@michengai/dsh-skills-manager 0.1.32 → 0.1.33

package/CHANGELOG.md

@@ -6,6 +6,14 @@ The five most recent published versions are listed below.
 
 ## Unreleased
 
+## 0.1.33 — 2026-09-02
+
+- Added an enabled-by-default, read-only `CC Switch` source at `~\.cc-switch\skills` with source-wide and per-Skill local policy toggles. Legacy state files gain the new source without failing closed.
+- Allowed top-level linked Skill bundles in user-level read-only sources only when they target a direct child of another known read-only Skills root. Provider loading revalidates the real target and deduplicates CC Switch deployments by real path.
+- Kept writable DSH roots, project sources, linked roots, hidden or invalid targets, arbitrary external targets, and import symlinks rejected.
+
+Published package: [`@michengai/dsh-skills-manager@0.1.33`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.33).
+
 ## 0.1.32 — 2026-08-31
 
 - Unified every per-Skill enable/disable action—user DSH, shared Agents, Codex, Claude, Gemini, OpenCode, project DSH, and project Agents—under manager-local tri-state policy; toggles never rewrite a source Skill file.

package/CHANGELOG.zh-CN.md

@@ -6,6 +6,14 @@
 
 ## 未发布
 
+## 0.1.33 — 2026-09-02
+
+- 新增默认开启的只读 `CC Switch` 来源，固定读取 `~\.cc-switch\skills`，支持来源级与逐 Skill 本地启停；旧状态文件自动补齐新来源，不会因缺少新键失败关闭。
+- 用户级只读来源支持指向已知只读 Skills 根直接子目录的顶层技能链接；Provider 在加载时复验真实目标，并按真实路径去重 CC Switch 分发到 Codex、Claude 等目录的副本。
+- 可写 DSH、项目来源、技能根链接、隐藏或非法目标以及任意根外目标继续拒绝，导入符号链接边界不变。
+
+发布包：[`@michengai/dsh-skills-manager@0.1.33`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.33)。
+
 ## 0.1.32 — 2026-08-31
 
 - 将用户 DSH、公共 Agent、Codex、Claude、Gemini、OpenCode、项目 DSH 与项目 Agent 的逐 Skill 启停全部统一为 manager 本地三态策略；启停不再改写任何来源 Skill 文件。

package/README.md

@@ -22,7 +22,7 @@
 
 ## Features
 
-- Discover and load user-level skills from `.agents`, Codex, Claude, Gemini, and OpenCode into DSH.
+- Discover and load user-level skills from `.agents`, CC Switch, Codex, Claude, Gemini, and OpenCode into DSH.
 - Discover project-level `.dsh/skills` and `.agents/skills` from active Session workspaces, grouped by project; every valid Skill can be enabled or disabled through non-mutating local policy.
 - Persist every per-Skill toggle under `$DSH_HOME/skills-manager/state.json` without rewriting any source Skill file.
 - Inspect Markdown bodies, frontmatter, invocation state, duplicate shadowing, and format diagnostics in a source-first UI.
@@ -152,6 +152,7 @@ Escape closes only the frontmost upload or confirmation dialog and leaves Settin
 | --- | --- | --- | --- | --- |
 | `$DSH_HOME\skills` | Yes | Manager state only | Yes | Moves to Trash |
 | `$DSH_AGENTS_HOME\skills` | Yes | Manager state only | No | No |
+| `~\.cc-switch\skills` | Yes, enabled by default | Manager state only | No | No |
 | `~/.codex/skills`, `~/.claude/skills`, `~/.gemini/skills`, `~/.config/opencode/skills` | Yes | Manager state only | No | No |
 | `<project>/.dsh/skills` | Yes, for active Session workspaces | Manager state only | Create in Settings | Moves to Trash and restores to the original project |
 | `<project>/.agents/skills` | Yes, for active Session workspaces | Manager state only | No | No |
@@ -162,6 +163,7 @@ Escape closes only the frontmost upload or confirmation dialog and leaves Settin
 - Trash falls back to copy-then-hide when a project and `$DSH_HOME` are on different volumes; restore uses the same guarded cross-volume path in reverse.
 - Project Trash entries retain their original opaque source identity. Restore is allowed only while that original project is still represented by an active Session workspace; the client cannot nominate a replacement path.
 - Project writes reject linked `.dsh` or `.dsh/skills` directories so a repository cannot redirect creation, deletion, or restore outside its own project root.
+- User-level read-only sources accept top-level linked Skill bundles only when the real target is an ordinary direct child of another known read-only Skills root. The same real Skill is displayed and loaded once according to source rank; writable DSH roots, project roots, linked roots, and arbitrary external targets remain rejected.
 - Rows and summaries say **Enabled/Disabled**, not **Loaded**: these labels describe invocation policy, while full Skill bodies are loaded on demand by DSH. Use Refresh after IDE, Git, or shell changes; the official provider remains responsible for project catalog watching and invalidation.
 - Empty project roots stay out of the main source list to reduce noise, but remain selectable in Create Skill so the first project Skill can still be created. Project DSH supports per-Skill toggles only, not a source-wide switch.
 - Replacements copy to a temporary sibling path first and keep the original until that succeeds.

