失败:', error)
+    return false
+  }
+}
+
 /**
  * 为有 mcp-servers 配置的域名额外注入 WebMCP 专属工具脚本（MAIN world）。
  * vendor/runtime.js 已由 injectRuntimeAndRegister 注入，此函数只追加域名工具。
diff --git a/packages/next-wxt/entrypoints/options/Options.vue b/packages/next-wxt/entrypoints/options/Options.vue
index 53b551bf..d054d7c7 100644
--- a/packages/next-wxt/entrypoints/options/Options.vue
+++ b/packages/next-wxt/entrypoints/options/Options.vue
@@ -1,12 +1,13 @@
 <script setup lang="ts">
 /**
- * Options 配置页：Skills 管理 + Token 生成
+ * Options 配置页：Skills / 页面 MCP 脚本 / Token / 模型配置
  * 使用 TinyVue Tabs 分标签展示，风格与 TinyVue 保持一致
  */
 import { ref } from 'vue'
 import SkillsTab from './SkillsTab.vue'
 import TokenTab from './TokenTab.vue'
 import ModelConfigTab from './ModelConfigTab.vue'
+import UserMcpScriptsTab from './UserMcpScriptsTab.vue'
 
 // 当前激活的标签
 const activeTab = ref('skills')
@@ -25,6 +26,9 @@ const isInnerMode = import.meta.env.VITE_MODEL_CONFIG === 'inner'
       <TinyTabItem name="skills" title="Skills 管理">
         <SkillsTab />
       </TinyTabItem>
+      <TinyTabItem name="user-mcp-scripts" title="页面 MCP 脚本">
+        <UserMcpScriptsTab />
+      </TinyTabItem>
       <TinyTabItem v-if="isInnerMode" name="token" title="Token 生成">
         <TokenTab />
       </TinyTabItem>
@@ -63,6 +67,11 @@ const isInnerMode = import.meta.env.VITE_MODEL_CONFIG === 'inner'
   margin-top: 16px;
 }
 
+/* 页面 MCP 脚本需要更高编辑区，减少底部留白 */
+.options-tabs :deep(.tiny-tabs__content) {
+  overflow: visible;
+}
+
 @media (max-width: 768px) {
   .options-container {
     padding: 16px;
diff --git a/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue b/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
new file mode 100644
index 00000000..3efad48c
--- /dev/null
+++ b/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
@@ -0,0 +1,1068 @@
+<script setup lang="ts">
+/**
+ * 页面 MCP 脚本管理（列表 + 大编辑器，TinyVue）
+ */
+import { ref, reactive, onMounted, computed, watch, nextTick } from 'vue'
+import { TinyForm, Message } from '@opentiny/vue'
+import {
+  iconDel,
+  iconAdd,
+  iconDownload,
+  iconUpload,
+  iconSave,
+  iconClose,
+  iconCode,
+  iconFile,
+  iconChevronUp,
+  iconChevronDown,
+  iconHelp
+} from '@opentiny/vue-icon'
+import {
+  listUserMcpScripts,
+  upsertUserMcpScript,
+  removeUserMcpScript,
+  setUserMcpScriptEnabled,
+  exportUserMcpScriptsJson,
+  importUserMcpScriptsJson,
+  validateMatchPatterns,
+  createDefaultScriptMeta,
+  type UserMcpScript
+} from '@/user-mcp-scripts'
+
+const IconDelComp = iconDel()
+const IconAddComp = iconAdd()
+const IconDownloadComp = iconDownload()
+const IconUploadComp = iconUpload()
+const IconSaveComp = iconSave()
+const IconCloseComp = iconClose()
+const IconCodeComp = iconCode()
+const IconFileComp = iconFile()
+const IconChevronUpComp = iconChevronUp()
+const IconChevronDownComp = iconChevronDown()
+const IconHelpComp = iconHelp()
+
+const scripts = ref<UserMcpScript[]>([])
+const loading = ref(false)
+const saving = ref(false)
+
+/** null = 未打开；'__new__' = 新建未落盘；否则为脚本 id */
+const selectedKey = ref<string | null>(null)
+const isDirty = ref(false)
+const collapseNames = ref<string[]>(['meta'])
+const sourceEditorRef = ref<HTMLTextAreaElement | null>(null)
+
+const editForm = reactive({
+  name: '',
+  description: '',
+  matchesText: '',
+  enabled: true,
+  replacesBuiltIn: false,
+  source: ''
+})
+
+const editFormRef = ref<{ validate: () => Promise<boolean>; clearValidate?: () => void } | null>(null)
+const editRules = {
+  name: [{ required: true, message: '请输入名称', trigger: 'blur' }],
+  matchesText: [{ required: true, message: '请输入至少一条 @match', trigger: 'blur' }],
+  source: [{ required: true, message: '脚本源码不能为空', trigger: 'blur' }]
+}
+
+const deleteVisible = ref(false)
+const discardVisible = ref(false)
+const pendingSelectKey = ref<string | null>(null)
+
+const importInputRef = ref<HTMLInputElement | null>(null)
+
+const isEditing = computed(() => selectedKey.value !== null)
+const isNewDraft = computed(() => selectedKey.value === '__new__')
+const metaExpanded = computed(() => collapseNames.value.includes('meta'))
+const editorTitle = computed(() => {
+  if (!isEditing.value) return ''
+  if (isNewDraft.value) return editForm.name || '未命名脚本'
+  return editForm.name || '编辑脚本'
+})
+
+const selectedScript = computed(() => {
+  if (!selectedKey.value || selectedKey.value === '__new__') return null
+  return scripts.value.find((s) => s.id === selectedKey.value) ?? null
+})
+
+const sourceLineCount = computed(() => {
+  const text = editForm.source || ''
+  return text.length === 0 ? 1 : text.split('\n').length
+})
+
+const lineNumbers = computed(() => {
+  const n = sourceLineCount.value
+  const lines: number[] = []
+  for (let i = 1; i <= n; i++) lines.push(i)
+  return lines
+})
+
+watch(
+  () => ({ ...editForm }),
+  () => {
+    if (isEditing.value) isDirty.value = true
+  },
+  { deep: true }
+)
+
+async function loadScripts() {
+  loading.value = true
+  try {
+    scripts.value = await listUserMcpScripts()
+  } catch (e) {
+    console.error(e)
+    Message.message({ message: '加载脚本失败', status: 'error' })
+  } finally {
+    loading.value = false
+  }
+}
+
+function parseMatchesText(text: string): string[] {
+  return text
+    .split(/[\n,]+/)
+    .map((s) => s.trim())
+    .filter(Boolean)
+}
+
+async function notifyReinject(opts: { scriptId?: string; matchesSnapshot?: string[][] }) {
+  try {
+    await browser.runtime.sendMessage({
+      type: 'reinject-user-mcp-scripts',
+      scriptId: opts.scriptId,
+      matchesSnapshot: opts.matchesSnapshot
+    })
+  } catch (e) {
+    console.warn('[user-mcp-scripts] reinject 通知失败', e)
+  }
+}
+
+function fillFormFromMeta(meta: {
+  name: string
+  description: string
+  matches: string[]
+  enabled: boolean
+  replacesBuiltIn: boolean
+  source: string
+}) {
+  editForm.name = meta.name
+  editForm.description = meta.description
+  editForm.matchesText = meta.matches.join('\n')
+  editForm.enabled = meta.enabled
+  editForm.replacesBuiltIn = meta.replacesBuiltIn
+  editForm.source = meta.source
+}
+
+function fillFormFromScript(row: UserMcpScript) {
+  editForm.name = row.name
+  editForm.description = row.description || ''
+  editForm.matchesText = row.matches.join('\n')
+  editForm.enabled = row.enabled
+  editForm.replacesBuiltIn = row.replacesBuiltIn
+  editForm.source = row.source
+}
+
+function focusEditor() {
+  nextTick(() => {
+    sourceEditorRef.value?.focus()
+  })
+}
+
+function openCreate() {
+  trySelect('__new__', () => {
+    selectedKey.value = '__new__'
+    const meta = createDefaultScriptMeta({ name: '我的页面工具', matches: ['*://example.com/*'] })
+    fillFormFromMeta(meta)
+    collapseNames.value = ['meta']
+    nextTick(() => {
+      isDirty.value = false
+      editFormRef.value?.clearValidate?.()
+      focusEditor()
+    })
+  })
+}
+
+function selectScript(id: string) {
+  if (selectedKey.value === id) return
+  trySelect(id, () => {
+    const row = scripts.value.find((s) => s.id === id)
+    if (!row) return
+    selectedKey.value = id
+    fillFormFromScript(row)
+    collapseNames.value = ['meta']
+    nextTick(() => {
+      isDirty.value = false
+      editFormRef.value?.clearValidate?.()
+      focusEditor()
+    })
+  })
+}
+
+function trySelect(nextKey: string, apply: () => void) {
+  if (isDirty.value && isEditing.value) {
+    pendingSelectKey.value = nextKey
+    discardVisible.value = true
+    return
+  }
+  apply()
+}
+
+function confirmDiscard() {
+  discardVisible.value = false
+  const key = pendingSelectKey.value
+  pendingSelectKey.value = null
+  isDirty.value = false
+  if (key === '__new__') {
+    openCreateForced()
+  } else if (key === null) {
+    selectedKey.value = null
+  } else if (key) {
+    const row = scripts.value.find((s) => s.id === key)
+    if (!row) return
+    selectedKey.value = key
+    fillFormFromScript(row)
+    nextTick(() => {
+      isDirty.value = false
+      focusEditor()
+    })
+  }
+}
+
+function openCreateForced() {
+  selectedKey.value = '__new__'
+  const meta = createDefaultScriptMeta({ name: '我的页面工具', matches: ['*://example.com/*'] })
+  fillFormFromMeta(meta)
+  collapseNames.value = ['meta']
+  nextTick(() => {
+    isDirty.value = false
+    focusEditor()
+  })
+}
+
+function closeEditor() {
+  if (isDirty.value) {
+    pendingSelectKey.value = null
+    discardVisible.value = true
+    return
+  }
+  selectedKey.value = null
+  isDirty.value = false
+}
+
+function cancelDiscard() {
+  discardVisible.value = false
+  pendingSelectKey.value = null
+}
+
+function toggleMeta() {
+  collapseNames.value = metaExpanded.value ? [] : ['meta']
+}
+
+async function saveEdit() {
+  const ok = await editFormRef.value?.validate().catch(() => false)
+  if (!ok) {
+    collapseNames.value = ['meta']
+    return
+  }
+
+  const name = editForm.name.trim()
+  const matches = parseMatchesText(editForm.matchesText)
+  const matchCheck = validateMatchPatterns(matches)
+  if (!matchCheck.ok) {
+    Message.message({ message: matchCheck.error, status: 'warning' })
+    collapseNames.value = ['meta']
+    return
+  }
+  if (!(editForm.source || '').trim()) {
+    Message.message({ message: '脚本源码不能为空', status: 'warning' })
+    return
+  }
+
+  saving.value = true
+  try {
+    const result = await upsertUserMcpScript({
+      id: isNewDraft.value ? undefined : selectedKey.value || undefined,
+      name,
+      description: editForm.description.trim(),
+      matches,
+      enabled: editForm.enabled,
+      replacesBuiltIn: editForm.replacesBuiltIn,
+      source: editForm.source
+    })
+    if (!result.ok) {
+      Message.message({ message: result.error, status: 'error' })
+      return
+    }
+    isDirty.value = false
+    Message.message({ message: '已保存，正在刷新匹配页面…', status: 'success' })
+    await loadScripts()
+    selectedKey.value = result.script.id
+    fillFormFromScript(result.script)
+    nextTick(() => {
+      isDirty.value = false
+    })
+    await notifyReinject({ scriptId: result.script.id })
+  } finally {
+    saving.value = false
+  }
+}
+
+async function toggleEnabled(row: UserMcpScript, enabled: boolean) {
+  const result = await setUserMcpScriptEnabled(row.id, enabled)
+  if (!result.ok) {
+    Message.message({ message: result.error, status: 'error' })
+    await loadScripts()
+    return
+  }
+  await loadScripts()
+  if (selectedKey.value === row.id) {
+    editForm.enabled = enabled
+    nextTick(() => {
+      isDirty.value = false
+    })
+  }
+  await notifyReinject({ scriptId: row.id })
+}
+
+function confirmDelete() {
+  if (isNewDraft.value) {
+    selectedKey.value = null
+    isDirty.value = false
+    return
+  }
+  if (!selectedScript.value) return
+  deleteVisible.value = true
+}
+
+async function doDelete() {
+  const row = selectedScript.value
+  if (!row) return
+  const snap = [row.matches]
+  await removeUserMcpScript(row.id)
+  deleteVisible.value = false
+  selectedKey.value = null
+  isDirty.value = false
+  Message.message({ message: '已删除', status: 'success' })
+  await loadScripts()
+  await notifyReinject({ matchesSnapshot: snap })
+}
+
+async function downloadBackup() {
+  if (!scripts.value.length) {
+    Message.message({ message: '暂无脚本可导出', status: 'warning' })
+    return
+  }
+  const json = exportUserMcpScriptsJson(scripts.value)
+  const blob = new Blob([json], { type: 'application/json' })
+  const url = URL.createObjectURL(blob)
+  const a = document.createElement('a')
+  a.href = url
+  a.download = `user-mcp-scripts-${new Date().toISOString().slice(0, 10)}.json`
+  a.click()
+  URL.revokeObjectURL(url)
+}
+
+function triggerImport() {
+  importInputRef.value?.click()
+}
+
+async function handleImportFile(event: Event) {
+  const input = event.target as HTMLInputElement
+  const file = input.files?.[0]
+  input.value = ''
+  if (!file) return
+  if (!file.name.toLowerCase().endsWith('.json')) {
+    Message.message({ message: '请选择 .json 备份文件', status: 'warning' })
+    return
+  }
+  try {
+    const text = await file.text()
+    const result = await importUserMcpScriptsJson(text)
+    if (!result.ok) {
+      Message.message({ message: result.error, status: 'error' })
+      return
+    }
+    Message.message({ message: `已导入 ${result.imported} 条脚本`, status: 'success' })
+    await loadScripts()
+    await notifyReinject({})
+  } catch (e: any) {
+    Message.message({ message: e?.message || '导入失败', status: 'error' })
+  }
+}
+
+function onSourceKeydown(e: KeyboardEvent) {
+  if ((e.ctrlKey || e.metaKey) && e.key === 's') {
+    e.preventDefault()
+    void saveEdit()
+    return
+  }
+  if (e.key === 'Tab') {
+    e.preventDefault()
+    const el = sourceEditorRef.value
+    if (!el) return
+    const start = el.selectionStart
+    const end = el.selectionEnd
+    const insert = '  '
+    editForm.source = editForm.source.slice(0, start) + insert + editForm.source.slice(end)
+    nextTick(() => {
+      el.selectionStart = el.selectionEnd = start + insert.length
+    })
+  }
+}
+
+function syncScroll() {
+  const el = sourceEditorRef.value
+  const gutter = el?.parentElement?.querySelector('.line-gutter') as HTMLElement | null
+  if (el && gutter) gutter.scrollTop = el.scrollTop
+}
+
+onMounted(loadScripts)
+</script>
+
+<template>
+  <div class="mcp-scripts-tab">
+    <div class="page-header">
+      <div class="page-header-text">
+        <p class="page-desc">
+          在线编辑页面 WebMCP 脚本：左侧管理列表，右侧编辑源码。用
+          <code>@match</code> 匹配站点并注册 <code>document.modelContext</code> 工具。
+        </p>
+      </div>
+      <div class="page-header-actions">
+        <TinyButton class="toolbar-btn" @click="downloadBackup">
+          <span class="toolbar-btn-inner">
+            <component :is="IconDownloadComp" />
+            <span>导出</span>
+          </span>
+        </TinyButton>
+        <TinyButton class="toolbar-btn" @click="triggerImport">
+          <span class="toolbar-btn-inner">
+            <component :is="IconUploadComp" />
+            <span>导入</span>
+          </span>
+        </TinyButton>
+        <TinyButton type="primary" class="toolbar-btn" @click="openCreate">
+          <span class="toolbar-btn-inner">
+            <component :is="IconAddComp" />
+            <span>新建脚本</span>
+          </span>
+        </TinyButton>
+        <input
+          ref="importInputRef"
+          type="file"
+          accept=".json,application/json"
+          class="hidden-input"
+          @change="handleImportFile"
+        />
+      </div>
+    </div>
+
+    <div class="workspace">
+      <!-- 左侧列表 -->
+      <aside class="sidebar">
+        <div class="sidebar-title">
+          <component :is="IconFileComp" class="sidebar-title-icon" />
+          <span>已安装脚本</span>
+          <TinyTag v-if="scripts.length" size="small" type="info" effect="light" class="count-tag">
+            {{ scripts.length }}
+          </TinyTag>
+        </div>
+
+        <div v-if="loading" class="sidebar-empty">加载中…</div>
+        <div v-else-if="scripts.length === 0" class="sidebar-empty">
+          <p>暂无脚本</p>
+          <TinyButton type="text" @click="openCreate">新建第一个</TinyButton>
+        </div>
+        <ul v-else class="script-list">
+          <li
+            v-for="row in scripts"
+            :key="row.id"
+            class="script-item"
+            :class="{ active: selectedKey === row.id, disabled: !row.enabled }"
+            @click="selectScript(row.id)"
+          >
+            <div class="script-item-switch" @click.stop>
+              <TinyTooltip content="启用 / 停用" placement="top" effect="light">
+                <TinySwitch
+                  :model-value="row.enabled"
+                  @change="(v: boolean) => toggleEnabled(row, v)"
+                />
+              </TinyTooltip>
+            </div>
+            <div class="script-item-body">
+              <div class="script-item-name">
+                <span class="name-text">{{ row.name }}</span>
+                <TinyTag v-if="row.replacesBuiltIn" size="small" type="warning" effect="light">覆盖</TinyTag>
+              </div>
+              <div class="script-item-match" :title="row.matches.join('\n')">
+                {{ row.matches[0] || '（无 match）' }}
+              </div>
+            </div>
+          </li>
+        </ul>
+
+        <TinyAlert
+          type="info"
+          :closable="false"
+          class="sidebar-alert"
+          description="勾选「覆盖内置」时，匹配页将跳过源码内置 mcp-servers。"
+        />
+      </aside>
+
+      <!-- 右侧编辑器 -->
+      <section class="editor-pane">
+        <div v-if="!isEditing" class="editor-placeholder">
+          <component :is="IconCodeComp" class="placeholder-icon" />
+          <h3>页面 MCP 脚本编辑器</h3>
+          <p>从左侧选择脚本，或点击「新建脚本」。支持 Tab 缩进与 Ctrl/⌘+S 保存。</p>
+          <TinyButton type="primary" @click="openCreate">
+            <span class="toolbar-btn-inner">
+              <component :is="IconAddComp" />
+              <span>新建脚本</span>
+            </span>
+          </TinyButton>
+        </div>
+
+        <template v-else>
+          <header class="editor-toolbar">
+            <div class="editor-toolbar-left">
+              <strong class="editor-title">{{ editorTitle }}</strong>
+              <TinyTag v-if="isDirty" size="small" type="warning" effect="light">未保存</TinyTag>
+              <TinyTag v-if="isNewDraft" size="small" type="info" effect="light">新草稿</TinyTag>
+            </div>
+            <div class="editor-toolbar-right">
+              <TinyTooltip :content="metaExpanded ? '收起元数据' : '展开元数据'" placement="top" effect="light">
+                <TinyButton size="mini" @click="toggleMeta">
+                  <span class="toolbar-btn-inner">
+                    <component :is="metaExpanded ? IconChevronUpComp : IconChevronDownComp" />
+                    <span>元数据</span>
+                  </span>
+                </TinyButton>
+              </TinyTooltip>
+              <TinyButton size="mini" @click="closeEditor">
+                <span class="toolbar-btn-inner">
+                  <component :is="IconCloseComp" />
+                  <span>关闭</span>
+                </span>
+              </TinyButton>
+              <TinyButton size="mini" type="danger" plain class="btn-danger-plain" @click="confirmDelete">
+                <span class="toolbar-btn-inner">
+                  <component :is="IconDelComp" class="btn-danger-icon" />
+                  <span>删除</span>
+                </span>
+              </TinyButton>
+              <TinyButton type="primary" size="mini" :loading="saving" @click="saveEdit">
+                <span class="toolbar-btn-inner">
+                  <component :is="IconSaveComp" />
+                  <span>保存并生效</span>
+                </span>
+              </TinyButton>
+            </div>
+          </header>
+
+          <TinyCollapse v-model="collapseNames" class="meta-collapse">
+            <TinyCollapseItem title="脚本元数据" name="meta">
+              <TinyForm
+                ref="editFormRef"
+                :model="editForm"
+                :rules="editRules"
+                label-width="100px"
+                class="meta-form"
+              >
+                <TinyFormItem label="名称" prop="name">
+                  <TinyInput v-model="editForm.name" placeholder="脚本显示名称" />
+                </TinyFormItem>
+                <TinyFormItem label="描述">
+                  <TinyInput v-model="editForm.description" placeholder="可选说明" />
+                </TinyFormItem>
+                <TinyFormItem label="@match" prop="matchesText">
+                  <TinyInput
+                    v-model="editForm.matchesText"
+                    type="textarea"
+                    :rows="3"
+                    placeholder="每行一条，例如：*://*.example.com/*"
+                  />
+                </TinyFormItem>
+                <TinyFormItem label="选项">
+                  <div class="option-row">
+                    <label class="option-item">
+                      <TinySwitch v-model="editForm.enabled" />
+                      <span>启用</span>
+                    </label>
+                    <label class="option-item">
+                      <TinySwitch v-model="editForm.replacesBuiltIn" />
+                      <span>覆盖内置 mcp-servers</span>
+                      <TinyTooltip
+                        content="开启后，匹配页面将不再注入源码内置 mcp-servers 域名脚本"
+                        placement="top"
+                        effect="light"
+                      >
+                        <span class="help-icon">
+                          <component :is="IconHelpComp" />
+                        </span>
+                      </TinyTooltip>
+                    </label>
+                  </div>
+                </TinyFormItem>
+              </TinyForm>
+            </TinyCollapseItem>
+          </TinyCollapse>
+
+          <div class="code-header">
+            <span class="code-header-left">
+              <component :is="IconCodeComp" />
+              <span>源码 · JavaScript</span>
+            </span>
+            <span class="code-header-hint">Tab 缩进 · Ctrl/⌘+S 保存</span>
+          </div>
+          <div class="code-wrap">
+            <div class="line-gutter" aria-hidden="true">
+              <div v-for="n in lineNumbers" :key="n" class="line-no">{{ n }}</div>
+            </div>
+            <textarea
+              ref="sourceEditorRef"
+              v-model="editForm.source"
+              class="source-editor"
+              spellcheck="false"
+              wrap="off"
+              @keydown="onSourceKeydown"
+              @scroll="syncScroll"
+            />
+          </div>
+        </template>
+      </section>
+    </div>
+
+    <TinyModal v-model="deleteVisible" title="删除确认" width="420" :show-footer="true">
+      <p>确定删除脚本「{{ selectedScript?.name }}」吗？匹配页面将被刷新。</p>
+      <template #footer>
+        <TinyButton @click="deleteVisible = false">取消</TinyButton>
+        <TinyButton type="danger" @click="doDelete">删除</TinyButton>
+      </template>
+    </TinyModal>
+
+    <TinyModal v-model="discardVisible" title="未保存的更改" width="420" :show-footer="true">
+      <p>当前脚本有未保存的修改，确定放弃吗？</p>
+      <template #footer>
+        <TinyButton @click="cancelDiscard">继续编辑</TinyButton>
+        <TinyButton type="danger" @click="confirmDiscard">放弃更改</TinyButton>
+      </template>
+    </TinyModal>
+  </div>
+</template>
+
+<style scoped>
+.mcp-scripts-tab {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.page-header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+}
+
+.page-desc {
+  margin: 0;
+  font-size: 13px;
+  color: #606266;
+  line-height: 1.6;
+  max-width: 640px;
+}
+
+.page-desc code {
+  font-size: 12px;
+  background: #f4f4f5;
+  padding: 1px 4px;
+  border-radius: 3px;
+}
+
+.page-header-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-shrink: 0;
+}
+
+.toolbar-btn :deep(button) {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.toolbar-btn-inner {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+
+/* plain danger 按钮内图标默认偏浅，强制与文字同色 */
+.btn-danger-plain :deep(.btn-danger-icon),
+.btn-danger-plain .btn-danger-icon {
+  color: #f56c6c !important;
+  fill: currentColor !important;
+}
+
+.btn-danger-plain :deep(.btn-danger-icon svg),
+.btn-danger-plain :deep(.btn-danger-icon path) {
+  fill: currentColor !important;
+  color: inherit;
+}
+
+.btn-danger-plain:hover :deep(.btn-danger-icon),
+.btn-danger-plain:hover .btn-danger-icon {
+  color: #f78989 !important;
+}
+
+.workspace {
+  display: flex;
+  height: calc(100vh - 200px);
+  min-height: 520px;
+  border: 1px solid #e4e7ed;
+  border-radius: 8px;
+  overflow: hidden;
+  background: #fff;
+}
+
+.sidebar {
+  width: 300px;
+  flex-shrink: 0;
+  border-right: 1px solid #e4e7ed;
+  display: flex;
+  flex-direction: column;
+  background: #fafafa;
+}
+
+.sidebar-title {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 12px 14px;
+  font-size: 13px;
+  font-weight: 600;
+  color: #303133;
+  border-bottom: 1px solid #ebeef5;
+}
+
+.sidebar-title-icon {
+  font-size: 16px;
+  color: #909399;
+}
+
+.count-tag {
+  margin-left: auto;
+}
+
+.sidebar-empty {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 4px;
+  color: #909399;
+  font-size: 13px;
+  padding: 24px;
+}
+
+.sidebar-empty p {
+  margin: 0;
+}
+
+.script-list {
+  list-style: none;
+  margin: 0;
+  padding: 8px;
+  overflow-y: auto;
+  flex: 1;
+}
+
+.script-item {
+  display: flex;
+  gap: 10px;
+  align-items: flex-start;
+  padding: 10px 10px;
+  border-radius: 6px;
+  cursor: pointer;
+  margin-bottom: 4px;
+  border: 1px solid transparent;
+  transition: background 0.15s, border-color 0.15s;
+}
+
+.script-item:hover {
+  background: #f0f2f5;
+}
+
+.script-item.active {
+  background: #ecf5ff;
+  border-color: #b3d8ff;
+}
+
+.script-item.disabled .name-text {
+  color: #909399;
+}
+
+.script-item-switch {
+  padding-top: 2px;
+}
+
+.script-item-body {
+  flex: 1;
+  min-width: 0;
+}
+
+.script-item-name {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 13px;
+  font-weight: 600;
+  color: #303133;
+}
+
+.name-text {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.script-item-match {
+  margin-top: 4px;
+  font-size: 11px;
+  color: #909399;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.sidebar-alert {
+  margin: 8px;
+  flex-shrink: 0;
+}
+
+.sidebar-alert :deep(.tiny-alert) {
+  padding: 8px 10px;
+  font-size: 12px;
+}
+
+.editor-pane {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  background: #fff;
+}
+
+.editor-placeholder {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 12px;
+  padding: 32px;
+  text-align: center;
+  color: #606266;
+}
+
+.placeholder-icon {
+  font-size: 48px;
+  color: #c0c4cc;
+}
+
+.editor-placeholder h3 {
+  margin: 0;
+  font-size: 18px;
+  color: #303133;
+}
+
+.editor-placeholder p {
+  margin: 0;
+  max-width: 420px;
+  font-size: 13px;
+  line-height: 1.6;
+  color: #909399;
+}
+
+.editor-toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 10px 14px;
+  border-bottom: 1px solid #ebeef5;
+  background: #fafafa;
+  flex-shrink: 0;
+}
+
+.editor-toolbar-left {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+}
+
+.editor-title {
+  font-size: 14px;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.editor-toolbar-right {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-shrink: 0;
+}
+
+.meta-collapse {
+  flex-shrink: 0;
+  border-bottom: 1px solid #ebeef5;
+}
+
+.meta-collapse :deep(.tiny-collapse-item__header) {
+  background: #fff;
+  padding-left: 14px;
+  padding-right: 14px;
+}
+
+.meta-collapse :deep(.tiny-collapse-item__content) {
+  padding: 4px 14px 12px;
+}
+
+.meta-form {
+  max-width: 920px;
+}
+
+.option-row {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 20px;
+  align-items: center;
+  min-height: 32px;
+}
+
+.option-item {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 13px;
+  color: #606266;
+  cursor: pointer;
+}
+
+.help-icon {
+  display: inline-flex;
+  color: #909399;
+  cursor: help;
+}
+
+.code-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  padding: 6px 14px;
+  font-size: 12px;
+  color: #606266;
+  background: #f5f7fa;
+  border-bottom: 1px solid #e4e7ed;
+  flex-shrink: 0;
+}
+
+.code-header-left {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.code-header-hint {
+  color: #909399;
+  font-size: 11px;
+}
+
+.code-wrap {
+  flex: 1;
+  min-height: 0;
+  display: flex;
+  background: #1e1e1e;
+  overflow: hidden;
+}
+
+.line-gutter {
+  flex-shrink: 0;
+  width: 48px;
+  overflow: hidden;
+  background: #252526;
+  color: #858585;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New',
+    monospace;
+  font-size: 13px;
+  line-height: 1.55;
+  padding: 12px 0;
+  text-align: right;
+  user-select: none;
+}
+
+.line-no {
+  padding: 0 8px 0 4px;
+  height: calc(13px * 1.55);
+}
+
+.source-editor {
+  flex: 1;
+  min-width: 0;
+  height: 100%;
+  border: none;
+  outline: none;
+  resize: none;
+  padding: 12px 14px;
+  margin: 0;
+  background: #1e1e1e;
+  color: #d4d4d4;
+  caret-color: #fff;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New',
+    monospace;
+  font-size: 13px;
+  line-height: 1.55;
+  tab-size: 2;
+  white-space: pre;
+  overflow: auto;
+}
+
+.hidden-input {
+  display: none;
+}
+
+@media (max-width: 960px) {
+  .page-header {
+    flex-direction: column;
+  }
+
+  .workspace {
+    flex-direction: column;
+    height: auto;
+    min-height: 0;
+  }
+
+  .sidebar {
+    width: 100%;
+    max-height: 240px;
+    border-right: none;
+    border-bottom: 1px solid #e4e7ed;
+  }
+
+  .code-wrap {
+    min-height: 420px;
+  }
+
+  .editor-toolbar {
+    flex-wrap: wrap;
+  }
+}
+</style>
diff --git a/packages/next-wxt/mcp-servers/types.d.ts b/packages/next-wxt/mcp-servers/types.d.ts
index 768e3e21..2ef2155c 100644
--- a/packages/next-wxt/mcp-servers/types.d.ts
+++ b/packages/next-wxt/mcp-servers/types.d.ts
@@ -12,6 +12,13 @@ declare global {
       consoleCloudPageAgentToolOptions?: Record<string, any>
       [key: string]: any
     }
+    /**
+     * 用户 MCP 脚本执行桥（vendor/user-mcp-exec.js）
+     * 在扩展脚本上下文执行源码，绕过页面 CSP 对 eval 的限制
+     */
+    __NEXT_WXT_EXEC_USER_MCP_SCRIPT__?: (
+      code: string
+    ) => { ok: true } | { ok: false; error: string }
   }
 
