vskill 0.5.85 → 0.5.87

package/dist/eval-server/api-routes.js

@@ -13,7 +13,8 @@ import { parseSource } from "../resolvers/source-resolver.js";
 import { runBenchmarkSSE, runSingleCaseSSE } from "./benchmark-runner.js";
 import { getSkillSemaphore } from "./concurrency.js";
 import { resolveSkillDir } from "./skill-resolver.js";
-import { scanSkills, classifyOrigin } from "../eval/skill-scanner.js";
+import { classifyOrigin, scanSkillsTriScope } from "../eval/skill-scanner.js";
+import { resolveGlobalSkillsDir } from "../eval/path-utils.js";
 import { loadAndValidateEvals, EvalValidationError } from "../eval/schema.js";
 import { readBenchmark } from "../eval/benchmark.js";
 import { writeHistoryEntry, listHistory, readHistoryEntry, computeRegressions, deleteHistoryEntry, getCaseHistory, computeStats } from "../eval/benchmark-history.js";
@@ -28,6 +29,9 @@ import { testActivation } from "../eval/activation-tester.js";
 import { detectMcpDependencies, detectSkillDependencies } from "../eval/mcp-detector.js";
 import { writeActivationRun, listActivationRuns, getActivationRun } from "../eval/activation-history.js";
 import { AGENTS_REGISTRY, detectInstalledAgents } from "../agents/agents-registry.js";
+import { resolveOllamaBaseUrl } from "../eval/env.js";
+import * as settingsStore from "./settings-store.js";
+import { loadStudioSelection, saveStudioSelection } from "./studio-json.js";
 /**
  * Build the response for GET /api/agents/installed.
  * Returns all known agents with installed flag based on detected agents.
@@ -51,6 +55,196 @@ export function buildInstalledAgentsResponse(detectedAgents) {
     }
     return { agents, suggested };
 }
+let agentPresenceCache = null;
+const AGENT_PRESENCE_CACHE_TTL = 30_000;
+/** Test hook — clear the 30 s cache so the next buildAgentsResponse() re-scans. */
+export function resetAgentPresenceCache() {
+    agentPresenceCache = null;
+}
+/** Count skills in a directory following the `<dir>/<skill>/SKILL.md` layout.
+ *  Non-recursive — skills are conventionally flat children of the skills dir. */
+function countSkillsIn(dir) {
+    if (!existsSync(dir))
+        return 0;
+    try {
+        const entries = readdirSync(dir, { withFileTypes: true });
+        let count = 0;
+        for (const entry of entries) {
+            const fullPath = join(dir, entry.name);
+            // Accept plain dirs AND symlinked-dirs.
+            let isDirLike = entry.isDirectory();
+            if (!isDirLike && entry.isSymbolicLink?.()) {
+                try {
+                    isDirLike = statSync(fullPath).isDirectory();
+                }
+                catch { /* broken link */ }
+            }
+            if (!isDirLike)
+                continue;
+            if (existsSync(join(fullPath, "SKILL.md")))
+                count++;
+        }
+        return count;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Build the /api/agents response. Filters to agents with presence and
+ * includes per-agent counts, resolved paths, and shared-folder grouping.
+ *
+ * Results are cached for 30s keyed by `(root, home, binaries)` so repeated
+ * polls don't re-walk the filesystem.
+ */
+export async function buildAgentsResponse(opts) {
+    const root = opts.root;
+    const home = opts.home;
+    const detectedBinaries = opts.detectedBinaries ?? new Set();
+    const cacheKey = {
+        rootKey: root,
+        homeKey: home ?? "",
+        binariesKey: [...detectedBinaries].sort().join(","),
+    };
+    const now = Date.now();
+    if (agentPresenceCache &&
+        now - agentPresenceCache.ts < AGENT_PRESENCE_CACHE_TTL &&
+        agentPresenceCache.rootKey === cacheKey.rootKey &&
+        agentPresenceCache.homeKey === cacheKey.homeKey &&
+        agentPresenceCache.binariesKey === cacheKey.binariesKey) {
+        return agentPresenceCache.data;
+    }
+    // Map each agent → resolved local + global dir. For tests, `home` overrides
+    // the homedir-derived global path. In production, resolveGlobalSkillsDir()
+    // handles cross-platform resolution (darwin / linux / win32).
