@michengai/dsh-skills-manager 0.1.48 → 0.1.49

package/CHANGELOG.md

@@ -4,6 +4,13 @@
 
 The five most recent published versions are listed below.
 
+## 0.1.49 - 2026-09-12
+
+- Add Copilot support for global `~/.copilot/skills` and project `.github/skills`, and expand project sources for common agents. The project tab follows only the current session; direct project-management API calls must include its ID in `x-dsh-skills-session`.
+- Prioritize project copies over global copies and toggle each source independently. Another enabled copy can take over when one is disabled, with the active source identified in the UI; invocation is blocked only when all copies are disabled.
+- Give Global, Project, and Trash separate tabs, group skills into collapsible sources, hide long descriptions, and remove redundant information. Creation and import always save to global DSH; generic project `skills/` directories use a neutral source label.
+- Fix update buttons and dialogs not following language changes, and align Trash date formatting and import-warning separators with the UI language.
+
 ## 0.1.48 - 2026-09-11
 
 - Add support for DeepSeek Harness `0.1.5-rc.2` while retaining support for the four previously supported versions; skill discovery, enable/disable policies, and management workflows remain unchanged.
@@ -24,7 +31,3 @@ The five most recent published versions are listed below.
 - Stop scanning resources inside ordinary skill bundles and skip `node_modules`, while retaining nested discovery beside a root skill. Hide overlapping project Agent roots so they cannot bypass user disable policies.
 - Read-only user and project Agent sources now discover nested skills and follow external directory symlinks and Windows junctions by default, including linked roots. Discovery has cycle, depth, and entry limits.
 - Keep list, detail, provider, and local enable/disable policies consistent across differently named aliases. Writable DSH roots and import/delete safeguards remain unchanged.
-
-## 0.1.44 - 2026-09-09
-
-- Unified settings headings, descriptions, and action layouts; maintenance controls no longer squeeze titles or versions. The layout adapts to native DSH settings without Codex UI.

package/CHANGELOG.zh-CN.md

@@ -4,6 +4,13 @@
 
 以下记录最近发布的五个版本。
 
+## 0.1.49 - 2026-09-12
+
+- 新增 Copilot 全局 `~/.copilot/skills` 和项目 `.github/skills` 支持，扩展常见 Agent 的项目来源。项目页仅跟随当前会话；直接调用项目管理接口时需携带 `x-dsh-skills-session` 会话 ID。
+- 项目副本优先于全局副本，各来源独立启停；停用后可由其他已启用副本接管，并在页面提示实际来源，全部副本停用时才阻断调用。
+- 全局、项目和回收站使用独立 Tab，技能按来源折叠并隐藏长描述，精简重复信息。创建和导入固定保存到全局 DSH；通用项目 `skills/` 使用中性来源名称。
+- 修复切换中英文时更新按钮和弹窗未同步、回收站时间格式及导入警告分隔符不一致的问题。
+
 ## 0.1.48 - 2026-09-11
 
 - 新增 DeepSeek Harness `0.1.5-rc.2` 兼容支持，保留此前四个版本的支持；技能发现、启停及管理方式保持不变。
@@ -24,7 +31,3 @@
 - 修复 bundle 内部资源耗尽扫描预算的问题：普通 bundle 作为叶子并跳过 `node_modules`，根技能仍允许嵌套发现。重叠的项目 Agent 来源现在隐藏，防止绕过用户停用策略。
 - 用户级只读来源和项目 Agent 来源默认递归发现技能，支持外部目录软链接、Windows junction 和技能根链接；扫描具备循环、深度和数量限制。
 - 列表、详情、Provider 与本地启停策略统一处理不同名称的分发入口；可写 DSH 和导入、删除防护保持不变。
-
-## 0.1.44 - 2026-09-09
-
-- 统一设置页标题、说明与操作布局，标题及版本不再被维护按钮挤压；适配原生 DSH 设置内容区，无需安装 Codex UI。

package/README.md

@@ -23,18 +23,18 @@
 
 Bring skills from your computer and projects into one DSH management page. Find skills, read their contents, control availability, and create or import your own.
 
