dsh-wsl-workspace 0.3.1 → 0.3.2

package/README.de.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 
 ![alt text](image-3.png)

package/README.es.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 
 ![alt text](image-3.png)

package/README.fr.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 
 ![alt text](image-3.png)

package/README.ja.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 
 ![alt text](image-3.png)

package/README.ko.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 
 ![alt text](image-3.png)

package/README.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 ![alt text](image-3.png)
 Add a WSL workspace from the DeepSeek Harness web GUI and run the whole agent session — bash commands and file reads/writes — inside a local WSL distribution with Linux paths. Nothing needs to be installed inside WSL. The session can reach both WSL and Windows at the same time: bash commands run inside the WSL distribution, while Windows files stay accessible via `/mnt/<drive>` (for example `/mnt/c/Users/...`).
@@ -33,6 +36,15 @@ Click "Create & open" to start a new session in the workspace. In the new sessio
 - **File tools (`read`/`write`/`edit`)**: go through the Windows-side WSL 9P share and run under the DSH file policy. Under `workspace-write`, reads work anywhere but writes are restricted to the session workspace; switch the file policy to `danger-full-access` to also allow writes outside it. The username field does not affect the file tools.
 - The garbled `localhost` port-forwarding banner `wsl.exe` prints to stderr when the distro was not running yet is harmless.
 
+## Changelog
+
+### 0.3.2 — 2026-08-29
+
+- **WSL workspace sessions now inject nested-project skill catalogs** ([#10](https://github.com/6Mikao9/dsh-wsl-workspace/issues/10)): `.dsh/skills` and `.agents/skills` directories of projects nested below the registered workspace root are discovered and published with the host's project ranks and sources, so the model sees the same skill catalog it would see when the session cwd is the project folder itself. Discovery is depth- and budget-bounded, prunes `node_modules`/dot-directories, and leaves non-WSL sessions untouched.
+- **Host-parity scan root**: lookups from inside a project subtree resolve the nearest `.git` ancestor first, so the enclosing project's skills stay visible from deeper cwds; skills above that ancestor do not leak.
+- **Hardening**: the skill-root budget is enforced per push, and the `skills.registerProvider` call is guarded so a host whose `skills` service has a different shape can no longer break plugin load.
+- **Housekeeping**: removed stale prebuilt `lib/` chunks that shipped dead vendor code (including an inlined schemastery copy that triggered dsh.so's `new Function` static rule); added `scripts/repro-setup.sh` plus a nested skill-catalog regression suite, and a matching TESTING.md section.
+
 ## License & attribution
 
 MIT — see [LICENSE](LICENSE) and [NOTICE](NOTICE). The NOTICE precisely lists:

package/README.pt.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 
 ![alt text](image-3.png)

package/README.ru.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 
 ![alt text](image-3.png)

package/README.zh.md

@@ -1,5 +1,8 @@
 # dsh-wsl-workspace
 
+[![dsh.so security](https://www.dsh.so/badge/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+[![dsh.so install](https://www.dsh.so/badge/install/dsh-wsl-workspace.svg)](https://www.dsh.so/artifact/dsh-wsl-workspace)
+
 [English](README.md) · [中文](README.zh.md) · [日本語](README.ja.md) · [한국어](README.ko.md) · [Français](README.fr.md) · [Deutsch](README.de.md) · [Español](README.es.md) · [Português](README.pt.md) · [Русский](README.ru.md)
 ![alt text](image-3.png)
 在 DeepSeek Harness Web GUI 中「添加 WSL 工作区」：让 agent 会话的 bash 命令与文件读写都运行在本机 WSL 发行版里，路径均为 Linux 形式，WSL 内无需安装任何工具链。会话可同时访问 WSL 与 Windows 两个系统——bash 命令在 WSL 发行版内执行，Windows 文件随时可通过 `/mnt/<drive>`（如 `/mnt/c/Users/...`）访问。

package/TESTING.md

@@ -13,7 +13,7 @@ This document describes how to verify `dsh-wsl-workspace` after a change or befo
 Run the unit tests from the plugin directory:
 
 ```powershell
-node --experimental-strip-types --test tests/variants.test.ts tests/fs-execution-context.test.ts tests/shell.test.ts tests/paths.test.ts
+node --experimental-strip-types --test tests/variants.test.ts tests/fs-execution-context.test.ts tests/shell.test.ts tests/paths.test.ts tests/wsl-skills.test.ts
 ```
 
