@michengai/dsh-skills-manager 0.1.30 → 0.1.31

package/CHANGELOG.md

@@ -4,6 +4,24 @@
 
 The five most recent published versions are listed below.
 
+## Unreleased
+
+## 0.1.31 — 2026-08-30
+
+- Added project Skill discovery for active Session workspaces, covering project-root `.dsh/skills` and `.agents/skills` with stable workspace-specific identities and official rank order.
+- Kept project files under DSH's scoped filesystem provider instead of registering a duplicate provider or reusing user-global toggle state.
+- Labeled project entries as discovered rather than loaded, exposed workspace-specific rank/path evidence and a manual Refresh action, and warned when an active workspace is not readable from the host.
+- Added regression coverage for nearest-git-root resolution, duplicate Session workspaces, same-name priority within one project, same-name isolation across projects, live modification/removal, stale source identities, and linked bundles outside the project skill root.
+- Added Settings creation and recoverable Trash deletion for active project `.dsh/skills`, reusing the global whole-bundle rollback/publish flow while keeping project `.agents/skills` read-only.
+- Trash now records the original user or project source, displays it in Settings, and restores project entries only after resolving the same opaque root from a currently active Session workspace.
+- Added enable/disable controls for project `.dsh/skills`; they update the Skill's invocation-policy fields while leaving Session-scoped catalog ownership with DSH's official provider.
+- Fixed project Trash and restore failing with `EXDEV` when the project and `$DSH_HOME` are on different volumes by using a guarded copy-then-hide fallback.
+- Hid empty project roots from the main source list while preserving them as Create Skill destinations, and removed the unsupported project source-wide toggle without affecting per-Skill enable/disable.
+- Fixed writable project discovery falling back to a non-Git Session cwd and potentially aliasing user-level Skill roots; project sources now require a real `.git` ancestor and are hidden and rejected when they overlap any user Skill root.
+- Stopped list and detail scans from following linked Skill roots, including project `.dsh`/`.agents` containers and Windows reparse points, while retaining the existing linked-bundle containment guard.
+
+Published package: [`@michengai/dsh-skills-manager@0.1.31`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.31).
+
 ## 0.1.30 — 2026-08-28
 
 - Fixed reverse-proxy domains and LAN IPs already trusted by DSH Web through `--trusted-host` still being rejected by Skills Manager's own loopback-only Host fence.
@@ -31,11 +49,3 @@ Published package: [`@michengai/dsh-skills-manager@0.1.28`](https://www.npmjs.co
 - Verified the reporter-provided cross-platform fnOS `trim-cli` Skill archive through the complete isolated import path.
 
 Published package: [`@michengai/dsh-skills-manager@0.1.27`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.27).
-
-## 0.1.26 — 2026-08-27
-
-- Fixed browser folder imports that exceeded the former 16 MiB Base64 JSON request ceiling while still fitting within the documented 25 MiB decoded-content limit.
-- Added client-side checks for the existing 10 MiB ZIP, 5 MiB per-file, 25 MiB total, and 500-entry upload limits so oversized selections fail with a specific message before being read.
-- Replaced the large-string Base64 validation regex with stack-safe validation to prevent multi-MiB files from exhausting the JavaScript call stack.
-
-Published package: [`@michengai/dsh-skills-manager@0.1.26`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.26).

package/CHANGELOG.zh-CN.md

@@ -4,6 +4,24 @@
 
 以下记录最近发布的五个版本。
 
+## 未发布
+
+## 0.1.31 — 2026-08-30
+
+- 新增活动 Session 工作区的项目 Skill 发现，覆盖项目根 `.dsh/skills` 与 `.agents/skills`，使用稳定的 workspace 专属身份并遵循官方优先级。
+- 项目文件继续由 DSH 作用域 filesystem provider 管理，不重复注册 provider，也不复用用户级全局启停状态。
+- 项目条目标记为“已发现”而不是“已加载”，展示 workspace 专属优先级/路径证据和手动刷新入口，并在宿主无法读取活动工作区时给出警告。
+- 补充最近 Git 根、Session 工作区去重、单项目同名优先级、跨项目同名隔离、实时修改/删除、过期来源身份以及项目 Skill 根外链接目录等回归测试。
+- 新增活动项目 `.dsh/skills` 的设置页创建与可恢复回收站删除，复用全局 Skill 的完整目录回滚/发布流程，同时保持项目 `.agents/skills` 只读。
+- 回收站现在记录并展示原用户级或项目级来源；项目条目仅在当前活动 Session 可重新解析出同一不透明根身份时恢复。
+- 新增项目 `.dsh/skills` 启停控件：只改写 Skill 自身调用策略字段，Session 作用域目录加载仍由 DSH 官方 provider 负责。
+- 修复项目与 `$DSH_HOME` 位于不同磁盘时，移入回收站和恢复因 `EXDEV` 失败的问题，新增受保护的“复制后原子隐藏”降级流程。
+- 主来源列表不再显示空项目根，但“创建技能”仍可选择它们；同时移除不受支持的项目来源总开关，不影响逐 Skill 启停。
+- 修复可写项目发现会回落到无 Git 的 Session cwd、进而可能与用户级技能根重合的问题；项目来源现在必须找到真实 `.git` 祖先，与任一用户技能根重叠时直接隐藏并拒绝写入。
+- 列表和详情不再跟随技能根本身的链接，包括项目 `.dsh`/`.agents` 容器及 Windows reparse point，同时保留既有的 bundle 子链接边界检查。
+
+发布包：[`@michengai/dsh-skills-manager@0.1.31`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.31)。
+
 ## 0.1.30 — 2026-08-28
 
 - 修复 DSH Web 已通过 `--trusted-host` 信任的反向代理域名或局域网 IP，仍被 Skills Manager 自身 loopback-only Host 校验拒绝的问题。
@@ -31,11 +49,3 @@
 - 使用反馈者提供的跨平台 fnOS `trim-cli` Skill 压缩包完成隔离环境全链路导入验证。
 
 发布包：[`@michengai/dsh-skills-manager@0.1.27`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.27)。
-
-## 0.1.26 — 2026-08-27
-
-- 修复浏览器上传文件夹时，原始内容仍在 25 MiB 总量限制内，却因 Base64 JSON 超过旧 16 MiB 请求体上限而失败的问题。
-- 在浏览器读取内容前检查既有的 ZIP 10 MiB、单文件 5 MiB、总量 25 MiB 和 500 个条目限制，超限时直接显示具体原因。
-- 将大字符串 Base64 正则校验改为栈安全校验，避免数 MiB 文件耗尽 JavaScript 调用栈。
-
-发布包：[`@michengai/dsh-skills-manager@0.1.26`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.26)。

package/README.md

@@ -23,10 +23,11 @@
 ## Features
 
 - Discover and load user-level skills from `.agents`, Codex, Claude, Gemini, and OpenCode into DSH.
+- Discover project-level `.dsh/skills` and `.agents/skills` from active Session workspaces, grouped by project; project DSH skills can be enabled, disabled, created, moved to Trash, and restored while project Agent skills stay read-only.
 - Persist external source and skill toggles under `$DSH_HOME/skills-manager/state.json` without rewriting shared source files.
 - Inspect Markdown bodies, frontmatter, load state, duplicate shadowing, and format diagnostics in a source-first UI.
-- Create a local DSH skill from Settings or conversation; conversational writes require user approval.
-- Move DSH-local skills to recoverable Trash, then restore or permanently delete them.
+- Create a user- or project-level DSH skill from Settings; conversational creation remains user-level and requires approval.
+- Move user- and project-level DSH skills to recoverable Trash, then restore them to the original source or permanently delete them.
 - Import `.zip` archives, skill folders, or a single `SKILL.md` safely into `$DSH_HOME/skills`.
 
 ## Screenshots
@@ -51,7 +52,6 @@ This product can be installed independently or used through the desktop app or W
 | --- | --- |
 | [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) | The host runtime that provides models, sessions, tools, and the plugin system |
 | [DSH Codex Desktop](https://github.com/MichengAI/dsh-codex-desktop) | A ready-to-install desktop product with this product and the other five feature products built in |
-| [DSH Codex Suite](https://github.com/MichengAI/dsh-codex-ui/tree/main/packages/dsh-codex-suite) | A one-click suite for existing DSH Web environments that installs this product and the other five feature products |
 | Six feature products | [Codex UI](https://github.com/MichengAI/dsh-codex-ui) · [IM Connect](https://github.com/MichengAI/dsh-im-connect) · [Automation](https://github.com/MichengAI/dsh-automation) · [Skills Manager](https://github.com/MichengAI/dsh-skills-manager) · [Archive Manager](https://github.com/MichengAI/dsh-archive-manager) · [Agency Agents](https://github.com/MichengAI/dsh-agency-agents) |
 
 ## Prerequisites
@@ -137,12 +137,12 @@ Open **Settings → Skills**, then use the panel as follows:
 | --- | --- | --- |
 | Search or filter | Narrow by source, name, or description. | All sources |
 | Inspect details | Review body, frontmatter, path, format diagnostics, and duplicate shadowing. | All sources |
-| Enable or disable | DSH skills update their own invocation policy; external skills update manager-local state only. | All sources |
-| Create or import | Create in Settings, or import `.zip`, a folder containing `SKILL.md`, or one `SKILL.md`. | `$DSH_HOME/skills` |
+| Enable or disable | User and project DSH skills update their own invocation policy; external user skills update manager-local state only. | User-level sources and active project DSH skills |
+| Create or import | Choose a user or active project DSH destination when creating in Settings; imports remain user-level. | `$DSH_HOME/skills`, active `<project>/.dsh/skills` for creation |
 | Create from conversation | Let an Agent call `create_skill`; DSH asks for approval before writing. | `$DSH_HOME/skills` |
-| Delete and recover | Move to Trash, restore, or permanently delete in a second step. | DSH-local skills |
+| Delete and recover | Move to Trash, restore to the original source, or permanently delete in a second step. | User and active-project DSH skills |
 
-> Toggling a shared source never changes its files; only DSH-local skills can move to Trash.
+> Toggling a shared source never changes its files; only user or project DSH skills can move to Trash.
 
 Escape closes only the frontmost upload or confirmation dialog and leaves Settings open.
 
@@ -153,8 +153,17 @@ Escape closes only the frontmost upload or confirmation dialog and leaves Settin
 | `$DSH_HOME\skills` | Yes | Updates local invocation policy | Yes | Moves to Trash |
 | `$DSH_AGENTS_HOME\skills` | Yes | Manager state only | No | No |
 | `~/.codex/skills`, `~/.claude/skills`, `~/.gemini/skills`, `~/.config/opencode/skills` | Yes | Manager state only | No | No |
+| `<project>/.dsh/skills` | Yes, for active Session workspaces | Updates the Skill's invocation policy; DSH's scoped provider remains responsible for loading | Create in Settings | Moves to Trash and restores to the original project |
+| `<project>/.agents/skills` | Yes, for active Session workspaces | No; managed by DSH's scoped filesystem provider | No | No |
 
 - Enable, disable, and delete accept only one ordinary skill-name path segment.
+- Project roots are derived only from active Session `cwd` values; client requests carry an opaque source key and cannot nominate an arbitrary workspace path.
+- Project sources follow DSH's nearest-`.git` root convention and rank order (`project-dsh` 100 before `project-agents` 200). The manager re-scans for each state/detail request and does not register a duplicate project provider; writes are limited to invocation-policy toggles and create/Trash/restore under the active project's `.dsh/skills` root.
+- Trash falls back to copy-then-hide when a project and `$DSH_HOME` are on different volumes; restore uses the same guarded cross-volume path in reverse.
+- Project Trash entries retain their original opaque source identity. Restore is allowed only while that original project is still represented by an active Session workspace; the client cannot nominate a replacement path.
+- Project writes reject linked `.dsh` or `.dsh/skills` directories so a repository cannot redirect creation, deletion, or restore outside its own project root.
+- Project rows say **Discovered**, not **Loaded**: only DSH's Session-scoped catalog can establish model visibility. Use Refresh after IDE, Git, or shell changes; the official provider remains responsible for model-catalog watching and invalidation.
+- Empty project roots stay out of the main source list to reduce noise, but remain selectable in Create Skill so the first project Skill can still be created. Project DSH supports per-Skill toggles only, not a source-wide switch.
 - Replacements copy to a temporary sibling path first and keep the original until that succeeds.
 - Every endpoint, including GET `/state`, accepts only a loopback `Host` or a canonical `host[:port]` that the DSH Web runtime already trusts through its LAN bind and `--trusted-host`; unknown hosts still receive 403.
 - Browser requests must also carry a same-origin `Origin` when present and must not be marked cross-site; write endpoints continue to require JSON and the DSH client request marker.