+    const entries = [];
+    const globalDirByAgentId = new Map();
+    for (const agent of AGENTS_REGISTRY) {
+        const resolvedLocalDir = join(root, agent.localSkillsDir);
+        const resolvedGlobalDir = home
+            ? join(home, firstNonTildeSegment(agent.globalSkillsDir))
+            : resolveGlobalSkillsDir(agent);
+        globalDirByAgentId.set(agent.id, resolvedGlobalDir);
+        const localExists = existsSync(resolvedLocalDir);
+        const globalExists = existsSync(resolvedGlobalDir);
+        const binaryDetected = detectedBinaries.has(agent.id);
+        const hasPresence = localExists || globalExists || binaryDetected;
+        if (!hasPresence)
+            continue;
+        const localSkillCount = countSkillsIn(resolvedLocalDir);
+        const globalSkillCount = countSkillsIn(resolvedGlobalDir);
+        const firstLocalSegment = agent.localSkillsDir.split("/")[0] || "";
+        const hasProjectFolder = firstLocalSegment
+            ? existsSync(join(root, firstLocalSegment))
+            : false;
+        const isDefault = agent.id === "claude-code" && hasProjectFolder;
+        // Best-effort lastSync from lockfile — null when no lockfile or no entry.
+        const lastSync = resolveAgentLastSync(root, agent.id);
+        const health = computeAgentHealth(lastSync, localSkillCount + globalSkillCount);
+        entries.push({
+            id: agent.id,
+            displayName: agent.displayName,
+            featureSupport: agent.featureSupport,
+            isUniversal: agent.isUniversal,
+            parentCompany: agent.parentCompany,
+            detected: hasPresence,
+            isDefault,
+            localSkillCount,
+            globalSkillCount,
+            resolvedLocalDir,
+            resolvedGlobalDir,
+            lastSync,
+            health,
+        });
+    }
+    // Sort: healthy + detected first, then by id.
+    entries.sort((a, b) => {
+        const aMissing = a.health === "missing";
+        const bMissing = b.health === "missing";
+        if (aMissing !== bMissing)
+            return aMissing ? 1 : -1;
+        return a.id.localeCompare(b.id);
+    });
+    // Shared-folder grouping — normalize paths via resolve() and group agents
+    // whose resolvedGlobalDir maps to the same absolute path.
+    const sharedGroups = new Map();
+    for (const entry of entries) {
+        const key = resolve(entry.resolvedGlobalDir);
+        const list = sharedGroups.get(key) ?? [];
+        list.push(entry.id);
+        sharedGroups.set(key, list);
+    }
+    const sharedFolders = [];
+    for (const [path, consumers] of sharedGroups.entries()) {
+        if (consumers.length >= 2) {
+            sharedFolders.push({ path, consumers: consumers.sort() });
+        }
+    }
+    // Suggested: claude-code if detected; else alphabetically-first detected;
+    // else claude-code as fallback (consistent with buildInstalledAgentsResponse).
+    let suggested = "claude-code";
+    if (!entries.some((e) => e.id === "claude-code")) {
+        suggested = entries[0]?.id ?? "claude-code";
+    }
+    const data = { agents: entries, suggested, sharedFolders };
+    agentPresenceCache = { data, ts: now, ...cacheKey };
+    return data;
+}
+function firstNonTildeSegment(p) {
+    if (p.startsWith("~/") || p.startsWith("~\\"))
+        return p.slice(2);
+    if (p.startsWith("~"))
+        return p.slice(1);
+    return p;
+}
+/** Read the lockfile and return the newest `updatedAt` across entries owned by
+ *  `agentId`. Returns null if the lockfile is missing or has no matching entry. */
+function resolveAgentLastSync(root, _agentId) {
+    try {
+        const lock = readLockfile(root);
+        if (!lock?.skills)
+            return null;
+        let newest = null;
+        for (const entry of Object.values(lock.skills)) {
+            const updatedAt = entry.updatedAt;
+            if (typeof updatedAt === "string" && (!newest || updatedAt > newest)) {
+                newest = updatedAt;
+            }
+        }
+        return newest;
+    }
+    catch {
+        return null;
+    }
+}
+function computeAgentHealth(lastSync, totalSkills) {
+    if (totalSkills === 0 && !lastSync)
+        return "missing";
+    if (!lastSync)
+        return "ok";
