@xopcai/xopc 0.0.224 → 0.0.227

package/dist/src/gateway/hono/routes/mcp.js

@@ -2,21 +2,31 @@ import { canonicalizeConfiguredMcpServer, normalizeConfiguredMcpServers } from "
 import { loadMergedBundleMcpConfig } from "../../../agent/mcp/bundle-mcp-config.js";
 import { isManagedConnectorServer } from "../../../connectors/materialize.js";
 import { getWorkspacePath } from "../../../config/workspace-path-helpers.js";
+import { getMcpOAuthManager } from "../../../agent/mcp/oauth/mcp-oauth-manager.js";
 import { listBundleMcpServerCapabilitiesForGateway, listBundleMcpServerToolsForGateway } from "../../../agent/mcp/bundle-mcp-gateway.js";
 //#region src/gateway/hono/routes/mcp.ts
 function registerMcpRoutes(authenticated, deps) {
-	authenticated.get("/api/mcp/servers", (c) => {
+	const resolveServer = (id) => {
+		const cfg = deps.service.currentConfig;
+		return loadMergedBundleMcpConfig({
+			workspaceDir: getWorkspacePath(cfg) || "./workspace",
+			cfg
+		}).config.mcpServers[id];
+	};
+	authenticated.get("/api/mcp/servers", async (c) => {
 		const cfg = deps.service.currentConfig;
 		const merged = loadMergedBundleMcpConfig({
 			workspaceDir: getWorkspacePath(cfg) || "./workspace",
 			cfg
 		});
 		const configured = normalizeConfiguredMcpServers(cfg.mcp?.servers);
-		const servers = Object.entries(configured).map(([id, server]) => ({
+		const oauthManager = getMcpOAuthManager();
+		const servers = await Promise.all(Object.entries(configured).map(async ([id, server]) => ({
 			id,
 			managed: isManagedConnectorServer(server),
-			connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0
-		}));
+			connectorId: isManagedConnectorServer(server) ? server.xopcConnector.connectorId : void 0,
+			oauth: await oauthManager.status(id, server)
+		})));
 		return c.json({
 			ok: true,
 			payload: {
@@ -26,6 +36,62 @@ function registerMcpRoutes(authenticated, deps) {
 			}
 		});
 	});
+	authenticated.get("/api/mcp/servers/:id/oauth", async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		return c.json({
+			ok: true,
+			payload: await getMcpOAuthManager().status(id, server)
+		});
+	});
+	authenticated.post("/api/mcp/servers/:id/oauth/start", deps.strictRateLimitMiddleware, async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		try {
+			const payload = await getMcpOAuthManager().start({
+				serverId: id,
+				rawServer: server,
+				cfg: deps.service.currentConfig
+			});
+			return c.json({
+				ok: true,
+				payload
+			});
+		} catch (err) {
+			return c.json({
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			}, 400);
+		}
+	});
+	authenticated.delete("/api/mcp/servers/:id/oauth", deps.strictRateLimitMiddleware, async (c) => {
+		const id = c.req.param("id");
+		const server = resolveServer(id);
+		if (!server) return c.json({
+			ok: false,
+			error: `Unknown MCP server: ${id}`
+		}, 404);
+		try {
+			const payload = await getMcpOAuthManager().disconnect(id, server);
+			return c.json({
+				ok: true,
+				payload
+			});
+		} catch (err) {
+			return c.json({
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			}, 400);
+		}
+	});
 	authenticated.get("/api/mcp/servers/:id/tools", async (c) => {
 		const id = c.req.param("id");
 		const cfg = deps.service.currentConfig;
@@ -79,11 +145,17 @@ function registerMcpRoutes(authenticated, deps) {
 			workspaceDir,
 			cfg
 		}).config.mcpServers;
-		if (!(inlineServer ?? servers[id] ?? mergedServers[id])) return c.json({
+		const knownServer = inlineServer ?? servers[id] ?? mergedServers[id];
+		if (!knownServer) return c.json({
 			ok: false,
 			error: `Unknown MCP server: ${id}`
 		}, 404);
 		try {
+			const oauth = await getMcpOAuthManager().status(id, knownServer);
+			if (oauth.configured && oauth.status !== "connected") return c.json({
+				ok: false,
+				error: oauth.session?.error ?? "MCP server authorization is required"
+			}, 409);
 			const capabilities = await listBundleMcpServerCapabilitiesForGateway({
 				workspaceDir,
 				cfg: inlineServer ? {

