dsh-skill-hub 0.3.27 → 0.3.28

package/src/client/locales/market.ts

@@ -79,6 +79,16 @@ export const zhMarket = {
   'repo.root.skills': 'skills',
   'repo.root.designTemplates': 'design-templates',
   'repo.root.generic': '{root}',
+  'foreign.open': '从其他 Agent 导入',
+  'foreign.title': '从其他 Agent 导入',
+  'foreign.text': '读取 Claude Code / Codex / Cursor 等工具的用户级技能目录（只读），把所选技能复制到 ~/.dsh/skills。原目录不受影响。',
+  'foreign.empty': '没有在这些工具的技能目录里发现技能。',
+  'foreign.exists': '已存在',
+  'foreign.import': '导入所选（{count}）',
+  'foreign.importing': '导入中…',
+  'foreign.skipped': '{count} 个因同名已存在被跳过。',
+  'foreign.importedBanner': '已导入 {count} 个技能。',
+  'foreign.importedReplacedBanner': '已导入 {count} 个技能，另有 {replaced} 个同名占位被移入回收站（可恢复）。',
 } as const
 
 export const enMarket: Record<keyof typeof zhMarket, string> = {
@@ -161,4 +171,14 @@ export const enMarket: Record<keyof typeof zhMarket, string> = {
   'repo.root.skills': 'Skills',
   'repo.root.designTemplates': 'Templates',
   'repo.root.generic': '{root}',
+  'foreign.open': 'Import from another agent',
+  'foreign.title': 'Import from another agent',
+  'foreign.text': 'Reads the user-level skill folders of Claude Code / Codex / Cursor and friends (read-only) and copies the selected skills into ~/.dsh/skills. The originals are left untouched.',
+  'foreign.empty': 'No skills found in those tool folders.',
+  'foreign.exists': 'exists',
+  'foreign.import': 'Import {count}',
+  'foreign.importing': 'Importing…',
+  'foreign.skipped': '{count} skipped because the name already exists.',
+  'foreign.importedBanner': 'Imported {count} skill(s).',
+  'foreign.importedReplacedBanner': 'Imported {count} skill(s); {replaced} same-name placeholder(s) moved to trash (restorable).',
 }

package/src/client/locales/sources.ts

@@ -11,6 +11,9 @@ export const zhSources = {
   'source.checking': '检查中…',
   'source.upToDate': '已是最新',
   'source.updated': '有更新 {count} 个',
+  'source.localModified': '本地改动 {count} 个',
+  'source.localModifiedBadge': '本地已改',
+  'source.localModifiedHint': '这些技能的磁盘内容与导入/同步时不一致（你自己改过）。同步会覆盖它们。',
   'source.deleted': '上游已删除 {count} 个',
   'source.error': '检查失败',
   'source.throttled': '刚刚检查过',
@@ -45,6 +48,9 @@ export const enSources: Record<keyof typeof zhSources, string> = {
   'source.checking': 'Checking…',
   'source.upToDate': 'Up to date',
   'source.updated': '{count} updates',
+  'source.localModified': '{count} edited locally',
+  'source.localModifiedBadge': 'edited',
+  'source.localModifiedHint': 'These skills no longer match what was imported or synced — you changed them on disk. Syncing overwrites them.',
   'source.deleted': '{count} deleted upstream',
   'source.error': 'Check failed',
   'source.throttled': 'Checked recently',