   interface Document {
diff --git a/packages/next-wxt/package.json b/packages/next-wxt/package.json
index 2dcfe083..3a1656e7 100644
--- a/packages/next-wxt/package.json
+++ b/packages/next-wxt/package.json
@@ -14,6 +14,8 @@
     "zip": "wxt zip",
     "zip:firefox": "wxt zip -b firefox",
     "compile": "vue-tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "postinstall": "wxt prepare"
   },
   "dependencies": {
@@ -42,6 +44,7 @@
     "unplugin-vue-components": "catalog:",
     "vite": "7.2.4",
     "vite-svg-loader": "catalog:",
+    "vitest": "^4.1.10",
     "vue-tsc": "catalog:",
     "wxt": "catalog:"
   }
diff --git a/packages/next-wxt/public/vendor/user-mcp-exec.js b/packages/next-wxt/public/vendor/user-mcp-exec.js
new file mode 100644
index 00000000..5c74f223
--- /dev/null
+++ b/packages/next-wxt/public/vendor/user-mcp-exec.js
@@ -0,0 +1,24 @@
+/**
+ * 用户 MCP 脚本执行桥（经 chrome-extension:// 注入 MAIN world）
+ * 在扩展脚本上下文中 new Function，避免页面 CSP 拦截
+ * （复现：京东等站直接 scripting.executeScript + new Function 失败，仅剩 page-agent-tool）
+ */
+;(function () {
+  var KEY = '__NEXT_WXT_EXEC_USER_MCP_SCRIPT__'
+  if (window[KEY]) return
+
+  window[KEY] = function (code) {
+    try {
+      if (typeof code !== 'string' || !code) {
+        return { ok: false, error: 'empty code' }
+      }
+      var runner = new Function(code)
+      runner()
+      return { ok: true }
+    } catch (err) {
+      var msg = err && err.message ? err.message : String(err)
+      console.error('[user-mcp-scripts] 桥接执行失败:', err)
+      return { ok: false, error: msg }
+    }
+  }
+})()
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
new file mode 100644
index 00000000..717fd9c6
--- /dev/null
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
@@ -0,0 +1,86 @@
+# Spec：design.md — 用户 MCP 脚本
+
+## 方案概述
+
+新增与内置 `mcp-servers` 并行的 `user-mcp-scripts` 模块：用户脚本以结构化记录存入 `@wxt-dev/storage`；运行时由 content 请求 background，按 `@match` 解析后对匹配脚本执行 MAIN-world `executeScript`；若命中 `replacesBuiltIn`，跳过内置 hostname 注入。Options 提供独立 Tab 管理，不复用 skills-storage。
+
+## 涉及模块 / 文件
+
+| 路径 | 变更 |
+|---|---|
+| `packages/next-wxt/user-mcp-scripts/*` | 新增核心模块 |
+| `packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts` | 新增注入适配 |
+| `packages/next-wxt/entrypoints/background.ts` | 注册消息与 reinject |
+| `packages/next-wxt/entrypoints/content.ts` | 薄钩子 |
+| `packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue` | 新增 UI |
+| `packages/next-wxt/entrypoints/options/Options.vue` | 挂载 Tab |
+| `packages/next-wxt/test/user-mcp-scripts/*.test.ts` | 单测 |
+| `packages/next-wxt/vitest.config.ts` / `package.json` | 测试基建 |
+| `docs/ai-extension/next-wxt.md` | 用户文档 |
+
+## 核心数据结构 / 类型定义
+
+```typescript
+export interface UserMcpScript {
+  id: string
+  name: string
+  description?: string
+  matches: string[]
+  enabled: boolean
+  replacesBuiltIn: boolean
+  source: string
+  updatedAt: number
+}
+
+export type UserMcpScriptsStore = Record<string, UserMcpScript>
+
+export const USER_MCP_SCRIPTS_KEY = 'local:user-mcp-scripts'
+```
+
+## 依赖变更
+
+- `packages/next-wxt` 增加 `vitest` / `jsdom`（devDependencies）与 `test` script
+
+## API / 行为变更
+
+| 符号或行为 | 变更类型 | 说明 |
+|---|---|---|
+| `matchUrl(pattern, url)` | 新增 | `@match` 匹配 |
+| `validateMatchPattern(pattern)` | 新增 | 保存前校验 |
+| `resolveMatchingScripts(store, url)` | 新增 | 返回 enabled 且匹配的脚本 |
+| `shouldSkipBuiltIn(store, url)` | 新增 | 任一匹配脚本 `replacesBuiltIn` 则为 true |
+| `get/set/upsert/removeUserMcpScript*` | 新增 | storage CRUD |
+| `createDefaultScriptTemplate()` | 新增 | 默认 JS 模板 |
+| content 注入顺序 | 修改 | runtime → 用户脚本 →（可选）内置 → `page-tools-injected` |
+| Options Tab「页面 MCP 脚本」 | 新增 | 在线管理 |
+
+## 数据流 / 时序
+
+```mermaid
+sequenceDiagram
+  participant Page
+  participant Content
+  participant BG as Background
+  participant Store as user-mcp-scripts
+
+  Content->>Content: injectRuntimeAndRegister
+  Content->>BG: inject-user-mcp-scripts tabId+url
+  BG->>Store: resolveMatchingScripts
+  BG->>Page: scripting.executeScript MAIN source
+  BG-->>Content: shouldSkipBuiltIn
+  alt not skip and has meta
+    Content->>Page: inject mcp-servers/host/index.js
+  end
+  Content-->>BG: page-tools-injected
+```
+
+## 风险与兼容
+
+- 重复注入可能导致工具重复注册：模板与注入侧使用幂等标记
+- 宽泛 `@match`（如 `*://*/*`）+ `replacesBuiltIn` 会禁用所有内置域名工具：UI 文案提示风险
+- 不改变内置三站行为（无用户脚本时路径与现网一致）
+
+## 备选方案（若有）
+
+- blob/`<script>` 注入：易受页面 CSP 拦截，已弃用
+- 统一迁入用户脚本体系：改动面过大，本需求明确 Out of Scope
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
new file mode 100644
index 00000000..492e44b4
--- /dev/null
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
@@ -0,0 +1,72 @@
+# Spec：用户 MCP 脚本（油猴式在线编辑）
+
+## 元信息
+
+- 状态：已交付
+- 主责包：`packages/next-wxt`
+- 关联 Issue：—
+
+## 背景
+
+内置 `mcp-servers/` 只能在扩展源码中按 hostname 编写并随构建注入，不利于插件推广与第三方站点适配。需要类似 Skills / 油猴的「在线编辑 + 实时运行」能力，让用户在 Options 中编写页面 WebMCP 脚本，按 `@match` 匹配注入，且与现有内置链路解耦。
+
+## 领域术语表
+
+- **用户 MCP 脚本**：存储在 `chrome.storage` 中的 JS 源码，运行时注入页面 MAIN world，调用 `document.modelContext.registerTool`
+- **内置 mcp-servers**：`packages/next-wxt/mcp-servers/<hostname>/`，构建期打成 IIFE，由 content 经 `<script src>` 注入
+- **`replacesBuiltIn`**：用户脚本标志；匹配当前 URL 且启用时，跳过该页内置域名脚本注入
+- **`@match`**：油猴风格 URL 匹配模式（如 `*://*.example.com/*`）
+
+## 目标用户 / 场景
+
+1. 扩展用户：为任意站点在 Options 中新增/编辑页面工具，无需重新打包扩展
+2. 插件推广：演示与文档引导用户自建站点工具
+3. 进阶用户：用 `replacesBuiltIn` 覆盖某站内置工具行为
+
+## 参考资料 / 上下文
+
+- 计划：用户 MCP 脚本（油猴式在线编辑）
+- Skills 在线编辑：`entrypoints/options/SkillsTab.vue`、`utils/skills-unified.ts`
+- 内置注入：`entrypoints/content.ts`、`plugins/vite-plugin-mcp-servers.ts`
+- 用户文档：`docs/ai-extension/next-wxt.md`
+
+## 范围
+
+### In Scope
+
+- 独立模块 `user-mcp-scripts/`（types / storage / match / resolve / template）
+- Options Tab：CRUD、启用开关、编辑源码、JSON 导入导出
+- background `scripting.executeScript` MAIN world 注入
+- content 薄钩子：请求注入 + 按 resolve 跳过内置
+- 保存后对匹配 tab 重新注入并通知工具列表刷新
+- 单测与用户文档更新
+
+### Out of Scope
+
+- 改造/废弃 `vite-plugin-mcp-servers` 与现有三站内置示例
+- `useCustomMarketMcpServers`（远程 SSE 市场）
+- 在线 TypeScript 编译、GM_* 等完整油猴 API
+- 与 skills-storage 共用存储实现
+
+## 用户故事与验收标准
+
+1. 作为用户，我希望在 Options 新建脚本并填写 `@match` 与 JS 源码，以便为新站点注册 WebMCP 工具。
+   - 验收：保存后访问匹配 URL，页面 `modelContext` 出现脚本中注册的工具；侧栏「浏览器内置工具」可同步到。
+
+2. 作为用户，我希望开关 `enabled`，以便临时停用脚本而不删除。
+   - 验收：`enabled: false` 的脚本不会被注入。
+
+3. 作为用户，我希望设置 `replacesBuiltIn`，以便覆盖同页内置域名工具。
+   - 验收：匹配且 `replacesBuiltIn: true` 时不注入 `mcp-servers/<hostname>/index.js`。
+
+4. 作为用户，我希望导入/导出脚本备份，以便迁移或分享。
+   - 验收：JSON 导出再导入后列表与字段一致。
+
+5. 作为开发者，模块边界清晰，不与 skills / 市场 MCP / mcpServer 代理业务耦合。
+   - 验收：核心逻辑仅在 `user-mcp-scripts/`；content/background/Options 仅薄适配。
+
+## 非功能
+
+- CSP：用户源码必须经 background `scripting.executeScript`（MAIN）注入，不得依赖 blob/`eval` 绕过
+- 幂等：默认模板含防重复注册防护
+- 非法 `@match` 保存时校验失败并提示
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
new file mode 100644
index 00000000..c6497cbc
--- /dev/null
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
@@ -0,0 +1,43 @@
+# Spec：tasks.md — 用户 MCP 脚本
+
+## 任务列表
+
+- [x] Task 1: 创建本 Spec（requirements / design / tasks）
+  - 产物：`packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/*`
+
+- [x] Task 2: 实现 `user-mcp-scripts` 核心模块
+  - 产物：`packages/next-wxt/user-mcp-scripts/{types,match,resolve,storage,template,index}.ts`
+  - [x] 测试：`packages/next-wxt/test/user-mcp-scripts/match.test.ts`
+  - [x] 测试：`packages/next-wxt/test/user-mcp-scripts/resolve.test.ts`
+  - [x] 测试：`packages/next-wxt/test/user-mcp-scripts/storage.test.ts`
+  - [x] 测试基建：`vitest.config.ts` + `package.json` `test` script
+
+- [x] Task 3: background 注入 + content 薄钩子
+  - 产物：`entrypoints/background/inject-user-mcp-scripts.ts`、改 `background.ts`、`content.ts`
+  - 行为：MAIN world 执行 source；`replacesBuiltIn` 跳过内置；保存后 reinject
+
+- [x] Task 4: Options `UserMcpScriptsTab`
+  - 产物：`entrypoints/options/UserMcpScriptsTab.vue`、改 `Options.vue`
+  - 能力：列表 / 启用 / CRUD / JSON 导入导出 / 保存 reinject
+
+- [x] Task 5: 用户文档与验收
+  - 产物：更新 `docs/ai-extension/next-wxt.md`
+  - 验收命令见下
+
+## 依赖顺序
+
+1 → 2 → 3 → 4 → 5
+
+## 验收命令
+
+```bash
+pnpm -F @opentiny/next-wxt test
+```
+
+## 手测清单
+
+1. Options →「页面 MCP 脚本」→ 新建，`@match` 填 `*://example.com/*`，保存示例工具
+2. 打开 example.com，侧栏「浏览器内置工具」出现新工具
+3. 关闭 enabled，刷新页面，工具消失
+4. 对内置站（如 `www.baidu.com`）建脚本并勾选 `replacesBuiltIn`，确认内置 `baidu-search` 不再注入、用户工具存在
+5. JSON 导出再导入，列表一致
diff --git a/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts b/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
new file mode 100644
index 00000000..690ad303
--- /dev/null
+++ b/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
@@ -0,0 +1,29 @@
+/**
+ * 复现：在 https://www.jd.com/ 配置 @match=*://www.jd.com/* 的用户 MCP 脚本并保存后，
+ * 页面仅出现 page-agent-tool，自定义 user_mcp_hello 未注册。
+ *
+ * 根因：background 在 MAIN world 的 scripting.executeScript 回调里直接 new Function(源码)，
+ * 会受页面 CSP（无 unsafe-eval）拦截；而 runtime / page-agent 经 chrome-extension:// script 注入不受影响。
+ *
+ * 修复后：必须通过扩展脚本桥 __NEXT_WXT_EXEC_USER_MCP_SCRIPT__ 执行用户源码。
+ */
+import { describe, expect, it } from 'vitest'
+import { matchUrl } from '../../user-mcp-scripts/match'
+import {
+  USER_MCP_EXEC_BRIDGE_NAME,
+  buildBridgeInvokeSnippet
+} from '../../user-mcp-scripts/exec-bridge'
+
+describe('复现：京东 CSP 阻断 MAIN world new Function', () => {
+  it('@match 能命中 https://www.jd.com/（排除匹配失败）', () => {
+    expect(matchUrl('*://www.jd.com/*', 'https://www.jd.com/')).toBe(true)
+    expect(matchUrl('*://www.jd.com/*', 'https://www.jd.com/index.html')).toBe(true)
+  })
+
+  it('注入路径须走扩展桥而非在 executeScript 回调内 new Function', () => {
+    expect(USER_MCP_EXEC_BRIDGE_NAME).toBe('__NEXT_WXT_EXEC_USER_MCP_SCRIPT__')
+    const snippet = buildBridgeInvokeSnippet('console.log(1)')
+    expect(snippet).toContain(USER_MCP_EXEC_BRIDGE_NAME)
+    expect(snippet).not.toMatch(/new\s+Function\s*\(/)
+  })
+})
diff --git a/packages/next-wxt/test/user-mcp-scripts/match.test.ts b/packages/next-wxt/test/user-mcp-scripts/match.test.ts
new file mode 100644
index 00000000..897cc7c4
--- /dev/null
+++ b/packages/next-wxt/test/user-mcp-scripts/match.test.ts
@@ -0,0 +1,58 @@
+import { describe, expect, it } from 'vitest'
+import {
+  matchUrl,
+  validateMatchPattern,
+  validateMatchPatterns,
+  matchAny
+} from '../../user-mcp-scripts/match'
+
+describe('validateMatchPattern', () => {
+  it('接受常见油猴模式', () => {
+    expect(validateMatchPattern('*://example.com/*').ok).toBe(true)
+    expect(validateMatchPattern('*://*.example.com/*').ok).toBe(true)
+    expect(validateMatchPattern('https://www.baidu.com/*').ok).toBe(true)
+    expect(validateMatchPattern('http://localhost:5173/*').ok).toBe(true)
+  })
+
+  it('拒绝空或非法模式', () => {
+    expect(validateMatchPattern('').ok).toBe(false)
+    expect(validateMatchPattern('example.com').ok).toBe(false)
+    expect(validateMatchPattern('*://').ok).toBe(false)
+  })
+
+  it('批量校验要求至少一条', () => {
+    expect(validateMatchPatterns([]).ok).toBe(false)
+    expect(validateMatchPatterns(['*://a.com/']).ok).toBe(true)
+  })
+})
+
+describe('matchUrl', () => {
+  it('精确 host + 通配 path', () => {
+    expect(matchUrl('*://example.com/*', 'https://example.com/')).toBe(true)
+    expect(matchUrl('*://example.com/*', 'https://example.com/foo?x=1')).toBe(true)
+    expect(matchUrl('*://example.com/*', 'https://www.example.com/')).toBe(false)
+  })
+
+  it('*.host 匹配 apex 与子域', () => {
+    expect(matchUrl('*://*.example.com/*', 'https://example.com/a')).toBe(true)
+    expect(matchUrl('*://*.example.com/*', 'https://www.example.com/a')).toBe(true)
+    expect(matchUrl('*://*.example.com/*', 'https://other.com/a')).toBe(false)
+  })
+
+  it('scheme 约束', () => {
+    expect(matchUrl('https://example.com/*', 'http://example.com/')).toBe(false)
+    expect(matchUrl('https://example.com/*', 'https://example.com/')).toBe(true)
+    expect(matchUrl('*://example.com/*', 'ftp://example.com/')).toBe(false)
+  })
+
+  it('非法 url 返回 false', () => {
+    expect(matchUrl('*://example.com/*', 'not-a-url')).toBe(false)
+  })
+
+  it('matchAny 任一命中', () => {
+    expect(
+      matchAny(['*://a.com/*', '*://b.com/*'], 'https://b.com/x')
+    ).toBe(true)
+    expect(matchAny(['*://a.com/*'], 'https://b.com/x')).toBe(false)
+  })
+})
diff --git a/packages/next-wxt/test/user-mcp-scripts/resolve.test.ts b/packages/next-wxt/test/user-mcp-scripts/resolve.test.ts
new file mode 100644
index 00000000..350301ad
--- /dev/null
+++ b/packages/next-wxt/test/user-mcp-scripts/resolve.test.ts
@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'vitest'
+import { resolveMatchingScripts, shouldSkipBuiltIn } from '../../user-mcp-scripts/resolve'
+import type { UserMcpScript, UserMcpScriptsStore } from '../../user-mcp-scripts/types'
+
+function script(partial: Partial<UserMcpScript> & Pick<UserMcpScript, 'id' | 'name' | 'matches'>): UserMcpScript {
+  return {
+    description: '',
+    enabled: true,
+    replacesBuiltIn: false,
+    source: '//',
+    updatedAt: 1,
+    ...partial
+  }
+}
+
+describe('resolveMatchingScripts', () => {
+  const store: UserMcpScriptsStore = {
+    a: script({
+      id: 'a',
+      name: 'Alpha',
+      matches: ['*://example.com/*'],
+      enabled: true
+    }),
+    b: script({
+      id: 'b',
+      name: 'Beta',
+      matches: ['*://*.other.com/*'],
+      enabled: true,
+      replacesBuiltIn: true
+    }),
+    c: script({
+      id: 'c',
+      name: 'Disabled',
+      matches: ['*://example.com/*'],
+      enabled: false
+    })
+  }
+
+  it('只返回 enabled 且匹配的脚本', () => {
+    const list = resolveMatchingScripts(store, 'https://example.com/page')
+    expect(list.map((s) => s.id)).toEqual(['a'])
+  })
+
+  it('子域匹配 replacesBuiltIn 脚本', () => {
+    const list = resolveMatchingScripts(store, 'https://www.other.com/')
+    expect(list.map((s) => s.id)).toEqual(['b'])
+  })
+
+  it('无匹配返回空', () => {
+    expect(resolveMatchingScripts(store, 'https://none.test/')).toEqual([])
+  })
+})
+
+describe('shouldSkipBuiltIn', () => {
+  it('匹配且 replacesBuiltIn 为 true 时跳过', () => {
+    const store: UserMcpScriptsStore = {
+      x: script({
+        id: 'x',
+        name: 'Override',
+        matches: ['*://www.baidu.com/*'],
+        replacesBuiltIn: true
+      })
+    }
+    expect(shouldSkipBuiltIn(store, 'https://www.baidu.com/s?wd=1')).toBe(true)
+  })
+
+  it('匹配但 replacesBuiltIn 为 false 时不跳过', () => {
+    const store: UserMcpScriptsStore = {
+      x: script({
+        id: 'x',
+        name: 'Add',
+        matches: ['*://www.baidu.com/*'],
+        replacesBuiltIn: false
+      })
+    }
+    expect(shouldSkipBuiltIn(store, 'https://www.baidu.com/')).toBe(false)
+  })
+
+  it('未匹配不跳过', () => {
+    const store: UserMcpScriptsStore = {
+      x: script({
+        id: 'x',
+        name: 'Override',
+        matches: ['*://example.com/*'],
+        replacesBuiltIn: true
+      })
+    }
+    expect(shouldSkipBuiltIn(store, 'https://www.baidu.com/')).toBe(false)
+  })
+})
diff --git a/packages/next-wxt/test/user-mcp-scripts/storage.test.ts b/packages/next-wxt/test/user-mcp-scripts/storage.test.ts
new file mode 100644
index 00000000..14207f74
--- /dev/null
+++ b/packages/next-wxt/test/user-mcp-scripts/storage.test.ts
@@ -0,0 +1,79 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+
+const memory = new Map<string, unknown>()
+
+vi.mock('@wxt-dev/storage', () => ({
+  storage: {
+    getItem: async (key: string) => memory.get(key),
+    setItem: async (key: string, value: unknown) => {
+      memory.set(key, value)
+    }
+  }
+}))
+
+import {
+  USER_MCP_SCRIPTS_KEY,
+  exportUserMcpScriptsJson,
+  importUserMcpScriptsJson,
+  upsertUserMcpScript,
+  getUserMcpScriptsStore,
+  listUserMcpScripts,
+  removeUserMcpScript
+} from '../../user-mcp-scripts'
+
+describe('user-mcp-scripts storage', () => {
+  beforeEach(() => {
+    memory.clear()
+  })
+
+  it('upsert 校验非法 match 并写入合法脚本', async () => {
+    const bad = await upsertUserMcpScript({
+      name: 'bad',
+      matches: ['not-a-pattern'],
+      enabled: true,
+      replacesBuiltIn: false,
+      source: '1'
+    })
+    expect(bad.ok).toBe(false)
+
+    const ok = await upsertUserMcpScript({
+      name: 'ok',
+      matches: ['*://example.com/*'],
+      enabled: true,
+      replacesBuiltIn: false,
+      source: 'console.log(1)'
+    })
+    expect(ok.ok).toBe(true)
+    if (!ok.ok) return
+    const store = await getUserMcpScriptsStore()
+    expect(store[ok.script.id]?.name).toBe('ok')
+    expect(memory.has(USER_MCP_SCRIPTS_KEY)).toBe(true)
+  })
+
+  it('导出再导入保持关键字段', async () => {
+    const created = await upsertUserMcpScript({
+      name: '导出测试',
+      description: 'd',
+      matches: ['*://a.com/*'],
+      enabled: true,
+      replacesBuiltIn: true,
+      source: '// hello'
+    })
+    expect(created.ok).toBe(true)
+    if (!created.ok) return
+
+    const json = exportUserMcpScriptsJson(await listUserMcpScripts())
+    await removeUserMcpScript(created.script.id)
+    expect(await listUserMcpScripts()).toEqual([])
+
+    const imported = await importUserMcpScriptsJson(json)
+    expect(imported.ok).toBe(true)
+    if (!imported.ok) return
+    expect(imported.imported).toBe(1)
+
+    const again = await listUserMcpScripts()
+    expect(again[0]?.name).toBe('导出测试')
+    expect(again[0]?.replacesBuiltIn).toBe(true)
+    expect(again[0]?.source).toBe('// hello')
+  })
+})
diff --git a/packages/next-wxt/user-mcp-scripts/exec-bridge.ts b/packages/next-wxt/user-mcp-scripts/exec-bridge.ts
new file mode 100644
index 00000000..0c112798
--- /dev/null
+++ b/packages/next-wxt/user-mcp-scripts/exec-bridge.ts
@@ -0,0 +1,19 @@
+/**
+ * 用户 MCP 脚本 MAIN world 执行桥约定
+ *
+ * Chrome 在 world:'MAIN' 的 scripting.executeScript 回调内使用 new Function/eval
+ * 会受页面 CSP 约束（京东等站无 unsafe-eval）。必须经 chrome-extension:// 加载的脚本执行源码。
+ */
+
+export const USER_MCP_EXEC_BRIDGE_NAME = '__NEXT_WXT_EXEC_USER_MCP_SCRIPT__'
+
+export const USER_MCP_EXEC_BRIDGE_PATH = 'vendor/user-mcp-exec.js'
+
+/**
+ * 供单测断言：注入侧应调用桥，而不是在回调里 new Function
+ */
+export function buildBridgeInvokeSnippet(codeLiteral: string): string {
+  return `window.${USER_MCP_EXEC_BRIDGE_NAME}(${JSON.stringify(codeLiteral)})`
+}
+
+export type BridgeExecResult = { ok: true } | { ok: false; error: string }
diff --git a/packages/next-wxt/user-mcp-scripts/index.ts b/packages/next-wxt/user-mcp-scripts/index.ts
new file mode 100644
index 00000000..dd00ab0a
--- /dev/null
+++ b/packages/next-wxt/user-mcp-scripts/index.ts
@@ -0,0 +1,22 @@
+/**
+ * 用户 MCP 脚本模块对外入口
+ * 与 mcp-servers / skills / 市场 MCP 解耦
+ */
+
+export * from './types'
+export * from './match'
+export * from './resolve'
+export * from './template'
+export * from './exec-bridge'
+export {
+  getUserMcpScriptsStore,
+  setUserMcpScriptsStore,
+  listUserMcpScripts,
+  upsertUserMcpScript,
+  removeUserMcpScript,
+  setUserMcpScriptEnabled,
+  createUserMcpScriptFromTemplate,
+  exportUserMcpScriptsJson,
+  importUserMcpScriptsJson,
+  type UpsertResult
+} from './storage'
diff --git a/packages/next-wxt/user-mcp-scripts/match.ts b/packages/next-wxt/user-mcp-scripts/match.ts
new file mode 100644
index 00000000..7d4b65fe
--- /dev/null
+++ b/packages/next-wxt/user-mcp-scripts/match.ts
@@ -0,0 +1,135 @@
+/**
+ * 油猴风格 @match 解析与匹配（v1）
+ * 支持：*://host/path、*://*.host/*、http(s)://*
+ */
+
+const MATCH_RE =
+  /^(?<scheme>\*|https?|file|ftp):\/\/(?<host>\*|(\*\.)?[^/*]+)(?<path>\/.*)$/i
+
+/**
+ * 校验单个 @match 模式是否合法
+ */
+export function validateMatchPattern(pattern: string): { ok: true } | { ok: false; error: string } {
+  const trimmed = pattern.trim()
+  if (!trimmed) {
+    return { ok: false, error: '匹配模式不能为空' }
+  }
+  if (!MATCH_RE.test(trimmed)) {
+    return {
+      ok: false,
+      error: `非法 @match：${trimmed}（示例：*://*.example.com/*）`
+    }
+  }
+  return { ok: true }
+}
+
+/**
+ * 批量校验 matches
+ */
+export function validateMatchPatterns(
+  patterns: string[]
+): { ok: true } | { ok: false; error: string } {
+  if (!patterns.length) {
+    return { ok: false, error: '至少需要一条 @match' }
+  }
+  for (const p of patterns) {
+    const r = validateMatchPattern(p)
+    if (!r.ok) return r
+  }
+  return { ok: true }
+}
+
+/**
+ * 将 @match host 段转为正则（不含 ^$）
+ * - `*` → 任意 host
+ * - `*.example.com` → 含子域与 apex
+ * - 其它 → 精确 host（大小写不敏感）
+ */
+function hostToRegexSource(host: string): string {
+  if (host === '*') return '[^/]+'
+  if (host.startsWith('*.')) {
+    const rest = escapeRegex(host.slice(2))
+    return `(?:[^/]+\\.)?${rest}`
+  }
+  return escapeRegex(host)
+}
+
+/**
+ * 将 path 段（含开头 /）转为正则；`*` 匹配任意（含空）
+ */
+function pathToRegexSource(path: string): string {
+  let out = ''
+  for (let i = 0; i < path.length; i++) {
+    const ch = path[i]
+    if (ch === '*') {
+      out += '.*'
+    } else {
+      out += escapeRegex(ch)
+    }
+  }
+  return out
+}
+
+function escapeRegex(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+/**
+ * 将单个 @match 编译为 RegExp（匹配完整 href 的 origin+pathname+search 风格：protocol//host/path）
+ * 使用 URL 解析后与 pattern 比较，避免把 hash 算进 path。
+ */
+export function matchPatternToRegExp(pattern: string): RegExp | null {
+  const m = pattern.trim().match(MATCH_RE)
+  if (!m?.groups) return null
+  const { scheme, host, path } = m.groups
+  const schemeSrc = scheme === '*' ? 'https?' : escapeRegex(scheme.toLowerCase())
+  const hostSrc = hostToRegexSource(host.toLowerCase())
+  const pathSrc = pathToRegexSource(path)
+  return new RegExp(`^${schemeSrc}:\\/\\/${hostSrc}${pathSrc}$`, 'i')
+}
+
+/**
+ * 判断 url 是否命中单个 @match
+ */
+export function matchUrl(pattern: string, url: string): boolean {
+  let parsed: URL
+  try {
+    parsed = new URL(url)
+  } catch {
+    return false
+  }
+
+  const m = pattern.trim().match(MATCH_RE)
+  if (!m?.groups) return false
+  const { scheme, host, path: pathPat } = m.groups
+
+  const urlScheme = parsed.protocol.replace(/:$/, '').toLowerCase()
+  if (scheme === '*') {
+    if (urlScheme !== 'http' && urlScheme !== 'https') return false
+  } else if (scheme.toLowerCase() !== urlScheme) {
+    return false
+  }
+
+  const urlHost = parsed.hostname.toLowerCase()
+  const patHost = host.toLowerCase()
+  if (patHost === '*') {
+    // ok
+  } else if (patHost.startsWith('*.')) {
+    const suffix = patHost.slice(2)
+    if (urlHost !== suffix && !urlHost.endsWith(`.${suffix}`)) return false
+  } else if (urlHost !== patHost) {
+    return false
+  }
+
+  // path 匹配：pathname + search（不含 hash），与油猴常见行为接近
+  const urlPath = `${parsed.pathname}${parsed.search}`
+  const pathRe = new RegExp(`^${pathToRegexSource(pathPat)}$`, 'i')
+  return pathRe.test(urlPath)
+}
+
+/**
+ * 任一 pattern 命中即为匹配
+ */
+export function matchAny(patterns: string[], url: string): boolean {
+  return patterns.some((p) => matchUrl(p, url))
+}
diff --git a/packages/next-wxt/user-mcp-scripts/resolve.ts b/packages/next-wxt/user-mcp-scripts/resolve.ts
new file mode 100644
index 00000000..8ec87748
--- /dev/null
+++ b/packages/next-wxt/user-mcp-scripts/resolve.ts
@@ -0,0 +1,25 @@
+/**
+ * 根据 URL 解析应注入的用户脚本、是否跳过内置
+ */
+
+import { matchAny } from './match'
+import type { UserMcpScript, UserMcpScriptsStore } from './types'
+
+/**
+ * 返回 enabled 且 @match 命中 url 的脚本（按 name 排序，稳定）
+ */
+export function resolveMatchingScripts(
+  store: UserMcpScriptsStore,
+  url: string
+): UserMcpScript[] {
+  return Object.values(store)
+    .filter((s) => s.enabled && Array.isArray(s.matches) && matchAny(s.matches, url))
+    .sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id))
+}
+
+/**
+ * 任一匹配且启用的脚本声明 replacesBuiltIn → 跳过内置 mcp-servers
+ */
+export function shouldSkipBuiltIn(store: UserMcpScriptsStore, url: string): boolean {
+  return resolveMatchingScripts(store, url).some((s) => s.replacesBuiltIn)
+}
diff --git a/packages/next-wxt/user-mcp-scripts/storage.ts b/packages/next-wxt/user-mcp-scripts/storage.ts
new file mode 100644
index 00000000..608b2203
--- /dev/null
+++ b/packages/next-wxt/user-mcp-scripts/storage.ts
@@ -0,0 +1,165 @@
+/**
+ * 用户 MCP 脚本存储（独立于 skills-overrides）
+ */
+
+import { storage } from '@wxt-dev/storage'
+import { validateMatchPatterns } from './match'
+import { createDefaultScriptMeta } from './template'
+import type { UserMcpScript, UserMcpScriptInput, UserMcpScriptsStore } from './types'
+import { USER_MCP_SCRIPTS_KEY } from './types'
+
+function newId(): string {
+  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+    return crypto.randomUUID()
+  }
+  return `ums_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`
+}
+
+function normalizeScript(raw: Partial<UserMcpScript> & { id: string }): UserMcpScript | null {
+  if (!raw.id || typeof raw.name !== 'string' || typeof raw.source !== 'string') return null
+  if (!Array.isArray(raw.matches)) return null
+  return {
+    id: raw.id,
+    name: raw.name,
+    description: typeof raw.description === 'string' ? raw.description : undefined,
+    matches: raw.matches.map(String),
+    enabled: raw.enabled !== false,
+    replacesBuiltIn: Boolean(raw.replacesBuiltIn),
+    source: raw.source,
+    updatedAt: typeof raw.updatedAt === 'number' ? raw.updatedAt : Date.now()
+  }
+}
+
+export async function getUserMcpScriptsStore(): Promise<UserMcpScriptsStore> {
+  try {
+    const data = (await storage.getItem(USER_MCP_SCRIPTS_KEY)) as UserMcpScriptsStore | undefined
+    if (!data || typeof data !== 'object') return {}
+    const out: UserMcpScriptsStore = {}
+    for (const [id, value] of Object.entries(data)) {
+      const normalized = normalizeScript({ ...value, id: value?.id || id })
+      if (normalized) out[normalized.id] = normalized
+    }
+    return out
+  } catch {
+    return {}
+  }
+}
+
+export async function setUserMcpScriptsStore(store: UserMcpScriptsStore): Promise<void> {
+  await storage.setItem(USER_MCP_SCRIPTS_KEY, store)
+}
+
+export async function listUserMcpScripts(): Promise<UserMcpScript[]> {
+  const store = await getUserMcpScriptsStore()
+  return Object.values(store).sort(
+    (a, b) => b.updatedAt - a.updatedAt || a.name.localeCompare(b.name)
+  )
+}
+
+export type UpsertResult =
+  | { ok: true; script: UserMcpScript }
+  | { ok: false; error: string }
+
+/**
+ * 新建或更新脚本；校验 @match
+ */
+export async function upsertUserMcpScript(input: UserMcpScriptInput): Promise<UpsertResult> {
+  const matchCheck = validateMatchPatterns(input.matches || [])
+  if (!matchCheck.ok) return matchCheck
+
+  const name = (input.name || '').trim()
+  if (!name) return { ok: false, error: '名称不能为空' }
+  if (!(input.source || '').trim()) return { ok: false, error: '脚本源码不能为空' }
+
+  const store = await getUserMcpScriptsStore()
+  const id = input.id && store[input.id] ? input.id : input.id || newId()
+  const script: UserMcpScript = {
+    id,
+    name,
+    description: input.description?.trim() || undefined,
+    matches: input.matches.map((m) => m.trim()).filter(Boolean),
+    enabled: input.enabled !== false,
+    replacesBuiltIn: Boolean(input.replacesBuiltIn),
+    source: input.source,
+    updatedAt: Date.now()
+  }
+  store[id] = script
+  await setUserMcpScriptsStore(store)
+  return { ok: true, script }
+}
+
+export async function removeUserMcpScript(id: string): Promise<void> {
+  const store = await getUserMcpScriptsStore()
+  delete store[id]
+  await setUserMcpScriptsStore(store)
+}
+
+export async function setUserMcpScriptEnabled(id: string, enabled: boolean): Promise<UpsertResult> {
+  const store = await getUserMcpScriptsStore()
+  const existing = store[id]
+  if (!existing) return { ok: false, error: '脚本不存在' }
+  return upsertUserMcpScript({ ...existing, enabled })
+}
+
+/**
+ * 用默认模板创建一条脚本
+ */
+export async function createUserMcpScriptFromTemplate(partial?: {
+  name?: string
+  description?: string
+  matches?: string[]
+}): Promise<UpsertResult> {
+  const meta = createDefaultScriptMeta(partial)
+  return upsertUserMcpScript(meta)
+}
+
+/**
+ * 导出为可分享的 JSON 数组（不含内部无关字段）
+ */
+export function exportUserMcpScriptsJson(scripts: UserMcpScript[]): string {
+  const payload = scripts.map((s) => ({
+    id: s.id,
+    name: s.name,
+    description: s.description,
+    matches: s.matches,
+    enabled: s.enabled,
+    replacesBuiltIn: s.replacesBuiltIn,
+    source: s.source,
+    updatedAt: s.updatedAt
+  }))
+  return JSON.stringify(payload, null, 2)
+}
+
+/**
+ * 从 JSON 导入（合并到现有 store；同 id 覆盖）
+ */
+export async function importUserMcpScriptsJson(json: string): Promise<
+  | { ok: true; imported: number }
+  | { ok: false; error: string }
+> {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(json)
+  } catch {
+    return { ok: false, error: 'JSON 解析失败' }
+  }
+  const list = Array.isArray(parsed) ? parsed : (parsed as any)?.scripts
+  if (!Array.isArray(list)) {
+    return { ok: false, error: 'JSON 应为脚本数组，或含 scripts 字段的对象' }
+  }
+
+  const store = await getUserMcpScriptsStore()
+  let imported = 0
+  for (const item of list) {
+    if (!item || typeof item !== 'object') continue
+    const id = typeof item.id === 'string' && item.id ? item.id : newId()
+    const candidate = normalizeScript({ ...item, id })
+    if (!candidate) continue
+    const matchCheck = validateMatchPatterns(candidate.matches)
+    if (!matchCheck.ok) continue
+    store[id] = { ...candidate, updatedAt: Date.now() }
+    imported++
+  }
+  await setUserMcpScriptsStore(store)
+  return { ok: true, imported }
+}
diff --git a/packages/next-wxt/user-mcp-scripts/template.ts b/packages/next-wxt/user-mcp-scripts/template.ts
new file mode 100644
index 00000000..c683235a
--- /dev/null
+++ b/packages/next-wxt/user-mcp-scripts/template.ts
@@ -0,0 +1,62 @@
+/**
+ * 用户 MCP 脚本默认源码模板（MAIN world）
+ */
+
+export function createDefaultScriptSource(toolName = 'user_mcp_hello'): string {
+  const guard = `__userMcp_${toolName}_registered`
+  return `;(function () {
+  var g = window;
+  if (g[${JSON.stringify(guard)}]) return;
+  var ctx = document.modelContext;
+  if (!ctx || typeof ctx.registerTool !== 'function') {
+    console.warn('[user-mcp-scripts] document.modelContext 未就绪');
+    return;
+  }
+  ctx.registerTool({
+    name: ${JSON.stringify(toolName)},
+    title: '用户 MCP 示例',
+    description: '由 Options「页面 MCP 脚本」注册的示例工具，返回当前页面标题。',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+      additionalProperties: false
+    },
+    execute: async function () {
+      return {
+        content: [{ type: 'text', text: '页面标题：' + (document.title || '(空)') }]
+      };
+    }
+  });
+  g[${JSON.stringify(guard)}] = true;
+})();
+`
+}
+
+export function createDefaultScriptMeta(partial?: {
+  name?: string
+  description?: string
+  matches?: string[]
+}): {
+  name: string
+  description: string
+  matches: string[]
+  enabled: boolean
+  replacesBuiltIn: boolean
+  source: string
+} {
+  const name = partial?.name?.trim() || '我的页面工具'
+  const toolSlug =
+    name
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, '_')
+      .replace(/^_|_$/g, '')
+      .slice(0, 40) || 'user_mcp_hello'
+  return {
+    name,
+    description: partial?.description ?? '在匹配站点注册 WebMCP 工具',
+    matches: partial?.matches?.length ? partial.matches : ['*://example.com/*'],
+    enabled: true,
+    replacesBuiltIn: false,
+    source: createDefaultScriptSource(toolSlug)
+  }
+}
diff --git a/packages/next-wxt/user-mcp-scripts/types.ts b/packages/next-wxt/user-mcp-scripts/types.ts
new file mode 100644
index 00000000..a3224a0c
--- /dev/null
+++ b/packages/next-wxt/user-mcp-scripts/types.ts
@@ -0,0 +1,26 @@
+/**
+ * 用户 MCP 脚本类型与存储键
+ * 与内置 mcp-servers、skills 存储完全独立
+ */
+
+export const USER_MCP_SCRIPTS_KEY = 'local:user-mcp-scripts'
+
+export interface UserMcpScript {
+  id: string
+  name: string
+  description?: string
+  /** 油猴风格 @match 列表 */
+  matches: string[]
+  enabled: boolean
+  /** true 且匹配当前 URL 时，跳过该页内置 mcp-servers 注入 */
+  replacesBuiltIn: boolean
+  /** 注入到 MAIN world 的 JS 源码 */
+  source: string
+  updatedAt: number
+}
+
+export type UserMcpScriptsStore = Record<string, UserMcpScript>
+
+export type UserMcpScriptInput = Omit<UserMcpScript, 'id' | 'updatedAt'> & {
+  id?: string
+}
diff --git a/packages/next-wxt/vitest.config.ts b/packages/next-wxt/vitest.config.ts
new file mode 100644
index 00000000..28cd9cf6
--- /dev/null
+++ b/packages/next-wxt/vitest.config.ts
@@ -0,0 +1,16 @@
+import { defineConfig } from 'vitest/config'
+import { resolve } from 'node:path'
+
+export default defineConfig({
+  resolve: {
+    alias: {
+      '@': resolve(__dirname, '.')
+    }
+  },
+  test: {
+    environment: 'node',
+    globals: false,
+    include: ['test/**/*.test.ts'],
+    exclude: ['node_modules/**', '.output/**', '.wxt/**']
+  }
+})
diff --git a/packages/next-wxt/wxt.config.ts b/packages/next-wxt/wxt.config.ts
index 93f5f7e7..35645774 100644
--- a/packages/next-wxt/wxt.config.ts
+++ b/packages/next-wxt/wxt.config.ts
@@ -41,8 +41,12 @@ export default defineConfig({
     },
     web_accessible_resources: [
       {
-        // next-sdk runtime + 显式注册脚本（content 经 <script src> 注入 MAIN world）
-        resources: ['vendor/runtime.js', 'vendor/register-page-agent-tool.js'],
+        // next-sdk runtime + 显式注册脚本 + 用户 MCP 执行桥（content 经 <script src> 注入 MAIN world）
+        resources: [
+          'vendor/runtime.js',
+          'vendor/register-page-agent-tool.js',
+          'vendor/user-mcp-exec.js'
+        ],
         matches: ['*://*/*']
       },
       {

