vskill 0.5.139 → 0.5.141

package/agents.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-04-26T18:37:09.719Z",
+  "generatedAt": "2026-04-26T19:11:59.758Z",
   "agentPrefixes": [
     ".adal",
     ".agent",

package/dist/commands/stamp-versions.d.ts

@@ -0,0 +1,25 @@
+interface StampOptions {
+    /** Roots to walk. When omitted, defaults to ~/.claude/skills + ~/.claude/plugins/cache. */
+    root?: string[];
+    /** Default version to stamp when missing. */
+    version?: string;
+    /** When true, write changes to disk; otherwise dry-run (just report). */
+    write?: boolean;
+    /** When true, emit one path per line instead of human report. */
+    json?: boolean;
+}
+interface FileResult {
+    path: string;
+    action: "stamped" | "skipped-has-version" | "skipped-no-frontmatter" | "error";
+    current?: string | null;
+    next?: string;
+    error?: string;
+}
+export declare function stampVersionsCommand(opts?: StampOptions): Promise<{
+    scanned: number;
+    stamped: number;
+    alreadyHadVersion: number;
+    errors: number;
+    results: FileResult[];
+}>;
+export {};

package/dist/commands/stamp-versions.js

@@ -0,0 +1,153 @@
+// ---------------------------------------------------------------------------
+// 0759 Phase 7 (B1) — `vskill stamp-versions` command.
+//
+// Walks local skill installation roots and injects `version: "1.0.0"` into the
+// frontmatter of any SKILL.md that is missing a version field. Opt-in only —
+// never runs automatically. Defaults to dry-run; pass `--write` to actually
+// modify files.
+//
+// Default scopes (when no --root passed):
+//   - ~/.claude/skills/                       (Claude Code personal skills)
+//   - ~/.claude/plugins/cache/*/skills/       (plugin-cached skills)
+//
+// Skips files whose frontmatter already declares a version (idempotent).
+// Skips files outside the user's home dir as a safety check.
+// ---------------------------------------------------------------------------
+import { promises as fs } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve, sep } from "node:path";
+const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---(?:\n|$)/;
+const VERSION_LINE_RE = /^version:\s*["']?([^"'\n]+?)["']?\s*$/m;
+async function findSkillMdFiles(roots) {
+    const found = [];
+    for (const root of roots) {
+        try {
+            await walk(root, found);
+        }
+        catch {
+            // Missing root — silently skip.
+        }
+    }
+    return found;
+}
+async function walk(dir, out) {
+    let entries;
+    try {
+        entries = await fs.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            await walk(full, out);
+        }
+        else if (entry.isFile() && entry.name === "SKILL.md") {
+            out.push(full);
+        }
+    }
+}
+function injectVersion(content, version) {
+    const versionLine = `version: "${version}"`;
+    const fm = content.match(FRONTMATTER_RE);
+    if (!fm) {
+        // No frontmatter at all — prepend a minimal one.
+        return `---\n${versionLine}\n---\n${content}`;
+    }
+    if (VERSION_LINE_RE.test(fm[1])) {
+        return content; // already has version → no-op
+    }
+    const newBlock = `${versionLine}\n${fm[1]}`;
+    const closer = fm[0].endsWith("---\n") ? "---\n" : "---";
+    const before = content.slice(0, fm.index ?? 0);
+    const after = content.slice((fm.index ?? 0) + fm[0].length);
+    return `${before}---\n${newBlock}\n${closer}${after}`;
+}
+export async function stampVersionsCommand(opts = {}) {
+    const home = homedir();
+    const defaultRoots = [