package/README.zh-CN.md

@@ -23,10 +23,11 @@
 ## 功能概览
 
 - 自动发现并把 `.agents`、Codex、Claude、Gemini 和 OpenCode 的用户级技能真正加载进 DSH。
+- 从活动 Session 工作区发现项目级 `.dsh/skills` 与 `.agents/skills` 并按项目分组；项目 DSH Skill 可启停、创建、移入回收站和恢复，项目 Agent Skill 保持只读。
 - 外部来源启停只写入 `$DSH_HOME\skills-manager\state.json`，绝不改写共享源文件。
 - 按来源折叠、搜索和筛选，并查看技能正文、frontmatter、加载状态、重名遮蔽与格式诊断。
-- 在设置页或对话中创建 DSH 本地技能；对话工具在写入前请求用户确认。
-- DSH 本地技能删除后先进入回收站，支持恢复和二次永久删除。
+- 在设置页创建用户级或项目级 DSH Skill；对话创建仍为用户级，并在写入前请求确认。
+- 用户级和项目级 DSH Skill 删除后先进入回收站，可恢复到原来源或二次永久删除。
 - 支持把 `.zip`、包含 `SKILL.md` 的技能文件夹或单个 `SKILL.md` 安全导入 `$DSH_HOME\skills`。
 
 ## 界面预览
@@ -51,7 +52,6 @@ DSH 本地技能移入回收站前需要确认；永久删除前仍可恢复：
 | --- | --- |
 | [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) | 本产品的运行宿主，提供模型、会话、工具和插件系统 |
 | [DSH Codex Desktop](https://github.com/MichengAI/dsh-codex-desktop) | 下载安装即用的桌面产品，已内置本产品和其他 5 个功能产品 |
-| [DSH Codex Suite](https://github.com/MichengAI/dsh-codex-ui/tree/main/packages/dsh-codex-suite) | 面向已有 DSH Web 环境的一键套件，会安装本产品和其他 5 个功能产品 |
 | 6 个功能产品 | [Codex UI](https://github.com/MichengAI/dsh-codex-ui) · [IM Connect](https://github.com/MichengAI/dsh-im-connect) · [Automation](https://github.com/MichengAI/dsh-automation) · [Skills Manager](https://github.com/MichengAI/dsh-skills-manager) · [Archive Manager](https://github.com/MichengAI/dsh-archive-manager) · [Agency Agents](https://github.com/MichengAI/dsh-agency-agents) |
 
 ## 前置条件
@@ -137,12 +137,12 @@ dsh --profile web --dump-config
 | --- | --- | --- |
 | 搜索或筛选 | 按来源、名称或简介收窄列表。 | 全部来源 |
 | 查看详情与诊断 | 查看正文、frontmatter、源文件路径、格式问题和重名遮蔽。 | 全部来源 |
-| 启用或停用 | DSH 技能更新自身调用策略；外部技能只更新 manager 本地状态。 | 全部来源 |
-| 创建或导入 | 在设置页创建，或导入 `.zip`、包含 `SKILL.md` 的文件夹、单个 `SKILL.md`。 | `$DSH_HOME\skills` |
+| 启用或停用 | 用户级与项目级 DSH Skill 更新自身调用策略；外部用户技能只更新 manager 本地状态。 | 用户级来源与活动项目 DSH Skill |
+| 创建或导入 | 在设置页创建时选择用户 DSH 或活动项目 DSH；导入仍为用户级。 | `$DSH_HOME\skills`，创建可选活动 `<project>/.dsh/skills` |
 | 从对话创建 | 让 Agent 调用 `create_skill`；写入前由 DSH 审批界面确认。 | `$DSH_HOME\skills` |
-| 删除与恢复 | 删除先进入回收站；可恢复或永久二次删除。 | DSH 本地技能 |
+| 删除与恢复 | 删除先进入回收站；可恢复到原来源或永久二次删除。 | 用户级与活动项目级 DSH Skill |
 
-> 共享来源的启停不会修改源文件；只有 DSH 本地技能可以移入回收站。
+> 共享来源的启停不会修改源文件；只有用户级或项目级 DSH Skill 可以移入回收站。
 
 按 ESC 只关闭最上层上传框或确认框，设置页会保持打开。
 
@@ -153,8 +153,17 @@ dsh --profile web --dump-config
 | `$DSH_HOME\skills` | 支持 | 改写本地调用策略 | 支持 | 进入回收站 |
 | `$DSH_AGENTS_HOME\skills` | 支持 | 仅写 manager 状态 | 不支持 | 不支持 |
 | `~/.codex/skills`、`~/.claude/skills`、`~/.gemini/skills`、`~/.config/opencode/skills` | 支持 | 仅写 manager 状态 | 不支持 | 不支持 |
+| `<project>/.dsh/skills` | 支持活动 Session 工作区 | 改写 Skill 调用策略；仍由 DSH 作用域 provider 负责加载 | 设置页支持创建 | 进入回收站并恢复到原项目 |
+| `<project>/.agents/skills` | 支持活动 Session 工作区 | 不支持；由 DSH 作用域 filesystem provider 管理 | 不支持 | 不支持 |
 
 - 启用、停用和删除只接受单个普通技能名称，目录穿越名称会被拒绝。
+- 项目根只从活动 Session 的 `cwd` 推导；客户端只提交不透明来源 key，不能指定任意工作区路径。
+- 项目来源遵循 DSH 最近 `.git` 项目根和固定优先级（`project-dsh` 100、`project-agents` 200）。管理器每次读取状态或详情时重新扫描且不重复注册项目 provider；写入仅限活动项目 `.dsh/skills` 下的调用策略启停、创建、回收与恢复。
+- 当项目与 `$DSH_HOME` 位于不同磁盘时，回收站会降级为“复制后在源盘原子隐藏”；恢复使用反向的同一安全流程。
+- 项目回收站条目保存原始不透明来源身份。仅当原项目仍由活动 Session 工作区提供时才允许恢复；客户端不能指定替代路径。
+- 项目写入会拒绝链接形式的 `.dsh` 或 `.dsh/skills` 目录，避免仓库把创建、删除或恢复重定向到项目根之外。
+- 项目条目标记为“已发现”而不是“已加载”：只有 DSH 的 Session 作用域目录才能证明模型可见性。IDE、Git 或 shell 改动后可点击“刷新”；模型目录 watcher 与 invalidation 仍由官方 provider 负责。
+- 没有 Skill 的项目根不会出现在主来源列表中，但仍保留在“创建技能”的目标选择中，确保可以创建第一个项目 Skill。项目 DSH 只提供逐 Skill 启停，不提供整个项目来源总开关。
 - 覆盖前先复制到同目录临时路径；复制成功前不会改动现有技能。
 - 全部接口（含 GET `/state`）只接受 loopback `Host`，或 DSH Web runtime 已通过 LAN 绑定和 `--trusted-host` 明确信任的 `host[:port]`；未知 Host 继续返回 403。
 - 浏览器请求还必须满足同源 `Origin` 且不能标记为 cross-site；写入接口继续要求 JSON 与 DSH 客户端请求标记。

