@geminixiang/mikan 1.0.0-beta.70 → 1.0.0-beta.72

package/CHANGELOG.md

@@ -9,6 +9,24 @@ any release.
 
 ## [Unreleased]
 
+## [1.0.0-beta.72]
+
+### Added
+
+- Admin: the Skills panel (conversation and global) can now create, edit, and delete skills directly, not just list and preview them. Saving writes `SKILL.md` straight into the workspace skills tree the harness loader reads, so a new or edited skill is available on the conversation's next turn.
+
+## [1.0.0-beta.71]
+
+### Changed
+
+- Built-in subagents now use the full 100-turn / $10 allowance, and the model-facing `subagent` tool can only request a larger token allowance instead of accidentally shrinking turn, cost, or duration budgets (for example, to $0.30).
+
+### Fixed
+
+- Shared-memory guidance now keeps personal, project-specific, and tool-specific knowledge in its proper scope, prevents memory from overriding system mechanisms, and removes the obsolete shared `SYSTEM.md` environment log.
+- Console usage summaries now show cache-read tokens alongside fresh input tokens.
+- Sandbox provisioning no longer logs `Container … already running` on every readiness check; creation, restart, drift, and failure messages remain visible.
+
 ## [1.0.0-beta.70]
 
 ### Fixed

package/dist/adapters/web/admin/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/admin/portal.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,qBAAa,uBAAwB,SAAQ,kBAAkB,CAAC,UAAU,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,UAAU,CAUb;CACF;AAoCD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAYpD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,OAAO,CAAC,CA6BlB;AAwGD,UAAU,sBAAsB;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,UAAU,GAChB,sBAAsB,CAexB;AA08BD,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,cAAc,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAwBD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,EAAE,CAuB/F;AAqRD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAmBjF"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/admin/portal.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAKjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,qBAAa,uBAAwB,SAAQ,kBAAkB,CAAC,UAAU,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,UAAU,CAUb;CACF;AAoCD,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAYpD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,OAAO,CAAC,CA6BlB;AA2GD,UAAU,sBAAsB;IAC9B,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,UAAU,GAChB,sBAAsB,CAexB;AA08BD,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,cAAc,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAwBD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,EAAE,CAuB/F;AA8XD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAmBjF"}