package/dist/src/gateway/hono/routes/project-skills.js

@@ -5,6 +5,8 @@ function projectSkills(deps) {
 	return new ProjectSkillService({
 		projects: deps.service.projects,
 		getConfig: () => deps.service.currentConfig,
+		getWorkspaceTrust: (workspaceRoot) => deps.service.agentService.getWorkspaceTrust(workspaceRoot),
+		setWorkspaceTrust: (workspaceRoot, trusted) => deps.service.agentService.setWorkspaceTrust(workspaceRoot, trusted),
 		refreshSkills: () => deps.service.agentService.refreshSkillsAfterDiskChange()
 	});
 }
@@ -31,11 +33,37 @@ function registerProjectSkillRoutes(authenticated, deps) {
 			return errorResponse(c, error);
 		}
 	});
-	authenticated.get("/api/projects/:projectId/skills/:skillId", (c) => {
+	authenticated.get("/api/projects/:projectId/workspace-trust", (c) => {
 		try {
 			return c.json({
 				ok: true,
-				skill: projectSkills(deps).getContent(c.req.param("projectId"), c.req.param("skillId"))
+				trust: projectSkills(deps).getWorkspaceTrust(c.req.param("projectId"))
+			});
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
+	authenticated.patch("/api/projects/:projectId/workspace-trust", async (c) => {
+		try {
+			const body = await c.req.json();
+			if (typeof body.trusted !== "boolean") return c.json({
+				ok: false,
+				error: "Expected { trusted: boolean }"
+			}, 400);
+			const trust = projectSkills(deps).setWorkspaceTrust(c.req.param("projectId"), body.trusted);
+			return c.json({
+				ok: true,
+				trust
+			});
+		} catch (error) {
+			return errorResponse(c, error);
+		}
+	});
+	authenticated.get("/api/projects/:projectId/skills/:skillKey", (c) => {
+		try {
+			return c.json({
+				ok: true,
+				skill: projectSkills(deps).getContent(c.req.param("projectId"), c.req.param("skillKey"))
 			});
 		} catch (error) {
 			return errorResponse(c, error);