package/src/client/panel/ForeignImportDialog.tsx

@@ -0,0 +1,130 @@
+/**
+ * 从其他 agent 导入：列出 Claude Code / Codex / Cursor / Gemini CLI 等技能目录里的
+ * 技能，勾选后复制到本地可写根。
+ *
+ * 只读扫描 + 复制，不改动别家目录。已存在的同名技能不可选（导入会覆盖，
+ * 那是用户在别处没预期的事）。
+ */
+
+import { useEffect, useState } from 'react'
+import type { ForeignSkillView } from '../../protocol.ts'
+import type { SkillHubApi } from '../api.ts'
+import { errorMessage, tt } from '../helpers.ts'
+import { DialogShell } from './dialogs.tsx'
+import css from './panel.module.css'
+
+export interface ForeignImportDialogProps {
+  api: SkillHubApi
+  onClose: () => void
+  /** 导入成功后回调，由面板负责刷新目录与提示（replaced = 被移入回收站的同名占位）。 */
+  onImported: (imported: string[], replaced: number) => void
+}
+
+/** 一个技能在一组里的稳定键（同名技能可来自不同 agent）。 */
+function keyOf(skill: { agent: string; name: string }): string {
+  return skill.agent + '/' + skill.name
+}
+
+export function ForeignImportDialog(props: ForeignImportDialogProps): React.JSX.Element {
+  const { api, onClose, onImported } = props
+  const [skills, setSkills] = useState<ForeignSkillView[] | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [selected, setSelected] = useState<ReadonlySet<string>>(new Set())
+  const [busy, setBusy] = useState(false)
+  const [message, setMessage] = useState<string | null>(null)
+
+  useEffect(() => {
+    let alive = true
+    void (async () => {
+      try {
+        const result = await api.listForeignSkills()
+        if (alive) setSkills(result.skills)
+      } catch (caught) {
+        if (alive) setError(errorMessage(caught))
+      }
+    })()
+    return () => { alive = false }
+  }, [api])
+
+  const toggle = (skill: ForeignSkillView): void => {
+    if (skill.existing || busy) return
+    const next = new Set(selected)
+    const key = keyOf(skill)
+    if (next.has(key)) next.delete(key)
+    else next.add(key)
+    setSelected(next)
+  }
+
+  const run = async (): Promise<void> => {
+    if (selected.size === 0 || skills === null) return
+    setBusy(true)
+    setError(null)
+    setMessage(null)
+    try {
+      const items = skills.filter((skill) => selected.has(keyOf(skill))).map((skill) => ({ agent: skill.agent, name: skill.name }))
+      const result = await api.importForeignSkills(items)
+      const replaced = result.replaced?.length ?? 0
+      if (result.failed.length > 0) {
+        setError(result.failed.map((failure) => failure.name + ': ' + failure.error).join('; '))
+        // 部分成功也要把成功的刷新出来，否则用户会以为一个都没进去。
+        if (result.imported.length > 0) onImported(result.imported, replaced)
+      } else if (result.skipped.length > 0) {
+        setMessage(tt('foreign.skipped', { count: result.skipped.length }))
+        if (result.imported.length > 0) onImported(result.imported, replaced)
+      } else {
+        onImported(result.imported, replaced)
+        onClose()
+      }
+    } catch (caught) {
+      setError(errorMessage(caught))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <DialogShell onClose={onClose}>
+      <h3 className={css.dialogTitle}>{tt('foreign.title')}</h3>
+      <p className={css.dialogText}>{tt('foreign.text')}</p>
+      {skills === null && error === null ? <p className={css.dialogText}>{tt('panel.loading')}</p> : null}
+      {skills !== null && skills.length === 0 ? <p className={css.dialogText}>{tt('foreign.empty')}</p> : null}
+      {skills !== null && skills.length > 0 ? (
+        <ul className={css.dialogList} style={{ maxHeight: 320, overflowY: 'auto' }}>
+          {skills.map((skill) => {
+            const key = keyOf(skill)
+            const disabled = skill.existing || busy
+            return (
+              <li key={key}>
+                <label style={{ display: 'flex', alignItems: 'center', gap: 8, cursor: disabled ? 'default' : 'pointer' }}>
+                  <input
+                    type='checkbox'
+                    disabled={disabled}
+                    checked={selected.has(key)}
+                    onChange={() => { toggle(skill) }}
+                  />
+                  <span className={css.rowNameText}>{skill.name}</span>
+                  <span className={css.statusBadge}>{skill.agent}</span>
+                  {skill.existing ? <span className={css.statusBadge + ' ' + css.statusLocal}>{tt('foreign.exists')}</span> : null}
+                </label>
+                <div className={css.rowDesc} title={skill.description}>{skill.description}</div>
+              </li>
+            )
+          })}
+        </ul>
+      ) : null}
+      {message !== null ? <p className={css.dialogText}>{message}</p> : null}
+      {error !== null ? <p className={css.dialogText} style={{ color: 'var(--hub-danger)' }}>{error}</p> : null}
+      <div className={css.dialogActions}>
+        <button type='button' className={css.button} onClick={onClose}>{tt('form.cancel')}</button>
+        <button
+          type='button'
+          className={css.button + ' ' + css.primary}
+          disabled={selected.size === 0 || busy}
+          onClick={() => { void run() }}
+        >
+          {busy ? tt('foreign.importing') : tt('foreign.import', { count: selected.size })}
+        </button>
+      </div>
+    </DialogShell>
+  )
+}

