dsh-skill-hub 0.3.26 → 0.3.28

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.26",
-  "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
+  "version": "0.3.28",
+  "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics plus a content audit (hidden characters, remote-execution pipes, credential paths, size caps), and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync, local-edit detection via content hashes, and read-only import from other agents' skill folders. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -68,7 +68,9 @@
         "0.2.0-rc.1",
         "0.2.0-rc.2",
         "0.2.1-alpha.2",
-        "0.2.1-alpha.5"
+        "0.2.1-alpha.5",
+        "0.2.1-rc.2",
+        "0.2.2-alpha.2"
       ]
     },
     "capability": {
@@ -88,7 +90,7 @@
     "js-yaml": "^4.1.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2 || ^4.0.5-alpha.1 || ^4.0.5-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2 || ^4.0.5-alpha.1 || ^4.0.5-alpha.2 || ^4.0.6-alpha.1",
     "@deepseek-ai/dsh-client-connection": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-locale": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-runtime": ">=0.1.7-alpha.1 <0.3.0-0",
@@ -102,7 +104,7 @@
     "@deepseek-ai/dsh-settings": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-skill": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-system-prompt": ">=0.1.7-alpha.1 <0.3.0-0",
-    "@deepseek-ai/schemastery": "^3.18.3 || ^3.18.5-alpha.1 || ^3.18.5-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.3 || ^3.18.5-alpha.1 || ^3.18.5-alpha.2 || ^3.18.6-alpha.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
@@ -115,22 +117,22 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.5-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-locale": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-store": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-host-webserver": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-session": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-session-query": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-settings": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-skill": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-system-prompt": "^0.2.1-alpha.5",
-    "@deepseek-ai/schemastery": "^3.18.5-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.6-alpha.1",
+    "@deepseek-ai/dsh-client-connection": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-store": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session-query": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-skill": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.2.2-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.6-alpha.1",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",

package/src/client/api.ts

@@ -10,6 +10,9 @@ import {
   type CreateResponse,
   type DiagnosticFixRequest,
   type DiagnosticFixResponse,
+  type ForeignImportRequest,
+  type ForeignImportResponse,
+  type ForeignListResponse,
   type GroupsResponse,
   type MarketCheckResponse,
   type MarketSourceAddResponse,
@@ -295,6 +298,17 @@ export class SkillHubApi {
     return this.get<SourcesResponse>(SKILL_HUB_API.sources)
   }
 
+  /** 列出其他 agent 用户级技能目录里的可收编技能（只读扫描）。 */
+  listForeignSkills(): Promise<ForeignListResponse> {
+    return this.get<ForeignListResponse>(SKILL_HUB_API.foreign)
+  }
+
+  /** 收编所选外部技能到 ~/.dsh/skills。 */
+  importForeignSkills(items: Array<{ agent: string; name: string }>): Promise<ForeignImportResponse> {
+    const payload: ForeignImportRequest = { items }
+    return this.post<ForeignImportResponse>(SKILL_HUB_API.foreignImport, payload)
+  }
+
   /** 检查指定（或全部）来源的上游更新。 */
   checkSources(repo?: string): Promise<SourceCheckResponse> {
     const payload: SourceCheckRequest = repo !== undefined ? { repo } : {}