package/lib/client.js

@@ -13,56 +13,56 @@ window.__ModuleLoader__.load({
       zh: {
         "title": "技能", "desc": "统一加载和管理本机 Agent Skills。",
         "btn.create": "创建技能", "btn.import": "导入", "btn.refresh": "刷新", "btn.cancel": "取消", "btn.close": "关闭", "btn.detail": "查看详情", "btn.trash": "移到回收站", "btn.restore": "恢复", "btn.delete.forever": "永久删除", "btn.file.pick": "选择文件", "btn.folder.pick": "选择文件夹", "btn.import.now": "安装", "btn.create.now": "创建技能", "btn.disable": "停用", "btn.enable": "启用", "btn.repair.enable": "修复并启用",
-        "status.enabled": "已加载", "status.disabled": "已停用", "status.invalid": "诊断异常", "status.shadowed": "被覆盖", "status.readonly": "源文件只读", "status.manageable": "可管理", "status.source.on": "已加载", "status.source.off": "已停用", "status.bundle": "目录技能", "status.single": "单文件",
+        "status.enabled": "已加载", "status.discovered": "已发现", "status.disabled": "已停用", "status.invalid": "诊断异常", "status.shadowed": "被覆盖", "status.readonly": "源文件只读", "status.manageable": "可管理", "status.project": "项目级", "status.rank": "优先级 {rank}", "status.source.on": "已加载", "status.source.off": "已停用", "status.bundle": "目录技能", "status.single": "单文件",
         "summary.total": "{count} 个技能", "summary.loaded": "{count} 个已在 DSH 加载", "summary.disabled": "{count} 个已停用", "summary.issues": "{count} 个诊断项", "summary.group": "{count} 个技能", "table.skill": "技能名称与描述", "table.status": "DSH 加载状态",
         "filter.source": "来源", "filter.all": "全部来源", "filter.option": "{name}（{count}）", "search": "搜索", "search.placeholder": "搜索技能名称或描述", "search.clear": "清除搜索",
         "empty.search": "没有匹配的技能。", "empty.source": "该来源目录不存在或暂时没有技能。", "loading": "正在加载技能…", "note.missing": "未提供简介", "source.toggle": "启停来源", "skill.toggle": "启停技能",
         "source.external.note": "通过 Skills Manager 只读加载，启停不会改写源文件。", "source.dsh.note": "DSH 本地技能可创建、导入和移到回收站。",
         "detail.title": "技能详情", "detail.body": "正文", "detail.frontmatter": "Frontmatter", "detail.diagnostics": "诊断", "detail.path": "源文件", "detail.noIssues": "未发现诊断问题。",
-        "create.title": "创建技能", "create.name": "名称", "create.name.placeholder": "例如 code-review-helper", "create.description": "简介", "create.description.placeholder": "一句话说明什么时候使用", "create.body": "正文（Markdown）", "create.body.placeholder": "写下技能要遵循的指令、步骤和边界…", "create.chat.note": "也可以在对话中直接说“创建一个 Skill”，DSH 会在写入前请求确认。",
+        "create.title": "创建技能", "create.target": "创建位置", "create.name": "名称", "create.name.placeholder": "例如 code-review-helper", "create.description": "简介", "create.description.placeholder": "一句话说明什么时候使用", "create.body": "正文（Markdown）", "create.body.placeholder": "写下技能要遵循的指令、步骤和边界…", "create.chat.note": "对话中的 create_skill 仍创建用户级 DSH Skill；项目 Skill 可在这里选择活动项目后创建。",
         "import.title": "导入技能", "upload.drop.title": "拖拽技能到此处", "upload.drop.copy": "支持 .zip、技能文件夹或单个 SKILL.md", "upload.selected": "{count} 个文件 · {size}", "upload.remove": "移除所选内容", "upload.requirements": "文件要求", "upload.requirement.skill": "压缩包或文件夹需包含 SKILL.md", "upload.requirement.frontmatter": "SKILL.md 需包含 YAML 格式的技能名称和描述", "upload.requirement.copy": "导入时复制完整内容，不修改原始来源", "upload.importing": "正在安装…", "status.selected": "已选择", "select.file.invalid": "请选择 .zip 或单个 SKILL.md。", "select.folder.invalid": "所选文件夹中没有找到 SKILL.md。", "error.browse.absolute": "目录路径必须是绝对路径：{path}", "error.browse.unreadable": "无法读取目录：{path}", "error.browse.notDirectory": "不是目录：{path}",
-        "trash.title": "回收站", "trash.count": "{count} 个待处理技能", "trash.empty": "回收站为空。", "trash.deletedAt": "删除于 {time}",
-        "confirm.trash.title": "移到回收站？", "confirm.trash.desc": "“{name}”将从 DSH 技能目录移入回收站，之后可以恢复。", "confirm.delete.title": "永久删除？", "confirm.delete.desc": "“{name}”将从回收站永久删除，无法恢复。",
+        "trash.title": "回收站", "trash.count": "{count} 个待处理技能", "trash.empty": "回收站为空。", "trash.deletedAt": "删除于 {time}", "trash.source": "来源：{source}",
+        "confirm.trash.title": "移到回收站？", "confirm.trash.desc": "“{name}”将从当前技能来源移入回收站，之后可以恢复到原位置。", "confirm.delete.title": "永久删除？", "confirm.delete.desc": "“{name}”将从回收站永久删除，无法恢复。",
         "result.created": "已创建技能：{name}", "result.imported": "导入完成：{names}", "result.importPartial": "已导入：{imported}；已跳过同名技能：{skipped}", "result.importSkipped": "未导入任何技能；已跳过同名技能：{names}", "result.importEmpty": "未导入任何技能。", "result.importWarnings": "{result}；警告：{warnings}", "result.restored": "已恢复技能：{name}", "result.trashed": "已移到回收站：{name}", "result.deleted": "已永久删除：{name}", "result.updated": "状态已更新。", "error.action": "操作失败：{error}",
-        "warning.state.invalid": "技能管理器状态文件不可读；外部技能已安全停用，修复文件前不会覆盖状态：{path}", "warning.backupUncleaned": "旧版本备份未清理: {path}（{error}）",
-        "error.root.readonly": "该来源不允许{action}", "error.root.unknown": "未知技能来源：{root}", "error.skill.notFound": "技能不存在: {name}", "error.skill.noFrontmatter": "技能缺少完整 frontmatter，无法{action}: {name}",
+        "warning.state.invalid": "技能管理器状态文件不可读；外部技能已安全停用，修复文件前不会覆盖状态：{path}", "warning.backupUncleaned": "旧版本备份未清理: {path}（{error}）", "warning.project.unavailable": "无法从宿主读取活动工作区，项目技能未显示：{path}",
+        "error.root.readonly": "该来源不允许{action}", "error.root.unknown": "未知技能来源：{root}", "error.root.unsafe": "项目技能目录不安全，拒绝写入：{path}", "error.skill.notFound": "技能不存在: {name}", "error.skill.noFrontmatter": "技能缺少完整 frontmatter，无法{action}: {name}",
         "error.source.notFound": "路径不存在: {path}", "error.source.symlink": "不支持包含符号链接的 skill 来源: {path}", "error.source.unrecognized": "无法识别的 skill 来源: {path}", "error.source.tooDeep": "skill 来源目录层级超过 {depth} 层: {path}",
         "error.import.overlap": "导入来源不能与 DSH 技能目录相同、包含或位于其中", "error.import.emptySource": "目录下未找到任何 skill 条目: {path}", "error.import.invalidName": "无法生成合法 kebab-case 名称（原始名: {name}）", "error.import.duplicateName": "批量来源中存在多个同名技能: {name}", "error.import.failed": "导入失败", "error.import.rollbackFailed": "覆盖导入回滚失败，备份保留在: {path}（{error}）",
         "error.upload.path": "上传内容包含非法路径：{path}", "error.upload.encoding": "上传内容编码无效", "error.upload.empty": "上传内容为空", "error.upload.tooMany": "上传文件过多，最多 {limit} 个", "error.upload.tooLarge": "上传内容过大，限制为 {limit} 字节", "error.upload.archiveTooLarge": "ZIP 压缩包过大，限制为 {limit} 字节", "error.upload.duplicate": "上传内容包含重复路径：{path}", "error.upload.zipInvalid": "ZIP 压缩包无法解压",
-        "error.trash.notFound": "回收站条目不存在: {id}", "error.trash.conflict": "无法恢复，同名技能已存在: {name}", "error.trash.invalid": "回收站条目路径非法: {id}", "error.trash.rollbackFailed": "移入回收站回滚失败，未恢复内容保留在: {path}（{error}）",
+        "error.trash.notFound": "回收站条目不存在: {id}", "error.trash.conflict": "无法恢复，同名技能已存在: {name}", "error.trash.invalid": "回收站条目路径非法: {id}", "error.trash.projectUnavailable": "原项目当前不在活动工作区中，无法恢复：{path}", "error.trash.rollbackFailed": "移入回收站回滚失败，未恢复内容保留在: {path}（{error}）",
         "error.state.invalid": "技能管理器状态文件不可读，已拒绝覆盖：{path}",
         "error.create.descriptionRequired": "技能简介不能为空", "error.create.bodyRequired": "技能正文不能为空", "error.create.tooLarge": "技能内容过长", "error.create.conflict": "同名技能已存在: {name}",
         "error.proto.forbidden": "禁止的修改请求（缺少客户端标记）", "error.proto.forbiddenHost": "禁止的请求来源（非法 Host）", "error.proto.contentType": "请求体必须是 application/json", "error.proto.method": "不支持的请求方法", "error.proto.unknownAction": "未知操作", "error.proto.bodyTooLarge": "请求体过大", "error.proto.invalidJson": "请求体不是合法 JSON", "error.proto.nonJson": "服务端返回非 JSON 响应（HTTP {status}）",
         "diagnostic.frontmatter.missing": "缺少完整 YAML frontmatter", "diagnostic.name.missing": "frontmatter 缺少 name", "diagnostic.name.invalid": "技能名称不是合法 kebab-case：{name}", "diagnostic.description.missing": "frontmatter 缺少 description", "diagnostic.invocation.invalid": "调用策略字段值无效", "diagnostic.shadowed": "被更高优先级来源 {root} 覆盖",
-        "action.enable": "启用", "action.disable": "停用", "action.delete": "删除", "action.toggle": "启用或停用",
-        "root.dsh": "DSH 技能", "root.agents": "公共 Agent", "root.codex": "Codex", "root.claude": "Claude", "root.gemini": "Gemini", "root.opencode": "OpenCode"
+        "action.enable": "启用", "action.disable": "停用", "action.create": "创建", "action.delete": "删除", "action.restore": "恢复", "action.toggle": "启用或停用",
+        "root.dsh": "DSH 技能", "root.agents": "公共 Agent", "root.projectDsh": "项目 DSH", "root.projectAgents": "项目 Agent", "root.codex": "Codex", "root.claude": "Claude", "root.gemini": "Gemini", "root.opencode": "OpenCode"
       },
       en: {
         "title": "Skills", "desc": "Load and manage Agent Skills on this computer in one place.",
         "btn.create": "Create skill", "btn.import": "Import", "btn.refresh": "Refresh", "btn.cancel": "Cancel", "btn.close": "Close", "btn.detail": "View details", "btn.trash": "Move to trash", "btn.restore": "Restore", "btn.delete.forever": "Delete forever", "btn.file.pick": "Choose file", "btn.folder.pick": "Choose folder", "btn.import.now": "Install", "btn.create.now": "Create skill", "btn.disable": "Disable", "btn.enable": "Enable", "btn.repair.enable": "Repair & enable",
-        "status.enabled": "Loaded", "status.disabled": "Disabled", "status.invalid": "Needs attention", "status.shadowed": "Shadowed", "status.readonly": "Source read-only", "status.manageable": "Manageable", "status.source.on": "Loaded", "status.source.off": "Disabled", "status.bundle": "Bundle", "status.single": "Single file",
+        "status.enabled": "Loaded", "status.discovered": "Discovered", "status.disabled": "Disabled", "status.invalid": "Needs attention", "status.shadowed": "Shadowed", "status.readonly": "Source read-only", "status.manageable": "Manageable", "status.project": "Project scoped", "status.rank": "Rank {rank}", "status.source.on": "Loaded", "status.source.off": "Disabled", "status.bundle": "Bundle", "status.single": "Single file",
         "summary.total": "{count} skills", "summary.loaded": "{count} loaded in DSH", "summary.disabled": "{count} disabled", "summary.issues": "{count} diagnostics", "summary.group": "{count} skills", "table.skill": "Skill name and description", "table.status": "DSH load status",
         "filter.source": "Source", "filter.all": "All sources", "filter.option": "{name} ({count})", "search": "Search", "search.placeholder": "Search skill names or descriptions", "search.clear": "Clear search",
         "empty.search": "No matching skills.", "empty.source": "This source does not exist or has no skills yet.", "loading": "Loading skills…", "note.missing": "No description provided", "source.toggle": "Toggle source", "skill.toggle": "Toggle skill",
         "source.external.note": "Loaded read-only through Skills Manager; toggles never rewrite source files.", "source.dsh.note": "Local DSH skills can be created, imported, and moved to trash.",
         "detail.title": "Skill details", "detail.body": "Body", "detail.frontmatter": "Frontmatter", "detail.diagnostics": "Diagnostics", "detail.path": "Source file", "detail.noIssues": "No diagnostic issues found.",
-        "create.title": "Create skill", "create.name": "Name", "create.name.placeholder": "e.g. code-review-helper", "create.description": "Description", "create.description.placeholder": "One sentence describing when to use it", "create.body": "Body (Markdown)", "create.body.placeholder": "Write the instructions, steps, and boundaries…", "create.chat.note": "You can also say “create a Skill” in chat; DSH asks for confirmation before writing.",
+        "create.title": "Create skill", "create.target": "Create in", "create.name": "Name", "create.name.placeholder": "e.g. code-review-helper", "create.description": "Description", "create.description.placeholder": "One sentence describing when to use it", "create.body": "Body (Markdown)", "create.body.placeholder": "Write the instructions, steps, and boundaries…", "create.chat.note": "The conversational create_skill tool still creates a user-level DSH Skill; choose an active project here for a project Skill.",
         "import.title": "Import skill", "upload.drop.title": "Drop a skill here", "upload.drop.copy": "Supports .zip, a skill folder, or one SKILL.md", "upload.selected": "{count} files · {size}", "upload.remove": "Remove selection", "upload.requirements": "File requirements", "upload.requirement.skill": "Archives and folders must contain SKILL.md", "upload.requirement.frontmatter": "SKILL.md must include a YAML name and description", "upload.requirement.copy": "Import copies all content and never modifies the source", "upload.importing": "Installing…", "status.selected": "Selected", "select.file.invalid": "Choose a .zip archive or one SKILL.md.", "select.folder.invalid": "No SKILL.md was found in the selected folder.", "error.browse.absolute": "Folder path must be absolute: {path}", "error.browse.unreadable": "Could not read folder: {path}", "error.browse.notDirectory": "Not a folder: {path}",
-        "trash.title": "Trash", "trash.count": "{count} skills pending", "trash.empty": "Trash is empty.", "trash.deletedAt": "Deleted {time}",
-        "confirm.trash.title": "Move to trash?", "confirm.trash.desc": "“{name}” will move out of the DSH skills directory and can be restored later.", "confirm.delete.title": "Delete forever?", "confirm.delete.desc": "“{name}” will be permanently deleted from trash and cannot be recovered.",
+        "trash.title": "Trash", "trash.count": "{count} skills pending", "trash.empty": "Trash is empty.", "trash.deletedAt": "Deleted {time}", "trash.source": "Source: {source}",
+        "confirm.trash.title": "Move to trash?", "confirm.trash.desc": "“{name}” will move out of its current skill source and can be restored to the same location later.", "confirm.delete.title": "Delete forever?", "confirm.delete.desc": "“{name}” will be permanently deleted from trash and cannot be recovered.",
         "result.created": "Created skill: {name}", "result.imported": "Import complete: {names}", "result.importPartial": "Imported: {imported}; skipped existing skills: {skipped}", "result.importSkipped": "No skills were imported; existing skills were skipped: {names}", "result.importEmpty": "No skills were imported.", "result.importWarnings": "{result}; warnings: {warnings}", "result.restored": "Restored skill: {name}", "result.trashed": "Moved to trash: {name}", "result.deleted": "Permanently deleted: {name}", "result.updated": "Status updated.", "error.action": "Action failed: {error}",
-        "warning.state.invalid": "The manager state file could not be read; external skills are disabled and state writes are blocked until it is repaired: {path}", "warning.backupUncleaned": "Old version backup was not cleaned up: {path} ({error})",
-        "error.root.readonly": "The shared Agent skills directory does not allow {action}", "error.root.unknown": "Unknown skill source: {root}", "error.skill.notFound": "Skill not found: {name}", "error.skill.noFrontmatter": "Skill lacks complete frontmatter, cannot {action}: {name}",
+        "warning.state.invalid": "The manager state file could not be read; external skills are disabled and state writes are blocked until it is repaired: {path}", "warning.backupUncleaned": "Old version backup was not cleaned up: {path} ({error})", "warning.project.unavailable": "The active workspace could not be read from the host, so its project skills are hidden: {path}",
+        "error.root.readonly": "This source does not allow {action}", "error.root.unknown": "Unknown skill source: {root}", "error.root.unsafe": "The project skill directory is unsafe, so the write was refused: {path}", "error.skill.notFound": "Skill not found: {name}", "error.skill.noFrontmatter": "Skill lacks complete frontmatter, cannot {action}: {name}",
         "error.source.notFound": "Path does not exist: {path}", "error.source.symlink": "Skill sources containing symbolic links are not supported: {path}", "error.source.unrecognized": "Unrecognized skill source: {path}", "error.source.tooDeep": "Skill source directory depth exceeds {depth} levels: {path}",
         "error.import.overlap": "Import source cannot be the same as, contain, or be inside the DSH skills directory", "error.import.emptySource": "No skill entries found in the directory: {path}", "error.import.invalidName": "Cannot generate a valid kebab-case name (original: {name})", "error.import.duplicateName": "Batch source contains duplicate skill names: {name}", "error.import.failed": "Import failed", "error.import.rollbackFailed": "Overwrite import rollback failed; backups kept at: {path} ({error})",
         "error.upload.path": "Upload contains an invalid path: {path}", "error.upload.encoding": "Upload encoding is invalid", "error.upload.empty": "Upload is empty", "error.upload.tooMany": "Too many uploaded files; maximum {limit}", "error.upload.tooLarge": "Upload is too large; limit {limit} bytes", "error.upload.archiveTooLarge": "ZIP archive is too large; limit {limit} bytes", "error.upload.duplicate": "Upload contains a duplicate path: {path}", "error.upload.zipInvalid": "ZIP archive could not be extracted",
-        "error.trash.notFound": "Trash item not found: {id}", "error.trash.conflict": "Cannot restore because a skill with the same name exists: {name}", "error.trash.invalid": "Invalid trash item path: {id}", "error.trash.rollbackFailed": "Move-to-trash rollback failed; unrecovered content was kept at: {path} ({error})",
+        "error.trash.notFound": "Trash item not found: {id}", "error.trash.conflict": "Cannot restore because a skill with the same name exists: {name}", "error.trash.invalid": "Invalid trash item path: {id}", "error.trash.projectUnavailable": "The original project is not an active workspace, so this skill cannot be restored: {path}", "error.trash.rollbackFailed": "Move-to-trash rollback failed; unrecovered content was kept at: {path} ({error})",
         "error.state.invalid": "The manager state file could not be read, so overwriting it was refused: {path}",
         "error.create.descriptionRequired": "Skill description is required", "error.create.bodyRequired": "Skill body is required", "error.create.tooLarge": "Skill content is too large", "error.create.conflict": "A skill with the same name already exists: {name}",
         "error.proto.forbidden": "Forbidden mutation request (missing client marker)", "error.proto.forbiddenHost": "Forbidden request origin (invalid host)", "error.proto.contentType": "Content type must be application/json", "error.proto.method": "Method not allowed", "error.proto.unknownAction": "Unknown action", "error.proto.bodyTooLarge": "Request body too large", "error.proto.invalidJson": "Invalid JSON request body", "error.proto.nonJson": "Server returned a non-JSON response (HTTP {status})",
         "diagnostic.frontmatter.missing": "Missing complete YAML frontmatter", "diagnostic.name.missing": "Frontmatter is missing name", "diagnostic.name.invalid": "Skill name is not valid kebab-case: {name}", "diagnostic.description.missing": "Frontmatter is missing description", "diagnostic.invocation.invalid": "Invocation policy value is invalid", "diagnostic.shadowed": "Shadowed by higher-priority source {root}",
-        "action.enable": "enable", "action.disable": "disable", "action.delete": "delete", "action.toggle": "enabling or disabling",
-        "root.dsh": "DSH skills", "root.agents": "Shared Agent", "root.codex": "Codex", "root.claude": "Claude", "root.gemini": "Gemini", "root.opencode": "OpenCode"
+        "action.enable": "enable", "action.disable": "disable", "action.create": "create", "action.delete": "delete", "action.restore": "restore", "action.toggle": "enabling or disabling",
+        "root.dsh": "DSH skills", "root.agents": "Shared Agent", "root.projectDsh": "Project DSH", "root.projectAgents": "Project Agent", "root.codex": "Codex", "root.claude": "Claude", "root.gemini": "Gemini", "root.opencode": "OpenCode"
       }
     };
 
