dsh-capability-panel 1.0.0 → 1.1.1

package/lib/index.js

@@ -1,3 +1,4 @@
+import { exec } from "node:child_process";
 import z from "@deepseek-ai/schemastery";
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -161,14 +162,14 @@ function createCapabilityController(ctx, appendStats, blockedCounts) {
 		ctx.effect(() => guardDispose, "capability-panel: tool guard");
 	};
 	ensureGuard();
-	ctx.on("tools/result", (exec, result) => {
-		const agent = exec.agent;
+	ctx.on("tools/result", (exec$1, result) => {
+		const agent = exec$1.agent;
 		if (agent === void 0 || typeof agent.id !== "string") return;
 		const state = states.get(agent.id);
 		if (state === void 0) return;
 		const hit = classifyBlockedCall({
-			name: exec.name,
-			arguments: exec.arguments,
+			name: exec$1.name,
+			arguments: exec$1.arguments,
 			agent,
 			...result.isError && result.error !== void 0 ? { error: result.error } : {}
 		}, new Set(state.skills.keys()), disabledToolNames(state));
@@ -225,8 +226,8 @@ function createCapabilityController(ctx, appendStats, blockedCounts) {
 			name: original.name,
 			description: original.description,
 			content: original.content,
-			source: "custom",
-			provider: "capability-panel",
+			source: typeof original.source === "string" ? original.source : "custom",
+			provider: typeof original.provider === "string" ? original.provider : "capability-panel",
 			...original.resourceBase === void 0 ? {} : { resourceBase: original.resourceBase },
 			invocation: {
 				modelInvocable: false,
@@ -336,8 +337,8 @@ function createCapabilityController(ctx, appendStats, blockedCounts) {
 						name: original.name,
 						description: original.description,
 						content: original.content,
-						source: "custom",
-						provider: "capability-panel",
+						source: typeof original.source === "string" ? original.source : "custom",
+						provider: typeof original.provider === "string" ? original.provider : "capability-panel",
 						...original.resourceBase === void 0 ? {} : { resourceBase: original.resourceBase },
 						invocation: {
 							modelInvocable: false,
@@ -359,33 +360,60 @@ function createCapabilityController(ctx, appendStats, blockedCounts) {
 		}
 		if (maskedAny) ensurePromptNote(agent, ensureState());
 	};
+	const mutationQueues = /* @__PURE__ */ new Map();
+	const enqueue = (sessionId, op) => {
+		const next = (mutationQueues.get(sessionId) ?? Promise.resolve()).then(op, op);
+		mutationQueues.set(sessionId, next.then(() => void 0, () => void 0));
+		return next;
+	};
+	const restoreImpl = async (sessionId, overrides) => {
+		const groups = [
+			["skill", overrides.skills],
+			["mcp-server", overrides.mcpServers],
+			["mcp-tool", overrides.mcpTools],
+			["system-tool", overrides.systemTools]
+		];
+		for (const [kind, positions] of groups) for (const [name, enabled] of Object.entries(positions)) {
+			if (states.get(sessionId)?.userToggled.has(`${kind}:${name}`) === true) continue;
+			try {
+				if (kind === "skill") await setSkill(sessionId, name, enabled);
+				else if (kind === "mcp-server") setServer(sessionId, name, enabled);
+				else setTool(sessionId, name, enabled, kind === "system-tool");
+			} catch {}
+		}
+		const st = states.get(sessionId);
+		if (st !== void 0 && st.userToggled.size === 0 && st.skills.size === 0 && st.mcpServers.size === 0 && st.mcpTools.size === 0 && st.systemTools.size === 0) {
+			st.noteDispose?.();
+			delete st.noteDispose;
+			states.delete(sessionId);
+		}
+	};
 	return {
 		states,
 		state: (sessionId) => states.get(sessionId),
-		seed,
-		async restore(sessionId, overrides) {
-			const groups = [
-				["skill", overrides.skills],
-				["mcp-server", overrides.mcpServers],
-				["mcp-tool", overrides.mcpTools],
-				["system-tool", overrides.systemTools]
-			];
-			for (const [kind, positions] of groups) for (const [name, enabled] of Object.entries(positions)) {
-				if (states.get(sessionId)?.userToggled.has(`${kind}:${name}`) === true) continue;
-				try {
-					if (kind === "skill") await setSkill(sessionId, name, enabled);
-					else if (kind === "mcp-server") setServer(sessionId, name, enabled);
-					else setTool(sessionId, name, enabled, kind === "system-tool");
-				} catch {}
-			}
+		seed: (sessionId, defaults) => enqueue(sessionId, () => seed(sessionId, defaults)),
+		restore: (sessionId, overrides) => enqueue(sessionId, () => restoreImpl(sessionId, overrides)),
+		reseed: (sessionId, defaults, overrides) => enqueue(sessionId, async () => {
 			const st = states.get(sessionId);
-			if (st !== void 0 && st.userToggled.size === 0 && st.skills.size === 0 && st.mcpServers.size === 0 && st.mcpTools.size === 0 && st.systemTools.size === 0) {
+			if (st !== void 0) {
+				for (const map of [
