@foggy-projects/deepseek-harness-plugin 0.4.0-beta.3 → 0.4.0-beta.5

package/README.md

@@ -8,7 +8,7 @@ only when the user selects **Initialize Foggy**.
 ## Local beta installation
 
 ```powershell
-dsh plugin --profile web add --workspace-root ./foggy-projects-deepseek-harness-plugin-0.4.0-beta.3.tgz
+dsh plugin --profile web add --workspace-root ./foggy-projects-deepseek-harness-plugin-0.4.0-beta.5.tgz
 ```
 
 Restart `dsh web`, open Settings → Plugins → Foggy Data Analysis, and initialize
@@ -20,13 +20,27 @@ After npm beta publication, the corresponding one-line install is:
 dsh plugin --profile web add --workspace-root @foggy-projects/deepseek-harness-plugin@beta
 ```
 
-For development, `FOGGY_PROJECT_ROOT` can override the workspace that receives
-the Skills and `FOGGY_ASSET_CACHE_DIRS` can contain platform-delimited verified
-asset-cache directories. Neither variable is required for a normal install.
+For development, `FOGGY_ASSET_CACHE_DIRS` can contain platform-delimited verified
+asset-cache directories. It is not required for a normal install.
 
 Database credentials are deliberately outside the ordinary DSH settings
 document. The database and semantic-layer wizard is the next Bundle milestone.
 
+## Native Skill and workspace contract
+
+The Bundle registers `foggy-deepseek-onboarding` and the downloaded
+`foggy-ai-analysis` through DeepSeek Harness's native Skill provider API. Skills
+are available in every DSH workspace without copying or symlinking `.agents`.
+The current session `cwd` remains the workspace boundary for semantic drafts and
+evidence.
+
+CLI, Launcher, the analysis Skill, install state, and Runtime state live in the
+user-level Foggy component directories. The managed CLI is intentionally isolated
+and does not need to be on `PATH`. **Re-download / Repair** verifies the global
+analysis Skill, backs up modified or outdated managed content, restores it, and
+invalidates DSH's Skill catalog. The onboarding Skill is bundled with the plugin
+and is restored by reinstalling or upgrading the plugin package.
+
 ## Linux and WSL2 experience
 
 Ubuntu and WSL2 users can use the checked-in preflighted installer under

package/experience/linux/prepare.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 DSH_VERSION="0.1.1-rc.2"
 PNPM_VERSION="11.7.0"
-PLUGIN_VERSION="0.4.0-beta.3"
+PLUGIN_VERSION="0.4.0-beta.4"
 PLUGIN_REF="v${PLUGIN_VERSION}"
 PLUGIN_REPOSITORY="https://github.com/foggy-projects/foggy-deepseek-harness-plugin.git"
 

package/lib/client.js

@@ -41,6 +41,8 @@ window.__ModuleLoader__.load({
       cli: 'CLI',
       launcher: 'Launcher',
       analysisSkill: '分析 Skill',
+      onboardingSkill: '引导 Skill',
+      skillRegistry: 'DSH Skill 注册',
       python: 'Python',
       java: 'Java',
       installed: '已安装',
@@ -57,7 +59,7 @@ window.__ModuleLoader__.load({
       progressCli: '准备 CLI',
       progressLauncher: '准备 Launcher',
       progressAnalysis: '准备分析 Skill',
-      progressSkills: '安装工作区 Skills',
+      progressSkills: '注册 DSH Skills',
       progressState: '写入安装状态',
       progressComplete: '初始化完成',
       progressFiles: '文件',
@@ -67,9 +69,8 @@ window.__ModuleLoader__.load({
       installRoot: '组件目录',
       dataRoot: '数据目录',
       runtimeUrl: 'Runtime 地址',
-      projectRoot: 'Skill 目标工作区',
       nextTitle: '后续配置',
-      nextCopy: 'Runtime 启动成功后，将继续进入数据库连接与语义层向导。数据库密码不会写入 DSH 普通设置。',
+      nextCopy: 'Skills 已通过 DeepSeek Harness 原生注册表提供给所有工作区；每个会话直接使用自己的工作目录。Runtime 启动成功后，将继续进入数据库连接与语义层向导。',
       beta: 'Beta',
     }
 
@@ -88,6 +89,8 @@ window.__ModuleLoader__.load({
       cli: 'CLI',
       launcher: 'Launcher',
       analysisSkill: 'Analysis Skill',
+      onboardingSkill: 'Onboarding Skill',
+      skillRegistry: 'DSH Skill registry',
       python: 'Python',
       java: 'Java',
       installed: 'Installed',
@@ -104,7 +107,7 @@ window.__ModuleLoader__.load({
       progressCli: 'Preparing CLI',
       progressLauncher: 'Preparing Launcher',
       progressAnalysis: 'Preparing analysis Skill',
-      progressSkills: 'Installing workspace Skills',
+      progressSkills: 'Registering DSH Skills',
       progressState: 'Writing install state',
       progressComplete: 'Initialization complete',
       progressFiles: 'files',
@@ -114,9 +117,8 @@ window.__ModuleLoader__.load({
       installRoot: 'Components',
       dataRoot: 'Data',
       runtimeUrl: 'Runtime URL',
-      projectRoot: 'Skill target workspace',
       nextTitle: 'Next configuration',
-      nextCopy: 'After the Runtime starts, the database connection and semantic-layer wizard comes next. Database passwords are never stored in ordinary DSH settings.',
+      nextCopy: 'Skills are provided to every workspace through the native DeepSeek Harness registry, and each session uses its own working directory. After Runtime starts, the database connection and semantic-layer wizard comes next.',
       beta: 'Beta',
     }
 
@@ -264,8 +266,8 @@ window.__ModuleLoader__.load({
