mstro-app 0.4.32 → 0.4.33

package/dist/server/utils/paths.js

@@ -6,7 +6,8 @@
  * Provides consistent path resolution for installed npm package.
  * Works correctly whether running from source or installed globally.
  */
-import { dirname, resolve } from 'node:path';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 // ES module equivalent of __dirname for this file
 const __filename = fileURLToPath(import.meta.url);
@@ -23,4 +24,20 @@ export const MSTRO_ROOT = resolve(__dirname, '../..');
  * Path to the MCP bouncer server script
  */
 export const MCP_SERVER_PATH = resolve(MSTRO_ROOT, 'server/mcp/server.ts');
+/**
+ * Walk up from startDir looking for `.claude/skills/`. Returns the path if found, null otherwise.
+ */
+export function findSkillsDir(startDir) {
+    let dir = startDir;
+    for (let i = 0; i < 10; i++) {
+        const candidate = join(dir, '.claude', 'skills');
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
 //# sourceMappingURL=paths.js.map

package/dist/server/utils/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../server/utils/paths.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,kDAAkD;AAClD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../server/utils/paths.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,gEAAgE;AAEhE;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,kDAAkD;AAClD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;AAE3E;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mstro-app",
-  "version": "0.4.32",
+  "version": "0.4.33",
   "description": "Run Claude Code from any browser - streams live sessions from your machine to mstro.app",
   "type": "module",
   "license": "Apache-2.0",

package/server/cli/improvisation-retry.ts

@@ -455,6 +455,23 @@ function isPrematureCompletionCandidate(
   return result.stopReason === 'max_tokens' || result.stopReason === 'end_turn';
 }
 
+/**
+ * Fast heuristic: detect response abandonment without a Haiku call.
+ * When thinking is significantly longer than the response and the response
+ * contains no tool calls, Claude likely planned work it never executed.
+ * This pattern occurs after context compaction or heavy parallel tool results.
+ */
+function isResponseAbandoned(result: HeadlessRunResult): boolean {
+  const thinkingLen = result.thinkingOutput?.length ?? 0;
+  const responseLen = result.assistantResponse?.length ?? 0;
+  const toolCallsInResponse = result.toolUseHistory?.filter(t => t.result !== undefined).length ?? 0;
+
+  if (thinkingLen < 500 || responseLen > 1000) return false;
+  if (toolCallsInResponse > 0 && responseLen > 200) return false;
+
+  return thinkingLen >= responseLen * 3;
+}
+
 /** Use Haiku to assess whether an end_turn response is genuinely complete */
 async function assessEndTurnCompletion(result: HeadlessRunResult, verbose: boolean): Promise<boolean> {
   if (!result.assistantResponse) return false;
@@ -531,7 +548,8 @@ export async function shouldRetryPrematureCompletion(
 
   const stopReason = result.stopReason!;
   const isMaxTokens = stopReason === 'max_tokens';
-  const isIncomplete = isMaxTokens || await assessEndTurnCompletion(result, session.options.verbose);
+  const abandoned = isResponseAbandoned(result);
+  const isIncomplete = isMaxTokens || abandoned || await assessEndTurnCompletion(result, session.options.verbose);
 
   if (!isIncomplete) return false;
 

package/server/cli/improvisation-session-manager.ts

@@ -115,7 +115,7 @@ export class ImprovisationSessionManager extends EventEmitter {
   // ========== Output Queue ==========
 
   private startQueueProcessor(): void {
-    this.queueTimer = setInterval(() => { this.flushOutputQueue(); }, 10);
+    this.queueTimer = setInterval(() => { this.flushOutputQueue(); }, 50);
   }
 
   private queueOutput(text: string): void {
@@ -136,6 +136,10 @@ export class ImprovisationSessionManager extends EventEmitter {
     this._isExecuting = true;
     this._cancelled = false;
     this._cancelCompleteEmitted = false;
+    if (userPrompt !== 'continue') {
+      this._autoContinueCount = 0;
+      this._autoContinuePending = false;
+    }
     this._executionStartTimestamp = _execStart;
     this.executionEventLog = [];
 
