@@ -197,7 +197,7 @@ altimate-code skill remove my-tool          # remove skill + paired tool
 altimate-code skill publish my-tool         # upload every file in the skill directory; re-run to update
 ```
 
-`skill publish` sends the whole skill directory, not just `SKILL.md`, so keep secrets out of it. A built-in filter skips known file and directory names — `.env*`, `.git`, `id_rsa`, `*.pem`, `*.key`, `*.p12`, `.npmrc`/`.netrc`, `credentials.json`, `secrets.*`, `.ssh`/`.aws`, editor swap files — but it matches names only and never scans file contents, so a token inside `config.yaml` or a key named `server.crt` would still be uploaded. Built-in skills, global skills and skills the workspace itself sent you cannot be published.
+`skill publish` sends the whole skill directory, not just `SKILL.md`, so keep secrets out of it. A built-in filter skips known file and directory names — `.env*`, `.git`, `id_rsa`, `*.pem`, `*.key`, `*.p12`, `.npmrc`/`.netrc`, `credentials.json`, `secrets.*`, `.ssh`/`.aws`, editor swap files — but it matches names only and never scans file contents, so a token inside `config.yaml` or a key named `server.crt` would still be uploaded. Built-in skills, global skills and skills the workspace itself sent you cannot be published — including the copies the VS Code / Cursor extension delivers into `.claude/skills/` and `.agents/skills/`, which carry an `.altimate-managed.json` marker.
 
 ### TUI
 
 
@@ -730,7 +730,8 @@ export namespace Telemetry {
         skill_name: string
         action: "created" | "updated"
         file_count: number
-        source: "cli" | "tui"
+        // "serve": published from the IDE extension over the serve route
+        source: "cli" | "tui" | "serve"
       }
     // altimate_change end
     // altimate_change start — plan refinement telemetry event
 
@@ -0,0 +1,54 @@
+// altimate_change - new file
+//
+// Which of the skills this project can reach may be published to its workspace, for the serve
+// routes the IDE extension calls. The CLI's `skill publish` and the TUI's "Publish to workspace"
+// row apply the same rules inline (`skillSource`, `isManagedSkill`, `assertProjectSkill`); the
+// refusal wording here matches theirs so a user moving between surfaces reads the same thing.
+import path from "path"
+import { skillSource } from "@/cli/cmd/skill-helpers"
+import { assertProjectSkill, IDE_DELIVERED_MARKER, isManagedSkill } from "./skill-publish"
+
+export type PublishEligibility = "publishable" | "builtin" | "personal" | "workspace" | "outside-project"
+
+/** The boundary a skill must lie within: the worktree, since discovery walks up to it — except for
+ * a project with no git, whose worktree is the sentinel `/`, which would contain everything. */
+export function projectRootFor(directory: string, worktree: string): string {
+  return worktree !== "/" ? worktree : directory
+}
+
+/** Whether a skill at `location` (its `SKILL.md`) may be published from `projectDirectory`. */
+export function publishEligibility(location: string, projectDirectory: string, projectRoot: string): PublishEligibility {
+  if (!path.isAbsolute(location) || skillSource(location) === "builtin") return "builtin"
+  if (skillSource(location) === "global") return "personal"
+  const skillDirectory = path.dirname(location)
+  if (isManagedSkill(projectDirectory, skillDirectory)) return "workspace"
+  try {
+    assertProjectSkill(projectRoot, skillDirectory)
+  } catch {
+    return "outside-project"
+  }
+  return "publishable"
+}
+
+/** Why a skill cannot be published, in the words the CLI uses, or null when it can. */
+export function explainIneligible(name: string, location: string, eligibility: PublishEligibility): string | null {
+  switch (eligibility) {
+    case "publishable":
+      return null
+    case "builtin":
+      return `"${name}" is a built-in skill and cannot be published.`
+    case "personal":
+      return (
+        `"${name}" is a personal skill (${path.dirname(location)}), not one of this project's. ` +
+        `Copy it into the project's skills directory to publish it.`
+      )
+    case "workspace":
+      return (
+        `"${name}" is a skill this workspace sent to you, not one you authored. ` +
+        `Publishing it would send the workspace's own skill back to it. ` +
+        `If you copied it to make your own, rename it and delete any ${IDE_DELIVERED_MARKER} in its folder.`
+      )
+    case "outside-project":
+      return `"${name}" is not inside this project (${path.dirname(location)}), so it cannot be published from here.`
+  }
+}
@@ -33,11 +33,12 @@
 //      interpret.
 import fs from "fs/promises"
 import path from "path"
-import { realpathSync } from "fs"
+import { existsSync, realpathSync } from "fs"
 import { Log } from "@/altimate/util/log"
 import { Global } from "@/global"
 import { Filesystem } from "@/util/filesystem"
 import { AltimateApi } from "@/altimate/api/client"
+import { isInWorkspaceSnapshot } from "./snapshot-path"
 import { ConflictError, ForbiddenError, NotFoundError, WorkspaceApi, altimateRequest } from "./api-client"
 import { resolveBinding } from "./state"
 
@@ -49,6 +50,13 @@ const SKILLS_BASE = "/skills"
  * process-global store — into every caller that only wants to publish. */
 const MANAGED_DIR = path.join(".altimate-code", "skill", "_workspace")
 
+/** Written by the VS Code / Cursor extension into every skill directory it delivers from the
+ * workspace (`.claude/skills/altimate-*`, `.agents/skills/altimate-*`). Those roots are also this
+ * project's own skill-discovery roots, so without the marker a delivered skill would be offered for
+ * publish — and uploaded back to the workspace that sent it, as a new skill owned by the publisher.
