codemini-cli 0.5.7 → 0.5.9

package/codemini-web/server.js

@@ -9,23 +9,107 @@ import { createChatRuntime } from '../src/core/chat-runtime.js';
 import { createSession, loadSession, listSessions, resolveSession, deleteSession } from '../src/core/session-store.js';
 import { buildDefaultSystemPrompt } from '../src/core/default-system-prompt.js';
 import { RuntimeBridge } from './lib/runtime-bridge.js';
-import { listSkillEntries } from '../src/commands/skill.js';
-import { readSkillRegistry, writeSkillRegistry, upsertSkillRegistryEntry } from '../src/core/skill-registry.js';
-import { getReplyLanguage } from '../src/core/reply-language.js';
-import { getSkillsDir, getBaseConfigDir } from '../src/core/paths.js';
-import { VERSION } from '../src/core/version.js';
+import { listSkillEntries } from '../src/commands/skill.js';
+import { readSkillRegistry, writeSkillRegistry } from '../src/core/skill-registry.js';
+import { getReplyLanguage } from '../src/core/reply-language.js';
+import { getBaseConfigDir, getProjectSkillsDir } from '../src/core/paths.js';
+import { VERSION } from '../src/core/version.js';
 
 const GENERAL_PROJECT_DIR = (() => {
   const base = getBaseConfigDir();
   return path.join(base, 'workspace');
 })();
 
-function isGeneralProjectDir(value) {
-  if (!value) return false;
-  return path.resolve(value) === path.resolve(GENERAL_PROJECT_DIR);
+const SKILL_CATALOG_FILE = 'codemini.skills.json';
+const SKILL_MODES = new Set(['always', 'auto_attach', 'agent_requested', 'manual']);
+
+function normalizeSkillMetadataPatch(input = {}) {
+  const out = {};
+  if (typeof input.description === 'string') out.description = input.description.trim();
+  if (typeof input.mode === 'string' && SKILL_MODES.has(input.mode)) out.mode = input.mode;
+  if (input.enabled !== undefined) out.enabled = input.enabled !== false;
+  if (input.priority !== undefined) {
+    const priority = Number(input.priority);
+    if (Number.isFinite(priority)) out.priority = Math.max(0, Math.min(100, Math.round(priority)));
+  }
+  if (Array.isArray(input.triggers)) {
+    out.triggers = input.triggers.map((item) => String(item || '').trim()).filter(Boolean);
+  } else if (typeof input.triggers === 'string') {
+    out.triggers = input.triggers.split(',').map((item) => item.trim()).filter(Boolean);
+  }
+  return out;
+}
+
+async function readProjectSkillCatalog(projectDir) {
+  const catalogPath = path.join(getProjectSkillsDir(projectDir), SKILL_CATALOG_FILE);
+  try {
+    const parsed = JSON.parse(await fs.readFile(catalogPath, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : { version: 1, skills: {} };
+  } catch {
+    return { version: 1, skills: {} };
+  }
 }
 