+    const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
+    const age = Date.now() - new Date(lastSync).getTime();
+    return age > SEVEN_DAYS_MS ? "stale" : "ok";
+}
+export function filterSkillsByScopeAndAgent(skills, filter) {
+    let out = skills;
+    if (filter.scope !== undefined) {
+        const allowed = ["own", "installed", "global"];
+        if (!allowed.includes(filter.scope))
+            return [];
+        out = out.filter((s) => (s.scope ?? "own") === filter.scope);
+    }
+    if (filter.agent !== undefined) {
+        const agent = filter.agent;
+        out = out.filter((s) => {
+            const scope = s.scope ?? "own";
+            if (scope === "own")
+                return true;
+            return s.sourceAgent === agent;
+        });
+    }
+    return out;
+}
 // ---------------------------------------------------------------------------
 // Shared helpers
 // ---------------------------------------------------------------------------
@@ -319,6 +513,10 @@ const PROVIDER_MODELS = {
 const PROBE_CACHE_TTL = 30_000; // re-probe every 30s
 let ollamaCache = null;
 let lmStudioCache = null;
+export const OPENROUTER_CACHE = new Map();
+export function resetOpenRouterCache() {
+    OPENROUTER_CACHE.clear();
+}
 /** Test hook: clear all probe caches so the next detectAvailableProviders() re-probes. */
 export function resetDetectionCache() {
     ollamaCache = null;
@@ -332,7 +530,7 @@ async function probeOllama() {
     let models = PROVIDER_MODELS["ollama"];
     let available = false;
     try {
-        const baseUrl = process.env.OLLAMA_BASE_URL || "http://localhost:11434";
+        const baseUrl = resolveOllamaBaseUrl(process.env);
         const resp = await fetch(`${baseUrl}/api/tags`, { signal: AbortSignal.timeout(500) });
         if (resp.ok) {
             available = true;
@@ -374,27 +572,83 @@ async function probeLmStudio() {
     lmStudioCache = { available, models, ts: now };
     return lmStudioCache;
 }
+const DETECTION_WRAPPER_FOLDERS = [
+    ".claude",
+    ".cursor",
+    ".codex",
+    ".gemini",
+    ".github",
+    ".zed",
+    ".specweave",
+];
+const DETECTION_BINARIES = ["claude", "cursor", "codex", "gemini"];
+let detectionCache = null;
+const DETECTION_CACHE_TTL = 30_000;
+export function resetProjectDetectionCache() {
+    detectionCache = null;
+}
+/**
+ * Scan the project root for known agent wrapper folders and the system
+ * PATH for known agent binaries. Cheap synchronous scan (`existsSync` +
+ * `which`) cached for 30 s so repeated `/api/config` polls don't burn CPU.
+ */
+export function detectProjectAgents(root) {
+    const now = Date.now();
+    if (detectionCache && now - detectionCache.ts < DETECTION_CACHE_TTL) {
+        return detectionCache.data;
+    }
+    const wrapperFolders = {};
+    for (const folder of DETECTION_WRAPPER_FOLDERS) {
+        try {
+            wrapperFolders[folder] = existsSync(join(root, folder));
+        }
+        catch {
+            wrapperFolders[folder] = false;
+        }
+    }
+    const binaries = {};
+    for (const bin of DETECTION_BINARIES) {
+        binaries[bin] = isBinaryOnPath(bin);
+    }
+    const data = { wrapperFolders, binaries };
+    detectionCache = { data, ts: now };
+    return data;
+}
+function isBinaryOnPath(name) {
+    try {
+        const cmd = process.platform === "win32" ? `where ${name}` : `command -v ${name}`;
+        execSync(cmd, { stdio: "ignore", timeout: 1000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function detectAvailableProviders() {
     const providers = [];
-    // Claude CLI — always available for the eval server (runs in a separate terminal)
+    // Claude CLI — delegates to the `claude` binary; the CLI owns session auth.
+    // See src/eval/llm.ts createClaudeCliClient compliance doc-block.
     providers.push({
         id: "claude-cli",
-        label: "Claude (Max/Pro subscription)",
+        label: "Use current Claude Code session",
         available: true,
         models: PROVIDER_MODELS["claude-cli"],
     });
-    // Anthropic API — available if ANTHROPIC_API_KEY is set
+    // Anthropic API — available if ANTHROPIC_API_KEY is set OR a key is in the
+    // settings-store (browser tier or Darwin keychain).
