@agentprojectcontext/apx 1.58.0 → 1.59.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentprojectcontext/apx",
-  "version": "1.58.0",
+  "version": "1.59.0",
   "description": "APX — unified CLI + daemon for the Agent Project Context (APC) standard.",
   "publishConfig": {
     "access": "public"

package/src/core/agent/skills/index.js

@@ -3,6 +3,15 @@ export { condenseSkillDescription, buildSkillsHintBlock } from "./catalog.js";
 export { tryResolveSkillCommand } from "./trigger.js";
 export { suggestSkillForPrompt, clearSkillVectorCache } from "./rag.js";
 export { listSkills, loadSkill, SKILL_LOCATIONS } from "./loader.js";
+export {
+  isPrivateSkill,
+  isSkillEnabled,
+  filterEnabledSkills,
+  annotateSkills,
+  setSkillEnabled,
+  resolveScopeKey,
+  DEFAULT_SCOPE,
+} from "./policy.js";
 export {
   inspectPromptForSkills,
   isInspectorEnabled,

package/src/core/agent/skills/inspector.js

@@ -25,6 +25,7 @@
 
 import { embedOne, cosineSim } from "#core/memory/embeddings.js";
 import { listSkills, loadSkill } from "./loader.js";
+import { filterEnabledSkills, isSkillEnabled } from "./policy.js";
 import { readIndex, backgroundRefreshIfStale } from "./index-store.js";
 
 // Defaults — exported so the CLI/web can render them.
@@ -187,7 +188,8 @@ export async function inspectPromptForSkills({ prompt, projectPath, globalConfig
     };
   }
 
-  const scored = scoreAgainstIndex(probe.vector, items);
+  const scored = scoreAgainstIndex(probe.vector, items).filter((s) =>
+    isSkillEnabled(s, { config: globalConfig, projectPath }));
   return await pickAndRender({ scored, projectPath, probe, cfg });
 }
 
@@ -196,7 +198,10 @@ export async function inspectPromptForSkills({ prompt, projectPath, globalConfig
 // ---------------------------------------------------------------------------
 
 async function inspectFromLive({ text, projectPath, cfg, globalConfig, embedOpts }) {
-  const skills = listSkills({ projectPath });
+  const skills = filterEnabledSkills(listSkills({ projectPath }), {
+    config: globalConfig,
+    projectPath,
+  });
   if (!skills.length) {
     return { contextNote: "", trace: { enabled: true, reason: "no_skills" } };
   }