package/dist/src/gateway/hono/routes/you.js

@@ -7,6 +7,8 @@ import { listUserFocuses, updateUserFocus } from "../../../user-context/sources/
 import { canonicalUnderstandingKey, findDuplicateUnderstanding } from "../../../user-context/understanding.js";
 import { listContextObjects } from "../../../user-context/context-objects.js";
 import { repairExtractedContext } from "../../../user-context/extraction/repair.js";
+import { getUserRelationship, listUserRelationships, mergeUserRelationships, patchUserRelationship } from "../../../user-context/relationships/service.js";
+import { USER_PERSON_KINDS } from "../../../user-context/relationships/types.js";
 import { userInfo } from "node:os";
 //#region src/gateway/hono/routes/you.ts
 const UNDERSTANDING_KIND_SET = new Set(UNDERSTANDING_KINDS);
@@ -42,6 +44,7 @@ const CONTEXT_OBJECT_VIEWS = new Set([
 	"review",
 	"history"
 ]);
+const USER_PERSON_KIND_SET = new Set(USER_PERSON_KINDS);
 function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
@@ -99,6 +102,55 @@ function registerYouRoutes(authenticated, deps) {
 		rules: listCollaborationRules(),
 		consolidation: { lastRun: listContextConsolidationRuns(1)[0] ?? null }
 	}));
+	authenticated.get("/api/you/relationships", (c) => {
+		const kind = c.req.query("kind");
+		if (kind && !USER_PERSON_KIND_SET.has(kind)) return c.json({ error: "Invalid relationship kind" }, 400);
+		const requestedLimit = Number(c.req.query("limit") ?? "30");
+		if (!Number.isInteger(requestedLimit) || requestedLimit < 1 || requestedLimit > 100) return c.json({ error: "limit must be an integer from 1 to 100" }, 400);
+		const cursor = c.req.query("cursor");
+		if (cursor && !/^\d+$/.test(cursor)) return c.json({ error: "Invalid cursor" }, 400);
+		return c.json(listUserRelationships({
+			query: c.req.query("q") ?? "",
+			...kind ? { kind } : {},
+			...c.req.query("source") ? { sourceInstanceId: c.req.query("source") } : {},
+			includeHidden: c.req.query("includeHidden") === "true",
+			hiddenOnly: c.req.query("hidden") === "true",
+			...cursor ? { cursor } : {},
+			limit: requestedLimit
+		}));
+	});
+	authenticated.get("/api/you/relationships/:id", (c) => {
+		const person = getUserRelationship(c.req.param("id"));
+		return person ? c.json({ person }) : c.json({ error: "Relationship not found" }, 404);
+	});
+	authenticated.patch("/api/you/relationships/:id", write, async (c) => {
+		const body = await readBody(c);
+		if (!body) return c.json({ error: "Invalid JSON" }, 400);
+		const patch = {};
+		if (body.displayName !== void 0) {
+			if (body.displayName !== null && (typeof body.displayName !== "string" || body.displayName.trim().length > 160)) return c.json({ error: "displayName must be null or a string of at most 160 characters" }, 400);
+			patch.displayName = typeof body.displayName === "string" && body.displayName.trim() ? body.displayName.trim() : null;
+		}
+		if (body.kind !== void 0) {
+			if (body.kind !== null && !USER_PERSON_KIND_SET.has(body.kind)) return c.json({ error: "Invalid relationship kind" }, 400);
+			patch.kind = body.kind;
+		}
+		if (body.hidden !== void 0) {
+			if (typeof body.hidden !== "boolean") return c.json({ error: "hidden must be a boolean" }, 400);
+			patch.hidden = body.hidden;
+		}
+		if (!Object.keys(patch).length) return c.json({ error: "No relationship fields provided" }, 400);
+		const person = patchUserRelationship(c.req.param("id"), patch);
+		return person ? c.json({ person }) : c.json({ error: "Relationship not found" }, 404);
+	});
+	authenticated.post("/api/you/relationships/merge", write, async (c) => {
+		const body = await readBody(c);
+		const sourcePersonId = nonEmptyString(body?.sourcePersonId, 200);
+		const targetPersonId = nonEmptyString(body?.targetPersonId, 200);
+		if (!sourcePersonId || !targetPersonId || sourcePersonId === targetPersonId) return c.json({ error: "Distinct sourcePersonId and targetPersonId are required" }, 400);
+		const person = mergeUserRelationships(sourcePersonId, targetPersonId);
+		return person ? c.json({ person }) : c.json({ error: "Relationship not found" }, 404);
+	});
 	authenticated.get("/api/you/context-objects", (c) => {
 		const view = c.req.query("view") ?? "current";
 		if (!CONTEXT_OBJECT_VIEWS.has(view)) return c.json({ error: "Invalid context object view" }, 400);