+					st.systemTools,
+					st.mcpServers,
+					st.mcpTools,
+					st.skills
+				]) {
+					for (const dispose of map.values()) dispose();
+					map.clear();
+				}
 				st.noteDispose?.();
 				delete st.noteDispose;
+				st.userToggled.clear();
 				states.delete(sessionId);
 			}
-		},
-		async set(sessionId, kind, name, enabled) {
+			if (defaults.tools.length > 0 || defaults.skills.length > 0) await seed(sessionId, defaults);
+			if (overrides !== void 0) await restoreImpl(sessionId, overrides);
+		}),
+		set: (sessionId, kind, name, enabled) => enqueue(sessionId, async () => {
 			stateFor(sessionId).userToggled.add(`${kind}:${name}`);
 			if (kind === "skill") await setSkill(sessionId, name, enabled);
 			else if (kind === "mcp-server") setServer(sessionId, name, enabled);
@@ -396,7 +424,7 @@ function createCapabilityController(ctx, appendStats, blockedCounts) {
 				kind: enabled ? "enable" : "disable",
 				name: `${kind}:${name}`
 			});
-		}
+		})
 	};
 }
 
@@ -449,36 +477,27 @@ function registerPresetEnforcement(ctx, capabilities, presetTools, sessionOverri
 			return;
 		}
 	});
-}
-
-//#endregion
-//#region src/host/settings-scope.ts
-const TOOLKIT_SETTINGS_NAMESPACE = "capability-panel";
-const SessionOverrideSchema = z.object({
-	skills: z.dict(z.boolean()).default({}),
-	mcpServers: z.dict(z.boolean()).default({}),
-	mcpTools: z.dict(z.boolean()).default({}),
-	systemTools: z.dict(z.boolean()).default({})
-});
-const ToolkitSettingsSchema = z.object({
-	presets: z.dict(z.array(z.string())).default({}),
-	presetSkills: z.dict(z.array(z.string())).default({}),
-	sessions: z.dict(SessionOverrideSchema).default({})
-});
-function createToolkitSettingsAccess(ctx) {
-	let scope;
-	let writeQueue = Promise.resolve();
-	return {
-		scope() {
-			if (scope === void 0) scope = ctx.get("settings")?.register(TOOLKIT_SETTINGS_NAMESPACE, ToolkitSettingsSchema, { applies: "live" });
-			return scope;
-		},
-		serialize(work) {
-			const next = writeQueue.then(work, work);
-			writeQueue = next.then(() => void 0, () => void 0);
-			return next;
+	/**
+	* A preset switch lands AFTER creation (the session header records the
+	* composing preset at creation, and the picker's select() recomposes the
+	* blank session later): the first agent/created seeded the ORIGINAL
+	* preset's defaults, so the new preset's defaults must re-seed on top of a
+	* clean slate. Session overrides replay last — the user's own switches in
+	* this session outrank either preset's defaults.
+	*/
+	ctx.on("agent-preset/selected", (sessionId, presetId) => {
+		try {
+			if (typeof sessionId !== "string" || typeof presetId !== "string") return void 0;
+			const defaults = presetTools.defaultsFor(presetId) ?? {
+				tools: [],
+				skills: []
+			};
+			const overrides = sessionOverrides.overridesFor(sessionId);
+			return capabilities.reseed(sessionId, defaults, overrides);
+		} catch {
+			return;
 		}
-	};
+	});
 }
 
 //#endregion
@@ -631,7 +650,7 @@ function decideStates(available, loads, shadowedSeqs, disabledSkills = /* @__PUR
 		if (bucket === void 0) byName.set(record.skillName, [record]);
 		else bucket.push(record);
 	}
-	return available.map(({ name, description, masked }) => {
+	return available.map(({ name, description, masked, source, provider, path, group }) => {
 		const records = byName.get(name) ?? [];
 		let state = "unloaded";
 		if (records.length > 0) {
@@ -644,7 +663,11 @@ function decideStates(available, loads, shadowedSeqs, disabledSkills = /* @__PUR
 			...description === void 0 ? {} : { description },
 			state,
 			enabled: !disabledSkills.has(name) && masked !== true,
-			loadCount: records.length
+			loadCount: records.length,
+			source,
+			provider,
+			...path === void 0 ? {} : { path },
+			...group === void 0 ? {} : { group }
 		};
 	});
 }
@@ -669,6 +692,299 @@ function groupMcpTools(toolNames) {
 	})).sort((a, b) => a.server.localeCompare(b.server));
 }
 
+//#endregion
+//#region src/host/catalog.ts
+/** Coerce a skill summary field to a string, falling back when the runtime shape is wrong. */
+function coerceString(value, fallback) {
+	return typeof value === "string" ? value : fallback;
+}
+/**
+* The source ROOT a skill was discovered under. The skills service reports
+* each skill's own directory as resourceBase (`<root>/<name>`), so the group
+* folder is its parent.
+*/
+function parentDir(path) {
+	const trimmed = path.replace(/[\\/]+$/, "");
+	if (trimmed === "") return "/";
+	const slash = Math.max(trimmed.lastIndexOf("/"), trimmed.lastIndexOf("\\"));
+	return slash > 0 ? trimmed.slice(0, slash) : trimmed;
+}
+/**
+* Abbreviate a host path for display: the session cwd becomes a relative
+* path, the user's home becomes `~`. Everything else stays absolute.