package/src/client/locales/common.ts

@@ -17,6 +17,10 @@ export const zhCommon = {
   'legend.hint': '每个技能最多一个圆点；无圆点 = 不可被调用。',
   'panel.disabled': '已禁用',
   'panel.diagnostics': '发现诊断',
+  'panel.auditBadge': '审计',
+  'panel.announcement': '公告预算 {chars} 字符 ≈ {tokens} tokens · {skills} 个技能',
+  'panel.announcementOver': '超出建议上限 {budget} 字符，排在后面的技能可能不触发',
+  'panel.announcementHint': '技能目录的第一层（name + description）常驻在 system prompt 里。建议不超 {budget} 字符 —— 超出后客户端会截断尾部条目，表现为「装了却不触发」。',
   'panel.empty': '没有匹配的技能。',
   'panel.emptyAll': '本地还没有技能。点击「新建技能」创建第一个。',
   'panel.loading': '读取中…',
@@ -66,6 +70,10 @@ export const enCommon: Record<keyof typeof zhCommon, string> = {
   'legend.hint': 'At most one dot per skill; no dot = not invocable.',
   'panel.disabled': 'Disabled',
   'panel.diagnostics': 'Discovery diagnostics',
+  'panel.auditBadge': 'audit',
+  'panel.announcement': 'Announcement budget: {chars} chars ≈ {tokens} tokens · {skills} skills',
+  'panel.announcementOver': 'over the suggested {budget}-char cap — later skills may stop triggering',
+  'panel.announcementHint': 'The first progressive-disclosure layer (name + description) sits in the system prompt. Stay under {budget} chars: past it, clients truncate the tail and skills silently stop triggering.',
   'panel.empty': 'No matching skills.',
   'panel.emptyAll': 'No skills installed yet. Create the first one.',
   'panel.loading': 'Loading…',

package/src/client/locales/market.ts

@@ -79,6 +79,16 @@ export const zhMarket = {
   'repo.root.skills': 'skills',
   'repo.root.designTemplates': 'design-templates',
   'repo.root.generic': '{root}',
+  'foreign.open': '从其他 Agent 导入',
+  'foreign.title': '从其他 Agent 导入',
+  'foreign.text': '读取 Claude Code / Codex / Cursor 等工具的用户级技能目录（只读），把所选技能复制到 ~/.dsh/skills。原目录不受影响。',
+  'foreign.empty': '没有在这些工具的技能目录里发现技能。',
+  'foreign.exists': '已存在',
+  'foreign.import': '导入所选（{count}）',
+  'foreign.importing': '导入中…',
+  'foreign.skipped': '{count} 个因同名已存在被跳过。',
+  'foreign.importedBanner': '已导入 {count} 个技能。',
+  'foreign.importedReplacedBanner': '已导入 {count} 个技能，另有 {replaced} 个同名占位被移入回收站（可恢复）。',
 } as const
 
 export const enMarket: Record<keyof typeof zhMarket, string> = {
@@ -161,4 +171,14 @@ export const enMarket: Record<keyof typeof zhMarket, string> = {
   'repo.root.skills': 'Skills',
   'repo.root.designTemplates': 'Templates',
   'repo.root.generic': '{root}',
+  'foreign.open': 'Import from another agent',
+  'foreign.title': 'Import from another agent',
+  'foreign.text': 'Reads the user-level skill folders of Claude Code / Codex / Cursor and friends (read-only) and copies the selected skills into ~/.dsh/skills. The originals are left untouched.',
+  'foreign.empty': 'No skills found in those tool folders.',
+  'foreign.exists': 'exists',
+  'foreign.import': 'Import {count}',
+  'foreign.importing': 'Importing…',
+  'foreign.skipped': '{count} skipped because the name already exists.',
+  'foreign.importedBanner': 'Imported {count} skill(s).',
+  'foreign.importedReplacedBanner': 'Imported {count} skill(s); {replaced} same-name placeholder(s) moved to trash (restorable).',
 }

package/src/client/locales/sources.ts

@@ -11,6 +11,9 @@ export const zhSources = {
   'source.checking': '检查中…',
   'source.upToDate': '已是最新',
   'source.updated': '有更新 {count} 个',
+  'source.localModified': '本地改动 {count} 个',
+  'source.localModifiedBadge': '本地已改',
+  'source.localModifiedHint': '这些技能的磁盘内容与导入/同步时不一致（你自己改过）。同步会覆盖它们。',
   'source.deleted': '上游已删除 {count} 个',
   'source.error': '检查失败',
   'source.throttled': '刚刚检查过',
@@ -45,6 +48,9 @@ export const enSources: Record<keyof typeof zhSources, string> = {
   'source.checking': 'Checking…',
   'source.upToDate': 'Up to date',
   'source.updated': '{count} updates',
+  'source.localModified': '{count} edited locally',
+  'source.localModifiedBadge': 'edited',
+  'source.localModifiedHint': 'These skills no longer match what was imported or synced — you changed them on disk. Syncing overwrites them.',
   'source.deleted': '{count} deleted upstream',
   'source.error': 'Check failed',
   'source.throttled': 'Checked recently',