From 4efb24e4f46b90ab20534eba4210a1b26c6ece9d Mon Sep 17 00:00:00 2001
From: zzcr <894103554@qq.com>
Date: Thu, 30 Jul 2026 16:57:44 +0800
Subject: [PATCH 2/5] =?UTF-8?q?chore=EF=BC=9A=E4=BF=AE=E5=A4=8D=E6=A3=80?=
 =?UTF-8?q?=E8=A7=86=E6=84=8F=E8=A7=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../background/inject-user-mcp-scripts.ts     |  12 +-
 .../next-wxt/entrypoints/options/Options.vue  |  10 +-
 .../entrypoints/options/UserMcpScriptsTab.vue | 106 ++++++++-------
 .../next-wxt/public/vendor/user-mcp-exec.js   |  68 ++++++++--
 .../REQ-20260730-user-mcp-scripts/design.md   |   2 +-
 .../next-wxt/user-mcp-scripts/exec-bridge.ts  |   8 +-
 packages/next-wxt/user-mcp-scripts/match.ts   |  46 ++-----
 packages/next-wxt/user-mcp-scripts/storage.ts | 127 +++++++++++-------
 .../next-wxt/user-mcp-scripts/template.ts     |  12 +-
 9 files changed, 236 insertions(+), 155 deletions(-)