+*/
+function displayPath(path, cwd) {
+	if (cwd !== void 0 && cwd !== "" && path.startsWith(`${cwd}/`)) return path.slice(cwd.length + 1);
+	const home = process.env["HOME"];
+	if (home !== void 0 && home !== "" && path.startsWith(home)) return `~${path.slice(home.length)}`;
+	return path;
+}
+/** The DSH home, matching the runtime's own resolution order. */
+function dshHome() {
+	return process.env["DSH_HOME"] ?? (process.env["HOME"] !== void 0 ? `${process.env["HOME"]}/.dsh` : void 0);
+}
+const EMPTY_STATE = {
+	skills: /* @__PURE__ */ new Map(),
+	mcpServers: /* @__PURE__ */ new Map(),
+	mcpTools: /* @__PURE__ */ new Map(),
+	systemTools: /* @__PURE__ */ new Map(),
+	userToggled: /* @__PURE__ */ new Set()
+};
+async function readAvailable(services, sessionId, degraded, presetDirs = []) {
+	const skills = services.get("skills");
+	if (skills === void 0) {
+		degraded.push("skills service unavailable");
+		return [];
+	}
+	try {
+		const agents = services.get("agents");
+		if (agents === void 0) {
+			degraded.push("agents service unavailable: session skill view cannot be determined");
+			return [];
+		}
+		const agent = agents.get(sessionId);
+		if (agent === void 0) {
+			degraded.push(`session agent "${sessionId}" unavailable: session skill view cannot be determined`);
+			return [];
+		}
+		const cwd = agent.session?.header?.cwd;
+		const list = await skills.list({
+			...cwd === void 0 ? {} : { cwd },
+			scope: agent
+		});
+		const out = [];
+		const seen = /* @__PURE__ */ new Map();
+		const groupFor = (source, rawRoot) => {
+			if (source !== "custom" || rawRoot === "") return void 0;
+			const owner = presetDirs.find((p) => rawRoot === p.path || rawRoot.startsWith(`${p.path}/`));
+			return owner === void 0 ? void 0 : `preset:${owner.key}`;
+		};
+		for (const item of list) {
+			if (typeof item.name !== "string" || item.name === "") continue;
+			const masked = item.invocation?.modelInvocable === false;
+			const source = coerceString(item.source, "unknown");
+			const provider = coerceString(item.provider, "unknown");
+			const base = item.resourceBase;
+			const rawPath = base !== null && typeof base === "object" && base.kind === "directory" ? coerceString(base.path, "") : "";
+			const rawRoot = rawPath === "" ? "" : parentDir(rawPath);
+			const path = rawRoot === "" ? "" : displayPath(rawRoot, cwd);
+			const group = groupFor(source, rawRoot);
+			const existing = seen.get(item.name);
+			if (existing !== void 0) {
+				if (masked) existing.masked = true;
+				if (existing.provider === "capability-panel" && provider !== "capability-panel") {
+					existing.source = source;
+					existing.provider = provider;
+					if (path !== "") existing.path = path;
+					if (group !== void 0) existing.group = group;
+				}
+				continue;
+			}
+			const description = typeof item.description === "string" ? item.description : void 0;
+			const row = {
+				name: item.name,
+				...description === void 0 ? {} : { description },
+				...masked ? { masked: true } : {},
+				source,
+				provider,
+				...path === "" ? {} : { path },
+				...group === void 0 ? {} : { group }
+			};
+			seen.set(item.name, row);
+			out.push(row);
+		}
+		return out;
+	} catch (error) {
+		degraded.push(`skills read failed: ${error instanceof Error ? error.message : String(error)}`);
+		return [];
+	}
+}
+/**
+* Read load facts off the LIVE session's in-memory log — the same object the
+* agent loop itself reads to assemble the next request.
+*
+* This used to go through `sessionQuery.readSession` + `listEvents`, which are
+* built for cross-session/cold reads: each call structuredClones the ENTIRE
+* event log, `readSession` additionally replay-validates it via Session.create,
+* and a write landing between the two parallel reads forced a whole second
+* round. On a long session (60k events / tens of MB) that meant four full-log
+* clones plus two full replays of synchronous CPU work on every panel open —
+* blocking the Node event loop and freezing the GUI served by the same process.
+*
+* The live session needs none of that: `snapshotEvents()` hands back borrowed
+* references (zero-copy), and `surface.nodes` is maintained incrementally as
+* events land, so "what the model sees right now" is an O(1) membership test.
+* Scanning references for the few `skill` tool calls costs microseconds even
+* on the longest log. Both reads happen in one synchronous tick, so the view
+* is always self-consistent — no cross-read race, no retry loop.
+*
+* A session without a live in-memory view (e.g. restored but not yet attached)
+* degrades honestly instead of paying for a cold-log read the panel never
+* asked for.