@@ -212,6 +216,11 @@ export class ImprovisationSessionManager extends EventEmitter {
       this.executionEventLog = [];
 
       this.emitMovementComplete(movement, result, _execStart, sequenceNumber);
+
+      if (this.shouldAutoContinue(result, userPrompt)) {
+        this.scheduleAutoContinue();
+      }
+
       return movement;
 
     } catch (error: unknown) {
@@ -474,6 +483,40 @@ export class ImprovisationSessionManager extends EventEmitter {
     this.emit('onSessionUpdate', this.getHistory());
   }
 
+  // ========== Auto-Continue ==========
+
+  private _autoContinueCount = 0;
+  private _autoContinuePending = false;
+  private static readonly MAX_AUTO_CONTINUES = 1;
+
+  private shouldAutoContinue(result: HeadlessRunResult, _userPrompt: string): boolean {
+    if (this._autoContinueCount >= ImprovisationSessionManager.MAX_AUTO_CONTINUES) return false;
+    if (this._cancelled) return false;
+    if (!result.completed || result.signalName) return false;
+    if (result.stopReason !== 'end_turn') return false;
+
+    const thinkingLen = result.thinkingOutput?.length ?? 0;
+    const responseLen = result.assistantResponse?.length ?? 0;
+
+    if (thinkingLen < 500 || responseLen > 1000) return false;
+    return thinkingLen >= responseLen * 3;
+  }
+
+  private scheduleAutoContinue(): void {
+    this._autoContinueCount++;
+    this._autoContinuePending = true;
+    this.queueOutput('\n⟳ Response appears incomplete — auto-continuing…\n');
+    this.flushOutputQueue();
+
+    setImmediate(() => {
+      if (this._cancelled || this._isExecuting || !this._autoContinuePending) return;
+      this._autoContinuePending = false;
+      this.executePrompt('continue').catch((err) => {
+        herror('Auto-continue failed:', err);
+      });
+    });
+  }
+
   // ========== History I/O ==========
 
   private loadHistory(): SessionHistory {

package/server/services/files.ts

@@ -115,8 +115,13 @@ export class FileService {
           isDirectory: entry.isDirectory()
         })
 
-        // Recursively search directories (with depth limit)
-        if (entry.isDirectory() && results.length < 1000) {
+        if (results.length >= 1000) {
+          console.warn('[FilesService] Directory scan hit 1000-item limit — results may be incomplete');
+          return results;
+        }
+
+        // Recursively search directories
+        if (entry.isDirectory()) {
           this.scanDirectory(fullPath, baseDir, results)
         }
       }

package/server/services/plan/agent-loader.ts

@@ -16,6 +16,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { findSkillsDir } from '../../utils/paths.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SYSTEM_AGENTS_DIR = join(__dirname, 'agents');
@@ -46,22 +47,6 @@ function tryLoadFile(filePath: string, variables: Record<string, string>): strin
   }
 }
 
-/**
- * Resolve the project root by walking up from a directory looking for `.claude/skills/`.
- * Returns the `.claude/skills/` path if found, or null.
- */
-function findSkillsDir(startDir: string): string | null {
-  let dir = startDir;
-  for (let i = 0; i < 10; i++) {
-    const candidate = join(dir, '.claude', 'skills');
-    if (existsSync(candidate)) return candidate;
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
 /**
  * Load an agent prompt by name with layered resolution.
  *