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
+async function writeProjectSkillCatalog(projectDir, catalog) {
+  const catalogPath = path.join(getProjectSkillsDir(projectDir), SKILL_CATALOG_FILE);
+  await fs.mkdir(path.dirname(catalogPath), { recursive: true });
+  const next = {
+    version: 1,
+    skills: catalog?.skills && typeof catalog.skills === 'object' ? catalog.skills : {}
+  };
+  await fs.writeFile(catalogPath, `${JSON.stringify(next, null, 2)}\n`, 'utf8');
+}
+
+async function upsertProjectSkillMetadata(projectDir, name, patch) {
+  const catalog = await readProjectSkillCatalog(projectDir);
+  catalog.skills = catalog.skills || {};
+  const prior = catalog.skills[name] && typeof catalog.skills[name] === 'object' ? catalog.skills[name] : {};
+  catalog.skills[name] = { ...prior, ...normalizeSkillMetadataPatch(patch) };
+  await writeProjectSkillCatalog(projectDir, catalog);
+  return catalog.skills[name];
+}
+
+async function listProjectRoots() {
+  if (process.platform === 'win32') {
+    const letters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'.split('');
+    const roots = [];
+    await Promise.all(letters.map(async (letter) => {
+      const drivePath = `${letter}:\\`;
+      try {
+        await fs.access(drivePath);
+        roots.push({ name: `${letter}:`, path: drivePath, isGit: false, isDrive: true });
+      } catch {}
+    }));
+    return roots.sort((a, b) => a.name.localeCompare(b.name));
+  }
+
+  const candidates = [
+    { name: '/', path: path.resolve('/') },
+    { name: 'Home', path: process.env.HOME || process.env.USERPROFILE || '' },
+    { name: 'Current', path: process.cwd() },
+  ];
+  const seen = new Set();
+  const roots = [];
+  for (const candidate of candidates) {
+    if (!candidate.path) continue;
+    const resolved = path.resolve(candidate.path);
+    if (seen.has(resolved)) continue;
+    try {
+      const stat = await fs.stat(resolved);
+      if (!stat.isDirectory()) continue;
+      seen.add(resolved);
+      roots.push({ name: candidate.name, path: resolved, isGit: false, isDrive: false });
+    } catch {}
+  }
+  return roots;
+}
+
+function isGeneralProjectDir(value) {
+  if (!value) return false;
+  return path.resolve(value) === path.resolve(GENERAL_PROJECT_DIR);
+}
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const CLIENT_SOURCE_DIR = path.join(__dirname, 'client');
 let CLIENT_DIR = CLIENT_SOURCE_DIR;
 try {
@@ -34,33 +118,33 @@ try {
   if (stat.isDirectory()) CLIENT_DIR = distDir;
 } catch {}
 
-const MIME_TYPES = {
+const MIME_TYPES = {
   '.html': 'text/html; charset=utf-8',
   '.css': 'text/css; charset=utf-8',
   '.js': 'text/javascript; charset=utf-8',
   '.json': 'application/json',
   '.svg': 'image/svg+xml',
   '.png': 'image/png',
-  '.ico': 'image/x-icon'
-};
-
-const DEFAULT_GATEWAY_BASE_URL = 'http://127.0.0.1:8000/v1';
-
-function normalizeBaseUrl(value) {
-  return String(value || '').trim().replace(/\/+$/, '');
-}
-
-function getConfigStatus(config) {
-  const baseUrl = normalizeBaseUrl(config?.gateway?.base_url);
-  const apiKey = String(config?.gateway?.api_key || '').trim();
-  const setupRequired = !baseUrl || (baseUrl === DEFAULT_GATEWAY_BASE_URL && !apiKey);
-  return {
-    setupRequired,
-    baseUrl,
-    hasApiKey: !!apiKey,
-    reason: setupRequired ? 'gateway_not_configured' : ''
-  };
-}
+  '.ico': 'image/x-icon'
+};
+
+const DEFAULT_GATEWAY_BASE_URL = 'http://127.0.0.1:8000/v1';
+
+function normalizeBaseUrl(value) {
+  return String(value || '').trim().replace(/\/+$/, '');
+}
+
+function getConfigStatus(config) {
+  const baseUrl = normalizeBaseUrl(config?.gateway?.base_url);
+  const apiKey = String(config?.gateway?.api_key || '').trim();
+  const setupRequired = !baseUrl || (baseUrl === DEFAULT_GATEWAY_BASE_URL && !apiKey);
+  return {
+    setupRequired,
+    baseUrl,
+    hasApiKey: !!apiKey,
+    reason: setupRequired ? 'gateway_not_configured' : ''
+  };
+}
 
 function parseArgs(argv) {
   const parsed = { port: 3210, session: undefined, model: undefined, project: undefined, open: true };
@@ -170,10 +254,14 @@ function collectSessionPathHints(session) {
   return hints;
 }
 
