dsh-skill-hub 0.1.0 → 0.2.0

package/lib/index.js

@@ -1,19 +1,97 @@
+import { createRequire } from "node:module";
 import z from "schemastery";
-import { mkdir, readFile, readdir, rename, stat, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
-import { load } from "js-yaml";
+import { dump, load } from "js-yaml";
 import { isSkillName } from "@deepseek-ai/dsh-skill";
+//#region src/protocol.ts
+/**
+* Shared API contract for dsh-skill-hub: the route paths and payload shapes
+* both the host half and the browser half import. The browser half must never
+* depend on host SDK packages, so registry types are re-spelled here as
+* plain JSON-safe interfaces.
+*/
+/** Browser-facing base paths of the skill-hub API family. */
+const SKILL_HUB_API = {
+	catalog: "/api/skill-hub/catalog",
+	skill: "/api/skill-hub/skill",
+	skillDelete: "/api/skill-hub/skill/delete",
+	toggle: "/api/skill-hub/toggle",
+	toggleBatch: "/api/skill-hub/toggle-batch",
+	create: "/api/skill-hub/create",
+	stats: "/api/skill-hub/stats",
+	config: "/api/skill-hub/config",
+	market: "/api/skill-hub/market",
+	marketSource: "/api/skill-hub/market/source",
+	marketSourceDelete: "/api/skill-hub/market/source/delete",
+	marketSourceRef: "/api/skill-hub/market/source/ref",
+	marketCheck: "/api/skill-hub/market/check",
+	marketSync: "/api/skill-hub/market/source/sync",
+	repo: "/api/skill-hub/repo",
+	repoImport: "/api/skill-hub/repo/import",
+	update: "/api/skill-hub/update",
+	groups: "/api/skill-hub/groups",
+	tag: "/api/skill-hub/tag",
+	tagDelete: "/api/skill-hub/tag/delete",
+	tagMembers: "/api/skill-hub/tag/members",
+	sources: "/api/skill-hub/sources",
+	sourceCheck: "/api/skill-hub/sources/check",
+	sourceSync: "/api/skill-hub/sources/sync",
+	sourceDelete: "/api/skill-hub/sources/delete",
+	sourceRestore: "/api/skill-hub/sources/restore",
+	sourceTrashClear: "/api/skill-hub/sources/trash/clear"
+};
+/**
+* Hub config defaults — the single source every layer reads: the cordis
+* schema (index.ts), the host's saved-override merge, and the routes'
+* fallback view. Changing a default here changes all three.
+*/
+const HUB_CONFIG_DEFAULTS = {
+	enabled: true,
+	announceToAgent: true,
+	showUseCount: true,
+	showUseTime: true,
+	showGroupSummary: true
+};
+/**
+* Resolve the effective hub config: saved sidecar overrides win over the
+* cordis composition entry (the web card owns runtime config), missing
+* booleans fall back to HUB_CONFIG_DEFAULTS, and dot colors pass through
+* (saved first, then base) only when set.
+*/
+function resolveHubConfig(saved, base = {}) {
+	const dotModelColor = saved.dotModelColor !== void 0 ? saved.dotModelColor : base.dotModelColor;
+	const dotUserColor = saved.dotUserColor !== void 0 ? saved.dotUserColor : base.dotUserColor;
+	return {
+		enabled: saved.enabled ?? base.enabled ?? HUB_CONFIG_DEFAULTS.enabled,
+		announceToAgent: saved.announceToAgent ?? base.announceToAgent ?? HUB_CONFIG_DEFAULTS.announceToAgent,
+		showUseCount: saved.showUseCount ?? base.showUseCount ?? HUB_CONFIG_DEFAULTS.showUseCount,
+		showUseTime: saved.showUseTime ?? base.showUseTime ?? HUB_CONFIG_DEFAULTS.showUseTime,
+		showGroupSummary: saved.showGroupSummary ?? base.showGroupSummary ?? HUB_CONFIG_DEFAULTS.showGroupSummary,
+		...dotModelColor !== void 0 ? { dotModelColor } : {},
+		...dotUserColor !== void 0 ? { dotUserColor } : {}
+	};
+}
+/** HEX color validation shared by host routes and the settings card. */
+const HEX_COLOR_RE = /^#[0-9a-f]{6}$/i;
+//#endregion
 //#region src/store.ts
 /**
-* Hub sidecar store: remembers which skills the hub toggled off. Disabling
-* renames the skill's SKILL.md (or flat .md) out of the filesystem provider's
-* discovery shapes, so the provider catalog alone cannot see disabled skills;
-* this store keeps name/path/root so the GUI can list them and re-enable.
+* Hub sidecar store: remembers which skills the hub toggled off and the
+* user's organization/tracking records. Disabling renames the skill's
+* SKILL.md (or flat .md) out of the filesystem provider's discovery shapes,
+* so the provider catalog alone cannot see disabled skills; this store keeps
+* name/path/root so the GUI can list them and re-enable. It also persists
+* user tag groups, upstream source records (repo + commit snapshot for
+* update checks), the market source list, and the trash (skills removed
+* after upstream deletion).
 *
 * State file: $DSH_HOME/dsh-skill-hub.json — a small JSON document written
 * atomically (tmp file + rename).
 */
+/** 默认场景名（系统预置的兜底场景，新技能自动归入）。 */
+const DEFAULT_SCENE_NAME = "通用";
 /** Resolve the DSH home directory (the filesystem provider's user-dsh root base). */
 function dshHome() {
 	return process.env.DSH_HOME ?? join(homedir(), ".dsh");
@@ -22,12 +100,80 @@ function dshHome() {
 function statePath(home = dshHome()) {
 	return join(home, "dsh-skill-hub.json");
 }
+/**
+* Business-rule failure the routes layer can map onto a 4xx status instead
+* of a blanket 500: user input is invalid (validation → 400), the target
+* does not exist (not-found → 404), or the operation conflicts with an
+* invariant (conflict → 409).
+*/
+var StoreError = class extends Error {
+	kind;
+	constructor(kind, message) {
+		super(message);
+		this.name = "StoreError";
+		this.kind = kind;
+	}
+};
+/**
+* Normalize an arbitrary parsed sidecar document to the current schema.
+* v1 to v2: scenes are dropped (the one-click role merged into group
+* switches), and origins are migrated into source records (repo = origin
+* value, commit snapshot empty — the first update check backfills it).
+* v2 to v3: market sources become records ({ repo, ref?, commitSha? })
+* instead of bare repo slugs, so a source can pin a release/branch version.
+* Returns null when the file claims a newer schema than this plugin
+* understands, so the caller starts empty instead of risking data loss.
+*/
+function migrateStore(parsed) {
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+	const record = parsed;
+	const version = typeof record.version === "number" ? record.version : 0;
+	if (version > 3) return null;
+	const disabled = Array.isArray(record.disabled) ? record.disabled : [];
+	const config = typeof record.config === "object" && record.config !== null && !Array.isArray(record.config) ? record.config : void 0;
+	const tags = Array.isArray(record.tags) ? record.tags : void 0;
+	const trash = Array.isArray(record.trash) ? record.trash : void 0;
+	const marketSources = Array.isArray(record.marketSources) ? record.marketSources.map((entry) => typeof entry === "string" ? { repo: entry } : entry) : void 0;
+	let sources;
+	if (Array.isArray(record.sources)) sources = record.sources;
+	else if (version < 2 && typeof record.origins === "object" && record.origins !== null && !Array.isArray(record.origins)) {
+		const byOrigin = /* @__PURE__ */ new Map();
+		for (const [name, origin] of Object.entries(record.origins)) {
+			if (typeof origin !== "string" || origin === "") continue;
+			const list = byOrigin.get(origin);
+			if (list === void 0) byOrigin.set(origin, [name]);
+			else list.push(name);
+		}
+		sources = [...byOrigin.entries()].map(([repo, skillNames]) => ({
+			repo,
+			root: "skills",
+			commitSha: "",
+			skills: skillNames.sort((a, b) => a.localeCompare(b))
+		}));
+	}
+	return {
+		version: 3,
+		disabled,
+		...config !== void 0 ? { config } : {},
+		...tags !== void 0 ? { tags } : {},
+		...sources !== void 0 ? { sources } : {},
+		...marketSources !== void 0 ? { marketSources } : {},
+		...trash !== void 0 ? { trash } : {}
+	};
+}
 /** Sidecar state owner. */
 var SkillHubStore = class {
 	file;
 	entries = /* @__PURE__ */ new Map();
 	config = {};
+	tagsById = /* @__PURE__ */ new Map();
+	sourcesByRepo = /* @__PURE__ */ new Map();
+	marketSources = [];
+	trashByName = /* @__PURE__ */ new Map();
 	loaded = false;
+	/** Serializes persist runs: concurrent mutators must not let an earlier
+	*  snapshot overwrite a later one (rename is atomic, ordering is not). */
+	writeChain = Promise.resolve();
 	constructor(file = statePath()) {
 		this.file = file;
 	}
@@ -36,18 +182,93 @@ var SkillHubStore = class {
 		this.loaded = true;
 		try {
 			const raw = await readFile(this.file, "utf8");
-			const parsed = JSON.parse(raw);
-			if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed.disabled)) {
-				for (const entry of parsed.disabled) if (typeof entry?.name === "string" && typeof entry?.path === "string") this.entries.set(entry.name, entry);
-				const saved = parsed.config;
+			const migrated = migrateStore(JSON.parse(raw));
+			if (migrated === null) console.warn("[dsh-skill-hub] sidecar state uses a newer schema than this plugin supports; starting empty");
+			else {
+				if (Array.isArray(migrated.disabled)) {
+					for (const entry of migrated.disabled) if (typeof entry?.name === "string" && typeof entry?.path === "string") this.entries.set(entry.name, entry);
+				}
+				const saved = migrated.config;
 				if (typeof saved === "object" && saved !== null) {
 					if (typeof saved.enabled === "boolean") this.config.enabled = saved.enabled;
 					if (typeof saved.announceToAgent === "boolean") this.config.announceToAgent = saved.announceToAgent;
+					if (typeof saved.dotModelColor === "string" && saved.dotModelColor !== "") this.config.dotModelColor = saved.dotModelColor;
+					if (typeof saved.dotUserColor === "string" && saved.dotUserColor !== "") this.config.dotUserColor = saved.dotUserColor;
+					if (typeof saved.showUseCount === "boolean") this.config.showUseCount = saved.showUseCount;
+					if (typeof saved.showUseTime === "boolean") this.config.showUseTime = saved.showUseTime;
+					if (typeof saved.showGroupSummary === "boolean") this.config.showGroupSummary = saved.showGroupSummary;
+				}
+				if (Array.isArray(migrated.tags)) for (const entry of migrated.tags) {
+					const tag = entry;
+					if (tag !== null && typeof tag === "object" && typeof tag.id === "string" && typeof tag.name === "string" && Array.isArray(tag.skillNames)) this.tagsById.set(tag.id, {
+						id: tag.id,
+						name: tag.name,
+						skillNames: tag.skillNames.filter((n) => typeof n === "string"),
+						...tag.default === true ? { default: true } : {}
+					});
+				}
+				if (Array.isArray(migrated.sources)) for (const entry of migrated.sources) {
+					const source = entry;
+					if (source !== null && typeof source === "object" && typeof source.repo === "string" && source.repo !== "" && Array.isArray(source.skills)) {
+						const manifest = source.manifest;
+						this.sourcesByRepo.set(source.repo, {
+							repo: source.repo,
+							...typeof source.ref === "string" && source.ref !== "" ? { ref: source.ref } : {},
+							root: source.root === "design-templates" ? "design-templates" : "skills",
+							commitSha: typeof source.commitSha === "string" ? source.commitSha : "",
+							skills: source.skills.filter((n) => typeof n === "string"),
+							...manifest !== null && typeof manifest === "object" && !Array.isArray(manifest) ? { manifest: Object.fromEntries(Object.entries(manifest).filter(([, size]) => typeof size === "number")) } : {}
+						});
+					}
+				}
+				if (Array.isArray(migrated.marketSources)) for (const entry of migrated.marketSources) {
+					const item = entry;
+					if (item !== null && typeof item === "object" && typeof item.repo === "string" && item.repo !== "" && !this.marketSources.some((s) => s.repo === item.repo)) this.marketSources.push({
+						repo: item.repo,
+						...typeof item.ref === "string" && item.ref !== "" ? { ref: item.ref } : {},
+						...typeof item.commitSha === "string" && item.commitSha !== "" ? { commitSha: item.commitSha } : {}
+					});
+				}
+				if (Array.isArray(migrated.trash)) for (const entry of migrated.trash) {
+					const item = entry;
+					if (item !== null && typeof item === "object" && typeof item.name === "string" && typeof item.path === "string") {
+						const origin = item.origin;
+						const tagIds = item.tagIds;
+						this.trashByName.set(item.name, {
+							name: item.name,
+							path: item.path,
+							movedAt: typeof item.movedAt === "number" ? item.movedAt : 0,
+							...typeof item.sourcePath === "string" && item.sourcePath !== "" ? { sourcePath: item.sourcePath } : {},
+							...origin !== null && typeof origin === "object" && typeof origin.repo === "string" && origin.repo !== "" && (origin.root === "skills" || origin.root === "design-templates") ? { origin: {
+								repo: origin.repo,
+								root: origin.root,
+								...typeof origin.ref === "string" && origin.ref !== "" ? { ref: origin.ref } : {},
+								commitSha: typeof origin.commitSha === "string" ? origin.commitSha : ""
+							} } : {},
+							...Array.isArray(tagIds) ? { tagIds: tagIds.filter((id) => typeof id === "string") } : {}
+						});
+					}
 				}
 			}
 		} catch (error) {
 			if (error.code !== "ENOENT") console.warn("[dsh-skill-hub] sidecar state unreadable, starting empty:", error instanceof Error ? error.message : error);
 		}
+		await this.ensureDefaultTag();
+	}
+	/**
+	* 保证存在默认场景：没有任何 default 标记的 tag 时创建「通用」。
+	* 新技能创建后自动归入它；用户可改名，但默认场景不可删除。
+	*/
+	async ensureDefaultTag() {
+		if ([...this.tagsById.values()].some((tag) => tag.default === true)) return;
+		const tag = {
+			id: crypto.randomUUID(),
+			name: DEFAULT_SCENE_NAME,
+			skillNames: [],
+			default: true
+		};
+		this.tagsById.set(tag.id, tag);
+		await this.persist();
 	}
 	async listDisabled() {
 		await this.ensureLoaded();
@@ -74,7 +295,7 @@ var SkillHubStore = class {
 	}
 	/**
 	* Persist a runtime-config patch, merged over the saved values. A field
-	* whose patch value is `undefined` is removed from the saved layer, so the
+	* whose patch value is undefined is removed from the saved layer, so the
 	* setting re-inherits its default (the web card's "reset" path).