-- **Reuse existing skills**: discover user skills from `.agents`, CC Switch, Codex, Claude, Gemini, OpenCode, and Cursor.
-- **Organize by project**: browse DSH and `.agents` skills from active projects, with source filters and search.
+- **Reuse existing skills**: discover user skills from `.agents`, CC Switch, Codex, Claude, Gemini, OpenCode, Cursor, Copilot, Windsurf, Trae, OpenClaw, Roo, and CodeBuddy.
+- **Organize by project**: use the Global / Project tabs to browse DSH, `.agents`, `.github` (Copilot), and other Agent directories in active projects, then filter by source or status.
 - **Toggle availability**: enabling or disabling a skill changes its availability in DSH without editing source files.
 - **Read before using**: inspect the body, source information, format diagnostics, and duplicate-name notices.
 - **Add your own skills**: create user or project skills in Settings, or import ZIP archives, skill folders, and `SKILL.md` files.
-- **Recover deleted skills**: DSH skills go to Trash first and can be restored to their original location.
+- **Recover deleted skills**: the dedicated Trash tab sits alongside Global / Project, shows the pending count, and lets you restore skills or confirm permanent deletion.
 
 ## Screenshots
 
-Browse by source or search in **Settings → Skills**. External Agent sources are made available through manager policy while their files stay read-only:
+Switch between Global skills, Project skills, and Trash in **Settings → Skills**. External Agent source files remain read-only:
 
-![Skills Manager source-first settings page](assets/screenshots/skills-manager-v2-preview.png)
+![Skills manager with a dedicated Trash tab](assets/screenshots/skills-manager-v2-preview.png)
 
 Open any skill to inspect its source path, diagnostics, Markdown body, and parsed frontmatter:
 
@@ -63,7 +63,7 @@ For a ready-to-use workbench, download [DSH Codex Desktop](https://github.com/Mi
 
 - A working DeepSeek Harness Web installation with `dsh` available in PowerShell.
 - Examples use the `web` profile; replace it with the target profile.
-- Plugin `0.1.48` is tested with DeepSeek Harness `0.1.0-rc.8`, `0.1.1-rc.2`, `0.1.2-rc.1`, `0.1.5-rc.1`, `0.1.5-rc.2`. Development dependencies remain pinned to `0.1.5-rc.2`; other Host versions are not implicitly supported.
+- Plugin `0.1.49` is tested with DeepSeek Harness `0.1.0-rc.8`, `0.1.1-rc.2`, `0.1.2-rc.1`, `0.1.5-rc.1`, `0.1.5-rc.2`. Development dependencies remain pinned to `0.1.5-rc.2`; other Host versions are not implicitly supported.
 - Source installation and development require Node.js `^22.19.0 || >=24.0.0`. npm installation does not require running `npm install` in an arbitrary directory.
 
 ## Installation
@@ -103,10 +103,10 @@ Open **Settings → Skills**, then use the panel as follows:
 
 | Goal | Action | Scope |
 | --- | --- | --- |
-| Search or filter | Narrow by source, name, or description. | All sources |
+| Search or filter | Choose the global or project scope first, then narrow by source, invocation status, name, or description. | Current scope |
 | Inspect details | Review body, frontmatter, path, format diagnostics, and duplicate shadowing. | All sources |
 | Enable or disable | Update manager-local invocation policy without modifying the source Skill file. | All valid Skills in user and active-project sources |
-| Create or import | Choose a user or active project DSH destination when creating in Settings; imports remain user-level. | `$DSH_HOME/skills`, active `<project>/.dsh/skills` for creation |
+| Create or import | Both Settings creation and import always save to global DSH. | `$DSH_HOME/skills` |
 | Create from conversation | Let an Agent call `create_skill`; DSH asks for approval before writing. | `$DSH_HOME/skills` |
 | Delete and recover | Move to Trash, restore to the original source, or permanently delete in a second step. | User and active-project DSH skills |
 