-async function existingDirectoryForHint(rawHint) {
-  let candidate = normalizeProjectPath(rawHint);
-  if (!candidate) return '';
-  candidate = candidate.replace(/[),\].。；;:]+$/g, '');
+async function existingDirectoryForHint(rawHint) {
+  let candidate = normalizeProjectPath(rawHint);
+  if (!candidate) return '';
+  const configRoot = path.resolve(getBaseConfigDir());
+  const candidateLower = path.resolve(candidate).toLowerCase();
+  const configRootLower = configRoot.toLowerCase();
+  if (candidateLower === configRootLower || candidateLower.startsWith(`${configRootLower}${path.sep}`)) return '';
+  candidate = candidate.replace(/[),\].。；;:]+$/g, '');
   for (let i = 0; i < 8 && candidate && candidate !== path.dirname(candidate); i += 1) {
     try {
       const stat = await fs.stat(candidate);
@@ -260,7 +348,7 @@ async function buildRuntimeForSession({ sessionId, model, projectDir }) {
     model: model || config.model?.name,
     systemPrompt
   });
-  return { runtime, config, session, cwd: process.cwd(), isGeneral: isGeneralProjectDir(process.cwd()) };
+  return { runtime, config, session, cwd: process.cwd(), isGeneral: isGeneralProjectDir(process.cwd()) };
 }
 
 async function main() {
@@ -317,25 +405,25 @@ async function main() {
       return;
     }
 
-    // ── Submit / Abort / Approval ──
-    if (req.method === 'POST' && url.pathname === '/api/submit') {
-      const { line, readOnlyCodeWiki } = await readBody(req);
-      if (!line || typeof line !== 'string') { jsonResponse(res, { error: true, message: 'Missing "line" field' }, 400); return; }
-      const currentConfig = await loadConfig();
-      const configStatus = getConfigStatus(currentConfig);
-      if (configStatus.setupRequired) {
-        jsonResponse(res, {
-          error: true,
-          code: 'CONFIG_REQUIRED',
-          message: 'Gateway is not configured. Open Settings and set the API Base URL and API Key.',
-          configStatus
-        }, 409);
-        return;
-      }
-      const result = bridge.handleSubmit(line, { readOnlyCodeWiki: readOnlyCodeWiki === true });
-      jsonResponse(res, result);
-      return;
-    }
+    // ── Submit / Abort / Approval ──
+    if (req.method === 'POST' && url.pathname === '/api/submit') {
+      const { line, readOnlyCodeWiki } = await readBody(req);
+      if (!line || typeof line !== 'string') { jsonResponse(res, { error: true, message: 'Missing "line" field' }, 400); return; }
+      const currentConfig = await loadConfig();
+      const configStatus = getConfigStatus(currentConfig);
+      if (configStatus.setupRequired) {
+        jsonResponse(res, {
+          error: true,
+          code: 'CONFIG_REQUIRED',
+          message: 'Gateway is not configured. Open Settings and set the API Base URL and API Key.',
+          configStatus
+        }, 409);
+        return;
+      }
+      const result = bridge.handleSubmit(line, { readOnlyCodeWiki: readOnlyCodeWiki === true });
+      jsonResponse(res, result);
+      return;
+    }
     if (req.method === 'POST' && url.pathname === '/api/abort') {
       bridge.handleAbort();
       jsonResponse(res, { ok: true });
@@ -367,7 +455,7 @@ async function main() {
       try {
         latest = execSync('npm view codemini-cli version', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
       } catch {}
-      jsonResponse(res, { current: VERSION, latest });
+      jsonResponse(res, { current: VERSION, latest });
       return;
     }
     if (req.method === 'POST' && url.pathname === '/api/update') {
@@ -382,7 +470,7 @@ async function main() {
 
     // ── Runtime state ──
     if (req.method === 'GET' && url.pathname === '/api/state') {
-      jsonResponse(res, { ...bridge.getState(), cwd: currentProjectDir, isGeneral: isGeneralProjectDir(currentProjectDir) });
+      jsonResponse(res, { ...bridge.getState(), cwd: currentProjectDir, isGeneral: isGeneralProjectDir(currentProjectDir) });
       return;
     }
     if (req.method === 'GET' && url.pathname === '/api/completions') {
@@ -488,25 +576,25 @@ async function main() {
       return;
     }
 