     providers.push({
         id: "anthropic",
-        label: "Anthropic API (requires key)",
-        available: !!process.env.ANTHROPIC_API_KEY,
+        label: "Anthropic API",
+        available: !!process.env.ANTHROPIC_API_KEY ||
+            settingsStore.hasKeySync("anthropic"),
         models: PROVIDER_MODELS["anthropic"],
     });
-    // OpenRouter — available if OPENROUTER_API_KEY is set
+    // OpenRouter — available if OPENROUTER_API_KEY is set OR a key is stored.
     providers.push({
         id: "openrouter",
-        label: "OpenRouter (100+ models, requires key)",
-        available: !!process.env.OPENROUTER_API_KEY,
+        label: "OpenRouter",
+        available: !!process.env.OPENROUTER_API_KEY ||
+            settingsStore.hasKeySync("openrouter"),
         models: PROVIDER_MODELS["openrouter"],
     });
     // Local providers (Ollama + LM Studio) — cached probes fired in parallel so
@@ -429,6 +683,20 @@ export function registerRoutes(router, root, projectName) {
             sendJson(res, { error: err.message }, 500, _req);
         }
     });
+    // 0686 — /api/agents: agents with filesystem presence + per-agent counts +
+    // shared-folder grouping. 30s detection cache (mirrors Ollama/LM Studio
+    // probe pattern from 0677).
+    router.get("/api/agents", async (req, res) => {
+        try {
+            const detected = await detectInstalledAgents();
+            const detectedBinaries = new Set(detected.map((a) => a.id));
+            const data = await buildAgentsResponse({ root, detectedBinaries });
+            sendJson(res, data, 200, req);
+        }
+        catch (err) {
+            sendJson(res, { error: err.message }, 500, req);
+        }
+    });
     // Server-Sent Events endpoint for data change notifications
     // Clients subscribe here to receive push updates when benchmarks complete,
     // history is written, or leaderboard is updated.
@@ -454,19 +722,41 @@ export function registerRoutes(router, root, projectName) {
         req.on("close", cleanup);
         req.on("aborted", cleanup);
     });
-    // OpenRouter model search proxy
+    // OpenRouter model search proxy — 10-minute in-memory cache keyed by the
+    // last-8 chars of the API key so different keys don't collide while the
+    // key itself is never stored in the cache map. Stale cache served (with
+    // X-Vskill-Catalog-Age header) when upstream is down.
     router.get("/api/openrouter/models", async (_req, res) => {
-        const apiKey = process.env.OPENROUTER_API_KEY;
+        const envKey = process.env.OPENROUTER_API_KEY;
+        const storedKey = settingsStore.readKeySync("openrouter");
+        const apiKey = envKey || storedKey;
         if (!apiKey) {
             sendJson(res, { error: "OPENROUTER_API_KEY not configured" }, 400);
             return;
         }
+        const cacheKey = apiKey.slice(-8);
+        const now = Date.now();
+        const cached = OPENROUTER_CACHE.get(cacheKey);
+        const CACHE_TTL_MS = 600_000; // 10 min
+        // Fresh cache hit — serve immediately without upstream.
+        if (cached && now - cached.fetchedAt < CACHE_TTL_MS) {
+            const ageSec = Math.floor((now - cached.fetchedAt) / 1000);
+            res.setHeader?.("X-Vskill-Catalog-Age", String(ageSec));
+            sendJson(res, { models: cached.value, ageSec });
+            return;
+        }
         try {
             const resp = await fetch("https://openrouter.ai/api/v1/models", {
                 headers: { "Authorization": `Bearer ${apiKey}` },
                 signal: AbortSignal.timeout(10_000),
             });
             if (!resp.ok) {
+                if (cached) {
+                    const ageSec = Math.floor((now - cached.fetchedAt) / 1000);
+                    res.setHeader?.("X-Vskill-Catalog-Age", String(ageSec));
+                    sendJson(res, { models: cached.value, ageSec, stale: true });
+                    return;
+                }
                 sendJson(res, { error: `OpenRouter API returned ${resp.status}` }, 502);
                 return;
             }
@@ -474,40 +764,122 @@ export function registerRoutes(router, root, projectName) {
             const models = (data.data || []).map((m) => ({
                 id: m.id,
                 name: m.name || m.id,
+                contextWindow: typeof m.context_length === "number" ? m.context_length : undefined,
                 pricing: {
                     prompt: parseFloat(m.pricing?.prompt || "0"),
                     completion: parseFloat(m.pricing?.completion || "0"),
                 },
             }));
-            sendJson(res, { models });
+            OPENROUTER_CACHE.set(cacheKey, { value: models, fetchedAt: now });
+            res.setHeader?.("X-Vskill-Catalog-Age", "0");
+            sendJson(res, { models, ageSec: 0 });
+        }
+        catch (err) {
+            if (cached) {
+                const ageSec = Math.floor((now - cached.fetchedAt) / 1000);
+                res.setHeader?.("X-Vskill-Catalog-Age", String(ageSec));
+                sendJson(res, { models: cached.value, ageSec, stale: true });
+                return;
+            }
+            sendJson(res, { error: err.message }, 500);
+        }
+    });
+    // Settings / API key endpoints (0682 — US-004).