+*/
+function readLogFacts(services, sessionId, degraded) {
+	const empty = {
+		loads: [],
+		shadowed: /* @__PURE__ */ new Set(),
+		pruned: /* @__PURE__ */ new Set()
+	};
+	try {
+		const session = services.get("agents")?.get(sessionId)?.session;
+		const nodes = session?.surface?.nodes;
+		if (session === void 0 || typeof session.snapshotEvents !== "function" || !Array.isArray(nodes)) {
+			degraded.push("live session view unavailable: load states cannot be determined");
+			return empty;
+		}
+		const events = session.snapshotEvents();
+		if (!Array.isArray(events)) {
+			degraded.push("snapshotEvents() returned an unexpected shape; cannot read skill loads");
+			return empty;
+		}
+		const surfaceSeqs = /* @__PURE__ */ new Set();
+		for (const seq of nodes) if (typeof seq === "number") surfaceSeqs.add(seq);
+		const loads = collectLoadRecords(events);
+		const resultSeqs = indexToolResultSeqs(events);
+		return {
+			loads,
+			shadowed: shadowedLoadSeqs(loads, resultSeqs, surfaceSeqs),
+			pruned: prunedLoadSeqs(loads, resultSeqs, surfaceSeqs, events)
+		};
+	} catch (error) {
+		degraded.push(`event read failed: ${error instanceof Error ? error.message : String(error)}`);
+		return empty;
+	}
+}
+function readMcp(services, degraded, disabledServers, disabledTools, agent, presetName, presetPath) {
+	const tools = services.get("tools");
+	if (tools === void 0) {
+		degraded.push("tools service unavailable");
+		return [];
+	}
+	try {
+		const names = [];
+		const descriptions = /* @__PURE__ */ new Map();
+		const collect = (scope) => {
+			for (const schema of tools.schemas(scope)) {
+				if (typeof schema.name !== "string" || !schema.name.startsWith("mcp__")) continue;
+				if (!names.includes(schema.name)) {
+					names.push(schema.name);
+					if (typeof schema.description === "string" && schema.description !== "") descriptions.set(schema.name, schema.description);
+				}
+			}
+		};
+		collect(void 0);
+		if (agent !== void 0) collect(agent);
+		const globalNames = /* @__PURE__ */ new Set();
+		for (const schema of tools.schemas()) if (typeof schema.name === "string" && schema.name.startsWith("mcp__")) globalNames.add(schema.name);
+		return groupMcpTools(names).map((group) => {
+			const enabled = !disabledServers.has(group.server);
+			const entries = group.tools.map((tool) => {
+				const name = `mcp__${group.server}__${tool}`;
+				const description = descriptions.get(name);
+				return {
+					name,
+					label: tool,
+					...description === void 0 ? {} : { description },
+					enabled: enabled && !disabledTools.has(name)
+				};
+			});
+			const allGlobal = group.tools.every((tool) => globalNames.has(`mcp__${group.server}__${tool}`));
+			const source = allGlobal ? "host" : presetName ?? "preset";
+			const rawPath = allGlobal ? dshHome() : presetPath;
+			return {
+				server: group.server,
+				tools: entries,
+				enabled,
+				source,
+				...rawPath === void 0 ? {} : { path: displayPath(rawPath) }
+			};
+		});
+	} catch (error) {
+		degraded.push(`tool read failed: ${error instanceof Error ? error.message : String(error)}`);
+		return [];
+	}
+}
+function readSystemTools(services, degraded, disabledTools, agent) {
+	const tools = services.get("tools");
+	if (tools === void 0) {
+		if (!degraded.includes("tools service unavailable")) degraded.push("tools service unavailable");
+		return [];
+	}
+	try {
+		let reachable;
+		if (agent !== void 0) {
+			reachable = /* @__PURE__ */ new Set();
+			for (const schema of tools.schemas(agent)) if (typeof schema.name === "string") reachable.add(schema.name);
+		}
+		const byName = /* @__PURE__ */ new Map();
+		const collect = (scope) => {
+			for (const schema of tools.schemas(scope)) {
+				if (typeof schema.name !== "string" || schema.name.startsWith("mcp__") || byName.has(schema.name)) continue;
+				const description = typeof schema.description === "string" && schema.description !== "" ? schema.description : void 0;
+				byName.set(schema.name, {
+					name: schema.name,
+					label: schema.name,
+					...description === void 0 ? {} : { description },
+					enabled: !disabledTools.has(schema.name) && (reachable === void 0 || reachable.has(schema.name)),
+					...schema.name === RESERVED_TOOL ? { reserved: true } : {}
+				});
+			}
+		};
+		collect(void 0);
+		if (agent !== void 0) collect(agent);
+		return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+	} catch (error) {
+		degraded.push(`tool read failed: ${error instanceof Error ? error.message : String(error)}`);
+		return [];
+	}
+}
+async function buildPayload(services, sessionId, capabilityState = EMPTY_STATE, blocked = {}) {
+	const degraded = [];
+	const disabledSkills = new Set(capabilityState.skills.keys());
+	const disabledServers = new Set(capabilityState.mcpServers.keys());
+	const disabledTools = new Set(capabilityState.mcpTools.keys());
+	const disabledSystem = new Set(capabilityState.systemTools.keys());
+	if (sessionId === null) return {
+		sessionId: null,
+		skills: [],