package/dist/src/gateway/service.js

@@ -45,11 +45,17 @@ import { MessageBus, MessageBusShutdownError } from "../infra/bus/queue.js";
 import "../infra/bus/index.js";
 import { AgentService } from "../agent/service.js";
 import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
-import "../config/index.js";
 import { setPairingBroadcastSink } from "../channels/pairing/pairing-events.js";
 import { registerClarifyBridge } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
+import "../config/index.js";
+import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
+import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
+import "../knowledge/index.js";
+import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
+import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
+import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { DiscussionService } from "../discussions/service.js";
 import { DiscussionOrganizer } from "../discussions/organizer.js";
 import { DiscussionLiveWorker } from "../discussions/live-worker.js";
@@ -58,12 +64,6 @@ import { DiscussionSealer } from "../discussions/sealer.js";
 import "../discussions/index.js";
 import { EndpointToolRuntime } from "../endpoint-tools/runtime.js";
 import "../endpoint-tools/index.js";
-import { ManagedComposioEventPoller } from "../connectors/composio-managed-events.js";
-import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
-import "../knowledge/index.js";
-import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
-import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
-import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { assertGatewayAuthConfigured, extractToken, resolveGatewayAuth, validateToken } from "./auth.js";
 import { prepareAutomationAgentSession } from "./automation-agent-session.js";
 import { reconcileDreamingAutomations } from "./dreaming-automation-reconciler.js";

package/dist/src/knowledge/connected-knowledge-pipeline.js

@@ -87,7 +87,14 @@ var ConnectedKnowledgePipeline = class {
 					expiresAt: existing.expiresAt,
 					canonicalKey: existing.canonicalKey,
 					supersedesRecordId: existing.supersedesRecordId,
-					conflictGroupId: existing.conflictGroupId
+					conflictGroupId: existing.conflictGroupId,
+					originClass: existing.provenance.originClass,
+					sessionKind: existing.provenance.sessionKind,
+					observedAt: existing.provenance.observedAt,
+					sourceSessionId: existing.provenance.sourceSessionId,
+					sourceTurnId: existing.provenance.sourceTurnId,
+					supersedesKey: existing.provenance.supersedesKey,
+					derivedFromRecalledContext: existing.provenance.derivedFromRecalledContext
 				});
 				completeKnowledgeSourceItemSynthesis({
 					itemId: item.id,
@@ -141,7 +148,11 @@ var ConnectedKnowledgePipeline = class {
 					confidence: .78,
 					observedAt: item.occurredAt ?? item.sourceUpdatedAt
 				}],
-				validFrom: item.occurredAt ?? item.sourceUpdatedAt
+				validFrom: item.occurredAt ?? item.sourceUpdatedAt,
+				originClass: "untrusted",
+				sessionKind: "background",
+				observedAt: item.occurredAt ?? item.sourceUpdatedAt ?? item.updatedAt,
+				derivedFromRecalledContext: false
 			});
 			attachMemoryEvidence({
 				recordId: record.id,
@@ -238,7 +249,14 @@ var ConnectedKnowledgePipeline = class {
 				validTo: (/* @__PURE__ */ new Date()).toISOString(),
 				reviewAfter: existing.reviewAfter,
 				expiresAt: existing.expiresAt,
-				canonicalKey: existing.canonicalKey
+				canonicalKey: existing.canonicalKey,
+				originClass: existing.provenance.originClass,
+				sessionKind: existing.provenance.sessionKind,
+				observedAt: existing.provenance.observedAt,
+				sourceSessionId: existing.provenance.sourceSessionId,
+				sourceTurnId: existing.provenance.sourceTurnId,
+				supersedesKey: existing.provenance.supersedesKey,
+				derivedFromRecalledContext: existing.provenance.derivedFromRecalledContext
 			});
 			return false;
 		}
@@ -282,7 +300,11 @@ var ConnectedKnowledgePipeline = class {
 				confidence: .72,
 				observedAt: item.occurredAt ?? item.sourceUpdatedAt
 			})),
-			validFrom: `${day}T00:00:00.000Z`
+			validFrom: `${day}T00:00:00.000Z`,
+			originClass: "untrusted",
+			sessionKind: "background",
+			observedAt: items.map((item) => item.occurredAt ?? item.sourceUpdatedAt ?? item.updatedAt).sort().at(-1),
+			derivedFromRecalledContext: false
 		});
 		deleteMemoryEvidenceForRecord(summary.id, "derived_from");
 		for (const item of items) attachMemoryEvidence({