+    // Keys live on-device only. Never logged, never synced, never returned
+    // through GET. Response includes only metadata (stored, updatedAt, tier).
+    router.get("/api/settings/keys", async (_req, res) => {
+        sendJson(res, settingsStore.listKeys());
+    });
+    router.post("/api/settings/keys", async (req, res) => {
+        // Reject any request that smuggles the key in a query-string — JSON body only.
+        const url = req.url || "";
+        if (/[?&]key=/.test(url)) {
+            sendJson(res, { error: "key must not appear in query string" }, 400);
+            return;
+        }
+        const body = (await readBody(req));
+        if (!body.key || typeof body.key !== "string" || body.key.trim().length === 0) {
+            sendJson(res, { error: "key must be non-empty string" }, 400);
+            return;
+        }
+        if (body.provider !== "anthropic" && body.provider !== "openrouter") {
+            sendJson(res, { error: `unknown provider: ${String(body.provider)}` }, 400);
+            return;
+        }
+        try {
+            const saved = await settingsStore.saveKey(body.provider, body.key.trim(), body.tier ?? "browser");
+            // Prefix hint — non-blocking, purely informational
+            let warning;
+            if (body.provider === "anthropic" && !body.key.startsWith("sk-ant-")) {
+                warning = "key doesn't match typical Anthropic prefix sk-ant-";
+            }
+            else if (body.provider === "openrouter" && !body.key.startsWith("sk-or-")) {
+                warning = "key doesn't match typical OpenRouter prefix sk-or-";
+            }
+            sendJson(res, {
+                ok: true,
+                updatedAt: saved.updatedAt,
+                tier: saved.tier,
+                available: true,
+                ...(warning ? { warning } : {}),
+            });
         }
         catch (err) {
             sendJson(res, { error: err.message }, 500);
         }
     });
+    router.delete("/api/settings/keys/:provider", async (req, res) => {
+        const provider = req.params?.provider;
+        if (provider !== "anthropic" && provider !== "openrouter") {
+            sendJson(res, { error: `unknown provider: ${String(provider)}` }, 400);
+            return;
+        }
+        await settingsStore.removeKey(provider);
+        sendJson(res, { ok: true });
+    });
     // Config — expose current provider/model + available providers + project
     // IMPORTANT: Return raw model IDs (e.g. "sonnet"), NOT display models
     // (e.g. "claude-sonnet"). The frontend round-trips config.model back to
     // generate-evals and other endpoints, so it must be a valid CLI model ID.
     router.get("/api/config", async (_req, res) => {
+        // On first load (no currentOverrides), try to restore from .vskill/studio.json.
+        if (!currentOverrides.provider) {
+            const stored = loadStudioSelection(root);
+            if (stored) {
+                currentOverrides.provider = stored.activeAgent;
+                if (stored.activeModel)
+                    currentOverrides.model = stored.activeModel;
+            }
+        }
         try {
             // Validate the client can be created (catches missing API keys etc.)
             getClient();
             const providers = await detectAvailableProviders();
+            const detection = detectProjectAgents(root);
             sendJson(res, {
                 provider: currentOverrides.provider || null,
                 model: getEffectiveRawModel(),
                 providers,
+                detection,
                 projectName: projectName || null,
                 root,
             });
         }
         catch (err) {
             const providers = await detectAvailableProviders().catch(() => []);
-            sendJson(res, { provider: null, model: "unknown", error: err.message, providers, projectName: projectName || null, root });
+            const detection = detectProjectAgents(root);
+            sendJson(res, {
+                provider: null,
+                model: "unknown",
+                error: err.message,
+                providers,
+                detection,
+                projectName: projectName || null,
+                root,
+            });
         }
     });
-    // Update config — change provider/model at runtime
+    // Update config — change provider/model at runtime and persist atomically.
     router.post("/api/config", async (req, res) => {
         const body = (await readBody(req));
         if (body.provider)
@@ -521,6 +893,21 @@ export function registerRoutes(router, root, projectName) {
             // Validate the client can be created
             getClient();
             const providers = await detectAvailableProviders();
+            // Persist to .vskill/studio.json (atomic tmp-then-rename). Fire-and-forget
+            // from the handler's perspective — errors are logged but not surfaced,
+            // matching how currentOverrides already survives process lifetime.