@@ -122,20 +122,22 @@ Escape closes only the frontmost upload or confirmation dialog and leaves Settin
 | `$DSH_AGENTS_HOME\skills` | Yes | Manager state only | No | No |
 | `~\.cc-switch\skills` | Yes, enabled by default | Manager state only | No | No |
 | `%USERPROFILE%\.cursor\skills` (or `$DSH_CURSOR_HOME\skills`) | Yes | Manager state only | No | No |
-| `~/.codex/skills`, `~/.claude/skills`, `~/.gemini/skills`, `~/.config/opencode/skills` | Yes | Manager state only | No | No |
-| `<project>/.dsh/skills` | Yes, for active Session workspaces | Manager state only | Create in Settings | Moves to Trash and restores to the original project |
-| `<project>/.agents/skills` | Yes, for active Session workspaces | Manager state only | No | No |
+| `~/.codex/skills`, `~/.claude/skills`, `~/.gemini/skills`, `~/.config/opencode/skills`, `~/.copilot/skills`, `~/.codeium/windsurf/skills`, `~/.windsurf/skills`, `~/.trae/skills`, `~/.trae-cn/skills`, `~/.openclaw/skills`, `~/.clawdbot/skills`, `~/.roo/skills`, `~/.codebuddy/skills` | Yes | Manager state only | No | No |
+| `<project>/.dsh/skills` | Yes, for active Session workspaces | Manager state only | No project creation in Settings | Moves to Trash and restores to the original project |
+| `<project>/.agents/skills`, `<project>/.github/skills`, `<project>/.codex/skills`, `<project>/.claude/skills`, `<project>/.gemini/skills`, `<project>/.opencode/skills`, `<project>/.cursor/skills`, `<project>/.windsurf/skills`, `<project>/.trae/skills`, `<project>/.trae-cn/skills`, `<project>/skills`, `<project>/.roo/skills`, `<project>/.codebuddy/skills` | Yes, for active Session workspaces | Manager state only | No | No |
 
 - Enable, disable, and delete accept only one ordinary skill-name path segment.
-- Project roots are derived only from active Session `cwd` values; client requests carry an opaque source key and cannot nominate an arbitrary workspace path.
-- Project sources follow DSH's nearest-`.git` root convention and rank order (`project-dsh` 100 before `project-agents` 200). The manager re-scans for each state/detail request. Explicit project policy is enforced by workspace-scoped rank 99/199 overlays; user DSH policy uses rank 399. With no override, DSH's official provider remains the owner. Toggle writes are limited to manager state; project file writes occur only for explicit create/Trash/restore actions under `.dsh/skills`.
+- `<project>/skills` is labeled “Project Skills”: it supports OpenClaw workspace skills without assuming Agent ownership. Existing toggle policies remain compatible.
+- The project tab follows the current session without a project selector. Requests carry its ID in `x-dsh-skills-session`; the server derives project roots only from that session’s `cwd`. Missing or unknown sessions never fall back to other sessions, and clients cannot nominate an arbitrary workspace path.
+- Enable/disable applies only to the selected source copy. The highest-priority copy not disabled in the manager is used: disabling a project copy falls back to another enabled project copy or a global copy. Disabling a global copy does not disable project copies. Only when all copies are disabled does the manager block the skill. Disabled rows identify the global or project source currently taking over; frontmatter invocation restrictions remain enforced.
+- Project sources follow DSH's nearest-`.git` root convention and rank order (`project-dsh` 100, `project-agents` 200, then other project sources 210–320, then user DSH 400, shared Agents 450, and other user sources 500–640). The manager re-scans for each state/detail request. Explicit project policy is enforced by workspace-scoped rank overlays; user DSH policy uses rank 399. With no override, DSH's official provider remains the owner. Toggle writes are limited to manager state; project file writes occur only for explicit create/Trash/restore actions under `.dsh/skills`.
 - Trash falls back to copy-then-hide when a project and `$DSH_HOME` are on different volumes; restore uses the same guarded cross-volume path in reverse.
-- Project Trash entries retain their original opaque source identity. Restore is allowed only while that original project is still represented by an active Session workspace; the client cannot nominate a replacement path.
+- Project Trash entries retain their original opaque source identity. Restore is allowed only when the original project matches the current session’s project; the client cannot nominate a replacement path.
 - Project writes reject linked `.dsh` or `.dsh/skills` directories so a repository cannot redirect creation, deletion, or restore outside its own project root.
 - User-level read-only and project Agent sources recursively discover `SKILL.md` by default. Skill directories, roots, and parent directories may link to external locations through symlinks or Windows junctions without an opt-in or allowlist. Real-path deduplication and manager-local toggles preserve read-only sources. Skill-file symlinks are ignored, cycles terminate, and scans have depth and size limits. Writable DSH roots, imports, and deletion retain their existing boundaries.
 - Directories containing `SKILL.md` are bundle leaves; their resources and `node_modules` are not traversed. A root-level `SKILL.md` can still coexist with nested skills. Project Agent roots that overlap user skill roots by real path are hidden to preserve user disable policies.
 - Rows and summaries say **Enabled/Disabled**, not **Loaded**: these labels describe invocation policy, while full Skill bodies are loaded on demand by DSH. Use Refresh after IDE, Git, or shell changes; the official provider remains responsible for project catalog watching and invalidation.
-- Empty project roots stay out of the main source list to reduce noise, but remain selectable in Create Skill so the first project Skill can still be created. Project DSH supports per-Skill toggles only, not a source-wide switch.
+- Missing read-only project sources stay out of the list; empty project DSH roots remain visible, while Settings creation and import always target global DSH. Project DSH supports per-Skill toggles only, not a source-wide switch.
 - Replacements copy to a temporary sibling path first and keep the original until that succeeds.
 - Every endpoint, including GET `/state`, accepts only a loopback `Host` or a canonical `host[:port]` that the DSH Web runtime already trusts through its LAN bind and `--trusted-host`; unknown hosts still receive 403.
 - Browser requests must also carry a same-origin `Origin` when present and must not be marked cross-site; write endpoints continue to require JSON and the DSH client request marker.