package/README.zh-CN.md

@@ -22,7 +22,7 @@
 
 ## 功能概览
 
-- 自动发现并把 `.agents`、Codex、Claude、Gemini 和 OpenCode 的用户级技能真正加载进 DSH。
+- 自动发现并把 `.agents`、CC Switch、Codex、Claude、Gemini 和 OpenCode 的用户级技能真正加载进 DSH。
 - 从活动 Session 工作区发现项目级 `.dsh/skills` 与 `.agents/skills` 并按项目分组；所有有效 Skill 都可通过不改源文件的本地策略启停。
 - 所有逐 Skill 启停都只写入 `$DSH_HOME\skills-manager\state.json`，绝不改写任何来源 Skill 文件。
 - 按来源折叠、搜索和筛选，并查看技能正文、frontmatter、调用状态、重名遮蔽与格式诊断。
@@ -152,6 +152,7 @@ dsh --profile web --dump-config
 | --- | --- | --- | --- | --- |
 | `$DSH_HOME\skills` | 支持 | 仅写 manager 状态 | 支持 | 进入回收站 |
 | `$DSH_AGENTS_HOME\skills` | 支持 | 仅写 manager 状态 | 不支持 | 不支持 |
+| `~\.cc-switch\skills` | 支持，默认开启 | 仅写 manager 状态 | 不支持 | 不支持 |
 | `~/.codex/skills`、`~/.claude/skills`、`~/.gemini/skills`、`~/.config/opencode/skills` | 支持 | 仅写 manager 状态 | 不支持 | 不支持 |
 | `<project>/.dsh/skills` | 支持活动 Session 工作区 | 仅写 manager 状态 | 设置页支持创建 | 进入回收站并恢复到原项目 |
 | `<project>/.agents/skills` | 支持活动 Session 工作区 | 仅写 manager 状态 | 不支持 | 不支持 |
@@ -162,6 +163,7 @@ dsh --profile web --dump-config
 - 当项目与 `$DSH_HOME` 位于不同磁盘时，回收站会降级为“复制后在源盘原子隐藏”；恢复使用反向的同一安全流程。
 - 项目回收站条目保存原始不透明来源身份。仅当原项目仍由活动 Session 工作区提供时才允许恢复；客户端不能指定替代路径。
 - 项目写入会拒绝链接形式的 `.dsh` 或 `.dsh/skills` 目录，避免仓库把创建、删除或恢复重定向到项目根之外。
+- 用户级只读来源允许顶层技能目录链接，但真实目标必须是另一个已知只读 Skills 根的普通直接子目录；同一真实技能按来源优先级只展示和加载一次。可写 DSH、项目来源、技能根链接和任意外部目标仍被拒绝。
 - 列表和摘要统一使用“已启用/已停用”，不再使用“已加载”：这里描述的是调用策略，完整 Skill 正文仍由 DSH 按需加载。IDE、Git 或 shell 改动后可点击“刷新”；项目 catalog 的 watcher 与 invalidation 仍由官方 provider 负责。
 - 没有 Skill 的项目根不会出现在主来源列表中，但仍保留在“创建技能”的目标选择中，确保可以创建第一个项目 Skill。项目 DSH 只提供逐 Skill 启停，不提供整个项目来源总开关。
 - 覆盖前先复制到同目录临时路径；复制成功前不会改动现有技能。