diff --git a/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts b/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
index 5ad3fc58..8d366567 100644
--- a/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
+++ b/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
@@ -12,6 +12,7 @@ import {
   shouldSkipBuiltIn,
   matchAny,
   USER_MCP_EXEC_BRIDGE_NAME,
+  USER_MCP_EXEC_BRIDGE_OWNER,
   type UserMcpScript,
   type BridgeExecResult
 } from '@/user-mcp-scripts'
@@ -28,15 +29,16 @@ export type InjectUserMcpResult = {
  */
 async function executeUserSourceInMainWorld(tabId: number, source: string): Promise<BridgeExecResult> {
   const bridgeName = USER_MCP_EXEC_BRIDGE_NAME
+  const ownerKey = USER_MCP_EXEC_BRIDGE_OWNER
   const results = await browser.scripting.executeScript({
     target: { tabId },
     world: 'MAIN',
-    args: [source, bridgeName],
-    func: (code: string, name: string) => {
+    args: [source, bridgeName, ownerKey],
+    func: (code: string, name: string, owner: string) => {
       const run = (window as any)[name]
-      if (typeof run !== 'function') {
-        console.warn('[user-mcp-scripts] 执行桥未就绪:', name)
-        return { ok: false, error: 'bridge missing: ' + name }
+      if (typeof run !== 'function' || run[owner] !== true) {
+        console.warn('[user-mcp-scripts] 执行桥未就绪或非扩展所有:', name)
+        return { ok: false, error: 'bridge missing or hijacked: ' + name }
       }
       return run(code)
     }
diff --git a/packages/next-wxt/entrypoints/options/Options.vue b/packages/next-wxt/entrypoints/options/Options.vue
index d054d7c7..09564a91 100644
--- a/packages/next-wxt/entrypoints/options/Options.vue
+++ b/packages/next-wxt/entrypoints/options/Options.vue
@@ -22,7 +22,11 @@ const isInnerMode = import.meta.env.VITE_MODEL_CONFIG === 'inner'
       <h2>OpenTiny AI Extension 配置</h2>
     </div>
 
-    <TinyTabs v-model="activeTab" class="options-tabs">
+    <TinyTabs
+      v-model="activeTab"
+      class="options-tabs"
+      :class="{ 'tabs-mcp-scripts': activeTab === 'user-mcp-scripts' }"
+    >
       <TinyTabItem name="skills" title="Skills 管理">
         <SkillsTab />
       </TinyTabItem>
@@ -67,8 +71,8 @@ const isInnerMode = import.meta.env.VITE_MODEL_CONFIG === 'inner'
   margin-top: 16px;
 }
 
-/* 页面 MCP 脚本需要更高编辑区，减少底部留白 */
-.options-tabs :deep(.tiny-tabs__content) {
+/* 仅页面 MCP 脚本 Tab 需要更高编辑区 */
+.tabs-mcp-scripts :deep(.tiny-tabs__content) {
   overflow: visible;
 }
 
diff --git a/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue b/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
index 3efad48c..27565f6c 100644
--- a/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
+++ b/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
@@ -50,6 +50,8 @@ const selectedKey = ref<string | null>(null)
 const isDirty = ref(false)
 const collapseNames = ref<string[]>(['meta'])
 const sourceEditorRef = ref<HTMLTextAreaElement | null>(null)
+/** Esc 后下一击 Tab 允许移出编辑器（无障碍） */
+const tabNavArmed = ref(false)
 
 const editForm = reactive({
   name: '',
@@ -92,20 +94,16 @@ const sourceLineCount = computed(() => {
   return text.length === 0 ? 1 : text.split('\n').length
 })
 
-const lineNumbers = computed(() => {
+const gutterText = computed(() => {
   const n = sourceLineCount.value
-  const lines: number[] = []
-  for (let i = 1; i <= n; i++) lines.push(i)
-  return lines
+  let out = ''
+  for (let i = 1; i <= n; i++) out += `${i}\n`
+  return out
 })
 
-watch(
-  () => ({ ...editForm }),
-  () => {
-    if (isEditing.value) isDirty.value = true
-  },
-  { deep: true }
-)
+watch(editForm, () => {
+  if (isEditing.value) isDirty.value = true
+})
 
 async function loadScripts() {
   loading.value = true
@@ -169,20 +167,21 @@ function focusEditor() {
   })
 }
 
-function openCreate() {
-  trySelect('__new__', () => {
-    selectedKey.value = '__new__'
-    const meta = createDefaultScriptMeta({ name: '我的页面工具', matches: ['*://example.com/*'] })
-    fillFormFromMeta(meta)
-    collapseNames.value = ['meta']
-    nextTick(() => {
-      isDirty.value = false
-      editFormRef.value?.clearValidate?.()
-      focusEditor()
-    })
+function applyNewDraft() {
+  selectedKey.value = '__new__'
+  fillFormFromMeta(createDefaultScriptMeta({ name: '我的页面工具', matches: ['*://example.com/*'] }))
+  collapseNames.value = ['meta']
+  nextTick(() => {
+    isDirty.value = false
+    editFormRef.value?.clearValidate?.()
+    focusEditor()
   })
 }
 
+function openCreate() {
+  trySelect('__new__', applyNewDraft)
+}
+
 function selectScript(id: string) {
   if (selectedKey.value === id) return
   trySelect(id, () => {
@@ -214,7 +213,7 @@ function confirmDiscard() {
   pendingSelectKey.value = null
   isDirty.value = false
   if (key === '__new__') {
-    openCreateForced()
+    applyNewDraft()
   } else if (key === null) {
     selectedKey.value = null
   } else if (key) {
@@ -224,22 +223,12 @@ function confirmDiscard() {
     fillFormFromScript(row)
     nextTick(() => {
       isDirty.value = false
+      editFormRef.value?.clearValidate?.()
       focusEditor()
     })
   }
 }
 
-function openCreateForced() {
-  selectedKey.value = '__new__'
-  const meta = createDefaultScriptMeta({ name: '我的页面工具', matches: ['*://example.com/*'] })
-  fillFormFromMeta(meta)
-  collapseNames.value = ['meta']
-  nextTick(() => {
-    isDirty.value = false
-    focusEditor()
-  })
-}
-
 function closeEditor() {
   if (isDirty.value) {
     pendingSelectKey.value = null
@@ -281,6 +270,7 @@ async function saveEdit() {
 
   saving.value = true
   try {
+    const previousMatches = selectedScript.value?.matches
     const result = await upsertUserMcpScript({
       id: isNewDraft.value ? undefined : selectedKey.value || undefined,
       name,
@@ -302,7 +292,12 @@ async function saveEdit() {
     nextTick(() => {
       isDirty.value = false
     })
-    await notifyReinject({ scriptId: result.script.id })
+    await notifyReinject({
+      scriptId: result.script.id,
+      matchesSnapshot: previousMatches ? [previousMatches, matches] : [matches]
+    })
+  } catch (e: any) {
+    Message.message({ message: e?.message || '保存失败', status: 'error' })
   } finally {
     saving.value = false
   }
@@ -359,8 +354,10 @@ async function downloadBackup() {
   const a = document.createElement('a')
   a.href = url
   a.download = `user-mcp-scripts-${new Date().toISOString().slice(0, 10)}.json`
+  document.body.appendChild(a)
   a.click()
-  URL.revokeObjectURL(url)
+  a.remove()
+  setTimeout(() => URL.revokeObjectURL(url), 0)
 }
 
 function triggerImport() {
@@ -383,7 +380,12 @@ async function handleImportFile(event: Event) {
       Message.message({ message: result.error, status: 'error' })
       return
     }
-    Message.message({ message: `已导入 ${result.imported} 条脚本`, status: 'success' })
+    Message.message({
+      message: `已导入 ${result.imported} 条（默认禁用，请审阅后启用）${
+        result.skipped ? `，跳过 ${result.skipped} 条` : ''
+      }`,
+      status: 'success'
+    })
     await loadScripts()
     await notifyReinject({})
   } catch (e: any) {
@@ -392,12 +394,21 @@ async function handleImportFile(event: Event) {
 }
 
 function onSourceKeydown(e: KeyboardEvent) {
-  if ((e.ctrlKey || e.metaKey) && e.key === 's') {
+  if (e.key === 'Escape') {
+    tabNavArmed.value = true
+    return
+  }
+  if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === 's') {
     e.preventDefault()
     void saveEdit()
     return
   }
   if (e.key === 'Tab') {
+    // Esc 后 Tab / 带修饰键的 Tab：允许焦点移出编辑器
+    if (tabNavArmed.value || e.ctrlKey || e.altKey) {
+      tabNavArmed.value = false
+      return
+    }
     e.preventDefault()
     const el = sourceEditorRef.value
     if (!el) return
@@ -408,7 +419,9 @@ function onSourceKeydown(e: KeyboardEvent) {
     nextTick(() => {
       el.selectionStart = el.selectionEnd = start + insert.length
     })
+    return
   }
+  tabNavArmed.value = false
 }
 
 function syncScroll() {
@@ -614,16 +627,15 @@ onMounted(loadScripts)
               <component :is="IconCodeComp" />
               <span>源码 · JavaScript</span>
             </span>
-            <span class="code-header-hint">Tab 缩进 · Ctrl/⌘+S 保存</span>
+            <span class="code-header-hint">Tab 缩进 · Esc 后 Tab 移出 · Ctrl/⌘+S 保存</span>
           </div>
           <div class="code-wrap">
-            <div class="line-gutter" aria-hidden="true">
-              <div v-for="n in lineNumbers" :key="n" class="line-no">{{ n }}</div>
-            </div>
+            <pre class="line-gutter" aria-hidden="true">{{ gutterText }}</pre>
             <textarea
               ref="sourceEditorRef"
               v-model="editForm.source"
               class="source-editor"
+              aria-label="脚本源码（JavaScript）"
               spellcheck="false"
               wrap="off"
               @keydown="onSourceKeydown"
@@ -998,20 +1010,18 @@ onMounted(loadScripts)
   flex-shrink: 0;
   width: 48px;
   overflow: hidden;
+  margin: 0;
   background: #252526;
   color: #858585;
   font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New',
     monospace;
   font-size: 13px;
   line-height: 1.55;
-  padding: 12px 0;
+  padding: 12px 8px 12px 4px;
   text-align: right;
   user-select: none;
-}
-
-.line-no {
-  padding: 0 8px 0 4px;
-  height: calc(13px * 1.55);
+  white-space: pre;
+  box-sizing: border-box;
 }
 
 .source-editor {
diff --git a/packages/next-wxt/public/vendor/user-mcp-exec.js b/packages/next-wxt/public/vendor/user-mcp-exec.js
index 5c74f223..f236e86e 100644
--- a/packages/next-wxt/public/vendor/user-mcp-exec.js
+++ b/packages/next-wxt/public/vendor/user-mcp-exec.js
@@ -1,24 +1,68 @@
 /**
  * 用户 MCP 脚本执行桥（经 chrome-extension:// 注入 MAIN world）
  * 在扩展脚本上下文中 new Function，避免页面 CSP 拦截
- * （复现：京东等站直接 scripting.executeScript + new Function 失败，仅剩 page-agent-tool）
+ *
+ * 安全：不复用页面预置的同名函数；以不可写属性安装；带所有权标记供 background 校验
  */
 ;(function () {
   var KEY = '__NEXT_WXT_EXEC_USER_MCP_SCRIPT__'
-  if (window[KEY]) return
+  var OWNER = '__NEXT_WXT_OWNED__'
 