package/README.zh-CN.md

@@ -23,18 +23,18 @@
 
 把散落在本机和项目中的 Agent 技能集中到 DSH 管理。在同一个页面里查找技能、查看内容、控制启停，也能创建或导入自己的技能。
 
-- **复用已有技能**：发现 `.agents`、CC Switch、Codex、Claude、Gemini、OpenCode 和 Cursor 的用户级技能。
-- **按项目整理**：展示活动项目中的 DSH 与 `.agents` 技能，按来源搜索和筛选。
+- **复用已有技能**：发现 `.agents`、CC Switch、Codex、Claude、Gemini、OpenCode、Cursor、Copilot、Windsurf、Trae、OpenClaw、Roo 和 CodeBuddy 的用户级技能。
+- **按项目整理**：用「全局技能 / 项目技能」页签查看活动项目中的 DSH、`.agents`、`.github`（Copilot）及其他 Agent 目录，并按来源、状态搜索。
 - **切换启停**：只改变 DSH 中的调用策略，不改动来源技能文件。
 - **查看技能内容**：阅读正文、来源信息、格式诊断和重名提示。
 - **添加自己的技能**：在设置页创建用户级或项目级技能，或导入 ZIP、技能文件夹及 `SKILL.md`。
-- **找回误删的技能**：DSH 技能删除后先进入回收站，可恢复到原位置。
+- **找回误删的技能**：回收站与全局／项目技能同级显示为独立 Tab，带待处理数量，可直接恢复或确认永久删除。
 
 ## 界面预览
 
-在「设置 → 技能」中按来源管理 DSH 与其他本机 Agent 的技能，启停不会改动来源技能文件：
+在「设置 → 技能」中切换全局技能、项目技能和回收站；启停不会改动来源技能文件：
 
-![按来源管理技能的设置页面](assets/screenshots/skills-manager-v2-preview.png)
+![技能管理与独立回收站 Tab](assets/screenshots/skills-manager-v2-preview.png)
 
 打开任意技能可查看来源路径、诊断结果、Markdown 正文与解析后的 frontmatter：
 
@@ -63,7 +63,7 @@ DSH 本地技能移入回收站前需要确认；永久删除前仍可恢复：
 
 - 已可正常运行 DeepSeek Harness Web，且可在 PowerShell 中使用 `dsh`。
 - 以下示例使用 `web` profile；请替换为实际目标 profile。
-- `0.1.48` 已验证兼容 DeepSeek Harness `0.1.0-rc.8`、`0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.5-rc.1`、`0.1.5-rc.2`；开发依赖固定使用 `0.1.5-rc.2`，不自动声明支持其他版本。
+- `0.1.49` 已验证兼容 DeepSeek Harness `0.1.0-rc.8`、`0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.5-rc.1`、`0.1.5-rc.2`；开发依赖固定使用 `0.1.5-rc.2`，不自动声明支持其他版本。
 - 从源码安装或二次开发需要 Node.js `^22.19.0 || >=24.0.0`；仅从 npm 安装无需在任意目录执行 `npm install`。
 