+        join(home, ".claude", "skills"),
+        join(home, ".claude", "plugins", "cache"),
+    ];
+    const roots = (opts.root && opts.root.length > 0 ? opts.root : defaultRoots).map((r) => resolve(r));
+    const version = opts.version ?? "1.0.0";
+    const write = !!opts.write;
+    // Safety: refuse to walk a root that isn't under $HOME (prevents ./. or /).
+    const safeRoots = [];
+    for (const r of roots) {
+        if (r === home || r === resolve(home)) {
+            // Refuse a literal home root — would scan EVERYTHING.
+            console.error(`vskill stamp-versions: refusing to walk full home dir: ${r}`);
+            continue;
+        }
+        if (!r.startsWith(home + sep)) {
+            console.error(`vskill stamp-versions: refusing to walk outside home: ${r}`);
+            continue;
+        }
+        safeRoots.push(r);
+    }
+    const files = await findSkillMdFiles(safeRoots);
+    const results = [];
+    let stamped = 0;
+    let already = 0;
+    let errors = 0;
+    for (const path of files) {
+        try {
+            const content = await fs.readFile(path, "utf8");
+            const fm = content.match(FRONTMATTER_RE);
+            if (!fm) {
+                // No frontmatter — we'd be creating one. That's invasive; skip in dry-run
+                // by default and only act on existing-frontmatter cases for stamp-versions.
+                // The full publish flow stamps unconditionally; this CLI is conservative.
+                results.push({ path, action: "skipped-no-frontmatter" });
+                continue;
+            }
+            if (VERSION_LINE_RE.test(fm[1])) {
+                const m = fm[1].match(VERSION_LINE_RE);
+                results.push({ path, action: "skipped-has-version", current: m?.[1] ?? null });
+                already++;
+                continue;
+            }
+            const next = injectVersion(content, version);
+            if (write) {
+                await fs.writeFile(path, next, "utf8");
+            }
+            results.push({ path, action: "stamped", next: version });
+            stamped++;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            results.push({ path, action: "error", error: msg });
+            errors++;
+        }
+    }
+    // Reporting
+    if (opts.json) {
+        process.stdout.write(JSON.stringify({ scanned: files.length, stamped, alreadyHadVersion: already, errors, results, dryRun: !write, version }, null, 2) + "\n");
+    }
+    else {
+        const dryNote = write ? "(applied)" : "(dry-run — pass --write to apply)";
+        process.stdout.write(`vskill stamp-versions ${dryNote}\n`);
+        process.stdout.write(`  scanned: ${files.length}\n`);
+        process.stdout.write(`  stamped: ${stamped} (with version "${version}")\n`);
+        process.stdout.write(`  already had version: ${already}\n`);
+        process.stdout.write(`  errors: ${errors}\n`);
+        if (stamped > 0) {
+            process.stdout.write(`\nFiles ${write ? "stamped" : "would stamp"}:\n`);
+            for (const r of results.filter((r) => r.action === "stamped")) {
+                process.stdout.write(`  + ${r.path}\n`);
+            }
+        }
+        if (errors > 0) {
+            process.stdout.write(`\nErrors:\n`);
+            for (const r of results.filter((r) => r.action === "error")) {
+                process.stdout.write(`  ! ${r.path}: ${r.error}\n`);
+            }
+        }
+    }
+    return { scanned: files.length, stamped, alreadyHadVersion: already, errors, results };
+}
+//# sourceMappingURL=stamp-versions.js.map