           jsxs('div', { className: 'foggy-state', children: [jsx('span', { className: 'foggy-dot', 'data-state': status.state }), jsx('span', { children: t(stateLabels[status.state] || 'notInstalled') })] }),
           jsxs('div', { className: 'foggy-actions', children: [
             jsx('button', { className: 'foggy-button', type: 'button', disabled: busy, onClick: refresh, children: t('refresh') }),
-            !status.installed ? jsx('button', { className: 'foggy-button foggy-button-primary', type: 'button', disabled: busy, onClick: () => run('initialize'), children: t('initialize') }) : null,
-            status.installed ? jsx('button', { className: 'foggy-button', type: 'button', disabled: busy, onClick: () => run('repair'), children: t('repair') }) : null,
+            status.state === 'not-installed' ? jsx('button', { className: 'foggy-button foggy-button-primary', type: 'button', disabled: busy, onClick: () => run('initialize'), children: t('initialize') }) : null,
+            status.state !== 'not-installed' ? jsx('button', { className: 'foggy-button', type: 'button', disabled: busy, onClick: () => run('repair'), children: t('repair') }) : null,
             status.installed && !status.running && status.components.java.available ? jsx('button', { className: 'foggy-button foggy-button-primary', type: 'button', disabled: busy, onClick: () => run('runtimeStart'), children: t('start') }) : null,
             status.running ? jsx('button', { className: 'foggy-button', type: 'button', disabled: busy, onClick: () => run('runtimeStop'), children: t('stop') }) : null,
           ] }),
@@ -278,13 +280,14 @@ window.__ModuleLoader__.load({
           componentCard(t('cli'), status.components.cli, 'runtime', t),
           componentCard(t('launcher'), status.components.launcher, 'runtime', t),
           componentCard(t('analysisSkill'), status.components.analysisSkill, 'runtime', t),
+          componentCard(t('onboardingSkill'), status.components.onboardingSkill, 'runtime', t),
+          componentCard(t('skillRegistry'), { installed: status.components.onboardingSkill?.provider === 'foggy-managed-skills', version: 'native' }, 'runtime', t),
         ] }),
         jsxs('div', { className: 'foggy-paths', children: [
           jsx('h4', { children: t('roots') }),
           jsxs('dl', { children: [
             jsx('dt', { children: t('installRoot') }), jsx('dd', { children: status.roots.installRoot }),
             jsx('dt', { children: t('dataRoot') }), jsx('dd', { children: status.roots.dataRoot }),
-            jsx('dt', { children: t('projectRoot') }), jsx('dd', { children: status.projectRoot }),
             status.runtimeUrl ? jsx('dt', { children: t('runtimeUrl') }) : null,
             status.runtimeUrl ? jsx('dd', { children: status.runtimeUrl }) : null,
           ] }),

package/lib/index.js

@@ -5,6 +5,7 @@ import { dirname, join, delimiter } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { promisify } from 'node:util'
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol'
+import { createFoggySkillProvider } from './skill-provider.js'
 import { compatible } from './version.js'
 
 const execFileAsync = promisify(execFile)
@@ -120,10 +121,18 @@ function operationView(operation) {
 }
 
 export class FoggyIntegrationGateway extends TypertRemoteService {
+  static inject = ['skills']
+
   operation = null
+  skillProviderControl = null
 
   constructor(ctx) {
     super(ctx, 'foggyIntegration')
+    const roots = defaultRoots()
+    ctx.skills.registerProvider((control) => {
+      this.skillProviderControl = control
+      return createFoggySkillProvider({ installRoot: roots.installRoot, versionsFile })
+    })
     for (const initialize of markerInitializers) initialize.call(this)
   }
 
@@ -147,6 +156,9 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
     try { runtime = await readJson(runtimeStatePath) } catch {}
     const cliPath = state?.cli?.command
     const launcherPath = state?.launcher?.path
+    const analysisSkillPath = state?.skills?.analysis?.path || join(roots.installRoot, 'skills', 'foggy-ai-analysis')
+    const onboardingSkillPath = join(packageRoot, 'skills', 'foggy-deepseek-onboarding')
+    const analysisMarker = await readOptionalJson(join(analysisSkillPath, '.foggy-managed-skill.json'))
     const components = {
       python,
       java,
@@ -159,11 +171,23 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
         version: state?.launcher?.version ?? manifest.components.launcher.version,
       },
       analysisSkill: {
-        installed: Boolean(state?.skills?.analysis?.path && await exists(state.skills.analysis.path)),
+        installed: Boolean(
+          await exists(join(analysisSkillPath, 'SKILL.md'))
+          && analysisMarker?.schemaVersion === 'foggy-managed-skill/v1'
+          && analysisMarker?.componentVersion === manifest.components.analysisSkill.version
+        ),
         version: state?.skills?.analysis?.version ?? manifest.components.analysisSkill.version,
       },
+      onboardingSkill: {
+        installed: await exists(join(onboardingSkillPath, 'SKILL.md')),