package/server/services/websocket/file-explorer-handlers.ts

@@ -111,9 +111,30 @@ export function handleFileExplorerMessage(ctx: HandlerContext, ws: WSContext, ms
       handleRenameFile(ctx, ws, msg, tabId, workingDir);
     },
     notifyFileOpened: () => handleNotifyFileOpened(ctx, ws, msg, workingDir),
-    searchFileContents: () => handleSearchFileContents(ctx, ws, msg, tabId, workingDir),
+    searchFileContents: () => {
+      if (isSandboxed && msg.data?.query) {
+        const searchPath = msg.data.path || msg.data.dirPath;
+        if (searchPath) {
+          const validation = validatePathWithinWorkingDir(searchPath, workingDir);
+          if (!validation.valid) {
+            ctx.send(ws, { type: 'contentSearchError', tabId, data: { error: 'Sandboxed: search path outside project directory' } });
+            return;
+          }
+        }
+      }
+      handleSearchFileContents(ctx, ws, msg, tabId, workingDir);
+    },
     cancelSearch: () => handleCancelSearch(ctx, tabId),
-    findDefinition: () => handleFindDefinition(ctx, ws, msg, tabId, workingDir),
+    findDefinition: () => {
+      if (isSandboxed && msg.data?.filePath) {
+        const validation = validatePathWithinWorkingDir(msg.data.filePath, workingDir);
+        if (!validation.valid) {
+          ctx.send(ws, { type: 'definitionResult', tabId, data: { definitions: [], symbol: msg.data.symbol || '' } });
+          return;
+        }
+      }
+      handleFindDefinition(ctx, ws, msg, tabId, workingDir);
+    },
   };
   const handler = handlers[msg.type];
   if (!handler) return;

package/server/services/websocket/git-handlers.ts

@@ -1,6 +1,7 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
 // Licensed under the MIT License. See LICENSE file for details.
 
+import { resolve } from 'node:path';
 import { loadSkillPrompt } from '../plan/agent-loader.js';
 import { handleGitCheckout, handleGitCreateBranch, handleGitDeleteBranch, handleGitListBranches } from './git-branch-handlers.js';
 import { handleGitCommitDiff, handleGitDiff, handleGitShowCommit } from './git-diff-handlers.js';
@@ -120,6 +121,16 @@ async function handleGitStage(ctx: HandlerContext, ws: WSContext, msg: WebSocket
     return;
   }
 
+  if (!stageAll && paths) {
+    const resolvedRoot = resolve(workingDir);
+    for (const p of paths) {
+      if (!resolve(workingDir, p).startsWith(resolvedRoot)) {
+        ctx.send(ws, { type: 'gitError', tabId, data: { error: `Path traversal not allowed: ${p}` } });
+        return;
+      }
+    }
+  }
+
   try {
     const args = stageAll ? ['add', '-A'] : ['add', '--', ...paths!];
     const result = await executeGitCommand(args, workingDir);
@@ -154,12 +165,18 @@ async function handleGitUnstage(ctx: HandlerContext, ws: WSContext, msg: WebSock
   }
 }
 
+const MAX_COMMIT_MESSAGE_LENGTH = 10_000;
+
 async function handleGitCommit(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string): Promise<void> {
   const message = msg.data?.message as string | undefined;
   if (!message) {
     ctx.send(ws, { type: 'gitError', tabId, data: { error: 'Commit message is required' } });
     return;
   }
+  if (message.length > MAX_COMMIT_MESSAGE_LENGTH) {
+    ctx.send(ws, { type: 'gitError', tabId, data: { error: `Commit message too long (${message.length} chars, max ${MAX_COMMIT_MESSAGE_LENGTH})` } });
+    return;
+  }
 
   try {
     const result = await executeGitCommand(['commit', '-m', message], workingDir);

package/server/services/websocket/handler.ts

@@ -25,6 +25,7 @@ import { handleQualityMessage } from './quality-handlers.js';
 import { handleHistoryMessage, handleSessionMessage, initializeTab, resumeHistoricalSession } from './session-handlers.js';
 import { SessionRegistry } from './session-registry.js';
 import { generateNotificationSummary, handleGetSettings, handleUpdateSettings } from './settings-handlers.js';
+import { handleListSkills } from './skill-handlers.js';
 import { handleCreateTab, handleGetActiveTabs, handleMarkTabViewed, handleRemoveTab, handleReorderTabs, handleSyncPromptText, handleSyncTabMeta } from './tab-handlers.js';
 import { cleanupTerminalSubscribers, handleTerminalMessage } from './terminal-handlers.js';
 import type { FrecencyData, WebSocketMessage, WebSocketResponse, WSContext } from './types.js';
@@ -53,6 +54,9 @@ export class WebSocketImproviseHandler implements HandlerContext {
   }
 