 Coverage:
@@ -24,6 +24,7 @@ Coverage:
 | `tests/fs-execution-context.test.ts` | `WslFileSystem` inherits the calling session's cwd through `AsyncLocalStorage` on `tools/execute`; agentless calls fall back to the configured distro. |
 | `tests/shell.test.ts` | The login-shell `cd` prefix preserves the resolved workdir (including single-quote escaping); non-login shells leave the command unchanged. |
 | `tests/paths.test.ts` | UNC ↔ Linux path translation, `/mnt/<drive>` mapping, canonical Windows path keys, WSL username validation. |
+| `tests/wsl-skills.test.ts` | The WSL skill provider (issue #10): non-WSL lookups return nothing, nested `.dsh/skills` / `.agents/skills` discovery with host ranks/sources, `get()` body loading, pruning of `node_modules` / dot-directories, frontmatter validation, depth and skill-root budgets, the nearest-`.git`-ancestor rule (a cwd deeper than the project root still sees the project's skills, and skills above that ancestor do not leak), and the skill-root cap. |
 
 ## Preset materialization integration test
 
@@ -59,6 +60,27 @@ The `build` script chains it after `tsdown`:
 pnpm build   # tsdown && node scripts/verify-lib.mjs
 ```
 
+## Nested skill-catalog regression (issue #10)
+
+The WSL skill provider publishes `.dsh/skills` / `.agents/skills` from nested projects below a WSL workspace (and from the cwd's nearest `.git` ancestor). Regression-test it on the real 9P share:
+
+1. Rebuild the repro tree inside the distribution (`scripts/repro-setup.sh` creates `~/repro-ws-root` with nested projects, pruned traps, and an over-budget deep skill):
+
+   ```powershell
+   cp scripts/repro-setup.sh //wsl.localhost/<distro>/tmp/
+   wsl -d <distro> -- bash -c "bash /tmp/repro-setup.sh"
+   ```
+
+2. Drive the provider against the real `\\wsl.localhost` share — four assertions print (workspace-root cwd finds root + nested skills; nested-project cwd finds only that project; `get()` loads a body; non-WSL cwd returns nothing):
+
+   ```powershell
+   node scripts/repro-e2e.mjs
+   ```
+
+   The script hardcodes `\\wsl.localhost\Ubuntu\home\mille\repro-ws-root`; adjust the two paths at the top when running as another user or distro.
+3. In the running harness, open a session on the repro workspace and ask the agent to load the nested skills (`brainstorming`, `systematic-debugging`, `writing-plans`) through its skill tool — each must load with the `wsl-workspace` provider attribution, and no duplicate entries may appear. In a non-WSL workspace session the same skills must be "unknown".
+4. Clean-install check (simulates another user): `npm pack`, `npm install <tarball>` in an empty temp project (peers must resolve), then `dsh plugin --profile web add <extracted tarball dir>`, restart `dsh web`, and repeat the end-to-end checks below plus the nested-skill probe above.
+
 ## End-to-end verification in the running harness
 
 After installing the plugin into a profile and restarting `dsh web`:
@@ -73,8 +95,9 @@ After installing the plugin into a profile and restarting `dsh web`:
 ## Release checklist
 
 1. `pnpm build` — rebuilds `lib/` and runs the verification gate.
-2. `node --experimental-strip-types --test tests/variants.test.ts tests/fs-execution-context.test.ts tests/shell.test.ts tests/paths.test.ts` — all green.
+2. `node --experimental-strip-types --test tests/variants.test.ts tests/fs-execution-context.test.ts tests/shell.test.ts tests/paths.test.ts tests/wsl-skills.test.ts` — all green.
 3. `node tests/host-materialize.mjs` — all assertions pass.
 4. `node --experimental-strip-types tests/smoke.ts` — real-WSL round-trip passes.
-5. `npm pack --dry-run` — confirm the tarball carries only live `lib/` chunks, `src/`, `cordis.patch.yml`, READMEs, `LICENSE`, and `NOTICE`.