 	*/
 	async setConfig(config) {
@@ -85,16 +306,311 @@ var SkillHubStore = class {
 		this.config = next;
 		await this.persist();
 	}
-	async persist() {
-		const payload = {
-			version: 1,
-			disabled: [...this.entries.values()],
-			config: this.config
+	/** All user-defined tag groups, in creation order. */
+	async listTags() {
+		await this.ensureLoaded();
+		return [...this.tagsById.values()];
+	}
+	/** One tag by id (undefined when absent). */
+	async getTag(id) {
+		await this.ensureLoaded();
+		return this.tagsById.get(id);
+	}
+	/**
+	* Create (no id) or rename (with id) a tag. Returns the saved tag.
+	* Creating assigns a fresh UUID; renaming keeps members.
+	*/
+	async saveTag(input) {
+		await this.ensureLoaded();
+		const name = input.name.trim();
+		if (name === "") throw new StoreError("validation", "tag name must not be empty");
+		let tag;
+		if (input.id !== void 0) {
+			const existing = this.tagsById.get(input.id);
+			if (existing === void 0) throw new StoreError("not-found", "tag not found: " + input.id);
+			tag = {
+				...existing,
+				name
+			};
+		} else tag = {
+			id: crypto.randomUUID(),
+			name,
+			skillNames: []
+		};
+		this.tagsById.set(tag.id, tag);
+		await this.persist();
+		return tag;
+	}
+	/** Delete a tag by id (no-op when absent). The default scene cannot be deleted. */
+	async deleteTag(id) {
+		await this.ensureLoaded();
+		if (this.tagsById.get(id)?.default === true) throw new StoreError("conflict", "the default scene cannot be deleted");
+		if (!this.tagsById.delete(id)) return;
+		await this.persist();
+	}
+	/** The default scene (「通用」), guaranteed to exist after ensureLoaded. */
+	async getDefaultTag() {
+		await this.ensureLoaded();
+		return [...this.tagsById.values()].find((tag) => tag.default === true);
+	}
+	/** Append one skill name to a tag (deduplicated; no-op when already a member). */
+	async addSkillToTag(id, name) {
+		await this.ensureLoaded();
+		const existing = this.tagsById.get(id);
+		if (existing === void 0 || name.trim() === "" || existing.skillNames.includes(name)) return existing;
+		const tag = {
+			...existing,
+			skillNames: [...existing.skillNames, name]
+		};
+		this.tagsById.set(id, tag);
+		await this.persist();
+		return tag;
+	}
+	/**
+	* Replace a tag's member list wholesale (idempotent). Deduplicates and
+	* drops blank names; unknown skill names are kept (they may arrive later),
+	* the routes layer filters against the live catalog before persisting.
+	*/
+	async setTagMembers(id, skillNames) {
+		await this.ensureLoaded();
+		const existing = this.tagsById.get(id);
+		if (existing === void 0) return void 0;
+		const names = [...new Set(skillNames.filter((n) => n.trim() !== ""))];
+		const tag = {
+			...existing,
+			skillNames: names
 		};
-		const tmp = this.file + ".tmp";
-		await mkdir(dirname(this.file), { recursive: true });
-		await writeFile(tmp, JSON.stringify(payload, null, 2) + "\n", "utf8");
-		await rename(tmp, this.file);
+		this.tagsById.set(id, tag);
+		await this.persist();
+		return tag;
+	}
+	/** Remove one skill from every tag group (used when the skill is deleted). */
+	async removeSkillFromTags(name) {
+		await this.ensureLoaded();
+		let changed = false;
+		for (const tag of this.tagsById.values()) {
+			if (!tag.skillNames.includes(name)) continue;
+			tag.skillNames = tag.skillNames.filter((n) => n !== name);
+			changed = true;
+		}
+		if (changed) await this.persist();
+	}
+	/** All source records, sorted by repo. */
+	async listSources() {
+		await this.ensureLoaded();
+		return [...this.sourcesByRepo.values()].sort((a, b) => a.repo.localeCompare(b.repo));
+	}
+	/** One source record by repo (undefined when absent). */
+	async getSource(repo) {
+		await this.ensureLoaded();
+		return this.sourcesByRepo.get(repo);
+	}
+	/** The source record that tracks a skill name (undefined when untracked). */
+	async getSourceForSkill(name) {
+		await this.ensureLoaded();
+		for (const source of this.sourcesByRepo.values()) if (source.skills.includes(name)) return source;
+	}
+	/** Remove a source record entirely (no-op when absent). */
+	async deleteSource(repo) {
+		await this.ensureLoaded();
+		if (!this.sourcesByRepo.delete(repo)) return;
+		await this.persist();
+	}
+	/**
+	* Upsert one skill into a source record. When the repo has no record yet a
+	* new one is created (root + commit snapshot from the caller).
+	*/
+	async addSourceSkill(repo, root, commitSha, ref, skillName) {
+		await this.ensureLoaded();
+		const existing = this.sourcesByRepo.get(repo);
+		if (existing === void 0) this.sourcesByRepo.set(repo, {
+			repo,
+			...ref !== void 0 && ref !== "" ? { ref } : {},
+			root,
+			commitSha,
+			skills: [skillName]
+		});
+		else {
+			const skills = existing.skills.includes(skillName) ? existing.skills : [...existing.skills, skillName].sort((a, b) => a.localeCompare(b));
+			this.sourcesByRepo.set(repo, {
+				...existing,
+				skills
+			});
+		}
+		await this.persist();
+	}
+	/** Replace a source's skill list (used after sync/confirm-delete). */
+	async setSourceSkills(repo, skills) {
+		await this.ensureLoaded();
+		const existing = this.sourcesByRepo.get(repo);
+		if (existing === void 0) return void 0;
+		const names = [...new Set(skills.filter((n) => n.trim() !== ""))].sort((a, b) => a.localeCompare(b));
+		if (names.length === 0) this.sourcesByRepo.delete(repo);
+		else this.sourcesByRepo.set(repo, {
+			...existing,
+			skills: names
+		});
+		await this.persist();
+		return this.sourcesByRepo.get(repo);
+	}
+	/** Remove one skill from every source record (used when the skill is deleted). */
+	async removeSkillFromSources(name) {
+		await this.ensureLoaded();
+		let changed = false;
+		for (const [repo, source] of this.sourcesByRepo) {
+			if (!source.skills.includes(name)) continue;
+			const skills = source.skills.filter((n) => n !== name);
+			if (skills.length === 0) this.sourcesByRepo.delete(repo);
+			else this.sourcesByRepo.set(repo, {
+				...source,
+				skills
+			});
+			changed = true;
+		}
+		if (changed) await this.persist();
+	}
+	/** Update a source's commit snapshot. */
+	async setSourceCommit(repo, commitSha) {
+		await this.ensureLoaded();
+		const existing = this.sourcesByRepo.get(repo);
+		if (existing === void 0) return;
+		this.sourcesByRepo.set(repo, {
+			...existing,
+			commitSha
+		});
+		await this.persist();
+	}
+	/** Update a source's pinned ref (release tag / branch) when the market syncs. */
+	async setSourceRef(repo, ref) {
+		await this.ensureLoaded();
+		const existing = this.sourcesByRepo.get(repo);
+		if (existing === void 0 || ref.trim() === "") return;
+		this.sourcesByRepo.set(repo, {
+			...existing,
+			ref: ref.trim()
+		});
+		await this.persist();
+	}
+	/**
+	* Merge per-path manifest entries into a source (incremental imports).
+	* When `dir` is given, every baseline path under that skill directory is
+	* dropped first, so files the upstream removed never linger in the
+	* baseline and skew later update diffs.
+	*/
+	async mergeSourceManifest(repo, manifest, dir) {
+		await this.ensureLoaded();
+		const existing = this.sourcesByRepo.get(repo);
+		if (existing === void 0 || Object.keys(manifest).length === 0) return;
+		const base = { ...existing.manifest ?? {} };
+		if (dir !== void 0 && dir !== "") {
+			const prefix = dir + "/";
+			for (const path of Object.keys(base)) if (path.startsWith(prefix)) delete base[path];
+		}
+		this.sourcesByRepo.set(repo, {
+			...existing,
+			manifest: {
+				...base,
+				...manifest
+			}
+		});
+		await this.persist();
+	}
+	/** skillName → collection name for every recorded origin (derived from sources). */
+	async listOrigins() {
+		await this.ensureLoaded();
+		const origins = {};
+		for (const source of this.sourcesByRepo.values()) for (const name of source.skills) origins[name] = source.repo;
+		return origins;
+	}
+	/** The user's market sources, in addition order. */
+	async listMarketSources() {
+		await this.ensureLoaded();
+		return [...this.marketSources];
+	}
+	/** One market source by repo (undefined when absent). */
+	async getMarketSource(repo) {
+		await this.ensureLoaded();
+		return this.marketSources.find((entry) => entry.repo === repo);
+	}
+	/** Add a repo (deduplicated), optionally with a pinned ref. Returns the fresh list. */
+	async addMarketSource(repo, ref) {
+		await this.ensureLoaded();
+		const existing = this.marketSources.find((entry) => entry.repo === repo);
+		if (existing === void 0) this.marketSources.push(ref !== void 0 && ref !== "" ? {
+			repo,
+			ref
+		} : { repo });
+		else if (ref !== void 0 && ref !== "" && existing.ref !== ref) existing.ref = ref;
+		await this.persist();
+		return [...this.marketSources];
+	}
+	/** Remove a repo (no-op when absent). Returns the fresh list. */
+	async removeMarketSource(repo) {
+		await this.ensureLoaded();
+		const index = this.marketSources.findIndex((entry) => entry.repo === repo);
+		if (index === -1) return [...this.marketSources];
+		this.marketSources.splice(index, 1);
+		await this.persist();
+		return [...this.marketSources];
+	}
+	/** Pin a market source to an explicit ref (branch/tag). Returns the record. */
+	async setMarketSourceRef(repo, ref) {
+		await this.ensureLoaded();
+		const entry = this.marketSources.find((item) => item.repo === repo);
+		if (entry === void 0 || ref.trim() === "") return entry;
+		entry.ref = ref.trim();
+		delete entry.commitSha;
+		await this.persist();
+		return entry;
+	}
+	/** Record the commit a market source's pinned ref resolved to (update baseline). */
+	async setMarketSourceCommit(repo, commitSha) {
+		await this.ensureLoaded();
+		const entry = this.marketSources.find((item) => item.repo === repo);
+		if (entry === void 0 || commitSha === "") return;
+		entry.commitSha = commitSha;
+		await this.persist();
+	}
+	/** All trashed skills, newest first. */
+	async listTrash() {
+		await this.ensureLoaded();
+		return [...this.trashByName.values()].sort((a, b) => b.movedAt - a.movedAt);
+	}
+	/** One trash entry by skill name (undefined when absent). */
+	async getTrash(name) {
+		await this.ensureLoaded();
+		return this.trashByName.get(name);
+	}
+	/** Record a trashed skill. */
+	async addTrash(entry) {
+		await this.ensureLoaded();
+		this.trashByName.set(entry.name, entry);
+		await this.persist();
+	}
+	/** Remove a trash record (after restore). */
+	async removeTrash(name) {
+		await this.ensureLoaded();
+		if (!this.trashByName.delete(name)) return;
+		await this.persist();
+	}
+	persist() {
+		const run = this.writeChain.then(async () => {
+			const payload = {
+				version: 3,
+				disabled: [...this.entries.values()],
+				config: this.config,
+				...this.tagsById.size > 0 ? { tags: [...this.tagsById.values()] } : {},
+				...this.sourcesByRepo.size > 0 ? { sources: [...this.sourcesByRepo.values()] } : {},
+				...this.marketSources.length > 0 ? { marketSources: [...this.marketSources] } : {},
+				...this.trashByName.size > 0 ? { trash: [...this.trashByName.values()] } : {}
+			};
+			const tmp = this.file + ".tmp";
+			await mkdir(dirname(this.file), { recursive: true });
+			await writeFile(tmp, JSON.stringify(payload, null, 2) + "\n", "utf8");
+			await rename(tmp, this.file);
+		});
+		this.writeChain = run.catch(() => {});
+		return run;
 	}
 };
 //#endregion
@@ -141,10 +657,11 @@ async function createSkill(root, name, description, home = dshHome()) {
 	const dir = join(rootPath(root, home), name);
 	const file = join(dir, "SKILL.md");
 	await mkdir(dir, { recursive: true });
+	const safeDescription = description.trim() === "" ? "New dsh skill created from the skill hub." : description.trim();
 	await writeFile(file, [
 		"---",
-		"name: " + name,
-		"description: " + (description.trim() === "" ? "New dsh skill created from the skill hub." : description.trim()),
+		"name: " + dump(name).trim(),
+		"description: " + dump(safeDescription).trim(),
 		"---",
 		"",
 		"# " + name,
@@ -172,23 +689,46 @@ async function enableSkill(disabledPath) {
 	await rename(disabledPath, original);
 	return original;
 }
+/**
+* Move a skill (directory bundle or flat .md file) into the root's trash.
+* The skill stays recoverable: the source is renamed into
+* <root>/.trash/<name>-<timestamp>. A directory bundle is addressed by its
+* SKILL.md path and moved as a whole directory.
+* @returns the trashed path plus the original path that was moved.
+*/
+async function trashSkill(sourcePath) {
+	const source = basename(sourcePath) === "SKILL.md" ? dirname(sourcePath) : sourcePath;
+	const trashDir = join(dirname(source), ".trash");
+	await mkdir(trashDir, { recursive: true });
+	const target = join(trashDir, basename(source) + "-" + Date.now());
+	await rename(source, target);
+	return {
+		path: target,
+		source
+	};
+}
+/** Restore a trashed skill (directory or flat file) to its original location. */
+async function restoreSkill(entry, home = dshHome()) {
+	if (basename(dirname(entry.path)) !== ".trash") throw new TypeError("not a trashed skill path: " + entry.path);
+	const target = entry.sourcePath ?? join(dirname(dirname(entry.path)), entry.name);
+	if (entry.sourcePath !== void 0 && rootOfPath(entry.sourcePath, home) === void 0) throw new TypeError("not a hub writable skill path: " + entry.sourcePath);
+	await rename(entry.path, target);
+	return target;
+}
+/** Permanently delete one trashed skill (directory or flat file). */
+async function clearTrash(entry, home = dshHome()) {
+	if (basename(dirname(entry.path)) !== ".trash" || rootOfPath(dirname(dirname(entry.path)), home) === void 0) throw new TypeError("not a hub trashed skill path: " + entry.path);
+	await rm(entry.path, {
+		recursive: true,
+		force: true
+	});
+	return entry.path;
+}
 /** Classify a skill file path: 'directory' (SKILL.md), 'flat' (<name>.md), or undefined. */
 function skillFileKind(path) {
 	if (basename(path) === "SKILL.md") return "directory";
 	if (path.endsWith(".md")) return "flat";
 }
-/**
-* Normalize an optional frontmatter `sets` value into a clean string list.