-    if (req.method === 'POST' && url.pathname === '/api/codewiki/ask') {
-      const { question, reportFile } = await readBody(req);
-      if (!question || typeof question !== 'string') {
-        jsonResponse(res, { error: true, message: 'Missing "question" field' }, 400);
-        return;
-      }
-      const currentConfig = await loadConfig();
-      const configStatus = getConfigStatus(currentConfig);
-      if (configStatus.setupRequired) {
-        jsonResponse(res, {
-          error: true,
-          code: 'CONFIG_REQUIRED',
-          message: 'Gateway is not configured. Open Settings and set the API Base URL and API Key.',
-          configStatus
-        }, 409);
-        return;
-      }
-      const selectedReport = isCodeWikiReportFile(reportFile) ? reportFile : '';
-      if (bridge.isBusy()) {
+    if (req.method === 'POST' && url.pathname === '/api/codewiki/ask') {
+      const { question, reportFile } = await readBody(req);
+      if (!question || typeof question !== 'string') {
+        jsonResponse(res, { error: true, message: 'Missing "question" field' }, 400);
+        return;
+      }
+      const currentConfig = await loadConfig();
+      const configStatus = getConfigStatus(currentConfig);
+      if (configStatus.setupRequired) {
+        jsonResponse(res, {
+          error: true,
+          code: 'CONFIG_REQUIRED',
+          message: 'Gateway is not configured. Open Settings and set the API Base URL and API Key.',
+          configStatus
+        }, 409);
+        return;
+      }
+      const selectedReport = isCodeWikiReportFile(reportFile) ? reportFile : '';
+      if (bridge.isBusy()) {
         jsonResponse(res, { error: true, message: 'Runtime is busy' }, 409);
         return;
       }
@@ -538,7 +626,7 @@ async function main() {
     // ── Session management ──
     if (req.method === 'GET' && url.pathname === '/api/sessions') {
       const sessions = await listSessions(1000);
-      const enriched = sessions.map(s => ({ ...s, isGeneral: isGeneralProjectDir(s.projectDir) }));
+      const enriched = sessions.map(s => ({ ...s, isGeneral: isGeneralProjectDir(s.projectDir) }));
       jsonResponse(res, enriched);
       return;
     }
@@ -551,7 +639,7 @@ async function main() {
             reused: true,
             sessionId: bridge.getSessionId(),
             cwd: currentProjectDir,
-            isGeneral: isGeneralProjectDir(currentProjectDir)
+            isGeneral: isGeneralProjectDir(currentProjectDir)
           });
           return;
         }
@@ -561,7 +649,7 @@ async function main() {
         });
         await bridge.switchRuntime(newRuntime);
         currentProjectDir = process.cwd();
-        jsonResponse(res, { ok: true, sessionId: session.id, cwd: currentProjectDir, isGeneral: isGeneralProjectDir(currentProjectDir) });
+        jsonResponse(res, { ok: true, sessionId: session.id, cwd: currentProjectDir, isGeneral: isGeneralProjectDir(currentProjectDir) });
       } catch (err) {
         jsonResponse(res, { error: true, message: err.message }, 500);
       }
@@ -577,7 +665,7 @@ async function main() {
         });
         await bridge.switchRuntime(newRuntime);
         currentProjectDir = process.cwd();
-        jsonResponse(res, { ok: true, sessionId, cwd: currentProjectDir, isGeneral: isGeneralProjectDir(currentProjectDir) });
+        jsonResponse(res, { ok: true, sessionId, cwd: currentProjectDir, isGeneral: isGeneralProjectDir(currentProjectDir) });
       } catch (err) {
         jsonResponse(res, { error: true, message: err.message }, 500);
       }
@@ -607,7 +695,7 @@ async function main() {
           nextSessionId = built.session.id;
           cwd = currentProjectDir;
         }
-        jsonResponse(res, { ok: true, removed: result.removed, sessionId: nextSessionId, cwd, isGeneral: isGeneralProjectDir(currentProjectDir) });
+        jsonResponse(res, { ok: true, removed: result.removed, sessionId: nextSessionId, cwd, isGeneral: isGeneralProjectDir(currentProjectDir) });
       } catch (err) {
         jsonResponse(res, { error: true, message: err.message }, 500);
       }
@@ -616,7 +704,7 @@ async function main() {
 