package/src/client/panel/PanelDialogs.tsx

@@ -22,6 +22,8 @@ export interface PanelDialogsProps {
   confirmDialog: SkillHubState['confirmDialog']
   setConfirmDialog: SkillHubState['setConfirmDialog']
   runConfirmed: SkillHubState['runConfirmed']
+  /** 来源检查结果（同步确认里标出本地改动过的技能）。 */
+  sourceCheck: SkillHubState['sourceCheck']
   /** 无 release 的市场源分支选择。 */
   branchChoice: SkillHubState['branchChoice']
   branchBusy: SkillHubState['branchBusy']
@@ -54,7 +56,7 @@ export interface PanelDialogsProps {
 export function PanelDialogs(props: PanelDialogsProps): JSX.Element {
   const {
     conflictDialog, tags, collections, setConflictDialog, resolveConflict,
-    confirmDialog, setConfirmDialog, runConfirmed,
+    confirmDialog, setConfirmDialog, runConfirmed, sourceCheck,
     branchChoice, branchBusy, setBranchChoice, confirmBranchChoice,
     versionDialog, versionBusy, setVersionDialog, confirmVersionDialog,
     marketSyncDialog, syncBusy, setMarketSyncDialog, confirmMarketSync,
@@ -80,6 +82,7 @@ export function PanelDialogs(props: PanelDialogsProps): JSX.Element {
           title={confirmDialog.kind === 'sync' ? tt('source.syncConfirmTitle') : tt('source.deleteConfirmTitle')}
           text={confirmDialog.kind === 'sync' ? tt('source.syncConfirmText') : tt('source.deleteConfirmText')}
           items={confirmDialog.skills}
+          {...(confirmDialog.kind === 'sync' ? { marked: sourceCheck[confirmDialog.repo]?.localModified ?? [] } : {})}
           confirmLabel={confirmDialog.kind === 'sync' ? tt('source.sync') : tt('source.followDelete')}
           danger={confirmDialog.kind === 'delete'}
           onCancel={() => { setConfirmDialog(null) }}

package/src/client/panel/SkillHubPanel.tsx

@@ -26,6 +26,7 @@ import { SourcesView } from './SourcesView.tsx'
 import { ScenesView } from './ScenesView.tsx'
 import { MarketView } from './MarketView.tsx'
 import { PanelDialogs } from './PanelDialogs.tsx'
+import { ForeignImportDialog } from './ForeignImportDialog.tsx'
 import { useSkillHub } from './useSkillHub.ts'
 import css from './panel.module.css'
 
@@ -37,6 +38,8 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
   const hub = useSkillHub(props.api)
   /** 工作区输入草稿：回车才应用，避免每次按键都触发目录重拉。 */
   const [workspaceDraft, setWorkspaceDraft] = useState('')
+  /** 「从其他 Agent 导入」弹窗开合。 */
+  const [showForeign, setShowForeign] = useState(false)
   /** 「筛选」面板开合（来源 + 调用方式收进这里；搜索/排序/视图切换始终可见）。 */
   const [filtersOpen, setFiltersOpen] = useState(false)
   const {
@@ -52,7 +55,7 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
     setConfirmClearTrash, setBranchChoice, setMarketSyncDialog, setEditingTag, setEditName, setMembersDraft, setEditSearch,
     setShowLegend, setEditMode,
     checkUpdate, loadMarket, checkSources, requestSync, requestDelete, restoreTrash, clearTrash, runDeleteSkill, runDeleteGroup,
-    runConfirmed, resolveConflict, confirmBranchChoice, confirmMarketSync, create, saveTag, deleteTag, enableDisabled,
+    runConfirmed, resolveConflict, confirmBranchChoice, confirmMarketSync, create, saveTag, deleteTag, enableDisabled, reloadCatalog,
   } = hub
   const { shortenedCount, fixingPaths, clearListFilters } = hub
 