-* Accepts a single string or a string array; trims, drops empties, and
-* ignores non-string entries. Returns undefined when absent or empty, so a
-* skill without sets stays uncategorized.
-*/
-function normalizeSets(raw) {
-	const items = typeof raw === "string" ? [raw] : Array.isArray(raw) ? raw : void 0;
-	if (items === void 0) return void 0;
-	const sets = items.filter((item) => typeof item === "string").map((item) => item.trim()).filter((item) => item !== "");
-	return sets.length === 0 ? void 0 : sets;
-}
 /** Parse a SKILL.md the way the official filesystem provider does. */
 function parseFrontmatter(text) {
 	const match = /^---\s*\r?\n([\s\S]*?)\r?\n---\s*(?:\r?\n([\s\S]*))?$/.exec(text);
@@ -207,7 +747,6 @@ function parseFrontmatter(text) {
 	const description = typeof record.description === "string" ? record.description.trim() : "";
 	if (description === "") return { error: "frontmatter requires a description field" };
 	const whenToUse = typeof record.whenToUse === "string" && record.whenToUse.trim() !== "" ? record.whenToUse.trim() : void 0;
-	const sets = normalizeSets(record.sets);
 	if (Object.hasOwn(record, "disableModelInvocation")) return { error: "frontmatter field \"disableModelInvocation\" is unsupported; use \"disable-model-invocation\"" };
 	if (Object.hasOwn(record, "modelInvocable")) return { error: "frontmatter field \"modelInvocable\" is unsupported; use \"disable-model-invocation\"" };
 	if (Object.hasOwn(record, "userInvocable")) return { error: "frontmatter field \"userInvocable\" is unsupported; use \"user-invocable\"" };
@@ -226,7 +765,6 @@ function parseFrontmatter(text) {
 		name,
 		description,
 		...whenToUse !== void 0 ? { whenToUse } : {},
-		...sets !== void 0 ? { sets } : {},
 		invocation,
 		content: (match[2] ?? "").trim()
 	} };
@@ -251,10 +789,9 @@ function frontmatterBoolean(data, key) {
 /**
 * Scan one skills root for discovery files: directory bundles (SKILL.md)
 * and flat <name>.md files. Hub-disabled files (.disabled) are excluded;
-* the .system subdirectory is excluded when skipSystem is set (mirrors the
-* official provider's user-dsh behavior).
+* dot-prefixed entries (including .trash and .system) are always skipped.
 */
-async function scanRoot(base, skipSystem) {
+async function scanRoot(base) {
 	const entries = [];
 	let names;
 	try {
@@ -265,7 +802,6 @@ async function scanRoot(base, skipSystem) {
 	}
 	for (const name of names) {
 		if (name.startsWith(".")) continue;
-		if (skipSystem && name === ".system") continue;
 		const absolute = join(base, name);
 		let stats;
 		try {
@@ -286,9 +822,9 @@ async function scanRoot(base, skipSystem) {
 	}
 	return entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
 }
-/** Scan one writable root (user-dsh skips .system, mirroring the official provider). */
+/** Scan one writable root. */
 function listSkillEntries(root, home = dshHome()) {
-	return scanRoot(rootPath(root, home), root === "user-dsh");
+	return scanRoot(rootPath(root, home));
 }
 /**
 * Walk up from cwd (max 32 levels) for a project marker (.dsh or .git);
@@ -325,10 +861,25 @@ async function scanDiagnostics(root, home = dshHome()) {
 			continue;
 		}
 		const parsed = parseFrontmatter(text);
-		if ("error" in parsed) diagnostics.push({
+		if ("error" in parsed) {
+			diagnostics.push({
+				path: entry.path,
+				root,
+				reason: parsed.error
+			});
+			continue;
+		}
+		const { value } = parsed;
+		const pathName = entry.kind === "directory" ? basename(entry.directory) : basename(entry.path, ".md");
+		if (value.name !== pathName) diagnostics.push({
+			path: entry.path,
+			root,
+			reason: `frontmatter name "${value.name}" does not match the discovery path "${pathName}" (the provider registers by path)`
+		});
+		if (value.description.length < 10) diagnostics.push({
 			path: entry.path,
 			root,
-			reason: parsed.error
+			reason: `description is only ${value.description.length} chars; write a one-line description so agents can auto-activate this skill`
 		});
 	}
 	return diagnostics;
@@ -380,13 +931,19 @@ var SkillHubProvider = class {
 		}, { once: true });
 		this.checkRoots();
 	}
-	/** Invalidate the registry cache when the top-level root shape changed. */
+	/**
+	* Invalidate the registry cache when the discovered skill files changed.
+	* The stamp covers the per-skill discovery file's mtime + size (plus the
+	* entry set itself), so editing a SKILL.md body — not just adding or
+	* renaming directories — refreshes the GUI catalog.
+	*/
 	async checkRoots() {
 		let stamp = "";
-		for (const root of await this.roots(void 0)) try {
-			stamp += root.base + ":" + (await stat(root.base)).mtimeMs + ";";
+		for (const root of await this.roots(void 0)) for (const entry of await scanRoot(root.base)) try {
+			const info = await stat(entry.path);
+			stamp += entry.path + ":" + info.mtimeMs + ":" + info.size + ";";
 		} catch {
-			stamp += root.base + ":missing;";
+			stamp += entry.path + ":missing;";
 		}
 		if (this.rootStamp === "") {
 			this.rootStamp = stamp;
@@ -399,7 +956,7 @@ var SkillHubProvider = class {
 	}
 	async list(options) {
 		const candidates = [];
-		for (const root of await this.roots(options.cwd)) for (const entry of await scanRoot(root.base, root.skipSystem)) {
+		for (const root of await this.roots(options.cwd)) for (const entry of await scanRoot(root.base)) {
 			let text;
 			try {
 				text = await readFile(entry.path, "utf8");
@@ -413,7 +970,6 @@ var SkillHubProvider = class {
 				name: value.name,
 				description: value.description,
 				...value.whenToUse !== void 0 ? { whenToUse: value.whenToUse } : {},
-				...value.sets !== void 0 ? { metadata: { sets: value.sets } } : {},
 				invocation: value.invocation,
 				source: root.source,
 				provider: this.name,
@@ -442,7 +998,6 @@ var SkillHubProvider = class {
 			name: value.name,
 			description: value.description,
 			...value.whenToUse !== void 0 ? { whenToUse: value.whenToUse } : {},
-			...value.sets !== void 0 ? { metadata: { sets: value.sets } } : {},
 			invocation: value.invocation,
 			source: candidate.source,
 			provider: this.name,
@@ -459,26 +1014,22 @@ var SkillHubProvider = class {
 		const roots = [{
 			base: rootPath("user-dsh", this.home),
 			source: "user-dsh",
-			rank: USER_DSH_RANK,
-			skipSystem: true
+			rank: USER_DSH_RANK
 		}, {
 			base: rootPath("user-agents", this.home),
 			source: "user-agents",
-			rank: USER_AGENTS_RANK,
-			skipSystem: false
+			rank: USER_AGENTS_RANK
 		}];
 		if (cwd !== void 0 && cwd !== "") {
 			const project = await findProjectRoot(cwd);
 			roots.unshift({
 				base: join(project, ".dsh", "skills"),
 				source: "project-dsh",
-				rank: PROJECT_DSH_RANK,
-				skipSystem: false
+				rank: PROJECT_DSH_RANK
 			}, {
 				base: join(project, ".agents", "skills"),
 				source: "project-agents",
-				rank: PROJECT_AGENTS_RANK,
-				skipSystem: false
+				rank: PROJECT_AGENTS_RANK
 			});
 		}
 		return roots;
@@ -489,76 +1040,659 @@ var SkillHubProvider = class {
 	}
 };
 //#endregion
-//#region src/protocol.ts
+//#region src/repo.ts
 /**
-* Shared API contract for dsh-skill-hub: the route paths and payload shapes
-* both the host half and the browser half import. The browser half must never
-* depend on host SDK packages, so registry types are re-spelled here as
-* plain JSON-safe interfaces.
+* GitHub repository skill discovery/import helpers.
+*
+* Kept dependency-free and mostly pure so the root/origin rules are easy to
+* test. The two supported roots mirror the repositories we care about:
+* `skills/**` (standard skill bundles) and `design-templates/**` (template
+* skill bundles in nexu-io/open-design).
 */
-/** Browser-facing base paths of the skill-hub API family. */
-const SKILL_HUB_API = {
-	catalog: "/api/skill-hub/catalog",
-	skill: "/api/skill-hub/skill",
-	toggle: "/api/skill-hub/toggle",
-	create: "/api/skill-hub/create",
-	stats: "/api/skill-hub/stats",
-	config: "/api/skill-hub/config"
+/** Fetch failure carrying a useful HTTP status for the route layer. */
+var RepoFetchError = class extends Error {
+	status;
+	constructor(message, status = 502) {
+		super(message);
+		this.name = "RepoFetchError";
+		this.status = status;
+	}
 };
-//#endregion
-//#region src/routes.ts
-/** Cap on JSON request bodies (toggle/create payloads are tiny). */
-const MAX_JSON_BODY_BYTES = 64 * 1024;
-/** Loopback literal check plus browser same-origin markers. */
-function isLoopbackRequest(request) {
-	const address = request.socket.remoteAddress;
-	if (address !== "127.0.0.1" && address !== "::1" && address !== "::ffff:127.0.0.1") return false;
-	const host = request.headers.host;
-	if (typeof host !== "string") return false;
-	let hostUrl;
+/**
+* GitHub token for authenticated API calls. Read from GITHUB_TOKEN /
+* GH_TOKEN at module load; setGithubToken() overrides it at runtime (the
+* plugin config route calls it when a saved token exists).
+*/
+let githubToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? "";
+/** Authorization header for api.github.com / raw.githubusercontent.com calls. */
+function githubAuthHeaders() {
+	return githubToken === "" ? {} : { authorization: "Bearer " + githubToken };
+}
+/**
+* Build a RepoFetchError; when the response shows an exhausted rate limit,
+* report the reset time instead of a bare HTTP status.
+*/
+function fetchError(context, response, fallbackStatus = 502) {
+	const remaining = response.headers.get("x-ratelimit-remaining");
+	const reset = response.headers.get("x-ratelimit-reset");
+	if (response.status === 403 || response.status === 429) {
+		if (remaining === "0" && reset !== null) return new RepoFetchError("github rate limit reached (anonymous quota exhausted); retry after " + (/* @__PURE__ */ new Date(Number(reset) * 1e3)).toLocaleTimeString() + " or set GITHUB_TOKEN", 403);
+	}
+	return new RepoFetchError(context + " (HTTP " + response.status + ")", response.status === 404 ? 404 : fallbackStatus);
+}
+/** `owner/repo` slug for a parsed reference. */
+function repoSlug(ref) {
+	return `${ref.owner}/${ref.repo}`;
+}
+/**
+* Normalize a GitHub URL or `owner/repo`/`owner/repo@ref` input.
+* Only github.com URLs are accepted in v1.
+*/
+function normalizeRepoInput(input) {
+	let value = input.trim();
+	if (value === "") return null;
+	let ref;
+	const urlMatch = /^https?:\/\/github\.com\/([^/]+)\/([^/#?@]+)(?:\/tree\/([^/?#]+))?/.exec(value);
+	if (urlMatch !== null) {
+		value = `${urlMatch[1]}/${urlMatch[2]}`;
+		ref = urlMatch[3];
+	} else {
+		if (/^https?:\/\//.test(value)) return null;
+		const at = value.indexOf("@");
+		if (at !== -1) {
+			ref = value.slice(at + 1).trim();
+			value = value.slice(0, at).trim();
+		}
+	}
+	value = value.replace(/\.git$/, "").replace(/\/+$/, "");
+	const parts = value.split("/").filter(Boolean);
+	if (parts.length < 2) return null;
+	const owner = parts[0];
+	const repo = parts[1];
+	if (owner === "" || repo === "" || owner.includes("..") || repo.includes("..")) return null;
+	return {
+		owner,
+		repo,
+		...ref !== void 0 && ref !== "" ? { ref } : {}
+	};
+}
+/**
+* Load repo metadata and the recursive git tree at the given ref. The meta
+* request always resolves the default branch (used when ref is absent); the
+* tree is fetched at `ref ?? default_branch` so an explicit branch/tag scans
+* the exact same content a later download would fetch.