     // ── Project management ──
     if (req.method === 'GET' && url.pathname === '/api/project') {
-      jsonResponse(res, { cwd: currentProjectDir, isGeneral: isGeneralProjectDir(currentProjectDir) });
+      jsonResponse(res, { cwd: currentProjectDir, isGeneral: isGeneralProjectDir(currentProjectDir) });
       return;
     }
     if (req.method === 'GET' && url.pathname === '/api/git') {
@@ -691,43 +779,48 @@ async function main() {
       jsonResponse(res, result);
       return;
     }
-    if (req.method === 'POST' && url.pathname === '/api/project/open') {
-      const { path: projectPath } = await readBody(req);
-      if (!projectPath) { jsonResponse(res, { error: true, message: 'Missing path' }, 400); return; }
-      try {
-        // Client marker for general workspace
-        const openingGeneral = projectPath === '__codemini_general__';
-        const resolved = openingGeneral ? GENERAL_PROJECT_DIR : path.resolve(projectPath);
-        const stat = await fs.stat(resolved);
-        if (!stat.isDirectory()) throw new Error('Not a directory');
-        let built;
-        if (openingGeneral) {
-          const all = await listSessions(1000, { includeEmpty: true });
-          const reusable = all.find((session) =>
-            isGeneralProjectDir(session.projectDir) &&
-            Number(session.messageCount || 0) === 0
-          );
-          built = reusable
-            ? await buildRuntimeForSession({ sessionId: reusable.id, model: bridge.getState().model })
-            : await buildRuntimeForSession({ model: bridge.getState().model, projectDir: GENERAL_PROJECT_DIR });
-        } else {
-          process.chdir(resolved);
-          currentProjectDir = process.cwd();
-          built = await buildRuntimeForSession({
-            model: bridge.getState().model
-          });
-        }
-        const { runtime: newRuntime, session } = built;
-        await bridge.switchRuntime(newRuntime);
-        currentProjectDir = process.cwd();
-        jsonResponse(res, { ok: true, cwd: currentProjectDir, sessionId: session.id, isGeneral: isGeneralProjectDir(currentProjectDir) });
-      } catch (err) {
-        jsonResponse(res, { error: true, message: err.message }, 400);
-      }
+    if (req.method === 'POST' && url.pathname === '/api/project/open') {
+      const { path: projectPath } = await readBody(req);
+      if (!projectPath) { jsonResponse(res, { error: true, message: 'Missing path' }, 400); return; }
+      try {
+        // Client marker for general workspace
+        const openingGeneral = projectPath === '__codemini_general__';
+        const resolved = openingGeneral ? GENERAL_PROJECT_DIR : path.resolve(projectPath);
+        const stat = await fs.stat(resolved);
+        if (!stat.isDirectory()) throw new Error('Not a directory');
+        let built;
+        if (openingGeneral) {
+          const all = await listSessions(1000, { includeEmpty: true });
+          const reusable = all.find((session) =>
+            isGeneralProjectDir(session.projectDir) &&
+            Number(session.messageCount || 0) === 0
+          );
+          built = reusable
+            ? await buildRuntimeForSession({ sessionId: reusable.id, model: bridge.getState().model })
+            : await buildRuntimeForSession({ model: bridge.getState().model, projectDir: GENERAL_PROJECT_DIR });
+        } else {
+          process.chdir(resolved);
+          currentProjectDir = process.cwd();
+          built = await buildRuntimeForSession({
+            model: bridge.getState().model
+          });
+        }
+        const { runtime: newRuntime, session } = built;
+        await bridge.switchRuntime(newRuntime);
+        currentProjectDir = process.cwd();
+        jsonResponse(res, { ok: true, cwd: currentProjectDir, sessionId: session.id, isGeneral: isGeneralProjectDir(currentProjectDir) });
+      } catch (err) {
+        jsonResponse(res, { error: true, message: err.message }, 400);
+      }
       return;
     }
     if (req.method === 'POST' && url.pathname === '/api/project/browse') {
       const { dir } = await readBody(req);
+      const roots = await listProjectRoots();
+      if (!dir && roots.length) {
+        jsonResponse(res, { path: '', roots, dirs: [] });
+        return;
+      }
       const base = dir ? path.resolve(dir) : path.resolve('/');
       try {
         const entries = await fs.readdir(base, { withFileTypes: true });
@@ -743,36 +836,38 @@ async function main() {
         await Promise.all(dirs.map(async (d) => {
           try { await fs.access(path.join(d.path, '.git')); d.isGit = true; } catch {}
         }));
-        jsonResponse(res, { path: base, dirs });
+        jsonResponse(res, { path: base, roots, dirs });
       } catch (err) {
-        jsonResponse(res, { path: base, dirs: [], error: err.message });
+        jsonResponse(res, { path: base, roots, dirs: [], error: err.message });
       }
       return;
     }
 