-  window[KEY] = function (code) {
+  function install() {
+    var existing = null
     try {
-      if (typeof code !== 'string' || !code) {
-        return { ok: false, error: 'empty code' }
+      existing = Object.getOwnPropertyDescriptor(window, KEY)
+    } catch (e) {
+      existing = null
+    }
+
+    // 页面已抢占且不可配置 → 失败关闭，绝不调用页面函数
+    if (existing && existing.configurable === false) {
+      var cur = existing.value
+      if (!cur || cur[OWNER] !== true) {
+        console.error('[user-mcp-scripts] 执行桥被页面抢占且不可覆盖，拒绝安装')
+        return
+      }
+      // 已是本扩展安装的桥
+      return
+    }
+
+    if (existing && existing.value && existing.value[OWNER] !== true) {
+      try {
+        delete window[KEY]
+      } catch (e) {
+        console.error('[user-mcp-scripts] 无法移除页面伪造的执行桥')
+        return
+      }
+    }
+
+    function run(code) {
+      try {
+        if (typeof code !== 'string' || !code) {
+          return { ok: false, error: 'empty code' }
+        }
+        var runner = new Function(code)
+        runner()
+        return { ok: true }
+      } catch (err) {
+        var msg = err && err.message ? err.message : String(err)
+        console.error('[user-mcp-scripts] 桥接执行失败:', err)
+        return { ok: false, error: msg }
       }
-      var runner = new Function(code)
-      runner()
-      return { ok: true }
-    } catch (err) {
-      var msg = err && err.message ? err.message : String(err)
-      console.error('[user-mcp-scripts] 桥接执行失败:', err)
-      return { ok: false, error: msg }
+    }
+    run[OWNER] = true
+
+    try {
+      Object.defineProperty(window, KEY, {
+        value: run,
+        writable: false,
+        configurable: false,
+        enumerable: false
+      })
+    } catch (e) {
+      console.error('[user-mcp-scripts] 安装执行桥失败:', e)
     }
   }
+
+  install()
 })()
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
index 717fd9c6..52ca5d94 100644
--- a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
@@ -39,7 +39,7 @@ export const USER_MCP_SCRIPTS_KEY = 'local:user-mcp-scripts'
 
 ## 依赖变更
 
-- `packages/next-wxt` 增加 `vitest` / `jsdom`（devDependencies）与 `test` script
+- `packages/next-wxt` 增加 `vitest`（devDependencies）与 `test` script（`vitest.config.ts` 使用 `environment: 'node'`）
 
 ## API / 行为变更
 
diff --git a/packages/next-wxt/user-mcp-scripts/exec-bridge.ts b/packages/next-wxt/user-mcp-scripts/exec-bridge.ts
index 0c112798..14c95d4f 100644
--- a/packages/next-wxt/user-mcp-scripts/exec-bridge.ts
+++ b/packages/next-wxt/user-mcp-scripts/exec-bridge.ts
@@ -2,15 +2,19 @@
  * 用户 MCP 脚本 MAIN world 执行桥约定
  *
  * Chrome 在 world:'MAIN' 的 scripting.executeScript 回调内使用 new Function/eval
- * 会受页面 CSP 约束（京东等站无 unsafe-eval）。必须经 chrome-extension:// 加载的脚本执行源码。
+ * 会受页面 CSP 约束。必须经 chrome-extension:// 加载的脚本执行源码，
+ * 且仅调用带所有权标记的桥，避免页面伪造 window 全局劫持源码。
  */
 
 export const USER_MCP_EXEC_BRIDGE_NAME = '__NEXT_WXT_EXEC_USER_MCP_SCRIPT__'
 
+/** 桥函数上的所有权标记字段名（与 vendor/user-mcp-exec.js 一致） */
+export const USER_MCP_EXEC_BRIDGE_OWNER = '__NEXT_WXT_OWNED__'
+
 export const USER_MCP_EXEC_BRIDGE_PATH = 'vendor/user-mcp-exec.js'
 
 /**
- * 供单测断言：注入侧应调用桥，而不是在回调里 new Function
+ * 供单测断言：注入侧应调用已校验所有权的桥，而不是在回调里 new Function
  */
 export function buildBridgeInvokeSnippet(codeLiteral: string): string {
   return `window.${USER_MCP_EXEC_BRIDGE_NAME}(${JSON.stringify(codeLiteral)})`
diff --git a/packages/next-wxt/user-mcp-scripts/match.ts b/packages/next-wxt/user-mcp-scripts/match.ts
index 7d4b65fe..333cad09 100644
--- a/packages/next-wxt/user-mcp-scripts/match.ts
+++ b/packages/next-wxt/user-mcp-scripts/match.ts
@@ -1,6 +1,6 @@
 /**
- * 油猴风格 @match 解析与匹配（v1）
- * 支持：*://host/path、*://*.host/*、http(s)://*
+ * @match URL 匹配（v1）
+ * 支持：*://host/path、*://*.host/*、http(s)://*（不含端口）
  */
 
 const MATCH_RE =
@@ -14,12 +14,20 @@ export function validateMatchPattern(pattern: string): { ok: true } | { ok: fals
   if (!trimmed) {
     return { ok: false, error: '匹配模式不能为空' }
   }
-  if (!MATCH_RE.test(trimmed)) {
+  const m = trimmed.match(MATCH_RE)
+  if (!m?.groups) {
     return {
       ok: false,
       error: `非法 @match：${trimmed}（示例：*://*.example.com/*）`
     }
   }
+  // host 含端口时与 URL.hostname 无法对齐，明确拒绝
+  if (m.groups.host.includes(':')) {
+    return {
+      ok: false,
+      error: `不支持带端口的 @match：${trimmed}（请去掉 :port）`
+    }
+  }
   return { ok: true }
 }
 
@@ -39,21 +47,6 @@ export function validateMatchPatterns(
   return { ok: true }
 }
 
-/**
- * 将 @match host 段转为正则（不含 ^$）
- * - `*` → 任意 host
- * - `*.example.com` → 含子域与 apex
- * - 其它 → 精确 host（大小写不敏感）
- */
-function hostToRegexSource(host: string): string {
-  if (host === '*') return '[^/]+'
-  if (host.startsWith('*.')) {
-    const rest = escapeRegex(host.slice(2))
-    return `(?:[^/]+\\.)?${rest}`
-  }
-  return escapeRegex(host)
-}
-
 /**
  * 将 path 段（含开头 /）转为正则；`*` 匹配任意（含空）
  */
@@ -74,20 +67,6 @@ function escapeRegex(s: string): string {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 }
 
-/**
- * 将单个 @match 编译为 RegExp（匹配完整 href 的 origin+pathname+search 风格：protocol//host/path）
- * 使用 URL 解析后与 pattern 比较，避免把 hash 算进 path。
- */
-export function matchPatternToRegExp(pattern: string): RegExp | null {
-  const m = pattern.trim().match(MATCH_RE)
-  if (!m?.groups) return null
-  const { scheme, host, path } = m.groups
-  const schemeSrc = scheme === '*' ? 'https?' : escapeRegex(scheme.toLowerCase())
-  const hostSrc = hostToRegexSource(host.toLowerCase())
-  const pathSrc = pathToRegexSource(path)
-  return new RegExp(`^${schemeSrc}:\\/\\/${hostSrc}${pathSrc}$`, 'i')
-}
-
 /**
  * 判断 url 是否命中单个 @match
  */
@@ -102,6 +81,7 @@ export function matchUrl(pattern: string, url: string): boolean {
   const m = pattern.trim().match(MATCH_RE)
   if (!m?.groups) return false
   const { scheme, host, path: pathPat } = m.groups
+  if (host.includes(':')) return false
 
   const urlScheme = parsed.protocol.replace(/:$/, '').toLowerCase()
   if (scheme === '*') {
@@ -121,7 +101,7 @@ export function matchUrl(pattern: string, url: string): boolean {
     return false
   }
 
-  // path 匹配：pathname + search（不含 hash），与油猴常见行为接近
+  // path 匹配：pathname + search（不含 hash）
   const urlPath = `${parsed.pathname}${parsed.search}`
   const pathRe = new RegExp(`^${pathToRegexSource(pathPat)}$`, 'i')
   return pathRe.test(urlPath)
diff --git a/packages/next-wxt/user-mcp-scripts/storage.ts b/packages/next-wxt/user-mcp-scripts/storage.ts
index 608b2203..1524a5af 100644
--- a/packages/next-wxt/user-mcp-scripts/storage.ts
+++ b/packages/next-wxt/user-mcp-scripts/storage.ts
@@ -8,6 +8,18 @@ import { createDefaultScriptMeta } from './template'
 import type { UserMcpScript, UserMcpScriptInput, UserMcpScriptsStore } from './types'
 import { USER_MCP_SCRIPTS_KEY } from './types'
 
+/** 串行化读改写，避免并发丢更新 */
+let storeWriteChain: Promise<unknown> = Promise.resolve()
+
+function withStoreLock<T>(fn: () => Promise<T>): Promise<T> {
+  const run = storeWriteChain.then(fn, fn)
+  storeWriteChain = run.then(
+    () => undefined,
+    () => undefined
+  )
+  return run
+}
+
 function newId(): string {
   if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
     return crypto.randomUUID()
@@ -64,41 +76,53 @@ export type UpsertResult =
  * 新建或更新脚本；校验 @match
  */
 export async function upsertUserMcpScript(input: UserMcpScriptInput): Promise<UpsertResult> {
-  const matchCheck = validateMatchPatterns(input.matches || [])
-  if (!matchCheck.ok) return matchCheck
-
-  const name = (input.name || '').trim()
-  if (!name) return { ok: false, error: '名称不能为空' }
-  if (!(input.source || '').trim()) return { ok: false, error: '脚本源码不能为空' }
-
-  const store = await getUserMcpScriptsStore()
-  const id = input.id && store[input.id] ? input.id : input.id || newId()
-  const script: UserMcpScript = {
-    id,
-    name,
-    description: input.description?.trim() || undefined,
-    matches: input.matches.map((m) => m.trim()).filter(Boolean),
-    enabled: input.enabled !== false,
-    replacesBuiltIn: Boolean(input.replacesBuiltIn),
-    source: input.source,
-    updatedAt: Date.now()
-  }
-  store[id] = script
-  await setUserMcpScriptsStore(store)
-  return { ok: true, script }
+  return withStoreLock(async () => {
+    const matchCheck = validateMatchPatterns(input.matches || [])
+    if (!matchCheck.ok) return matchCheck
+
+    const name = (input.name || '').trim()
+    if (!name) return { ok: false, error: '名称不能为空' }
+    if (!(input.source || '').trim()) return { ok: false, error: '脚本源码不能为空' }
+
+    const store = await getUserMcpScriptsStore()
+    const id = input.id || newId()
+    const script: UserMcpScript = {
+      id,
+      name,
+      description: input.description?.trim() || undefined,
+      matches: input.matches.map((m) => m.trim()).filter(Boolean),
+      enabled: input.enabled !== false,
+      replacesBuiltIn: Boolean(input.replacesBuiltIn),
+      source: input.source,
+      updatedAt: Date.now()
+    }
+    store[id] = script
+    await setUserMcpScriptsStore(store)
+    return { ok: true, script }
+  })
 }
 
 export async function removeUserMcpScript(id: string): Promise<void> {
-  const store = await getUserMcpScriptsStore()
-  delete store[id]
-  await setUserMcpScriptsStore(store)
+  return withStoreLock(async () => {
+    const store = await getUserMcpScriptsStore()
+    delete store[id]
+    await setUserMcpScriptsStore(store)
+  })
 }
 
+/**
+ * 仅切换启用状态，不更新 updatedAt，避免侧栏排序跳动
+ */
 export async function setUserMcpScriptEnabled(id: string, enabled: boolean): Promise<UpsertResult> {
-  const store = await getUserMcpScriptsStore()
-  const existing = store[id]
-  if (!existing) return { ok: false, error: '脚本不存在' }
-  return upsertUserMcpScript({ ...existing, enabled })
+  return withStoreLock(async () => {
+    const store = await getUserMcpScriptsStore()
+    const existing = store[id]
+    if (!existing) return { ok: false, error: '脚本不存在' }
+    const script = { ...existing, enabled }
+    store[id] = script
+    await setUserMcpScriptsStore(store)
+    return { ok: true, script }
+  })
 }
 
 /**
@@ -131,10 +155,11 @@ export function exportUserMcpScriptsJson(scripts: UserMcpScript[]): string {
 }
 
 /**
- * 从 JSON 导入（合并到现有 store；同 id 覆盖）
+ * 从 JSON 导入（合并到现有 store；同 id 覆盖）。
+ * 导入项一律先禁用，需用户审阅后手动启用。
  */
 export async function importUserMcpScriptsJson(json: string): Promise<
-  | { ok: true; imported: number }
+  | { ok: true; imported: number; skipped: number }
   | { ok: false; error: string }
 > {
   let parsed: unknown
@@ -148,18 +173,30 @@ export async function importUserMcpScriptsJson(json: string): Promise<
     return { ok: false, error: 'JSON 应为脚本数组，或含 scripts 字段的对象' }
   }
 
-  const store = await getUserMcpScriptsStore()
-  let imported = 0
-  for (const item of list) {
-    if (!item || typeof item !== 'object') continue
-    const id = typeof item.id === 'string' && item.id ? item.id : newId()
-    const candidate = normalizeScript({ ...item, id })
-    if (!candidate) continue
-    const matchCheck = validateMatchPatterns(candidate.matches)
-    if (!matchCheck.ok) continue
-    store[id] = { ...candidate, updatedAt: Date.now() }
-    imported++
-  }
-  await setUserMcpScriptsStore(store)
-  return { ok: true, imported }
+  return withStoreLock(async () => {
+    const store = await getUserMcpScriptsStore()
+    let imported = 0
+    let skipped = 0
+    for (const item of list) {
+      if (!item || typeof item !== 'object') {
+        skipped++
+        continue
+      }
+      const id = typeof item.id === 'string' && item.id ? item.id : newId()
+      const candidate = normalizeScript({ ...item, id })
+      if (!candidate) {
+        skipped++
+        continue
+      }
+      const matchCheck = validateMatchPatterns(candidate.matches)
+      if (!matchCheck.ok) {
+        skipped++
+        continue
+      }
+      store[id] = { ...candidate, enabled: false, updatedAt: Date.now() }
+      imported++
+    }
+    await setUserMcpScriptsStore(store)
+    return { ok: true, imported, skipped }
+  })
 }
diff --git a/packages/next-wxt/user-mcp-scripts/template.ts b/packages/next-wxt/user-mcp-scripts/template.ts
index c683235a..0d6d4586 100644
--- a/packages/next-wxt/user-mcp-scripts/template.ts
+++ b/packages/next-wxt/user-mcp-scripts/template.ts
@@ -45,12 +45,12 @@ export function createDefaultScriptMeta(partial?: {
   source: string
 } {
   const name = partial?.name?.trim() || '我的页面工具'
-  const toolSlug =
-    name
-      .toLowerCase()
-      .replace(/[^a-z0-9]+/g, '_')
-      .replace(/^_|_$/g, '')
-      .slice(0, 40) || 'user_mcp_hello'
+  const asciiSlug = name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '_')
+    .replace(/^_|_$/g, '')
+    .slice(0, 40)
+  const toolSlug = asciiSlug || `user_mcp_${Math.random().toString(36).slice(2, 8)}`
   return {
     name,
     description: partial?.description ?? '在匹配站点注册 WebMCP 工具',

From e86aba4b375f8d2740a547f323c696f881663fdb Mon Sep 17 00:00:00 2001
From: zzcr <894103554@qq.com>
Date: Thu, 30 Jul 2026 17:03:00 +0800
Subject: [PATCH 3/5] test: enhance csp-bridge-repro test with script injection
 and ownership validation

---
 .../user-mcp-scripts/csp-bridge-repro.test.ts | 67 ++++++++++++++++++-
 1 file changed, 66 insertions(+), 1 deletion(-)

diff --git a/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts b/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
index 690ad303..9cc8dde1 100644
--- a/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
+++ b/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
@@ -7,14 +7,39 @@
  *
  * 修复后：必须通过扩展脚本桥 __NEXT_WXT_EXEC_USER_MCP_SCRIPT__ 执行用户源码。
  */
-import { describe, expect, it } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { matchUrl } from '../../user-mcp-scripts/match'
 import {
   USER_MCP_EXEC_BRIDGE_NAME,
+  USER_MCP_EXEC_BRIDGE_OWNER,
   buildBridgeInvokeSnippet
 } from '../../user-mcp-scripts/exec-bridge'
 
+const memory = new Map<string, unknown>()
+const executeScript = vi.fn()
+
+vi.mock('@wxt-dev/storage', () => ({
+  storage: {
+    getItem: async (key: string) => memory.get(key),
+    setItem: async (key: string, value: unknown) => {
+      memory.set(key, value)
+    }
+  }
+}))
+
+vi.stubGlobal('browser', {
+  scripting: { executeScript }
+})
+
+import { injectUserMcpScriptsForTab } from '../../entrypoints/background/inject-user-mcp-scripts'
+import { USER_MCP_SCRIPTS_KEY } from '../../user-mcp-scripts'
+
 describe('复现：京东 CSP 阻断 MAIN world new Function', () => {
+  beforeEach(() => {
+    memory.clear()
+    executeScript.mockReset()
+  })
+
   it('@match 能命中 https://www.jd.com/（排除匹配失败）', () => {
     expect(matchUrl('*://www.jd.com/*', 'https://www.jd.com/')).toBe(true)
     expect(matchUrl('*://www.jd.com/*', 'https://www.jd.com/index.html')).toBe(true)
@@ -26,4 +51,44 @@ describe('复现：京东 CSP 阻断 MAIN world new Function', () => {
     expect(snippet).toContain(USER_MCP_EXEC_BRIDGE_NAME)
     expect(snippet).not.toMatch(/new\s+Function\s*\(/)
   })
+
+  it('injectUserMcpScriptsForTab 经 MAIN world 调用带所有权标记的桥', async () => {
+    memory.set(USER_MCP_SCRIPTS_KEY, {
+      s1: {
+        id: 's1',
+        name: 'jd',
+        description: '',
+        matches: ['*://www.jd.com/*'],
+        enabled: true,
+        replacesBuiltIn: false,
+        source: 'window.__user_mcp_hello = 1',
+        createdAt: 1,
+        updatedAt: 1
+      }
+    })
+
+    const bridgeFn = Object.assign(vi.fn(() => ({ ok: true as const })), {
+      [USER_MCP_EXEC_BRIDGE_OWNER]: true
+    })
+    vi.stubGlobal('window', { [USER_MCP_EXEC_BRIDGE_NAME]: bridgeFn })
+
+    executeScript.mockImplementation(
+      async (opts: { world?: string; args?: unknown[]; func?: (...a: any[]) => unknown }) => {
+        expect(opts.world).toBe('MAIN')
+        expect(opts.args?.[1]).toBe(USER_MCP_EXEC_BRIDGE_NAME)
+        expect(opts.args?.[2]).toBe(USER_MCP_EXEC_BRIDGE_OWNER)
+        const body = String(opts.func)
+        expect(body).not.toMatch(/new\s+Function\s*\(/)
+        expect(body).toContain('run')
+        const result = opts.func!(...(opts.args as [string, string, string]))
+        return [{ result }]
+      }
+    )
+
+    const out = await injectUserMcpScriptsForTab(42, 'https://www.jd.com/')
+    expect(out.injectedCount).toBe(1)
+    expect(out.success).toBe(true)
+    expect(bridgeFn).toHaveBeenCalledWith('window.__user_mcp_hello = 1')
+    expect(executeScript).toHaveBeenCalledTimes(1)
+  })
 })

From 23794f4280dfdfe87f8a774856eb09788841bd26 Mon Sep 17 00:00:00 2001
From: zzcr <894103554@qq.com>
Date: Thu, 30 Jul 2026 17:12:50 +0800
Subject: [PATCH 4/5] =?UTF-8?q?feat:=20=E6=94=AF=E6=8C=81=20mcp-servers=20?=
 =?UTF-8?q?=E7=9B=AE=E5=BD=95=E6=A0=BC=E5=BC=8F=E7=9A=84=20zip=20=E5=AF=BC?=
 =?UTF-8?q?=E5=85=A5/=E5=AF=BC=E5=87=BA=EF=BC=8C=E5=85=BC=E5=AE=B9?=
 =?UTF-8?q?=E6=97=A7=E7=89=88=20JSON=20=E5=A4=87=E4=BB=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/ai-extension/next-wxt.md                 |   2 +-
 packages/next-wxt/components.d.ts             |  15 --
 .../entrypoints/options/UserMcpScriptsTab.vue |  30 ++-
 .../REQ-20260730-user-mcp-scripts/design.md   |   2 +
 .../requirements.md                           |   6 +-
 .../REQ-20260730-user-mcp-scripts/tasks.md    |   8 +-
 .../test/user-mcp-scripts/match.test.ts       |   5 +-
 .../test/user-mcp-scripts/pack.test.ts        | 159 +++++++++++++
 .../test/user-mcp-scripts/storage.test.ts     |  33 +--
 packages/next-wxt/user-mcp-scripts/index.ts   |  11 +
 packages/next-wxt/user-mcp-scripts/pack.ts    | 221 ++++++++++++++++++
 packages/next-wxt/user-mcp-scripts/storage.ts |  48 ++++
 12 files changed, 474 insertions(+), 66 deletions(-)
 create mode 100644 packages/next-wxt/test/user-mcp-scripts/pack.test.ts
 create mode 100644 packages/next-wxt/user-mcp-scripts/pack.ts

diff --git a/docs/ai-extension/next-wxt.md b/docs/ai-extension/next-wxt.md
index 07d42d71..7eb82453 100644
--- a/docs/ai-extension/next-wxt.md
+++ b/docs/ai-extension/next-wxt.md
@@ -22,7 +22,7 @@
    - **源码**：纯 JS，在页面 MAIN world 调用 `document.modelContext.registerTool`
    - **启用** / **覆盖内置**（可选）
 3. 保存后，匹配的标签页会自动刷新并注入脚本；工具出现在侧栏「浏览器内置工具」中。
-4. 支持 JSON 导入/导出备份。
+4. 支持 zip 导入/导出备份（解压后即为 `mcp-servers/<host>/{index.ts,meta.ts}`，与源码内置格式一致；兼容旧版 JSON）。
 