+*/
+async function loadRepoTree(repo, ref, fetchImpl = fetch) {
+	let metaResponse;
 	try {
-		hostUrl = new URL("http://" + host);
-	} catch {
-		return false;
+		metaResponse = await fetchImpl(`https://api.github.com/repos/${repo}`, { headers: {
+			accept: "application/vnd.github+json",
+			...githubAuthHeaders()
+		} });
+	} catch (error) {
+		throw new RepoFetchError("github request failed: " + (error instanceof Error ? error.message : String(error)));
 	}
-	if (hostUrl.hostname !== "127.0.0.1" && hostUrl.hostname !== "localhost" && hostUrl.hostname !== "[::1]") return false;
-	if (request.headers["sec-fetch-site"] === "cross-site") return false;
-	const origin = request.headers.origin;
-	if (origin === void 0) return true;
+	if (!metaResponse.ok) throw fetchError("github repo not found or unavailable", metaResponse);
+	let meta;
 	try {
-		return new URL(origin).host === hostUrl.host;
+		meta = await metaResponse.json();
 	} catch {
-		return false;
+		throw new RepoFetchError("invalid github repo response");
 	}
-}
-/** One JSON response. */
-function writeJson(res, status, body) {
-	const payload = JSON.stringify(body);
-	res.writeHead(status, {
-		"content-type": "application/json; charset=utf-8",
-		"referrer-policy": "no-referrer"
-	});
-	res.end(payload);
-}
-/** One JSON error response. */
-function writeError(res, status, error) {
-	writeJson(res, status, { error: error instanceof Error ? error.message : String(error) });
-}
-/** Read a JSON request body (undefined when too large or unparseable). */
-async function readJsonBody(req) {
-	const chunks = [];
-	let size = 0;
-	for await (const chunk of req) {
-		const buffer = chunk;
-		size += buffer.length;
-		if (size > MAX_JSON_BODY_BYTES) return void 0;
-		chunks.push(buffer);
+	const record = typeof meta === "object" && meta !== null ? meta : {};
+	const defaultBranch = typeof record.default_branch === "string" && record.default_branch !== "" ? record.default_branch : "main";
+	const treeRef = ref !== void 0 && ref !== "" ? ref : defaultBranch;
+	let treeResponse;
+	try {
+		treeResponse = await fetchImpl(`https://api.github.com/repos/${repo}/git/trees/${encodeURIComponent(treeRef)}?recursive=1`, { headers: {
+			accept: "application/vnd.github+json",
+			...githubAuthHeaders()
+		} });
+	} catch (error) {
+		throw new RepoFetchError("github tree request failed: " + (error instanceof Error ? error.message : String(error)));
 	}
+	if (!treeResponse.ok) throw fetchError("github tree not found", treeResponse);
+	let payload;
 	try {
-		const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+		payload = await treeResponse.json();
 	} catch {
-		return;
+		throw new RepoFetchError("invalid github tree response");
+	}
+	const treeRecord = typeof payload === "object" && payload !== null ? payload : {};
+	if (treeRecord.truncated === true) throw new RepoFetchError("repo tree is too large to scan");
+	return {
+		ref: treeRef,
+		tree: Array.isArray(treeRecord.tree) ? treeRecord.tree : []
+	};
+}
+/** Collect every file inside a skill directory, including SKILL.md itself. */
+function collectRepoSkillFiles(tree, dir) {
+	const prefix = dir + "/";
+	return tree.filter((item) => item.type === "blob" && item.path.startsWith(prefix)).map((item) => ({
+		path: item.path,
+		size: typeof item.size === "number" ? item.size : 0
+	})).sort((a, b) => a.path.localeCompare(b.path));
+}
+/** Compute an origin collection name. Multiple roots split by root, one root keeps the repo slug. */
+function originForRoot(repo, rootsPresent, root) {
+	return rootsPresent.size > 1 ? `${repo}/${root}` : repo;
+}
+/** Discover importable skills from a repo tree. Invalid names are ignored. */
+function discoverRepoEntries(tree, repo, existingNames = /* @__PURE__ */ new Set()) {
+	const candidates = [];
+	const rootsPresent = /* @__PURE__ */ new Set();
+	for (const item of tree) {
+		if (item.type !== "blob") continue;
+		const match = /^(skills|design-templates)\/(.+)\/SKILL\.md$/.exec(item.path);
+		if (match === null) continue;
+		const root = match[1];
+		const dir = item.path.slice(0, -9);
+		const name = dir.slice(dir.lastIndexOf("/") + 1);
+		if (!isSkillName(name)) continue;
+		rootsPresent.add(root);
+		candidates.push({
+			root,
+			dir,
+			name,
+			path: item.path
+		});
+	}
+	return candidates.map((candidate) => {
+		const files = collectRepoSkillFiles(tree, candidate.dir);
+		return {
+			name: candidate.name,
+			dir: candidate.dir,
+			path: candidate.path,
+			root: candidate.root,
+			origin: originForRoot(repo, rootsPresent, candidate.root),
+			fileCount: files.length,
+			totalBytes: files.reduce((sum, file) => sum + file.size, 0),
+			existing: existingNames.has(candidate.name)
+		};
+	}).sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Run an async worker over items with a bounded concurrency. */
+async function mapConcurrent(items, limit, worker) {
+	const results = new Array(items.length);
+	let cursor = 0;
+	const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
+		while (cursor < items.length) {
+			const index = cursor;
+			cursor += 1;
+			results[index] = await worker(items[index], index);
+		}
+	});
+	await Promise.all(runners);
+	return results;
+}
+/**
+* Download one GitHub file as a buffer. Tries raw.githubusercontent.com
+* first (no API quota); on any failure falls back to the api.github.com
+* contents endpoint with the raw media type (rate-limited, but reachable
+* from networks that block the raw host).
+*/
+async function downloadGitHubFile(repo, ref, path, fetchImpl = fetch) {
+	const encodedPath = path.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+	const rawUrl = `https://raw.githubusercontent.com/${repo}/${encodeURIComponent(ref)}/${encodedPath}`;
+	let firstError = null;
+	let response = null;
+	try {
+		response = await fetchImpl(rawUrl, { headers: githubAuthHeaders() });
+	} catch (error) {
+		firstError = error instanceof Error ? error.message : String(error);
+	}
+	if (response === null || !response.ok) {
+		const apiUrl = `https://api.github.com/repos/${repo}/contents/${encodedPath}`;
+		try {
+			response = await fetchImpl(apiUrl, { headers: {
+				accept: "application/vnd.github.raw",
+				...githubAuthHeaders()
+			} });
+		} catch (error) {
+			throw new RepoFetchError("download failed: " + (firstError ?? (error instanceof Error ? error.message : String(error))));
+		}
+	}
+	if (response === null || !response.ok) throw fetchError("download failed", response);
+	try {
+		return Buffer.from(await response.arrayBuffer());
+	} catch (error) {
+		throw new RepoFetchError("download read failed: " + (error instanceof Error ? error.message : String(error)));
+	}
+}
+/**
+* Download a full skill directory into a temporary dir, validate SKILL.md,
+* then atomically rename it into place. The target root is created when missing.
+* Callers pass a target root and a skill entry plus its collected files.
+*/
+async function downloadRepoSkill(repo, ref, entry, files, targetRoot, fetchImpl = fetch) {
+	const targetDir = join(targetRoot, entry.name);
+	await mkdir(targetRoot, { recursive: true });
+	const tempDir = await mkdtemp(join(targetRoot, "." + entry.name + ".import-"));
+	try {
+		await mapConcurrent(files, 6, async (file) => {
+			const relative = file.path.slice(entry.dir.length + 1);
+			if (relative === "" || relative.includes("..")) throw new RepoFetchError("unsafe repo path: " + file.path);
+			const target = join(tempDir, relative);
+			const buffer = await downloadGitHubFile(repo, ref, file.path, fetchImpl);
+			await mkdir(dirname(target), { recursive: true });
+			await writeFile(target, buffer);
+		});
+		let text;
+		try {
+			text = await readFile(join(tempDir, "SKILL.md"), "utf8");
+		} catch {
+			throw new RepoFetchError("downloaded skill has no SKILL.md");
+		}
+		const parsed = parseFrontmatter(text);
+		if ("error" in parsed) throw new RepoFetchError("downloaded skill rejected: " + parsed.error, 422);
+		if (parsed.value.name !== entry.name) throw new RepoFetchError("downloaded skill declares name \"" + parsed.value.name + "\", expected \"" + entry.name + "\"", 422);
+		await rename(tempDir, targetDir);
+		return {
+			targetDir,
+			skillPath: join(targetDir, "SKILL.md")
+		};
+	} catch (error) {
+		await rm(tempDir, {
+			recursive: true,
+			force: true
+		}).catch(async () => {
+			await new Promise((resolve) => setTimeout(resolve, 60));
+			await rm(tempDir, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+		});
+		throw error;
+	}
+}
+/**
+* The latest non-prerelease release tag of a repo, or undefined when the
+* repo has no releases (GitHub's /releases/latest skips prereleases/drafts).
+*/
+async function getLatestReleaseTag(repo, fetchImpl = fetch) {
+	let response;
+	try {
+		response = await fetchImpl(`https://api.github.com/repos/${repo}/releases/latest`, { headers: {
+			accept: "application/vnd.github+json",
+			...githubAuthHeaders()
+		} });
+	} catch (error) {
+		throw new RepoFetchError("github release request failed: " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (response.status === 404) return void 0;
+	if (!response.ok) throw fetchError("github release lookup failed", response);
+	let payload;
+	try {
+		payload = await response.json();
+	} catch {
+		throw new RepoFetchError("invalid github release response");
+	}
+	const tag = typeof payload === "object" && payload !== null ? payload.tag_name : void 0;
+	return typeof tag === "string" && tag !== "" ? tag : void 0;
+}
+/** Branch names of a repo, default branch first (one GitHub API request). */
+async function listRepoBranches(repo, fetchImpl = fetch) {
+	let response;
+	try {
+		response = await fetchImpl(`https://api.github.com/repos/${repo}/branches?per_page=100`, { headers: {
+			accept: "application/vnd.github+json",
+			...githubAuthHeaders()
+		} });
+	} catch (error) {
+		throw new RepoFetchError("github branches request failed: " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (!response.ok) throw fetchError("github branches lookup failed", response);
+	let payload;
+	try {
+		payload = await response.json();
+	} catch {
+		throw new RepoFetchError("invalid github branches response");
+	}
+	if (!Array.isArray(payload)) return [];
+	return payload.map((item) => typeof item === "object" && item !== null ? item.name : void 0).filter((name) => typeof name === "string" && name !== "");
+}
+/**
+* Fetch the latest commit of a repo (explicit ref or default branch) with
+* its tree SHA. One GitHub API request; the tree SHA is used to diff the
+* upstream tree on change (one extra request).
+*/
+async function getLatestCommit(repo, ref, fetchImpl = fetch) {
+	const url = ref !== void 0 && ref !== "" ? `https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref)}` : `https://api.github.com/repos/${repo}/commits?per_page=1`;
+	let response;
+	try {
+		response = await fetchImpl(url, { headers: {
+			accept: "application/vnd.github+json",
+			...githubAuthHeaders()
+		} });
+	} catch (error) {
+		throw new RepoFetchError("github request failed: " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (!response.ok) throw fetchError("github commit lookup failed", response);
+	let payload;
+	try {
+		payload = await response.json();
+	} catch {
+		throw new RepoFetchError("invalid github commit response");
+	}
+	const record = Array.isArray(payload) ? payload[0] ?? {} : typeof payload === "object" && payload !== null ? payload : {};
+	const commitSha = typeof record.sha === "string" && record.sha !== "" ? record.sha : null;
+	const tree = typeof record.commit === "object" && record.commit !== null ? record.commit.tree : void 0;
+	const treeSha = typeof tree?.sha === "string" && tree.sha !== "" ? tree.sha : null;
+	if (commitSha === null || treeSha === null) throw new RepoFetchError("github commit response has no sha/tree");
+	return {
+		commitSha,
+		treeSha
+	};
+}
+/** Load the recursive git tree at an explicit tree SHA (one API request). */
+async function loadRepoTreeAt(repo, treeSha, fetchImpl = fetch) {
+	let response;
+	try {
+		response = await fetchImpl(`https://api.github.com/repos/${repo}/git/trees/${encodeURIComponent(treeSha)}?recursive=1`, { headers: {
+			accept: "application/vnd.github+json",
+			...githubAuthHeaders()
+		} });
+	} catch (error) {
+		throw new RepoFetchError("github tree request failed: " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (!response.ok) throw fetchError("github tree lookup failed", response);
+	let payload;
+	try {
+		payload = await response.json();
+	} catch {
+		throw new RepoFetchError("invalid github tree response");
+	}
+	const record = typeof payload === "object" && payload !== null ? payload : {};
+	if (record.truncated === true) throw new RepoFetchError("repo tree is too large to scan");
+	return Array.isArray(record.tree) ? record.tree : [];
+}
+/** Build a path→size manifest for one skill directory from a repo tree. */
+function skillManifest(tree, dir) {
+	const prefix = dir + "/";
+	const manifest = {};
+	for (const item of tree) if (item.type === "blob" && item.path.startsWith(prefix)) manifest[item.path] = typeof item.size === "number" ? item.size : 0;
+	return manifest;
+}
+/**
+* The real upstream directory of one tracked skill. Source records keep only
+* the short name and top-level root (e.g. root "skills", name "ask-matt"),
+* but upstream repos may nest skills under category directories
+* (skills/engineering/ask-matt/) or move them between categories. Resolution
+* order: exact match under the top-level root in the upstream tree, then the
+* manifest's recorded blob path, then any same-name skill in the tree, then
+* the flat root/name fallback. Passing the tree paths makes the lookup
+* resilient to incomplete manifests and upstream moves.
+*/
+function skillDirOf(source, name, treePaths) {
+	if (treePaths !== void 0) {
+		const rootPrefix = source.root + "/";
+		const found = treePaths.find((path) => path.startsWith(rootPrefix) && path.endsWith("/" + name + "/SKILL.md"));
+		if (found !== void 0) return found.slice(0, found.lastIndexOf("/"));
+	}
+	const manifest = source.manifest ?? {};
+	const fromManifest = Object.keys(manifest).find((path) => path.endsWith("/" + name + "/SKILL.md"));
+	if (fromManifest !== void 0) return fromManifest.slice(0, fromManifest.lastIndexOf("/"));
+	if (treePaths !== void 0) {
+		const found = treePaths.find((path) => path.endsWith("/" + name + "/SKILL.md"));
+		if (found !== void 0) return found.slice(0, found.lastIndexOf("/"));
+	}
+	return source.root + "/" + name;
+}
+/**
+* Diff one source record against an upstream tree at treeSha: which tracked
+* skills disappeared (no SKILL.md blob) and which changed (manifest baseline
+* differs, or no baseline exists — treated as changed). Pure over the tree.
+*/
+function diffRemoteSkills(tree, source) {
+	const blobs = /* @__PURE__ */ new Map();
+	for (const item of tree) if (item.type === "blob") blobs.set(item.path, typeof item.size === "number" ? item.size : 0);
+	const treePaths = [...blobs.keys()];
+	const updated = [];
+	const deleted = [];
+	for (const name of source.skills) {
+		const prefix = skillDirOf(source, name, treePaths) + "/";
+		const remote = /* @__PURE__ */ new Map();
+		for (const [path, size] of blobs) if (path.startsWith(prefix)) remote.set(path, size);
+		if (!remote.has(prefix + "SKILL.md")) {
+			deleted.push(name);
+			continue;
+		}
+		const baseline = source.manifest ?? {};
+		const baselineEntries = Object.entries(baseline).filter(([path]) => path.startsWith(prefix));
+		if (baselineEntries.length === 0) {
+			updated.push(name);
+			continue;
+		}
+		let differs = baselineEntries.length !== remote.size;
+		if (!differs) {
+			for (const [path, size] of baselineEntries) if (remote.get(path) !== size) {
+				differs = true;
+				break;
+			}
+		}
+		if (differs) updated.push(name);
+	}
+	return {
+		updated,
+		deleted
+	};
+}
+/** Minimal RepoSkillEntry for a tracked skill name (sync re-downloads by name). */
+function repoSkillEntry(name, root, repo) {
+	return {
+		name,
+		dir: root + "/" + name,
+		path: root + "/" + name + "/SKILL.md",
+		root,
+		origin: repo,
+		fileCount: 0,
+		totalBytes: 0,
+		existing: false
+	};
+}
+//#endregion
+//#region src/update.ts
+/**
+* Self-update check for dsh-skill-hub, mirroring cc-switch's behavior:
+* query GitHub's latest release and compare it to the installed version.
+*
+* This stays dependency-free: Node's global fetch is used and the version
+* comparison is a small semver-subset parser (the plugin only publishes
+* plain x.y.z tags, optionally prefixed with `v`).