package/lib/client.js

@@ -35,7 +35,7 @@ window.__ModuleLoader__.load({
         "error.proto.forbidden": "禁止的修改请求（缺少客户端标记）", "error.proto.forbiddenHost": "禁止的请求来源（非法 Host）", "error.proto.contentType": "请求体必须是 application/json", "error.proto.method": "不支持的请求方法", "error.proto.unknownAction": "未知操作", "error.proto.bodyTooLarge": "请求体过大", "error.proto.invalidJson": "请求体不是合法 JSON", "error.proto.nonJson": "服务端返回非 JSON 响应（HTTP {status}）",
         "diagnostic.frontmatter.missing": "缺少完整 YAML frontmatter", "diagnostic.name.missing": "frontmatter 缺少 name", "diagnostic.name.invalid": "技能名称不是合法 kebab-case：{name}", "diagnostic.description.missing": "frontmatter 缺少 description", "diagnostic.invocation.invalid": "调用策略字段值无效", "diagnostic.shadowed": "被更高优先级来源 {root} 覆盖",
         "action.enable": "启用", "action.disable": "停用", "action.create": "创建", "action.delete": "删除", "action.restore": "恢复", "action.toggle": "启用或停用",
-        "root.dsh": "DSH 技能", "root.agents": "公共 Agent", "root.projectDsh": "项目 DSH", "root.projectAgents": "项目 Agent", "root.codex": "Codex", "root.claude": "Claude", "root.gemini": "Gemini", "root.opencode": "OpenCode"
+        "root.dsh": "DSH 技能", "root.agents": "公共 Agent", "root.ccswitch": "CC Switch", "root.projectDsh": "项目 DSH", "root.projectAgents": "项目 Agent", "root.codex": "Codex", "root.claude": "Claude", "root.gemini": "Gemini", "root.opencode": "OpenCode"
       },
       en: {
         "title": "Skills", "desc": "Load and manage Agent Skills on this computer in one place.",
@@ -62,7 +62,7 @@ window.__ModuleLoader__.load({
         "error.proto.forbidden": "Forbidden mutation request (missing client marker)", "error.proto.forbiddenHost": "Forbidden request origin (invalid host)", "error.proto.contentType": "Content type must be application/json", "error.proto.method": "Method not allowed", "error.proto.unknownAction": "Unknown action", "error.proto.bodyTooLarge": "Request body too large", "error.proto.invalidJson": "Invalid JSON request body", "error.proto.nonJson": "Server returned a non-JSON response (HTTP {status})",
         "diagnostic.frontmatter.missing": "Missing complete YAML frontmatter", "diagnostic.name.missing": "Frontmatter is missing name", "diagnostic.name.invalid": "Skill name is not valid kebab-case: {name}", "diagnostic.description.missing": "Frontmatter is missing description", "diagnostic.invocation.invalid": "Invocation policy value is invalid", "diagnostic.shadowed": "Shadowed by higher-priority source {root}",
         "action.enable": "enable", "action.disable": "disable", "action.create": "create", "action.delete": "delete", "action.restore": "restore", "action.toggle": "enabling or disabling",
-        "root.dsh": "DSH skills", "root.agents": "Shared Agent", "root.projectDsh": "Project DSH", "root.projectAgents": "Project Agent", "root.codex": "Codex", "root.claude": "Claude", "root.gemini": "Gemini", "root.opencode": "OpenCode"
+        "root.dsh": "DSH skills", "root.agents": "Shared Agent", "root.ccswitch": "CC Switch", "root.projectDsh": "Project DSH", "root.projectAgents": "Project Agent", "root.codex": "Codex", "root.claude": "Claude", "root.gemini": "Gemini", "root.opencode": "OpenCode"
       }
     };
 