package/dist/adapters/web/admin/portal.js

@@ -1,7 +1,8 @@
 import { validateEventFilename } from "../../../events/index.js";
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, } from "node:fs";
 import { basename, join, resolve as pathResolve, sep as pathSep } from "node:path";
-import { MikanModels, parseFrontmatter } from "../../../harness/index.js";
+import { atomicWritePrivateFile } from "../../../file-guards.js";
+import { MikanModels, parseFrontmatter, validateSkill } from "../../../harness/index.js";
 import { SessionStore } from "../../../sessions/session-store.js";
 import { InMemoryTokenStore } from "../token-store.js";
 const ADMIN_TOKEN_TTL_MS = 30 * 60 * 1000;
@@ -104,7 +105,8 @@ async function routeGetApiRequest(res, url, services) {
     }
 }
 async function routePostApiRequest(req, res, url, services) {
-    const body = await readJsonBody(req, res, 32 * 1024);
+    const bodyLimit = url.pathname === "/admin/api/skills/mutate" ? 256 * 1024 : 32 * 1024;
+    const body = await readJsonBody(req, res, bodyLimit);
     if (!body)
         return;
     const token = services.adminTokenStore.peek(typeof body.token === "string" ? body.token : "");
@@ -127,6 +129,8 @@ async function routePostApiRequest(req, res, url, services) {
             return serveConversationEventDelete(res, body, services, token);
         case "/admin/api/mcp-servers/mutate":
             return serveMcpServerMutation(res, body, services, token);
+        case "/admin/api/skills/mutate":
+            return serveSkillMutation(res, body, services, token);
         case "/admin/api/settings/model":
             return serveGlobalModelUpdate(res, body, services);
         case "/admin/api/settings/sandbox":
@@ -1221,6 +1225,96 @@ function serveSkillFile(res, url, services, token) {
     }
     servePreviewFile(res, safe.absolute, { source, directory }, "Skill file not found");
 }
+const SKILL_DIRECTORY_PATTERN = /^[a-z0-9-]+$/;
+function resolveSkillsRoot(workspace, scope, source) {
+    if (source !== "global" && source !== "conversation") {
+        return { error: "Invalid skill source" };
+    }
+    return {
+        root: source === "global" ? workspace.skillsDir : workspace.office(scope.address).skillsDir,
+        source,
+    };
+}
+/**
+ * Create, overwrite, or delete one skill directory. The directory name is
+ * fixed at creation (renaming would leave the old directory as an orphan);
+ * editing an existing skill always targets its current directory. Writes go
+ * straight to the workspace skills tree — the same location the harness
+ * loader reads — so a saved skill is available on the conversation's next
+ * turn without a restart.
+ */
+async function serveSkillMutation(res, body, services, token) {
+    const action = body.action;
+    if (action !== "save" && action !== "delete") {
+        jsonRes(res, 400, { error: "action must be 'save' or 'delete'" });
+        return;
+    }
+    const scope = resolveTargetConversation(body, token);
+    if (scope.error) {
+        jsonRes(res, 403, { error: scope.error });
+        return;
+    }
+    const workspace = requireAdminWorkspace(res, services);
+    if (!workspace)
+        return;
+    const resolved = resolveSkillsRoot(workspace, scope, body.source);
+    if ("error" in resolved) {
+        jsonRes(res, 400, { error: resolved.error });
+        return;
+    }
+    const directory = typeof body.directory === "string" ? body.directory.trim() : "";
+    if (!directory || !SKILL_DIRECTORY_PATTERN.test(directory)) {
+        jsonRes(res, 400, {
+            error: "directory must be lowercase a-z, 0-9 and hyphens",
+        });
+        return;
+    }
+    const safe = safeJoinUnderRoot(resolved.root, directory);
+    if (safe.error) {
+        jsonRes(res, 400, { error: safe.error });
+        return;
+    }
+    if (action === "delete") {
+        if (!existsSync(join(safe.absolute, "SKILL.md"))) {
+            jsonRes(res, 404, { error: "Skill not found" });
+            return;
+        }
+        try {
+            rmSync(safe.absolute, { recursive: true, force: true });
+        }
+        catch (err) {
+            jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
+            return;
+        }
+        jsonRes(res, 200, { ok: true });
+        return;
+    }
+    const name = typeof body.name === "string" ? body.name.trim() : directory;
+    const description = typeof body.description === "string" ? body.description.trim() : "";
+    const content = typeof body.content === "string" ? body.content : "";
+    if (!description) {
+        jsonRes(res, 400, { error: "description is required" });
+        return;
+    }
+    const errors = validateSkill(name, description);
+    if (errors.length > 0) {
+        jsonRes(res, 400, { error: errors.join("; ") });
+        return;
+    }
+    try {
+        if (existsSync(safe.absolute) && lstatSync(safe.absolute).isSymbolicLink()) {
+            throw new Error("Refusing to write through a symlinked skill directory");
+        }
+        mkdirSync(safe.absolute, { recursive: true });
+        const frontmatter = ["---", `name: ${name}`, `description: ${description}`, "---", ""].join("\n");
+        atomicWritePrivateFile(join(safe.absolute, "SKILL.md"), frontmatter + content.trim() + "\n");
+    }
+    catch (err) {
+        jsonRes(res, 500, { error: err instanceof Error ? err.message : String(err) });
+        return;
+    }
+    jsonRes(res, 200, { ok: true, name, directory, source: resolved.source });
+}
 // ── Events ─────────────────────────────────────────────────────────────────────
 /**
  * List events through the owning store, whose payloads are validated by the
@@ -1362,7 +1456,10 @@ const adminViewBody = `<nav class="tab-nav" role="tablist" aria-label="Admin sec
             <p class="eyebrow">Skills</p>
             <h2 class="card-title">可用的 skills</h2>
           </div></div>
-          <button class="refresh-btn" onclick="event.stopPropagation(); loadSkills()">↻</button>
+          <div class="sect-head-actions">
+            <button class="primary-action-btn" onclick="event.stopPropagation(); openSkillDialog('conversation')">+ New skill</button>
+            <button class="refresh-btn" onclick="event.stopPropagation(); loadSkills()">↻</button>
+          </div>
         </summary>
         <div class="sect-body">
           <div class="workspace-split">
@@ -1487,9 +1584,15 @@ const adminViewBody = `<nav class="tab-nav" role="tablist" aria-label="Admin sec
             <p class="eyebrow">Global Skills</p>
             <h2 class="card-title">全域 skills</h2>
           </div>
-          <button class="refresh-btn" onclick="loadGlobalSkills()">↻</button>
+          <div class="sect-head-actions">
+            <button class="primary-action-btn" onclick="openSkillDialog('global')">+ New global skill</button>
+            <button class="refresh-btn" onclick="loadGlobalSkills()">↻</button>
+          </div>
         </header>
-        <div id="global-skills-content"><div class="loading-msg">Loading…</div></div>
+        <div class="workspace-split">
+          <div id="global-skills-content" class="workspace-tree"><div class="loading-msg">Loading…</div></div>
+          <div id="global-skills-preview" class="workspace-preview"><div class="placeholder-msg">Click a skill to preview SKILL.md</div></div>
+        </div>
       </section>
 