+*/
+/** Repository checked for releases. Keep in sync with package.json. */
+const UPDATE_REPO = "cheshireez/dsh-skill-hub";
+const CURRENT_VERSION = createRequire(import.meta.url)("../package.json").version;
+/** Normalize a release tag (`v1.2.3` → `1.2.3`) and parse it numerically. */
+function parseVersion(tag) {
+	const match = /^[vV]?(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
+	if (match === null) return null;
+	return [
+		Number(match[1]),
+		Number(match[2]),
+		Number(match[3])
+	];
+}
+/** Compare two dotted version strings: negative when a < b, 0 equal, positive when a > b. */
+function compareVersions(a, b) {
+	const left = parseVersion(a);
+	const right = parseVersion(b);
+	if (left === null || right === null) return a.localeCompare(b, "en");
+	for (let i = 0; i < 3; i += 1) if (left[i] !== right[i]) return left[i] < right[i] ? -1 : 1;
+	return 0;
+}
+/** True when latest is strictly newer than current. */
+function isUpdateAvailable(currentVersion, latestVersion) {
+	return compareVersions(latestVersion, currentVersion) > 0;
+}
+/** Best-effort GitHub latest-release lookup. Always resolves with ok:true. */
+async function checkLatestRelease(repo = UPDATE_REPO, fetchImpl = fetch) {
+	const currentVersion = CURRENT_VERSION;
+	const url = `https://api.github.com/repos/${repo}/releases/latest`;
+	let response;
+	try {
+		response = await fetchImpl(url, { headers: {
+			accept: "application/vnd.github+json",
+			...githubAuthHeaders()
+		} });
+	} catch (error) {
+		return {
+			ok: true,
+			currentVersion,
+			latestVersion: null,
+			updateAvailable: false,
+			url: null,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+	if (response.status === 404) return {
+		ok: true,
+		currentVersion,
+		latestVersion: null,
+		updateAvailable: false,
+		url: null,
+		error: "no release published yet"
+	};
+	if (!response.ok) {
+		const remaining = response.headers.get("x-ratelimit-remaining");
+		const reset = response.headers.get("x-ratelimit-reset");
+		if ((response.status === 403 || response.status === 429) && remaining === "0" && reset !== null) return {
+			ok: true,
+			currentVersion,
+			latestVersion: null,
+			updateAvailable: false,
+			url: null,
+			error: "github rate limit reached; retry after " + (/* @__PURE__ */ new Date(Number(reset) * 1e3)).toLocaleTimeString() + " or set GITHUB_TOKEN"
+		};
+		return {
+			ok: true,
+			currentVersion,
+			latestVersion: null,
+			updateAvailable: false,
+			url: null,
+			error: "GitHub HTTP " + response.status
+		};
+	}
+	let payload;
+	try {
+		payload = await response.json();
+	} catch (error) {
+		return {
+			ok: true,
+			currentVersion,
+			latestVersion: null,
+			updateAvailable: false,
+			url: null,
+			error: error instanceof Error ? error.message : "invalid GitHub response"
+		};
+	}
+	const record = typeof payload === "object" && payload !== null ? payload : {};
+	const rawTag = typeof record.tag_name === "string" ? record.tag_name.trim() : "";
+	const parsed = parseVersion(rawTag);
+	if (parsed === null) return {
+		ok: true,
+		currentVersion,
+		latestVersion: null,
+		updateAvailable: false,
+		url: null,
+		error: "unsupported release tag: " + (rawTag || "missing")
+	};
+	const latestVersion = `${parsed[0]}.${parsed[1]}.${parsed[2]}`;
+	return {
+		ok: true,
+		currentVersion,
+		latestVersion,
+		updateAvailable: isUpdateAvailable(currentVersion, latestVersion),
+		url: typeof record.html_url === "string" ? record.html_url : null
+	};
+}
+//#endregion
+//#region src/routes.ts
+/**
+* The /api/skill-hub route family: full catalog (enabled skills from the
+* official registry + hub-disabled skills + discovery diagnostics), skill
+* detail, enable/disable toggle, new-skill scaffold, user groups (tags +
+* origin collections), and upstream source tracking (check/sync/follow
+* upstream deletion into a restorable trash). Every route carries a
+* loopback-only trust fence — these endpoints rename files under the user's
+* skill roots, so LAN-exposed dsh web deployments must not serve them.
+*
+* Every handler is declared through the local `route()` wrapper, which owns
+* the shared request fences (loopback trust, HTTP method, master switch,
+* JSON body) exactly once, so a new route cannot forget them.
+*/
+/** Cap on JSON request bodies (toggle/create payloads are tiny). */
+const MAX_JSON_BODY_BYTES = 64 * 1024;
+/** Minimum interval between network update checks per source (GitHub rate limits). */
+const MIN_CHECK_INTERVAL_MS = 5 * 6e4;
+/** Loopback literal check plus browser same-origin markers. */
+function isLoopbackRequest(request) {
+	const address = request.socket.remoteAddress;
+	if (address !== "127.0.0.1" && address !== "::1" && address !== "::ffff:127.0.0.1") return false;
+	const host = request.headers.host;
+	if (typeof host !== "string") return false;
+	let hostUrl;
+	try {
+		hostUrl = new URL("http://" + host);
+	} catch {
+		return false;
+	}
+	if (hostUrl.hostname !== "127.0.0.1" && hostUrl.hostname !== "localhost" && hostUrl.hostname !== "[::1]") return false;
+	if (request.headers["sec-fetch-site"] === "cross-site") return false;
+	const origin = request.headers.origin;
+	if (origin === void 0) return true;
+	try {
+		return new URL(origin).host === hostUrl.host;
+	} catch {
+		return false;
+	}
+}
+/** One JSON response. */
+function writeJson(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"referrer-policy": "no-referrer"
+	});
+	res.end(payload);
+}
+/** One JSON error response. */
+function writeError(res, status, error) {
+	writeJson(res, status, { error: error instanceof Error ? error.message : String(error) });
+}
+/** HTTP status per store business-rule kind (user error, not server fault). */
+const STORE_ERROR_STATUS = {
+	validation: 400,
+	"not-found": 404,
+	conflict: 409
+};
+/** Map known error types onto HTTP statuses: repo fetch + store business rules. */
+function writeRouteError(res, error) {
+	if (error instanceof RepoFetchError) {
+		writeError(res, error.status, error);
+		return;
+	}
+	if (error instanceof StoreError) {
+		writeError(res, STORE_ERROR_STATUS[error.kind], error);
+		return;
+	}
+	writeError(res, 500, error);
+}
+/** Read a JSON request body (undefined when too large or unparseable). */
+async function readJsonBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = chunk;
+		size += buffer.length;
+		if (size > MAX_JSON_BODY_BYTES) return void 0;
+		chunks.push(buffer);
+	}
+	try {
+		const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+	} catch {
+		return;
 	}
 }
 /** URL query helper (first value, decoded). */
@@ -566,16 +1700,22 @@ function queryParam(url, name) {
 	const value = url.searchParams.get(name);
 	return value === null ? void 0 : value;
 }
+/** Async existence check (import/sync use it on the user root). */
+async function pathExists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
 /** Sources the hub may toggle (the user-level filesystem roots). */
 function isWritableSource(source) {
 	return source === "user-dsh" || source === "user-agents";
 }
-/** The resolved hub config a route sees (defaults when the owner omits it). */
+/** The resolved hub config a route sees (the shared resolver fills defaults). */
 function configOf(deps) {
-	return deps.config?.() ?? {
-		enabled: true,
-		announceToAgent: true
-	};
+	return resolveHubConfig({}, deps.config?.() ?? {});
 }
 /** The raw saved config layer a route reports (empty when the owner omits it). */
 function savedOf(deps) {
@@ -591,28 +1731,111 @@ function disabledGate(deps, res) {
 function homeOf(deps) {
 	return deps.home ?? dshHome();
 }
+/**
+* Resolve a skill by name as something the hub may write, or the exact
+* refusal the caller should answer with. Owns the guard sequence shared by
+* toggle, toggle-batch, and skill/delete: registry lookup, writable source,
+* writable file, and path containment inside a user root.
+*/
+async function resolveWritableSkill(deps, name, cwd) {
+	const lookup = cwd !== void 0 && cwd !== "" ? { cwd } : void 0;
+	const skill = await deps.skills.get(name, lookup);
+	if (skill === void 0) return {
+		ok: false,
+		status: 404,
+		error: "skill not found: " + name
+	};
+	if (!isWritableSource(skill.source)) return {
+		ok: false,
+		status: 409,
+		error: "source \"" + skill.source + "\" is managed outside the hub (read-only)"
+	};
+	if (skill.path === void 0) return {
+		ok: false,
+		status: 409,
+		error: "provider-managed skill has no writable file"
+	};
+	const root = rootOfPath(skill.path, homeOf(deps));
+	if (root === void 0) return {
+		ok: false,
+		status: 409,
+		error: "skill path is outside the hub writable roots"
+	};
+	return {
+		ok: true,
+		skill,
+		path: skill.path,
+		root
+	};
+}
+/** 系统集合组 + 用户 tag + origin 映射（groups 路由的数据源）。 */
+async function buildGroups(deps) {
+	const [tags, origins] = await Promise.all([deps.store.listTags(), deps.store.listOrigins()]);
+	const byCollection = /* @__PURE__ */ new Map();
+	for (const [skillName, origin] of Object.entries(origins)) {
+		const list = byCollection.get(origin);
+		if (list === void 0) byCollection.set(origin, [skillName]);
+		else list.push(skillName);
+	}
+	return {
+		ok: true,
+		tags,
+		collections: [...byCollection.entries()].map(([name, skillNames]) => ({
+			name,
+			skillNames: [...skillNames].sort((a, b) => a.localeCompare(b))
+		})).sort((a, b) => a.name.localeCompare(b.name)),
+		origins
+	};
+}
+/** 目录中存在的技能名集合（tag 成员校验用）：启用目录 ∪ 已禁用名单，避免成员因禁用而丢失。 */
+async function knownSkillNames(deps) {
+	const snapshot = await deps.skills.snapshot();
+	const names = new Set(snapshot.skills.map((skill) => skill.name));
+	for (const disabled of await deps.store.listDisabled()) names.add(disabled.name);
+	return names;
+}
 /** Build the full catalog response (shared by catalog/toggle/create handlers). */
 async function buildCatalog(deps, cwd) {
 	const lookup = cwd !== void 0 ? { cwd } : void 0;
 	const snapshot = await deps.skills.snapshot(lookup);
-	const skills = await Promise.all(snapshot.skills.map(async (skill) => {
-		const sets = await readSets(deps, skill.name, lookup);
-		return {
+	const home = homeOf(deps);
+	const timesByName = /* @__PURE__ */ new Map();
+	await Promise.all(snapshot.skills.map(async (skill) => {
+		if (!isWritableSource(skill.source)) return;
+		const base = rootPath(skill.source, home);
+		for (const candidate of [
+			join(base, skill.name, "SKILL.md"),
+			join(base, skill.name),
+			join(base, skill.name + ".md")
+		]) try {
+			const times = await stat(candidate);
+			timesByName.set(skill.name, {
+				addedAt: times.birthtimeMs,
+				updatedAt: times.mtimeMs
+			});
+			return;
+		} catch {}
+	}));
+	const skills = snapshot.skills.map((skill) => {
+		const row = {
 			name: skill.name,
 			description: skill.description,
 			...skill.whenToUse !== void 0 ? { whenToUse: skill.whenToUse } : {},
-			...sets !== void 0 ? { sets } : {},
 			invocation: {
 				modelInvocable: skill.invocation.modelInvocable,
 				userInvocable: skill.invocation.userInvocable
 			},
-			source: skill.source,
 			provider: skill.provider,
 			writable: isWritableSource(skill.source)
 		};
-	}));
+		const times = timesByName.get(skill.name);
+		if (times !== void 0) {
+			row.addedAt = times.addedAt;
+			row.updatedAt = times.updatedAt;
+		}
+		return row;
+	});
 	const disabled = await deps.store.listDisabled();
-	const home = homeOf(deps);
 	const diagnostics = [...await scanDiagnostics("user-dsh", home), ...await scanDiagnostics("user-agents", home)];
 	return {
 		ok: true,
@@ -622,325 +1845,1130 @@ async function buildCatalog(deps, cwd) {
 		diagnostics
 	};
 }
-/** Read one skill's normalized `sets` (undefined when absent, unreadable, or empty). */
-async function readSets(deps, name, lookup) {
-	try {
-		return normalizeSets((await deps.skills.get(name, lookup))?.metadata?.sets);
-	} catch {
-		return;
-	}
-}
 /** Map a loaded definition onto the wire shape. */
 function toDetail(skill) {
-	const sets = normalizeSets(skill.metadata?.sets);
 	return {
 		name: skill.name,
 		description: skill.description,
 		...skill.whenToUse !== void 0 ? { whenToUse: skill.whenToUse } : {},
-		...sets !== void 0 ? { sets } : {},
 		invocation: {
 			modelInvocable: skill.invocation.modelInvocable,
 			userInvocable: skill.invocation.userInvocable
 		},
-		source: skill.source,
 		provider: skill.provider,
 		...skill.path !== void 0 ? { path: skill.path } : {},
 		content: skill.content
 	};
 }
+/** Last successful check time per repo (in-memory throttle for GitHub rate limits). */
+const lastSourceCheck = /* @__PURE__ */ new Map();
+/** Last successful market update check per repo (same throttle). */
+const lastMarketCheck = /* @__PURE__ */ new Map();
+/** Replace one skill directory with a fresh download; restores the old dir on failure. */
+async function replaceSkillDir(targetDir, download) {
+	const backup = join(dirname(targetDir), "." + basename(targetDir) + ".sync-bak-" + Date.now());
+	await rename(targetDir, backup);
+	try {
+		await download();
+	} catch (error) {
+		await rename(backup, targetDir).catch(() => {});
+		throw error;
+	}
+	await rm(backup, {
+		recursive: true,
+		force: true
+	});
+}
 /**
 * Build every /api/skill-hub route.
 * @param deps - skill registry view + sidecar store.
 * @returns the exact-path routes.
 */
 function makeRoutes(deps) {
+	/**
+	* Wrap one handler in the shared request fences. Order matches the
+	* original per-handler prologue: loopback trust → HTTP method → master
+	* switch → JSON body. The outer catch maps errors onto the JSON error
+	* body (preserving RepoFetchError status codes).