@@ -90,6 +90,7 @@ window.__ModuleLoader__.load({
     function parseApiResponse(response) { return response.json().catch(function () { var error = new Error("non-json response"); error.code = "error.proto.nonJson"; error.params = { status: response.status }; throw error; }).then(function (payload) { if (!response.ok || payload.ok === false) throw payload; return payload.data; }); }
     function callApi(path, options) { return fetch("/api/dsh-skills-manager" + path, options).then(parseApiResponse); }
     function isSkillEnabled(skill) { if (skill.loaded !== undefined) return skill.loaded === true; return skill.invocationPolicyValid && skill.modelInvocable && skill.userInvocable && skill.managerEnabled !== false; }
+    function rootDisplayName(t, root) { var base = translateOrFallback(t, "root." + (root.localeKey || root.kind || root.key), root.label); return root.projectName ? base + " · " + root.projectName : base; }
     function summarizeImportResult(t, data) {
       var importedItems = data && data.imported || [];
       var imported = importedItems.map(function (item) { return item.name; });
@@ -112,6 +113,7 @@ window.__ModuleLoader__.load({
     function normalizeSkillQuery(query) { return String(query == null ? "" : query).trim().toLowerCase(); }
     function matchSkillQuery(skill, query) { var q = normalizeSkillQuery(query); if (!q) return true; return [skill.name, skill.declaredName, skill.description, skill.kind, skill.kindLabel, skill.statusLabel, skill.rootKey, skill.rootLabel].some(function (value) { return String(value == null ? "" : value).toLowerCase().includes(q); }); }
     function filterSkills(list, options) { var rootKey = options && options.rootKey != null ? options.rootKey : ""; return list.filter(function (skill) { return (!rootKey || skill.rootKey === rootKey) && matchSkillQuery(skill, options && options.query); }); }
+    function visibleSkillRoots(roots) { return (roots || []).filter(function (root) { return root.scope !== "project" || (root.skills || []).length > 0; }); }
     var MAX_UPLOAD_ARCHIVE_BYTES = 32 << 20, MAX_UPLOAD_ENTRY_BYTES = 32 << 20, MAX_UPLOAD_TOTAL_BYTES = 64 << 20, MAX_UPLOAD_ENTRIES = 1000;
     function uploadFilePath(file) { return String(file && (file._dssmPath || file.webkitRelativePath || file.name) || "").replace(/\\/g, "/"); }
     function inspectUploadSelection(files) {
@@ -158,7 +160,7 @@ window.__ModuleLoader__.load({
       var es = react.useState({ codex: true }), expanded = es[0], setExpanded = es[1];
       var ms = react.useState(null), modal = ms[0], setModal = ms[1];
       var rs = react.useState(null), result = rs[0], setResult = rs[1];
-      var fms = react.useState({ name: "", description: "", body: "" }), form = fms[0], setForm = fms[1];
+      var fms = react.useState({ root: "dsh", name: "", description: "", body: "" }), form = fms[0], setForm = fms[1];
       var us = react.useState(null), upload = us[0], setUpload = us[1];
       var ds = react.useState(null), detail = ds[0], setDetail = ds[1];
       var inflightRef = react.useRef(false);
@@ -170,27 +172,30 @@ window.__ModuleLoader__.load({
       function post(path, body, successKey, successParams) { if (inflightRef.current) return Promise.reject({ error: "operation already in progress" }); inflightRef.current = true; setBusy(true); setResult(null); return callApi(path, { method: "POST", headers: MUTATION_HEADERS, body: JSON.stringify(body || {}) }).then(function (data) { setResult({ ok: true, text: successKey ? t(successKey, successParams || data || {}) : t("result.updated") }); return refresh(true).then(function () { return data; }); }).catch(function (error) { setResult({ ok: false, text: t("error.action", { error: translateError(t, error) }) }); throw error; }).finally(function () { inflightRef.current = false; setBusy(false); }); }
       function openDetail(root, skill) { setBusy(true); setDetail(null); setModal("detail"); callApi("/detail", { method: "POST", headers: MUTATION_HEADERS, body: JSON.stringify({ root: root.key, name: skill.name }) }).then(setDetail).catch(function (error) { setResult({ ok: false, text: t("error.action", { error: translateError(t, error) }) }); setModal(null); }).finally(function () { setBusy(false); }); }
       function updateForm(key, value) { setForm(Object.assign({}, form, { [key]: value })); }
-      function submitCreate() { post("/create", form, null).then(function (data) { setModal(null); setForm({ name: "", description: "", body: "" }); setResult({ ok: true, text: t("result.created", { name: data.name }) }); }).catch(function () {}); }
+      function submitCreate() { post("/create", form, null).then(function (data) { setModal(null); setForm({ root: "dsh", name: "", description: "", body: "" }); setResult({ ok: true, text: t("result.created", { name: data.name }) }); }).catch(function () {}); }
       function selectUploadFiles(files) { pickerOpenRef.current = false; var selected = inspectUploadSelection(files); if (!selected) return; if (selected.error) { setUpload(null); setResult({ ok: false, text: translateError(t, selected.error) }); return; } setUpload(selected); setResult(null); }
       function openNativePicker(ref) { if (busy || pickerOpenRef.current || !ref.current) return; pickerOpenRef.current = true; ref.current.value = ""; function release() { setTimeout(function () { pickerOpenRef.current = false; }, 0); } window.addEventListener("focus", release, { once: true }); ref.current.click(); setTimeout(function () { pickerOpenRef.current = false; }, 30000); }
       function submitImport() { if (!upload) return; buildUploadPayload(upload).then(function (payload) { return post("/upload", payload, null); }).then(function (data) { var summary = summarizeImportResult(t, data); setResult({ ok: summary.ok, warning: summary.warning, text: summary.text }); if (summary.imported) { setModal(null); setUpload(null); } }).catch(function () {}); }
-      var data = snapshot.data || { roots: [], trash: [], summary: { total: 0, loaded: 0, disabled: 0, issues: 0 } }, roots = data.roots || [];
-      var options = [{ value: "", label: t("filter.all") }].concat(roots.map(function (root) { return { value: root.key, label: t("filter.option", { name: translateOrFallback(t, "root." + root.key, root.label), count: root.count == null ? root.skills.length : root.count }) }; }));
+      var data = snapshot.data || { roots: [], trash: [], summary: { total: 0, loaded: 0, disabled: 0, issues: 0 } }, allRoots = data.roots || [], roots = visibleSkillRoots(allRoots), activeSource = roots.some(function (root) { return root.key === source; }) ? source : "";
+      var createRoots = allRoots.filter(function (root) { return root.mutable === true; }), createOptions = createRoots.map(function (root) { return { value: root.key, label: rootDisplayName(t, root) }; }); if (!createOptions.length) createOptions.push({ value: "dsh", label: t("root.dsh") });
+      function openCreate() { var selectedRoot = createRoots.some(function (root) { return root.key === activeSource; }) ? activeSource : "dsh"; setForm(Object.assign({}, form, { root: selectedRoot })); setModal("create"); }
+      function trashRootLabel(item) { return item.root && item.root.scope === "project" ? t("root.projectDsh") + " · " + (item.root.projectName || item.root.projectRoot) : t("root.dsh"); }
+      var options = [{ value: "", label: t("filter.all") }].concat(roots.map(function (root) { return { value: root.key, label: t("filter.option", { name: rootDisplayName(t, root), count: root.count == null ? root.skills.length : root.count }) }; }));
 
       function renderSkill(root, skill) {
-        var enabled = isSkillEnabled(skill), repairable = root.mutable && skill.hasFrontmatter && skill.invocationPolicyValid === false && !skill.shadowedBy, key = skill.shadowedBy ? "status.shadowed" : skill.loadable === false || !skill.invocationPolicyValid ? "status.invalid" : enabled ? "status.enabled" : "status.disabled", cls = skill.shadowedBy ? "dssm-shadowed" : enabled ? "dssm-loaded" : "dssm-disabled";
-        return h("div", { key: skill.name, className: "dssm-row" }, h("div", { className: "dssm-main" }, h("div", { className: "dssm-name" }, skill.declaredName || skill.name), h("div", { className: "dssm-note" }, skill.description || t("note.missing"))), h("div", { className: "dssm-tags" }, h("span", { className: "dssm-tag" }, translateOrFallback(t, "root." + root.key, root.label)), !root.mutable ? h("span", { className: "dssm-tag" }, t("status.readonly")) : null), h("div", { className: "dssm-status " + cls }, t(key)), h("div", { className: "dssm-row-actions" }, repairable ? h("button", { type: "button", className: "dssm-btn dssm-btn-quiet", disabled: busy, onClick: function () { post("/enable", { root: root.key, name: skill.name }); } }, t("btn.repair.enable")) : h(Switch, { on: enabled, disabled: busy || !!skill.shadowedBy || skill.loadable === false, label: t("skill.toggle") + " " + skill.name, onClick: function () { post(enabled ? "/disable" : "/enable", { root: root.key, name: skill.name }); } }), h("button", { type: "button", className: "dssm-btn dssm-btn-quiet", onClick: function () { openDetail(root, skill); } }, t("btn.detail")), root.mutable ? h("button", { type: "button", className: "dssm-btn dssm-btn-quiet", onClick: function () { setModal({ type: "trash-confirm", root: root.key, name: skill.name }); } }, t("btn.trash")) : null));
+        var enabled = isSkillEnabled(skill), repairable = root.mutable && skill.hasFrontmatter && skill.invocationPolicyValid === false && !skill.shadowedBy, key = skill.shadowedBy ? "status.shadowed" : skill.loadable === false || !skill.invocationPolicyValid ? "status.invalid" : root.scope === "project" && enabled ? "status.discovered" : enabled ? "status.enabled" : "status.disabled", cls = skill.shadowedBy ? "dssm-shadowed" : enabled ? "dssm-loaded" : "dssm-disabled";
+        return h("div", { key: skill.name, className: "dssm-row" }, h("div", { className: "dssm-main" }, h("div", { className: "dssm-name" }, skill.declaredName || skill.name), h("div", { className: "dssm-note" }, skill.description || t("note.missing"))), h("div", { className: "dssm-tags" }, h("span", { className: "dssm-tag" }, rootDisplayName(t, root)), !root.mutable ? h("span", { className: "dssm-tag" }, t("status.readonly")) : null), h("div", { className: "dssm-status " + cls }, t(key)), h("div", { className: "dssm-row-actions" }, repairable ? h("button", { type: "button", className: "dssm-btn dssm-btn-quiet", disabled: busy, onClick: function () { post("/enable", { root: root.key, name: skill.name }); } }, t("btn.repair.enable")) : root.toggleable !== false ? h(Switch, { on: enabled, disabled: busy || !!skill.shadowedBy || skill.loadable === false, label: t("skill.toggle") + " " + skill.name, onClick: function () { post(enabled ? "/disable" : "/enable", { root: root.key, name: skill.name }); } }) : null, h("button", { type: "button", className: "dssm-btn dssm-btn-quiet", onClick: function () { openDetail(root, skill); } }, t("btn.detail")), root.mutable ? h("button", { type: "button", className: "dssm-btn dssm-btn-quiet", onClick: function () { setModal({ type: "trash-confirm", root: root.key, name: skill.name }); } }, t("btn.trash")) : null));
       }
       function renderRoot(root) {
-        if (source && source !== root.key) return null;
-        var filtered = root.skills.filter(function (skill) { return matchSkillQuery(Object.assign({}, skill, { rootKey: root.key, rootLabel: root.label }), query); }); if (query && !filtered.length) return null; var open = !!expanded[root.key] || !!query;
-        return h("section", { key: root.key, className: "dssm-source" }, h("div", { className: "dssm-source-head" }, h("button", { type: "button", className: "dssm-source-head-main", "aria-expanded": open, onClick: function () { setExpanded(Object.assign({}, expanded, { [root.key]: !open })); } }, h("span", { className: "dssm-source-title" }, translateOrFallback(t, "root." + root.key, root.label)), h("span", { className: "dssm-count" }, t("summary.group", { count: root.count == null ? root.skills.length : root.count })), h("span", { className: "dssm-tag " + (root.key === "dsh" ? "" : root.enabled ? "dssm-tag-on" : "dssm-tag-off") }, root.key === "dsh" ? t("status.manageable") : t(root.enabled ? "status.source.on" : "status.source.off")), h("span", { className: "dssm-path", title: root.path }, root.path)), root.key !== "dsh" ? h("span", { className: "dssm-source-actions" }, h(Switch, { on: root.enabled, disabled: busy, label: t("source.toggle") + " " + root.label, onClick: function () { post(root.enabled ? "/source-disable" : "/source-enable", { root: root.key }); } })) : null), open ? h("div", { className: "dssm-source-body" }, filtered.length ? h(react.Fragment, null, h("div", { className: "dssm-table-head" }, h("span", null, t("table.skill")), h("span", null, t("filter.source")), h("span", null, t("table.status")), h("span", null, "")), filtered.map(function (skill) { return renderSkill(root, skill); })) : h("div", { className: "dssm-empty" }, query ? t("empty.search") : t("empty.source"))) : null);
+        if (activeSource && activeSource !== root.key) return null;
+        var displayName = rootDisplayName(t, root), filtered = root.skills.filter(function (skill) { return matchSkillQuery(Object.assign({}, skill, { rootKey: root.key, rootLabel: displayName }), query); }); if (query && !filtered.length) return null; var open = !!expanded[root.key] || !!query;
+        return h("section", { key: root.key, className: "dssm-source" }, h("div", { className: "dssm-source-head" }, h("button", { type: "button", className: "dssm-source-head-main", "aria-expanded": open, onClick: function () { setExpanded(Object.assign({}, expanded, { [root.key]: !open })); } }, h("span", { className: "dssm-source-title" }, displayName), h("span", { className: "dssm-count" }, t("summary.group", { count: root.count == null ? root.skills.length : root.count })), h("span", { className: "dssm-tag " + (root.scope === "project" ? "dssm-tag-on" : root.key === "dsh" ? "" : root.enabled ? "dssm-tag-on" : "dssm-tag-off") }, root.scope === "project" ? t("status.project") : root.key === "dsh" ? t("status.manageable") : t(root.enabled ? "status.source.on" : "status.source.off")), root.scope === "project" ? h("span", { className: "dssm-tag" }, t("status.rank", { rank: root.rank })) : null, h("span", { className: "dssm-path", title: root.path }, root.path)), root.scope !== "project" && root.key !== "dsh" && root.toggleable !== false ? h("span", { className: "dssm-source-actions" }, h(Switch, { on: root.enabled, disabled: busy, label: t("source.toggle") + " " + displayName, onClick: function () { post(root.enabled ? "/source-disable" : "/source-enable", { root: root.key }); } })) : null), open ? h("div", { className: "dssm-source-body" }, filtered.length ? h(react.Fragment, null, h("div", { className: "dssm-table-head" }, h("span", null, t("table.skill")), h("span", null, t("filter.source")), h("span", null, t("table.status")), h("span", null, "")), filtered.map(function (skill) { return renderSkill(root, skill); })) : h("div", { className: "dssm-empty" }, query ? t("empty.search") : t("empty.source"))) : null);
       }
 