package/src/core/agent/skills/policy.js

@@ -0,0 +1,128 @@
+// Skills enable/disable policy — scope-aware gating shared by every consumer.
+//
+// A skill can be turned off per scope. A "scope" is either the super-agent /
+// no-project baseline ("default") or a specific project (keyed by its absolute
+// path). Config lives at:
+//
+//   config.skills.policy["default"]        = { "<slug>": true|false, ... }
+//   config.skills.policy["<projectPath>"]  = { "<slug>": true|false, ... }
+//
+// A boolean under a scope is an explicit override; an absent slug inherits.
+// Empty/missing policy = every skill enabled (the pre-feature behavior), so this
+// is fully backward compatible.
+//
+// PRIVATE skills (source "builtin") are APX's own shipped skills. They are
+// always active and can never be disabled or deleted — the UI shows them locked.
+//
+// Effective enabled(skill, projectPath):
+//   1. builtin source                → true (private, locked)
+//   2. project scope explicit value  → that value
+//   3. "default" scope explicit value→ that value
+//   4. otherwise                     → true
+
+export const DEFAULT_SCOPE = "default";
+
+// Sources whose skills ship with apx and are always active.
+const PRIVATE_SOURCES = new Set(["builtin"]);
+
+/** True for APX's own built-in skills — always active, never disableable. */
+export function isPrivateSkill(skill) {
+  return PRIVATE_SOURCES.has(skill?.source);
+}
+
+/** Normalize a project path (or nothing) into a policy scope key. */
+export function resolveScopeKey(projectPath) {
+  const p = typeof projectPath === "string" ? projectPath.trim() : "";
+  return p || DEFAULT_SCOPE;
+}
+
+function policyMap(config) {
+  const p = config?.skills?.policy;
+  return p && typeof p === "object" ? p : {};
+}
+
+function scopeOverride(config, scopeKey, slug) {
+  const scope = policyMap(config)[scopeKey];
+  if (!scope || typeof scope !== "object") return undefined;
+  const v = scope[slug];
+  return typeof v === "boolean" ? v : undefined;
+}
+
+/**
+ * Resolve whether a skill is enabled for the given scope.
+ * @param {{slug:string, source?:string}} skill
+ * @param {{config?:object, projectPath?:string}} ctx
+ * @returns {boolean}
+ */
+export function isSkillEnabled(skill, { config, projectPath } = {}) {
+  if (isPrivateSkill(skill)) return true;
+  const slug = skill?.slug;
+  if (!slug) return true;
+
+  const scopeKey = resolveScopeKey(projectPath);
+  if (scopeKey !== DEFAULT_SCOPE) {
+    const own = scopeOverride(config, scopeKey, slug);
+    if (own !== undefined) return own;
+  }
+  const base = scopeOverride(config, DEFAULT_SCOPE, slug);
+  if (base !== undefined) return base;
+  return true;
+}
+
+/** Keep only the skills enabled for the given scope. */
+export function filterEnabledSkills(skills, ctx = {}) {
+  if (!Array.isArray(skills)) return [];
+  return skills.filter((s) => isSkillEnabled(s, ctx));
+}
+
+/**
+ * Annotate skills for a UI client: adds `enabled`, `private`, and `overridden`
+ * (whether *this* scope holds an explicit override, ignoring inheritance).
+ */
+export function annotateSkills(skills, { config, projectPath } = {}) {
+  if (!Array.isArray(skills)) return [];
+  const scopeKey = resolveScopeKey(projectPath);
+  return skills.map((s) => {
+    const priv = isPrivateSkill(s);
+    const own = priv ? undefined : scopeOverride(config, scopeKey, s.slug);
+    return {
+      ...s,
+      private: priv,
+      enabled: isSkillEnabled(s, { config, projectPath }),
+      overridden: own !== undefined,
+    };
+  });
+}
+
+/**
+ * Set (or clear) a skill's enabled override for a scope. Mutates and returns the
+ * config object. `enabled === null|undefined` clears the override (back to
+ * inherit). Private/builtin skills cannot be overridden.
+ *
+ * @param {object} config          the global config (mutated in place)
+ * @param {object} args
+ * @param {string} args.slug
+ * @param {boolean|null} args.enabled
+ * @param {string=} args.scope     scope key ("default" or a project path)
+ * @param {string=} args.projectPath alternative to scope; normalized to a key
+ */
+export function setSkillEnabled(config, { slug, enabled, scope, projectPath } = {}) {
+  if (!slug) throw new Error("setSkillEnabled: slug required");
+  const scopeKey = scope ? resolveScopeKey(scope) : resolveScopeKey(projectPath);
+
+  config.skills = config.skills || {};
+  config.skills.policy = config.skills.policy || {};
+  const map = config.skills.policy;
+
+  if (enabled === null || enabled === undefined) {
+    if (map[scopeKey]) {
+      delete map[scopeKey][slug];
+      if (Object.keys(map[scopeKey]).length === 0) delete map[scopeKey];
+    }
+    return config;
+  }
+
+  map[scopeKey] = map[scopeKey] || {};
+  map[scopeKey][slug] = !!enabled;
+  return config;
+}

package/src/core/agent/super-agent.js

@@ -1,6 +1,7 @@
 // Super-agent: daemon-level action agent for Telegram, TUI, desktop, routines.
 import { createToolSession, buildLazyToolsBlock, makeToolHandlers } from "#core/agent/tools/registry.js";
 import { listSkills } from "#core/agent/skills/loader.js";
+import { filterEnabledSkills } from "#core/agent/skills/policy.js";
 import {
   runAgent,
   buildSuperAgentSystem,
@@ -97,10 +98,16 @@ export async function runSuperAgent({
   // noTools callers (summarize/ask) get no session — text only.
   const toolSession = noTools ? null : createToolSession(channel, { allowedTools });
 