@@ -171,10 +174,22 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
         </span>
         <button type='button' className={css.legendToggle + (showLegend ? ' ' + css.legendToggleActive : '')} onClick={() => { setShowLegend((value) => !value) }} title={tt('legend.hint')}>?</button>
         <span className={css.actions}>
+          <button type='button' className={css.button} onClick={() => { setShowForeign(true) }}>{tt('foreign.open')}</button>
           <button type='button' className={css.button + ' ' + css.primary} onClick={() => { setShowForm((value) => !value) }}>{tt('panel.new')}</button>
         </span>
       </div>
 
+      {showForeign ? (
+        <ForeignImportDialog
+          api={props.api}
+          onClose={() => { setShowForeign(false) }}
+          onImported={(imported, replaced) => {
+            void reloadCatalog()
+            setSuccessBanner(tt(replaced > 0 ? 'foreign.importedReplacedBanner' : 'foreign.importedBanner', { count: imported.length, replaced }))
+          }}
+        />
+      ) : null}
+
       {showForm ? (
         <form className={css.form} onSubmit={(event) => { void create(event) }}>
           <p className={css.hintLine}>{tt('form.capabilityHint')}</p>
@@ -291,6 +306,17 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
             </div>
           ) : null}
 
+          {catalog !== null && catalog.announcement !== undefined && catalog.announcement.skills > 0 ? (
+            <div className={css.hintLine} style={{ margin: '2px 2px 0', display: 'flex', gap: 8, flexWrap: 'wrap' }}>
+              <span title={tt('panel.announcementHint', { budget: catalog.announcement.budget })}>
+                {tt('panel.announcement', { chars: catalog.announcement.chars, tokens: catalog.announcement.approxTokens, skills: catalog.announcement.skills })}
+              </span>
+              {catalog.announcement.overBudget
+                ? <span style={{ color: 'var(--hub-danger)' }}>{tt('panel.announcementOver', { budget: catalog.announcement.budget })}</span>
+                : null}
+            </div>
+          ) : null}
+
           {filtered.length === 0 && search.trim() !== '' ? <div className={css.empty}>{tt('panel.empty')}</div> : null}
           {filtered.length === 0 && search.trim() === '' && catalog.skills.length === 0 && catalog.disabled.length === 0 && catalog.diagnostics.length === 0
             ? <div className={css.empty}>{tt('panel.emptyAll')}</div>
@@ -319,10 +345,13 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
           {catalog.diagnostics.length > 0 ? (
             <section className={css.section}>
               <div className={css.sectionTitle}>{tt('panel.diagnostics')}</div>
-              {catalog.diagnostics.map((entry) => (
-                <div key={entry.path} className={css.diagRow} style={{ display:'flex', alignItems:'flex-start', gap:10 }}>
+              {catalog.diagnostics.map((entry, index) => (
+                <div key={entry.path + '|' + String(index)} className={css.diagRow + (entry.severity === 'block' ? ' ' + css.diagRowBlock : '')} style={{ display:'flex', alignItems:'flex-start', gap:10 }}>
                   <div style={{ flex:1, minWidth:0 }}>
-                    <div className={css.diagPath}>{entry.path}</div>
+                    <div className={css.diagPath}>
+                      {entry.kind === 'security' ? <span className={css.auditBadge}>{tt('panel.auditBadge')}</span> : null}
+                      {entry.path}
+                    </div>
                     <div className={css.diagReason}>{entry.reason}</div>
                   </div>
                   {entry.fixable === true ? (
@@ -350,6 +379,7 @@ export function SkillHubPanel(props: SkillHubPanelProps): React.JSX.Element {
         confirmDialog={confirmDialog}
         setConfirmDialog={setConfirmDialog}
         runConfirmed={runConfirmed}
+        sourceCheck={sourceCheck}
         branchChoice={branchChoice}
         branchBusy={branchBusy}
         setBranchChoice={setBranchChoice}