-6. Install the tarball into a clean profile (`dsh plugin --profile web add <tarball>`), restart `dsh web`, and run the end-to-end checks above.
+5. `node scripts/repro-e2e.mjs` (after `scripts/repro-setup.sh`) — nested skill-catalog assertions pass.
+6. `npm pack --dry-run` — confirm the tarball carries only live `lib/` chunks, `src/`, `cordis.patch.yml`, READMEs, `LICENSE`, and `NOTICE` (tsdown uses `clean: false`, so remove stale chunks from `lib/` before packing).
+7. Install the tarball into a clean profile (`dsh plugin --profile web add <tarball>`), restart `dsh web`, and run the end-to-end checks above plus the nested-skill probe.

package/lib/fs.js

@@ -1,7 +1,7 @@
 import { a as isAbsoluteLinuxPath, c as joinUnc, d as parseWslUnc, f as windowsToMntPath, l as mntToWindowsPath, n as defaultDistroSync } from "./wsl-C5_mxGPM.js";
 import z from "@deepseek-ai/schemastery";
-import { AsyncLocalStorage } from "node:async_hooks";
 import { link, lstat, rename } from "node:fs/promises";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { FsError } from "@deepseek-ai/dsh-fs";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
 //#region src/fs.ts

package/lib/index.js

@@ -3,8 +3,9 @@ import { a as registerWindowsWorkspace, i as listWorkspaceKeys, n as getWindowsW
 import z from "@deepseek-ai/schemastery";
 import { cpSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
+import { dirname, join, posix } from "node:path";
 import { homedir } from "node:os";
+import { readFile, readdir, stat } from "node:fs/promises";
 //#region src/host/variants.ts
 /**
 * WSL preset-variant generator. For every healthy source preset the roster
@@ -169,6 +170,353 @@ function variantIdFor(sourceId) {
 	return `wsl-${sourceId.toLowerCase()}`;
 }
 //#endregion
+//#region src/host/wsl-skills.ts
+/**
+* WSL workspace skill provider (host half).
+*
+* DSH's shipped skill-filesystem provider scans only the session cwd's
+* project root (the nearest `.git` ancestor) for `.dsh/skills` / `.agents/skills`
+* and never descends into nested projects. A WSL workspace whose project
+* folders live below the registered workspace root therefore shows an empty
+* skill catalog, even though the same layout works when the session cwd is
+* the project folder itself (issue #10).
+*
+* This provider mirrors the host's discovery rules for WSL UNC session
+* workspaces: it starts at the session cwd's nearest `.git` ancestor (the
+* host's project-root rule; the cwd itself when no ancestor has a `.git`
+* marker), then walks that root (depth- and budget-bounded), collects every
+* `.dsh/skills` and `.agents/skills` directory it finds — including nested
+* projects — and publishes their skills with the same
+* project ranks and sources the host uses, so precedence and duplicate
+* resolution behave identically. Non-WSL lookups return nothing and leave
+* the host's own providers untouched.
+*
+* All filesystem reads go through `node:fs` against the `\\wsl.localhost\…`
+* 9P share (the same substrate `WslFileSystem` uses); an injectable IO face
+* keeps the discovery logic unit-testable without a live distro.
+*
+* @module dsh-wsl-workspace/host/wsl-skills
+*/
+/** Project ranks copied from @deepseek-ai/dsh-skill-filesystem so WSL and host entries interleave identically. */
+const PROJECT_DSH_RANK = 100;
+const PROJECT_AGENTS_RANK = 200;
+/** How many directory levels below the workspace root are scanned. */
+const MAX_SCAN_DEPTH = 4;
+/** Maximum distinct skill directories published per lookup. */
+const MAX_SKILL_ROOTS = 64;
+/** Maximum directories visited per lookup (an absolute blast-radius cap). */
+const MAX_VISITED_DIRECTORIES = 4096;