+  // Scope the catalog hint to the skills enabled for this project (or the
+  // super-agent baseline when no project). Built-in/private skills always pass.
+  const projectPath = channelMeta?.projectPath;
+  const scopedListSkills = (opts = {}) =>
+    filterEnabledSkills(listSkills(opts), { config: globalConfig, projectPath });
+
   const system = buildSuperAgentSystem({
     globalConfig,
     projects,
-    listSkills,
+    listSkills: scopedListSkills,
     contextNote,
     channel,
     channelMeta,

package/src/core/agent/tools/handlers/list-skills.js

@@ -1,5 +1,5 @@
 import { listSkills, SKILL_LOCATIONS } from "#core/agent/skills/loader.js";
-import { condenseSkillDescription } from "#core/agent/skills/index.js";
+import { condenseSkillDescription, filterEnabledSkills } from "#core/agent/skills/index.js";
 
 export default {
   name: "list_skills",
@@ -20,8 +20,11 @@ export default {
       },
     },
   },
-  makeHandler: () => ({ project_path } = {}) => {
-    const skills = listSkills({ projectPath: project_path });
+  makeHandler: (ctx = {}) => ({ project_path } = {}) => {
+    const skills = filterEnabledSkills(
+      listSkills({ projectPath: project_path }),
+      { config: ctx.globalConfig, projectPath: project_path },
+    );
     return {
       ok: true,
       count: skills.length,

package/src/core/agent/tools/handlers/load-skill.js

@@ -1,4 +1,5 @@
 import { loadSkill } from "#core/agent/skills/loader.js";
+import { isSkillEnabled } from "#core/agent/skills/policy.js";
 
 export default {
   name: "load_skill",
@@ -24,8 +25,14 @@ export default {
       },
     },
   },
-  makeHandler: () => ({ slug, project_path } = {}) => {
+  makeHandler: (ctx = {}) => ({ slug, project_path } = {}) => {
     if (!slug) throw new Error("load_skill: slug required");
-    return loadSkill(slug, { projectPath: project_path });
+    const skill = loadSkill(slug, { projectPath: project_path });
+    if (!isSkillEnabled(skill, { config: ctx.globalConfig, projectPath: project_path })) {
+      throw new Error(
+        `skill "${slug}" is disabled for this scope. Enable it in Settings → Skills, or pick another.`,
+      );
+    }
+    return skill;
   },
 };