+	*/
+	const route = (spec) => ({
+		kind: "exact",
+		path: spec.path,
+		handler: async (req, res) => {
+			if (!isLoopbackRequest(req)) {
+				writeError(res, 403, "forbidden: loopback-only");
+				return;
+			}
+			if (!spec.methods.includes(req.method)) {
+				writeError(res, 405, "method not allowed: " + (req.method ?? ""));
+				return;
+			}
+			if (spec.skipGate !== true && disabledGate(deps, res)) return;
+			const url = new URL(req.url ?? "/", "http://localhost");
+			let body = {};
+			if (spec.jsonBody === true && req.method === "POST") {
+				const parsed = await readJsonBody(req);
+				if (parsed === void 0) {
+					writeError(res, 400, "invalid JSON body");
+					return;
+				}
+				body = parsed;
+			}
+			try {
+				await spec.handler({
+					req,
+					res,
+					url,
+					body
+				});
+			} catch (error) {
+				writeRouteError(res, error);
+			}
+		}
+	});
 	return [
-		{
-			kind: "exact",
+		route({
 			path: SKILL_HUB_API.catalog,
-			handler: async (req, res) => {
-				if (!isLoopbackRequest(req)) {
-					writeError(res, 403, "forbidden: loopback-only");
+			methods: ["GET"],
+			handler: async ({ res, url }) => {
+				writeJson(res, 200, await buildCatalog(deps, queryParam(url, "cwd")));
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.skill,
+			methods: ["GET"],
+			handler: async ({ res, url }) => {
+				const name = queryParam(url, "name");
+				if (name === void 0 || name === "") {
+					writeError(res, 400, "name query parameter is required");
+					return;
+				}
+				const cwd = queryParam(url, "cwd");
+				const skill = await deps.skills.get(name, cwd !== void 0 ? { cwd } : void 0);
+				if (skill === void 0) {
+					writeError(res, 404, "skill not found: " + name);
+					return;
+				}
+				const detail = toDetail(skill);
+				if (skill.path !== void 0) try {
+					const times = await stat(skill.path);
+					detail.addedAt = times.birthtimeMs;
+					detail.updatedAt = times.mtimeMs;
+				} catch {}
+				writeJson(res, 200, {
+					ok: true,
+					skill: detail
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.skillDelete,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const name = typeof request.name === "string" ? request.name : "";
+				if (name === "") {
+					writeError(res, 400, "name is required");
+					return;
+				}
+				const resolved = await resolveWritableSkill(deps, name, typeof request.cwd === "string" ? request.cwd : void 0);
+				if (!resolved.ok) {
+					writeError(res, resolved.status, resolved.error);
+					return;
+				}
+				const tracked = await deps.store.getSourceForSkill(name);
+				const tagIds = (await deps.store.listTags()).filter((tag) => tag.skillNames.includes(name)).map((tag) => tag.id);
+				const { path, source } = await trashSkill(resolved.path);
+				await deps.store.addTrash({
+					name,
+					path,
+					movedAt: Date.now(),
+					sourcePath: source,
+					...tracked !== void 0 ? { origin: {
+						repo: tracked.repo,
+						root: tracked.root,
+						...tracked.ref !== void 0 && tracked.ref !== "" ? { ref: tracked.ref } : {},
+						commitSha: tracked.commitSha
+					} } : {},
+					...tagIds.length > 0 ? { tagIds } : {}
+				});
+				await deps.store.removeDisabled(name);
+				await deps.store.removeSkillFromSources(name);
+				await deps.store.removeSkillFromTags(name);
+				deps.invalidate?.();
+				writeJson(res, 200, {
+					ok: true,
+					name,
+					path
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.toggle,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const name = typeof request.name === "string" ? request.name : "";
+				if (name === "") {
+					writeError(res, 400, "name is required");
+					return;
+				}
+				const lookup = typeof request.cwd === "string" && request.cwd !== "" ? { cwd: request.cwd } : void 0;
+				if (request.enabled === true) {
+					const record = await deps.store.getDisabled(name);
+					if (record === void 0) {
+						writeError(res, 404, "skill is not hub-disabled: " + name);
+						return;
+					}
+					try {
+						await enableSkill(record.path);
+					} catch (error) {
+						if (error.code === "ENOENT") {
+							writeError(res, 409, "disabled skill file is missing on disk: " + record.path);
+							return;
+						}
+						throw error;
+					}
+					await deps.store.removeDisabled(name);
+				} else {
+					const resolved = await resolveWritableSkill(deps, name, typeof request.cwd === "string" ? request.cwd : void 0);
+					if (!resolved.ok) {
+						writeError(res, resolved.status, resolved.error);
+						return;
+					}
+					const disabledPath = await disableSkill(resolved.path);
+					await deps.store.addDisabled({
+						name,
+						description: resolved.skill.description,
+						path: disabledPath,
+						root: resolved.root,
+						disabledAt: Date.now()
+					});
+				}
+				deps.invalidate?.();
+				writeJson(res, 200, {
+					ok: true,
+					catalog: await buildCatalog(deps, lookup?.cwd)
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.toggleBatch,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const names = Array.isArray(request.names) ? request.names.filter((n) => typeof n === "string" && n !== "") : [];
+				if (names.length === 0) {
+					writeError(res, 400, "names must be a non-empty array");
+					return;
+				}
+				const enabled = request.enabled === true;
+				const lookup = typeof request.cwd === "string" && request.cwd !== "" ? { cwd: request.cwd } : void 0;
+				const failures = [];
+				for (const name of names) try {
+					if (enabled) {
+						const record = await deps.store.getDisabled(name);
+						if (record === void 0) continue;
+						await enableSkill(record.path);
+						await deps.store.removeDisabled(name);
+					} else {
+						const resolved = await resolveWritableSkill(deps, name, typeof request.cwd === "string" ? request.cwd : void 0);
+						if (!resolved.ok) {
+							failures.push({
+								name,
+								error: resolved.error
+							});
+							continue;
+						}
+						const disabledPath = await disableSkill(resolved.path);
+						await deps.store.addDisabled({
+							name,
+							description: resolved.skill.description,
+							path: disabledPath,
+							root: resolved.root,
+							disabledAt: Date.now()
+						});
+					}
+				} catch (error) {
+					failures.push({
+						name,
+						error: error instanceof Error ? error.message : String(error)
+					});
+				}
+				deps.invalidate?.();
+				writeJson(res, 200, {
+					ok: true,
+					catalog: await buildCatalog(deps, lookup?.cwd),
+					failures
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.create,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const name = typeof request.name === "string" ? request.name.trim() : "";
+				if (!isSkillName(name)) {
+					writeError(res, 400, "skill name must be kebab-case (lowercase letters, digits, dashes)");
+					return;
+				}
+				const root = request.root ?? "user-dsh";
+				if (root !== "user-dsh" && root !== "user-agents") {
+					writeError(res, 400, "root must be user-dsh or user-agents");
+					return;
+				}
+				if (await deps.skills.get(name) !== void 0) {
+					writeError(res, 409, "skill name already exists: " + name);
+					return;
+				}
+				if (await deps.store.getDisabled(name) !== void 0) {
+					writeError(res, 409, "skill name is disabled: re-enable it from the disabled list first");
+					return;
+				}
+				if (await pathExists(join(rootPath(root, homeOf(deps)), name))) {
+					writeError(res, 409, "skill directory already exists on disk: " + name + " (check the discovery diagnostics)");
+					return;
+				}
+				const path = await createSkill(root, name, typeof request.description === "string" ? request.description : "", homeOf(deps));
+				const defaultTag = await deps.store.getDefaultTag();
+				if (defaultTag !== void 0) await deps.store.addSkillToTag(defaultTag.id, name);
+				deps.invalidate?.();
+				writeJson(res, 201, {
+					ok: true,
+					path,
+					root
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.stats,
+			methods: ["GET"],
+			handler: async ({ res }) => {
+				if (deps.stats === void 0) {
+					writeJson(res, 200, {
+						ok: true,
+						available: false,
+						stats: []
+					});
+					return;
+				}
+				writeJson(res, 200, {
+					ok: true,
+					available: true,
+					stats: await deps.stats()
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.config,
+			methods: ["GET", "POST"],
+			jsonBody: true,
+			skipGate: true,
+			handler: async ({ req, res, body }) => {
+				if (req.method === "GET") {
+					writeJson(res, 200, {
+						ok: true,
+						config: configOf(deps),
+						saved: savedOf(deps)
+					});
+					return;
+				}
+				const raw = body;
+				const patch = {};
+				if (raw.enabled !== void 0) if (raw.enabled === null) patch.enabled = void 0;
+				else if (typeof raw.enabled !== "boolean") {
+					writeError(res, 400, "enabled must be a boolean or null");
+					return;
+				} else patch.enabled = raw.enabled;
+				if (raw.announceToAgent !== void 0) if (raw.announceToAgent === null) patch.announceToAgent = void 0;
+				else if (typeof raw.announceToAgent !== "boolean") {
+					writeError(res, 400, "announceToAgent must be a boolean or null");
+					return;
+				} else patch.announceToAgent = raw.announceToAgent;
+				for (const key of [
+					"showUseCount",
+					"showUseTime",
+					"showGroupSummary"
+				]) {
+					const value = raw[key];
+					if (value === void 0) continue;
+					if (value === null) {
+						patch[key] = void 0;
+						continue;
+					}
+					if (typeof value !== "boolean") {
+						writeError(res, 400, key + " must be a boolean or null");
+						return;
+					}
+					patch[key] = value;
+				}
+				for (const key of ["dotModelColor", "dotUserColor"]) {
+					const value = raw[key];
+					if (value === void 0) continue;
+					if (value === null) {
+						patch[key] = void 0;
+						continue;
+					}
+					if (typeof value !== "string" || !HEX_COLOR_RE.test(value)) {
+						writeError(res, 400, key + " must be a #rrggbb color or null");
+						return;
+					}
+					patch[key] = value;
+				}
+				let config;
+				if (deps.updateConfig === void 0) {
+					const merged = { ...configOf(deps) };
+					for (const [key, value] of Object.entries(patch)) if (value === void 0) delete merged[key];
+					else merged[key] = value;
+					config = merged;
+				} else config = await deps.updateConfig(patch);
+				writeJson(res, 200, {
+					ok: true,
+					config,
+					saved: savedOf(deps)
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.market,
+			methods: ["GET"],
+			handler: async ({ res }) => {
+				writeJson(res, 200, {
+					ok: true,
+					repos: await deps.store.listMarketSources()
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.marketSource,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const parsed = normalizeRepoInput(typeof request.repo === "string" ? request.repo.trim() : "");
+				if (parsed === null) {
+					writeError(res, 400, "repo must be owner/repo or a github.com URL");
 					return;
 				}
-				if (req.method !== "GET") {
-					writeError(res, 405, "method not allowed: " + (req.method ?? ""));
+				const ref = parsed.ref !== void 0 ? parsed.ref : void 0;
+				writeJson(res, 200, {
+					ok: true,
+					repos: await deps.store.addMarketSource(repoSlug(parsed), ref)
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.marketSourceDelete,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const parsed = normalizeRepoInput(typeof request.repo === "string" ? request.repo.trim() : "");
+				if (parsed === null) {
+					writeError(res, 400, "repo must be owner/repo or a github.com URL");
 					return;
 				}
-				if (disabledGate(deps, res)) return;
-				try {
-					writeJson(res, 200, await buildCatalog(deps, queryParam(new URL(req.url ?? "/", "http://localhost"), "cwd")));
-				} catch (error) {
-					writeError(res, 500, error);
+				writeJson(res, 200, {
+					ok: true,
+					repos: await deps.store.removeMarketSource(repoSlug(parsed))
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.marketSourceRef,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const parsed = normalizeRepoInput(typeof request.repo === "string" ? request.repo : "");
+				const ref = typeof request.ref === "string" ? request.ref.trim() : "";
+				if (parsed === null) {
+					writeError(res, 400, "repo must be owner/repo or a github.com URL");
+					return;
+				}
+				if (ref === "") {
+					writeError(res, 400, "ref is required");
+					return;
+				}
+				if (await deps.store.setMarketSourceRef(repoSlug(parsed), ref) === void 0) {
+					writeError(res, 404, "market source not found: " + repoSlug(parsed));
+					return;
 				}
+				writeJson(res, 200, {
+					ok: true,
+					repos: await deps.store.listMarketSources()
+				});
 			}
-		},
-		{
-			kind: "exact",
-			path: SKILL_HUB_API.skill,
-			handler: async (req, res) => {
-				if (!isLoopbackRequest(req)) {
-					writeError(res, 403, "forbidden: loopback-only");
+		}),
+		route({
+			path: SKILL_HUB_API.marketCheck,
+			methods: ["GET"],
+			handler: async ({ res }) => {
+				const sources = await deps.store.listMarketSources();
+				if (lastMarketCheck.size > 500) lastMarketCheck.clear();
+				const results = [];
+				for (const source of sources) {
+					const base = {
+						repo: source.repo,
+						...source.ref !== void 0 ? { ref: source.ref } : {}
+					};
+					const now = Date.now();
+					if (now - (lastMarketCheck.get(source.repo) ?? 0) < MIN_CHECK_INTERVAL_MS) {
+						results.push({
+							...base,
+							updateAvailable: false,
+							commitSha: source.commitSha ?? "",
+							throttled: true
+						});
+						continue;
+					}
+					try {
+						const latestTag = await getLatestReleaseTag(source.repo);
+						if (source.ref === void 0) {
+							results.push({
+								...base,
+								updateAvailable: false,
+								commitSha: source.commitSha ?? "",
+								...latestTag !== void 0 ? { latestTag } : {}
+							});
+							continue;
+						}
+						const latest = await getLatestCommit(source.repo, source.ref);
+						lastMarketCheck.set(source.repo, now);
+						const commitMoved = source.commitSha !== void 0 && latest.commitSha !== source.commitSha;
+						const newRelease = latestTag !== void 0 && latestTag !== source.ref;
+						results.push({
+							...base,
+							updateAvailable: commitMoved || newRelease,
+							commitSha: latest.commitSha,
+							...newRelease ? { latestTag } : {}
+						});
+					} catch (error) {
+						results.push({
+							...base,
+							updateAvailable: false,
+							commitSha: source.commitSha ?? "",
+							error: error instanceof Error ? error.message : String(error)
+						});
+					}
+				}
+				writeJson(res, 200, {
+					ok: true,
+					results
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.marketSync,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const parsed = normalizeRepoInput(typeof request.repo === "string" ? request.repo : "");
+				if (parsed === null) {
+					writeError(res, 400, "repo must be owner/repo or a github.com URL");
 					return;
 				}
-				if (req.method !== "GET") {
-					writeError(res, 405, "method not allowed: " + (req.method ?? ""));
+				const repo = repoSlug(parsed);
+				const source = await deps.store.getMarketSource(repo);
+				if (source === void 0) {
+					writeError(res, 404, "market source not found: " + repo);
 					return;
 				}
-				if (disabledGate(deps, res)) return;