+		mcp: readMcp(services, degraded, disabledServers, disabledTools),
+		systemTools: readSystemTools(services, degraded, disabledSystem),
+		blocked,
+		...degraded.length > 0 ? { degraded } : {}
+	};
+	const agent = services.get("agents")?.get(sessionId);
+	let presetName;
+	let presetPath;
+	let presetDirs = [];
+	if (agent !== void 0) {
+		const presetId = services.get("agentPresets")?.composedPreset(agent.ctx);
+		try {
+			const presets = await services.get("agentPresets")?.list();
+			presetDirs = (presets ?? []).filter((p) => typeof p.path === "string" && p.path !== "").map((p) => ({
+				key: p.name ?? p.id,
+				path: p.path
+			}));
+			if (presetId !== void 0) {
+				const preset = presets?.find((p) => p.id === presetId);
+				presetName = preset?.name ?? presetId;
+				presetPath = preset?.path;
+			}
+		} catch {
+			presetName = presetId;
+		}
+	}
+	const available = await readAvailable(services, sessionId, degraded, presetDirs);
+	const logFacts = readLogFacts(services, sessionId, degraded);
+	return {
+		sessionId,
+		skills: decideStates(available, logFacts.loads, logFacts.shadowed, disabledSkills, logFacts.pruned),
+		mcp: readMcp(services, degraded, disabledServers, disabledTools, agent, presetName, presetPath),
+		systemTools: readSystemTools(services, degraded, disabledSystem, agent),
+		blocked,
+		...degraded.length > 0 ? { degraded } : {}
+	};
+}
+
 //#endregion
 //#region src/host/preset-tools.ts
 function requireService(service, message) {
@@ -694,18 +1010,32 @@ function toolSummaries(tools, scope) {
 * workspace would contribute. A project skill is marked rather than dropped:
 * hiding it would silently shorten the list, while marking it says plainly
 * that a session opened elsewhere will not see the row.
+*
+* Each row also carries the same provenance the session payload reports:
+* the raw runtime source, the discovery root (parent of the skill's own
+* directory, abbreviated for display), and a `preset:<name>` group when the
+* root sits inside a preset's directory.
 */
-async function presetSkillRows(skills, scope, disabled, cwd) {
+async function presetSkillRows(skills, scope, disabled, cwd, presetDirs = []) {
 	const seen = /* @__PURE__ */ new Map();
 	const add = (summaries, project) => {
 		for (const summary of summaries) {
 			if (typeof summary.name !== "string" || summary.name === "" || seen.has(summary.name)) continue;
 			const description = typeof summary.description === "string" ? summary.description : void 0;
+			const source = typeof summary.source === "string" ? summary.source : void 0;
+			const base = summary.resourceBase;
+			const rawPath = base !== null && typeof base === "object" && base.kind === "directory" ? base.path : void 0;
+			const rawRoot = typeof rawPath === "string" && rawPath !== "" ? parentDir(rawPath) : "";
+			const path = rawRoot === "" ? void 0 : displayPath(rawRoot, cwd);
+			const owner = source === "custom" && rawRoot !== "" ? presetDirs.find((p) => rawRoot === p.path || rawRoot.startsWith(`${p.path}/`)) : void 0;
 			seen.set(summary.name, {
 				name: summary.name,
 				...description === void 0 ? {} : { description },
 				enabled: !disabled.has(summary.name),
-				...project ? { project: true } : {}
+				...project ? { project: true } : {},
+				...source === void 0 ? {} : { source },
+				...path === void 0 ? {} : { path },
+				...owner === void 0 ? {} : { group: `preset:${owner.key}` }
 			});
 		}
 	};
@@ -743,25 +1073,28 @@ function createPresetToolController(ctx, access) {
 		const skills = ctx.get("skills");
 		const cwd = process.cwd();
 		const presets = await agentPresets.list();
+		const presetDirs = presets.filter((p) => typeof p.path === "string" && p.path !== "").map((p) => ({
+			key: p.name ?? p.id,
+			path: p.path
+		}));
+		const globalNames = /* @__PURE__ */ new Set();
+		for (const schema of tools.schemas()) if (typeof schema.name === "string" && schema.name.startsWith("mcp__")) globalNames.add(schema.name);
 		return {
 			presets: await Promise.all(presets.map(async (preset) => {
 				let entries = [];
 				let skillRows = [];
+				let mountError;
 				if (preset.broken === void 0) {
 					let scope;
 					try {
 						scope = await agentPresets.standingKeyFor(preset.id);
 						entries = toolSummaries(tools, scope);
-					} catch (error) {
-						throw new HttpError(503, `preset "${preset.id}" tools are unavailable: ${errorMessage(error)}`);
-					}
-					if (skills !== void 0) {
-						const disabledSkills = new Set(stored.presetSkills[preset.id] ?? []);
-						try {
-							skillRows = await presetSkillRows(skills, scope, disabledSkills, cwd);
-						} catch (error) {
-							throw new HttpError(503, `preset "${preset.id}" skills are unavailable: ${errorMessage(error)}`);
+						if (skills !== void 0) {
+							const disabledSkills = new Set(stored.presetSkills[preset.id] ?? []);
+							skillRows = await presetSkillRows(skills, scope, disabledSkills, cwd, presetDirs);
 						}
+					} catch (error) {
+						mountError = errorMessage(error);
