In-GUI skill hub for DeepSeek Harness (dsh). Browse the full local skill catalog from the official ctx.skills registry, toggle skills on/off, inspect their bodies, understand why a skill is missing, and scaffold new ones — all from the dsh web GUI.

A skill manager beyond the read-only browser. The host half runs in the dsh process and speaks only official SDKs; the browser half renders inside the GUI through official slots. No dsh source changes.

Why another skill manager?

dsh-skill-manager is a read-only browser, dsh-skill-importer and dsh-find-skill focus on importing and market-style installs. dsh-skill-hub fills the gap between them: a full catalog you can actually manage.

Features

• Full catalog — every skill the official registry knows: project .dsh/skills & .agents/skills, custom roots, user ~/.dsh/skills & ~/.agents/skills, bundled, and third-party providers.
• Search & grouping — one row combines search, source filter, and flat/grouped view; groups are user tags plus source collections (auto-aggregated by upstream repo); uncategorized stays visible.
• Group switches — every group header carries a sliding switch: enable/disable the whole group in one click. Closing a group whose member is also enabled elsewhere opens a conflict dialog (close all / keep on → the group falls into a half-filled mixed state). Read-only skills are skipped with per-name reports.
• Enable / disable — disable renames SKILL.md out of discovery (tracked in a sidecar file), so the change survives restarts and is trivially reversible. Files are never deleted.
• Source tracking — skills imported from GitHub (market sources or direct URLs) record the repo, ref, and upstream commit snapshot. Check for updates per source (1–2 GitHub API requests, 5-minute throttle), sync selected skills (overwrite confirm), and follow upstream deletion into a restorable trash. Deleting and restoring a tracked skill keeps its source and scene membership (snapshotted in the trash entry). Personal skills (no source) are never tracked.
• Market — codex-style: a built-in catalog of curated repos (one-click add) plus custom repo sources (owner/repo or a GitHub URL); scan skills/ and design-templates/ roots and import with one click. Each source row aggregates its state — installed / updatable / deleted upstream — and one "update all" pass syncs every source with pending updates (per-source failures are reported, never fatal).
• Skill detail — read a skill’s rendered body straight from disk.
• Discovery diagnostics — the catalog reports why a skill was ignored (missing YAML frontmatter, missing name/description, illegal name), per skill.
• New-skill wizard — scaffold a valid skill into ~/.dsh/skills or ~/.agents/skills from the GUI.
• Invocation statistics — the panel shows how many times each skill was actually called, read from session logs (optional; absent session-query deployments simply omit the data).
• Settings card — enable the plugin, toggle the agent announcement, and adjust panel display preferences from Settings → 插件 → Skill Hub.

How it works

src/
├── index.ts            host entry: inject [webServer, skills, systemPrompt]; system-prompt announcement
├── routes.ts           /api/skill-hub/{catalog,skill,toggle,toggle-batch,create,stats,config,
│                       groups,tag*,market*,repo*,sources*,update} (loopback-only fence)
├── store.ts            sidecar state ~/.dsh/dsh-skill-hub.json v3 (disabled, tags, sources, market
│                       sources, trash, runtime config; versioned v1→v2→v3 migrations)
├── repo.ts             GitHub discovery/import + source tracking (latest commit, tree diff, manifest)
├── skillfs.ts          root resolution / toggle rename / trash & restore / scaffold / diagnostics
├── stats.ts            invocation stats: session logs → per-skill call counts (optional sessionQuery)
├── protocol.ts         host ↔ browser shared API contract (types + endpoint table)
└── client/             browser half: settings card + skill hub panel (React, CSS Modules, Apple-style)

• Host half uses only official SDKs: ctx.skills.snapshot()/get(), ctx.webServer.register(), ctx.systemPrompt.section(). No dsh source is modified.
• Browser half mounts through official slots: a Settings → 技能 section and a Settings → 插件 → Skill Hub configuration card.
• Configuration is plugin-owned. The host’s settings service refuses to expose third-party namespaces to the web client, so the settings card reads/writes the plugin’s own /api/skill-hub/config route instead of the settings transport — no namespace mounting required.

Installation

From the dsh web profile:

dsh plugin --profile web add dsh-skill-hub

Requires Node ^22.19.0 || >=24.0.0 and a dsh web deployment (0.1.0-rc.6 SDK family).

Usage

Open Settings → 技能 (Skill Hub) in the dsh web GUI:

• Browse — the full catalog, searchable; search, source filter, and flat/grouped view share one row.
• Groups — user tags and source collections (upstream repos). Group headers carry tri-state sliding switches (on / off / mixed) with a conflict dialog when closing affects skills enabled elsewhere.
• Market — a built-in catalog of curated repos (one-click add), plus custom sources (add a repo source, scan, one-click install) or direct URLs; every import records the upstream repo/commit. Each source row shows installed / updatable / deleted-upstream counts; "check all" refreshes every source, and "update all" syncs every pending source in one pass.
• Trash — skills removed after upstream deletion (or deleted manually) land in a restorable trash; restoring brings back the skill's source and scene membership.
• Toggle — enable/disable any skill from a user-writable root; disabled skills list separately and can be re-enabled any time.
• Diagnose — the discovery diagnostics explain why a skill is not showing up.
• New skill — scaffold a new skill from the form and start writing.
• Statistics — per-skill invocation counts when session-query data is available; group headers summarize.

The plugin’s own switches live on the Settings → 插件 → Skill Hub card:

HTTP API

All endpoints are loopback-only (127.0.0.1/localhost) and JSON.

Development

npm install
npm run typecheck   # tsc --noEmit
npm test            # vitest (151 tests across 9 suites)
npm run build       # tsc declarations + tsdown bundles (lib/index.js + lib/client.js)
npm pack            # build the installable tarball (dsh-skill-hub-<version>.tgz)

Local testing: do not run two dsh web instances against the same $DSH_HOME and the same project directory at the same time. dsh rc.6 has no cross-process session-log lock, and a second instance resuming the same session can write duplicate seq rows (corrupt session log: seq gap in committed region). Stop the old instance first, or give the preview its own DSH_HOME.

The test suites cover the route family (including the config route and the disabled gate), the sidecar store, skill filesystem operations, the registry provider, and invocation statistics.

Roadmap

• v0.1.0 — full catalog, enable/disable, diagnostics, new-skill wizard, settings card.
• v0.2.0 — invocation statistics · tags/scenes + source-collection grouping with tri-state switches · upstream source tracking (check / sync / follow-delete into a restorable trash) · codex-style market with built-in catalog, per-source state badges, and one-click update-all · delete/restore keeps source + scene membership.
• Next — SSE realtime push to replace polling · market catalog expansion · optional auto-update.

License

MIT — see LICENSE.