   getRegistry(workingDir: string): SessionRegistry {
+    if (!this.sessionRegistry && workingDir) {
+      this.sessionRegistry = new SessionRegistry(workingDir);
+    }
     if (!this.sessionRegistry) {
       this.sessionRegistry = new SessionRegistry(workingDir);
     }
@@ -87,9 +91,16 @@ export class WebSocketImproviseHandler implements HandlerContext {
     }
   }
 
+  private frecencySaveTimer: ReturnType<typeof setTimeout> | null = null;
+
   recordFileSelection(filePath: string): void {
     this.autocompleteService.recordFileSelection(filePath);
-    this.saveFrecencyData();
+    if (!this.frecencySaveTimer) {
+      this.frecencySaveTimer = setTimeout(() => {
+        this.frecencySaveTimer = null;
+        this.saveFrecencyData();
+      }, 2000);
+    }
   }
 
   handleConnection(ws: WSContext, _workingDir: string): void {
@@ -175,6 +186,8 @@ export class WebSocketImproviseHandler implements HandlerContext {
         return handleGetSettings(this, ws);
       case 'updateSettings':
         return handleUpdateSettings(this, ws, msg);
+      case 'listSkills':
+        return handleListSkills(this, ws, workingDir);
     }
 
     // Dispatch table lookup for domain handlers
@@ -222,28 +235,14 @@ export class WebSocketImproviseHandler implements HandlerContext {
   }
 
   handleClose(ws: WSContext): void {
-    // Destroy sessions owned by this connection to free interval timers
     const tabMap = this.connections.get(ws);
     if (tabMap) {
-      const sessionIds = new Set(tabMap.values());
-      for (const sessionId of sessionIds) {
-        const session = this.sessions.get(sessionId);
-        if (session) {
-          session.destroy();
-          this.sessions.delete(sessionId);
-        }
-      }
+      this.cleanupConnectionResources(tabMap);
     }
     this.connections.delete(ws);
     this.allConnections.delete(ws);
     cleanupTerminalSubscribers(this, ws);
 
-    // Kill any active search processes to prevent resource leaks
-    for (const [key, process] of this.activeSearches) {
-      try { process.kill(); } catch { /* ignore */ }
-      this.activeSearches.delete(key);
-    }
-
     // Clean up file upload handler when no connections remain
     if (this.allConnections.size === 0 && this.fileUploadHandler) {
       this.fileUploadHandler.destroy();
@@ -251,6 +250,26 @@ export class WebSocketImproviseHandler implements HandlerContext {
     }
   }
 
+  private cleanupConnectionResources(tabMap: Map<string, string>): void {
+    // Destroy sessions owned by this connection
+    const sessionIds = new Set(tabMap.values());
+    for (const sessionId of sessionIds) {
+      const session = this.sessions.get(sessionId);
+      if (session) {
+        session.destroy();
+        this.sessions.delete(sessionId);
+      }
+    }
+    // Kill search processes owned by this connection's tabs
+    for (const tabId of tabMap.keys()) {
+      const searchProcess = this.activeSearches.get(tabId);
+      if (searchProcess) {
+        try { searchProcess.kill(); } catch { /* ignore */ }
+        this.activeSearches.delete(tabId);
+      }
+    }
+  }
+
   send(ws: WSContext, response: WebSocketResponse): void {
     try {
       ws.send(JSON.stringify(response));

package/server/services/websocket/session-history.ts

@@ -2,6 +2,7 @@
 // Licensed under the MIT License. See LICENSE file for details.
 