package/src/client/panel/ForeignImportDialog.tsx

@@ -0,0 +1,130 @@
+/**
+ * 从其他 agent 导入：列出 Claude Code / Codex / Cursor / Gemini CLI 等技能目录里的
+ * 技能，勾选后复制到本地可写根。
+ *
+ * 只读扫描 + 复制，不改动别家目录。已存在的同名技能不可选（导入会覆盖，
+ * 那是用户在别处没预期的事）。
+ */
+
+import { useEffect, useState } from 'react'
+import type { ForeignSkillView } from '../../protocol.ts'
+import type { SkillHubApi } from '../api.ts'
+import { errorMessage, tt } from '../helpers.ts'
+import { DialogShell } from './dialogs.tsx'
+import css from './panel.module.css'
+
+export interface ForeignImportDialogProps {
+  api: SkillHubApi
+  onClose: () => void
+  /** 导入成功后回调，由面板负责刷新目录与提示（replaced = 被移入回收站的同名占位）。 */
+  onImported: (imported: string[], replaced: number) => void
+}
+
+/** 一个技能在一组里的稳定键（同名技能可来自不同 agent）。 */
+function keyOf(skill: { agent: string; name: string }): string {
+  return skill.agent + '/' + skill.name
+}
+
+export function ForeignImportDialog(props: ForeignImportDialogProps): React.JSX.Element {
+  const { api, onClose, onImported } = props
+  const [skills, setSkills] = useState<ForeignSkillView[] | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [selected, setSelected] = useState<ReadonlySet<string>>(new Set())
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState<string | null>(null)
+
+  useEffect(() => {
+    let alive = true
+    void (async () => {
+      try {
+        const result = await api.listForeignSkills()
+        if (alive) setSkills(result.skills)
+      } catch (caught) {
+        if (alive) setError(errorMessage(caught))
+      }
+    })()
+    return () => { alive = false }
+  }, [api])
+
+  const toggle = (skill: ForeignSkillView): void => {
+    if (skill.existing || busy) return
+    const next = new Set(selected)
+    const key = keyOf(skill)
+    if (next.has(key)) next.delete(key)
+    else next.add(key)
+    setSelected(next)
+  }
+
+  const run = async (): Promise<void> => {
+    if (selected.size === 0 || skills === null) return
+    setBusy(true)
+    setError(null)
+    setMessage(null)
+    try {
+      const items = skills.filter((skill) => selected.has(keyOf(skill))).map((skill) => ({ agent: skill.agent, name: skill.name }))
+      const result = await api.importForeignSkills(items)
+      const replaced = result.replaced?.length ?? 0
+      if (result.failed.length > 0) {
+        setError(result.failed.map((failure) => failure.name + ': ' + failure.error).join('; '))
+        // 部分成功也要把成功的刷新出来，否则用户会以为一个都没进去。
+        if (result.imported.length > 0) onImported(result.imported, replaced)
+      } else if (result.skipped.length > 0) {
+        setMessage(tt('foreign.skipped', { count: result.skipped.length }))
+        if (result.imported.length > 0) onImported(result.imported, replaced)
+      } else {
+        onImported(result.imported, replaced)
+        onClose()
+      }
+    } catch (caught) {
+      setError(errorMessage(caught))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <DialogShell onClose={onClose}>
+      <h3 className={css.dialogTitle}>{tt('foreign.title')}</h3>
+      <p className={css.dialogText}>{tt('foreign.text')}</p>
+      {skills === null && error === null ? <p className={css.dialogText}>{tt('panel.loading')}</p> : null}
+      {skills !== null && skills.length === 0 ? <p className={css.dialogText}>{tt('foreign.empty')}</p> : null}
+      {skills !== null && skills.length > 0 ? (
+        <ul className={css.dialogList} style={{ maxHeight: 320, overflowY: 'auto' }}>
+          {skills.map((skill) => {
+            const key = keyOf(skill)
+            const disabled = skill.existing || busy
+            return (
+              <li key={key}>
+                <label style={{ display: 'flex', alignItems: 'center', gap: 8, cursor: disabled ? 'default' : 'pointer' }}>
+                  <input
+                    type='checkbox'
+                    disabled={disabled}
+                    checked={selected.has(key)}
+                    onChange={() => { toggle(skill) }}
+                  />
+                  <span className={css.rowNameText}>{skill.name}</span>
+                  <span className={css.statusBadge}>{skill.agent}</span>
+                  {skill.existing ? <span className={css.statusBadge + ' ' + css.statusLocal}>{tt('foreign.exists')}</span> : null}
+                </label>
+                <div className={css.rowDesc} title={skill.description}>{skill.description}</div>
+              </li>
+            )
+          })}
+        </ul>
+      ) : null}
+      {message !== null ? <p className={css.dialogText}>{message}</p> : null}
+      {error !== null ? <p className={css.dialogText} style={{ color: 'var(--hub-danger)' }}>{error}</p> : null}
+      <div className={css.dialogActions}>
+        <button type='button' className={css.button} onClick={onClose}>{tt('form.cancel')}</button>
+        <button
+          type='button'
+          className={css.button + ' ' + css.primary}
+          disabled={selected.size === 0 || busy}
+          onClick={() => { void run() }}
+        >
+          {busy ? tt('foreign.importing') : tt('foreign.import', { count: selected.size })}
+        </button>
+      </div>
+    </DialogShell>
+  )
+}