package/src/host/daemon/api/skills.js

@@ -1,16 +1,36 @@
-// `/skills` listing + Skill Inspector control surface for UI clients.
+// `/skills` listing + enable/disable + Skill Inspector control surface.
 //
-//   GET  /skills                       catalog (slug + condensed description)
-//   GET  /skills/inspector             inspector config + index status
-//   PUT  /skills/inspector             toggle / tune inspector config
-//   POST /skills/index                 (re)build the inspector vector index
-//   POST /skills/inspect               dry-run the inspector for a prompt
+//   GET    /skills                     catalog annotated with enabled/private per scope
+//   GET    /skills/:slug/detail        full body + frontmatter for the viewer
+//   PUT    /skills/enabled             toggle a skill on/off (or clear) for a scope
+//   POST   /skills                     create a user skill (online editor)
+//   POST   /skills/import/zip          import a skill from an uploaded .zip
+//   POST   /skills/import/repo         import a skill by cloning a git repo
+//   DELETE /skills/:slug               delete a user skill
+//   GET    /skills/inspector           inspector config + index status
+//   PUT    /skills/inspector           toggle / tune inspector config
+//   POST   /skills/index               (re)build the inspector vector index
+//   POST   /skills/inspect             dry-run the inspector for a prompt
 //
-// The listing is the same data backing `list_skills` (no auth-binding to a
-// project). The inspector routes mirror /embeddings/* so the web admin can
-// configure the skill RAG exactly like it configures the memory RAG.
-import { listSkills } from "#core/agent/skills/loader.js";
+// A "scope" is either "default" (the super-agent / no-project baseline) or a
+// project's absolute path. Creating/importing with a project_path targets that
+// project's <project>/.apc/skills/ (source "project"); without it, skills land
+// in ~/.apx/skills/ (source "global"). Built-in skills are private: always
+// active, never disableable or deletable. The inspector routes mirror
+// /embeddings/* so the web admin configures the skill RAG like the memory RAG.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { listSkills, loadSkill, SKILL_LOCATIONS } from "#core/agent/skills/loader.js";
 import { condenseSkillDescription } from "#core/agent/skills/catalog.js";
+import { apcSkillsDir } from "#core/apc/paths.js";
+import {
+  annotateSkills,
+  setSkillEnabled,
+  resolveScopeKey,
+  isPrivateSkill,
+} from "#core/agent/skills/policy.js";
 import {
   inspectPromptForSkills,
   INSPECTOR_DEFAULTS,
@@ -22,8 +42,63 @@ import {
 } from "#core/agent/skills/index-store.js";
 import { readConfig, writeConfig } from "#core/config/index.js";
 
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+// Only http(s)/ssh/git git remotes — never a local path or shell metachar.
+const REPO_URL_RE = /^(https?:\/\/|git@|ssh:\/\/|git:\/\/)[\w.@:/\-~]+$/;
+
 const KNOWN_KEYS = Object.keys(INSPECTOR_DEFAULTS);
 
+// Where a newly created/imported skill lands, given a scope. A project_path
+// targets that project's .apc/skills/ (source "project"); otherwise the global
+// ~/.apx/skills/ (source "global").
+function targetSkillsDir(projectPath) {
+  return projectPath ? apcSkillsDir(projectPath) : SKILL_LOCATIONS.global;
+}
+
+function skillExists(slug, projectPath) {
+  return listSkills({ projectPath }).some((s) => s.slug === slug);
+}
+
+function writeSkillFile(dir, slug, description, body) {
+  fs.mkdirSync(dir, { recursive: true });
+  const fmDesc = String(description || "").replace(/\r?\n/g, " ").trim();
+  const content =
+    `---\nname: ${slug}\ndescription: ${fmDesc}\n---\n\n${String(body || "").trim()}\n`;
+  fs.writeFileSync(path.join(dir, "SKILL.md"), content, "utf8");
+}
+
+// Find the skill root inside an extracted/cloned tree: the dir that directly
+// contains a SKILL.md (the tree itself, or its single top-level subdir).
+function findSkillRoot(root) {
+  if (fs.existsSync(path.join(root, "SKILL.md"))) return root;
+  let entries;
+  try { entries = fs.readdirSync(root, { withFileTypes: true }); } catch { return null; }
+  const dirs = entries.filter((e) => e.isDirectory() && e.name !== "__MACOSX");
+  for (const d of dirs) {
+    const sub = path.join(root, d.name);
+    if (fs.existsSync(path.join(sub, "SKILL.md"))) return sub;
+  }
+  return null;
+}
+
+function readSlugFromSkill(dir, fallback) {
+  try {
+    const raw = fs.readFileSync(path.join(dir, "SKILL.md"), "utf8");
+    const m = raw.match(/^---[\s\S]*?\bname\s*:\s*(.+?)\s*$/m);
+    if (m && SLUG_RE.test(m[1].trim())) return m[1].trim();
+  } catch { /* ignore */ }
+  return fallback;
+}
+
+// Copy an extracted skill dir into the target skills location under <slug>/.
+function installSkillDir(srcDir, slug, projectPath) {
+  const destBase = targetSkillsDir(projectPath);
+  const dest = path.join(destBase, slug);
+  fs.mkdirSync(destBase, { recursive: true });
+  fs.cpSync(srcDir, dest, { recursive: true });
+  return dest;
+}
+
 function mergedInspectorConfig(cfg) {
   return { ...INSPECTOR_DEFAULTS, ...(cfg?.skills?.inspector || {}) };
 }
@@ -40,17 +115,31 @@ function indexStatus() {
 