+        version: manifest.packageVersion,
+        provider: 'foggy-managed-skills',
+      },
     }
-    const installed = components.cli.installed && components.launcher.installed && components.analysisSkill.installed
+    const installed = components.cli.installed
+      && components.launcher.installed
+      && components.analysisSkill.installed
+      && components.onboardingSkill.installed
     const running = Boolean(runtime && processRunning(Number(runtime.pid)))
     const progress = await readOptionalJson(progressPath)
     let operation = operationView(this.operation)
@@ -189,7 +213,6 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
       running,
       runtimeUrl: running ? runtime.runtimeUrl ?? null : null,
       roots,
-      projectRoot: process.env.FOGGY_PROJECT_ROOT || process.cwd(),
       components,
       operation,
       next: installed ? (running ? 'configure-database' : 'start-runtime') : 'initialize',
@@ -202,13 +225,14 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
     return {
       success: true,
       roots,
-      projectRoot: process.env.FOGGY_PROJECT_ROOT || process.cwd(),
+      workspaceMode: 'dsh-session-cwd',
       versions: Object.fromEntries(Object.entries(manifest.components).map(([name, value]) => [name, value.version])),
       operations: [
         'create isolated Python environment',
         'download and verify pinned CLI and Launcher assets',
-        'install Foggy analysis and onboarding Skills into the workspace',
-        'write local install state',
+        'install the Foggy analysis Skill into the global managed component directory',
+        'register onboarding and analysis Skills through the native DSH Skill registry',
+        'write global install state; resolve each workspace from the DSH session cwd',
       ],
       secretsInDshSettings: false,
     }
@@ -235,7 +259,7 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
       return { success: false, accepted: false, operation: operationView(this.operation), error: 'another Foggy operation is running' }
     }
     const id = `${Date.now()}-${Math.random().toString(16).slice(2, 10)}`
-    const args = explicitArgs ?? ['install', '--project-root', process.env.FOGGY_PROJECT_ROOT || process.cwd()]
+    const args = explicitArgs ?? ['install']
     if (!explicitArgs) {
       const roots = defaultRoots()
       args.push('--progress-file', join(roots.dataRoot, 'operation-progress.json'), '--operation-id', id, '--operation-kind', kind)
@@ -270,6 +294,7 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
         operation.state = result.success === false ? 'failed' : 'succeeded'
         operation.result = result
         operation.finishedAt = new Date().toISOString()
+        this.skillProviderControl?.invalidate()
         if (operation.progress) {
           operation.progress = {
             ...operation.progress,
@@ -284,6 +309,7 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
         operation.state = 'failed'
         operation.error = String(error.message ?? error)
         operation.finishedAt = new Date().toISOString()
+        this.skillProviderControl?.invalidate()
         if (operation.progress) {
           operation.progress = {
             ...operation.progress,

package/lib/skill-provider.js

@@ -0,0 +1,111 @@
+import { access, readFile } from 'node:fs/promises'
+import { constants as fsConstants } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { BUNDLED_SKILL_RANK } from '@deepseek-ai/dsh-skill'
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)))
+const onboardingRoot = join(packageRoot, 'skills', 'foggy-deepseek-onboarding')
+const onboardingPath = join(onboardingRoot, 'SKILL.md')
+const providerName = 'foggy-managed-skills'
+const invocation = { modelInvocable: true, userInvocable: true }
+
+async function exists(path) {
+  try {
+    await access(path, fsConstants.F_OK)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function readOptionalJson(path) {
+  try {
+    return JSON.parse(await readFile(path, 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+function parseSkill(source, expectedName) {
+  const match = source.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/)
+  if (!match) throw new Error(`Foggy Skill ${expectedName} has no valid frontmatter`)
+  const metadata = Object.fromEntries(match[1].split(/\r?\n/).flatMap((line) => {
+    const separator = line.indexOf(':')
+    if (separator < 1) return []
+    return [[line.slice(0, separator).trim(), line.slice(separator + 1).trim().replace(/^(['\"])(.*)\1$/, '$2')]]
+  }))
+  if (metadata.name !== expectedName || !metadata.description) {
+    throw new Error(`Foggy Skill ${expectedName} has invalid name or description metadata`)
+  }
+  return { metadata, content: match[2] }
+}
+
+function candidate(name, description, path, source) {
+  const root = dirname(path)
+  return {
+    name,
+    description,
+    invocation,
+    provider: providerName,
+    source,
+    resourceBase: { kind: 'directory', path: root },