package/src/client/panel/SourceStatusBadge.tsx

@@ -32,30 +32,40 @@ export function SourceStatusBadge(props: {
       </button>
     )
   }
-  const badges = ((): JSX.Element | null => {
+  // 单一容器：状态徽章与「本地改动」是并列关系，多套一层 flex 会多出一份 gap。
+  const items: JSX.Element[] = (() => {
     if (check.error !== undefined) {
-      return <span className={css.statusBadge + ' ' + css.statusError}>{tt('source.error')}</span>
+      return [<span key='error' className={css.statusBadge + ' ' + css.statusError}>{tt('source.error')}</span>]
     }
     if (check.throttled === true) {
-      return <span className={css.statusBadge}>{tt('source.throttled')}</span>
+      return [<span key='throttled' className={css.statusBadge}>{tt('source.throttled')}</span>]
     }
     if (check.unverified === true) {
-      return <span className={css.statusBadge}>{tt('source.unverified')}</span>
+      return [<span key='unverified' className={css.statusBadge}>{tt('source.unverified')}</span>]
     }
     if (check.changed) {
-      return (
-        <span className={css.statusBadges}>
-          {check.updated.length > 0 ? <span className={css.statusBadge + ' ' + css.statusUpdated}>{tt('source.updated', { count: check.updated.length })}</span> : null}
-          {check.deleted.length > 0 ? <span className={css.statusBadge + ' ' + css.statusError}>{tt('source.deleted', { count: check.deleted.length })}</span> : null}
-        </span>
-      )
+      return [
+        ...(check.updated.length > 0 ? [<span key='updated' className={css.statusBadge + ' ' + css.statusUpdated}>{tt('source.updated', { count: check.updated.length })}</span>] : []),
+        ...(check.deleted.length > 0 ? [<span key='deleted' className={css.statusBadge + ' ' + css.statusError}>{tt('source.deleted', { count: check.deleted.length })}</span>] : []),
+      ]
     }
-    return <span className={css.statusBadge + ' ' + css.statusOk}>{tt('source.upToDate')}</span>
+    return [<span key='ok' className={css.statusBadge + ' ' + css.statusOk}>{tt('source.upToDate')}</span>]
   })()
-  if (onCheck === undefined) return badges
+  // 本地改动与上游状态正交：上游没变时它同样存在，所以挂在状态旁边而不是
+  // 塞进状态分支里。
+  const modified = check.localModified ?? []
+  if (modified.length > 0) {
+    items.push(
+      <span key='local' className={css.statusBadge + ' ' + css.statusLocal} title={tt('source.localModifiedHint') + '\n' + modified.join(', ')}>
+        {tt('source.localModified', { count: modified.length })}
+      </span>,
+    )
+  }
+  const combined = <span className={css.statusBadges}>{items}</span>
+  if (onCheck === undefined) return combined
   return (
     <button type='button' className={css.statusWrap} title={tt('source.checkHint')} onClick={onCheck}>
-      {badges}
+      {combined}
     </button>
   )
 }

package/src/client/panel/dialogs.tsx

@@ -55,7 +55,7 @@ export interface MarketSyncDialogState {
 }
 
 /** Overlay + centered alert-dialog shell; outside click or Escape cancels. */
-function DialogShell(props: { onClose: () => void; children: ReactNode }): JSX.Element {
+export function DialogShell(props: { onClose: () => void; children: ReactNode }): JSX.Element {
   useEffect(() => {
     const onKey = (event: KeyboardEvent): void => {
       if (event.key === 'Escape') props.onClose()
@@ -78,20 +78,31 @@ export function ConfirmDialog(props: {
   text: string
   /** Optional skill names listed between the text and the buttons. */
   items?: readonly string[]
+  /**
+   * 这些条目在磁盘上已被本地改过。列出来时逐个标记 —— 「会覆盖本地修改」
+   * 这句话只有在能指出是哪几个时才有用。
+   */
+  marked?: readonly string[]
   confirmLabel: string
   /** Danger-styled confirm button (destructive actions). */
   danger?: boolean
   onCancel: () => void
   onConfirm: () => void
 }): JSX.Element {
-  const { title, text, items, confirmLabel, danger, onCancel, onConfirm } = props
+  const { title, text, items, marked, confirmLabel, danger, onCancel, onConfirm } = props
+  const markedSet = new Set(marked ?? [])
   return (
     <DialogShell onClose={onCancel}>
       <h3 className={css.dialogTitle}>{title}</h3>
       <p className={css.dialogText}>{text}</p>
       {items !== undefined ? (
         <ul className={css.dialogList}>
-          {items.map((name) => <li key={name}><span className={css.rowNameText}>{name}</span></li>)}
+          {items.map((name) => (
+            <li key={name}>
+              <span className={css.rowNameText}>{name}</span>
+              {markedSet.has(name) ? <span className={css.statusBadge + ' ' + css.statusLocal} style={{ marginLeft: 6 }}>{tt('source.localModifiedBadge')}</span> : null}
+            </li>
+          ))}
         </ul>
       ) : null}
       <div className={css.dialogActions}>