+            if (currentOverrides.provider) {
+                try {
+                    await saveStudioSelection(root, {
+                        activeAgent: currentOverrides.provider,
+                        activeModel: getEffectiveRawModel(),
+                        updatedAt: new Date().toISOString(),
+                    });
+                }
+                catch (e) {
+                    console.warn(`[studio.json] atomic write failed: ${e.message}`);
+                }
+            }
             sendJson(res, { provider: currentOverrides.provider || null, model: getEffectiveRawModel(), providers });
         }
         catch (err) {
@@ -539,7 +926,33 @@ export function registerRoutes(router, root, projectName) {
     //     unknown/missing fields default to `null` (not undefined) so the shape
     //     remains JSON-stable for all consumers.
     router.get("/api/skills", async (req, res) => {
-        const skills = await scanSkills(root);
+        // 0686: ?scope=own|installed|global and ?agent=<id> query params.
+        // When either is present, switch to tri-scope scanning so the response
+        // carries the new `scope`/`isSymlink`/`symlinkTarget`/`installMethod`/
+        // `sourceAgent` fields. With no filter, we stay on the legacy two-scope
+        // path AND still layer the tri-scope enrichment on top so the UI gets a
+        // consistent shape either way.
+        const url = new URL(req.url ?? "/api/skills", "http://localhost");
+        const rawScope = url.searchParams.get("scope") ?? undefined;
+        const rawAgent = url.searchParams.get("agent") ?? undefined;
+        // Determine which agent's global scope to scan. When the caller doesn't
+        // specify one, default to the suggested agent from buildAgentsResponse —
+        // that's usually claude-code but falls back to the first detected agent.
+        let activeAgent = rawAgent;
+        if (!activeAgent) {
+            try {
+                const detected = await detectInstalledAgents();
+                const resp = await buildAgentsResponse({
+                    root,
+                    detectedBinaries: new Set(detected.map((a) => a.id)),
+                });
+                activeAgent = resp.suggested;
+            }
+            catch {
+                activeAgent = "claude-code";
+            }
+        }
+        const skills = await scanSkillsTriScope(root, { agentId: activeAgent });
         const enriched = await Promise.all(skills.map(async (s) => {
             let evalCount = 0;
             let assertionCount = 0;
@@ -553,12 +966,17 @@ export function registerRoutes(router, root, projectName) {
             catch { /* no evals */ }
             const benchmark = await readBenchmark(s.dir);
             const meta = buildSkillMetadata(s.dir, s.origin, root);
-            // Defensive origin guarantee — scanSkills sets it, but fall back to a
-            // recomputation if anything downstream ever widens the type.
             const origin = s.origin ?? classifyOrigin(s.dir, root);
+            // Preserve scanner-derived sourceAgent (populated for installed + global
+            // scopes) over the metadata-derived one which only covers local wrappers.
+            const sourceAgent = s.sourceAgent ?? meta.sourceAgent;
             return {
                 ...s,
                 origin,
+                scope: s.scope ?? (origin === "installed" ? "installed" : "own"),
+                isSymlink: s.isSymlink ?? false,
+                symlinkTarget: s.symlinkTarget ?? null,
+                installMethod: s.installMethod ?? (origin === "installed" ? "copied" : "authored"),
                 evalCount,
                 assertionCount,
                 benchmarkStatus: computeBenchmarkStatus(benchmark, evalIds, s.hasEvals),
@@ -576,10 +994,14 @@ export function registerRoutes(router, root, projectName) {
                 entryPoint: meta.entryPoint,
                 lastModified: meta.lastModified,
                 sizeBytes: meta.sizeBytes,
-                sourceAgent: meta.sourceAgent,
+                sourceAgent,
             };
         }));
-        sendJson(res, enriched, 200, req);
+        const filtered = filterSkillsByScopeAndAgent(enriched, {
+            scope: rawScope,
+            agent: rawAgent,
+        });
+        sendJson(res, filtered, 200, req);
     });
     // Check for skill updates via `vskill outdated --json`
     router.get("/api/skills/updates", async (req, res) => {