 					}
 				}
 				const disabled = new Set(configured[preset.id] ?? []);
@@ -776,12 +1109,17 @@ function createPresetToolController(ctx, access) {
 						...name === RESERVED_TOOL ? { reserved: true } : {}
 					};
 				};
+				const presetName = preset.name ?? preset.id;
 				const mcp = groupMcpTools(entries.map((entry) => entry.name)).map((group) => {
 					const tools$1 = group.tools.map((tool) => row(`mcp__${group.server}__${tool}`, tool));
+					const allGlobal = group.tools.every((tool) => globalNames.has(`mcp__${group.server}__${tool}`));
+					const rawPath = allGlobal ? dshHome() : preset.path;
 					return {
 						server: group.server,
 						tools: tools$1,
-						enabled: tools$1.some((tool) => tool.enabled)
+						enabled: tools$1.some((tool) => tool.enabled),
+						source: allGlobal ? "host" : presetName,
+						...rawPath === void 0 ? {} : { path: displayPath(rawPath) }
 					};
 				});
 				const systemTools = entries.filter((entry) => !entry.name.startsWith("mcp__")).map((entry) => row(entry.name, entry.name));
@@ -790,7 +1128,7 @@ function createPresetToolController(ctx, access) {
 					name: preset.name ?? preset.id,
 					trust: preset.trust,
 					...preset.description === void 0 ? {} : { description: preset.description },
-					...preset.broken === void 0 ? {} : { broken: preset.broken },
+					...preset.broken !== void 0 ? { broken: preset.broken } : mountError === void 0 ? {} : { broken: `failed to mount: ${mountError}` },
 					skills: skillRows,
 					mcp,
 					systemTools
@@ -904,212 +1242,21 @@ function isLoopback(req) {
 }
 
 //#endregion
-//#region src/host/catalog.ts
-const EMPTY_STATE = {
-	skills: /* @__PURE__ */ new Map(),
-	mcpServers: /* @__PURE__ */ new Map(),
-	mcpTools: /* @__PURE__ */ new Map(),
-	systemTools: /* @__PURE__ */ new Map(),
-	userToggled: /* @__PURE__ */ new Set()
-};
-async function readAvailable(services, sessionId, degraded) {
-	const skills = services.get("skills");
-	if (skills === void 0) {
-		degraded.push("skills service unavailable");
-		return [];
-	}
-	try {
-		const agents = services.get("agents");
-		if (agents === void 0) {
-			degraded.push("agents service unavailable: session skill view cannot be determined");
-			return [];
-		}
-		const agent = agents.get(sessionId);
-		if (agent === void 0) {
-			degraded.push(`session agent "${sessionId}" unavailable: session skill view cannot be determined`);
-			return [];
-		}
-		const cwd = agent.session?.header?.cwd;
-		const list = await skills.list({
-			...cwd === void 0 ? {} : { cwd },
-			scope: agent
-		});
-		const out = [];
-		const seen = /* @__PURE__ */ new Map();
-		for (const item of list) {
-			if (typeof item.name !== "string" || item.name === "") continue;
-			const masked = item.invocation?.modelInvocable === false;
-			const existing = seen.get(item.name);
-			if (existing !== void 0) {
-				if (masked) existing.masked = true;
-				continue;
-			}
-			const description = typeof item.description === "string" ? item.description : void 0;
-			const row = {
-				name: item.name,
-				...description === void 0 ? {} : { description },
-				...masked ? { masked: true } : {}
-			};
-			seen.set(item.name, row);
-			out.push(row);
-		}
-		return out;
-	} catch (error) {
-		degraded.push(`skills read failed: ${error instanceof Error ? error.message : String(error)}`);
-		return [];
-	}
-}
+//#region src/host/open-folder.ts
 /**
-* Read load facts off the LIVE session's in-memory log — the same object the
-* agent loop itself reads to assemble the next request.
-*
-* This used to go through `sessionQuery.readSession` + `listEvents`, which are
-* built for cross-session/cold reads: each call structuredClones the ENTIRE
-* event log, `readSession` additionally replay-validates it via Session.create,
-* and a write landing between the two parallel reads forced a whole second
-* round. On a long session (60k events / tens of MB) that meant four full-log
-* clones plus two full replays of synchronous CPU work on every panel open —
-* blocking the Node event loop and freezing the GUI served by the same process.
-*
-* The live session needs none of that: `snapshotEvents()` hands back borrowed
-* references (zero-copy), and `surface.nodes` is maintained incrementally as
-* events land, so "what the model sees right now" is an O(1) membership test.
-* Scanning references for the few `skill` tool calls costs microseconds even
-* on the longest log. Both reads happen in one synchronous tick, so the view
-* is always self-consistent — no cross-read race, no retry loop.
+* Open a folder in the system file manager.
 *
-* A session without a live in-memory view (e.g. restored but not yet attached)
-* degrades honestly instead of paying for a cold-log read the panel never
-* asked for.
+* Covers macOS (`open`), Windows (`start`), and every freedesktop Linux
+* desktop (GNOME, KDE, XFCE, …) via `xdg-open`. Server-only Linux distros
+* that lack a desktop cannot open folders, but the error is graceful.