package/lib/core.js

@@ -68,6 +68,7 @@ export function userRoots() {
   return [
     { key: "dsh", path: join(resolveDshHome(), "skills"), label: "DSH 技能", mutable: true, toggleable: true, native: true, rank: 400 },
     { key: "agents", path: join(resolveAgentsHome(), "skills"), label: "公共 Agent", mutable: false, toggleable: true, native: true, rank: 450 },
+    { key: "ccswitch", path: join(homedir(), ".cc-switch", "skills"), label: "CC Switch", mutable: false, toggleable: true, native: false, rank: 510 },
     { key: "codex", path: join(process.env.DSH_CODEX_HOME || join(homedir(), ".codex"), "skills"), label: "Codex", mutable: false, toggleable: true, native: false, rank: 520 },
     { key: "claude", path: join(process.env.DSH_CLAUDE_HOME || join(homedir(), ".claude"), "skills"), label: "Claude", mutable: false, toggleable: true, native: false, rank: 530 },
     { key: "gemini", path: join(process.env.DSH_GEMINI_HOME || join(homedir(), ".gemini"), "skills"), label: "Gemini", mutable: false, toggleable: true, native: false, rank: 540 },
@@ -336,6 +337,11 @@ async function isInsideResolvedRoot(rootReal, path) {
   return isSameOrDescendant(rootReal, await resolvedPath(path));
 }
 
+function pathIdentity(path) {
+  const canonical = resolve(path);
+  return process.platform === "win32" ? canonical.toLowerCase() : canonical;
+}
+
 async function lstatOrNull(path) {
   try {
     return await fs.lstat(path);
@@ -344,6 +350,49 @@ async function lstatOrNull(path) {
   }
 }
 