 import { existsSync, readdirSync, readFileSync, unlinkSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import type { HandlerContext } from './handler-context.js';
 import type { WebSocketMessage, WSContext } from './types.js';
@@ -9,8 +10,9 @@ import type { WebSocketMessage, WSContext } from './types.js';
 export function handleHistoryMessage(ctx: HandlerContext, ws: WSContext, msg: WebSocketMessage, tabId: string, workingDir: string): void {
   switch (msg.type) {
     case 'getSessions': {
-      const result = getSessionsList(workingDir, msg.data?.limit ?? 20, msg.data?.offset ?? 0);
-      ctx.send(ws, { type: 'sessions', tabId, data: result });
+      getSessionsList(workingDir, msg.data?.limit ?? 20, msg.data?.offset ?? 0).then(result => {
+        ctx.send(ws, { type: 'sessions', tabId, data: result });
+      });
       break;
     }
     case 'getSessionsCount':
@@ -42,7 +44,7 @@ function getSessionsCount(workingDir: string): number {
   return readdirSync(sessionsDir).filter((name: string) => name.endsWith('.json')).length;
 }
 
-function getSessionsList(workingDir: string, limit: number = 20, offset: number = 0): { sessions: Array<Record<string, unknown> | null>; total: number; hasMore: boolean } {
+async function getSessionsList(workingDir: string, limit: number = 20, offset: number = 0): Promise<{ sessions: Array<Record<string, unknown> | null>; total: number; hasMore: boolean }> {
   const sessionsDir = join(workingDir, '.mstro', 'history');
 
   if (!existsSync(sessionsDir)) {
@@ -60,17 +62,17 @@ function getSessionsList(workingDir: string, limit: number = 20, offset: number
   const total = historyFiles.length;
   const pageFiles = historyFiles.slice(offset, offset + limit);
 
-  const sessions = pageFiles.map((filename: string) => {
+  const sessions = await Promise.all(pageFiles.map(async (filename: string) => {
     const historyPath = join(sessionsDir, filename);
     try {
-      const historyData = JSON.parse(readFileSync(historyPath, 'utf-8'));
-      return buildSessionSummary(historyData);
+      const raw = await readFile(historyPath, 'utf-8');
+      return buildSessionSummary(JSON.parse(raw));
     } catch {
       return null;
     }
-  }).filter(Boolean);
+  }));
 
-  return { sessions, total, hasMore: offset + limit < total };
+  return { sessions: sessions.filter(Boolean), total, hasMore: offset + limit < total };
 }
 
 function getSessionById(workingDir: string, sessionId: string): Record<string, unknown> | null {