package/dist/commands/stamp-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stamp-versions.js","sourceRoot":"","sources":["../../src/commands/stamp-versions.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,uDAAuD;AACvD,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,gBAAgB;AAChB,EAAE;AACF,0CAA0C;AAC1C,4EAA4E;AAC5E,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAC7D,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,cAAc,GAAG,+BAA+B,CAAC;AACvD,MAAM,eAAe,GAAG,wCAAwC,CAAC;AAqBjE,KAAK,UAAU,gBAAgB,CAAC,KAAwB;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,GAAa;IAC5C,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QACrC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,OAAe;IACrD,MAAM,WAAW,GAAG,aAAa,OAAO,GAAG,CAAC;IAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,iDAAiD;QACjD,OAAO,QAAQ,WAAW,UAAU,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,CAAC,8BAA8B;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,GAAG,MAAM,QAAQ,QAAQ,KAAK,MAAM,GAAG,KAAK,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAqB,EAAE;IAOhE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG;QACnB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;KAC1C,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACrF,OAAO,CAAC,CAAC,CAAC,CACX,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAE3B,4EAA4E;IAC5E,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,sDAAsD;YACtD,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,EAAE,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,EAAE,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACzC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,0EAA0E;gBAC1E,4EAA4E;gBAC5E,0EAA0E;gBAC1E,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC/E,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IAED,YAAY;IACZ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjK,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mCAAmC,CAAC;QAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,mBAAmB,OAAO,MAAM,CAAC,CAAC;QAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,OAAO,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC;QAC9C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC"}

package/dist/eval-server/api-routes.d.ts

@@ -28,6 +28,7 @@ export interface AgentScopeEntry {
     isDefault: boolean;
     localSkillCount: number;
     globalSkillCount: number;
+    pluginSkillCount: number;
     resolvedLocalDir: string;
     resolvedGlobalDir: string;
     lastSync: string | null;
@@ -111,6 +112,40 @@ export declare function parseSkillFrontmatter(content: string): Record<string, s
  * for `origin="source"` or if no registry entry matches.
  */
 export declare function deriveSourceAgent(skillDir: string, root: string, origin: "source" | "installed"): string | null;
+/**
+ * 0770 — Pure regex parser. Normalizes any github.com origin remote
+ * (SSH, HTTPS, ssh://) to its canonical `https://github.com/owner/repo`
+ * form (no `.git` suffix, no trailing path). Returns null for non-github
+ * hosts, malformed input, empty/whitespace strings.
+ */
+export declare function parseGithubRemote(remote: string | null | undefined): string | null;
+/**
+ * 0770 — Walk parent directories from `startDir` looking for a `.git` entry
+ * (directory OR file — git worktrees use a `.git` file). Bails at the
+ * filesystem root or after `maxLevels` iterations. Returns the absolute
+ * path of the discovered git root, or null.
+ */
+export declare function walkUpForGitRoot(startDir: string, maxLevels?: number): string | null;
+/**
+ * 0770 — Test-only helper to clear the module-level memoization cache so
+ * tests can isolate detection runs across `beforeEach`.
+ */
+export declare function resetAuthoredSourceLinkCache(): void;
+/**
+ * 0770 — Detect source-repo provenance for a locally-authored skill (no
+ * lockfile entry). Walks for `.git`, reads `origin` remote, normalizes via
+ * `parseGithubRemote`, and computes `skillPath` from `git ls-files` (with a
+ * filesystem fallback for untracked SKILL.md files). Memoized per absolute
+ * skill dir for the eval-server process lifetime.
+ *
+ * All git invocations use `execFileSync` with explicit argv (no shell), a
+ * 1500ms hard timeout, and silenced stderr. Any error converts to
+ * `{null, null}` — `buildSkillMetadata` never throws because of git.
+ */
+export declare function detectAuthoredSourceLink(skillDir: string): {
+    repoUrl: string | null;
+    skillPath: string | null;
+};
 /**
  * Build the T-025 metadata payload for a single skill. Reads SKILL.md from
  * disk if present; returns EMPTY_METADATA on any error so the /api/skills