       var summary = data.summary || { total: 0, loaded: 0, disabled: 0, issues: 0 };
-      var content = [h("style", { key: "css" }, CSS), h("div", { key: "head", className: "dssm-head" }, h("div", null, h("h2", { className: "dssm-title" }, t("title")), h("p", { className: "dssm-desc" }, t("desc"))), h("div", { className: "dssm-actions" }, h("button", { type: "button", className: "dssm-btn", onClick: function () { setModal("create"); } }, t("btn.create")), h("button", { type: "button", className: "dssm-btn dssm-btn-secondary", onClick: function () { setResult(null); setUpload(null); setModal("import"); } }, t("btn.import")))), h("div", { key: "summary", className: "dssm-summary" }, [[summary.total, "summary.total"], [summary.loaded, "summary.loaded"], [summary.disabled, "summary.disabled"]].map(function (item) { return h("div", { key: item[1], className: "dssm-stat" }, h("strong", null, item[0]), t(item[1], { count: item[0] }).replace(String(item[0]), "")); })), h("div", { key: "filters", className: "dssm-filters" }, h("input", { className: "dssm-control dssm-search", value: query, "aria-label": t("search"), placeholder: t("search.placeholder"), onChange: function (e) { setQuery(e.target.value); } }), h("div", { className: "dssm-source-filter" }, h(SourceSelect, { value: source, options: options, onChange: setSource }))), result && modal !== "import" ? h("div", { key: "result", className: "dssm-feedback" + (result.warning ? " dssm-warning" : result.ok ? "" : " dssm-error") }, result.text) : null].concat((data.warnings || []).map(function (warning, index) { return h("div", { key: "warning-" + index, className: "dssm-feedback dssm-warning", role: "alert" }, translateError(t, warning)); }), [snapshot.error ? h("div", { key: "error", className: "dssm-feedback dssm-error" }, snapshot.error) : null, snapshot.loading && !snapshot.data ? h("div", { key: "loading", className: "dssm-empty" }, t("loading")) : h("div", { key: "sources", className: "dssm-sources" }, roots.map(renderRoot)), h("button", { key: "trash", type: "button", className: "dssm-trash-row", onClick: function () { setModal("trash"); } }, h("span", null, t("trash.title")), h("span", { className: "dssm-trash-count" }, (data.trash || []).length))]);
+      var content = [h("style", { key: "css" }, CSS), h("div", { key: "head", className: "dssm-head" }, h("div", null, h("h2", { className: "dssm-title" }, t("title")), h("p", { className: "dssm-desc" }, t("desc"))), h("div", { className: "dssm-actions" }, h("button", { type: "button", className: "dssm-btn dssm-btn-secondary", disabled: busy || snapshot.loading, onClick: function () { refresh(false); } }, t("btn.refresh")), h("button", { type: "button", className: "dssm-btn", onClick: openCreate }, t("btn.create")), h("button", { type: "button", className: "dssm-btn dssm-btn-secondary", onClick: function () { setResult(null); setUpload(null); setModal("import"); } }, t("btn.import")))), h("div", { key: "summary", className: "dssm-summary" }, [[summary.total, "summary.total"], [summary.loaded, "summary.loaded"], [summary.disabled, "summary.disabled"]].map(function (item) { return h("div", { key: item[1], className: "dssm-stat" }, h("strong", null, item[0]), t(item[1], { count: item[0] }).replace(String(item[0]), "")); })), h("div", { key: "filters", className: "dssm-filters" }, h("input", { className: "dssm-control dssm-search", value: query, "aria-label": t("search"), placeholder: t("search.placeholder"), onChange: function (e) { setQuery(e.target.value); } }), h("div", { className: "dssm-source-filter" }, h(SourceSelect, { value: activeSource, options: options, onChange: setSource }))), result && modal !== "import" ? h("div", { key: "result", className: "dssm-feedback" + (result.warning ? " dssm-warning" : result.ok ? "" : " dssm-error") }, result.text) : null].concat((data.warnings || []).map(function (warning, index) { return h("div", { key: "warning-" + index, className: "dssm-feedback dssm-warning", role: "alert" }, translateError(t, warning)); }), [snapshot.error ? h("div", { key: "error", className: "dssm-feedback dssm-error" }, snapshot.error) : null, snapshot.loading && !snapshot.data ? h("div", { key: "loading", className: "dssm-empty" }, t("loading")) : h("div", { key: "sources", className: "dssm-sources" }, roots.map(renderRoot)), h("button", { key: "trash", type: "button", className: "dssm-trash-row", onClick: function () { setModal("trash"); } }, h("span", null, t("trash.title")), h("span", { className: "dssm-trash-count" }, (data.trash || []).length))]);
 
-      if (modal === "create") content.push(h(Modal, { key: "create", title: t("create.title"), closeLabel: t("btn.close"), onClose: function () { setModal(null); } }, h("div", { className: "dssm-form" }, [["name", "create.name", "create.name.placeholder"], ["description", "create.description", "create.description.placeholder"]].map(function (field) { return h("label", { key: field[0], className: "dssm-field" }, h("span", { className: "dssm-label" }, t(field[1])), h("input", { className: "dssm-control", value: form[field[0]], placeholder: t(field[2]), onChange: function (e) { updateForm(field[0], e.target.value); } })); }), h("label", { className: "dssm-field" }, h("span", { className: "dssm-label" }, t("create.body")), h("textarea", { className: "dssm-control", value: form.body, placeholder: t("create.body.placeholder"), onChange: function (e) { updateForm("body", e.target.value); } })), h("p", { className: "dssm-help" }, t("create.chat.note"))), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", onClick: function () { setModal(null); } }, t("btn.cancel")), h("button", { className: "dssm-btn", disabled: busy || !form.name.trim() || !form.description.trim() || !form.body.trim(), onClick: submitCreate }, t("btn.create.now")))));
+      if (modal === "create") content.push(h(Modal, { key: "create", title: t("create.title"), closeLabel: t("btn.close"), onClose: function () { setModal(null); } }, h("div", { className: "dssm-form" }, h("label", { className: "dssm-field" }, h("span", { className: "dssm-label" }, t("create.target")), h(SourceSelect, { value: form.root, options: createOptions, onChange: function (value) { updateForm("root", value); } })), [["name", "create.name", "create.name.placeholder"], ["description", "create.description", "create.description.placeholder"]].map(function (field) { return h("label", { key: field[0], className: "dssm-field" }, h("span", { className: "dssm-label" }, t(field[1])), h("input", { className: "dssm-control", value: form[field[0]], placeholder: t(field[2]), onChange: function (e) { updateForm(field[0], e.target.value); } })); }), h("label", { className: "dssm-field" }, h("span", { className: "dssm-label" }, t("create.body")), h("textarea", { className: "dssm-control", value: form.body, placeholder: t("create.body.placeholder"), onChange: function (e) { updateForm("body", e.target.value); } })), h("p", { className: "dssm-help" }, t("create.chat.note"))), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", onClick: function () { setModal(null); } }, t("btn.cancel")), h("button", { className: "dssm-btn", disabled: busy || !form.name.trim() || !form.description.trim() || !form.body.trim(), onClick: submitCreate }, t("btn.create.now")))));
       if (modal === "import") content.push(h(Modal, { key: "import", className: "dssm-modal-import", title: t("import.title"), closeLabel: t("btn.close"), onClose: function () { pickerOpenRef.current = false; setUpload(null); setResult(null); setModal(null); } },
         h("input", { ref: importInputRef, className: "dssm-hidden-input", type: "file", accept: ".zip,.md", onChange: function (event) { selectUploadFiles(event.target.files); event.target.value = ""; } }),
         h("input", { ref: folderInputRef, className: "dssm-hidden-input", type: "file", multiple: true, webkitdirectory: "", directory: "", onChange: function (event) { selectUploadFiles(event.target.files); event.target.value = ""; } }),
@@ -204,7 +209,7 @@ window.__ModuleLoader__.load({
         h("div", { className: "dssm-upload-requirements" }, h("div", { className: "dssm-label" }, t("upload.requirements")), h("ul", null, h("li", null, t("upload.requirement.skill")), h("li", null, t("upload.requirement.frontmatter")), h("li", null, t("upload.requirement.copy")))),
         h("div", { className: "dssm-modal-actions" }, h("button", { type: "button", className: "dssm-btn dssm-btn-secondary", onClick: function () { pickerOpenRef.current = false; setUpload(null); setResult(null); setModal(null); } }, t("btn.cancel")), h("button", { type: "button", className: "dssm-btn", disabled: busy || !upload, onClick: submitImport }, busy ? t("upload.importing") : t("btn.import.now")))
       ));      if (modal === "detail") content.push(h(Modal, { key: "detail", wide: true, title: t("detail.title"), closeLabel: t("btn.close"), onClose: function () { setModal(null); } }, detail ? h(react.Fragment, null, h("div", { className: "dssm-detail-path" }, detail.path), h("div", { className: "dssm-detail-section" }, h("div", { className: "dssm-detail-title" }, t("detail.diagnostics")), detail.diagnostics.length ? detail.diagnostics.map(function (item, index) { return h("div", { key: index, className: "dssm-diag" }, t(item.code, item.params || {})); }) : h("div", { className: "dssm-note" }, t("detail.noIssues"))), h("div", { className: "dssm-detail-section" }, h("div", { className: "dssm-detail-title" }, t("detail.body")), h("pre", { className: "dssm-code" }, detail.body || "")), h("div", { className: "dssm-detail-section" }, h("div", { className: "dssm-detail-title" }, t("detail.frontmatter")), h("pre", { className: "dssm-code" }, JSON.stringify(detail.frontmatter, null, 2)))) : h("div", { className: "dssm-empty" }, t("loading"))));
-      if (modal === "trash") content.push(h(Modal, { key: "trash-modal", title: t("trash.title"), closeLabel: t("btn.close"), onClose: function () { setModal(null); } }, h("div", { className: "dssm-count" }, t("trash.count", { count: data.trash.length })), data.trash.length ? data.trash.map(function (item) { return h("div", { key: item.id, className: "dssm-trash-item" }, h("div", { className: "dssm-trash-main" }, h("div", { className: "dssm-name" }, item.name), h("div", { className: "dssm-note" }, t("trash.deletedAt", { time: new Date(item.deletedAt).toLocaleString() }))), h("button", { className: "dssm-btn dssm-btn-quiet", disabled: busy, onClick: function () { post("/trash-restore", { id: item.id }, "result.restored", { name: item.name }); } }, t("btn.restore")), h("button", { className: "dssm-btn dssm-btn-quiet dssm-btn-danger", disabled: busy, onClick: function () { setModal({ type: "delete-confirm", id: item.id, name: item.name }); } }, t("btn.delete.forever"))); }) : h("div", { className: "dssm-empty" }, t("trash.empty"))));
+      if (modal === "trash") content.push(h(Modal, { key: "trash-modal", title: t("trash.title"), closeLabel: t("btn.close"), onClose: function () { setModal(null); } }, h("div", { className: "dssm-count" }, t("trash.count", { count: data.trash.length })), data.trash.length ? data.trash.map(function (item) { return h("div", { key: item.id, className: "dssm-trash-item" }, h("div", { className: "dssm-trash-main" }, h("div", { className: "dssm-name" }, item.name), h("div", { className: "dssm-note" }, t("trash.deletedAt", { time: new Date(item.deletedAt).toLocaleString() }) + " · " + t("trash.source", { source: trashRootLabel(item) }))), h("button", { className: "dssm-btn dssm-btn-quiet", disabled: busy, onClick: function () { post("/trash-restore", { id: item.id }, "result.restored", { name: item.name }); } }, t("btn.restore")), h("button", { className: "dssm-btn dssm-btn-quiet dssm-btn-danger", disabled: busy, onClick: function () { setModal({ type: "delete-confirm", id: item.id, name: item.name }); } }, t("btn.delete.forever"))); }) : h("div", { className: "dssm-empty" }, t("trash.empty"))));
       if (modal && modal.type === "trash-confirm") content.push(h(Modal, { key: "trash-confirm", title: t("confirm.trash.title"), closeLabel: t("btn.close"), onClose: function () { setModal(null); } }, h("p", { className: "dssm-desc" }, t("confirm.trash.desc", { name: modal.name })), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", onClick: function () { setModal(null); } }, t("btn.cancel")), h("button", { className: "dssm-btn", disabled: busy, onClick: function () { post("/delete", { root: modal.root, name: modal.name }, "result.trashed", { name: modal.name }).then(function () { setModal(null); }).catch(function () {}); } }, t("btn.trash")))));
       if (modal && modal.type === "delete-confirm") content.push(h(Modal, { key: "delete-confirm", title: t("confirm.delete.title"), closeLabel: t("btn.close"), onClose: function () { setModal("trash"); } }, h("p", { className: "dssm-desc" }, t("confirm.delete.desc", { name: modal.name })), h("div", { className: "dssm-modal-actions" }, h("button", { className: "dssm-btn dssm-btn-secondary", onClick: function () { setModal("trash"); } }, t("btn.cancel")), h("button", { className: "dssm-btn dssm-btn-danger", disabled: busy, onClick: function () { post("/trash-delete", { id: modal.id }, "result.deleted", { name: modal.name }).then(function () { setModal("trash"); }).catch(function () {}); } }, t("btn.delete.forever")))));
       return h("section", { className: "dssm-section" }, content);
@@ -212,7 +217,7 @@ window.__ModuleLoader__.load({
 