+    rank: BUNDLED_SKILL_RANK,
+    locator: { name, path },
+    path,
+  }
+}
+
+async function managedAnalysisSkill(installRoot, manifest) {
+  const state = await readOptionalJson(join(installRoot, 'install-state.json'))
+  const path = state?.skills?.analysis?.path
+  if (!path || !await exists(join(path, 'SKILL.md'))) return null
+  const marker = await readOptionalJson(join(path, '.foggy-managed-skill.json'))
+  if (
+    marker?.schemaVersion !== 'foggy-managed-skill/v1'
+    || marker?.kind !== 'analysis'
+    || marker?.componentVersion !== manifest.components.analysisSkill.version
+  ) return null
+  return join(path, 'SKILL.md')
+}
+
+export function createFoggySkillProvider({ installRoot, versionsFile }) {
+  return {
+    name: providerName,
+    async list(options = {}) {
+      if (options.signal?.aborted) return []
+      const manifest = await readOptionalJson(versionsFile)
+      const onboarding = parseSkill(await readFile(onboardingPath, 'utf8'), 'foggy-deepseek-onboarding')
+      const result = [candidate(
+        'foggy-deepseek-onboarding',
+        onboarding.metadata.description,
+        onboardingPath,
+        'bundled',
+      )]
+      if (!manifest) return result
+      const analysisPath = await managedAnalysisSkill(installRoot, manifest)
+      if (analysisPath) {
+        const analysis = parseSkill(await readFile(analysisPath, 'utf8'), 'foggy-ai-analysis')
+        result.push(candidate('foggy-ai-analysis', analysis.metadata.description, analysisPath, 'bundled'))
+      }
+      return result
+    },
+    async get(selected, options = {}) {
+      if (options.signal?.aborted) return undefined
+      const locator = selected?.locator
+      if (!locator?.name || !locator?.path || !await exists(locator.path)) return undefined
+      const parsed = parseSkill(await readFile(locator.path, 'utf8'), locator.name)
+      return {
+        name: locator.name,
+        description: parsed.metadata.description,
+        invocation,
+        provider: providerName,
+        source: selected.source,
+        resourceBase: { kind: 'directory', path: dirname(locator.path) },
+        content: parsed.content,
+        path: locator.path,
+        metadata: parsed.metadata,
+      }
+    },
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foggy-projects/deepseek-harness-plugin",
-  "version": "0.4.0-beta.3",
+  "version": "0.4.0-beta.5",
   "description": "Foggy Java data analysis engine integration for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",
@@ -50,10 +50,11 @@
     "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-skill": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-typert-protocol": "^0.1.1-rc.2"
   },
   "scripts": {
-    "check": "node --check lib/index.js && node --check lib/client.js && node --check lib/typert.js && node --check lib/remote.js",
+    "check": "node --check lib/index.js && node --check lib/skill-provider.js && node --check lib/client.js && node --check lib/typert.js && node --check lib/remote.js",
     "test": "node --test test/package.test.js"
   }
 }

package/skills/foggy-deepseek-onboarding/SKILL.md

@@ -7,6 +7,24 @@ description: Install and operate a pinned Foggy CLI-first dev/test environment f
 
 Set up Foggy through shell and `foggy-runtime` CLI. Do not configure Foggy MCP for this local workflow.
 
+## Native registry and installed-state gate
+
+This Skill is registered by the Foggy plugin through DeepSeek Harness's native Skill registry. Its
+resource base is the authoritative location for these scripts and references; do not search for or
+copy this Skill into the current workspace.
+
+- Resolve the global install state from the platform default component directory: on Linux use
+  `${XDG_DATA_HOME:-$HOME/.local/share}/foggy/deepseek-harness/install-state.json`; on Windows use
+  `%LOCALAPPDATA%\Foggy\DeepSeekHarness\install-state.json`.
+- Confirm the installation with this Skill's `doctor` wrapper and pass the current DSH session
+  workspace as `--project-root`. The absence of `foggy-runtime` from `PATH` is not evidence that the
+  managed CLI is missing; the plugin intentionally installs it in an isolated environment and records
+  its absolute command in the global install state.
+- Do not independently download or reinstall the CLI. If the global install state, managed marker, or
+  analysis Skill is missing or invalid, ask the user to open the Foggy plugin settings and use
+  **Re-download / Repair**. Repair restores the global managed analysis Skill and invalidates the
+  native DSH Skill catalog. Reinstall or upgrade the plugin itself to restore this bundled Skill.
+
 ## Mandatory orchestration boundary
 
 For every new-database onboarding session, this Skill is the orchestration authority until
@@ -42,13 +60,14 @@ For every new-database onboarding session, this Skill is the orchestration autho
 
 ## Workflow
 
-1. Run `scripts/doctor.ps1 --project-root <root>` on Windows or
-   `bash scripts/doctor.sh --project-root <root>` on Linux.