package/src/client/panel/panel.module.css

@@ -70,6 +70,10 @@
 
 .empty { font-size: 13px; color: var(--hub-text-3); padding: 20px 0; text-align: center; }
 .diagRow { font-size: 12px; padding: 9px 14px; border-left: 3px solid var(--hub-warn); background: rgba(210,153,34,.06); }
+/* 审计条目与发现诊断共用一块 UI：block 级换成红色边框，一眼分得出「文件没加载」
+   和「文件能加载但正文有问题」。 */
+.diagRowBlock { border-left-color: var(--hub-danger); background: rgba(209,36,47,.06); }
+.auditBadge { display: inline-block; margin-right: 6px; padding: 0 5px; border-radius: 4px; font-size: 11px; font-weight: 700; color: var(--hub-danger); background: rgba(209,36,47,.12); vertical-align: 1px; }
 .diagPath { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 11px; color: var(--hub-text-2); word-break: break-all; }
 .diagReason { color: var(--hub-text-3); margin-top: 1px; }
 .updateLink { color: inherit; font-weight: 600; text-decoration: underline; }
@@ -163,6 +167,8 @@
 .statusOk { color: var(--hub-success); border-color: currentColor; background: transparent; }
 .statusUpdated { color: var(--hub-warn); border-color: currentColor; background: rgba(210,153,34,.08); }
 .statusError { color: var(--hub-danger); border-color: currentColor; background: rgba(209,36,47,.08); }
+/* 本地已改动：既不是上游有更新，也不是错误 —— 是「这份磁盘内容和你导入的不一样」。 */
+.statusLocal { color: var(--hub-accent); border-color: currentColor; background: rgba(47,129,247,.08); }
 
 /* Clickable status badge (group-header re-check affordance). */
 .statusWrap { display: inline-flex; gap: 4px; align-items: center; border: none; background: none; padding: 0; cursor: pointer; font-family: inherit; }

package/src/client/panel/useSkillHub.ts

@@ -212,6 +212,6 @@ export function useSkillHub(api: SkillHubApi) {
     clearScan: marketFlow.clearScan,
     checkMarket: marketFlow.checkMarket, loadMarketStats: marketFlow.loadMarketStats,
     syncMarketSource: marketFlow.syncMarketSource, confirmMarketSync: marketFlow.confirmMarketSync,
-    updateAll: marketFlow.updateAll, create: catalogFlow.create,
+    updateAll: marketFlow.updateAll, create: catalogFlow.create, reloadCatalog: catalogFlow.load,
   }
 }