     var inject = ["slots", "locale"];
     function apply(ctx) { ctx.effect(function () { return ctx.locale.register(NS, DICT); }); ctx.slots.inject("settings.section", function () { return ctx.slots.register({ name: "settings.section", id: "skills-manager", order: 17, label: function () { return ctx.locale.bind(NS)("title"); }, icon: "skill", locale: NS }, SkillManagerSection); }); }
-    module.exports.DICT = DICT; module.exports.translateError = translateError; module.exports.parseApiResponse = parseApiResponse; module.exports.isSkillEnabled = isSkillEnabled; module.exports.summarizeImportResult = summarizeImportResult; module.exports.normalizeSkillQuery = normalizeSkillQuery; module.exports.matchSkillQuery = matchSkillQuery; module.exports.filterSkills = filterSkills; module.exports.trapModalFocus = trapModalFocus; module.exports.handleModalEscape = handleModalEscape; module.exports.inspectUploadSelection = inspectUploadSelection; module.exports.apply = apply; module.exports.inject = inject;
+    module.exports.DICT = DICT; module.exports.translateError = translateError; module.exports.parseApiResponse = parseApiResponse; module.exports.isSkillEnabled = isSkillEnabled; module.exports.rootDisplayName = rootDisplayName; module.exports.summarizeImportResult = summarizeImportResult; module.exports.normalizeSkillQuery = normalizeSkillQuery; module.exports.matchSkillQuery = matchSkillQuery; module.exports.filterSkills = filterSkills; module.exports.visibleSkillRoots = visibleSkillRoots; module.exports.trapModalFocus = trapModalFocus; module.exports.handleModalEscape = handleModalEscape; module.exports.inspectUploadSelection = inspectUploadSelection; module.exports.apply = apply; module.exports.inject = inject;
     return module.exports;
   }
 });

package/lib/core.js

@@ -1,7 +1,8 @@
 // dsh-skills-manager core —— 纯 Node 技能文件管理核心（仅 ZIP 解压使用 fflate，可独立单测）
 //
-// 覆盖 DSH 用户级技能根：
-//   - 根目录：~/.dsh/skills
+// 覆盖 DSH 用户级与活动 Session 项目级技能根：
+//   - 用户根目录：~/.dsh/skills 与常见 Agent 用户目录
+//   - 项目根目录：<project>/.dsh/skills（可启停、创建、回收）、<project>/.agents/skills（只读展示）
 //   - 条目形态：<root>/<name>/SKILL.md（bundle）或 <root>/<name>.md（flat），只扫一层
 //   - 前端展示 name、description 与启停状态，不做格式检查或自动修复
 //
@@ -13,7 +14,7 @@
 import { homedir } from "node:os";
 import { join, basename, dirname, resolve, relative, isAbsolute, sep } from "node:path";
 import { promises as fs } from "node:fs";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { unzipSync } from "fflate";
 
 const KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -72,6 +73,85 @@ export function userRoots() {
   ];
 }
 
+function projectIdentity(path) {
+  const canonical = process.platform === "win32" ? resolve(path).toLowerCase() : resolve(path);
+  return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
+}
+
+async function nearestProjectRoot(cwd) {
+  if (typeof cwd !== "string" || !isAbsolute(cwd)) return null;
+  let start;
+  try {
+    start = await fs.realpath(resolve(cwd));
+    if (!(await fs.stat(start)).isDirectory()) return null;
+  } catch {
+    return { unavailable: true, cwd };
+  }
+  let current = start;
+  for (;;) {
+    try {
+      await fs.lstat(join(current, ".git"));
+      return { root: current, cwd: start };
+    } catch {
+      /* 继续向上查找最近的项目根 */
+    }
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+async function projectSourceSafe(definition) {
+  const container = join(definition.projectRoot, definition.kind === "project-dsh" ? ".dsh" : ".agents");
+  for (const path of [container, definition.path]) {
+    const st = await lstatOrNull(path);
+    if (st && (!st.isDirectory() || st.isSymbolicLink())) return false;
+  }
+  return !(await overlapsUserSkillRoot(definition.path));
+}
+
+/**
+ * 从活动 Session cwd 推导项目技能根。只接受宿主上可解析的绝对目录，
+ * 同一项目的多个 Session 会折叠到同一组稳定 key，避免跨 workspace 合并同名技能。
+ */
+export async function projectRoots(projectCwds = [], diagnostics) {
+  const projects = new Map();
+  for (const cwd of Array.isArray(projectCwds) ? projectCwds : []) {
+    const found = await nearestProjectRoot(cwd);
+    if (!found || !found.root) {
+      if (found && found.unavailable && Array.isArray(diagnostics) && typeof cwd === "string" && isAbsolute(cwd)) {
+        diagnostics.push({ code: "warning.project.unavailable", params: { path: cwd }, error: `无法从宿主读取活动工作区，项目技能未显示: ${cwd}` });
+      }
+      continue;
+    }
+    const identity = process.platform === "win32" ? found.root.toLowerCase() : found.root;
+    const existing = projects.get(identity) || { root: found.root, cwds: new Set() };
+    existing.cwds.add(found.cwd);
+    projects.set(identity, existing);
+  }
+  const roots = [];
+  for (const project of [...projects.values()].sort((a, b) => a.root.localeCompare(b.root))) {
+    const id = projectIdentity(project.root);
+    const common = {
+      mutable: false,
+      toggleable: false,
+      native: true,
+      scope: "project",
+      projectRoot: project.root,
+      projectName: basename(project.root) || project.root,
+      workspaceCwds: [...project.cwds].sort(),
+    };
+    const candidates = [
+      { ...common, key: `project-dsh:${id}`, kind: "project-dsh", localeKey: "projectDsh", path: join(project.root, ".dsh", "skills"), label: "Project DSH", rank: 100, mutable: true, toggleable: true },
+      { ...common, key: `project-agents:${id}`, kind: "project-agents", localeKey: "projectAgents", path: join(project.root, ".agents", "skills"), label: "Project Agent", rank: 200 },
+    ];
+    for (const candidate of candidates) {
+      if (await projectSourceSafe(candidate)) roots.push(candidate);
+    }
+  }
+  return roots;
+}
+
 export function managerHomePath() {
   return join(resolveDshHome(), "skills-manager");
 }
@@ -149,13 +229,13 @@ function dshRootPath() {
   return userRoots().find((root) => root.key === "dsh").path;
 }
 
-/** 公共 Agent 目录的只读拒绝结果；action 为可翻译语义值（toggle/delete）。 */
+/** 只读来源的拒绝结果；action 为可翻译语义值（toggle/delete）。 */
 function readonlyError(action) {
   return {
     ok: false,
     code: "error.root.readonly",
     params: { action },
-    error: action === "delete" ? "公共 Agent 技能目录不允许删除" : "公共 Agent 技能目录不允许启用或停用",
+    error: action === "delete" ? "该技能来源不允许删除" : "该技能来源不允许启用或停用",
   };
 }
 
@@ -170,6 +250,38 @@ function rootByKey(key) {
   return userRoots().find((item) => item.key === key) || null;
 }
 
+/** 只允许用户 DSH 根，或由活动 Session 推导出的项目 DSH 根参与文件写入。 */
+function writableRootDefinition(root) {
+  const definition = rootDefinition(root);
+  if (!definition || definition.mutable !== true) return null;
+  if (definition.key === "dsh") return resolve(definition.path) === resolve(dshRootPath()) ? rootByKey("dsh") : null;
+  if (
+    definition.scope !== "project"
+    || definition.kind !== "project-dsh"
+    || typeof definition.projectRoot !== "string"
+    || !isAbsolute(definition.projectRoot)
+    || definition.key !== `project-dsh:${projectIdentity(definition.projectRoot)}`
+    || resolve(definition.path) !== resolve(join(definition.projectRoot, ".dsh", "skills"))
+  ) return null;
+  return definition;
+}
+
+async function checkedWritableRootDefinition(root) {
+  const definition = writableRootDefinition(root);
+  if (!definition || definition.scope !== "project") return definition;
+  if (await overlapsUserSkillRoot(definition.path)) {
+    return { ok: false, error: `项目技能目录与用户技能目录重叠，拒绝写入: ${definition.path}`, code: "error.root.unsafe", params: { path: definition.path } };
+  }
+  // 项目仓库内容不可信；拒绝通过 .dsh 或 skills 链接把写入重定向到项目之外。
+  for (const path of [join(definition.projectRoot, ".dsh"), definition.path]) {
+    const st = await lstatOrNull(path);
+    if (st && (!st.isDirectory() || st.isSymbolicLink())) {
+      return { ok: false, error: `项目技能目录不安全，拒绝写入: ${path}`, code: "error.root.unsafe", params: { path } };
+    }
+  }
+  return definition;
+}
+
 /** 判断 child 是否与 parent 相同或位于其内部。跨盘符时 relative 会返回绝对路径。 */
 function isSameOrDescendant(parent, child) {
   const rel = relative(resolve(parent), resolve(child));
@@ -185,6 +297,31 @@ async function resolvedPath(path) {
   }
 }
 
+/** 即使末级路径尚不存在，也解析最近既存祖先中的链接，供权限域重叠判断。 */
+async function comparisonPath(path) {
+  let current = resolve(path);
+  const missing = [];
+  for (;;) {
+    try {
+      return resolve(await fs.realpath(current), ...missing);
+    } catch {
+      const parent = dirname(current);
+      if (parent === current) return resolve(path);
+      missing.unshift(basename(current));
+      current = parent;
+    }
+  }
+}
+
+async function overlapsUserSkillRoot(path) {
+  const candidate = await comparisonPath(path);
+  for (const root of userRoots()) {
+    const userPath = await comparisonPath(root.path);
+    if (isSameOrDescendant(candidate, userPath) || isSameOrDescendant(userPath, candidate)) return true;
+  }
+  return false;
+}
+
 /** 两个路径重叠时，覆盖导入可能删除自身来源，必须拒绝。 */
 async function pathsOverlap(a, b) {
   const left = await resolvedPath(a);
@@ -336,6 +473,47 @@ export async function renameWithRetry(source, destination, options = {}) {
   }
 }
 