 */
-function readLogFacts(services, sessionId, degraded) {
-	const empty = {
-		loads: [],
-		shadowed: /* @__PURE__ */ new Set(),
-		pruned: /* @__PURE__ */ new Set()
-	};
-	try {
-		const session = services.get("agents")?.get(sessionId)?.session;
-		const nodes = session?.surface?.nodes;
-		if (session === void 0 || typeof session.snapshotEvents !== "function" || !Array.isArray(nodes)) {
-			degraded.push("live session view unavailable: load states cannot be determined");
-			return empty;
-		}
-		const events = session.snapshotEvents();
-		if (!Array.isArray(events)) {
-			degraded.push("snapshotEvents() returned an unexpected shape; cannot read skill loads");
-			return empty;
-		}
-		const surfaceSeqs = /* @__PURE__ */ new Set();
-		for (const seq of nodes) if (typeof seq === "number") surfaceSeqs.add(seq);
-		const loads = collectLoadRecords(events);
-		const resultSeqs = indexToolResultSeqs(events);
-		return {
-			loads,
-			shadowed: shadowedLoadSeqs(loads, resultSeqs, surfaceSeqs),
-			pruned: prunedLoadSeqs(loads, resultSeqs, surfaceSeqs, events)
-		};
-	} catch (error) {
-		degraded.push(`event read failed: ${error instanceof Error ? error.message : String(error)}`);
-		return empty;
-	}
-}
-function readMcp(services, degraded, disabledServers, disabledTools) {
-	const tools = services.get("tools");
-	if (tools === void 0) {
-		degraded.push("tools service unavailable");
-		return [];
-	}
-	try {
-		const names = [];
-		const descriptions = /* @__PURE__ */ new Map();
-		for (const schema of tools.schemas()) {
-			if (typeof schema.name !== "string") continue;
-			names.push(schema.name);
-			if (typeof schema.description === "string" && schema.description !== "") descriptions.set(schema.name, schema.description);
-		}
-		return groupMcpTools(names).map((group) => {
-			const enabled = !disabledServers.has(group.server);
-			const entries = group.tools.map((tool) => {
-				const name = `mcp__${group.server}__${tool}`;
-				const description = descriptions.get(name);
-				return {
-					name,
-					label: tool,
-					...description === void 0 ? {} : { description },
-					enabled: enabled && !disabledTools.has(name)
-				};
-			});
-			return {
-				server: group.server,
-				tools: entries,
-				enabled
-			};
+function openFolder(path) {
+	return new Promise((resolve, reject) => {
+		exec(`${process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open"} "${path}"`, (error) => {
+			if (error) reject(/* @__PURE__ */ new Error(`failed to open folder: ${error.message}`));
+			else resolve();
 		});
-	} catch (error) {
-		degraded.push(`tool read failed: ${error instanceof Error ? error.message : String(error)}`);
-		return [];
-	}
-}
-function readSystemTools(services, degraded, disabledTools, agent) {
-	const tools = services.get("tools");
-	if (tools === void 0) {
-		if (!degraded.includes("tools service unavailable")) degraded.push("tools service unavailable");
-		return [];
-	}
-	try {
-		let reachable;
-		if (agent !== void 0) {
-			reachable = /* @__PURE__ */ new Set();
-			for (const schema of tools.schemas(agent)) if (typeof schema.name === "string") reachable.add(schema.name);
-		}
-		const byName = /* @__PURE__ */ new Map();
-		const collect = (scope) => {
-			for (const schema of tools.schemas(scope)) {
-				if (typeof schema.name !== "string" || schema.name.startsWith("mcp__") || byName.has(schema.name)) continue;
-				const description = typeof schema.description === "string" && schema.description !== "" ? schema.description : void 0;
-				byName.set(schema.name, {
-					name: schema.name,
-					label: schema.name,
-					...description === void 0 ? {} : { description },
-					enabled: !disabledTools.has(schema.name) && (reachable === void 0 || reachable.has(schema.name)),
-					...schema.name === RESERVED_TOOL ? { reserved: true } : {}
-				});
-			}
-		};
-		collect(void 0);
-		if (agent !== void 0) collect(agent);
-		return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
-	} catch (error) {
-		degraded.push(`tool read failed: ${error instanceof Error ? error.message : String(error)}`);
-		return [];
-	}
-}
-async function buildPayload(services, sessionId, capabilityState = EMPTY_STATE, blocked = {}) {
-	const degraded = [];
-	const disabledSkills = new Set(capabilityState.skills.keys());
-	const disabledServers = new Set(capabilityState.mcpServers.keys());
-	const disabledTools = new Set(capabilityState.mcpTools.keys());
-	const disabledSystem = new Set(capabilityState.systemTools.keys());
-	if (sessionId === null) return {
-		sessionId: null,
-		skills: [],
-		mcp: readMcp(services, degraded, disabledServers, disabledTools),
-		systemTools: readSystemTools(services, degraded, disabledSystem),
-		blocked,
-		...degraded.length > 0 ? { degraded } : {}
-	};
-	const agent = services.get("agents")?.get(sessionId);
-	const available = await readAvailable(services, sessionId, degraded);
-	const logFacts = readLogFacts(services, sessionId, degraded);