package/src/index.ts

@@ -134,8 +134,8 @@ const SECTION_ORDER = 152
 
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
 export const SKILL_HUB_GUIDANCE = [
-  '本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；本插件的配置页（启用/公告开关、圆点颜色、GitHub token、统计窗口）在插件管理页——侧边栏「插件」→ 本插件，是本插件自己注册的配置卡片（默认折叠，点标题展开）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由受 dsh 自身的 /api 信任栅栏保护（回环、监听器绑定地址、--trusted-host 声明的 authority，外加浏览器会话认证），因此反代部署下与 GUI 同一套放行规则。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。',
-  'The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → "Skills" is the management page; the plugin\'s configuration page (enable / announcement toggles, dot colors, GitHub token, stats window) is registered by the plugin itself on its own page in the Plugins manager (sidebar → 插件 → the plugin; collapsed until you expand the title). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with "check all" and "update all" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics; new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; the routes sit behind dsh\'s own /api trust fence (loopback, the listener\'s bind address, any --trusted-host authority, plus browser-session authentication), so a reverse-proxied deployment is judged exactly like the GUI around it. When the user mentions "skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill", this plugin is what they mean — collaborate accordingly.'
+  '本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；本插件的配置页（启用/公告开关、圆点颜色、GitHub token、统计窗口）在插件管理页——侧边栏「插件」→ 本插件，是本插件自己注册的配置卡片（默认折叠，点标题展开）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；内容审计（隐藏字符、危险命令、凭据路径与体积上限；市场导入命中阻断级规则即整包拒绝）；技能目录公告预算（一层渐进加载注入的字符数与 token 估算）；本地内容哈希比对（标出被自己改过、同步会覆盖的技能）；从其他 agent 的技能目录只读导入（Claude Code / Codex / Cursor / Gemini CLI 等）；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由受 dsh 自身的 /api 信任栅栏保护（回环、监听器绑定地址、--trusted-host 声明的 authority，外加浏览器会话认证），因此反代部署下与 GUI 同一套放行规则。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。',
+  'The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → "Skills" is the management page; the plugin\'s configuration page (enable / announcement toggles, dot colors, GitHub token, stats window) is registered by the plugin itself on its own page in the Plugins manager (sidebar → 插件 → the plugin; collapsed until you expand the title). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with "check all" and "update all" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics plus a content audit (hidden characters, dangerous commands, credential paths, size caps — a market import with a blocking finding is refused as a whole); the skill-catalog announcement budget (characters and estimated tokens for the first progressive-disclosure layer); local content-hash comparison (flags skills you edited that a sync would overwrite); read-only import from other agents\' skill folders (Claude Code / Codex / Cursor / Gemini CLI and friends); new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; the routes sit behind dsh\'s own /api trust fence (loopback, the listener\'s bind address, any --trusted-host authority, plus browser-session authentication), so a reverse-proxied deployment is judged exactly like the GUI around it. When the user mentions "skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill", this plugin is what they mean — collaborate accordingly.'
 ].join('\n\n')
 
 /**

package/src/protocol/api.ts

@@ -49,4 +49,6 @@ export const SKILL_HUB_API = {
   diagnosticFix: '/api/skill-hub/diagnostic/fix',
   marketSourceVersions: '/api/skill-hub/market/source/versions',
   marketStats: '/api/skill-hub/market/stats',
+  foreign: '/api/skill-hub/foreign',
+  foreignImport: '/api/skill-hub/foreign/import',
 } as const

package/src/protocol/catalog.ts

@@ -54,6 +54,60 @@ export interface DiagnosticEntry {
   reason: string
   /** Whether this diagnostic can be auto-fixed (e.g. unquoted colon). */
   fixable?: boolean
+  /**
+   * 条目来源。缺省 = 发现诊断（provider 跳过了这个文件）；`security` = 内容审计
+   * （文件能被加载，但正文里有值得看一眼的东西）。两者共用同一块 UI，但
+   * security 条目不能「修复」，只能说清问题在哪一行。
+   */
+  kind?: 'security'
+  /** security 条目的严重度；发现诊断条目省略。 */
+  severity?: 'block' | 'warn'
+}
+
+/**
+ * 技能目录在 system prompt 里占用的公告预算。渐进加载的第一层只放
+ * name + description，但技能多了这一层本身就会顶到客户端的上限而被截断，
+ * 表现为「装了却不触发」—— 面板必须能看见这个数字。
+ */
+export interface AnnouncementBudget {
+  /** 参与公告的技能数（已启用且 modelInvocable）。 */
+  skills: number
+  /** name + description + whenToUse 的总字符数。 */
+  chars: number
+  /** 粗略 token 估算（按 3 字符/token）。 */
+  approxTokens: number
+  /** 建议预算（字符），超出即 overBudget。 */
+  budget: number
+  overBudget: boolean
+}
+
+/**
+ * 技能目录的建议字符预算。取 8000：这是 Codex 在上下文窗口未知时对初始
+ * 技能清单的硬上限，也是目前公开客户端里最保守的一档。超出后尾部条目会被
+ * 静默丢弃（技能看起来装了，实际不触发）。
+ */
+export const ANNOUNCEMENT_CHAR_BUDGET = 8000
+
+/**
+ * 按「已启用且模型可调用」的技能估算公告成本。只统计一层渐进加载真正注入的
+ * 字段（name + description + whenToUse），不含正文 —— 正文是激活后才载入的，
+ * 不占常驻预算。
+ */
+export function computeAnnouncementBudget(skills: readonly CatalogSkill[]): AnnouncementBudget {
+  let chars = 0
+  let count = 0
+  for (const skill of skills) {
+    if (!skill.invocation.modelInvocable) continue
+    count += 1
+    chars += skill.name.length + skill.description.length + (skill.whenToUse?.length ?? 0)
+  }
+  return {
+    skills: count,
+    chars,
+    approxTokens: Math.ceil(chars / 3),
+    budget: ANNOUNCEMENT_CHAR_BUDGET,
+    overBudget: chars > ANNOUNCEMENT_CHAR_BUDGET,
+  }
 }
 