-				const url = new URL(req.url ?? "/", "http://localhost");
-				const name = queryParam(url, "name");
-				if (name === void 0 || name === "") {
-					writeError(res, 400, "name query parameter is required");
+				let ref = source.ref;
+				if (ref === void 0 || ref === "") {
+					const latestTag = await getLatestReleaseTag(repo);
+					if (latestTag === void 0) {
+						writeError(res, 409, "repo has no release — pick a branch first");
+						return;
+					}
+					ref = latestTag;
+					await deps.store.setMarketSourceRef(repo, ref);
+				}
+				const latest = await getLatestCommit(repo, ref);
+				await deps.store.setMarketSourceCommit(repo, latest.commitSha);
+				await deps.store.setSourceRef(repo, ref);
+				const tracked = await deps.store.getSource(repo);
+				writeJson(res, 200, {
+					ok: true,
+					repo,
+					ref,
+					commitSha: latest.commitSha,
+					skills: tracked !== void 0 ? [...tracked.skills] : []
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.repo,
+			methods: ["GET"],
+			handler: async ({ res, url }) => {
+				const parsed = normalizeRepoInput(queryParam(url, "repo") ?? "");
+				if (parsed === null) {
+					writeError(res, 400, "repo must be owner/repo or a github.com URL");
 					return;
 				}
-				const cwd = queryParam(url, "cwd");
-				try {
-					const skill = await deps.skills.get(name, cwd !== void 0 ? { cwd } : void 0);
-					if (skill === void 0) {
-						writeError(res, 404, "skill not found: " + name);
+				const repo = repoSlug(parsed);
+				let ref = parsed.ref;
+				if (ref === void 0 || ref === "") {
+					const pinned = await deps.store.getMarketSource(repo);
+					if (pinned?.ref !== void 0 && pinned.ref !== "") ref = pinned.ref;
+				}
+				if (ref === void 0 || ref === "") {
+					const releaseTag = await getLatestReleaseTag(repo);
+					if (releaseTag !== void 0) ref = releaseTag;
+					else {
+						const branches = await listRepoBranches(repo);
+						if (branches.length === 0) {
+							writeError(res, 404, "repo has no branches to scan");
+							return;
+						}
+						writeJson(res, 200, {
+							ok: true,
+							repo,
+							ref: null,
+							branches,
+							entries: []
+						});
 						return;
 					}
-					writeJson(res, 200, {
-						ok: true,
-						skill: toDetail(skill)
-					});
-				} catch (error) {
-					writeError(res, 500, error);
 				}
+				const { ref: resolvedRef, tree } = await loadRepoTree(repo, ref);
+				writeJson(res, 200, {
+					ok: true,
+					repo,
+					ref: resolvedRef,
+					entries: discoverRepoEntries(tree, repo, await knownSkillNames(deps))
+				});
 			}
-		},
-		{
-			kind: "exact",
-			path: SKILL_HUB_API.toggle,
-			handler: async (req, res) => {
-				if (!isLoopbackRequest(req)) {
-					writeError(res, 403, "forbidden: loopback-only");
+		}),
+		route({
+			path: SKILL_HUB_API.repoImport,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const input = typeof request.repo === "string" ? request.repo.trim() : "";
+				const paths = Array.isArray(request.paths) ? request.paths.filter((path) => typeof path === "string" && path !== "") : [];
+				if (paths.length === 0) {
+					writeError(res, 400, "paths must be a non-empty array");
 					return;
 				}
-				if (req.method !== "POST") {
-					writeError(res, 405, "method not allowed: " + (req.method ?? ""));
+				const parsed = normalizeRepoInput(input);
+				if (parsed === null) {
+					writeError(res, 400, "repo must be owner/repo or a github.com URL");
 					return;
 				}
-				if (disabledGate(deps, res)) return;
-				const raw = await readJsonBody(req);
-				if (raw === void 0) {
-					writeError(res, 400, "invalid JSON body");
+				const repo = repoSlug(parsed);
+				const { ref: resolvedRef, tree } = await loadRepoTree(repo, typeof request.ref === "string" && request.ref !== "" ? request.ref : parsed.ref);
+				const entries = discoverRepoEntries(tree, repo, await knownSkillNames(deps));
+				const byPath = new Map(entries.map((entry) => [entry.path, entry]));
+				const selected = paths.map((path) => byPath.get(path)).filter((entry) => entry !== void 0);
+				if (selected.length > 500) {
+					writeError(res, 400, "select at most 500 skills per import");
 					return;
 				}
-				const request = raw;
-				const name = typeof request.name === "string" ? request.name : "";
-				if (name === "") {
-					writeError(res, 400, "name is required");
+				if (selected.reduce((sum, entry) => sum + entry.totalBytes, 0) > 200 * 1024 * 1024) {
+					writeError(res, 400, "selected skills exceed the 200MB import limit");
 					return;
 				}
-				const lookup = typeof request.cwd === "string" && request.cwd !== "" ? { cwd: request.cwd } : void 0;
+				let commitSha = "";
 				try {
-					if (request.enabled === true) {
-						const record = await deps.store.getDisabled(name);
-						if (record === void 0) {
-							writeError(res, 404, "skill is not hub-disabled: " + name);
-							return;
-						}
-						await enableSkill(record.path);
-						await deps.store.removeDisabled(name);
-					} else {
-						const skill = await deps.skills.get(name, lookup);
-						if (skill === void 0) {
-							writeError(res, 404, "skill not found: " + name);
-							return;
-						}
-						if (!isWritableSource(skill.source)) {
-							writeError(res, 409, "source \"" + skill.source + "\" is managed outside the hub (read-only)");
-							return;
-						}
-						if (skill.path === void 0) {
-							writeError(res, 409, "provider-managed skill has no writable file");
-							return;
-						}
-						const root = rootOfPath(skill.path, homeOf(deps));
-						if (root === void 0) {
-							writeError(res, 409, "skill path is outside the hub writable roots");
-							return;
-						}
-						const disabledPath = await disableSkill(skill.path);
-						await deps.store.addDisabled({
-							name,
-							description: skill.description,
-							path: disabledPath,
-							root,
-							disabledAt: Date.now()
+					commitSha = (await getLatestCommit(repo, resolvedRef)).commitSha;
+				} catch {}
+				const imported = [];
+				const skipped = [];
+				const failed = [];
+				const targetRoot = rootPath("user-dsh", homeOf(deps));
+				await mkdir(targetRoot, { recursive: true });
+				const defaultTag = await deps.store.getDefaultTag();
+				for (const entry of selected) {
+					if (entry.existing) {
+						skipped.push({
+							name: entry.name,
+							reason: "exists"
+						});
+						continue;
+					}
+					if (await pathExists(join(targetRoot, entry.name))) {
+						skipped.push({
+							name: entry.name,
+							reason: "exists"
+						});
+						continue;
+					}
+					const files = collectRepoSkillFiles(tree, entry.dir);
+					try {
+						const result = await downloadRepoSkill(repo, resolvedRef, entry, files, targetRoot);
+						await deps.store.addSourceSkill(repo, entry.root, commitSha, resolvedRef, entry.name);
+						await deps.store.mergeSourceManifest(repo, skillManifest(tree, entry.dir), entry.dir);
+						if (defaultTag !== void 0) await deps.store.addSkillToTag(defaultTag.id, entry.name);
+						imported.push({
+							name: entry.name,
+							origin: entry.origin,
+							path: result.skillPath
+						});
+					} catch (error) {
+						failed.push({
+							name: entry.name,
+							error: error instanceof Error ? error.message : String(error)
 						});
 					}
-					deps.invalidate?.();
-					writeJson(res, 200, {
-						ok: true,
-						catalog: await buildCatalog(deps, lookup?.cwd)
-					});
-				} catch (error) {
-					writeError(res, 500, error);
 				}
+				deps.invalidate?.();
+				writeJson(res, 200, {
+					ok: true,
+					imported,
+					skipped,
+					failed
+				});
 			}
-		},
-		{
-			kind: "exact",
-			path: SKILL_HUB_API.create,
-			handler: async (req, res) => {
-				if (!isLoopbackRequest(req)) {
-					writeError(res, 403, "forbidden: loopback-only");
+		}),
+		route({
+			path: SKILL_HUB_API.update,
+			methods: ["GET"],
+			handler: async ({ res }) => {
+				writeJson(res, 200, await checkLatestRelease());
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.groups,
+			methods: ["GET"],
+			handler: async ({ res }) => {
+				writeJson(res, 200, await buildGroups(deps));
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.tag,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const name = typeof body.name === "string" ? body.name.trim() : "";
+				if (name === "") {
+					writeError(res, 400, "tag name is required");
 					return;
 				}
-				if (req.method !== "POST") {
-					writeError(res, 405, "method not allowed: " + (req.method ?? ""));
+				const id = typeof body.id === "string" && body.id !== "" ? body.id : void 0;
+				await deps.store.saveTag({
+					id,
+					name
+				});
+				writeJson(res, 200, {
+					ok: true,
+					tags: await deps.store.listTags()
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.tagDelete,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const id = typeof body.id === "string" ? body.id : "";
+				if (id === "") {
+					writeError(res, 400, "tag id is required");
 					return;
 				}
-				if (disabledGate(deps, res)) return;
-				const raw = await readJsonBody(req);
-				if (raw === void 0) {
-					writeError(res, 400, "invalid JSON body");
+				if ((await deps.store.getTag(id))?.default === true) {
+					writeError(res, 409, "the default scene cannot be deleted");
 					return;
 				}
-				const request = raw;
-				const name = typeof request.name === "string" ? request.name.trim() : "";
-				if (!isSkillName(name)) {
-					writeError(res, 400, "skill name must be kebab-case (lowercase letters, digits, dashes)");
+				await deps.store.deleteTag(id);
+				writeJson(res, 200, {
+					ok: true,
+					tags: await deps.store.listTags()
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.tagMembers,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const id = typeof request.id === "string" ? request.id : "";
+				if (id === "") {
+					writeError(res, 400, "tag id is required");
 					return;
 				}
-				const root = request.root ?? "user-dsh";
-				if (root !== "user-dsh" && root !== "user-agents") {
-					writeError(res, 400, "root must be user-dsh or user-agents");
+				const names = Array.isArray(request.skillNames) ? request.skillNames.filter((n) => typeof n === "string") : [];
+				const known = await knownSkillNames(deps);
+				if (await deps.store.setTagMembers(id, names.filter((n) => known.has(n))) === void 0) {
+					writeError(res, 404, "tag not found: " + id);
 					return;
 				}
-				try {
-					if (await deps.skills.get(name) !== void 0) {
-						writeError(res, 409, "skill name already exists: " + name);
-						return;
-					}
-					const path = await createSkill(root, name, typeof request.description === "string" ? request.description : "", homeOf(deps));
-					deps.invalidate?.();
-					writeJson(res, 201, {
-						ok: true,
-						path,
-						root
-					});
-				} catch (error) {
-					writeError(res, 500, error);
+				writeJson(res, 200, {
+					ok: true,
+					tags: await deps.store.listTags()
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.sources,
+			methods: ["GET"],
+			handler: async ({ res }) => {
+				const [sources, origins, trash] = await Promise.all([
+					deps.store.listSources(),
+					deps.store.listOrigins(),
+					deps.store.listTrash()
+				]);
+				const byCollection = /* @__PURE__ */ new Map();
+				for (const [skillName, origin] of Object.entries(origins)) {
+					const list = byCollection.get(origin);
+					if (list === void 0) byCollection.set(origin, [skillName]);
+					else list.push(skillName);
 				}
+				writeJson(res, 200, {
+					ok: true,
+					sources,
+					origins,
+					collections: [...byCollection.entries()].map(([name, skillNames]) => ({
+						name,
+						skillNames: [...skillNames].sort((a, b) => a.localeCompare(b))
+					})).sort((a, b) => a.name.localeCompare(b.name)),
+					trash
+				});
 			}
-		},
-		{
-			kind: "exact",
-			path: SKILL_HUB_API.stats,
-			handler: async (req, res) => {
-				if (!isLoopbackRequest(req)) {
-					writeError(res, 403, "forbidden: loopback-only");
+		}),
+		route({
+			path: SKILL_HUB_API.sourceCheck,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				let only;
+				if (typeof request.repo === "string" && request.repo !== "") {
+					const parsedOnly = normalizeRepoInput(request.repo);
+					only = parsedOnly !== null ? repoSlug(parsedOnly) : void 0;
+				}
+				const source = only !== void 0 ? await deps.store.getSource(only) : void 0;
+				if (only !== void 0 && source === void 0) {
+					writeError(res, 404, "source not found: " + only);
 					return;
 				}
-				if (req.method !== "GET") {
-					writeError(res, 405, "method not allowed: " + (req.method ?? ""));
+				const sources = source !== void 0 ? [source] : await deps.store.listSources();
+				if (lastSourceCheck.size > 500) lastSourceCheck.clear();
+				const results = [];
+				for (const item of sources) {
+					const base = {
+						repo: item.repo,
+						...item.ref !== void 0 ? { ref: item.ref } : {}
+					};
+					const now = Date.now();
+					if (now - (lastSourceCheck.get(item.repo) ?? 0) < MIN_CHECK_INTERVAL_MS) {
+						results.push({
+							...base,
+							changed: false,
+							updated: [],
+							deleted: [],
+							throttled: true
+						});
+						continue;
+					}
+					try {
+						const latest = await getLatestCommit(item.repo, item.ref);
+						lastSourceCheck.set(item.repo, now);
+						if (item.commitSha === "") {
+							await deps.store.setSourceCommit(item.repo, latest.commitSha);
+							results.push({
+								...base,
+								changed: false,
+								updated: [],
+								deleted: [],
+								unverified: true,
+								commitSha: latest.commitSha
+							});
+							continue;
+						}
+						if (latest.commitSha === item.commitSha) {
+							results.push({
+								...base,
+								changed: false,
+								updated: [],
+								deleted: []
+							});
+							continue;
+						}
+						const diff = diffRemoteSkills(await loadRepoTreeAt(item.repo, latest.treeSha), item);
+						results.push({
+							...base,
+							changed: true,
+							commitSha: latest.commitSha,
+							updated: diff.updated,
+							deleted: diff.deleted
+						});
+					} catch (error) {
+						results.push({
+							...base,
+							changed: false,
+							updated: [],
+							deleted: [],
+							error: error instanceof Error ? error.message : String(error)
+						});
+					}
+				}
+				writeJson(res, 200, {
+					ok: true,
+					results
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.sourceSync,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const repo = typeof request.repo === "string" ? request.repo.trim() : "";
+				if (repo === "") {
+					writeError(res, 400, "repo is required");
 					return;
 				}
-				if (disabledGate(deps, res)) return;
-				if (deps.stats === void 0) {
-					writeJson(res, 200, {
-						ok: true,
-						available: false,
-						stats: []
-					});
+				const selected = Array.isArray(request.skills) ? request.skills.filter((n) => typeof n === "string" && n !== "") : void 0;
+				const source = await deps.store.getSource(repo);
+				if (source === void 0) {
+					writeError(res, 404, "source not found: " + repo);
 					return;
 				}
-				try {
-					writeJson(res, 200, {
-						ok: true,
-						available: true,
-						stats: await deps.stats()
-					});
-				} catch (error) {
-					writeError(res, 500, error);
+				const targets = selected !== void 0 ? selected : source.skills;