package/src/client/panel/PanelDialogs.tsx

@@ -22,6 +22,8 @@ export interface PanelDialogsProps {
   confirmDialog: SkillHubState['confirmDialog']
   setConfirmDialog: SkillHubState['setConfirmDialog']
   runConfirmed: SkillHubState['runConfirmed']
+  /** 来源检查结果（同步确认里标出本地改动过的技能）。 */
+  sourceCheck: SkillHubState['sourceCheck']
   /** 无 release 的市场源分支选择。 */
   branchChoice: SkillHubState['branchChoice']
   branchBusy: SkillHubState['branchBusy']
@@ -54,7 +56,7 @@ export interface PanelDialogsProps {
 export function PanelDialogs(props: PanelDialogsProps): JSX.Element {
   const {
     conflictDialog, tags, collections, setConflictDialog, resolveConflict,
-    confirmDialog, setConfirmDialog, runConfirmed,
+    confirmDialog, setConfirmDialog, runConfirmed, sourceCheck,
     branchChoice, branchBusy, setBranchChoice, confirmBranchChoice,
     versionDialog, versionBusy, setVersionDialog, confirmVersionDialog,
     marketSyncDialog, syncBusy, setMarketSyncDialog, confirmMarketSync,
@@ -80,6 +82,7 @@ export function PanelDialogs(props: PanelDialogsProps): JSX.Element {
           title={confirmDialog.kind === 'sync' ? tt('source.syncConfirmTitle') : tt('source.deleteConfirmTitle')}
           text={confirmDialog.kind === 'sync' ? tt('source.syncConfirmText') : tt('source.deleteConfirmText')}
           items={confirmDialog.skills}
+          {...(confirmDialog.kind === 'sync' ? { marked: sourceCheck[confirmDialog.repo]?.localModified ?? [] } : {})}
           confirmLabel={confirmDialog.kind === 'sync' ? tt('source.sync') : tt('source.followDelete')}
           danger={confirmDialog.kind === 'delete'}
           onCancel={() => { setConfirmDialog(null) }}

package/src/client/panel/SkillHubPanel.tsx

@@ -26,6 +26,7 @@ import { SourcesView } from './SourcesView.tsx'
 import { ScenesView } from './ScenesView.tsx'
 import { MarketView } from './MarketView.tsx'
 import { PanelDialogs } from './PanelDialogs.tsx'
+import { ForeignImportDialog } from './ForeignImportDialog.tsx'
 import { useSkillHub } from './useSkillHub.ts'
 import css from './panel.module.css'
 