-	return {
-		sessionId,
-		skills: decideStates(available, logFacts.loads, logFacts.shadowed, disabledSkills, logFacts.pruned),
-		mcp: readMcp(services, degraded, disabledServers, disabledTools),
-		systemTools: readSystemTools(services, degraded, disabledSystem, agent),
-		blocked,
-		...degraded.length > 0 ? { degraded } : {}
-	};
+	});
 }
 
 //#endregion
@@ -1253,6 +1400,74 @@ function createRouteHandler(services, capabilities, stats, blockedCounts, preset
 				}, true);
 				return;
 			}
+			if (url.pathname === `${ROUTE}/open-folder`) {
+				if (req.method !== "POST") {
+					res.writeHead(405, {
+						allow: "POST",
+						"content-type": "text/plain; charset=utf-8"
+					});
+					res.end("method not allowed");
+					return;
+				}
+				if (!validatePresetContentType(req, res)) return;
+				const body = await readRequestBody(req);
+				if (body === null || typeof body !== "object") {
+					json(res, 400, { error: "invalid request body" });
+					return;
+				}
+				const record = body;
+				if (typeof record.source !== "string" || record.source === "") {
+					json(res, 400, { error: "source is required" });
+					return;
+				}
+				const source = record.source;
+				const sessionId$1 = typeof record.sessionId === "string" ? record.sessionId : null;
+				let folderPath;
+				if (sessionId$1 !== null) try {
+					const skills = services.get("skills");
+					const agent = services.get("agents")?.get(sessionId$1);
+					if (skills !== void 0 && agent !== void 0) {
+						const cwd = agent.session?.header?.cwd;
+						const list = await skills.list({
+							...cwd === void 0 ? {} : { cwd },
+							scope: agent
+						});
+						for (const item of list) {
+							if (item.source !== source) continue;
+							const base = item.resourceBase;
+							if (base !== null && typeof base === "object" && base.kind === "directory") {
+								const path = base.path;
+								if (typeof path === "string" && path !== "") {
+									folderPath = parentDir(path);
+									break;
+								}
+							}
+						}
+					}
+				} catch {}
+				if (folderPath === void 0 && (source === "user-dsh" || source === "user-agents")) {
+					const dshHome$1 = process.env["DSH_HOME"] ?? (process.env["HOME"] !== void 0 ? `${process.env["HOME"]}/.dsh` : void 0);
+					if (dshHome$1 !== void 0) folderPath = source === "user-dsh" ? `${dshHome$1}/skills` : `${process.env["DSH_AGENTS_HOME"] ?? `${process.env["HOME"]}/.agents`}/skills`;
+				} else if (folderPath === void 0 && (source === "project-dsh" || source === "project-agents")) {
+					const cwd = (sessionId$1 === null ? void 0 : services.get("agents")?.get(sessionId$1))?.session?.header?.cwd ?? (sessionId$1 === null ? process.cwd() : void 0);
+					if (cwd !== void 0) folderPath = source === "project-dsh" ? `${cwd}/.dsh/skills` : `${cwd}/.agents/skills`;
+				} else if (folderPath === void 0 && source === "host") folderPath = process.env["DSH_HOME"] ?? (process.env["HOME"] !== void 0 ? `${process.env["HOME"]}/.dsh` : void 0);
+				else if (folderPath === void 0 && source !== "bundled" && source !== "runtime") try {
+					const preset = (await services.get("agentPresets")?.list())?.find((p) => p.id === source || p.name === source);
+					if (preset !== void 0) folderPath = preset.path;
+				} catch {}
+				if (folderPath === void 0) {
+					json(res, 404, { error: `cannot open folder for source "${source}"` });
+					return;
+				}
+				try {
+					await openFolder(folderPath);
+					json(res, 200, { ok: true });
+				} catch (error) {
+					json(res, 500, { error: `failed to open folder: ${errorMessage(error)}` });
+				}
+				return;
+			}
 			if (url.pathname !== ROUTE && url.pathname !== "/") {
 				res.writeHead(404, {
 					"content-type": "text/plain; charset=utf-8",
@@ -1367,6 +1582,36 @@ function createSessionOverrideStore(access) {
 	};
 }
 
+//#endregion
+//#region src/host/settings-scope.ts
+const TOOLKIT_SETTINGS_NAMESPACE = "capability-panel";
+const SessionOverrideSchema = z.object({
+	skills: z.dict(z.boolean()).default({}),
+	mcpServers: z.dict(z.boolean()).default({}),
+	mcpTools: z.dict(z.boolean()).default({}),
+	systemTools: z.dict(z.boolean()).default({})
+});
+const ToolkitSettingsSchema = z.object({
+	presets: z.dict(z.array(z.string())).default({}),
+	presetSkills: z.dict(z.array(z.string())).default({}),
+	sessions: z.dict(SessionOverrideSchema).default({})
+});
+function createToolkitSettingsAccess(ctx) {
+	let scope;
+	let writeQueue = Promise.resolve();
+	return {
+		scope() {
+			if (scope === void 0) scope = ctx.get("settings")?.register(TOOLKIT_SETTINGS_NAMESPACE, ToolkitSettingsSchema, { applies: "live" });
+			return scope;
+		},
+		serialize(work) {
+			const next = writeQueue.then(work, work);
+			writeQueue = next.then(() => void 0, () => void 0);
+			return next;
+		}
+	};
+}
+
 //#endregion
 //#region src/host/stats-store.ts
 function statsFilePath(environment = process.env, home = homedir()) {