package/dist/src/knowledge/connected-understanding-pipeline.js

@@ -1,6 +1,7 @@
 import { listKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import "../storage/sqlite/index.js";
 import { clusterUnderstandingSignals } from "../user-context/sources/signal-clustering.js";
+import { personIdForIdentity, personIdentityKey, rebuildUserPeopleIndex } from "../user-context/relationships/indexer.js";
 //#region src/knowledge/connected-understanding-pipeline.ts
 function logicalEventKey(item) {
 	const value = item.metadata.logicalEventKey;
@@ -96,9 +97,12 @@ function relationshipObservations(items) {
 			const strongIdentity = (signal.email ?? signal.username)?.toLowerCase();
 			if (strongIdentity && owners.has(strongIdentity)) continue;
 			const label = signal.name ?? signal.email ?? signal.username;
-			const identityKey = signal.email?.toLowerCase() ?? `${String(item.metadata.toolkit ?? item.sourceInstanceId)}:${signal.username?.toLowerCase() ?? signal.name?.toLowerCase()}`;
+			const identityKey = personIdentityKey(signal, item.sourceInstanceId);
+			const personId = personIdForIdentity(signal, item.sourceInstanceId);
+			if (!identityKey || !personId) continue;
 			const entry = grouped.get(identityKey) ?? {
 				label,
+				personId,
 				events: /* @__PURE__ */ new Map()
 			};
 			const eventKey = logicalEventKey(item);
@@ -108,8 +112,11 @@ function relationshipObservations(items) {
 	}
 	return [...grouped.values()].sort((left, right) => right.events.size - left.events.size).slice(0, 8).map((entry) => ({
 		class: "relationship",
-		key: `person:${entry.label.toLocaleLowerCase()}`,
-		value: { label: entry.label },
+		key: `person:${entry.personId}`,
+		value: {
+			label: entry.label,
+			personId: entry.personId
+		},
 		items: [...entry.events.values()],
 		windowDays: 90
 	}));
@@ -182,6 +189,7 @@ function renderConnectedObservation(observation) {
 		kind: "relationship",
 		content: `Frequently collaborates with ${label}.`,
 		canonicalKey: `connected:${observation.key}`,
+		payload: typeof observation.value.personId === "string" ? { personId: observation.value.personId } : void 0,
 		confidence,
 		importance: .65,
 		explicitness: "inferred",
@@ -227,6 +235,7 @@ var ConnectedUnderstandingPipeline = class {
 		this.memoryManager = memoryManager;
 	}
 	async process(agentId, extractionRunId) {
+		rebuildUserPeopleIndex();
 		const observations = deriveConnectedClaimObservations(listKnowledgeSourceItems({
 			agentId,
 			includeDeleted: false,

package/dist/src/knowledge/index.d.ts

@@ -4,4 +4,3 @@ export * from './connected-knowledge-pipeline.js';
 export * from './connected-understanding-pipeline.js';
 export * from './coordinator.js';
 export * from './local-folder-adapter.js';
-export * from './people-graph.js';

package/dist/src/knowledge/index.js

@@ -3,5 +3,4 @@ import { ConnectedKnowledgePipeline } from "./connected-knowledge-pipeline.js";
 import { ConnectedUnderstandingPipeline, deriveConnectedClaimObservations, renderConnectedObservation } from "./connected-understanding-pipeline.js";
 import { startConnectedKnowledgeCoordinator } from "./coordinator.js";
 import { LocalFolderKnowledgeSourceAdapter } from "./local-folder-adapter.js";
-import { buildConnectedPeopleGraph } from "./people-graph.js";
-export { ConnectedKnowledgePipeline, ConnectedUnderstandingPipeline, KnowledgeIngestionService, LocalFolderKnowledgeSourceAdapter, SqliteKnowledgeSourceStateStore, buildConnectedPeopleGraph, deriveConnectedClaimObservations, renderConnectedObservation, startConnectedKnowledgeCoordinator };
+export { ConnectedKnowledgePipeline, ConnectedUnderstandingPipeline, KnowledgeIngestionService, LocalFolderKnowledgeSourceAdapter, SqliteKnowledgeSourceStateStore, deriveConnectedClaimObservations, renderConnectedObservation, startConnectedKnowledgeCoordinator };