@@ -37,6 +38,8 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
   const hub = useSkillHub(props.api)
   /** 工作区输入草稿：回车才应用，避免每次按键都触发目录重拉。 */
   const [workspaceDraft, setWorkspaceDraft] = useState('')
+  /** 「从其他 Agent 导入」弹窗开合。 */
+  const [showForeign, setShowForeign] = useState(false)
   /** 「筛选」面板开合（来源 + 调用方式收进这里；搜索/排序/视图切换始终可见）。 */
   const [filtersOpen, setFiltersOpen] = useState(false)
   const {
@@ -52,7 +55,7 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
     setConfirmClearTrash, setBranchChoice, setMarketSyncDialog, setEditingTag, setEditName, setMembersDraft, setEditSearch,
     setShowLegend, setEditMode,
     checkUpdate, loadMarket, checkSources, requestSync, requestDelete, restoreTrash, clearTrash, runDeleteSkill, runDeleteGroup,
-    runConfirmed, resolveConflict, confirmBranchChoice, confirmMarketSync, create, saveTag, deleteTag, enableDisabled,
+    runConfirmed, resolveConflict, confirmBranchChoice, confirmMarketSync, create, saveTag, deleteTag, enableDisabled, reloadCatalog,
   } = hub
   const { shortenedCount, fixingPaths, clearListFilters } = hub
 
@@ -171,10 +174,22 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
         </span>
         <button type='button' className={css.legendToggle + (showLegend ? ' ' + css.legendToggleActive : '')} onClick={() => { setShowLegend((value) => !value) }} title={tt('legend.hint')}>?</button>
         <span className={css.actions}>
+          <button type='button' className={css.button} onClick={() => { setShowForeign(true) }}>{tt('foreign.open')}</button>
           <button type='button' className={css.button + ' ' + css.primary} onClick={() => { setShowForm((value) => !value) }}>{tt('panel.new')}</button>
         </span>
       </div>
 
+      {showForeign ? (
+        <ForeignImportDialog
+          api={props.api}
+          onClose={() => { setShowForeign(false) }}
+          onImported={(imported, replaced) => {
+            void reloadCatalog()
+            setSuccessBanner(tt(replaced > 0 ? 'foreign.importedReplacedBanner' : 'foreign.importedBanner', { count: imported.length, replaced }))
+          }}
+        />
+      ) : null}
+
       {showForm ? (
         <form className={css.form} onSubmit={(event) => { void create(event) }}>
           <p className={css.hintLine}>{tt('form.capabilityHint')}</p>
@@ -291,6 +306,17 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
             </div>
           ) : null}
 
+          {catalog !== null && catalog.announcement !== undefined && catalog.announcement.skills > 0 ? (
+            <div className={css.hintLine} style={{ margin: '2px 2px 0', display: 'flex', gap: 8, flexWrap: 'wrap' }}>
+              <span title={tt('panel.announcementHint', { budget: catalog.announcement.budget })}>
+                {tt('panel.announcement', { chars: catalog.announcement.chars, tokens: catalog.announcement.approxTokens, skills: catalog.announcement.skills })}
+              </span>
+              {catalog.announcement.overBudget
+                ? <span style={{ color: 'var(--hub-danger)' }}>{tt('panel.announcementOver', { budget: catalog.announcement.budget })}</span>
+                : null}
+            </div>
+          ) : null}
+
           {filtered.length === 0 && search.trim() !== '' ? <div className={css.empty}>{tt('panel.empty')}</div> : null}
           {filtered.length === 0 && search.trim() === '' && catalog.skills.length === 0 && catalog.disabled.length === 0 && catalog.diagnostics.length === 0
             ? <div className={css.empty}>{tt('panel.emptyAll')}</div>
@@ -319,10 +345,13 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
           {catalog.diagnostics.length > 0 ? (
             <section className={css.section}>
               <div className={css.sectionTitle}>{tt('panel.diagnostics')}</div>
-              {catalog.diagnostics.map((entry) => (
-                <div key={entry.path} className={css.diagRow} style={{ display:'flex', alignItems:'flex-start', gap:10 }}>
+              {catalog.diagnostics.map((entry, index) => (
+                <div key={entry.path + '|' + String(index)} className={css.diagRow + (entry.severity === 'block' ? ' ' + css.diagRowBlock : '')} style={{ display:'flex', alignItems:'flex-start', gap:10 }}>
                   <div style={{ flex:1, minWidth:0 }}>
-                    <div className={css.diagPath}>{entry.path}</div>
+                    <div className={css.diagPath}>
+                      {entry.kind === 'security' ? <span className={css.auditBadge}>{tt('panel.auditBadge')}</span> : null}
+                      {entry.path}
+                    </div>
                     <div className={css.diagReason}>{entry.reason}</div>
                   </div>
                   {entry.fixable === true ? (
@@ -350,6 +379,7 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
         confirmDialog={confirmDialog}
         setConfirmDialog={setConfirmDialog}
         runConfirmed={runConfirmed}
+        sourceCheck={sourceCheck}
         branchChoice={branchChoice}
         branchBusy={branchBusy}
         setBranchChoice={setBranchChoice}