       <section class="card sect">
@@ -1534,6 +1637,38 @@ const adminViewBody = `<nav class="tab-nav" role="tablist" aria-label="Admin sec
         <button class="mcp-btn" type="button" onclick="closeMcpCustomDialog()">Cancel</button>
         <button id="mcp-custom-dialog-submit" class="primary-action-btn" type="button" onclick="submitMcpCustomDialog(this)">新增並測試連線</button>
       </div>
+    </dialog>
+
+    <dialog id="skill-dialog" class="mcp-dialog" aria-labelledby="skill-dialog-title">
+      <div class="mcp-dialog-head">
+        <div>
+          <p class="eyebrow" id="skill-dialog-eyebrow">Skill</p>
+          <h2 id="skill-dialog-title" class="card-title">New skill</h2>
+        </div>
+        <button class="mcp-dialog-close" type="button" aria-label="Close" onclick="closeSkillDialog()">×</button>
+      </div>
+      <div class="mcp-field">
+        <span>Directory</span>
+        <input id="skill-dialog-directory" class="form-input mcp-json" placeholder="my-skill" autocomplete="off" />
+        <small class="mcp-secret-note">Lowercase letters, digits, hyphens. Cannot be changed after creation.</small>
+      </div>
+      <div class="mcp-field">
+        <span>Name</span>
+        <input id="skill-dialog-name" class="form-input mcp-json" placeholder="my-skill" autocomplete="off" />
+      </div>
+      <div class="mcp-field">
+        <span>Description</span>
+        <input id="skill-dialog-description" class="form-input mcp-json" placeholder="Use when …" autocomplete="off" />
+      </div>
+      <div class="mcp-field">
+        <span>Instructions (SKILL.md body)</span>
+        <textarea id="skill-dialog-content" class="form-input mcp-json" spellcheck="false" rows="12" placeholder="# My skill&#10;&#10;Instructions here."></textarea>
+      </div>
+      <div id="skill-dialog-error" class="inline-result err" style="display:none"></div>
+      <div class="mcp-dialog-actions">
+        <button class="mcp-btn" type="button" onclick="closeSkillDialog()">Cancel</button>
+        <button id="skill-dialog-submit" class="primary-action-btn" type="button" onclick="submitSkillDialog(this)">Save</button>
+      </div>
     </dialog>`;
 const adminViewScript = `    let activeConversationKey = defaultConversationKey;
     function scopeOf(key) {
@@ -2287,6 +2422,31 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
       void mutateMcpServer(btn.dataset.mcpScope, btn.dataset.mcpAction, btn.dataset.mcpName);
     });
 