package/dist/src/projects/project-skill-service.d.ts

@@ -1,5 +1,6 @@
 import type { Config } from '../config/schema.js';
-import type { SkillDiagnostic, SkillMetadata, SkillToolConditions } from '../agent/skills/types.js';
+import { type WorkspaceSkillSourceStatus } from '../agent/skills/index.js';
+import type { Skill, SkillDiagnostic, SkillMetadata, SkillToolConditions } from '../agent/skills/types.js';
 import type { ProjectService } from './project-service.js';
 export type ProjectSkillErrorCode = 'project_not_found' | 'project_workspace_required' | 'project_workspace_missing' | 'project_workspace_not_writable' | 'skill_not_found' | 'invalid_skill_id';
 export declare class ProjectSkillError extends Error {
@@ -8,33 +9,53 @@ export declare class ProjectSkillError extends Error {
     constructor(code: ProjectSkillErrorCode, status: 400 | 403 | 404 | 409, message: string);
 }
 export interface ProjectSkillSummary {
-    id: string;
+    key: string;
+    directoryId: string;
     name: string;
     description: string;
     category?: string;
+    origin: Skill['origin']['id'];
+    path: string;
+    managed: boolean;
+    writable: boolean;
+    removable: boolean;
+    effective: boolean;
+    shadowedBy?: Skill['origin']['id'];
     disableModelInvocation: boolean;
     metadata: SkillMetadata;
     toolConditions?: SkillToolConditions;
     requiredEnvVarNames?: string[];
 }
+export interface ProjectWorkspaceTrustState {
+    workspacePath: string;
+    required: boolean;
+    decision: boolean | null;
+    trusted: boolean;
+}
 export interface ProjectSkillListResult {
     workspaceRoot: string;
-    skillsRoot: string;
+    sources: WorkspaceSkillSourceStatus[];
+    trust: ProjectWorkspaceTrustState;
     items: ProjectSkillSummary[];
+    inheritedItems: ProjectSkillSummary[];
     diagnostics: SkillDiagnostic[];
 }
 interface ProjectSkillServiceOptions {
     projects: ProjectService;
     getConfig: () => Config;
+    getWorkspaceTrust: (workspaceRoot: string) => ProjectWorkspaceTrustState;
+    setWorkspaceTrust: (workspaceRoot: string, trusted: boolean) => ProjectWorkspaceTrustState;
     refreshSkills: () => void | Promise<void>;
 }
 export declare class ProjectSkillService {
     private readonly options;
     constructor(options: ProjectSkillServiceOptions);
     list(projectId: string): ProjectSkillListResult;
-    getContent(projectId: string, skillId: string): ProjectSkillSummary & {
+    getContent(projectId: string, skillKey: string): ProjectSkillSummary & {
         bodyMarkdown: string;
     };
+    getWorkspaceTrust(projectId: string): ProjectWorkspaceTrustState;
+    setWorkspaceTrust(projectId: string, trusted: boolean): ProjectWorkspaceTrustState;
     installZip(projectId: string, buffer: Buffer, input?: {
         skillId?: string;
         overwrite?: boolean;
@@ -59,9 +80,10 @@ export declare class ProjectSkillService {
         bodyMarkdown: string;
     }>;
     remove(projectId: string, skillId: string): Promise<void>;
-    private findSkill;
     private resolveLocation;
-    private isDirectSkill;
+    private loadCatalog;
+    private skillKey;
+    private encodeSkillKey;
     private toSummary;
 }
 export {};