package/src/client/panel/SourceStatusBadge.tsx

@@ -32,30 +32,40 @@ export function SourceStatusBadge(props: {
       </button>
     )
   }
-  const badges = ((): JSX.Element | null => {
+  // 单一容器：状态徽章与「本地改动」是并列关系，多套一层 flex 会多出一份 gap。
+  const items: JSX.Element[] = (() => {
     if (check.error !== undefined) {
-      return <span className={css.statusBadge + ' ' + css.statusError}>{tt('source.error')}</span>
+      return [<span key='error' className={css.statusBadge + ' ' + css.statusError}>{tt('source.error')}</span>]
     }
     if (check.throttled === true) {
-      return <span className={css.statusBadge}>{tt('source.throttled')}</span>
+      return [<span key='throttled' className={css.statusBadge}>{tt('source.throttled')}</span>]
     }
     if (check.unverified === true) {
-      return <span className={css.statusBadge}>{tt('source.unverified')}</span>
+      return [<span key='unverified' className={css.statusBadge}>{tt('source.unverified')}</span>]
     }
     if (check.changed) {
-      return (
-        <span className={css.statusBadges}>
-          {check.updated.length > 0 ? <span className={css.statusBadge + ' ' + css.statusUpdated}>{tt('source.updated', { count: check.updated.length })}</span> : null}
-          {check.deleted.length > 0 ? <span className={css.statusBadge + ' ' + css.statusError}>{tt('source.deleted', { count: check.deleted.length })}</span> : null}
-        </span>
-      )
+      return [
+        ...(check.updated.length > 0 ? [<span key='updated' className={css.statusBadge + ' ' + css.statusUpdated}>{tt('source.updated', { count: check.updated.length })}</span>] : []),
+        ...(check.deleted.length > 0 ? [<span key='deleted' className={css.statusBadge + ' ' + css.statusError}>{tt('source.deleted', { count: check.deleted.length })}</span>] : []),
+      ]
     }
-    return <span className={css.statusBadge + ' ' + css.statusOk}>{tt('source.upToDate')}</span>
+    return [<span key='ok' className={css.statusBadge + ' ' + css.statusOk}>{tt('source.upToDate')}</span>]
   })()
-  if (onCheck === undefined) return badges
+  // 本地改动与上游状态正交：上游没变时它同样存在，所以挂在状态旁边而不是
+  // 塞进状态分支里。
+  const modified = check.localModified ?? []
+  if (modified.length > 0) {
+    items.push(
+      <span key='local' className={css.statusBadge + ' ' + css.statusLocal} title={tt('source.localModifiedHint') + '\n' + modified.join(', ')}>
+        {tt('source.localModified', { count: modified.length })}
+      </span>,
+    )
+  }
+  const combined = <span className={css.statusBadges}>{items}</span>
+  if (onCheck === undefined) return combined
   return (
     <button type='button' className={css.statusWrap} title={tt('source.checkHint')} onClick={onCheck}>
-      {badges}
+      {combined}
     </button>
   )
 }