 默认模板已包含幂等防护。示例片段：
 
diff --git a/packages/next-wxt/components.d.ts b/packages/next-wxt/components.d.ts
index ca191ffe..91d54eb3 100644
--- a/packages/next-wxt/components.d.ts
+++ b/packages/next-wxt/components.d.ts
@@ -9,21 +9,6 @@ declare module 'vue' {
   export interface GlobalComponents {
     RouterLink: typeof import('vue-router')['RouterLink']
     RouterView: typeof import('vue-router')['RouterView']
-    TinyAlert: typeof import('@opentiny/vue-alert')['default']
-    TinyButton: typeof import('@opentiny/vue-button')['default']
-    TinyCollapse: typeof import('@opentiny/vue-collapse')['default']
-    TinyCollapseItem: typeof import('@opentiny/vue-collapse-item')['default']
-    TinyFormItem: typeof import('@opentiny/vue-form-item')['default']
-    TinyInput: typeof import('@opentiny/vue-input')['default']
-    TinyModal: typeof import('@opentiny/vue-modal')['default']
-    TinyRadio: typeof import('@opentiny/vue-radio')['default']
-    TinySelect: typeof import('@opentiny/vue-select')['default']
-    TinySwitch: typeof import('@opentiny/vue-switch')['default']
-    TinyTabItem: typeof import('@opentiny/vue-tab-item')['default']
-    TinyTabs: typeof import('@opentiny/vue-tabs')['default']
-    TinyTag: typeof import('@opentiny/vue-tag')['default']
-    TinyTooltip: typeof import('@opentiny/vue-tooltip')['default']
-    TinyTree: typeof import('@opentiny/vue-tree')['default']
     VanIcon: typeof import('vant/es')['Icon']
   }
 }
diff --git a/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue b/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
index 27565f6c..ed70cc06 100644
--- a/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
+++ b/packages/next-wxt/entrypoints/options/UserMcpScriptsTab.vue
@@ -22,7 +22,8 @@ import {
   upsertUserMcpScript,
   removeUserMcpScript,
   setUserMcpScriptEnabled,
-  exportUserMcpScriptsJson,
+  exportUserMcpScriptsZip,
+  importUserMcpScriptsZip,
   importUserMcpScriptsJson,
   validateMatchPatterns,
   createDefaultScriptMeta,
@@ -348,12 +349,11 @@ async function downloadBackup() {
     Message.message({ message: '暂无脚本可导出', status: 'warning' })
     return
   }
-  const json = exportUserMcpScriptsJson(scripts.value)
-  const blob = new Blob([json], { type: 'application/json' })
+  const blob = await exportUserMcpScriptsZip(scripts.value)
   const url = URL.createObjectURL(blob)
   const a = document.createElement('a')
   a.href = url
-  a.download = `user-mcp-scripts-${new Date().toISOString().slice(0, 10)}.json`
+  a.download = `mcp-servers-${new Date().toISOString().slice(0, 10)}.zip`
   document.body.appendChild(a)
   a.click()
   a.remove()
@@ -369,13 +369,18 @@ async function handleImportFile(event: Event) {
   const file = input.files?.[0]
   input.value = ''
   if (!file) return
-  if (!file.name.toLowerCase().endsWith('.json')) {
-    Message.message({ message: '请选择 .json 备份文件', status: 'warning' })
-    return
-  }
+  const lower = file.name.toLowerCase()
   try {
-    const text = await file.text()
-    const result = await importUserMcpScriptsJson(text)
+    let result: { ok: true; imported: number; skipped: number } | { ok: false; error: string }
+    if (lower.endsWith('.zip')) {
+      result = await importUserMcpScriptsZip(await file.arrayBuffer())
+    } else if (lower.endsWith('.json')) {
+      // 兼容旧版 JSON 备份
+      result = await importUserMcpScriptsJson(await file.text())
+    } else {
+      Message.message({ message: '请选择 .zip（mcp-servers 目录）备份文件', status: 'warning' })
+      return
+    }
     if (!result.ok) {
       Message.message({ message: result.error, status: 'error' })
       return
@@ -439,7 +444,8 @@ onMounted(loadScripts)
       <div class="page-header-text">
         <p class="page-desc">
           在线编辑页面 WebMCP 脚本：左侧管理列表，右侧编辑源码。用
-          <code>@match</code> 匹配站点并注册 <code>document.modelContext</code> 工具。
+          <code>@match</code> 匹配站点并注册 <code>document.modelContext</code> 工具。导入/导出为
+          <code>mcp-servers</code> 目录结构的 zip（与源码内置格式一致）。
         </p>
       </div>
       <div class="page-header-actions">
@@ -464,7 +470,7 @@ onMounted(loadScripts)
         <input
           ref="importInputRef"
           type="file"
-          accept=".json,application/json"
+          accept=".zip,application/zip,.json,application/json"
           class="hidden-input"
           @change="handleImportFile"
         />
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
index 52ca5d94..3e2618f4 100644
--- a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
@@ -51,6 +51,8 @@ export const USER_MCP_SCRIPTS_KEY = 'local:user-mcp-scripts'
 | `shouldSkipBuiltIn(store, url)` | 新增 | 任一匹配脚本 `replacesBuiltIn` 则为 true |
 | `get/set/upsert/removeUserMcpScript*` | 新增 | storage CRUD |
 | `createDefaultScriptTemplate()` | 新增 | 默认 JS 模板 |
+| `exportUserMcpScriptsZip` / `importUserMcpScriptsZip` | 新增 | 与 `mcp-servers/<host>/{index,meta}.ts` 一致的 zip；主导入导出路径 |
+| `export/importUserMcpScriptsJson` | 保留 | 兼容旧备份；UI 主路径改为 zip |
 | content 注入顺序 | 修改 | runtime → 用户脚本 →（可选）内置 → `page-tools-injected` |
 | Options Tab「页面 MCP 脚本」 | 新增 | 在线管理 |
 
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
index 492e44b4..972b90fc 100644
--- a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
@@ -35,7 +35,7 @@
 ### In Scope
 
 - 独立模块 `user-mcp-scripts/`（types / storage / match / resolve / template）
-- Options Tab：CRUD、启用开关、编辑源码、JSON 导入导出
+- Options Tab：CRUD、启用开关、编辑源码、mcp-servers 目录 zip 导入导出（兼容旧 JSON）
 - background `scripting.executeScript` MAIN world 注入
 - content 薄钩子：请求注入 + 按 resolve 跳过内置
 - 保存后对匹配 tab 重新注入并通知工具列表刷新
@@ -59,8 +59,8 @@
 3. 作为用户，我希望设置 `replacesBuiltIn`，以便覆盖同页内置域名工具。
    - 验收：匹配且 `replacesBuiltIn: true` 时不注入 `mcp-servers/<hostname>/index.js`。
 
-4. 作为用户，我希望导入/导出脚本备份，以便迁移或分享。
-   - 验收：JSON 导出再导入后列表与字段一致。
+4. 作为用户，我希望导入/导出脚本备份，以便迁移或分享，并与源码 `mcp-servers` 目录格式统一。
+   - 验收：导出 zip 解压为 `<folder>/index.ts` + `<folder>/meta.ts`；可导入同结构或内置 mcp-servers 目录 zip；旧版 JSON 仍可导入。
 
 5. 作为开发者，模块边界清晰，不与 skills / 市场 MCP / mcpServer 代理业务耦合。
    - 验收：核心逻辑仅在 `user-mcp-scripts/`；content/background/Options 仅薄适配。
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
index c6497cbc..0e551c63 100644
--- a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
@@ -18,12 +18,16 @@
 
 - [x] Task 4: Options `UserMcpScriptsTab`
   - 产物：`entrypoints/options/UserMcpScriptsTab.vue`、改 `Options.vue`
-  - 能力：列表 / 启用 / CRUD / JSON 导入导出 / 保存 reinject
+  - 能力：列表 / 启用 / CRUD / mcp-servers zip 导入导出 / 保存 reinject
 
 - [x] Task 5: 用户文档与验收
   - 产物：更新 `docs/ai-extension/next-wxt.md`
   - 验收命令见下
 
+- [x] Task 6: 导入导出对齐 mcp-servers 目录格式
+  - 产物：`user-mcp-scripts/pack.ts`、storage zip API、Options 改 zip、文档与 Spec
+  - [x] 测试：`packages/next-wxt/test/user-mcp-scripts/pack.test.ts`
+
 ## 依赖顺序
 
 1 → 2 → 3 → 4 → 5
@@ -40,4 +44,4 @@ pnpm -F @opentiny/next-wxt test
 2. 打开 example.com，侧栏「浏览器内置工具」出现新工具
 3. 关闭 enabled，刷新页面，工具消失
 4. 对内置站（如 `www.baidu.com`）建脚本并勾选 `replacesBuiltIn`，确认内置 `baidu-search` 不再注入、用户工具存在
-5. JSON 导出再导入，列表一致
+5. zip 导出再导入（或导入内置 mcp-servers 目录打包），列表一致且默认禁用
diff --git a/packages/next-wxt/test/user-mcp-scripts/match.test.ts b/packages/next-wxt/test/user-mcp-scripts/match.test.ts
index 897cc7c4..e76ac69c 100644
--- a/packages/next-wxt/test/user-mcp-scripts/match.test.ts
+++ b/packages/next-wxt/test/user-mcp-scripts/match.test.ts
@@ -11,7 +11,10 @@ describe('validateMatchPattern', () => {
     expect(validateMatchPattern('*://example.com/*').ok).toBe(true)
     expect(validateMatchPattern('*://*.example.com/*').ok).toBe(true)
     expect(validateMatchPattern('https://www.baidu.com/*').ok).toBe(true)
-    expect(validateMatchPattern('http://localhost:5173/*').ok).toBe(true)
+  })
+
+  it('拒绝 host 含端口', () => {
+    expect(validateMatchPattern('http://localhost:5173/*').ok).toBe(false)
   })
 
   it('拒绝空或非法模式', () => {
diff --git a/packages/next-wxt/test/user-mcp-scripts/pack.test.ts b/packages/next-wxt/test/user-mcp-scripts/pack.test.ts
new file mode 100644
index 00000000..98531791
--- /dev/null
+++ b/packages/next-wxt/test/user-mcp-scripts/pack.test.ts
@@ -0,0 +1,159 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest'
+import JSZip from 'jszip'
+
+const memory = new Map<string, unknown>()
+
+vi.mock('@wxt-dev/storage', () => ({
+  storage: {
+    getItem: async (key: string) => memory.get(key),
+    setItem: async (key: string, value: unknown) => {
+      memory.set(key, value)
+    }
+  }
+}))
+
+import {
+  exportUserMcpScriptsZip,
+  importUserMcpScriptsZip,
+  importUserMcpScriptsJson,
+  upsertUserMcpScript,
+  listUserMcpScripts,
+  removeUserMcpScript,
+  parseMetaModule,
+  serializeMetaTs,
+  hostHintFromMatch,
+  folderNameForScript,
+  parseUserMcpScriptsZip
+} from '../../user-mcp-scripts'
+import type { UserMcpScript } from '../../user-mcp-scripts'
+
+describe('user-mcp-scripts mcp-servers zip 打包', () => {
+  beforeEach(() => {
+    memory.clear()
+  })
+
+  it('hostHintFromMatch 提取目录名提示', () => {
+    expect(hostHintFromMatch('*://www.baidu.com/*')).toBe('www.baidu.com')
+    expect(hostHintFromMatch('https://excalidraw.com/')).toBe('excalidraw.com')
+    expect(hostHintFromMatch('*://*.example.com/*')).toBe('example.com')
+  })
+
+  it('serialize/parse meta.ts 往返', () => {
+    const text = serializeMetaTs({
+      name: 'www.baidu.com',
+      description: '百度',
+      matches: ['*://www.baidu.com/*'],
+      enabled: true,
+      replacesBuiltIn: false,
+      id: 'abc'
+    })
+    expect(text).toContain('export default')
+    const meta = parseMetaModule(text)
+    expect(meta?.name).toBe('www.baidu.com')
+    expect(meta?.matches).toEqual(['*://www.baidu.com/*'])
+    expect(meta?.id).toBe('abc')
+  })
+
+  it('可解析内置 mcp-servers 单引号 meta.ts', () => {
+    const meta = parseMetaModule(`export default {
+  name: 'www.baidu.com',
+  description: '百度搜索页面工具集'
+}`)
+    expect(meta?.name).toBe('www.baidu.com')
+    expect(meta?.description).toContain('百度')
+  })
+
+  it('导出 zip 为 <folder>/index.ts + meta.ts，导入后字段一致（默认禁用）', async () => {
+    const created = await upsertUserMcpScript({
+      name: '导出测试',
+      description: 'd',
+      matches: ['*://a.com/*'],
+      enabled: true,
+      replacesBuiltIn: true,
+      source: '// hello'
+    })
+    expect(created.ok).toBe(true)
+    if (!created.ok) return
+
+    const blob = await exportUserMcpScriptsZip(await listUserMcpScripts())
+    const parsed = await parseUserMcpScriptsZip(await blob.arrayBuffer())
+    expect(parsed.ok).toBe(true)
+    if (!parsed.ok) return
+    expect(parsed.entries).toHaveLength(1)
+    expect(parsed.entries[0].folder).toBe('a.com')
+    expect(parsed.entries[0].source).toBe('// hello')
+    expect(parsed.entries[0].meta.replacesBuiltIn).toBe(true)
+
+    await removeUserMcpScript(created.script.id)
+    const imported = await importUserMcpScriptsZip(await blob.arrayBuffer())
+    expect(imported.ok).toBe(true)
+    if (!imported.ok) return
+    expect(imported.imported).toBe(1)
+
+    const again = await listUserMcpScripts()
+    expect(again[0]?.name).toBe('导出测试')
+    expect(again[0]?.replacesBuiltIn).toBe(true)
+    expect(again[0]?.source).toBe('// hello')
+    expect(again[0]?.enabled).toBe(false)
+  })
+
+  it('可导入纯 mcp-servers 风格 zip（无 matches 时按目录名补全）', async () => {
+    const zip = new JSZip()
+    zip.file(
+      'www.baidu.com/meta.ts',
+      `export default {
+  name: 'www.baidu.com',
+  description: '百度搜索页面工具集，由插件注入到 www.baidu.com 页面执行'
+}
+`
+    )
+    zip.file('www.baidu.com/index.ts', 'document.modelContext.registerTool({ name: "baidu-search" })')
+    const buf = await zip.generateAsync({ type: 'arraybuffer' })
+
+    const imported = await importUserMcpScriptsZip(buf)
+    expect(imported.ok).toBe(true)
+    if (!imported.ok) return
+    expect(imported.imported).toBe(1)
+
+    const list = await listUserMcpScripts()
+    expect(list[0]?.name).toBe('www.baidu.com')
+    expect(list[0]?.matches).toEqual(['*://www.baidu.com/*'])
+    expect(list[0]?.source).toContain('baidu-search')
+    expect(list[0]?.enabled).toBe(false)
+  })
+
+  it('folderNameForScript 冲突时追加序号', () => {
+    const used = new Set<string>()
+    const a: UserMcpScript = {
+      id: '1',
+      name: 'A',
+      matches: ['*://same.com/*'],
+      enabled: true,
+      replacesBuiltIn: false,
+      source: '1',
+      updatedAt: 1
+    }
+    const b = { ...a, id: '2', name: 'B' }
+    expect(folderNameForScript(a, used)).toBe('same.com')
+    expect(folderNameForScript(b, used)).toBe('same.com-2')
+  })
+
+  it('仍兼容旧版 JSON 导入', async () => {
+    const json = JSON.stringify([
+      {
+        id: 'legacy-1',
+        name: '旧备份',
+        matches: ['*://legacy.com/*'],
+        enabled: true,
+        replacesBuiltIn: false,
+        source: '1+1',
+        updatedAt: 1
+      }
+    ])
+    const imported = await importUserMcpScriptsJson(json)
+    expect(imported.ok).toBe(true)
+    if (!imported.ok) return
+    expect(imported.imported).toBe(1)
+    expect((await listUserMcpScripts())[0]?.enabled).toBe(false)
+  })
+})
diff --git a/packages/next-wxt/test/user-mcp-scripts/storage.test.ts b/packages/next-wxt/test/user-mcp-scripts/storage.test.ts
index 14207f74..1485cb15 100644
--- a/packages/next-wxt/test/user-mcp-scripts/storage.test.ts
+++ b/packages/next-wxt/test/user-mcp-scripts/storage.test.ts
@@ -13,12 +13,8 @@ vi.mock('@wxt-dev/storage', () => ({
 
 import {
   USER_MCP_SCRIPTS_KEY,
-  exportUserMcpScriptsJson,
-  importUserMcpScriptsJson,
   upsertUserMcpScript,
-  getUserMcpScriptsStore,
-  listUserMcpScripts,
-  removeUserMcpScript
+  getUserMcpScriptsStore
 } from '../../user-mcp-scripts'
 