-2. If the pinned CLI, Launcher, or analysis Skill is missing, run the matching `install` script. Use
-   `--dry-run` first when paths or permissions are uncertain.
+1. Run `scripts/doctor.ps1 --project-root <current-session-workspace>` on Windows or
+   `bash scripts/doctor.sh --project-root <current-session-workspace>` on Linux.
+2. If the pinned CLI, Launcher, or global managed analysis Skill is missing, use the Foggy
+   plugin's Repair action. Use the matching install script only when the plugin UI is unavailable;
+   use `--dry-run` first when paths or permissions are uncertain.
 3. Run `runtime-start` and require successful `wait-ready` plus `capabilities`. Record engine,
    Runtime API version, schema version, security mode, URL, namespace, PID, and evidence path.
-4. Confirm the project contains `.agents/skills/foggy-ai-analysis/SKILL.md`.
+4. Load `foggy-ai-analysis` from the native DSH Skill registry. Do not require a workspace copy.
 5. For a new business database, read [references/onboarding-workflow.md](references/onboarding-workflow.md)
    and prefer its two composite `onboard-datasource-run` / `onboard-semantic-run` commands. Require the
    trusted operator to create the private CLI profile outside Harness. Accept only the opaque profile

package/skills/foggy-deepseek-onboarding/assets/versions.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "foggy-deepseek-onboarding-versions/v1",
-  "packageVersion": "0.4.0-beta.3",
-  "validatedAt": "2026-08-28",
+  "packageVersion": "0.4.0-beta.5",
+  "validatedAt": "2026-09-01",
   "components": {
     "deepseekHarness": {
       "version": "0.1.1-rc.2",

package/skills/foggy-deepseek-onboarding/scripts/onboarding.py

@@ -25,6 +25,9 @@ import zipfile
 STATE_SCHEMA = "foggy-deepseek-onboarding-install/v1"
 RUNTIME_STATE_SCHEMA = "foggy-deepseek-onboarding-runtime/v1"
 ONBOARDING_STATE_SCHEMA = "foggy-deepseek-onboarding-state/v1"
+MANAGED_SKILL_SCHEMA = "foggy-managed-skill/v1"
+MANAGED_SKILL_MARKER = ".foggy-managed-skill.json"
+LEGACY_SKILL_MARKER = ".foggy-onboarding-install.json"
 CONNECTION_SCHEMA = "foggy-deepseek-connection/v1"
 SEMANTIC_PLAN_SCHEMA = "foggy-deepseek-semantic-plan/v1"
 PROFILE_PATTERN = re.compile(r"^[a-z0-9][a-z0-9._-]{0,62}$")
@@ -331,6 +334,98 @@ def atomic_json(path: Path, payload: dict) -> None:
     os.replace(temporary, path)
 
 
+def skill_tree_digest(root: Path) -> str:
+    """Hash managed Skill content while ignoring generated and management files."""
+    digest = hashlib.sha256()
+    ignored_names = {MANAGED_SKILL_MARKER, LEGACY_SKILL_MARKER}
+    files = sorted(
+        path for path in root.rglob("*")
+        if path.is_file()
+        and path.name not in ignored_names
+        and "__pycache__" not in path.parts
+        and path.suffix != ".pyc"
+    )
+    for path in files:
+        relative = path.relative_to(root).as_posix().encode("utf-8")
+        digest.update(len(relative).to_bytes(4, "big"))
+        digest.update(relative)
+        with path.open("rb") as stream:
+            for chunk in iter(lambda: stream.read(1024 * 1024), b""):
+                digest.update(chunk)
+    return digest.hexdigest()
+
+
+def read_skill_marker(destination: Path) -> dict | None:
+    for name in (MANAGED_SKILL_MARKER, LEGACY_SKILL_MARKER):
+        marker = destination / name
+        if marker.is_file():
+            try:
+                payload = json.loads(marker.read_text(encoding="utf-8"))
+                if isinstance(payload, dict):
+                    return payload
+            except (OSError, json.JSONDecodeError):
+                return None
+    return None
+
+
+def managed_skill_status(destination: Path, kind: str, expected_version: str) -> dict:
+    marker = read_skill_marker(destination)
+    present = (destination / "SKILL.md").is_file()
+    actual_digest = skill_tree_digest(destination) if destination.is_dir() else None
+    marker_digest = marker.get("installedDigest") if marker else None
+    managed = bool(
+        marker
+        and marker.get("schemaVersion") == MANAGED_SKILL_SCHEMA
+        and marker.get("kind") == kind
+    )
+    version = marker.get("componentVersion") if marker else None
+    return {
+        "path": str(destination),
+        "present": present,
+        "markerPresent": bool(marker),
+        "managed": managed,
+        "version": version,
+        "versionMatches": version == expected_version,
+        "integrityValid": bool(marker_digest and actual_digest == marker_digest),
+        "valid": bool(present and managed and version == expected_version and marker_digest and actual_digest == marker_digest),
+    }
+
+
+def write_skill_marker(
+    destination: Path,
+    *,
+    kind: str,
+    package_version: str,
+    component_version: str,
+    source_digest: str,
+    archive_sha256: str | None = None,
+) -> dict:
+    marker = {
+        "schemaVersion": MANAGED_SKILL_SCHEMA,