+    let skillsCache = [];
+
+    function renderSkillsInto(containerId, skills, allowedSource) {
+      const container = document.getElementById(containerId);
+      if (!container) return;
+      const filtered = allowedSource ? skills.filter((s) => s.source === allowedSource) : skills;
+      if (filtered.length === 0) {
+        container.innerHTML = '<div class="empty-state">No skills available</div>';
+        return;
+      }
+      container.innerHTML = '<div class="skills-list">' +
+        filtered.map((s) =>
+          '<div class="skill-row">' +
+            '<button class="skill-row-btn" data-skill-source="' + escAttr(s.source) + '" data-skill-directory="' + escAttr(s.directory) + '" data-skill-name="' + escAttr(s.name) + '">' +
+              '<div class="skill-name">' + escHtml(s.name) + '<span class="skill-source skill-source-' + s.source + '">' + s.source + '</span></div>' +
+              (s.description ? '<div class="skill-desc">' + escHtml(s.description) + '</div>' : '') +
+            '</button>' +
+            '<div class="skill-row-actions">' +
+              '<button class="mcp-btn" data-skill-edit-source="' + escAttr(s.source) + '" data-skill-edit-directory="' + escAttr(s.directory) + '">Edit</button>' +
+              '<button class="mcp-btn mcp-btn-danger" data-skill-delete-source="' + escAttr(s.source) + '" data-skill-delete-directory="' + escAttr(s.directory) + '" data-skill-delete-name="' + escAttr(s.name) + '">Delete</button>' +
+            '</div>' +
+          '</div>'
+        ).join('') + '</div>';
+    }
+
     async function loadSkills() {
       const container = document.getElementById('skills-content');
       const previewEl = document.getElementById('skills-preview');
@@ -2294,25 +2454,19 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
       if (previewEl) previewEl.innerHTML = '<div class="placeholder-msg">Click a skill to preview SKILL.md</div>';
       try {
         const data = await apiGet('/admin/api/skills?' + scopeQuery());
-        if (data.skills.length === 0) {
-          container.innerHTML = '<div class="empty-state">No skills available</div>';
-          return;
-        }
-        container.innerHTML = '<div class="skills-list">' +
-          data.skills.map((s) =>
-            '<button class="skill-row skill-row-btn" data-skill-source="' + escAttr(s.source) + '" data-skill-directory="' + escAttr(s.directory) + '" data-skill-name="' + escAttr(s.name) + '">' +
-              '<div class="skill-name">' + escHtml(s.name) + '<span class="skill-source skill-source-' + s.source + '">' + s.source + '</span></div>' +
-              (s.description ? '<div class="skill-desc">' + escHtml(s.description) + '</div>' : '') +
-            '</button>'
-          ).join('') + '</div>';
-
+        skillsCache = Array.isArray(data.skills) ? data.skills : [];
+        renderSkillsInto('skills-content', skillsCache);
+        renderSkillsInto('global-skills-content', skillsCache, 'global');
       } catch (err) {
         container.innerHTML = '<div class="err-msg">' + escHtml(err.message) + '</div>';
       }
     }
 
-    async function previewSkill(source, directory, name) {
-      const previewEl = document.getElementById('skills-preview');
+    const loadGlobalSkills = loadSkills;
+
+    async function previewSkillInto(previewId, source, directory, name) {
+      const previewEl = document.getElementById(previewId);
+      if (!previewEl) return;
       if (!source || !directory) {
         previewEl.innerHTML = '<div class="err-msg">Missing skill source or directory</div>';
         return;
@@ -2326,11 +2480,105 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
       }
     }
 