package/src/client/panel/dialogs.tsx

@@ -55,7 +55,7 @@ export interface MarketSyncDialogState {
 }
 
 /** Overlay + centered alert-dialog shell; outside click or Escape cancels. */
-function DialogShell(props: { onClose: () => void; children: ReactNode }): JSX.Element {
+export function DialogShell(props: { onClose: () => void; children: ReactNode }): JSX.Element {
   useEffect(() => {
     const onKey = (event: KeyboardEvent): void => {
       if (event.key === 'Escape') props.onClose()
@@ -78,20 +78,31 @@ export function ConfirmDialog(props: {
   text: string
   /** Optional skill names listed between the text and the buttons. */
   items?: readonly string[]
+  /**
+   * 这些条目在磁盘上已被本地改过。列出来时逐个标记 —— 「会覆盖本地修改」
+   * 这句话只有在能指出是哪几个时才有用。
+   */
+  marked?: readonly string[]
   confirmLabel: string
   /** Danger-styled confirm button (destructive actions). */
   danger?: boolean
   onCancel: () => void
   onConfirm: () => void
 }): JSX.Element {
-  const { title, text, items, confirmLabel, danger, onCancel, onConfirm } = props
+  const { title, text, items, marked, confirmLabel, danger, onCancel, onConfirm } = props
+  const markedSet = new Set(marked ?? [])
   return (
     <DialogShell onClose={onCancel}>
       <h3 className={css.dialogTitle}>{title}</h3>
       <p className={css.dialogText}>{text}</p>
       {items !== undefined ? (
         <ul className={css.dialogList}>
-          {items.map((name) => <li key={name}><span className={css.rowNameText}>{name}</span></li>)}
+          {items.map((name) => (
+            <li key={name}>
+              <span className={css.rowNameText}>{name}</span>
+              {markedSet.has(name) ? <span className={css.statusBadge + ' ' + css.statusLocal} style={{ marginLeft: 6 }}>{tt('source.localModifiedBadge')}</span> : null}
+            </li>
+          ))}
         </ul>
       ) : null}
       <div className={css.dialogActions}>

package/src/client/panel/panel.module.css

@@ -70,6 +70,10 @@
 
 .empty { font-size: 13px; color: var(--hub-text-3); padding: 20px 0; text-align: center; }
 .diagRow { font-size: 12px; padding: 9px 14px; border-left: 3px solid var(--hub-warn); background: rgba(210,153,34,.06); }
+/* 审计条目与发现诊断共用一块 UI：block 级换成红色边框，一眼分得出「文件没加载」
+   和「文件能加载但正文有问题」。 */
+.diagRowBlock { border-left-color: var(--hub-danger); background: rgba(209,36,47,.06); }
+.auditBadge { display: inline-block; margin-right: 6px; padding: 0 5px; border-radius: 4px; font-size: 11px; font-weight: 700; color: var(--hub-danger); background: rgba(209,36,47,.12); vertical-align: 1px; }
 .diagPath { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 11px; color: var(--hub-text-2); word-break: break-all; }
 .diagReason { color: var(--hub-text-3); margin-top: 1px; }
 .updateLink { color: inherit; font-weight: 600; text-decoration: underline; }
@@ -163,6 +167,8 @@
 .statusOk { color: var(--hub-success); border-color: currentColor; background: transparent; }
 .statusUpdated { color: var(--hub-warn); border-color: currentColor; background: rgba(210,153,34,.08); }
 .statusError { color: var(--hub-danger); border-color: currentColor; background: rgba(209,36,47,.08); }
+/* 本地已改动：既不是上游有更新，也不是错误 —— 是「这份磁盘内容和你导入的不一样」。 */
+.statusLocal { color: var(--hub-accent); border-color: currentColor; background: rgba(47,129,247,.08); }
 