package/dist/eval-server/api-routes.js

@@ -3,7 +3,7 @@
 // ---------------------------------------------------------------------------
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, statSync } from "node:fs";
 import { execSync, execFileSync } from "node:child_process";
-import { join, resolve, dirname, basename } from "node:path";
+import { join, resolve, dirname, basename, relative } from "node:path";
 import { homedir } from "node:os";
 import { sendJson, readBody } from "./router.js";
 import { initSSE, sendSSE, sendSSEDone, withHeartbeat, startDynamicHeartbeat } from "./sse-helpers.js";
@@ -122,6 +122,14 @@ export async function buildAgentsResponse(opts) {
         agentPresenceCache.binariesKey === cacheKey.binariesKey) {
         return agentPresenceCache.data;
     }
+    // 0772 US-002: count plugin skills once for claude-code. The plugin scanner
+    // walks ~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/skills/, so
+    // the result is independent of agent identity (plugins are CC-only by
+    // current registry design). Pass `home` so tests can override the homedir.
+    const claudePluginCount = scanInstalledPluginSkills({
+        agentId: "claude-code",
+        home,
+    }).length;
     // Map each agent → resolved local + global dir. For tests, `home` overrides
     // the homedir-derived global path. In production, resolveGlobalSkillsDir()
     // handles cross-platform resolution (darwin / linux / win32).
@@ -167,6 +175,7 @@ export async function buildAgentsResponse(opts) {
             isDefault,
             localSkillCount,
             globalSkillCount,
+            pluginSkillCount: agent.id === "claude-code" ? claudePluginCount : 0,
             resolvedLocalDir,
             resolvedGlobalDir,
             lastSync,
@@ -597,6 +606,116 @@ export function deriveSourceAgent(skillDir, root, origin) {
     }
     return null;
 }
+/**
+ * 0770 — Pure regex parser. Normalizes any github.com origin remote
+ * (SSH, HTTPS, ssh://) to its canonical `https://github.com/owner/repo`
+ * form (no `.git` suffix, no trailing path). Returns null for non-github
+ * hosts, malformed input, empty/whitespace strings.
+ */
+export function parseGithubRemote(remote) {
+    const trimmed = (remote ?? "").trim();
+    if (!trimmed)
+        return null;
+    // SSH: git@github.com:owner/repo[.git]
+    let m = /^git@github\.com:([^/\s]+)\/([^/\s]+?)(?:\.git)?$/.exec(trimmed);
+    if (m)
+        return `https://github.com/${m[1]}/${m[2]}`;
+    // ssh://git@github.com/owner/repo[.git]
+    m = /^ssh:\/\/git@github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?$/.exec(trimmed);
+    if (m)
+        return `https://github.com/${m[1]}/${m[2]}`;
+    // http(s)://github.com/owner/repo[.git][/...]
+    m = /^https?:\/\/github\.com\/([^/\s]+)\/([^/\s?#]+?)(?:\.git)?(?:[/?#].*)?$/.exec(trimmed);
+    if (m)
+        return `https://github.com/${m[1]}/${m[2]}`;
+    return null;
+}
+/**
+ * 0770 — Walk parent directories from `startDir` looking for a `.git` entry
+ * (directory OR file — git worktrees use a `.git` file). Bails at the
+ * filesystem root or after `maxLevels` iterations. Returns the absolute
+ * path of the discovered git root, or null.
+ */
+export function walkUpForGitRoot(startDir, maxLevels = 12) {
+    let current = resolve(startDir);
+    for (let i = 0; i < maxLevels; i++) {
+        if (existsSync(join(current, ".git")))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+    return null;
+}
+const authoredSourceLinkCache = new Map();
+/**
+ * 0770 — Test-only helper to clear the module-level memoization cache so
+ * tests can isolate detection runs across `beforeEach`.
+ */
+export function resetAuthoredSourceLinkCache() {
+    authoredSourceLinkCache.clear();
+}
+/**
+ * 0770 — Detect source-repo provenance for a locally-authored skill (no
+ * lockfile entry). Walks for `.git`, reads `origin` remote, normalizes via
+ * `parseGithubRemote`, and computes `skillPath` from `git ls-files` (with a
+ * filesystem fallback for untracked SKILL.md files). Memoized per absolute