-    document.getElementById('skills-content').addEventListener('click', (event) => {
-      const btn = event.target.closest('[data-skill-source]');
-      if (!btn) return;
-      previewSkill(btn.dataset.skillSource, btn.dataset.skillDirectory, btn.dataset.skillName);
-    });
+    async function deleteSkill(source, directory, name) {
+      if (!confirm('Delete skill "' + (name || directory) + '" (' + source + ')?')) return;
+      try {
+        await apiPost('/admin/api/skills/mutate', { action: 'delete', source: source, directory: directory, ...scopeBody() });
+        await loadSkills();
+      } catch (err) {
+        alert(err.message);
+      }
+    }
+
+    function bindSkillListEvents(containerId, previewId) {
+      const el = document.getElementById(containerId);
+      if (!el) return;
+      el.addEventListener('click', (event) => {
+        const previewBtn = event.target.closest('[data-skill-source]');
+        if (previewBtn) {
+          previewSkillInto(previewId, previewBtn.dataset.skillSource, previewBtn.dataset.skillDirectory, previewBtn.dataset.skillName);
+          return;
+        }
+        const editBtn = event.target.closest('[data-skill-edit-source]');
+        if (editBtn) {
+          const skill = skillsCache.find((s) => s.source === editBtn.dataset.skillEditSource && s.directory === editBtn.dataset.skillEditDirectory);
+          if (skill) void openSkillDialog(skill.source, skill);
+          return;
+        }
+        const deleteBtn = event.target.closest('[data-skill-delete-source]');
+        if (deleteBtn) {
+          void deleteSkill(deleteBtn.dataset.skillDeleteSource, deleteBtn.dataset.skillDeleteDirectory, deleteBtn.dataset.skillDeleteName);
+        }
+      });
+    }
+    bindSkillListEvents('skills-content', 'skills-preview');
+    bindSkillListEvents('global-skills-content', 'global-skills-preview');
+
+    let editingSkill = null;
+    let pendingSkillScope = null;
+
+    async function openSkillDialog(scope, existing) {
+      editingSkill = existing ? { source: existing.source, directory: existing.directory } : null;
+      document.getElementById('skill-dialog-eyebrow').textContent = scope === 'global' ? 'Global skill' : 'Conversation skill';
+      document.getElementById('skill-dialog-title').textContent = existing ? 'Edit skill' : 'New skill';
+      const dirInput = document.getElementById('skill-dialog-directory');
+      dirInput.value = existing ? existing.directory : '';
+      dirInput.disabled = Boolean(existing);
+      document.getElementById('skill-dialog-name').value = existing ? existing.name : '';
+      document.getElementById('skill-dialog-description').value = existing ? existing.description : '';
+      const contentEl = document.getElementById('skill-dialog-content');
+      contentEl.value = '';
+      const dialogError = document.getElementById('skill-dialog-error');
+      dialogError.style.display = 'none';
+      dialogError.textContent = '';
+      pendingSkillScope = scope;
+      if (existing) {
+        contentEl.value = 'Loading…';
+        try {
+          const data = await apiGet('/admin/api/skills/file?' + scopeQuery() + '&source=' + encodeURIComponent(existing.source) + '&directory=' + encodeURIComponent(existing.directory));
+          contentEl.value = data.binary ? '' : (data.content || '').replace(/^---[\\s\\S]*?---\\n?/, '').trim();
+        } catch (err) {
+          contentEl.value = '';
+          dialogError.textContent = 'Failed to load current content: ' + err.message;
+          dialogError.style.display = 'block';
+        }
+      }
+      document.getElementById('skill-dialog').showModal();
+    }
+
+    function closeSkillDialog() {
+      editingSkill = null;
+      pendingSkillScope = null;
+      document.getElementById('skill-dialog').close();
+    }
+
+    async function submitSkillDialog(btn) {
+      const dialogError = document.getElementById('skill-dialog-error');
+      dialogError.style.display = 'none';
+      dialogError.textContent = '';
+      const directory = document.getElementById('skill-dialog-directory').value.trim();
+      const name = document.getElementById('skill-dialog-name').value.trim() || directory;
+      const description = document.getElementById('skill-dialog-description').value.trim();
+      const content = document.getElementById('skill-dialog-content').value;
+      if (!directory) { dialogError.textContent = 'Directory is required'; dialogError.style.display = 'block'; return; }
+      if (!description) { dialogError.textContent = 'Description is required'; dialogError.style.display = 'block'; return; }
+      const source = editingSkill ? editingSkill.source : pendingSkillScope;
+      btn.disabled = true;
+      btn.textContent = 'Saving…';
+      try {
+        await apiPost('/admin/api/skills/mutate', {
+          action: 'save', source: source, directory: directory, name: name, description: description, content: content, ...scopeBody(),
+        });
+        closeSkillDialog();
+        await loadSkills();
+      } catch (err) {
+        dialogError.textContent = err.message;
+        dialogError.style.display = 'block';
+      } finally {
+        btn.disabled = false;
+        btn.textContent = 'Save';
+      }
+    }
 