 /** POST /api/skill-hub/diagnostic/fix — repair a fixable diagnostic in place. */
@@ -78,6 +132,8 @@ export interface CatalogResponse {
   disabled: DisabledSkill[]
   /** Files in the writable roots the provider ignores, with reasons. */
   diagnostics: DiagnosticEntry[]
+  /** 技能目录占用的公告预算（见 AnnouncementBudget）。 */
+  announcement: AnnouncementBudget
   /** Skill names that appeared in multiple roots (first wins, others hidden). Mirrors codex name_counts. */
   duplicateNames?: string[]
 }

package/src/protocol/foreign.ts

@@ -0,0 +1,47 @@
+/**
+ * 外部 agent 技能（收编）的线格式。
+ *
+ * 发现源是别的 agent 的用户级技能目录（Claude Code / Codex / Cursor / …），
+ * 它们一律只读：这里只描述「看到了什么」和「要收编哪一个」。
+ */
+
+/** 一个被扫描的外部技能根。 */
+export interface ForeignRootView {
+  agent: string
+  dir: string
+  /** 该目录在本机是否存在（不存在时 skills 里不会出现它的条目）。 */
+  present: boolean
+}
+
+/** 一条可收编的外部技能。 */
+export interface ForeignSkillView {
+  name: string
+  description: string
+  agent: string
+  /** 发现文件绝对路径（只读展示）。 */
+  path: string
+  kind: 'directory' | 'flat'
+  /** 目标根已有同名技能，不可导入。 */
+  existing: boolean
+}
+
+/** GET /api/skill-hub/foreign */
+export interface ForeignListResponse {
+  ok: true
+  roots: ForeignRootView[]
+  skills: ForeignSkillView[]
+}
+
+/** POST /api/skill-hub/foreign/import — 按 agent + 名字收编（不信任前端给的路径）。 */
+export interface ForeignImportRequest {
+  items: Array<{ agent: string; name: string }>
+}
+
+export interface ForeignImportResponse {
+  ok: true
+  imported: string[]
+  /** 导入前被移入回收站的同名占位（已禁用的发现文件 / 空壳目录），可恢复。 */
+  replaced?: string[]
+  skipped: Array<{ name: string; reason: string }>
+  failed: Array<{ name: string; error: string }>
+}

package/src/protocol/sources.ts

@@ -15,6 +15,12 @@ export interface SourceRecord {
   skills: string[]
   /** 仓库内路径 → 文件大小 的基线清单（差异检测用；缺失 = 无基线）。 */
   manifest?: Record<string, number>
+  /**
+   * 技能名 → 本地内容哈希（导入/同步落盘后立刻采集）。用于区分「上游变了」
+   * 与「本地被改过」：没有它，「全部更新」只能盲覆盖。缺失 = 该技能还没采集过
+   * （旧记录），比对时按「未知」处理，不误报为已修改。
+   */
+  localHashes?: Record<string, string>
 }
 
 /** 回收站条目：上游删除后跟进删除（移入 .trash）的技能。 */
@@ -77,6 +83,11 @@ export interface SourceCheckResult {
   throttled?: boolean
   /** 该来源此前没有快照（迁移/旧记录），本次已回填 commit，尚未有差异基线。 */
   unverified?: boolean
+  /**
+   * 本地磁盘内容与上次导入/同步时不一致的技能（用户自己改过）。只在检查
+   * 时本地能读到文件才判定；哈希未采集过（旧记录）的技能不出现在这里。
+   */
+  localModified?: string[]
 }
 
 /** POST /api/skill-hub/sources/check */
@@ -100,6 +111,8 @@ export interface SourceSyncResponse {
   commitSha: string
   /** 成功同步的技能。 */
   synced: string[]
+  /** 本次同步覆盖掉的、本地有改动的技能（改前哈希 ≠ 记录哈希）。 */
+  overwritten?: string[]
   /** 失败的技能。 */
   failed: Array<{ name: string; error: string }>
 }