-    // ── Config management ──
-    if (req.method === 'GET' && url.pathname === '/api/config/status') {
-      const config = await loadConfig();
-      jsonResponse(res, getConfigStatus(config));
-      return;
-    }
-    if (req.method === 'GET' && url.pathname === '/api/config') {
-      const config = await loadConfig();
-      jsonResponse(res, config);
-      return;
-    }
+    // ── Config management ──
+    if (req.method === 'GET' && url.pathname === '/api/config/status') {
+      const config = await loadConfig();
+      jsonResponse(res, getConfigStatus(config));
+      return;
+    }
+    if (req.method === 'GET' && url.pathname === '/api/config') {
+      const config = await loadConfig();
+      jsonResponse(res, config);
+      return;
+    }
     if (req.method === 'POST' && url.pathname === '/api/config/set') {
       const { key, value } = await readBody(req);
       if (!key) { jsonResponse(res, { error: true, message: 'Missing key' }, 400); return; }
-      try {
-        await setConfigValue(key, value);
-        const config = await loadConfig();
-        await bridge.reloadConfig();
+      try {
+        await setConfigValue(key, value);
+        const config = await loadConfig();
+        await bridge.reloadConfig(
+          key === 'model.name' ? { model: config.model?.name } : {}
+        );
         bridge.broadcastRuntimeState();
-        jsonResponse(res, { ok: true, config });
-      } catch (err) {
-        jsonResponse(res, { error: true, message: err.message }, 500);
-      }
+        jsonResponse(res, { ok: true, config });
+      } catch (err) {
+        jsonResponse(res, { error: true, message: err.message }, 500);
+      }
       return;
     }
     if (req.method === 'GET' && url.pathname.startsWith('/api/config/get/')) {
@@ -783,53 +878,54 @@ async function main() {
     }
 