 /* Clickable status badge (group-header re-check affordance). */
 .statusWrap { display: inline-flex; gap: 4px; align-items: center; border: none; background: none; padding: 0; cursor: pointer; font-family: inherit; }

package/src/client/panel/useSkillHub.ts

@@ -212,6 +212,6 @@ export function useSkillHub(api: SkillHubApi) {
     clearScan: marketFlow.clearScan,
     checkMarket: marketFlow.checkMarket, loadMarketStats: marketFlow.loadMarketStats,
     syncMarketSource: marketFlow.syncMarketSource, confirmMarketSync: marketFlow.confirmMarketSync,
-    updateAll: marketFlow.updateAll, create: catalogFlow.create,
+    updateAll: marketFlow.updateAll, create: catalogFlow.create, reloadCatalog: catalogFlow.load,
   }
 }

package/src/index.ts

@@ -134,8 +134,8 @@ const SECTION_ORDER = 152
 
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
 export const SKILL_HUB_GUIDANCE = [
-  '本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；本插件的配置页（启用/公告开关、圆点颜色、GitHub token、统计窗口）在插件管理页——侧边栏「插件」→ 本插件，是本插件自己注册的配置卡片（默认折叠，点标题展开）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由受 dsh 自身的 /api 信任栅栏保护（回环、监听器绑定地址、--trusted-host 声明的 authority，外加浏览器会话认证），因此反代部署下与 GUI 同一套放行规则。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。',
-  'The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → "Skills" is the management page; the plugin\'s configuration page (enable / announcement toggles, dot colors, GitHub token, stats window) is registered by the plugin itself on its own page in the Plugins manager (sidebar → 插件 → the plugin; collapsed until you expand the title). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with "check all" and "update all" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics; new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; the routes sit behind dsh\'s own /api trust fence (loopback, the listener\'s bind address, any --trusted-host authority, plus browser-session authentication), so a reverse-proxied deployment is judged exactly like the GUI around it. When the user mentions "skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill", this plugin is what they mean — collaborate accordingly.'
+  '本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；本插件的配置页（启用/公告开关、圆点颜色、GitHub token、统计窗口）在插件管理页——侧边栏「插件」→ 本插件，是本插件自己注册的配置卡片（默认折叠，点标题展开）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；内容审计（隐藏字符、危险命令、凭据路径与体积上限；市场导入命中阻断级规则即整包拒绝）；技能目录公告预算（一层渐进加载注入的字符数与 token 估算）；本地内容哈希比对（标出被自己改过、同步会覆盖的技能）；从其他 agent 的技能目录只读导入（Claude Code / Codex / Cursor / Gemini CLI 等）；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由受 dsh 自身的 /api 信任栅栏保护（回环、监听器绑定地址、--trusted-host 声明的 authority，外加浏览器会话认证），因此反代部署下与 GUI 同一套放行规则。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。',
+  'The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → "Skills" is the management page; the plugin\'s configuration page (enable / announcement toggles, dot colors, GitHub token, stats window) is registered by the plugin itself on its own page in the Plugins manager (sidebar → 插件 → the plugin; collapsed until you expand the title). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with "check all" and "update all" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics plus a content audit (hidden characters, dangerous commands, credential paths, size caps — a market import with a blocking finding is refused as a whole); the skill-catalog announcement budget (characters and estimated tokens for the first progressive-disclosure layer); local content-hash comparison (flags skills you edited that a sync would overwrite); read-only import from other agents\' skill folders (Claude Code / Codex / Cursor / Gemini CLI and friends); new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; the routes sit behind dsh\'s own /api trust fence (loopback, the listener\'s bind address, any --trusted-host authority, plus browser-session authentication), so a reverse-proxied deployment is judged exactly like the GUI around it. When the user mentions "skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill", this plugin is what they mean — collaborate accordingly.'
 ].join('\n\n')
 
 /**

package/src/protocol/api.ts

@@ -49,4 +49,6 @@ export const SKILL_HUB_API = {
   diagnosticFix: '/api/skill-hub/diagnostic/fix',
   marketSourceVersions: '/api/skill-hub/market/source/versions',
   marketStats: '/api/skill-hub/market/stats',
+  foreign: '/api/skill-hub/foreign',
+  foreignImport: '/api/skill-hub/foreign/import',
 } as const