 describe('user-mcp-scripts storage', () => {
@@ -49,31 +45,4 @@ describe('user-mcp-scripts storage', () => {
     expect(store[ok.script.id]?.name).toBe('ok')
     expect(memory.has(USER_MCP_SCRIPTS_KEY)).toBe(true)
   })
-
-  it('导出再导入保持关键字段', async () => {
-    const created = await upsertUserMcpScript({
-      name: '导出测试',
-      description: 'd',
-      matches: ['*://a.com/*'],
-      enabled: true,
-      replacesBuiltIn: true,
-      source: '// hello'
-    })
-    expect(created.ok).toBe(true)
-    if (!created.ok) return
-
-    const json = exportUserMcpScriptsJson(await listUserMcpScripts())
-    await removeUserMcpScript(created.script.id)
-    expect(await listUserMcpScripts()).toEqual([])
-
-    const imported = await importUserMcpScriptsJson(json)
-    expect(imported.ok).toBe(true)
-    if (!imported.ok) return
-    expect(imported.imported).toBe(1)
-
-    const again = await listUserMcpScripts()
-    expect(again[0]?.name).toBe('导出测试')
-    expect(again[0]?.replacesBuiltIn).toBe(true)
-    expect(again[0]?.source).toBe('// hello')
-  })
 })
diff --git a/packages/next-wxt/user-mcp-scripts/index.ts b/packages/next-wxt/user-mcp-scripts/index.ts
index dd00ab0a..994c4ffb 100644
--- a/packages/next-wxt/user-mcp-scripts/index.ts
+++ b/packages/next-wxt/user-mcp-scripts/index.ts
@@ -8,6 +8,16 @@ export * from './match'
 export * from './resolve'
 export * from './template'
 export * from './exec-bridge'
+export {
+  exportUserMcpScriptsZip,
+  parseUserMcpScriptsZip,
+  parseMetaModule,
+  serializeMetaTs,
+  folderNameForScript,
+  hostHintFromMatch,
+  type PackMeta,
+  type PackedScriptEntry
+} from './pack'
 export {
   getUserMcpScriptsStore,
   setUserMcpScriptsStore,
@@ -18,5 +28,6 @@ export {
   createUserMcpScriptFromTemplate,
   exportUserMcpScriptsJson,
   importUserMcpScriptsJson,
+  importUserMcpScriptsZip,
   type UpsertResult
 } from './storage'
diff --git a/packages/next-wxt/user-mcp-scripts/pack.ts b/packages/next-wxt/user-mcp-scripts/pack.ts
new file mode 100644
index 00000000..25a877c7
--- /dev/null
+++ b/packages/next-wxt/user-mcp-scripts/pack.ts
@@ -0,0 +1,221 @@
+/**
+ * 用户 MCP 脚本 ↔ mcp-servers 目录格式（zip）打包
+ *
+ * 与源码内置结构对齐：
+ *   <folder>/index.ts
+ *   <folder>/meta.ts   // export default { name, description, ... }
+ *
+ * 行为对齐 Skills：导出 zip 解压即文件夹；导入 zip 写回 storage。
+ */
+
+import JSZip from 'jszip'
+import type { UserMcpScript } from './types'
+
+export type PackMeta = {
+  name: string
+  description?: string
+  matches?: string[]
+  enabled?: boolean
+  replacesBuiltIn?: boolean
+  id?: string
+}
+
+export type PackedScriptEntry = {
+  folder: string
+  source: string
+  meta: PackMeta
+}
+
+/** 从 @match 提取可用作目录名的 host 提示 */
+export function hostHintFromMatch(pattern: string): string | null {
+  const p = (pattern || '').trim()
+  if (!p) return null
+  // *://www.baidu.com/*  |  https://excalidraw.com/foo  |  *://*.example.com/*
+  const m = p.match(/^(?:\*|https?):\/{0,2}([^/]+)/i)
+  if (!m) return null
+  let host = m[1]
+  // 去掉端口（目录名不含端口）
+  host = host.replace(/:\d+$/, '')
+  if (host.startsWith('*.')) host = host.slice(2)
+  if (!host || host.includes('*') || host.includes(':')) return null
+  return host
+}
+
+export function sanitizeFolderName(raw: string): string {
+  const s = (raw || '')
+    .trim()
+    .replace(/[^a-zA-Z0-9._-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 80)
+  return s || 'script'
+}
+
+/**
+ * 为脚本分配唯一目录名（优先 match host，其次 name）
+ */
+export function folderNameForScript(script: UserMcpScript, used: Set<string>): string {
+  const fromMatch = script.matches?.map(hostHintFromMatch).find(Boolean)
+  const base = sanitizeFolderName(fromMatch || script.name || script.id)
+  let name = base
+  let n = 2
+  while (used.has(name)) {
+    name = `${base}-${n++}`
+  }
+  used.add(name)
+  return name
+}
+
+/** 生成与 mcp-servers 一致的 meta.ts 文本 */
+export function serializeMetaTs(meta: PackMeta): string {
+  const body: Record<string, unknown> = {
+    name: meta.name
+  }
+  if (meta.description) body.description = meta.description
+  if (meta.matches?.length) body.matches = meta.matches
+  if (typeof meta.enabled === 'boolean') body.enabled = meta.enabled
+  if (typeof meta.replacesBuiltIn === 'boolean') body.replacesBuiltIn = meta.replacesBuiltIn
+  if (meta.id) body.id = meta.id
+  return `export default ${JSON.stringify(body, null, 2)}\n`
+}
+
+/**
+ * 解析 meta.ts / meta.js（export default { ... }）或纯 JSON
+ */
+export function parseMetaModule(content: string): PackMeta | null {
+  const trimmed = (content || '').trim()
+  if (!trimmed) return null
+
+  const tryObject = (raw: string): PackMeta | null => {
+    try {
+      const value = new Function(`"use strict"; return (${raw});`)()
+      if (!value || typeof value !== 'object' || Array.isArray(value)) return null
+      const name = typeof value.name === 'string' ? value.name : undefined
+      if (!name) return null
+      return {
+        name,
+        description: typeof value.description === 'string' ? value.description : undefined,
+        matches: Array.isArray(value.matches) ? value.matches.map(String) : undefined,
+        enabled: typeof value.enabled === 'boolean' ? value.enabled : undefined,
+        replacesBuiltIn:
+          typeof value.replacesBuiltIn === 'boolean' ? value.replacesBuiltIn : undefined,
+        id: typeof value.id === 'string' ? value.id : undefined
+      }
+    } catch {
+      return null
+    }
+  }
+
+  if (trimmed.startsWith('{')) {
+    try {
+      const obj = JSON.parse(trimmed)
+      if (!obj || typeof obj !== 'object' || Array.isArray(obj) || typeof obj.name !== 'string') {
+        return null
+      }
+      return {
+        name: obj.name,
+        description: typeof obj.description === 'string' ? obj.description : undefined,
+        matches: Array.isArray(obj.matches) ? obj.matches.map(String) : undefined,
+        enabled: typeof obj.enabled === 'boolean' ? obj.enabled : undefined,
+        replacesBuiltIn:
+          typeof obj.replacesBuiltIn === 'boolean' ? obj.replacesBuiltIn : undefined,
+        id: typeof obj.id === 'string' ? obj.id : undefined
+      }
+    } catch {
+      return tryObject(trimmed)
+    }
+  }
+
+  const m = trimmed.match(/export\s+default\s+([\s\S]+?)\s*;?\s*$/)
+  if (m) return tryObject(m[1])
+  return null
+}
+
+function normalizeZipEntryPath(zipPath: string): string | null {
+  let p = zipPath.replace(/\\/g, '/')
+  if (p.includes('..') || p.startsWith('/')) return null
+  p = p.replace(/^\.\//, '')
+  // 允许用户直接压缩整个 mcp-servers 目录
+  if (p.startsWith('mcp-servers/')) p = p.slice('mcp-servers/'.length)
+  if (!p || p === 'index.ts' || p === 'types.d.ts' || p.endsWith('/')) return null
+  return p
+}
+
+/**
+ * 将脚本列表打包为 mcp-servers 目录结构的 zip Blob
+ */
+export async function exportUserMcpScriptsZip(scripts: UserMcpScript[]): Promise<Blob> {
+  const zip = new JSZip()
+  const used = new Set<string>()
+  for (const script of scripts) {
+    const folder = folderNameForScript(script, used)
+    zip.file(
+      `${folder}/meta.ts`,
+      serializeMetaTs({
+        name: script.name,
+        description: script.description,
+        matches: script.matches,
+        enabled: script.enabled,
+        replacesBuiltIn: script.replacesBuiltIn,
+        id: script.id
+      })
+    )
+    zip.file(`${folder}/index.ts`, script.source)
+  }
+  return zip.generateAsync({ type: 'blob' })
+}
+
+/**
+ * 从 zip 解析出 mcp-servers 风格条目（不写 storage）
+ */
+export async function parseUserMcpScriptsZip(
+  data: ArrayBuffer | Blob | Uint8Array
+): Promise<{ ok: true; entries: PackedScriptEntry[] } | { ok: false; error: string }> {
+  let loaded: JSZip
+  try {
+    loaded = await JSZip.loadAsync(data)
+  } catch {
+    return { ok: false, error: '无法读取 zip 文件' }
+  }
+
+  const byFolder = new Map<string, { meta?: string; index?: string }>()
+  const fileEntries = Object.entries(loaded.files).filter(([, z]) => !z.dir)
+
+  for (const [zipPath, zipObj] of fileEntries) {
+    const normalized = normalizeZipEntryPath(zipPath)
+    if (!normalized) continue
+    const parts = normalized.split('/')
+    if (parts.length !== 2) continue
+    const [folder, file] = parts
+    if (!folder || !file) continue
+    const lower = file.toLowerCase()
+    const bucket = byFolder.get(folder) || {}
+    if (lower === 'meta.ts' || lower === 'meta.js' || lower === 'meta.json') {
+      bucket.meta = await zipObj.async('string')
+    } else if (lower === 'index.ts' || lower === 'index.js') {
+      bucket.index = await zipObj.async('string')
+    }
+    byFolder.set(folder, bucket)
+  }
+
+  const entries: PackedScriptEntry[] = []
+  for (const [folder, files] of byFolder) {
+    if (files.index == null || !(files.index || '').trim()) continue
+    let meta: PackMeta | null = files.meta ? parseMetaModule(files.meta) : null
+    if (!meta) {
+      // 内置 mcp-servers 风格：仅有 index，用目录名补全
+      meta = { name: folder, description: undefined }
+    }
+    if (!meta.matches?.length) {
+      meta = {
+        ...meta,
+        matches: [`*://${folder}/*`]
+      }
+    }
+    entries.push({ folder, source: files.index, meta })
+  }
+
+  if (!entries.length) {
+    return { ok: false, error: '压缩包中未找到合法的 mcp-servers 目录（需含 */index.ts 与可选 meta.ts）' }
+  }
+  return { ok: true, entries }
+}
diff --git a/packages/next-wxt/user-mcp-scripts/storage.ts b/packages/next-wxt/user-mcp-scripts/storage.ts
index 1524a5af..17976fa2 100644
--- a/packages/next-wxt/user-mcp-scripts/storage.ts
+++ b/packages/next-wxt/user-mcp-scripts/storage.ts
@@ -5,6 +5,7 @@
 import { storage } from '@wxt-dev/storage'
 import { validateMatchPatterns } from './match'
 import { createDefaultScriptMeta } from './template'
+import { parseUserMcpScriptsZip } from './pack'
 import type { UserMcpScript, UserMcpScriptInput, UserMcpScriptsStore } from './types'
 import { USER_MCP_SCRIPTS_KEY } from './types'
 
@@ -157,6 +158,7 @@ export function exportUserMcpScriptsJson(scripts: UserMcpScript[]): string {
 /**
  * 从 JSON 导入（合并到现有 store；同 id 覆盖）。
  * 导入项一律先禁用，需用户审阅后手动启用。
+ * @deprecated 主路径已改为 mcp-servers 目录 zip；保留以兼容旧备份。
  */
 export async function importUserMcpScriptsJson(json: string): Promise<
   | { ok: true; imported: number; skipped: number }
@@ -200,3 +202,49 @@ export async function importUserMcpScriptsJson(json: string): Promise<
     return { ok: true, imported, skipped }
   })
 }
+
+/**
+ * 从 mcp-servers 风格 zip 导入（合并；同 id 覆盖）。
+ * 导入项一律先禁用。缺 matches 时按目录名生成 `*://<folder>/*`。
+ */
+export async function importUserMcpScriptsZip(
+  data: ArrayBuffer | Blob | Uint8Array
+): Promise<{ ok: true; imported: number; skipped: number } | { ok: false; error: string }> {
+  const parsed = await parseUserMcpScriptsZip(data)
+  if (!parsed.ok) return parsed
+
+  return withStoreLock(async () => {
+    const store = await getUserMcpScriptsStore()
+    let imported = 0
+    let skipped = 0
+    for (const entry of parsed.entries) {
+      const id =
+        (typeof entry.meta.id === 'string' && entry.meta.id) ||
+        `ums_${entry.folder.replace(/[^a-zA-Z0-9._-]/g, '_')}`
+      const matches = entry.meta.matches?.length ? entry.meta.matches : [`*://${entry.folder}/*`]
+      const matchCheck = validateMatchPatterns(matches)
+      if (!matchCheck.ok) {
+        skipped++
+        continue
+      }
+      const name = (entry.meta.name || entry.folder).trim()
+      if (!name || !(entry.source || '').trim()) {
+        skipped++
+        continue
+      }
+      store[id] = {
+        id,
+        name,
+        description: entry.meta.description,
+        matches,
+        enabled: false,
+        replacesBuiltIn: Boolean(entry.meta.replacesBuiltIn),
+        source: entry.source,
+        updatedAt: Date.now()
+      }
+      imported++
+    }
+    await setUserMcpScriptsStore(store)
+    return { ok: true, imported, skipped }
+  })
+}

From 6776ff5f0f481b7a1b91703b2f4e87824a1af6b8 Mon Sep 17 00:00:00 2001
From: zzcr <894103554@qq.com>
Date: Thu, 30 Jul 2026 17:19:53 +0800
Subject: [PATCH 5/5] feat: implement capability token for user MCP script
 execution bridge to enhance security and prevent spoofing

---
 docs/ai-extension/next-wxt.md                 |  2 +-
 packages/next-wxt/components.d.ts             | 15 +++
 packages/next-wxt/entrypoints/background.ts   |  9 +-
 .../background/inject-user-mcp-scripts.ts     | 87 ++++++++++++++--
 packages/next-wxt/entrypoints/content.ts      |  6 +-
 packages/next-wxt/mcp-servers/types.d.ts      |  8 +-
 .../next-wxt/public/vendor/user-mcp-exec.js   | 95 +++++++++++++-----
 .../REQ-20260730-user-mcp-scripts/design.md   |  1 +
 .../requirements.md                           |  2 +
 .../REQ-20260730-user-mcp-scripts/tasks.md    |  7 +-
 .../user-mcp-scripts/csp-bridge-repro.test.ts | 99 ++++++++++++++++---
 .../next-wxt/user-mcp-scripts/exec-bridge.ts  | 43 ++++++--
 packages/next-wxt/user-mcp-scripts/index.ts   |  9 +-
 packages/next-wxt/wxt.config.ts               |  1 +
 14 files changed, 318 insertions(+), 66 deletions(-)

diff --git a/docs/ai-extension/next-wxt.md b/docs/ai-extension/next-wxt.md
index 7eb82453..9743c2e4 100644
--- a/docs/ai-extension/next-wxt.md
+++ b/docs/ai-extension/next-wxt.md
@@ -137,4 +137,4 @@ export default {
 3. **参数描述要清晰**：`description` 与 `inputSchema` 是大模型判断是否使用工具以及如何传参的**唯一依据**，务必描述详尽。
 4. **宽泛 @match + 覆盖内置**：例如 `*://*/*` 且开启「覆盖内置」会跳过所有内置域名工具，请谨慎使用。
 5. **幂等注册**：重复注入时应用全局标记或同名覆盖策略，避免重复注册异常。
-6. **严格 CSP 站点**（如京东）：用户脚本经扩展桥 `vendor/user-mcp-exec.js` 执行，勿依赖页面内 `eval`；保存后请刷新目标页再查看「浏览器内置工具」。
+6. **严格 CSP 站点**（如京东）：用户脚本经扩展桥 `vendor/user-mcp-exec.js`（background bind 能力令牌后执行）注入，勿依赖页面内 `eval`；保存后请刷新目标页再查看「浏览器内置工具」。
diff --git a/packages/next-wxt/components.d.ts b/packages/next-wxt/components.d.ts
index 91d54eb3..ca191ffe 100644
--- a/packages/next-wxt/components.d.ts
+++ b/packages/next-wxt/components.d.ts
@@ -9,6 +9,21 @@ declare module 'vue' {
   export interface GlobalComponents {
     RouterLink: typeof import('vue-router')['RouterLink']
     RouterView: typeof import('vue-router')['RouterView']
+    TinyAlert: typeof import('@opentiny/vue-alert')['default']
+    TinyButton: typeof import('@opentiny/vue-button')['default']
+    TinyCollapse: typeof import('@opentiny/vue-collapse')['default']
+    TinyCollapseItem: typeof import('@opentiny/vue-collapse-item')['default']
+    TinyFormItem: typeof import('@opentiny/vue-form-item')['default']
+    TinyInput: typeof import('@opentiny/vue-input')['default']
+    TinyModal: typeof import('@opentiny/vue-modal')['default']
+    TinyRadio: typeof import('@opentiny/vue-radio')['default']
+    TinySelect: typeof import('@opentiny/vue-select')['default']
+    TinySwitch: typeof import('@opentiny/vue-switch')['default']
+    TinyTabItem: typeof import('@opentiny/vue-tab-item')['default']
+    TinyTabs: typeof import('@opentiny/vue-tabs')['default']
+    TinyTag: typeof import('@opentiny/vue-tag')['default']
+    TinyTooltip: typeof import('@opentiny/vue-tooltip')['default']
+    TinyTree: typeof import('@opentiny/vue-tree')['default']
     VanIcon: typeof import('vant/es')['Icon']
   }
 }
diff --git a/packages/next-wxt/entrypoints/background.ts b/packages/next-wxt/entrypoints/background.ts
index 97a313ea..18d64f50 100644
--- a/packages/next-wxt/entrypoints/background.ts
+++ b/packages/next-wxt/entrypoints/background.ts
@@ -3,7 +3,8 @@ import { tabHistory } from './background/tab-history'
 import {
   injectUserMcpScriptsForTab,
   reloadTabsByMatchesSnapshot,
-  reinjectAfterUserMcpScriptsChange
+  reinjectAfterUserMcpScriptsChange,
+  clearUserMcpBridgeToken
 } from './background/inject-user-mcp-scripts'
 
 export default defineBackground(() => {
@@ -20,6 +21,12 @@ export default defineBackground(() => {
       })
   }, 0)
 
+  // 页面导航 / 关闭后丢弃 capability，避免跨文档复用
+  browser.tabs.onRemoved.addListener((tabId) => clearUserMcpBridgeToken(tabId))
+  browser.tabs.onUpdated.addListener((tabId, changeInfo) => {
+    if (changeInfo.status === 'loading') clearUserMcpBridgeToken(tabId)
+  })
+
   // ─────────────────────────────────────────
   // 消息处理（需要返回值的使用原生 onMessage）
   // ─────────────────────────────────────────
diff --git a/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts b/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
index 8d366567..7cace6ef 100644
--- a/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
+++ b/packages/next-wxt/entrypoints/background/inject-user-mcp-scripts.ts
@@ -4,6 +4,8 @@
  *
  * 注意：不可在 executeScript 回调内直接 new Function(源码)——会受页面 CSP 拦截
  * （复现：京东等站只剩 page-agent-tool）。须调用 chrome-extension 桥。
+ *
+ * 能力令牌：先 bind(token) 再 exec(code, token)；token 仅存于 background（及桥闭包）。
  */
 
 import {
@@ -11,8 +13,9 @@ import {
   resolveMatchingScripts,
   shouldSkipBuiltIn,
   matchAny,
+  USER_MCP_BIND_BRIDGE_NAME,
   USER_MCP_EXEC_BRIDGE_NAME,
-  USER_MCP_EXEC_BRIDGE_OWNER,
+  createUserMcpBridgeToken,
   type UserMcpScript,
   type BridgeExecResult
 } from '@/user-mcp-scripts'
@@ -24,23 +27,72 @@ export type InjectUserMcpResult = {
   error?: string
 }
 
+/** tabId → capability token（页面刷新 / tab 关闭后失效） */
+const tabBridgeTokens = new Map<number, string>()
+
+export function clearUserMcpBridgeToken(tabId: number): void {
+  tabBridgeTokens.delete(tabId)
+}
+
+/**
+ * 绑定（或复用）当前 tab 的执行桥 capability
+ */
+async function ensureBridgeCapability(tabId: number): Promise<
+  | { ok: true; token: string }
+  | { ok: false; error: string }
+> {
+  const cached = tabBridgeTokens.get(tabId)
+  if (cached) return { ok: true, token: cached }
+
+  const token = createUserMcpBridgeToken()
+  const bindName = USER_MCP_BIND_BRIDGE_NAME
+  const results = await browser.scripting.executeScript({
+    target: { tabId },
+    world: 'MAIN',
+    args: [bindName, token],
+    func: (installName: string, capability: string) => {
+      const install = (window as any)[installName]
+      if (typeof install !== 'function') {
+        return { ok: false, error: 'bind entry missing: ' + installName }
+      }
+      return install(capability)
+    }
+  })
+  const value = results?.[0]?.result as BridgeExecResult | undefined
+  if (!value) return { ok: false, error: 'empty bind result' }
+  if (!value.ok) {
+    if (value.locked) {
+      return {
+        ok: false,
+        error: '执行桥已被锁定且无本地 token（请刷新页面后重试）'
+      }
+    }
+    return { ok: false, error: value.error || 'bind failed' }
+  }
+  tabBridgeTokens.set(tabId, token)
+  return { ok: true, token }
+}
+
 /**
  * 通过扩展脚本桥在 MAIN world 执行用户源码（绕过页面 CSP 对 eval 的限制）
  */
-async function executeUserSourceInMainWorld(tabId: number, source: string): Promise<BridgeExecResult> {
+async function executeUserSourceInMainWorld(
+  tabId: number,
+  source: string,
+  token: string
+): Promise<BridgeExecResult> {
   const bridgeName = USER_MCP_EXEC_BRIDGE_NAME
-  const ownerKey = USER_MCP_EXEC_BRIDGE_OWNER
   const results = await browser.scripting.executeScript({
     target: { tabId },
     world: 'MAIN',
-    args: [source, bridgeName, ownerKey],
-    func: (code: string, name: string, owner: string) => {
+    args: [source, bridgeName, token],
+    func: (code: string, name: string, capability: string) => {
       const run = (window as any)[name]
-      if (typeof run !== 'function' || run[owner] !== true) {
-        console.warn('[user-mcp-scripts] 执行桥未就绪或非扩展所有:', name)
-        return { ok: false, error: 'bridge missing or hijacked: ' + name }
+      if (typeof run !== 'function') {
+        console.warn('[user-mcp-scripts] 执行桥未就绪:', name)
+        return { ok: false, error: 'bridge missing: ' + name }
       }
-      return run(code)
+      return run(code, capability)
     }
   })
   const value = results?.[0]?.result as BridgeExecResult | undefined
@@ -59,10 +111,24 @@ export async function injectUserMcpScriptsForTab(
     const store = await getUserMcpScriptsStore()
     const skip = shouldSkipBuiltIn(store, url)
     const scripts = resolveMatchingScripts(store, url)
+    if (!scripts.length) {
+      return { success: true, shouldSkipBuiltIn: skip, injectedCount: 0 }
+    }
+
+    const bound = await ensureBridgeCapability(tabId)
+    if (!bound.ok) {
+      return {
+        success: false,
+        shouldSkipBuiltIn: skip,
+        injectedCount: 0,
+        error: bound.error
+      }
+    }
+
     let injectedCount = 0
     const errors: string[] = []
     for (const script of scripts) {
-      const result = await executeUserSourceInMainWorld(tabId, script.source)
+      const result = await executeUserSourceInMainWorld(tabId, script.source, bound.token)
       if (result.ok) {
         injectedCount++
       } else {
@@ -100,6 +166,7 @@ export async function reloadTabsByMatchesSnapshot(matchesList: string[][]): Prom
     if (!/^https?:/i.test(tab.url)) continue
     if (!matchAny(flatPatterns, tab.url)) continue
     try {
+      clearUserMcpBridgeToken(tab.id)
       await browser.tabs.reload(tab.id)
       count++
     } catch {
diff --git a/packages/next-wxt/entrypoints/content.ts b/packages/next-wxt/entrypoints/content.ts
index 4442dc39..679e276b 100644
--- a/packages/next-wxt/entrypoints/content.ts
+++ b/packages/next-wxt/entrypoints/content.ts
@@ -86,6 +86,10 @@ function injectScript(path: string): Promise<void> {
 /**
  * 注入 vendor/runtime.js，再注入 register-page-agent-tool.js 与用户脚本执行桥。
  * 全部走 <script src="chrome-extension://...">，与百度/京东等严格 CSP 页面兼容。
+ *
+ * 硬约束顺序（能力令牌桥）：
+ *   runtime → register-page-agent-tool → user-mcp-exec（仅 bind 入口）
+ *   → background bind(token) → exec(code, token)
  * 注意：勿在 content script 调用 browser.scripting（该 API 仅 background/扩展页可用）。
  */
 let runtimeInjected: Promise<void> | null = null
@@ -94,7 +98,7 @@ async function injectRuntimeAndRegister(): Promise<void> {
     runtimeInjected = (async () => {
       await injectScript('vendor/runtime.js')
       await injectScript('vendor/register-page-agent-tool.js')
-      // 用户 MCP 脚本执行桥：须在 scripting.executeScript 调用前就绪
+      // 须在 background scripting.executeScript(bind/exec) 之前就绪
       await injectScript('vendor/user-mcp-exec.js')
     })()
   }
diff --git a/packages/next-wxt/mcp-servers/types.d.ts b/packages/next-wxt/mcp-servers/types.d.ts
index 2ef2155c..bb6865a4 100644
--- a/packages/next-wxt/mcp-servers/types.d.ts
+++ b/packages/next-wxt/mcp-servers/types.d.ts
@@ -14,10 +14,14 @@ declare global {
     }
     /**
      * 用户 MCP 脚本执行桥（vendor/user-mcp-exec.js）
-     * 在扩展脚本上下文执行源码，绕过页面 CSP 对 eval 的限制
+     * bind 一次性入口 + exec(code, capability) 闭包令牌校验
      */
+    __NEXT_WXT_BIND_USER_MCP_BRIDGE__?: (
+      token: string
+    ) => { ok: true } | { ok: false; error: string; locked?: boolean }
     __NEXT_WXT_EXEC_USER_MCP_SCRIPT__?: (
-      code: string
+      code: string,
+      capability: string
     ) => { ok: true } | { ok: false; error: string }
   }
 