 ## 安装
@@ -103,10 +103,10 @@ dsh --profile web --dump-config
 
 | 目标 | 操作 | 范围 |
 | --- | --- | --- |
-| 搜索或筛选 | 按来源、名称或简介收窄列表。 | 全部来源 |
+| 搜索或筛选 | 先选择全局或项目作用域，再按来源、调用状态、名称或简介收窄列表。 | 当前作用域 |
 | 查看详情与诊断 | 查看正文、frontmatter、源文件路径、格式问题和重名遮蔽。 | 全部来源 |
 | 启用或停用 | 只更新 manager 本地调用策略，不修改来源 Skill 文件。 | 全部用户级来源与活动项目来源中的有效 Skill |
-| 创建或导入 | 在设置页创建时选择用户 DSH 或活动项目 DSH；导入仍为用户级。 | `$DSH_HOME\skills`，创建可选活动 `<project>/.dsh/skills` |
+| 创建或导入 | 设置页创建和导入均固定保存到全局 DSH。 | `$DSH_HOME\skills` |
 | 从对话创建 | 让 Agent 调用 `create_skill`；写入前由 DSH 审批界面确认。 | `$DSH_HOME\skills` |
 | 删除与恢复 | 删除先进入回收站；可恢复到原来源或永久二次删除。 | 用户级与活动项目级 DSH Skill |
 
@@ -122,20 +122,22 @@ dsh --profile web --dump-config
 | `$DSH_AGENTS_HOME\skills` | 支持 | 仅写 manager 状态 | 不支持 | 不支持 |
 | `~\.cc-switch\skills` | 支持，默认开启 | 仅写 manager 状态 | 不支持 | 不支持 |
 | `%USERPROFILE%\.cursor\skills`（或 `$DSH_CURSOR_HOME\skills`） | 支持 | 仅写 manager 状态 | 不支持 | 不支持 |
-| `~/.codex/skills`、`~/.claude/skills`、`~/.gemini/skills`、`~/.config/opencode/skills` | 支持 | 仅写 manager 状态 | 不支持 | 不支持 |
-| `<project>/.dsh/skills` | 支持活动 Session 工作区 | 仅写 manager 状态 | 设置页支持创建 | 进入回收站并恢复到原项目 |
-| `<project>/.agents/skills` | 支持活动 Session 工作区 | 仅写 manager 状态 | 不支持 | 不支持 |
+| `~/.codex/skills`、`~/.claude/skills`、`~/.gemini/skills`、`~/.config/opencode/skills`、`~/.copilot/skills`、`~/.codeium/windsurf/skills`、`~/.windsurf/skills`、`~/.trae/skills`、`~/.trae-cn/skills`、`~/.openclaw/skills`、`~/.clawdbot/skills`、`~/.roo/skills`、`~/.codebuddy/skills` | 支持 | 仅写 manager 状态 | 不支持 | 不支持 |
+| `<project>/.dsh/skills` | 支持活动 Session 工作区 | 仅写 manager 状态 | 设置页不提供项目创建 | 进入回收站并恢复到原项目 |
+| `<project>/.agents/skills`、`<project>/.github/skills`、`<project>/.codex/skills`、`<project>/.claude/skills`、`<project>/.gemini/skills`、`<project>/.opencode/skills`、`<project>/.cursor/skills`、`<project>/.windsurf/skills`、`<project>/.trae/skills`、`<project>/.trae-cn/skills`、`<project>/skills`、`<project>/.roo/skills`、`<project>/.codebuddy/skills` | 支持活动 Session 工作区 | 仅写 manager 状态 | 不支持 | 不支持 |
 