     // ── Skills management ──
-    if (req.method === 'GET' && url.pathname === '/api/skills') {
-      try {
-        const skills = await listSkillEntries({ scope: 'all' });
-        jsonResponse(res, skills);
-      } catch (err) { jsonResponse(res, { error: true, message: err.message }, 500); }
-      return;
+    if (req.method === 'GET' && url.pathname === '/api/skills') {
+      try {
+        const skills = await listSkillEntries({ scope: 'all', cwd: currentProjectDir });
+        jsonResponse(res, skills);
+      } catch (err) { jsonResponse(res, { error: true, message: err.message }, 500); }
+      return;
     }
     if (req.method === 'GET' && url.pathname.startsWith('/api/skills/') && url.pathname.endsWith('/content')) {
-      const name = decodeURIComponent(url.pathname.slice('/api/skills/'.length, -'/content'.length));
-      try {
-        const entries = await listSkillEntries({ scope: 'all' });
-        const skill = entries.find(s => s.name === name);
-        if (!skill) { jsonResponse(res, { error: true, message: 'Skill not found' }, 404); return; }
-        const content = await fs.readFile(skill.path, 'utf8');
+      const name = decodeURIComponent(url.pathname.slice('/api/skills/'.length, -'/content'.length));
+      try {
+        const entries = await listSkillEntries({ scope: 'all', cwd: currentProjectDir });
+        const skill = entries.find(s => s.name === name);
+        if (!skill) { jsonResponse(res, { error: true, message: 'Skill not found' }, 404); return; }
+        const content = await fs.readFile(skill.path, 'utf8');
         jsonResponse(res, { name: skill.name, content, scope: skill.scope });
       } catch (err) { jsonResponse(res, { error: true, message: err.message }, 500); }
       return;
     }
-    if (req.method === 'POST' && url.pathname === '/api/skills/create') {
-      const { name, description, content } = await readBody(req);
-      if (!name || !content) { jsonResponse(res, { error: true, message: 'Missing name or content' }, 400); return; }
-      try {
-        const skillDir = path.join(getSkillsDir(), name);
-        await fs.mkdir(skillDir, { recursive: true });
-        const skillFile = path.join(skillDir, 'SKILL.md');
-        await fs.writeFile(skillFile, content, 'utf8');
-        const { createHash } = await import('node:crypto');
-        const hash = createHash('sha256').update(content).digest('hex');
-        await upsertSkillRegistryEntry(undefined, {
-          name, version: '0.1.0', description: description || '', enabled: true,
-          source: 'web-ui', entryFile: 'SKILL.md', sha256: hash, installedAt: new Date().toISOString()
-        });
-        const config = await loadConfig();
-        config.skills = config.skills || {};
-        config.skills.enabled = config.skills.enabled || {};
+    if (req.method === 'POST' && url.pathname === '/api/skills/create') {
+      const { name, description, content } = await readBody(req);
+      if (!name || !content) { jsonResponse(res, { error: true, message: 'Missing name or content' }, 400); return; }
+      try {
+        const skillDir = path.join(getProjectSkillsDir(currentProjectDir), name);
+        await fs.mkdir(skillDir, { recursive: true });
+        const skillFile = path.join(skillDir, 'SKILL.md');
+        await fs.writeFile(skillFile, content, 'utf8');
+        await upsertProjectSkillMetadata(currentProjectDir, name, {
+          description: description || '',
+          mode: 'agent_requested',
+          triggers: [],
+          enabled: true,
+          priority: 50
+        });
+        const config = await loadConfig();
+        config.skills = config.skills || {};
+        config.skills.enabled = config.skills.enabled || {};
         config.skills.enabled[name] = true;
         await saveConfig(config);
         jsonResponse(res, { ok: true, name });
       } catch (err) { jsonResponse(res, { error: true, message: err.message }, 500); }
       return;
     }
-    if (req.method === 'PUT' && url.pathname.startsWith('/api/skills/') && url.pathname.endsWith('/content')) {
-      const name = decodeURIComponent(url.pathname.slice('/api/skills/'.length, -'/content'.length));
-      const { content } = await readBody(req);
-      if (!content) { jsonResponse(res, { error: true, message: 'Missing content' }, 400); return; }
-      try {
-        const entries = await listSkillEntries({ scope: 'all' });
+    if (req.method === 'PUT' && url.pathname.startsWith('/api/skills/') && url.pathname.endsWith('/content')) {
+      const name = decodeURIComponent(url.pathname.slice('/api/skills/'.length, -'/content'.length));
+      const { content } = await readBody(req);
+      if (!content) { jsonResponse(res, { error: true, message: 'Missing content' }, 400); return; }
+      try {