+        "kind": kind,
+        "managedBy": "@foggy-projects/deepseek-harness-plugin",
+        "packageVersion": package_version,
+        "componentVersion": component_version,
+        "sourceDigest": source_digest,
+        "installedDigest": skill_tree_digest(destination),
+        "installedAt": now_utc(),
+    }
+    if archive_sha256:
+        marker["archiveSha256"] = archive_sha256
+    atomic_json(destination / MANAGED_SKILL_MARKER, marker)
+    legacy = destination / LEGACY_SKILL_MARKER
+    if legacy.is_file():
+        legacy.unlink()
+    return marker
+
+
+def backup_skill(destination: Path, backup_root: Path) -> Path:
+    backup_root.mkdir(parents=True, exist_ok=True)
+    backup = backup_root / f"{destination.name}-{dt.datetime.now().strftime('%Y%m%d-%H%M%S-%f')}"
+    shutil.move(str(destination), str(backup))
+    return backup
+
+
 def read_json_object(path: Path, label: str) -> dict:
     if not path.is_file():
         raise OnboardingError(f"{label} not found: {path}")
@@ -621,22 +716,16 @@ def safe_extract(zip_path: Path, destination: Path) -> None:
         archive.extractall(destination)
 
 
-def install_analysis_skill(zip_path: Path, project_root: Path, version: str, expected_hash: str, replace: bool) -> dict:
-    skills_root = project_root / ".agents" / "skills"
+def install_analysis_skill(
+    zip_path: Path,
+    install_root: Path,
+    version: str,
+    expected_hash: str,
+    package_version: str,
+    replace: bool,
+) -> dict:
+    skills_root = install_root / "skills"
     destination = skills_root / "foggy-ai-analysis"
-    marker = destination / ".foggy-onboarding-install.json"
-    if destination.exists():
-        if marker.is_file():
-            installed = json.loads(marker.read_text(encoding="utf-8"))
-            if installed.get("archiveSha256") == expected_hash:
-                return {"path": str(destination), "version": version, "action": "kept-matching"}
-        if not replace:
-            raise OnboardingError(f"Analysis Skill already exists and is not managed at {destination}; rerun with --replace-skill to back it up")
-        backup_root = project_root / ".foggy" / "onboarding-backups"
-        backup_root.mkdir(parents=True, exist_ok=True)
-        backup = backup_root / f"foggy-ai-analysis-{dt.datetime.now().strftime('%Y%m%d-%H%M%S')}"
-        shutil.move(str(destination), str(backup))
-    skills_root.mkdir(parents=True, exist_ok=True)
     with tempfile.TemporaryDirectory(prefix="foggy-skill-") as temporary:
         extract_root = Path(temporary)
         safe_extract(zip_path, extract_root)
@@ -644,21 +733,41 @@ def install_analysis_skill(zip_path: Path, project_root: Path, version: str, exp
         if len(candidates) != 1:
             raise OnboardingError(f"Expected exactly one SKILL.md in analysis Skill archive, found {len(candidates)}")
         source = candidates[0].parent
+        source_digest = skill_tree_digest(source)
+        if destination.exists():
+            installed = read_skill_marker(destination)
+            actual_digest = skill_tree_digest(destination)
+            marker_matches = bool(
+                installed
+                and installed.get("schemaVersion") in (MANAGED_SKILL_SCHEMA, "foggy-installed-skill/v1")
+                and installed.get("archiveSha256") == expected_hash
+                and (installed.get("sourceDigest") or installed.get("installedDigest") or actual_digest) == source_digest
+                and actual_digest == source_digest
+            )
+            if marker_matches:
+                marker = write_skill_marker(
+                    destination,
+                    kind="analysis",
+                    package_version=package_version,
+                    component_version=version,
+                    source_digest=source_digest,
+                    archive_sha256=expected_hash,
+                )
+                return {"path": str(destination), "version": version, "digest": marker["installedDigest"], "managed": True, "action": "kept-matching"}
+            if not replace:
+                raise OnboardingError(f"Analysis Skill is missing, modified, or outdated at {destination}; use the plugin Repair action to back it up and restore it")
+            backup_skill(destination, install_root / "skill-backups")
+        skills_root.mkdir(parents=True, exist_ok=True)
         shutil.copytree(source, destination)
-    atomic_json(marker, {"schemaVersion": "foggy-installed-skill/v1", "version": version, "archiveSha256": expected_hash})
-    return {"path": str(destination), "version": version, "action": "installed"}
-
-
-def install_onboarding_skill(project_root: Path) -> dict:
-    destination = project_root / ".agents" / "skills" / "foggy-deepseek-onboarding"
-    source = skill_root()
-    if source.resolve() == destination.resolve(strict=False):