 export function register(app /*, ctx */) {
   app.get("/skills", (req, res) => {
-    const projectPath = typeof req.query?.project_path === "string"
+    const projectPath = typeof req.query?.project_path === "string" && req.query.project_path
       ? req.query.project_path
       : undefined;
+    // A caller may ask about the "default" (super-agent) scope while still
+    // wanting project-scoped skills scanned — keep the two concerns separate.
+    const scope = typeof req.query?.scope === "string" && req.query.scope
+      ? req.query.scope
+      : undefined;
     try {
-      const skills = listSkills({ projectPath });
+      const cfg = readConfig();
+      const scopeKey = resolveScopeKey(scope || projectPath);
+      const annotated = annotateSkills(listSkills({ projectPath }), {
+        config: cfg,
+        projectPath: scopeKey === "default" ? undefined : scopeKey,
+      });
       res.json({
-        count: skills.length,
-        skills: skills.map(({ slug, source, description }) => ({
-          slug,
-          source,
-          description: condenseSkillDescription(description),
+        count: annotated.length,
+        scope: scopeKey,
+        skills: annotated.map((s) => ({
+          slug: s.slug,
+          source: s.source,
+          description: condenseSkillDescription(s.description),
+          enabled: s.enabled,
+          private: s.private,
+          overridden: s.overridden,
         })),
       });
     } catch (e) {
@@ -58,6 +147,201 @@ export function register(app /*, ctx */) {
     }
   });
 