package/dist/src/projects/project-skill-service.js

@@ -1,5 +1,6 @@
+import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
 import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "../agent/skills/workspace-skills-dir.js";
-import { loadWorkspaceSkills } from "../agent/skills/index.js";
+import { loadSkills, loadWorkspaceSkillInventory } from "../agent/skills/index.js";
 import { removeSkillsLockEntry } from "../agent/skills/hub-lock.js";
 import { deleteManagedSkill, installSkillFromZip, isValidSkillId } from "../agent/skills/managed-store.js";
 import { pullSkillFromSource } from "../agent/skills/hub-pull.js";
@@ -7,6 +8,7 @@ import { downloadFromMarketplace } from "../agent/skills/skills-marketplace.js";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { accessSync, constants, existsSync, statSync } from "node:fs";
 //#region src/projects/project-skill-service.ts
+init_paths();
 var ProjectSkillError = class extends Error {
 	constructor(code, status, message) {
 		super(message);
@@ -20,21 +22,44 @@ var ProjectSkillService = class {
 		this.options = options;
 	}
 	list(projectId) {
-		const location = this.resolveLocation(projectId, false);
-		const loaded = loadWorkspaceSkills(location.workspaceRoot);
+		const { location, loaded, inherited, trust } = this.loadCatalog(projectId);
 		return {
-			...location,
-			items: loaded.skills.filter((skill) => this.isDirectSkill(skill, location.skillsRoot)).map((skill) => this.toSummary(skill)),
-			diagnostics: loaded.diagnostics
+			workspaceRoot: location.workspaceRoot,
+			sources: loaded.sources,
+			trust,
+			items: loaded.entries.map((entry) => this.toSummary(entry)),
+			inheritedItems: inherited.skills.map((skill) => this.toSummary({
+				skill,
+				effective: true
+			})),
+			diagnostics: inherited.diagnostics
 		};
 	}
-	getContent(projectId, skillId) {
-		const { skill } = this.findSkill(projectId, skillId);
+	getContent(projectId, skillKey) {
+		const { loaded, inherited } = this.loadCatalog(projectId);
+		const entry = loaded.entries.find((candidate) => this.skillKey(candidate.skill) === skillKey);
+		if (entry) return {
+			...this.toSummary(entry),
+			bodyMarkdown: entry.skill.content
+		};
+		const inheritedSkill = inherited.skills.find((candidate) => this.skillKey(candidate) === skillKey);
+		if (!inheritedSkill) throw new ProjectSkillError("skill_not_found", 404, "Project skill not found");
 		return {
-			...this.toSummary(skill),
-			bodyMarkdown: skill.content
+			...this.toSummary({
+				skill: inheritedSkill,
+				effective: true
+			}),
+			bodyMarkdown: inheritedSkill.content
 		};
 	}
+	getWorkspaceTrust(projectId) {
+		const location = this.resolveLocation(projectId, false);
+		return this.options.getWorkspaceTrust(location.workspaceRoot);
+	}
+	setWorkspaceTrust(projectId, trusted) {
+		const location = this.resolveLocation(projectId, false);
+		return this.options.setWorkspaceTrust(location.workspaceRoot, trusted);
+	}
 	async installZip(projectId, buffer, input = {}) {
 		const location = this.resolveLocation(projectId, true);
 		const installed = installSkillFromZip(buffer, {
@@ -44,7 +69,7 @@ var ProjectSkillService = class {
 		});
 		removeSkillsLockEntry(installed.skillId, resolveWorkspaceSkillsLockPath(location.workspaceRoot));
 		await this.options.refreshSkills();
-		return this.getContent(projectId, installed.skillId);
+		return this.getContent(projectId, this.encodeSkillKey("xopc-workspace", installed.skillId));
 	}
 	async installMarketplace(projectId, input) {