+        const entries = await listSkillEntries({ scope: 'all', cwd: currentProjectDir });
         const skill = entries.find(s => s.name === name);
         if (!skill) { jsonResponse(res, { error: true, message: 'Skill not found' }, 404); return; }
         if (skill.scope === 'builtin') { jsonResponse(res, { error: true, message: 'Cannot edit builtin skill' }, 403); return; }
@@ -847,25 +943,56 @@ async function main() {
         if (skill.scope === 'builtin') { jsonResponse(res, { error: true, message: 'Cannot delete builtin skill' }, 403); return; }
         const dir = path.dirname(skill.path);
         await fs.rm(dir, { recursive: true, force: true });
-        const registry = await readSkillRegistry();
-        registry.skills = (registry.skills || []).filter(s => s.name !== name);
-        await writeSkillRegistry(undefined, registry);
-        const config = await loadConfig();
-        if (config.skills?.enabled) delete config.skills.enabled[name];
-        await saveConfig(config);
+        const registry = await readSkillRegistry();
+        registry.skills = (registry.skills || []).filter(s => s.name !== name);
+        await writeSkillRegistry(undefined, registry);
+        const catalog = await readProjectSkillCatalog(currentProjectDir);
+        if (catalog.skills?.[name]) {
+          delete catalog.skills[name];
+          await writeProjectSkillCatalog(currentProjectDir, catalog);
+        }
+        const config = await loadConfig();
+        if (config.skills?.enabled) delete config.skills.enabled[name];
+        await saveConfig(config);
         jsonResponse(res, { ok: true });
       } catch (err) { jsonResponse(res, { error: true, message: err.message }, 500); }
-      return;
-    }
-    if (req.method === 'POST' && url.pathname.startsWith('/api/skills/') && url.pathname.endsWith('/toggle')) {
-      const name = decodeURIComponent(url.pathname.slice('/api/skills/'.length, -'/toggle'.length));
-      const { enabled } = await readBody(req);
-      try {
-        const entries = await listSkillEntries({ scope: 'all' });
-        const skill = entries.find(s => s.name === name);
-        if (!skill) { jsonResponse(res, { error: true, message: 'Skill not found' }, 404); return; }
-        if (skill.scope === 'builtin') { jsonResponse(res, { error: true, message: 'Cannot toggle builtin skill' }, 403); return; }
-        const config = await loadConfig();
+      return;
+    }
+    if (req.method === 'PUT' && url.pathname.startsWith('/api/skills/') && url.pathname.endsWith('/metadata')) {
+      const name = decodeURIComponent(url.pathname.slice('/api/skills/'.length, -'/metadata'.length));
+      const body = await readBody(req);
+      try {
+        const entries = await listSkillEntries({ scope: 'all', cwd: currentProjectDir });
+        const skill = entries.find(s => s.name === name);
+        if (!skill) { jsonResponse(res, { error: true, message: 'Skill not found' }, 404); return; }
+        const metadata = await upsertProjectSkillMetadata(currentProjectDir, name, body || {});
+        if (skill.scope !== 'builtin' && body?.enabled !== undefined) {
+          const config = await loadConfig();
+          config.skills = config.skills || {};
+          config.skills.enabled = config.skills.enabled || {};
+          config.skills.enabled[name] = body.enabled !== false;
+          await saveConfig(config);
+          const registry = await readSkillRegistry();
+          const idx = registry.skills.findIndex(s => s.name === name);
+          if (idx !== -1) { registry.skills[idx].enabled = body.enabled !== false; await writeSkillRegistry(undefined, registry); }
+        }
+        jsonResponse(res, { ok: true, name, metadata });
+      } catch (err) { jsonResponse(res, { error: true, message: err.message }, 500); }
+      return;
+    }
+    if (req.method === 'POST' && url.pathname.startsWith('/api/skills/') && url.pathname.endsWith('/toggle')) {
+      const name = decodeURIComponent(url.pathname.slice('/api/skills/'.length, -'/toggle'.length));
+      const { enabled } = await readBody(req);
+      try {
+        const entries = await listSkillEntries({ scope: 'all', cwd: currentProjectDir });
+        const skill = entries.find(s => s.name === name);
+        if (!skill) { jsonResponse(res, { error: true, message: 'Skill not found' }, 404); return; }
+        if (skill.scope === 'builtin') {
+          const metadata = await upsertProjectSkillMetadata(currentProjectDir, name, { enabled });
+          jsonResponse(res, { ok: true, name, metadata });
+          return;
+        }
+        const config = await loadConfig();
         config.skills = config.skills || {};
         config.skills.enabled = config.skills.enabled || {};
         config.skills.enabled[name] = !!enabled;