+				const latest = await getLatestCommit(repo, source.ref);
+				const tree = await loadRepoTreeAt(repo, latest.treeSha);
+				const targetRoot = rootPath("user-dsh", homeOf(deps));
+				await mkdir(targetRoot, { recursive: true });
+				const synced = [];
+				const failed = [];
+				for (const name of targets) {
+					if (!isSkillName(name) || !source.skills.includes(name)) {
+						failed.push({
+							name,
+							error: "skill is not tracked by this source"
+						});
+						continue;
+					}
+					try {
+						const entry = repoSkillEntry(name, source.root, repo);
+						entry.dir = skillDirOf(source, name, tree.map((item) => item.path));
+						entry.path = entry.dir + "/SKILL.md";
+						const files = collectRepoSkillFiles(tree, entry.dir);
+						if (files.length === 0) {
+							failed.push({
+								name,
+								error: "skill missing upstream"
+							});
+							continue;
+						}
+						const targetDir = join(targetRoot, name);
+						const wasDisabled = await deps.store.getDisabled(name) !== void 0;
+						if (await pathExists(targetDir)) await replaceSkillDir(targetDir, async () => {
+							await downloadRepoSkill(repo, latest.commitSha, entry, files, targetRoot);
+						});
+						else await downloadRepoSkill(repo, latest.commitSha, entry, files, targetRoot);
+						if (wasDisabled) await rename(join(targetDir, "SKILL.md"), join(targetDir, "SKILL.md.disabled"));
+						else await deps.store.removeDisabled(name);
+						await deps.store.mergeSourceManifest(repo, skillManifest(tree, entry.dir), entry.dir);
+						synced.push(name);
+					} catch (error) {
+						failed.push({
+							name,
+							error: error instanceof Error ? error.message : String(error)
+						});
+					}
 				}
+				if (failed.length === 0) await deps.store.setSourceCommit(repo, latest.commitSha);
+				deps.invalidate?.();
+				writeJson(res, 200, {
+					ok: true,
+					repo,
+					commitSha: latest.commitSha,
+					synced,
+					failed
+				});
 			}
-		},
-		{
-			kind: "exact",
-			path: SKILL_HUB_API.config,
-			handler: async (req, res) => {
-				if (!isLoopbackRequest(req)) {
-					writeError(res, 403, "forbidden: loopback-only");
+		}),
+		route({
+			path: SKILL_HUB_API.sourceDelete,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const repo = typeof request.repo === "string" ? request.repo.trim() : "";
+				const skills = Array.isArray(request.skills) ? request.skills.filter((n) => typeof n === "string" && n !== "") : [];
+				if (repo === "") {
+					writeError(res, 400, "repo is required");
 					return;
 				}
-				if (req.method === "GET") {
-					writeJson(res, 200, {
-						ok: true,
-						config: configOf(deps),
-						saved: savedOf(deps)
-					});
+				if (skills.length === 0) {
+					writeError(res, 400, "skills must be a non-empty array");
 					return;
 				}
-				if (req.method !== "POST") {
-					writeError(res, 405, "method not allowed: " + (req.method ?? ""));
+				const source = await deps.store.getSource(repo);
+				if (source === void 0) {
+					writeError(res, 404, "source not found: " + repo);
 					return;
 				}
-				const raw = await readJsonBody(req);
-				if (raw === void 0) {
-					writeError(res, 400, "invalid JSON body");
+				const home = homeOf(deps);
+				const trashed = [];
+				const failed = [];
+				const sourceNames = new Set(source.skills);
+				for (const name of skills) {
+					if (!isSkillName(name) || !sourceNames.has(name)) {
+						failed.push({
+							name,
+							error: "skill is not tracked by this source"
+						});
+						continue;
+					}
+					const sourcePath = join(rootPath("user-dsh", home), name);
+					if (rootOfPath(sourcePath, home) === void 0) {
+						failed.push({
+							name,
+							error: "skill path is outside the hub writable roots"
+						});
+						continue;
+					}
+					if (!await pathExists(sourcePath)) {
+						failed.push({
+							name,
+							error: "skill directory not found"
+						});
+						continue;
+					}
+					try {
+						const tagIds = (await deps.store.listTags()).filter((tag) => tag.skillNames.includes(name)).map((tag) => tag.id);
+						const { path } = await trashSkill(sourcePath);
+						await deps.store.addTrash({
+							name,
+							path,
+							movedAt: Date.now(),
+							sourcePath,
+							origin: {
+								repo: source.repo,
+								root: source.root,
+								...source.ref !== void 0 && source.ref !== "" ? { ref: source.ref } : {},
+								commitSha: source.commitSha
+							},
+							...tagIds.length > 0 ? { tagIds } : {}
+						});
+						await deps.store.removeDisabled(name);
+						await deps.store.removeSkillFromTags(name);
+						trashed.push(name);
+					} catch (error) {
+						failed.push({
+							name,
+							error: error instanceof Error ? error.message : String(error)
+						});
+					}
+				}
+				if (trashed.length > 0) {
+					await deps.store.setSourceSkills(repo, source.skills.filter((n) => !trashed.includes(n)));
+					deps.invalidate?.();
+				}
+				writeJson(res, 200, {
+					ok: true,
+					trashed,
+					failed
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.sourceRestore,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const name = typeof request.name === "string" ? request.name : "";
+				if (name === "") {
+					writeError(res, 400, "name is required");
 					return;
 				}
-				const patch = {};
-				if (raw.enabled !== void 0) if (raw.enabled === null) patch.enabled = void 0;
-				else if (typeof raw.enabled !== "boolean") {
-					writeError(res, 400, "enabled must be a boolean or null");
+				const entry = await deps.store.getTrash(name);
+				if (entry === void 0) {
+					writeError(res, 404, "trash entry not found: " + name);
 					return;
-				} else patch.enabled = raw.enabled;
-				if (raw.announceToAgent !== void 0) if (raw.announceToAgent === null) patch.announceToAgent = void 0;
-				else if (typeof raw.announceToAgent !== "boolean") {
-					writeError(res, 400, "announceToAgent must be a boolean or null");
+				}
+				const home = homeOf(deps);
+				if (await pathExists(entry.sourcePath ?? join(rootPath("user-dsh", home), name))) {
+					writeError(res, 409, "skill already exists: " + name);
 					return;
-				} else patch.announceToAgent = raw.announceToAgent;
-				let config;
-				if (deps.updateConfig === void 0) {
-					const merged = { ...configOf(deps) };
-					for (const [key, value] of Object.entries(patch)) if (value === void 0) delete merged[key];
-					else merged[key] = value;
-					config = merged;
-				} else try {
-					config = await deps.updateConfig(patch);
+				}
+				const path = await restoreSkill(entry, home);
+				if (entry.origin !== void 0) await deps.store.addSourceSkill(entry.origin.repo, entry.origin.root, entry.origin.commitSha, entry.origin.ref, name);
+				for (const tagId of entry.tagIds ?? []) await deps.store.addSkillToTag(tagId, name);
+				await deps.store.removeTrash(name);
+				deps.invalidate?.();
+				writeJson(res, 200, {
+					ok: true,
+					name,
+					path
+				});
+			}
+		}),
+		route({
+			path: SKILL_HUB_API.sourceTrashClear,
+			methods: ["POST"],
+			handler: async ({ res }) => {
+				const home = homeOf(deps);
+				const entries = await deps.store.listTrash();
+				const deleted = [];
+				const failed = [];
+				for (const entry of entries) try {
+					await clearTrash(entry, home);
+					await deps.store.removeSkillFromTags(entry.name);
+					deleted.push(entry.name);
 				} catch (error) {
-					writeError(res, 500, error);
-					return;
+					failed.push({
+						name: entry.name,
+						error: error instanceof Error ? error.message : String(error)
+					});
 				}
+				for (const name of deleted) await deps.store.removeTrash(name);
+				if (deleted.length > 0) deps.invalidate?.();
 				writeJson(res, 200, {
 					ok: true,
-					config,
-					saved: savedOf(deps)
+					deleted,
+					failed
 				});
 			}
-		}
+		})
 	];
 }
 //#endregion
 //#region src/stats.ts
-/** Count skill invocations in one session's event log, keyed by skill name. */
+/** Collect per-skill invocation counts and last-used times from one session. */
 function countSkillInvocations(events) {
-	const counts = /* @__PURE__ */ new Map();
-	const bump = (name) => {
-		if (name !== "") counts.set(name, (counts.get(name) ?? 0) + 1);
+	const stats = /* @__PURE__ */ new Map();
+	const bump = (name, time) => {
+		if (name === "") return;
+		const current = stats.get(name);
+		if (current === void 0) stats.set(name, {
+			count: 1,
+			lastUsed: time
+		});
+		else {
+			current.count += 1;
+			if (time > current.lastUsed) current.lastUsed = time;
+		}
 	};
 	for (const event of events) if (event.type === "user/message") {
 		const source = event.data.source;
-		if (source.kind === "skill-invocation") bump(source.name);
+		if (source.kind === "skill-invocation") bump(source.name, event.time);
 	} else if (event.type === "tool/call") {
 		const call = event.data;
 		if (call.name === "skill") try {
 			const parsed = JSON.parse(call.arguments);
 			if (typeof parsed === "object" && parsed !== null) {
 				const name = parsed.name;
-				if (typeof name === "string") bump(name);
+				if (typeof name === "string") bump(name, event.time);
 			}
 		} catch {}
 	}
-	return counts;
+	return stats;
 }
-/** Scan every session and total per-skill invocation counts. */
+/** Scan every session and total per-skill counts, keeping the latest lastUsed. */
 async function readSkillStats(query) {
 	const totals = /* @__PURE__ */ new Map();
 	const sessions = await query.listSessions();
@@ -951,22 +2979,42 @@ async function readSkillStats(query) {
 		} catch {
 			continue;
 		}
-		for (const [name, count] of countSkillInvocations(snapshot.events)) totals.set(name, (totals.get(name) ?? 0) + count);
+		for (const [name, stat] of countSkillInvocations(snapshot.events)) {
+			const total = totals.get(name);
+			if (total === void 0) totals.set(name, { ...stat });
+			else {
+				total.count += stat.count;
+				if (stat.lastUsed > total.lastUsed) total.lastUsed = stat.lastUsed;
+			}
+		}
 	}
-	return [...totals.entries()].map(([name, count]) => ({
+	return [...totals.entries()].map(([name, stat]) => ({
 		name,
-		count
+		count: stat.count,
+		lastUsed: stat.lastUsed
 	})).sort((a, b) => a.name.localeCompare(b.name));
 }
-/** Wrap a query in a TTL cache so a 5s panel poll does not rescan every log. */
-function createSkillStatsReader(query, ttlMs = 3e4) {
+/**
+* Wrap a query in a stale-while-revalidate cache: responses never wait for a
+* full session-log scan. While the TTL is fresh the cached totals are
+* returned; after expiry the stale totals are returned immediately and a
+* single background rescan refreshes them — the panel's next poll picks the
+* fresh numbers. A full scan decompresses every session log and can take
+* seconds, so it must never sit on the request path.
+*/
+function createSkillStatsReader(query, ttlMs = 3e5) {
 	let cached;
 	let cachedAt = 0;
+	let refreshing = null;
 	return async () => {
 		if (cached !== void 0 && Date.now() - cachedAt < ttlMs) return cached;
-		cached = await readSkillStats(query);
-		cachedAt = Date.now();
-		return cached;
+		if (refreshing === null) refreshing = readSkillStats(query).then((stats) => {
+			cached = stats;
+			cachedAt = Date.now();
+		}).catch(() => {}).finally(() => {
+			refreshing = null;
+		});
+		return cached ?? [];
 	};
 }
 //#endregion
@@ -980,18 +3028,16 @@ const inject = [
 	"systemPrompt"
 ];
 const Config = z.object({
-	announceToAgent: z.boolean().default(true),
-	enabled: z.boolean().default(true)
+	announceToAgent: z.boolean().default(HUB_CONFIG_DEFAULTS.announceToAgent),
+	enabled: z.boolean().default(HUB_CONFIG_DEFAULTS.enabled),
+	showUseCount: z.boolean().default(HUB_CONFIG_DEFAULTS.showUseCount),
+	showUseTime: z.boolean().default(HUB_CONFIG_DEFAULTS.showUseTime),
+	showGroupSummary: z.boolean().default(HUB_CONFIG_DEFAULTS.showGroupSummary)
 });
 /** Order of the announcement section within the tool-guidance band. */
 const SECTION_ORDER = 152;
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-const SKILL_HUB_GUIDANCE = ["本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；设置 → 插件列表中有本插件的配置卡片（启用/公告开关）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；搜索、按来源分组；启用/禁用技能（重命名 SKILL.md 并记录于 ~/.dsh/dsh-skill-hub.json，文件不删除、可随时恢复）；查看技能正文；发现诊断（列出被忽略技能的原因：缺 frontmatter、缺 name/description、非法名称）；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由仅回环可访问。用户提到「技能管理 / 技能列表 / 技能开关 / 新建技能」时即指本插件，请据此协作。", "The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → \"Skills\" is the management page; Settings → Plugins lists this plugin's configuration card (enable / announcement toggles). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); search; grouping by source; enable/disable skills (renames SKILL.md and records it in ~/.dsh/dsh-skill-hub.json; files are never deleted and can be restored anytime); view skill bodies; discovery diagnostics (reasons a skill is ignored: missing frontmatter, missing name/description, invalid name); new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; routes are loopback-only. When the user mentions \"skill management / skill list / skill toggle / new skill\", this plugin is what they mean — collaborate accordingly."].join("\n\n");
-/** Defaults the hub applies when neither the cordis config nor the sidecar says otherwise. */
-const DEFAULTS = {
-	enabled: true,
-	announceToAgent: true
-};
+const SKILL_HUB_GUIDANCE = ["本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；设置 → 插件列表中有本插件的配置卡片（启用/公告开关）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由仅回环可访问。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。", "The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → \"Skills\" is the management page; Settings → Plugins lists this plugin's configuration card (enable / announcement toggles). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with \"check all\" and \"update all\" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics; new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; routes are loopback-only. When the user mentions \"skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill\", this plugin is what they mean — collaborate accordingly."].join("\n\n");
 /**
 * Mount the skill hub routes and announcement.
 * @param ctx - host plugin context carrying webServer/skills/systemPrompt.
@@ -999,11 +3045,7 @@ const DEFAULTS = {
 */
 function apply(ctx, config) {
 	const base = config ?? {};
-	const resolveSaved = (saved) => ({
-		enabled: saved.enabled ?? base.enabled ?? DEFAULTS.enabled,
-		announceToAgent: saved.announceToAgent ?? base.announceToAgent ?? DEFAULTS.announceToAgent
-	});
-	let current = () => resolveSaved({});
+	let current = () => resolveHubConfig({}, base);
 	let savedState = {};
 	const store = new SkillHubStore();
 	let disposeRoutes;
@@ -1014,7 +3056,7 @@ function apply(ctx, config) {
 	const updateConfig = async (patch) => {
 		await store.setConfig(patch);
 		savedState = await store.getConfig();
-		const next = resolveSaved(savedState);
+		const next = resolveHubConfig(savedState, base);
 		current = () => next;
 		sync();
 		return next;
@@ -1065,7 +3107,7 @@ function apply(ctx, config) {
 	sync();
 	store.getConfig().then((saved) => {
 		savedState = saved;
-		current = () => resolveSaved(saved);
+		current = () => resolveHubConfig(saved, base);
 		sync();
 	});
 	ctx.inject(["sessionQuery"], (sctx) => {