package/server/services/websocket/skill-handlers.ts

@@ -0,0 +1,90 @@
+// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
+// Licensed under the MIT License. See LICENSE file for details.
+
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { findSkillsDir } from '../../utils/paths.js';
+import type { HandlerContext } from './handler-context.js';
+import type { SkillEntry, WSContext } from './types.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SYSTEM_AGENTS_DIR = join(__dirname, '..', 'plan', 'agents');
+
+function parseFrontmatter(content: string): Record<string, string> {
+	if (!content.startsWith('---')) return {};
+	const endIdx = content.indexOf('---', 3);
+	if (endIdx === -1) return {};
+	const yaml = content.slice(3, endIdx).trim();
+	const result: Record<string, string> = {};
+	for (const line of yaml.split('\n')) {
+		const colonIdx = line.indexOf(':');
+		if (colonIdx === -1) continue;
+		const key = line.slice(0, colonIdx).trim();
+		let val = line.slice(colonIdx + 1).trim();
+		if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+			val = val.slice(1, -1);
+		}
+		result[key] = val;
+	}
+	return result;
+}
+
+function scanProjectSkills(skillsDir: string): SkillEntry[] {
+	if (!existsSync(skillsDir)) return [];
+	const entries: SkillEntry[] = [];
+	for (const name of readdirSync(skillsDir, { withFileTypes: true })) {
+		if (!name.isDirectory()) continue;
+		const skillFile = join(skillsDir, name.name, 'SKILL.md');
+		if (!existsSync(skillFile)) continue;
+		try {
+			const content = readFileSync(skillFile, 'utf-8');
+			const fm = parseFrontmatter(content);
+			if (fm['user-invocable'] === 'false') continue;
+			entries.push({
+				name: fm.name || name.name,
+				displayName: `/${fm.name || name.name}`,
+				description: fm.description || '',
+				source: 'project',
+			});
+		} catch { /* skip unreadable files */ }
+	}
+	return entries;
+}
+
+function scanSystemAgents(agentsDir: string, seen: Set<string>): SkillEntry[] {
+	if (!existsSync(agentsDir)) return [];
+	const entries: SkillEntry[] = [];
+	for (const file of readdirSync(agentsDir)) {
+		if (!file.endsWith('.md')) continue;
+		const name = file.replace(/\.md$/, '');
+		if (seen.has(name)) continue;
+		try {
+			const content = readFileSync(join(agentsDir, file), 'utf-8');
+			const fm = parseFrontmatter(content);
+			if (fm['user-invocable'] === 'false') continue;
+			entries.push({
+				name: fm.name || name,
+				displayName: `/${fm.name || name}`,
+				description: fm.description || '',
+				source: 'system',
+			});
+		} catch { /* skip unreadable files */ }
+	}
+	return entries;
+}
+
+export function handleListSkills(ctx: HandlerContext, ws: WSContext, workingDir: string): void {
+	const skills: SkillEntry[] = [];
+
+	const projectSkillsDir = findSkillsDir(workingDir);
+	if (projectSkillsDir) {
+		skills.push(...scanProjectSkills(projectSkillsDir));
+	}
+
+	const seen = new Set(skills.map(s => s.name));
+	skills.push(...scanSystemAgents(SYSTEM_AGENTS_DIR, seen));
+
+	skills.sort((a, b) => a.name.localeCompare(b.name));
+	ctx.send(ws, { type: 'skillsList', data: { skills } });
+}

package/server/services/websocket/types.ts

@@ -168,7 +168,9 @@ export interface WebSocketMessage {
     | 'deployHttpRequest'
     // Deploy usage/health message types (cli→server)
     | 'deployUsageReport'
-    | 'deployAiHealthUpdate';
+    | 'deployAiHealthUpdate'
+    // Skill discovery
+    | 'listSkills';
   tabId?: string;
   terminalId?: string;
   // biome-ignore lint/suspicious/noExplicitAny: message envelope carries heterogeneous payloads
@@ -346,7 +348,9 @@ export interface WebSocketResponse {
     | 'deployHttpResponseChunk'
     | 'deployStatus'
     | 'deployUsageReportAck'
-    | 'deployAiHealthAck';
+    | 'deployAiHealthAck'
+    // Skill discovery response types
+    | 'skillsList';
   tabId?: string;
   terminalId?: string;
   // biome-ignore lint/suspicious/noExplicitAny: message envelope carries heterogeneous payloads
@@ -358,6 +362,13 @@ export interface ConnectionData {
   workingDir: string;
 }
 
+export interface SkillEntry {
+  name: string;
+  displayName: string;
+  description: string;
+  source: 'project' | 'system' | 'builtin';
+}
+
 // Extended autocomplete option with metadata
 export interface AutocompleteResult {
   value: string;

package/server/utils/paths.ts

@@ -8,7 +8,8 @@
  * Works correctly whether running from source or installed globally.
  */
 
-import { dirname, resolve } from 'node:path';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 // ES module equivalent of __dirname for this file
@@ -29,3 +30,18 @@ export const MSTRO_ROOT = resolve(__dirname, '../..');
  */
 export const MCP_SERVER_PATH = resolve(MSTRO_ROOT, 'server/mcp/server.ts');
 
+/**
+ * Walk up from startDir looking for `.claude/skills/`. Returns the path if found, null otherwise.
+ */
+export function findSkillsDir(startDir: string): string | null {
+  let dir = startDir;
+  for (let i = 0; i < 10; i++) {
+    const candidate = join(dir, '.claude', 'skills');
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+