+/** How many parent levels above the session cwd are searched for a `.git` project marker. */
+const MAX_ANCESTOR_WALK = 64;
+/** Kebab-case skill names, matching the host grammar. */
+const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** Directory names that never contain project skill roots (safe to prune while walking). */
+const PRUNED_DIRECTORY_NAMES = new Set([
+	".git",
+	".hg",
+	".svn",
+	".bzr",
+	"node_modules",
+	".venv",
+	"venv",
+	".tox",
+	".pants.d",
+	".next",
+	".nuxt",
+	"dist",
+	"build",
+	"out",
+	"coverage",
+	"__pycache__",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".cache",
+	".idea",
+	".vscode",
+	".serverless",
+	".terraform",
+	".yarn",
+	".pnpm-store"
+]);
+/** The node:fs/promises implementation the provider uses in production. */
+const nodeSkillIo = {
+	readdir: async (path, options) => readdir(path, options),
+	readFile: async (path, options) => readFile(path, options),
+	stat: async (path) => stat(path)
+};
+/**
+* Locate the nearest ancestor of `linuxDir` (the directory itself included)
+* containing a `.git` marker, mirroring the host skill-filesystem's
+* project-root rule. `.git` may be a directory or a worktree pointer file;
+* existence is enough. Bounded so a pathological path cannot spin the walk.
+* @param distro - the WSL distribution name.
+* @param linuxDir - the session cwd's absolute Linux path.
+* @param io - filesystem face.
+* @returns the project root's Linux path, or `undefined` when no ancestor carries a `.git`.
+*/
+async function nearestGitAncestor(distro, linuxDir, io) {
+	let current = linuxDir;
+	for (let levels = 0; levels <= MAX_ANCESTOR_WALK; levels += 1) {
+		try {
+			await io.stat(joinUnc(distro, posix.join(current, ".git")));
+			return current;
+		} catch {}
+		const parent = posix.dirname(current);
+		if (parent === current) return void 0;
+		current = parent;
+	}
+}
+/**
+* Scan a WSL workspace root for nested skill directories.
+* @param distro - the WSL distribution name.
+* @param linuxRoot - the workspace's absolute Linux path.
+* @param io - filesystem face.
+* @returns discovered skill directories, bounded by depth and budget.
+*/
+async function discoverSkillRoots(distro, linuxRoot, io) {
+	const roots = [];
+	const visited = /* @__PURE__ */ new Set();
+	let frontier = [[linuxRoot, 0]];
+	while (frontier.length > 0 && roots.length < MAX_SKILL_ROOTS) {
+		const next = [];
+		for (const [dir, depth] of frontier) {
+			if (visited.size >= MAX_VISITED_DIRECTORIES) return roots;
+			if (visited.has(dir)) continue;
+			visited.add(dir);
+			if (roots.length < MAX_SKILL_ROOTS) {
+				const directoryRoots = await skillRootsOfDirectory(distro, dir, io);
+				roots.push(...directoryRoots.slice(0, MAX_SKILL_ROOTS - roots.length));
+			}
+			if (depth >= MAX_SCAN_DEPTH) continue;
+			let entries;
+			try {
+				entries = await io.readdir(joinUnc(distro, dir), { withFileTypes: true });
+			} catch {
+				continue;
+			}
+			for (const entry of entries) {
+				if (!entry.isDirectory()) continue;
+				if (PRUNED_DIRECTORY_NAMES.has(entry.name)) continue;
+				if (entry.name.startsWith(".") && entry.name !== ".dsh" && entry.name !== ".agents") continue;
+				if (entry.name === ".dsh" || entry.name === ".agents") continue;
+				next.push([posix.join(dir, entry.name), depth + 1]);
+			}
+		}
+		frontier = next;
+	}
+	return roots;
+}
+/**
+* Publish the skill roots of one scanned directory (its `.dsh/skills` and
+* `.agents/skills`, each with the host's project ranks).
+* @param distro - the WSL distribution name.
+* @param linuxDir - the scanned directory's Linux path.
+* @param io - filesystem face.
+* @returns the directory's skill roots that exist.
+*/
+async function skillRootsOfDirectory(distro, linuxDir, io) {