+ * skill dir for the eval-server process lifetime.
+ *
+ * All git invocations use `execFileSync` with explicit argv (no shell), a
+ * 1500ms hard timeout, and silenced stderr. Any error converts to
+ * `{null, null}` — `buildSkillMetadata` never throws because of git.
+ */
+export function detectAuthoredSourceLink(skillDir) {
+    const absDir = resolve(skillDir);
+    const cached = authoredSourceLinkCache.get(absDir);
+    if (cached)
+        return cached;
+    const compute = () => {
+        const gitRoot = walkUpForGitRoot(absDir);
+        if (!gitRoot)
+            return { repoUrl: null, skillPath: null };
+        let remote = "";
+        try {
+            remote = execFileSync("git", ["config", "--get", "remote.origin.url"], {
+                cwd: gitRoot,
+                timeout: 1500,
+                stdio: ["ignore", "pipe", "ignore"],
+                encoding: "utf-8",
+            }).trim();
+        }
+        catch {
+            return { repoUrl: null, skillPath: null };
+        }
+        const repoUrl = parseGithubRemote(remote);
+        if (!repoUrl)
+            return { repoUrl: null, skillPath: null };
+        let skillPath = null;
+        try {
+            const tracked = execFileSync("git", ["ls-files", "--full-name", "SKILL.md"], {
+                cwd: absDir,
+                timeout: 1500,
+                stdio: ["ignore", "pipe", "ignore"],
+                encoding: "utf-8",
+            }).trim();
+            if (tracked)
+                skillPath = tracked;
+        }
+        catch {
+            // fall through to filesystem fallback
+        }
+        if (!skillPath) {
+            // Filesystem fallback for untracked SKILL.md — same path the file will
+            // have on github.com once committed and pushed.
+            skillPath = relative(gitRoot, join(absDir, "SKILL.md")).replace(/\\/g, "/");
+        }
+        return { repoUrl, skillPath };
+    };
+    const result = compute();
+    authoredSourceLinkCache.set(absDir, result);
+    return result;
+}
 /**
  * 0737 — Resolve the source-repo provenance (repoUrl + skillPath) for a
  * skill by looking up its lockfile entry. Two precedences:
@@ -608,19 +727,20 @@ export function deriveSourceAgent(skillDir, root, origin) {
  * skill dir basename and the lockfile key differ — fall back to the parent
  * directory's basename when no exact match exists.
  *
- * Returns `{ null, null }` for any non-github source (e.g.
- * `marketplace:specweave/sw#name`) — guessing a repo URL would produce
- * broken anchors. Authored skills (no lockfile entry) also return null.
+ * 0770 — When no lockfile entry resolves provenance, fall through to
+ * `detectAuthoredSourceLink` which inspects the parent git repo's origin
+ * remote. Lockfile-derived values still take precedence to preserve
+ * install-time provenance when the workspace itself is a git repo.
  */
 function resolveSourceLink(skillDir, root) {
     const lock = readLockfile(root);
     if (!lock)
-        return { repoUrl: null, skillPath: null };
+        return detectAuthoredSourceLink(skillDir);
     const skillName = basename(skillDir);
     const parentName = basename(dirname(skillDir));
     const entry = lock.skills[skillName] ?? lock.skills[parentName];
     if (!entry)
-        return { repoUrl: null, skillPath: null };
+        return detectAuthoredSourceLink(skillDir);
     if (entry.sourceRepoUrl) {
         return {
             repoUrl: entry.sourceRepoUrl,
@@ -636,6 +756,9 @@ function resolveSourceLink(skillDir, root) {
     // copy-chip (local path); a fresh `vskill add` writes the explicit
     // `sourceSkillPath` and restores the working anchor via the branch above.
     const m = /^github:([^/]+)\/([^/#]+)/.exec(entry.source ?? "");
+    // 0770: do NOT fall through here — an installed skill with a non-github
+    // `source` (e.g. `marketplace:...`) is still installed, not authored. Local
+    // git detection would leak the workspace remote (umbrella, etc.).
     if (!m)
         return { repoUrl: null, skillPath: null };
     return {