+/**
+ * 只接受用户级只读来源中的顶层目录链接，且目标必须是另一个已知只读 Skills 根的直接子目录。
+ * 这样可以兼容 CC Switch 的分发链接，同时不把任意文件系统路径扩展成技能来源。
+ */
+async function resolveTrustedLinkedBundle(root, bundlePath) {
+  const sourceRoot = rootDefinition(root);
+  if (!sourceRoot || sourceRoot.mutable || sourceRoot.scope === "project") return null;
+
+  let realEntryPath;
+  try {
+    realEntryPath = await fs.realpath(bundlePath);
+  } catch {
+    return null;
+  }
+  const realEntryStat = await lstatOrNull(realEntryPath);
+  if (!realEntryStat || !realEntryStat.isDirectory() || realEntryStat.isSymbolicLink()) return null;
+
+  let sourceRootReal;
+  try {
+    sourceRootReal = await fs.realpath(sourceRoot.path);
+  } catch {
+    return null;
+  }
+  let trusted = false;
+  for (const targetRoot of userRoots().filter((candidate) => !candidate.mutable && candidate.scope !== "project")) {
+    const targetRootStat = await lstatOrNull(targetRoot.path);
+    if (!targetRootStat || !targetRootStat.isDirectory() || targetRootStat.isSymbolicLink()) continue;
+    const targetRootReal = await fs.realpath(targetRoot.path);
+    if (pathIdentity(targetRootReal) === pathIdentity(sourceRootReal)) continue;
+    const acceptedTarget = entryPath(targetRootReal, basename(realEntryPath));
+    if (acceptedTarget && pathIdentity(acceptedTarget) === pathIdentity(realEntryPath)) {
+      trusted = true;
+      break;
+    }
+  }
+  if (!trusted) return null;
+
+  const realDocPath = join(realEntryPath, "SKILL.md");
+  const docStat = await lstatOrNull(realDocPath);
+  if (!docStat || !docStat.isFile() || docStat.isSymbolicLink()) return null;
+  return { realEntryPath, realDocPath };
+}
+
 /** 名称只允许一个普通路径段；不把既有技能名称限制为 kebab-case。 */
 export function entryPath(root, name) {
   if (typeof name !== "string" || name === "" || name === "." || name === ".." || name.startsWith(".") || name.length > MAX_ENTRY_NAME_LENGTH || /[\\/:*?"<>|\0]/.test(name) || /[. ]$/.test(name) || WINDOWS_DEVICE_NAME_RE.test(name) || basename(name) !== name) return null;
@@ -535,14 +584,19 @@ export async function resolveEntry(root, name) {
     const bundleDoc = join(bundlePath, "SKILL.md");
     const docStat = await lstatOrNull(bundleDoc);
     if (docStat && docStat.isFile() && !docStat.isSymbolicLink() && await isInsideResolvedRoot(rootReal, bundleDoc)) {
-      return { kind: "bundle", docPath: bundleDoc, entryPath: bundlePath };
+      return { kind: "bundle", docPath: bundleDoc, entryPath: bundlePath, realDocPath: await fs.realpath(bundleDoc), realEntryPath: await fs.realpath(bundlePath), linked: false };
     }
   }
+  if (bundleStat && bundleStat.isSymbolicLink()) {
+    const linked = await resolveTrustedLinkedBundle(rootPath, bundlePath);
+    if (linked) return { kind: "bundle", docPath: join(bundlePath, "SKILL.md"), entryPath: bundlePath, ...linked, linked: true };
+  }
   const flatDoc = resolve(rootPath, `${name}.md`);
   if (!isSameOrDescendant(rootPath, flatDoc) || rootPath === flatDoc) return null;
   const flatStat = await lstatOrNull(flatDoc);
   if (flatStat && flatStat.isFile() && !flatStat.isSymbolicLink() && await isInsideResolvedRoot(rootReal, flatDoc)) {
-    return { kind: "flat", docPath: flatDoc, entryPath: flatDoc };
+    const realDocPath = await fs.realpath(flatDoc);
+    return { kind: "flat", docPath: flatDoc, entryPath: flatDoc, realDocPath, realEntryPath: realDocPath, linked: false };
   }
   return null;
 }
@@ -591,20 +645,29 @@ export async function scanEntries(root) {
   const rootReal = await resolvedPath(root);
   for (const it of items) {
     try {
-      if (it.isSymbolicLink()) continue;
+      if (it.isSymbolicLink()) {
+        const bundlePath = entryPath(root, it.name);
+        if (bundlePath === null) continue;
+        const linked = await resolveTrustedLinkedBundle(root, bundlePath);
+        if (!linked) continue;
+        const doc = parseSkillDoc(await fs.readFile(linked.realDocPath, "utf8"));
+        byName.set(it.name, { ...entryOf(it.name, "bundle", join(bundlePath, "SKILL.md"), doc), entryPath: bundlePath, ...linked, linked: true });
+        continue;
+      }
       if (it.isDirectory() && entryPath(root, it.name) !== null) {
         const docPath = join(root, it.name, "SKILL.md");
         const st = await lstatOrNull(docPath);
         if (!st || !st.isFile() || st.isSymbolicLink() || !(await isInsideResolvedRoot(rootReal, docPath))) continue;
         const doc = parseSkillDoc(await fs.readFile(docPath, "utf8"));
-        byName.set(it.name, entryOf(it.name, "bundle", docPath, doc));
+        byName.set(it.name, { ...entryOf(it.name, "bundle", docPath, doc), entryPath: join(root, it.name), realDocPath: await fs.realpath(docPath), realEntryPath: await fs.realpath(join(root, it.name)), linked: false });
       } else if (it.isFile() && it.name.toLowerCase().endsWith(".md") && it.name.toLowerCase() !== "skill.md" && entryPath(root, it.name.slice(0, -3)) !== null) {
         const skillName = it.name.slice(0, -3);
         if (byName.has(skillName)) continue;
         const docPath = join(root, it.name);
         if (!(await isInsideResolvedRoot(rootReal, docPath))) continue;
         const doc = parseSkillDoc(await fs.readFile(docPath, "utf8"));
-        byName.set(skillName, entryOf(skillName, "flat", docPath, doc));
+        const realDocPath = await fs.realpath(docPath);
+        byName.set(skillName, { ...entryOf(skillName, "flat", docPath, doc), entryPath: docPath, realDocPath, realEntryPath: realDocPath, linked: false });
       }
     } catch {
       /* 跳过不可读条目 */
@@ -614,6 +677,23 @@ export async function scanEntries(root) {
   return { exists: true, entries };
 }
 