-        return {"path": str(destination), "action": "already-running-from-target"}
-    if destination.exists():
-        return {"path": str(destination), "action": "kept-existing"}
-    destination.parent.mkdir(parents=True, exist_ok=True)
-    shutil.copytree(source, destination)
-    return {"path": str(destination), "action": "installed"}
+    marker = write_skill_marker(
+        destination,
+        kind="analysis",
+        package_version=package_version,
+        component_version=version,
+        source_digest=source_digest,
+        archive_sha256=expected_hash,
+    )
+    return {"path": str(destination), "version": version, "digest": marker["installedDigest"], "managed": True, "action": "installed"}
 
 
 def read_install_state(install_root: Path, required: bool = True) -> dict | None:
@@ -687,7 +796,6 @@ def install_command(args: argparse.Namespace) -> dict:
     versions = load_versions()
     install_root = normalized(args.install_root or default_install_root())
     data_root = normalized(args.data_root or default_data_root())
-    project_root = normalized(args.project_root or Path.cwd())
     cache_dirs = [normalized(item) for item in args.asset_cache_dir]
     components = versions["components"]
     assert_managed_root(install_root, "Install root")
@@ -698,9 +806,9 @@ def install_command(args: argparse.Namespace) -> dict:
         "schemaVersion": "foggy-deepseek-onboarding-plan/v1",
         "installRoot": str(install_root),
         "dataRoot": str(data_root),
-        "projectRoot": str(project_root),
+        "workspaceMode": "dsh-session-cwd",
         "versions": {name: value.get("version") for name, value in components.items()},
-        "operations": ["install isolated CLI", "verify Launcher assets", "install project Skills", "write install state"],
+        "operations": ["install isolated CLI", "verify Launcher assets", "install global analysis Skill", "write install state"],
         "productionReady": False,
     }
     if args.dry_run:
@@ -714,8 +822,6 @@ def install_command(args: argparse.Namespace) -> dict:
     progress.update("preflight", 0, "Checking prerequisites")
     if sys.version_info < (3, 11):
         raise OnboardingError(f"Python 3.11+ required, got {sys.version.split()[0]}")
-    if not project_root.is_dir():
-        raise OnboardingError(f"Project root not found: {project_root}")
     install_root.mkdir(parents=True, exist_ok=True)
     data_root.mkdir(parents=True, exist_ok=True)
     downloads = install_root / "downloads"
@@ -820,19 +926,26 @@ def install_command(args: argparse.Namespace) -> dict:
     zip_asset = next(item for item in analysis_assets if item["role"] == "zip")
     progress.update("analysis-skill", 3, "Installing analysis Skill", fraction=0.9, current_file=zip_asset["file"])
     analysis_skill = install_analysis_skill(
-        downloads / "skill" / zip_asset["file"], project_root, components["analysisSkill"]["version"], zip_asset["sha256"], args.replace_skill
+        downloads / "skill" / zip_asset["file"], install_root, components["analysisSkill"]["version"],
+        zip_asset["sha256"], versions["packageVersion"], args.replace_skill,
     )
     progress.update("analysis-skill", 3, "Analysis Skill ready", fraction=1.0)
-    progress.update("workspace-skills", 4, "Installing onboarding Skill", fraction=0.1)
-    onboarding_skill = install_onboarding_skill(project_root)
-    progress.update("workspace-skills", 4, "Workspace Skills ready", fraction=1.0)
+    progress.update("workspace-skills", 4, "Registering native DSH Skills", fraction=0.1)
+    onboarding_skill = {
+        "path": str(skill_root()),
+        "version": versions["packageVersion"],
+        "managed": False,
+        "action": "provided-by-plugin",
+        "provider": "foggy-managed-skills",
+    }
+    progress.update("workspace-skills", 4, "Native DSH Skills ready", fraction=1.0)
     state = {
         "schemaVersion": STATE_SCHEMA,
         "installedAt": now_utc(),
         "packageVersion": versions["packageVersion"],
         "installRoot": str(install_root),
         "dataRoot": str(data_root),
-        "projectRoot": str(project_root),
+        "workspaceMode": "dsh-session-cwd",
         "cli": {"version": cli_component["version"], "command": str(cli_command), "mode": cli_mode},
         "launcher": {"version": components["launcher"]["version"], "path": str(launcher_dir)},
         "skills": {"onboarding": onboarding_skill, "analysis": analysis_skill},
@@ -850,7 +963,7 @@ def install_command(args: argparse.Namespace) -> dict:
         "statePath": str(install_root / "install-state.json"),
         "installRoot": str(install_root),
         "dataRoot": str(data_root),
-        "projectRoot": str(project_root),
+        "workspaceMode": "dsh-session-cwd",
         "cliVersion": cli_component["version"],
         "launcherVersion": components["launcher"]["version"],
         "analysisSkill": analysis_skill,