 		const downloaded = await downloadFromMarketplace(this.options.getConfig(), input.name, input.version, input.provider);
@@ -64,7 +89,7 @@ var ProjectSkillService = class {
 			lockPath: resolveWorkspaceSkillsLockPath(location.workspaceRoot)
 		});
 		await this.options.refreshSkills();
-		return this.getContent(projectId, installed.skillId);
+		return this.getContent(projectId, this.encodeSkillKey("xopc-workspace", installed.skillId));
 	}
 	async remove(projectId, skillId) {
 		const location = this.resolveLocation(projectId, true);
@@ -74,18 +99,6 @@ var ProjectSkillService = class {
 		removeSkillsLockEntry(skillId, resolveWorkspaceSkillsLockPath(location.workspaceRoot));
 		await this.options.refreshSkills();
 	}
-	findSkill(projectId, skillId) {
-		if (!isValidSkillId(skillId)) throw new ProjectSkillError("invalid_skill_id", 400, "Invalid skill id");
-		const location = this.resolveLocation(projectId, false);
-		const skill = loadWorkspaceSkills(location.workspaceRoot).skills.find((item) => {
-			return !relative(location.skillsRoot, item.baseDir).includes(sep) && basename(item.baseDir) === skillId;
-		});
-		if (!skill) throw new ProjectSkillError("skill_not_found", 404, "Project skill not found");
-		return {
-			skill,
-			skillsRoot: location.skillsRoot
-		};
-	}
 	resolveLocation(projectId, requireWritable) {
 		const project = this.options.projects.get(projectId);
 		if (!project) throw new ProjectSkillError("project_not_found", 404, "Project not found");
@@ -110,16 +123,50 @@ var ProjectSkillService = class {
 			skillsRoot
 		};
 	}
-	isDirectSkill(skill, skillsRoot) {
-		const rel = relative(skillsRoot, skill.baseDir);
-		return Boolean(rel) && !rel.includes(sep) && isValidSkillId(basename(skill.baseDir));
+	loadCatalog(projectId) {
+		const location = this.resolveLocation(projectId, false);
+		const trust = this.options.getWorkspaceTrust(location.workspaceRoot);
+		const loaded = loadWorkspaceSkillInventory(location.workspaceRoot, { workspaceTrust: trust.trusted ? "trusted" : "untrusted" });
+		const all = loadSkills({
+			workspaceDir: location.workspaceRoot,
+			builtinDir: resolveBundledSkillsDir(),
+			workspaceTrust: trust.trusted ? "trusted" : "untrusted"
+		});
+		return {
+			location,
+			loaded,
+			inherited: {
+				skills: all.skills.filter((skill) => skill.origin.scope !== "workspace"),
+				diagnostics: all.diagnostics
+			},
+			trust
+		};
+	}
+	skillKey(skill) {
+		const rel = relative(skill.origin.rootDir, skill.baseDir).split(sep).join("/");
+		return this.encodeSkillKey(skill.origin.id, rel);
+	}
+	encodeSkillKey(origin, relativeDir) {
+		return Buffer.from(`${origin}\0${relativeDir}`, "utf8").toString("base64url");
 	}
-	toSummary(skill) {
+	toSummary(entry) {
+		const { skill } = entry;
+		const id = basename(skill.baseDir);
+		const relativeDir = relative(skill.origin.rootDir, skill.baseDir);
+		const removable = skill.origin.id === "xopc-workspace" && !relativeDir.includes(sep) && isValidSkillId(id);
 		return {
-			id: basename(skill.baseDir),
+			key: this.skillKey(skill),
+			directoryId: id,
 			name: skill.name,
 			description: skill.description,
 			category: skill.category,
+			origin: skill.origin.id,
+			path: skill.baseDir,
+			managed: skill.origin.managed,
+			writable: skill.origin.writable,
+			removable,
+			effective: entry.effective,
+			shadowedBy: entry.shadowedBy,
 			disableModelInvocation: skill.disableModelInvocation,
 			metadata: skill.metadata,
 			toolConditions: skill.toolConditions,