+/** 同一真实技能可能被 CC Switch 分发到多个 Agent 根；按来源 rank 只保留一份。 */
+async function scanDeduplicatedUserRoots(roots = userRoots()) {
+  const scans = new Map();
+  for (const root of roots) scans.set(root.key, await scanEntries(root.path));
+  const claimed = new Set();
+  for (const root of [...roots].sort((left, right) => left.rank - right.rank)) {
+    const scan = scans.get(root.key);
+    scan.entries = scan.entries.filter((entry) => {
+      const identity = pathIdentity(entry.realEntryPath || entry.entryPath || entry.docPath);
+      if (claimed.has(identity)) return false;
+      claimed.add(identity);
+      return true;
+    });
+  }
+  return scans;
+}
+
 // ── Manager 本地策略（外部源只读，启停状态写入 DSH_HOME）────────────────────
 
 function defaultManagerState() {
@@ -667,6 +747,15 @@ function validManagerStateDocument(value) {
   return true;
 }
 
+/** v0.1.32 及更早状态尚无 CC Switch 键；只补充新增字段，其余损坏仍然失败关闭。 */
+function migrateManagerStateDocument(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.version !== 1) return value;
+  if (value.sources && typeof value.sources === "object" && !Array.isArray(value.sources) && value.sources.ccswitch === undefined) value.sources.ccswitch = true;
+  if (value.disabledSkills && typeof value.disabledSkills === "object" && !Array.isArray(value.disabledSkills) && value.disabledSkills.ccswitch === undefined) value.disabledSkills.ccswitch = [];
+  if (value.enabledSkills && typeof value.enabledSkills === "object" && !Array.isArray(value.enabledSkills) && value.enabledSkills.ccswitch === undefined) value.enabledSkills.ccswitch = [];
+  return value;
+}
+
 function normalizeManagerState(value) {
   const normalized = defaultManagerState();
   if (!value || typeof value !== "object" || Array.isArray(value)) return normalized;
@@ -692,7 +781,7 @@ function normalizeManagerState(value) {
 export async function readManagerState() {
   try {
     const raw = await fs.readFile(managerStatePath(), "utf8");
-    const parsed = JSON.parse(raw);
+    const parsed = migrateManagerStateDocument(JSON.parse(raw));
     if (!validManagerStateDocument(parsed)) throw codedError("invalid manager state schema", "error.state.invalid");
     return { state: normalizeManagerState(parsed), warning: null, writable: true };
   } catch (error) {
@@ -1449,7 +1538,7 @@ export async function skillDetail(key, name, options = {}) {
   if (!root) return { ok: false, error: `未知技能来源: ${key}`, code: "error.root.unknown", params: { root: key } };
   const entry = await resolveEntry(root.path, name);
   if (!entry) return { ok: false, error: `技能不存在: ${name}`, code: "error.skill.notFound", params: { name } };
-  const raw = await fs.readFile(entry.docPath, "utf8");
+  const raw = await fs.readFile(entry.realDocPath || entry.docPath, "utf8");
   const doc = parseSkillDoc(raw);
   const summary = entryOf(name, entry.kind, entry.docPath, doc);
   return {
@@ -1471,8 +1560,10 @@ export async function skillDetail(key, name, options = {}) {
 export async function listProviderCandidates(options = {}) {
   const policyResult = await readManagerState();
   const candidates = [];
-  for (const root of userRoots()) {
-    const scanned = await scanEntries(root.path);
+  const user = userRoots();
+  const userScans = await scanDeduplicatedUserRoots(user);
+  for (const root of user) {