@@ -1112,7 +1225,7 @@ def require_opaque_profile_cli(install_state: dict) -> None:
 def onboarding_plan_command(args: argparse.Namespace) -> dict:
     install_root, install_state, data_root, runtime_state = onboarding_context(args, require_runtime=False)
     profile = safe_profile(args.profile)
-    project_root = normalized(args.project_root or install_state["projectRoot"])
+    project_root = normalized(args.project_root or Path.cwd())
     if not project_root.is_dir():
         raise OnboardingError(f"Project root not found: {project_root}")
     connection_file = normalized(args.connection_file)
@@ -1772,7 +1885,7 @@ def save_composite_result(evidence_dir: Path, name: str, payload: dict, files: l
 
 def datasource_run_command(args: argparse.Namespace) -> dict:
     _install_root, install_state, data_root, _runtime_state = onboarding_context(args, require_runtime=True)
-    project_root = normalized(args.project_root or install_state["projectRoot"])
+    project_root = normalized(args.project_root or Path.cwd())
     requested_connection = validate_connection(read_json_object(normalized(args.connection_file), "Connection plan"))
     if not requested_connection.get("profile"):
         raise OnboardingError("Composite datasource onboarding requires connection.profile in the approved contract")
@@ -2032,8 +2145,17 @@ def doctor_command(args: argparse.Namespace) -> dict:
             path = launcher_dir / asset["file"]
             launcher_checks.append({"file": asset["file"], "present": path.is_file(), "sha256Valid": path.is_file() and sha256(path) == asset["sha256"]})
     launcher_ok = bool(launcher_checks) and all(item["present"] and item["sha256Valid"] for item in launcher_checks)
-    analysis_skill = project_root / ".agents" / "skills" / "foggy-ai-analysis" / "SKILL.md"
-    onboarding_skill = project_root / ".agents" / "skills" / "foggy-deepseek-onboarding" / "SKILL.md"
+    analysis_skill_root = normalized(state.get("skills", {}).get("analysis", {}).get("path") or install_root / "skills" / "foggy-ai-analysis") if state else install_root / "skills" / "foggy-ai-analysis"
+    onboarding_skill_root = skill_root()
+    analysis_skill = managed_skill_status(analysis_skill_root, "analysis", versions["components"]["analysisSkill"]["version"])
+    onboarding_skill = {
+        "path": str(onboarding_skill_root),
+        "present": (onboarding_skill_root / "SKILL.md").is_file(),
+        "managed": False,
+        "version": versions["packageVersion"],
+        "provider": "foggy-managed-skills",
+        "valid": (onboarding_skill_root / "SKILL.md").is_file(),
+    }
     runtime = {"status": "stopped"}
     if state:
         data_root = normalized(state["dataRoot"])
@@ -2047,7 +2169,8 @@ def doctor_command(args: argparse.Namespace) -> dict:
         "java": java_ok,
         "cli": cli_ok,
         "launcher": launcher_ok,
-        "analysisSkill": analysis_skill.is_file(),
+        "analysisSkill": analysis_skill["valid"],
+        "onboardingSkill": onboarding_skill["valid"],
     }
     if args.strict_runtime:
         required["runtime"] = runtime["status"] == "running"
@@ -2061,7 +2184,8 @@ def doctor_command(args: argparse.Namespace) -> dict:
         "java": java,
         "cli": cli,
         "launcherAssets": launcher_checks,
-        "skills": {"analysis": str(analysis_skill), "onboarding": str(onboarding_skill), "onboardingPresent": onboarding_skill.is_file()},
+        "skills": {"analysis": analysis_skill, "onboarding": onboarding_skill},
+        "workspace": {"path": str(project_root), "mode": "dsh-session-cwd"},
         "runtime": runtime,
         "environmentPresence": {name: bool(os.environ.get(name)) for name in ("DEEPSEEK_API_KEY", "ALIYUN_TOKEN_PLAN_API_KEY", "FOGGY_RUNTIME_API_AUTH_CODE", "FOGGY_RUNTIME_AUTHORIZATION")},
         "productionReady": False,
@@ -2077,13 +2201,8 @@ def uninstall_command(args: argparse.Namespace) -> dict:
     assert_managed_root(data_root, "Data root")
     if install_root == data_root:
         raise OnboardingError("Install root and data root must be different")
-    project_root = normalized(state["projectRoot"])
-    skills_root = project_root / ".agents" / "skills"
-    skill_targets = [skills_root / name for name in ("foggy-deepseek-onboarding", "foggy-ai-analysis")]
-    if args.remove_skills:
-        for target in skill_targets:
-            if target.exists() and (target.is_symlink() or not is_child(target, skills_root)):
-                raise OnboardingError(f"Refusing to remove unexpected Skill path: {target}")
+    skills_root = install_root / "skills"
+    skill_targets = [skills_root / "foggy-ai-analysis"]
     plan = {"installRoot": str(install_root), "dataRoot": str(data_root), "removeSkills": args.remove_skills, "purgeData": args.purge_data}
     if args.dry_run:
         return {"success": True, "dryRun": True, "plan": plan}