+	const result = [];
+	for (const [marker, source, rank] of [[
+		".dsh",
+		"project-dsh",
+		PROJECT_DSH_RANK
+	], [
+		".agents",
+		"project-agents",
+		PROJECT_AGENTS_RANK
+	]]) {
+		const path = joinUnc(distro, posix.join(linuxDir, marker, "skills"));
+		try {
+			if ((await io.stat(path)).isDirectory()) result.push({
+				path,
+				source,
+				rank
+			});
+		} catch {}
+	}
+	return result;
+}
+/** List one skills directory's entries (directory bundles and flat `.md` skills). */
+async function listSkillEntries(root, io) {
+	let dirents;
+	try {
+		dirents = await io.readdir(root.path, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const entries = [];
+	for (const entry of dirents) if (entry.isDirectory()) entries.push({
+		name: entry.name,
+		kind: "bundle",
+		path: join(root.path, entry.name, "SKILL.md")
+	});
+	else if (entry.isFile() && entry.name.endsWith(".md")) entries.push({
+		name: entry.name.slice(0, -3),
+		kind: "flat",
+		path: join(root.path, entry.name)
+	});
+	return entries.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Read and parse one skill file; `undefined` when missing or unparsable. */
+async function readSkill(path, io, signal) {
+	signal?.throwIfAborted();
+	let raw;
+	try {
+		raw = await io.readFile(path, { encoding: "utf8" });
+	} catch {
+		return;
+	}
+	signal?.throwIfAborted();
+	return parseSkillFrontmatter(raw, path);
+}
+/**
+* Parse the frontmatter subset skill files use: `---` fenced YAML with
+* `name` / `description` / `whenToUse` / `user-invocable` /
+* `disable-model-invocation`. Host-incompatible files are skipped, matching
+* the shipped provider's leniency: a bad file must not fail the catalog.
+*/
+function parseSkillFrontmatter(raw, path) {
+	const firstLineEnd = raw.indexOf("\n");
+	if (firstLineEnd < 0) return void 0;
+	if (raw.slice(0, firstLineEnd).replace(/\r$/, "") !== "---") return void 0;
+	const start = firstLineEnd + 1;
+	const closing = findFrontmatterEnd(raw, start);
+	if (closing === void 0) return void 0;
+	const fields = /* @__PURE__ */ new Map();
+	for (const line of raw.slice(start, closing).split("\n")) {
+		const match = /^([A-Za-z0-9-]+):\s*(.*)$/.exec(line.replace(/\r$/, ""));
+		if (match === null) continue;
+		const value = match[2]?.trim() ?? "";
+		if (value !== "") fields.set(match[1] ?? "", unquote(value));
+	}
+	const name = fields.get("name") ?? "";
+	const description = fields.get("description") ?? "";
+	if (!SKILL_NAME.test(name) || description === "") return;
+	const whenToUse = fields.get("whenToUse");
+	return {
+		name,
+		description,
+		...whenToUse !== void 0 && whenToUse !== "" ? { whenToUse } : {},
+		invocation: {
+			modelInvocable: !frontmatterBoolean(fields, "disable-model-invocation"),
+			userInvocable: frontmatterBoolean(fields, "user-invocable", true)
+		},
+		content: raw.slice(closing + 1).trim()
+	};
+}
+/** Locate the closing `---` line of a frontmatter block. */
+function findFrontmatterEnd(raw, start) {
+	let lineStart = start;
+	while (lineStart <= raw.length) {
+		const nextNewline = raw.indexOf("\n", lineStart);
+		const lineEnd = nextNewline < 0 ? raw.length : nextNewline;
+		if (raw.slice(lineStart, lineEnd).replace(/\r$/, "") === "---") return lineEnd + 1;
+		if (nextNewline < 0) return void 0;
+		lineStart = nextNewline + 1;
+	}
+}
+/** Strip one level of matching quotes from a scalar value. */
+function unquote(value) {
+	if (value.length >= 2) {
+		const first = value[0];
+		const last = value[value.length - 1];
+		if (first === "\"" && last === "\"" || first === "'" && last === "'") return value.slice(1, -1);
+	}
+	return value;
+}
+/** Boolean semantics for `user-invocable` / `disable-model-invocation` (matches the host parser). */