diff --git a/packages/next-wxt/public/vendor/user-mcp-exec.js b/packages/next-wxt/public/vendor/user-mcp-exec.js
index f236e86e..096b05b0 100644
--- a/packages/next-wxt/public/vendor/user-mcp-exec.js
+++ b/packages/next-wxt/public/vendor/user-mcp-exec.js
@@ -1,42 +1,49 @@
 /**
  * 用户 MCP 脚本执行桥（经 chrome-extension:// 注入 MAIN world）
- * 在扩展脚本上下文中 new Function，避免页面 CSP 拦截
+ * 在扩展脚本上下文中 new Function，避免页面 CSP 拦截。
  *
- * 安全：不复用页面预置的同名函数；以不可写属性安装；带所有权标记供 background 校验
+ * 安全模型（能力令牌，非可伪造属性）：
+ * 1. 本文件只安装一次性 bind 入口（不执行用户源码）
+ * 2. background 经 scripting.executeScript 传入随机 capability token 调用 bind
+ * 3. bind 用闭包保存 token，安装不可配置的 exec(code, capability)；校验失败则拒绝
+ * 4. 静态标记如 __NEXT_WXT_OWNED__ 可被页面伪造，故不再使用
+ *
+ * 约定顺序（见 content.ts / wxt.config.ts）：
+ *   runtime → register-page-agent-tool → 本脚本 → background bind(token) → exec(code, token)
  */
 ;(function () {
-  var KEY = '__NEXT_WXT_EXEC_USER_MCP_SCRIPT__'
-  var OWNER = '__NEXT_WXT_OWNED__'
+  var BIND_KEY = '__NEXT_WXT_BIND_USER_MCP_BRIDGE__'
+  var EXEC_KEY = '__NEXT_WXT_EXEC_USER_MCP_SCRIPT__'
+
+  function bind(token) {
+    if (typeof token !== 'string' || token.length < 32) {
+      return { ok: false, error: 'invalid token' }
+    }
 
-  function install() {
     var existing = null
     try {
-      existing = Object.getOwnPropertyDescriptor(window, KEY)
+      existing = Object.getOwnPropertyDescriptor(window, EXEC_KEY)
     } catch (e) {
       existing = null
     }
 
-    // 页面已抢占且不可配置 → 失败关闭，绝不调用页面函数
+    // 已锁定：无法改写闭包 token（需整页刷新后由扩展重新 bind）
     if (existing && existing.configurable === false) {
-      var cur = existing.value
-      if (!cur || cur[OWNER] !== true) {
-        console.error('[user-mcp-scripts] 执行桥被页面抢占且不可覆盖，拒绝安装')
-        return
-      }
-      // 已是本扩展安装的桥
-      return
+      return { ok: false, error: 'bridge locked', locked: true }
     }
 
-    if (existing && existing.value && existing.value[OWNER] !== true) {
+    if (existing) {
       try {
-        delete window[KEY]
+        delete window[EXEC_KEY]
       } catch (e) {
-        console.error('[user-mcp-scripts] 无法移除页面伪造的执行桥')
-        return
+        return { ok: false, error: 'cannot clear forged bridge' }
       }
     }
 
-    function run(code) {
+    function run(code, capability) {
+      if (capability !== token) {
+        return { ok: false, error: 'unauthorized' }
+      }
       try {
         if (typeof code !== 'string' || !code) {
           return { ok: false, error: 'empty code' }
@@ -50,19 +57,61 @@
         return { ok: false, error: msg }
       }
     }
-    run[OWNER] = true
 
     try {
-      Object.defineProperty(window, KEY, {
+      Object.defineProperty(window, EXEC_KEY, {
         value: run,
         writable: false,
         configurable: false,
         enumerable: false
       })
     } catch (e) {
-      console.error('[user-mcp-scripts] 安装执行桥失败:', e)
+      return { ok: false, error: 'defineProperty failed' }
+    }
+
+    // 一次性 bind：成功后移除入口，降低页面后续窃听新 token 的窗口
+    try {
+      delete window[BIND_KEY]
+    } catch (e) {
+      /* ignore */
+    }
+
+    return { ok: true }
+  }
+
+  function installBind() {
+    var existing = null
+    try {
+      existing = Object.getOwnPropertyDescriptor(window, BIND_KEY)
+    } catch (e) {
+      existing = null
+    }
+
+    if (existing && existing.configurable === false) {
+      console.error('[user-mcp-scripts] bind 入口被页面抢占且不可覆盖，拒绝安装')
+      return
+    }
+
+    if (existing) {
+      try {
+        delete window[BIND_KEY]
+      } catch (e) {
+        console.error('[user-mcp-scripts] 无法移除页面伪造的 bind 入口')
+        return
+      }
+    }
+
+    try {
+      Object.defineProperty(window, BIND_KEY, {
+        value: bind,
+        writable: false,
+        configurable: true,
+        enumerable: false
+      })
+    } catch (e) {
+      console.error('[user-mcp-scripts] 安装 bind 入口失败:', e)
     }
   }
 
-  install()
+  installBind()
 })()
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
index 3e2618f4..dbb77690 100644
--- a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/design.md
@@ -81,6 +81,7 @@ sequenceDiagram
 - 重复注入可能导致工具重复注册：模板与注入侧使用幂等标记
 - 宽泛 `@match`（如 `*://*/*`）+ `replacesBuiltIn` 会禁用所有内置域名工具：UI 文案提示风险
 - 不改变内置三站行为（无用户脚本时路径与现网一致）
+- MAIN world 桥：禁止依赖可伪造的静态 OWNER；使用 bind(token) 闭包能力令牌。仍存在「脚本 onload 与 background bind 之间」的极短 TOCTOU 窗口，靠尽快 bind + 一次性删除 bind 入口收敛
 
 ## 备选方案（若有）
 
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
index 972b90fc..634a3e0b 100644
--- a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/requirements.md
@@ -68,5 +68,7 @@
 ## 非功能
 
 - CSP：用户源码必须经 background `scripting.executeScript`（MAIN）注入，不得依赖 blob/`eval` 绕过
+- 能力令牌：`user-mcp-exec.js` 仅装 bind；background 生成 token 闭包校验，禁止依赖可伪造的静态 OWNER 属性
+- 注入顺序：runtime → register-page-agent-tool → user-mcp-exec → bind(token) → exec(code, token)
 - 幂等：默认模板含防重复注册防护
 - 非法 `@match` 保存时校验失败并提示
diff --git a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
index 0e551c63..b438d736 100644
--- a/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
+++ b/packages/next-wxt/specs/REQ-20260730-user-mcp-scripts/tasks.md
@@ -24,9 +24,10 @@
   - 产物：更新 `docs/ai-extension/next-wxt.md`
   - 验收命令见下
 
-- [x] Task 6: 导入导出对齐 mcp-servers 目录格式
-  - 产物：`user-mcp-scripts/pack.ts`、storage zip API、Options 改 zip、文档与 Spec
-  - [x] 测试：`packages/next-wxt/test/user-mcp-scripts/pack.test.ts`
+- [x] Task 7: 执行桥改用 capability token（修复可伪造 OWNER）
+  - 产物：`public/vendor/user-mcp-exec.js`、`exec-bridge.ts`、`inject-user-mcp-scripts.ts`、content/wxt 顺序注释
+  - [x] 测试：`csp-bridge-repro.test.ts`（bind→exec、拒绝无 token 伪造桥）
+
 
 ## 依赖顺序
 
diff --git a/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts b/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
index 9cc8dde1..29209b25 100644
--- a/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
+++ b/packages/next-wxt/test/user-mcp-scripts/csp-bridge-repro.test.ts
@@ -5,14 +5,15 @@
  * 根因：background 在 MAIN world 的 scripting.executeScript 回调里直接 new Function(源码)，
  * 会受页面 CSP（无 unsafe-eval）拦截；而 runtime / page-agent 经 chrome-extension:// script 注入不受影响。
  *
- * 修复后：必须通过扩展脚本桥 __NEXT_WXT_EXEC_USER_MCP_SCRIPT__ 执行用户源码。
+ * 修复后：必须通过扩展脚本桥；并用 capability token（闭包）而非可伪造的 OWNER 属性。
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { matchUrl } from '../../user-mcp-scripts/match'
 import {
+  USER_MCP_BIND_BRIDGE_NAME,
   USER_MCP_EXEC_BRIDGE_NAME,
-  USER_MCP_EXEC_BRIDGE_OWNER,
-  buildBridgeInvokeSnippet
+  buildBridgeInvokeSnippet,
+  createUserMcpBridgeToken
 } from '../../user-mcp-scripts/exec-bridge'
 
 const memory = new Map<string, unknown>()
@@ -31,13 +32,17 @@ vi.stubGlobal('browser', {
   scripting: { executeScript }
 })
 
-import { injectUserMcpScriptsForTab } from '../../entrypoints/background/inject-user-mcp-scripts'
+import {
+  injectUserMcpScriptsForTab,
+  clearUserMcpBridgeToken
+} from '../../entrypoints/background/inject-user-mcp-scripts'
 import { USER_MCP_SCRIPTS_KEY } from '../../user-mcp-scripts'
 
 describe('复现：京东 CSP 阻断 MAIN world new Function', () => {
   beforeEach(() => {
     memory.clear()
     executeScript.mockReset()
+    clearUserMcpBridgeToken(42)
   })
 
   it('@match 能命中 https://www.jd.com/（排除匹配失败）', () => {
@@ -47,12 +52,13 @@ describe('复现：京东 CSP 阻断 MAIN world new Function', () => {
 
   it('注入路径须走扩展桥而非在 executeScript 回调内 new Function', () => {
     expect(USER_MCP_EXEC_BRIDGE_NAME).toBe('__NEXT_WXT_EXEC_USER_MCP_SCRIPT__')
-    const snippet = buildBridgeInvokeSnippet('console.log(1)')
+    const snippet = buildBridgeInvokeSnippet('console.log(1)', 'tok')
     expect(snippet).toContain(USER_MCP_EXEC_BRIDGE_NAME)
+    expect(snippet).toContain('tok')
     expect(snippet).not.toMatch(/new\s+Function\s*\(/)
   })
 
-  it('injectUserMcpScriptsForTab 经 MAIN world 调用带所有权标记的桥', async () => {
+  it('injectUserMcpScriptsForTab：先 bind(token) 再经 MAIN world 调用 exec(code, token)', async () => {
     memory.set(USER_MCP_SCRIPTS_KEY, {
       s1: {
         id: 's1',
@@ -67,20 +73,25 @@ describe('复现：京东 CSP 阻断 MAIN world new Function', () => {
       }
     })
 
-    const bridgeFn = Object.assign(vi.fn(() => ({ ok: true as const })), {
-      [USER_MCP_EXEC_BRIDGE_OWNER]: true
+    let boundToken = ''
+    const bridgeFn = vi.fn((code: string, capability: string) => {
+      if (capability !== boundToken) return { ok: false, error: 'unauthorized' }
+      return { ok: true as const }
+    })
+    const bindFn = vi.fn((token: string) => {
+      boundToken = token
+      ;(globalThis as any).window[USER_MCP_EXEC_BRIDGE_NAME] = bridgeFn
+      delete (globalThis as any).window[USER_MCP_BIND_BRIDGE_NAME]
+      return { ok: true as const }
     })
-    vi.stubGlobal('window', { [USER_MCP_EXEC_BRIDGE_NAME]: bridgeFn })
+    vi.stubGlobal('window', { [USER_MCP_BIND_BRIDGE_NAME]: bindFn })
 
     executeScript.mockImplementation(
       async (opts: { world?: string; args?: unknown[]; func?: (...a: any[]) => unknown }) => {
         expect(opts.world).toBe('MAIN')
-        expect(opts.args?.[1]).toBe(USER_MCP_EXEC_BRIDGE_NAME)
-        expect(opts.args?.[2]).toBe(USER_MCP_EXEC_BRIDGE_OWNER)
         const body = String(opts.func)
         expect(body).not.toMatch(/new\s+Function\s*\(/)
-        expect(body).toContain('run')
-        const result = opts.func!(...(opts.args as [string, string, string]))
+        const result = opts.func!(...(opts.args as any[]))
         return [{ result }]
       }
     )
@@ -88,7 +99,65 @@ describe('复现：京东 CSP 阻断 MAIN world new Function', () => {
     const out = await injectUserMcpScriptsForTab(42, 'https://www.jd.com/')
     expect(out.injectedCount).toBe(1)
     expect(out.success).toBe(true)
-    expect(bridgeFn).toHaveBeenCalledWith('window.__user_mcp_hello = 1')
-    expect(executeScript).toHaveBeenCalledTimes(1)
+    expect(bindFn).toHaveBeenCalledTimes(1)
+    expect(boundToken.length).toBeGreaterThanOrEqual(32)
+    expect(bridgeFn).toHaveBeenCalledWith('window.__user_mcp_hello = 1', boundToken)
+    // bind + exec
+    expect(executeScript).toHaveBeenCalledTimes(2)
+  })
+
+  it('伪造 OWNER 属性不能代替 capability：错误 token 被拒绝', async () => {
+    memory.set(USER_MCP_SCRIPTS_KEY, {
+      s1: {
+        id: 's1',
+        name: 'jd',
+        matches: ['*://www.jd.com/*'],
+        enabled: true,
+        replacesBuiltIn: false,
+        source: '1',
+        updatedAt: 1
+      }
+    })
+
+    const realToken = createUserMcpBridgeToken()
+    const forged = Object.assign(
+      vi.fn(() => ({ ok: true as const })),
+      { __NEXT_WXT_OWNED__: true }
+    )
+    // 模拟：页面伪造了 exec，bind 已不在（或我们直接走第二次注入复用 token）
+    // 先正常 bind
+    const bindFn = vi.fn((token: string) => {
+      expect(token).toBeTruthy()
+      ;(globalThis as any).window[USER_MCP_EXEC_BRIDGE_NAME] = (code: string, cap: string) => {
+        if (cap !== token) return { ok: false, error: 'unauthorized' }
+        return { ok: true }
+      }
+      return { ok: true }
+    })
+    vi.stubGlobal('window', { [USER_MCP_BIND_BRIDGE_NAME]: bindFn })
+
+    executeScript.mockImplementation(
+      async (opts: { world?: string; args?: unknown[]; func?: (...a: any[]) => unknown }) => {
+        const result = opts.func!(...(opts.args as any[]))
+        return [{ result }]
+      }
+    )
+
+    const ok = await injectUserMcpScriptsForTab(42, 'https://www.jd.com/')
+    expect(ok.success).toBe(true)
+
+    // 再次注入应复用 token；即使 window 上被换成伪造 OWNER 函数，
+    // 调用仍带真实 token——此处替换为只认 realToken 的假函数应失败
+    clearUserMcpBridgeToken(42)
+    // 重新走 bind，但页面抢先装了带 OWNER 的假桥且 bind 被删——用 locked 场景
+    vi.stubGlobal('window', {
+      [USER_MCP_EXEC_BRIDGE_NAME]: forged
+      // 无 bind
+    })
+    const fail = await injectUserMcpScriptsForTab(42, 'https://www.jd.com/')
+    expect(fail.success).toBe(false)
+    expect(fail.error).toMatch(/bind entry missing|locked|失败/)
+    expect(forged).not.toHaveBeenCalled()
+    void realToken
   })
 })
diff --git a/packages/next-wxt/user-mcp-scripts/exec-bridge.ts b/packages/next-wxt/user-mcp-scripts/exec-bridge.ts
index 14c95d4f..398eecc4 100644
--- a/packages/next-wxt/user-mcp-scripts/exec-bridge.ts
+++ b/packages/next-wxt/user-mcp-scripts/exec-bridge.ts
@@ -2,22 +2,47 @@
  * 用户 MCP 脚本 MAIN world 执行桥约定
  *
  * Chrome 在 world:'MAIN' 的 scripting.executeScript 回调内使用 new Function/eval
- * 会受页面 CSP 约束。必须经 chrome-extension:// 加载的脚本执行源码，
- * 且仅调用带所有权标记的桥，避免页面伪造 window 全局劫持源码。
+ * 会受页面 CSP 约束。必须经 chrome-extension:// 加载的脚本执行源码。
+ *
+ * 所有权：使用 background 生成的 capability token（闭包校验），
+ * 而非可被页面伪造的静态属性（如 __NEXT_WXT_OWNED__）。
+ *
+ * 注入顺序（硬约束）：
+ * 1. content：vendor/runtime.js
+ * 2. content：vendor/register-page-agent-tool.js
+ * 3. content：vendor/user-mcp-exec.js（仅安装 bind 入口）
+ * 4. background：bind(token) → exec(code, token)
  */
 
-export const USER_MCP_EXEC_BRIDGE_NAME = '__NEXT_WXT_EXEC_USER_MCP_SCRIPT__'
+/** 一次性 bind 入口（user-mcp-exec.js 安装，bind 成功后删除） */
+export const USER_MCP_BIND_BRIDGE_NAME = '__NEXT_WXT_BIND_USER_MCP_BRIDGE__'
 
-/** 桥函数上的所有权标记字段名（与 vendor/user-mcp-exec.js 一致） */
-export const USER_MCP_EXEC_BRIDGE_OWNER = '__NEXT_WXT_OWNED__'
+/** 执行桥（bind 后安装，校验 capability） */
+export const USER_MCP_EXEC_BRIDGE_NAME = '__NEXT_WXT_EXEC_USER_MCP_SCRIPT__'
 
 export const USER_MCP_EXEC_BRIDGE_PATH = 'vendor/user-mcp-exec.js'
 
 /**
- * 供单测断言：注入侧应调用已校验所有权的桥，而不是在回调里 new Function
+ * 供单测断言：注入侧应调用桥而非在回调里 new Function
  */
-export function buildBridgeInvokeSnippet(codeLiteral: string): string {
-  return `window.${USER_MCP_EXEC_BRIDGE_NAME}(${JSON.stringify(codeLiteral)})`
+export function buildBridgeInvokeSnippet(codeLiteral: string, tokenLiteral = '<token>'): string {
+  return `window.${USER_MCP_EXEC_BRIDGE_NAME}(${JSON.stringify(codeLiteral)}, ${JSON.stringify(tokenLiteral)})`
 }
 
-export type BridgeExecResult = { ok: true } | { ok: false; error: string }
+export type BridgeExecResult =
+  | { ok: true }
+  | { ok: false; error: string; locked?: boolean }
+
+export function createUserMcpBridgeToken(): string {
+  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+    return crypto.randomUUID()
+  }
+  // 至少 32 字符，满足桥对 token 长度的校验
+  const bytes = new Uint8Array(32)
+  if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+    crypto.getRandomValues(bytes)
+  } else {
+    for (let i = 0; i < bytes.length; i++) bytes[i] = (Math.random() * 256) | 0
+  }
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')
+}
diff --git a/packages/next-wxt/user-mcp-scripts/index.ts b/packages/next-wxt/user-mcp-scripts/index.ts
index 994c4ffb..5c9d6c52 100644
--- a/packages/next-wxt/user-mcp-scripts/index.ts
+++ b/packages/next-wxt/user-mcp-scripts/index.ts
@@ -7,7 +7,14 @@ export * from './types'
 export * from './match'
 export * from './resolve'
 export * from './template'
-export * from './exec-bridge'
+export {
+  USER_MCP_BIND_BRIDGE_NAME,
+  USER_MCP_EXEC_BRIDGE_NAME,
+  USER_MCP_EXEC_BRIDGE_PATH,
+  buildBridgeInvokeSnippet,
+  createUserMcpBridgeToken,
+  type BridgeExecResult
+} from './exec-bridge'
 export {
   exportUserMcpScriptsZip,
   parseUserMcpScriptsZip,
diff --git a/packages/next-wxt/wxt.config.ts b/packages/next-wxt/wxt.config.ts
index 35645774..dee30b52 100644
--- a/packages/next-wxt/wxt.config.ts
+++ b/packages/next-wxt/wxt.config.ts
@@ -42,6 +42,7 @@ export default defineConfig({
     web_accessible_resources: [
       {
         // next-sdk runtime + 显式注册脚本 + 用户 MCP 执行桥（content 经 <script src> 注入 MAIN world）
+        // 顺序由 content.ts 保证：runtime → register-page-agent-tool → user-mcp-exec → background bind/exec
         resources: [
           'vendor/runtime.js',
           'vendor/register-page-agent-tool.js',