+async function removeMovedPath(path) {
+  const st = await lstatOrNull(path);
+  if (!st) return;
+  if (st.isDirectory() && !st.isSymbolicLink()) await fs.rm(path, { recursive: true, force: false });
+  else await fs.unlink(path);
+}
+
+/** rename 跨盘返回 EXDEV 时：先完整复制，再在源盘原子隐藏源条目，最后清理隐藏副本。 */
+async function movePathWithFallback(source, destination, options = {}) {
+  try {
+    await renameWithRetry(source, destination, options);
+    return { copied: false, cleanupError: null };
+  } catch (error) {
+    if (!error || error.code !== "EXDEV") throw error;
+  }
+
+  const quarantine = join(dirname(source), `.${basename(source)}.dssm-move-${randomUUID()}`);
+  try {
+    await fs.cp(source, destination, {
+      recursive: true,
+      dereference: false,
+      errorOnExist: true,
+      force: false,
+      verbatimSymlinks: true,
+    });
+    // 源与 quarantine 位于同一目录；成功后原技能名立即消失，避免递归删除留下半份可见条目。
+    await renameWithRetry(source, quarantine, options);
+  } catch (error) {
+    await removeMovedPath(destination).catch(() => undefined);
+    throw error;
+  }
+
+  let cleanupError = null;
+  try {
+    await removeMovedPath(quarantine);
+  } catch (error) {
+    cleanupError = error;
+  }
+  return { copied: true, cleanupError, quarantine };
+}
+
 async function writeFileAtomically(path, content) {
   const temp = join(dirname(path), `.${basename(path)}.dssm-${randomUUID()}.tmp`);
   try {
@@ -362,6 +540,8 @@ export async function resolveEntry(root, name) {
   const bundlePath = entryPath(root, name);
   if (bundlePath === null) return null;
   const rootPath = resolve(root);
+  const rootStat = await lstatOrNull(rootPath);
+  if (!rootStat || !rootStat.isDirectory() || rootStat.isSymbolicLink()) return null;
   const rootReal = await resolvedPath(rootPath);
   const bundleStat = await lstatOrNull(bundlePath);
   if (bundleStat && bundleStat.isDirectory() && !bundleStat.isSymbolicLink()) {
@@ -411,6 +591,8 @@ function entryOf(name, kind, docPath, doc) {
 
 /** 扫描一个技能根（只扫一层）。返回 { exists, entries }。 */
 export async function scanEntries(root) {
+  const rootStat = await lstatOrNull(resolve(root));
+  if (!rootStat || !rootStat.isDirectory() || rootStat.isSymbolicLink()) return { exists: false, entries: [] };
   let items;
   try {
     items = await fs.readdir(root, { withFileTypes: true });
@@ -552,9 +734,12 @@ async function setReadOnlySkillEnabled(root, name, enabled, log) {
 
 /** enabled=true 恢复模型与 / 手动调用；false 同时停用两种调用入口。 */
 export async function setSkillEnabled(root, name, enabled, log) {
-  const definition = rootDefinition(root);
+  let definition = rootDefinition(root);
+  if (!definition || !definition.toggleable) return readonlyError("toggle");
+  if (definition.key !== "dsh" && definition.kind !== "project-dsh") return setReadOnlySkillEnabled(definition, name, enabled, log);
+  definition = await checkedWritableRootDefinition(definition);
+  if (definition && definition.ok === false) return definition;
   if (!definition) return readonlyError("toggle");
-  if (definition.key !== "dsh") return setReadOnlySkillEnabled(definition, name, enabled, log);
   const resolved = await resolveEntry(definition.path, name);
   if (resolved === null) return { ok: false, error: `技能不存在: ${name}`, code: "error.skill.notFound", params: { name } };
   const source = await fs.readFile(resolved.docPath, "utf8");
@@ -562,7 +747,7 @@ export async function setSkillEnabled(root, name, enabled, log) {
   if (updated === null) return { ok: false, error: `技能缺少完整 frontmatter，无法${enabled ? "启用" : "停用"}: ${name}`, code: "error.skill.noFrontmatter", params: { name, action: enabled ? "enable" : "disable" } };
   await writeFileAtomically(resolved.docPath, updated);
   if (log) log(enabled ? "enable" : "disable", `${enabled ? "启用" : "停用"} ${resolved.docPath}`);
-  return { name, enabled };
+  return { root: definition.key, name, enabled };
 }
 
 async function safeExistingEntryPaths(root, name) {
@@ -626,10 +811,48 @@ async function publishTrashStage(stage, finalPath, metadata, renameOptions) {
   return { fallback: true, cleanupError };
 }
 
-/** 把 DSH 根目录中的单个技能移入 manager-owned 回收站。 */
+function trashRootMetadata(definition) {
+  if (definition.key === "dsh") return { key: "dsh", scope: "user", label: definition.label };
+  return {
+    key: definition.key,
+    scope: "project",
+    kind: "project-dsh",
+    projectRoot: definition.projectRoot,
+    projectName: definition.projectName,
+    label: definition.label,
+  };
+}
+
+async function restoreRootDefinition(metadata, options = {}) {
+  // version 1 entries predate scoped Trash and always belong to $DSH_HOME/skills.
+  if (!metadata.root) return rootByKey("dsh");
+  if (metadata.root.scope === "user" && metadata.root.key === "dsh") return rootByKey("dsh");
+  if (
+    metadata.root.scope !== "project"
+    || metadata.root.kind !== "project-dsh"
+    || typeof metadata.root.key !== "string"
+    || typeof metadata.root.projectRoot !== "string"
+    || !isAbsolute(metadata.root.projectRoot)
+  ) return { ok: false, error: `回收站条目来源非法: ${metadata.id}`, code: "error.trash.invalid", params: { id: metadata.id } };
+  const roots = await projectRoots(options.projectCwds);
+  const normalizedProjectRoot = process.platform === "win32" ? resolve(metadata.root.projectRoot).toLowerCase() : resolve(metadata.root.projectRoot);
+  const root = roots.find((item) => item.key === metadata.root.key && item.kind === "project-dsh" && (process.platform === "win32" ? resolve(item.projectRoot).toLowerCase() : resolve(item.projectRoot)) === normalizedProjectRoot);
+  if (!root) {
+    return {
+      ok: false,
+      error: `原项目当前不在活动工作区中，无法恢复: ${metadata.root.projectRoot}`,
+      code: "error.trash.projectUnavailable",
+      params: { path: metadata.root.projectRoot },
+    };
+  }
+  return checkedWritableRootDefinition(root);
+}
+
+/** 把用户或活动项目的 DSH 根中的单个技能移入 manager-owned 回收站。 */
 export async function deleteSkill(root, name, log, options = {}) {
-  const definition = rootDefinition(root);
-  if (!definition || definition.key !== "dsh") return readonlyError("delete");
+  const definition = await checkedWritableRootDefinition(root);
+  if (definition && definition.ok === false) return definition;
+  if (!definition) return readonlyError("delete");
   const resolved = await resolveEntry(definition.path, name);
   if (resolved === null) return { ok: false, error: `技能不存在: ${name}`, code: "error.skill.notFound", params: { name } };
   const targets = await safeExistingEntryPaths(definition.path, name);
@@ -642,20 +865,21 @@ export async function deleteSkill(root, name, log, options = {}) {
   try {
     for (const target of targets) {
       const destination = join(stage, target.fileName);
-      await renameWithRetry(target.path, destination, options.renameOptions);
+      const transferred = await movePathWithFallback(target.path, destination, options.renameOptions);
+      if (transferred.cleanupError && log) log("trash-source-warning", `技能已跨盘移入回收站，但源盘隐藏副本等待后续清理: ${transferred.quarantine}（${transferred.cleanupError.message || transferred.cleanupError}）`);
       moved.push({ ...target, destination });
     }
-    const metadata = { version: 1, id, name, deletedAt: new Date().toISOString(), entries: moved.map((item) => item.fileName) };
+    const metadata = { version: 2, id, name, deletedAt: new Date().toISOString(), entries: moved.map((item) => item.fileName), root: trashRootMetadata(definition) };
     await fs.writeFile(join(stage, "metadata.json"), `${JSON.stringify(metadata, null, 2)}\n`, "utf8");
     const published = await publishTrashStage(stage, finalPath, metadata, options.renameOptions);
     if (published.cleanupError && log) log("trash-stage-warning", `回收站已发布，但临时目录等待后续清理: ${stage}（${published.cleanupError.message || published.cleanupError}）`);
     if (log) log("trash", `移到回收站 ${name} -> ${finalPath}`);
-    return { id, name, deletedAt: metadata.deletedAt };
+    return { id, name, deletedAt: metadata.deletedAt, root: metadata.root };
   } catch (error) {
     const rollbackFailures = [];
     for (const item of moved.reverse()) {
       try {
-        await renameWithRetry(item.destination, item.path, options.renameOptions);
+        await movePathWithFallback(item.destination, item.path, options.renameOptions);
       } catch (rollbackError) {
         rollbackFailures.push({ path: item.destination, error: String(rollbackError && rollbackError.message ? rollbackError.message : rollbackError) });
       }
@@ -689,10 +913,12 @@ export async function listTrash() {
   return result.sort((a, b) => String(b.deletedAt).localeCompare(String(a.deletedAt)));
 }
 
-export async function restoreTrash(id, log) {
+export async function restoreTrash(id, log, options = {}) {
   const metadata = await readTrashMetadata(id);
   if (!metadata) return { ok: false, error: `回收站条目不存在: ${id}`, code: "error.trash.notFound", params: { id } };
-  const root = dshRootPath();
+  const definition = await restoreRootDefinition(metadata, options);
+  if (!definition || definition.ok === false) return definition || readonlyError("restore");
+  const root = definition.path;
   const conflicts = await safeExistingEntryPaths(root, metadata.name);
   if (conflicts.length) return { ok: false, error: `无法恢复，同名技能已存在: ${metadata.name}`, code: "error.trash.conflict", params: { name: metadata.name } };
   await fs.mkdir(root, { recursive: true });
@@ -703,14 +929,14 @@ export async function restoreTrash(id, log) {
       const source = join(itemRoot, fileName);
       const destination = join(root, fileName);
       if (!isSameOrDescendant(itemRoot, source) || !isSameOrDescendant(root, destination)) throw codedError("回收站条目路径非法", "error.trash.invalid", { id });
-      await renameWithRetry(source, destination);
+      await movePathWithFallback(source, destination, options.renameOptions);
       moved.push({ source, destination });
     }
     await fs.rm(itemRoot, { recursive: true, force: true });
-    if (log) log("restore", `从回收站恢复 ${metadata.name}`);
-    return { id, name: metadata.name };
+    if (log) log("restore", `从回收站恢复 ${metadata.name} -> ${root}`);
+    return { id, name: metadata.name, root: trashRootMetadata(definition) };
   } catch (error) {
-    for (const item of moved.reverse()) await renameWithRetry(item.destination, item.source).catch(() => undefined);
+    for (const item of moved.reverse()) await movePathWithFallback(item.destination, item.source, options.renameOptions).catch(() => undefined);
     throw error;
   }
 }
@@ -1128,18 +1354,23 @@ function yamlString(value) {
   return JSON.stringify(String(value));
 }
 
-export async function createSkill(input, log) {
+export async function createSkill(input, log, options = {}) {
+  const requestedRoot = Object.prototype.hasOwnProperty.call(options, "root") ? options.root : rootByKey("dsh");
+  const definition = await checkedWritableRootDefinition(requestedRoot);
+  if (definition && definition.ok === false) return definition;
+  if (!definition) return readonlyError("create");
+  const root = definition.path;
   const requestedName = String(input && input.name || "").trim();
   const name = toKebab(requestedName);
   const description = String(input && input.description || "").trim();
   const body = String(input && input.body || "").trim();
-  if (!name || !KEBAB_RE.test(name) || entryPath(dshRootPath(), name) === null) return { ok: false, error: `无法生成合法 kebab-case 名称（原始名: ${requestedName}）`, code: "error.import.invalidName", params: { name: requestedName } };
+  if (!name || !KEBAB_RE.test(name) || entryPath(root, name) === null) return { ok: false, error: `无法生成合法 kebab-case 名称（原始名: ${requestedName}）`, code: "error.import.invalidName", params: { name: requestedName } };
   if (!description) return { ok: false, error: "技能简介不能为空", code: "error.create.descriptionRequired" };
   if (!body) return { ok: false, error: "技能正文不能为空", code: "error.create.bodyRequired" };
   if (description.length > 500 || body.length > (1 << 18)) return { ok: false, error: "技能内容过长", code: "error.create.tooLarge" };
-  if (await safeExistingEntryPaths(dshRootPath(), name).then((items) => items.length > 0)) return { ok: false, error: `同名技能已存在: ${name}`, code: "error.create.conflict", params: { name } };
-  await fs.mkdir(dshRootPath(), { recursive: true });
-  const target = entryPath(dshRootPath(), name);
+  if (await safeExistingEntryPaths(root, name).then((items) => items.length > 0)) return { ok: false, error: `同名技能已存在: ${name}`, code: "error.create.conflict", params: { name } };
+  await fs.mkdir(root, { recursive: true });
+  const target = entryPath(root, name);
   const stage = temporaryPath(target, "create");
   try {
     await fs.mkdir(stage);
@@ -1151,11 +1382,12 @@ export async function createSkill(input, log) {
     throw error;
   }
   if (log) log("create", `创建 ${join(target, "SKILL.md")}`);
-  return { name, path: join(target, "SKILL.md") };
+  return { name, path: join(target, "SKILL.md"), root: definition.key };
 }
 