+function frontmatterBoolean(fields, key, dflt = false) {
+	const value = fields.get(key);
+	if (value === void 0) return dflt;
+	switch (value.toLowerCase()) {
+		case "true":
+		case "yes":
+		case "on":
+		case "1": return true;
+		case "false":
+		case "no":
+		case "off":
+		case "0": return false;
+		default: return dflt;
+	}
+}
+/**
+* The WSL workspace skill provider. Registered on the host's `ctx.skills`
+* registry; serves only lookups whose cwd is a WSL UNC workspace path.
+*/
+var WslSkillsProvider = class {
+	name = "wsl-workspace";
+	control;
+	io;
+	constructor(control, io = nodeSkillIo) {
+		this.control = control;
+		this.io = io;
+	}
+	/**
+	* Discover nested project skills for a WSL UNC session workspace.
+	* @param options - lookup options; `cwd` selects the WSL workspace.
+	* @returns candidates for every `.dsh/skills` / `.agents/skills` under the
+	*   session's scan root — the nearest `.git` ancestor of the cwd, else the
+	*   cwd itself — or an empty array for non-WSL lookups.
+	*/
+	async list(options) {
+		this.control.signal.throwIfAborted();
+		options.signal?.throwIfAborted();
+		const unc = options.cwd === void 0 ? null : parseWslUnc(options.cwd);
+		if (unc === null) return [];
+		const scanRoot = await nearestGitAncestor(unc.distro, unc.linuxPath, this.io) ?? unc.linuxPath;
+		const roots = await discoverSkillRoots(unc.distro, scanRoot, this.io);
+		const candidates = [];
+		for (const root of roots) {
+			const entries = await listSkillEntries(root, this.io);
+			for (const entry of entries) {
+				options.signal?.throwIfAborted();
+				const parsed = await readSkill(entry.path, this.io, options.signal);
+				if (parsed === void 0) continue;
+				candidates.push({
+					name: parsed.name,
+					description: parsed.description,
+					...parsed.whenToUse !== void 0 ? { whenToUse: parsed.whenToUse } : {},
+					invocation: parsed.invocation,
+					source: root.source,
+					provider: this.name,
+					rank: root.rank,
+					locator: {
+						path: entry.path,
+						directory: entry.kind === "bundle" ? join(entry.path, "..") : root.path
+					},
+					path: entry.path
+				});
+			}
+		}
+		return candidates;
+	}
+	/**
+	* Load a complete skill body for a previously listed candidate.
+	* @param candidate - the candidate this provider returned.
+	* @param options - lookup options whose signal cancels the read.
+	* @returns the full skill, or `undefined` if the file disappeared.
+	*/
+	async get(candidate, options) {
+		this.control.signal.throwIfAborted();
+		const parsed = await readSkill(candidate.locator.path, this.io, options.signal);
+		if (parsed === void 0 || parsed.name !== candidate.name) return void 0;
+		return {
+			name: parsed.name,
+			description: parsed.description,
+			...parsed.whenToUse !== void 0 ? { whenToUse: parsed.whenToUse } : {},
+			invocation: parsed.invocation,
+			source: candidate.source,
+			provider: candidate.provider,
+			rank: candidate.rank,
+			locator: candidate.locator,
+			path: candidate.path,
+			content: parsed.content
+		};
+	}
+};
+//#endregion
 //#region src/index.ts
 /** The HTTP route this plugin serves (a relative, same-origin path). */
 const DEFAULT_ROUTE = "/wsl-workspace/api";
@@ -489,6 +837,8 @@ function apply(ctx, config) {
 		});
 		return () => {};
 	}, "dsh-wsl-workspace: WSL preset variants");
+	const skills = ctx.get("skills");
+	if (skills !== void 0 && typeof skills.registerProvider === "function") ctx.effect(() => skills.registerProvider((control) => new WslSkillsProvider(control)), "dsh-wsl-workspace: WSL workspace skills provider");
 	const shellEnv = ctx.get("shellEnv");
 	if (shellEnv !== void 0) ctx.effect(() => shellEnv.register({
 		name: "wsl-workspace-distro",