 - 启用、停用和删除只接受单个普通技能名称，目录穿越名称会被拒绝。
-- 项目根只从活动 Session 的 `cwd` 推导；客户端只提交不透明来源 key，不能指定任意工作区路径。
-- 项目来源遵循 DSH 最近 `.git` 项目根和固定优先级（`project-dsh` 100、`project-agents` 200）。管理器每次读取状态或详情时重新扫描；显式项目策略通过 workspace 作用域 rank 99/199 覆盖候选执行，用户 DSH 策略使用 rank 399；没有覆盖时仍由 DSH 官方 provider 负责。启停只写 manager 状态，项目文件写入仅发生在用户明确执行 `.dsh/skills` 创建、回收或恢复时。
+- 根目录 `<project>/skills` 显示为“项目 Skills”，可兼容 OpenClaw workspace 技能，但不据此判断所属 Agent；现有启停策略保持兼容。
+- 项目页只跟随当前会话，不提供项目选择框。请求通过 `x-dsh-skills-session` 携带当前会话 ID，后端只从该会话的 `cwd` 推导项目根；缺失或失效时不回退到其他会话，客户端不能指定任意工作区路径。
+- 启停仅影响所选来源的副本。管理器在未被停用的副本中按优先级选择：停用项目副本后可使用其他已启用项目副本或全局副本；停用全局副本不影响项目副本。全部副本停用时才阻断该技能；停用行会标明当前接管的全局或项目来源，frontmatter 自带的调用限制仍然生效。
+- 项目来源遵循 DSH 最近 `.git` 项目根和固定优先级（`project-dsh` 100、`project-agents` 200，其余项目来源 210–320，之后为全局 DSH 400、公共 Agent 450、其他全局来源 500–640）。管理器每次读取状态或详情时重新扫描；显式项目策略通过 workspace 作用域 rank 覆盖候选执行，用户 DSH 策略使用 rank 399；没有覆盖时仍由 DSH 官方 provider 负责。启停只写 manager 状态，项目文件写入仅发生在用户明确执行 `.dsh/skills` 创建、回收或恢复时。
 - 当项目与 `$DSH_HOME` 位于不同磁盘时，回收站会降级为“复制后在源盘原子隐藏”；恢复使用反向的同一安全流程。
-- 项目回收站条目保存原始不透明来源身份。仅当原项目仍由活动 Session 工作区提供时才允许恢复；客户端不能指定替代路径。
+- 项目回收站条目保存原始不透明来源身份。仅当原项目与当前会话的项目一致时才允许恢复；客户端不能指定替代路径。
 - 项目写入会拒绝链接形式的 `.dsh` 或 `.dsh/skills` 目录，避免仓库把创建、删除或恢复重定向到项目根之外。
 - 用户级只读来源与项目 Agent 来源默认递归发现 `SKILL.md`，允许技能目录、技能根及其父目录通过软链接或 Windows junction 指向外部目录，无需开关或目录白名单；按真实路径去重，启停只写 manager 状态。忽略 `SKILL.md` 文件链接，限制扫描深度和数量并终止循环；可写 DSH 与导入、删除仍保留原有边界。
 - 普通技能目录发现 `SKILL.md` 后作为 bundle 叶子，不再扫描内部资源，并跳过 `node_modules`；扫描根自身的 `SKILL.md` 仍可与嵌套技能并存。项目 Agent 根与用户技能根真实路径重叠时隐藏，避免绕过用户停用策略。
 - 列表和摘要统一使用“已启用/已停用”，不再使用“已加载”：这里描述的是调用策略，完整 Skill 正文仍由 DSH 按需加载。IDE、Git 或 shell 改动后可点击“刷新”；项目 catalog 的 watcher 与 invalidation 仍由官方 provider 负责。
-- 没有 Skill 的项目根不会出现在主来源列表中，但仍保留在“创建技能”的目标选择中，确保可以创建第一个项目 Skill。项目 DSH 只提供逐 Skill 启停，不提供整个项目来源总开关。
+- 不存在的只读项目来源不会出现在列表中；空的项目 DSH 保留来源展示；界面的创建和导入始终写入全局 DSH。项目 DSH 只提供逐 Skill 启停，不提供整个项目来源总开关。
 - 覆盖前先复制到同目录临时路径；复制成功前不会改动现有技能。
 - 全部接口（含 GET `/state`）只接受 loopback `Host`，或 DSH Web runtime 已通过 LAN 绑定和 `--trusted-host` 明确信任的 `host[:port]`；未知 Host 继续返回 403。
 - 浏览器请求还必须满足同源 `Origin` 且不能标记为 cross-site；写入接口继续要求 JSON 与 DSH 客户端请求标记。