-export async function skillDetail(key, name) {
-  const root = rootByKey(key);
+export async function skillDetail(key, name, options = {}) {
+  const scopedRoots = await projectRoots(options.projectCwds);
+  const root = rootByKey(key) || scopedRoots.find((item) => item.key === key);
   if (!root) return { ok: false, error: `未知技能来源: ${key}`, code: "error.root.unknown", params: { root: key } };
   const entry = await resolveEntry(root.path, name);
   if (!entry) return { ok: false, error: `技能不存在: ${name}`, code: "error.skill.notFound", params: { name } };
@@ -1229,18 +1461,46 @@ export async function getProviderSkill(candidate) {
 
 // ── 状态快照 ────────────────────────────────────────────────────────────────
 
-/** DSH 与常见 Agent 根目录技能快照。 */
-export async function state() {
-  const roots = userRoots();
+function canonicalSkillName(item) {
+  return item.entry.declaredName || item.entry.name;
+}
+
+function markWinners(items, options = {}) {
+  const winners = new Map();
+  for (const item of [...items].sort((a, b) => a.root.rank - b.root.rank)) {
+    const canonicalName = canonicalSkillName(item);
+    if (!item.entry.loadable) continue;
+    if (!winners.has(canonicalName)) {
+      winners.set(canonicalName, item);
+    } else if (options.markShadowed !== false) {
+      item.view.shadowedBy = { root: winners.get(canonicalName).root.key, name: winners.get(canonicalName).entry.name };
+    }
+  }
+  for (const [canonicalName, winner] of winners) {
+    if (options.markWinner !== false) winner.view.winner = true;
+    if (options.setLoaded === false) winner.view.discovered = true;
+    else winner.view.loaded = winner.managerEnabled && winner.entry.modelInvocable && winner.entry.userInvocable;
+    winner.view.canonicalName = canonicalName;
+  }
+  return winners;
+}
+
+/** DSH、常见 Agent 与活动 Session 项目根的技能快照。 */
+export async function state(options = {}) {
+  const user = userRoots();
+  const projectWarnings = [];
+  const scoped = await projectRoots(options.projectCwds, projectWarnings);
   const policyResult = await readManagerState();
   const trash = await listTrash();
-  const result = { roots: [], trash, warnings: policyResult.warning ? [policyResult.warning] : [] };
+  const result = { roots: [], projects: [], trash, warnings: [...(policyResult.warning ? [policyResult.warning] : []), ...projectWarnings] };
   const all = [];
-  for (const root of roots) {
+  for (const root of [...scoped, ...user]) {
     const { exists, entries } = await scanEntries(root.path);
+    // 即使项目 .dsh/skills 尚不存在，也要把可写根返回给创建表单；只读项目根仍按实际存在性展示。
+    if (root.scope === "project" && !exists && root.kind !== "project-dsh") continue;
     const skills = [];
     for (const e of entries) {
-      const managerEnabled = root.key === "dsh" ? true : managerSkillEnabled(policyResult.state, root.key, e.name);
+      const managerEnabled = root.scope === "project" || root.key === "dsh" ? true : managerSkillEnabled(policyResult.state, root.key, e.name);
       skills.push({
         name: e.name,
         declaredName: e.declaredName,
@@ -1257,21 +1517,41 @@ export async function state() {
       });
       all.push({ root, entry: e, managerEnabled, view: skills[skills.length - 1] });
     }
-    result.roots.push({ key: root.key, path: root.path, label: root.label, mutable: root.mutable, toggleable: root.toggleable, native: root.native, exists, enabled: root.key === "dsh" ? true : policyResult.state.sources[root.key] !== false, skills });
+    result.roots.push({
+      key: root.key,
+      ...(root.kind ? { kind: root.kind } : {}),
+      ...(root.localeKey ? { localeKey: root.localeKey } : {}),
+      path: root.path,
+      label: root.label,
+      mutable: root.mutable,
+      toggleable: root.toggleable,
+      native: root.native,
+      rank: root.rank,
+      scope: root.scope || "user",
+      ...(root.projectRoot ? { projectRoot: root.projectRoot, projectName: root.projectName, workspaceCwds: root.workspaceCwds } : {}),
+      exists,
+      enabled: root.scope === "project" || root.key === "dsh" ? true : policyResult.state.sources[root.key] !== false,
+      skills,
+    });
   }
-  const winners = new Map();
-  for (const item of all.sort((a, b) => a.root.rank - b.root.rank)) {
-    const canonicalName = item.entry.declaredName || item.entry.name;
-    if (!item.entry.loadable) continue;
-    if (!winners.has(canonicalName)) winners.set(canonicalName, item);
-    else item.view.shadowedBy = { root: winners.get(canonicalName).root.key, name: winners.get(canonicalName).entry.name };
+  const userItems = all.filter((item) => item.root.scope !== "project");
+  markWinners(userItems);
+  const projectGroups = new Map();
+  for (const item of all.filter((candidate) => candidate.root.scope === "project")) {
+    const group = projectGroups.get(item.root.projectRoot) || [];
+    group.push(item);
+    projectGroups.set(item.root.projectRoot, group);
   }
-  for (const [canonicalName, winner] of winners) {
-    winner.view.winner = true;
-    winner.view.loaded = winner.root.key === "dsh"
-      ? winner.entry.modelInvocable && winner.entry.userInvocable
-      : winner.managerEnabled && winner.entry.modelInvocable && winner.entry.userInvocable;
-    winner.view.canonicalName = canonicalName;
+  for (const projectItems of projectGroups.values()) {
+    // 用户级条目参与该 workspace 的优先级判定，但不把其全局视图标记为“被某项目覆盖”。
+    const userCopies = userItems.map((item) => ({ ...item, view: { ...item.view } }));
+    markWinners([...projectItems, ...userCopies], { setLoaded: false });
+  }
+  const seenProjects = new Set();
+  for (const root of result.roots.filter((item) => item.scope === "project")) {
+    if (seenProjects.has(root.projectRoot)) continue;
+    seenProjects.add(root.projectRoot);
+    result.projects.push({ root: root.projectRoot, name: root.projectName, workspaceCwds: root.workspaceCwds });
   }
   result.summary = {
     total: all.length,

package/lib/index.js

@@ -2,7 +2,8 @@
 // - host 路由仅依赖 node: 内置与本地 core.js；ZIP 解压封装在 core
 // - 路由：状态、启停、详情、创建、导入、回收站
 // - 全部接口先校验 DSH Web 信任的 Host；写接口再校验请求标记与 JSON
-// - $DSH_HOME\skills 可创建、导入、回收、启停；外部 Agent 根只读，由 manager 状态控制加载
+// - $DSH_HOME\skills 可创建、导入、回收、启停；用户级外部 Agent 根只读，由 manager 状态控制加载
+// - 活动 Session 的项目 .dsh/skills 可启停、创建、回收与恢复；项目 .agents/skills 保持只读
 
 import { appendFile, rename, rm, stat } from "node:fs/promises";
 import {
@@ -20,11 +21,12 @@ import {
   listProviderCandidates,
   getProviderSkill,
   userRoots,
+  projectRoots,
   logPath,
 } from "./core.js";
 
 const name = "skills-manager";
-const inject = ["webServer", "webRuntime", "skills", "tools"];
+const inject = ["webServer", "webRuntime", "skills", "tools", "sessions"];
 const CLIENT_MARKER_HEADER = "x-dsh-skills-manager";
 const MAX_LOG_BYTES = 1 << 20;
 // 文件夹上传允许 64 MiB 原始内容；Base64 会膨胀约 1/3，再为最多 1000 条路径预留余量。
@@ -243,6 +245,20 @@ function notifyChatCatalog(ctx, invalidateSkills) {
   }
 }
 
+/** 活动 Session 的宿主 cwd；项目 Skill 只从这些已知 workspace 推导。 */
+function activeSessionCwds(ctx) {
+  try {
+    const sessions = ctx.sessions || (typeof ctx.get === "function" ? ctx.get("sessions") : undefined);
+    const list = sessions && typeof sessions.list === "function" ? sessions.list() : [];
+    return [...new Set(list
+      .map((session) => session && session.header && session.header.cwd)
+      .filter((cwd) => typeof cwd === "string" && cwd.trim() !== "")
+      .map((cwd) => cwd.trim()))];
+  } catch {
+    return [];
+  }
+}
+
 function externalSkillProvider(control, invalidators) {
   invalidators.add(control.invalidate);
   if (control.signal && typeof control.signal.addEventListener === "function") {
@@ -306,6 +322,8 @@ function apply(ctx) {
   const trustedHosts = Array.isArray(ctx.webRuntime.trustedHosts) ? ctx.webRuntime.trustedHosts : [];
   const roots = userRoots();
   const rootByKey = Object.fromEntries(roots.map((r) => [r.key, r]));
+  const projectOptions = () => ({ projectCwds: activeSessionCwds(ctx) });
+  const requestRoot = async (key) => rootByKey[key] || (await projectRoots(projectOptions().projectCwds)).find((root) => root.key === key);
   const providerInvalidators = new Set();
   const invalidateSkills = () => {
     for (const invalidate of providerInvalidators) invalidate();
@@ -368,11 +386,11 @@ function apply(ctx) {
           return;
         }
         if (req.method === "GET" && path === "/api/dsh-skills-manager/state") {
-          return run(res, state);
+          return run(res, () => state(projectOptions()));
         }
         if (req.method === "HEAD") {
           // HEAD 复用 GET/405 的载荷计算 content-length，保持与实体一致的响应头语义。
-          if (path === "/api/dsh-skills-manager/state") return run(res, state, undefined, true);
+          if (path === "/api/dsh-skills-manager/state") return run(res, () => state(projectOptions()), undefined, true);
           json(res, 405, { ok: false, code: "error.proto.method", error: `method not allowed: ${req.method}` }, true);
           return;
         }
@@ -392,23 +410,27 @@ function apply(ctx) {
         return enqueueMutation(() => {
           switch (path) {
             case "/api/dsh-skills-manager/enable":
-              return run(res, () => setSkillEnabled(rootByKey[String(body.root || "dsh")], String(body.name || ""), true, log), afterWrite);
+              return run(res, async () => setSkillEnabled(await requestRoot(String(body.root || "dsh")), String(body.name || ""), true, log), afterWrite);
             case "/api/dsh-skills-manager/disable":
-              return run(res, () => setSkillEnabled(rootByKey[String(body.root || "dsh")], String(body.name || ""), false, log), afterWrite);
+              return run(res, async () => setSkillEnabled(await requestRoot(String(body.root || "dsh")), String(body.name || ""), false, log), afterWrite);
             case "/api/dsh-skills-manager/source-enable":
               return run(res, () => setSourceEnabled(String(body.root || ""), true, log), afterWrite);
             case "/api/dsh-skills-manager/source-disable":
               return run(res, () => setSourceEnabled(String(body.root || ""), false, log), afterWrite);
             case "/api/dsh-skills-manager/delete":
-              return run(res, () => deleteSkill(rootByKey[String(body.root || "dsh")], String(body.name || ""), log), afterWrite);
+              return run(res, async () => deleteSkill(await requestRoot(String(body.root || "dsh")), String(body.name || ""), log), afterWrite);
             case "/api/dsh-skills-manager/trash-restore":
-              return run(res, () => restoreTrash(String(body.id || ""), log), afterWrite);
+              return run(res, () => restoreTrash(String(body.id || ""), log, projectOptions()), afterWrite);
             case "/api/dsh-skills-manager/trash-delete":
               return run(res, () => permanentlyDeleteTrash(String(body.id || ""), log));
             case "/api/dsh-skills-manager/detail":
-              return run(res, () => skillDetail(String(body.root || "dsh"), String(body.name || "")));
+              return run(res, () => skillDetail(String(body.root || "dsh"), String(body.name || ""), projectOptions()));
             case "/api/dsh-skills-manager/create":
-              return run(res, () => createSkill({ name: body.name, description: body.description, body: body.body }, log), afterWrite);
+              return run(res, async () => createSkill(
+                { name: body.name, description: body.description, body: body.body },
+                log,
+                { root: await requestRoot(String(body.root || "dsh")) },
+              ), afterWrite);
             case "/api/dsh-skills-manager/import":
               return run(res, () => importSkill(String(body.source || ""), log, {
                 conflict: body.conflict === "overwrite" ? "overwrite" : "skip",
@@ -434,4 +456,4 @@ function apply(ctx) {
   return route;
 }
 
-export { apply, inject, name, notifyChatCatalog, registerAgentSkillProviders };
+export { activeSessionCwds, apply, inject, name, notifyChatCatalog, registerAgentSkillProviders };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-skills-manager",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "description": "NPM-installable DSH Web plugin for safely loading and managing skills across DSH and common local Agents.",
   "license": "Apache-2.0",
   "repository": {