+  // ---- Full detail (viewer) ----------------------------------------------
+
+  app.get("/skills/:slug/detail", (req, res) => {
+    try {
+      const projectPath = typeof req.query?.project_path === "string" && req.query.project_path
+        ? req.query.project_path
+        : undefined;
+      const skill = loadSkill(req.params.slug, { projectPath });
+      const cfg = readConfig();
+      const [annotated] = annotateSkills([skill], { config: cfg, projectPath });
+      res.json({
+        slug: skill.slug,
+        source: skill.source,
+        description: skill.description,
+        frontmatter: skill.frontmatter,
+        body: skill.body,
+        file: skill.file,
+        enabled: annotated?.enabled ?? true,
+        private: annotated?.private ?? false,
+        overridden: annotated?.overridden ?? false,
+      });
+    } catch (e) {
+      res.status(404).json({ error: e.message });
+    }
+  });
+
+  // ---- Enable / disable per scope ----------------------------------------
+
+  app.put("/skills/enabled", (req, res) => {
+    try {
+      const { slug, enabled, scope, project_path } = req.body || {};
+      if (!slug || typeof slug !== "string") {
+        return res.status(400).json({ error: "slug required" });
+      }
+      const cfg = readConfig();
+      const all = listSkills({ projectPath: project_path });
+      const target = all.find((s) => s.slug === slug);
+      if (!target) return res.status(404).json({ error: `skill "${slug}" not found` });
+      if (isPrivateSkill(target)) {
+        return res.status(403).json({ error: `skill "${slug}" is private (built-in) and always active` });
+      }
+      // enabled: boolean sets an override; null/undefined clears it (inherit).
+      const value = enabled === null || enabled === undefined ? null : !!enabled;
+      setSkillEnabled(cfg, { slug, enabled: value, scope, projectPath: project_path });
+      writeConfig(cfg);
+      const scopeKey = resolveScopeKey(scope || project_path);
+      res.json({ ok: true, slug, scope: scopeKey, enabled: value });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // ---- Create / import user skills ---------------------------------------
+
+  // Online editor: write a SKILL.md from slug + description + body.
+  app.post("/skills", (req, res) => {
+    try {
+      const { slug, description, body, project_path } = req.body || {};
+      if (!slug || typeof slug !== "string" || !SLUG_RE.test(slug)) {
+        return res.status(400).json({ error: "slug required (lowercase letters, digits, dashes)" });
+      }
+      if (skillExists(slug, project_path)) {
+        return res.status(409).json({ error: `a skill named "${slug}" already exists in this scope` });
+      }
+      const dir = path.join(targetSkillsDir(project_path), slug);
+      writeSkillFile(dir, slug, description, body);
+      res.status(201).json({ ok: true, slug, source: project_path ? "project" : "global" });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // Import from an uploaded .zip (sent as base64 in JSON — skills are tiny).
+  app.post("/skills/import/zip", (req, res) => {
+    let tmp;
+    try {
+      const { data, project_path } = req.body || {};
+      if (!data || typeof data !== "string") {
+        return res.status(400).json({ error: "zip data (base64) required" });
+      }
+      const buf = Buffer.from(data.replace(/^data:.*;base64,/, ""), "base64");
+      if (!buf.length) return res.status(400).json({ error: "empty zip" });
+
+      tmp = fs.mkdtempSync(path.join(os.tmpdir(), "apx-skill-zip-"));
+      const zipPath = path.join(tmp, "skill.zip");
+      fs.writeFileSync(zipPath, buf);
+      const out = path.join(tmp, "out");
+      fs.mkdirSync(out);
+      const unzip = spawnSync("unzip", ["-qq", "-o", zipPath, "-d", out], { encoding: "utf8" });
+      if (unzip.status !== 0) {
+        return res.status(400).json({ error: `unzip failed: ${(unzip.stderr || "bad archive").trim()}` });
+      }
+      const root = findSkillRoot(out);
+      if (!root) return res.status(400).json({ error: "no SKILL.md found in the zip" });
+      const slug = readSlugFromSkill(root, path.basename(root));
+      if (!SLUG_RE.test(slug)) return res.status(400).json({ error: `invalid skill name "${slug}"` });
+      if (skillExists(slug, project_path)) {
+        return res.status(409).json({ error: `a skill named "${slug}" already exists in this scope` });
+      }
+      installSkillDir(root, slug, project_path);
+      res.status(201).json({ ok: true, slug, source: project_path ? "project" : "global" });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    } finally {
+      if (tmp) fs.rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  // Import by cloning a git repo. The repo root (or its single skill subdir)