+    const scanned = userScans.get(root.key);
     for (const entry of scanned.entries) {
       if (!entry.loadable) continue;
       const policy = effectiveSkillPolicy(policyResult, root, entry);
@@ -1485,8 +1576,8 @@ export async function listProviderCandidates(options = {}) {
         provider: "dsh-skills-manager-external",
         source: root.key === "dsh" ? "user-dsh" : `agent-${root.key}`,
         rank: root.key === "dsh" ? USER_DSH_POLICY_RANK : root.rank,
-        locator: { rootKey: root.key, entryName: entry.name, path: entry.docPath },
-        resourceBase: { kind: "directory", path: entry.kind === "bundle" ? dirname(entry.docPath) : root.path },
+        locator: { rootKey: root.key, entryName: entry.name, path: entry.docPath, realEntryPath: entry.realEntryPath, realDocPath: entry.realDocPath },
+        resourceBase: { kind: "directory", path: entry.kind === "bundle" ? entry.realEntryPath : root.path },
         path: entry.docPath,
         metadata: { dshSkillsManager: { root: root.key, readOnly: !root.mutable, sourceReadOnly: !root.mutable, policyOnly: root.key === "dsh" } },
       });
@@ -1531,7 +1622,9 @@ export async function getProviderSkill(candidate, options = {}) {
   if (!root) return undefined;
   const entry = await resolveEntry(root.path, String(locator.entryName || ""));
   if (!entry || resolve(entry.docPath) !== resolve(locator.path)) return undefined;
-  const doc = parseSkillDoc(await fs.readFile(entry.docPath, "utf8"));
+  if (locator.realEntryPath && pathIdentity(entry.realEntryPath) !== pathIdentity(locator.realEntryPath)) return undefined;
+  if (locator.realDocPath && pathIdentity(entry.realDocPath) !== pathIdentity(locator.realDocPath)) return undefined;
+  const doc = parseSkillDoc(await fs.readFile(entry.realDocPath || entry.docPath, "utf8"));
   const summary = entryOf(locator.entryName, entry.kind, entry.docPath, doc);
   if (!summary.loadable || summary.declaredName !== candidate.name) return undefined;
   return {
@@ -1575,6 +1668,7 @@ function markWinners(items, options = {}) {
 /** DSH、常见 Agent 与活动 Session 项目根的技能快照。 */
 export async function state(options = {}) {
   const user = userRoots();
+  const userScans = await scanDeduplicatedUserRoots(user);
   const projectWarnings = [];
   const scoped = await projectRoots(options.projectCwds, projectWarnings);
   const policyResult = await readManagerState();
@@ -1582,7 +1676,7 @@ export async function state(options = {}) {
   const result = { roots: [], projects: [], trash, warnings: [...(policyResult.warning ? [policyResult.warning] : []), ...projectWarnings] };
   const all = [];
   for (const root of [...scoped, ...user]) {
-    const { exists, entries } = await scanEntries(root.path);
+    const { exists, entries } = root.scope === "project" ? await scanEntries(root.path) : userScans.get(root.key);
     // 即使项目 .dsh/skills 尚不存在，也要把可写根返回给创建表单；只读项目根仍按实际存在性展示。
     if (root.scope === "project" && !exists && root.kind !== "project-dsh") continue;
     const skills = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-skills-manager",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "NPM-installable DSH Web plugin for safely loading and managing skills across DSH and common local Agents.",
   "license": "Apache-2.0",
   "repository": {