     // ── Vault (Login link) ───────────────────────────────────────────────────────
 
@@ -2673,26 +2921,6 @@ const adminViewScript = `    let activeConversationKey = defaultConversationKey;
       await saveSetting(btn, result, 'settings/slack', { replyMode }, 'Save Slack');
     }
 
-    async function loadGlobalSkills() {
-      const container = document.getElementById('global-skills-content');
-      container.innerHTML = '<div class="loading-msg">Loading…</div>';
-      try {
-        // Reuse skills endpoint scoped to a conversation that doesn't have any of its own; the global half is what we want.
-        const data = await apiGet('/admin/api/skills?' + scopeQuery());
-        const globals = data.skills.filter((s) => s.source === 'global');
-        if (globals.length === 0) {
-          container.innerHTML = '<div class="empty-state">No global skills</div>';
-          return;
-        }
-        container.innerHTML = '<div class="skills-list">' + globals.map((s) =>
-          '<div class="skill-row"><div class="skill-name">' + escHtml(s.name) + '</div>' +
-          (s.description ? '<div class="skill-desc">' + escHtml(s.description) + '</div>' : '') + '</div>'
-        ).join('') + '</div>';
-      } catch (err) {
-        container.innerHTML = '<div class="err-msg">' + escHtml(err.message) + '</div>';
-      }
-    }
-
     // ── Init ─────────────────────────────────────────────────────────────────────
 
     // Sections load on demand (see initSections); loadSettingsPanel already
@@ -2831,6 +3059,7 @@ const adminViewStyles = `
     font: 500 0.84rem/1.2 'DM Sans', sans-serif; cursor: pointer;
   }
   .refresh-btn:hover { background: rgba(0,0,0,0.06); color: var(--text); }
+  .sect-head-actions { display: flex; align-items: center; gap: 8px; flex-shrink: 0; }
 
   /* ── Workspace ──────────────────────────────────────────────────────── */
 
@@ -2881,11 +3110,14 @@ const adminViewStyles = `
   .skill-row {
     padding: 10px 12px; border: 1px solid var(--border); border-radius: 10px;
     background: rgba(0,0,0,0.02);
+    display: flex; align-items: flex-start; justify-content: space-between; gap: 10px;
   }
   .skill-row-btn {
-    width: 100%; text-align: left; cursor: pointer; font-family: inherit;
+    flex: 1 1 auto; min-width: 0; text-align: left; cursor: pointer; font-family: inherit;
+    background: transparent; border: none; padding: 0;
   }
-  .skill-row-btn:hover { background: rgba(0,0,0,0.05); }
+  .skill-row-btn:hover .skill-name { color: var(--accent); }
+  .skill-row-actions { display: flex; gap: 6px; flex-shrink: 0; }
   .skill-name {
     font-weight: 650; font-size: 0.9rem; color: var(--text);
     display: flex; align-items: center; gap: 8px; flex-wrap: wrap;