+  // must contain a SKILL.md.
+  app.post("/skills/import/repo", (req, res) => {
+    let tmp;
+    try {
+      const { url, project_path } = req.body || {};
+      if (!url || typeof url !== "string" || !REPO_URL_RE.test(url.trim())) {
+        return res.status(400).json({ error: "a valid git URL (https/ssh/git) is required" });
+      }
+      tmp = fs.mkdtempSync(path.join(os.tmpdir(), "apx-skill-repo-"));
+      const clone = path.join(tmp, "repo");
+      // Array args (no shell) — url is regex-validated above.
+      const git = spawnSync("git", ["clone", "--depth", "1", url.trim(), clone], {
+        encoding: "utf8",
+        timeout: 60_000,
+        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+      });
+      if (git.status !== 0) {
+        return res.status(400).json({ error: `git clone failed: ${(git.stderr || "").trim().slice(0, 300)}` });
+      }
+      const root = findSkillRoot(clone);
+      if (!root) return res.status(400).json({ error: "no SKILL.md found in the repo" });
+      const slug = readSlugFromSkill(root, path.basename(root));
+      if (!SLUG_RE.test(slug)) return res.status(400).json({ error: `invalid skill name "${slug}"` });
+      if (skillExists(slug, project_path)) {
+        return res.status(409).json({ error: `a skill named "${slug}" already exists in this scope` });
+      }
+      // Strip the repo's .git before installing so we don't nest a git dir.
+      fs.rmSync(path.join(root, ".git"), { recursive: true, force: true });
+      installSkillDir(root, slug, project_path);
+      res.status(201).json({ ok: true, slug, source: project_path ? "project" : "global" });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    } finally {
+      if (tmp) fs.rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  app.delete("/skills/:slug", (req, res) => {
+    try {
+      const slug = req.params.slug;
+      if (!slug || !SLUG_RE.test(slug)) {
+        return res.status(400).json({ error: "invalid slug" });
+      }
+      const projectPath = typeof req.query?.project_path === "string" && req.query.project_path
+        ? req.query.project_path
+        : undefined;
+      let entry;
+      try { entry = loadSkill(slug, { projectPath }); } catch { entry = null; }
+      if (!entry) return res.status(404).json({ error: `skill "${slug}" not found` });
+      // Only user-managed skills (global ~/.apx/skills or project .apc/skills)
+      // can be deleted; built-in ones ship with apx.
+      if (entry.source !== "global" && entry.source !== "project") {
+        return res.status(403).json({ error: `built-in skill "${slug}" cannot be deleted (it ships with apx)` });
+      }
+      // The skill dir is the parent of its SKILL.md (dir-style) — never the
+      // shared skills root itself.
+      const dir = path.dirname(entry.file);
+      const roots = [SKILL_LOCATIONS.global, projectPath ? apcSkillsDir(projectPath) : null]
+        .filter(Boolean)
+        .map((p) => path.resolve(p));
+      if (roots.includes(path.resolve(dir))) {
+        // Flat-style <slug>.md — remove just the file.
+        fs.rmSync(entry.file, { force: true });
+      } else {
+        fs.rmSync(dir, { recursive: true, force: true });
+      }
+      // Drop any dangling enable/disable overrides for this slug.
+      const cfg = readConfig();
+      const pol = cfg?.skills?.policy;
+      if (pol && typeof pol === "object") {
+        let touched = false;
+        for (const scopeKey of Object.keys(pol)) {
+          if (pol[scopeKey] && slug in pol[scopeKey]) {
+            delete pol[scopeKey][slug];
+            if (Object.keys(pol[scopeKey]).length === 0) delete pol[scopeKey];
+            touched = true;
+          }
+        }
+        if (touched) writeConfig(cfg);
+      }
+      res.json({ ok: true, slug });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
   // ---- Inspector config + status -----------------------------------------
 
   app.get("/skills/inspector", (_req, res) => {

package/src/interfaces/cli/commands/skills.js

@@ -215,10 +215,11 @@ export async function cmdSkillsList(args = {}) {
       console.log("(no skills available)");
       return;
     }
-    console.log(`SLUG`.padEnd(28) + "SOURCE".padEnd(10) + "DESCRIPTION");
+    console.log(`SLUG`.padEnd(28) + "SOURCE".padEnd(10) + "STATE".padEnd(10) + "DESCRIPTION");
     for (const s of out.skills) {
       const desc = (s.description || "").slice(0, 70);
-      console.log(s.slug.padEnd(28) + (s.source || "?").padEnd(10) + desc);
+      const state = s.private ? "private" : s.enabled === false ? "off" : "on";
+      console.log(s.slug.padEnd(28) + (s.source || "?").padEnd(10) + state.padEnd(10) + desc);
     }
     return;
   }