+ * The name is the extension's (`OWNERSHIP_MARKER` in its `customSkillDelivery.ts`); keep in step. */
+export const IDE_DELIVERED_MARKER = ".altimate-managed.json"
+
 /** Mirrors the server's own ceilings so an oversized bundle fails locally, with a
  * usable message, instead of after a long upload. `MAX_BUNDLE_FILES` and
  * `MAX_BUNDLE_BYTES` in `app/service/custom_skills/bundle.py`; a mismatch
@@ -355,7 +363,8 @@ export async function collectBundle(dir: string): Promise<BundleFile[]> {
   return files
 }
 
-/** True when this path lives inside the workspace-owned snapshot. */
+/** True when this skill came from the workspace: it lives inside the workspace-owned snapshot, or
+ * the IDE extension delivered it (see {@link IDE_DELIVERED_MARKER}). */
 export function isManagedSkill(projectDirectory: string, skillDirectory: string): boolean {
   // `path.resolve` is lexical: it normalises `..` and makes the path absolute,
   // but it does not follow links. A skill directory that IS a symlink into the
@@ -374,7 +383,11 @@ export function isManagedSkill(projectDirectory: string, skillDirectory: string)
   }
   const managed = real(path.resolve(projectDirectory, MANAGED_DIR))
   const candidate = real(skillDirectory)
-  return candidate === managed || candidate.startsWith(managed + path.sep)
+  if (candidate === managed || candidate.startsWith(managed + path.sep)) return true
+  // A snapshot above the project directory: discovery reads config directories up to the worktree.
+  if (isInWorkspaceSnapshot(candidate)) return true
+  // A delivered skill sits in the project's own discovery roots, not under the snapshot.
+  return existsSync(path.join(candidate, IDE_DELIVERED_MARKER))
 }
 
 // ---------------------------------------------------------------------------
 
@@ -0,0 +1,17 @@
+// altimate_change - new file
+//
+// Whether a path lies inside a workspace skill snapshot (`.altimate-code/skill/_workspace`), judged
+// by path segments rather than against one project directory: discovery walks config directories up
+// to the worktree, so a session started in `repo/sub` also reads `repo/.altimate-code/...`.
+// Dependency-free on purpose — skill discovery imports it, and the workspace modules are heavy.
+import path from "path"
+
+const SNAPSHOT_SEGMENTS = [".altimate-code", "skill", "_workspace"]
+
+export function isInWorkspaceSnapshot(location: string): boolean {
+  const parts = path.resolve(location).split(path.sep)
+  for (let i = 0; i + SNAPSHOT_SEGMENTS.length <= parts.length; i++) {
+    if (SNAPSHOT_SEGMENTS.every((segment, j) => parts[i + j] === segment)) return true
+  }
+  return false
+}
@@ -112,6 +112,59 @@ export namespace Server {
     }
     return undefined
   }
+  /** The skill registry this instance serves, reloaded so a skill written since it loaded is found
+   * — also one in a skills directory that did not exist at boot. Same in-context path as
+   * `refreshSkillRegistry` in session/prompt.ts: the facade's invalidate keeps the stale root list
+   * `Config.directories()` cached. The CLI's `skill publish` reads this registry too.
+   *
+   * Not free: `Config.Service.invalidate()` drops the config cache for every instance and the
+   * refresh re-pulls any `skills.urls`. Acceptable for a user-triggered command, and the only
+   * invalidation the service offers. A config file mid-edit (invalid) fails this call — and would
+   * fail the session's next config read the same way. */
+  async function reloadSkills() {
+    const [{ Effect }, { Config }, { Skill: Registry }] = await Promise.all([
+      import("effect"),
+      import("../config/config"),
+      import("../skill"),
+    ])
+    await AppRuntime.runPromise(
+      Effect.gen(function* () {
+        const config = yield* Config.Service
+        const skill = yield* Registry.Service
+        yield* config.invalidate()
+        yield* skill.refresh()
+      }),
+    )
+    return Registry
+  }
+
+  /** A request body that must be absent or a JSON object: the parsed object, or the response
+   * to send instead. A failed read keeps the routes' `{ ok: false, error }` 500 contract. */
+  async function readJsonObject(
+    read: () => Promise<string>,
+    route: string,
+  ): Promise<{ body: Record<string, unknown> } | { failure: { status: 400 | 500; body: { ok: false; error: string } } }> {
+    let text: string
+    try {
+      text = await read()
+    } catch (err) {
+      const error = err instanceof Error ? err.message : String(err)
+      log.error(`${route}: could not read the request body`, { error })
+      return { failure: { status: 500, body: { ok: false, error } } }
+    }
+    if (!text.trim()) return { body: {} }
+    let body: unknown
+    try {
+      body = JSON.parse(text)
+    } catch {
+      return { failure: { status: 400, body: { ok: false, error: "Request body is not valid JSON." } } }
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+      return { failure: { status: 400, body: { ok: false, error: "Request body must be a JSON object." } } }
+    }
+    return { body: body as Record<string, unknown> }
+  }
+
   export function sameOrigin(origin: string, host: string | undefined): boolean {
     try {
       return !!host && new URL(origin).host === host
@@ -1008,26 +1061,10 @@ export namespace Server {
         // An absent or empty body is a session-less refresh; anything else must be well formed.
         // Falling back to "no session" on bad input would silently widen the operation to
         // resetting every session's memory overlay.
-        let text: string
-        try {
-          text = await c.req.text()
-        } catch (err) {
-          const error = err instanceof Error ? err.message : String(err)
-          log.error("workspace refresh: could not read the request body", { error })
-          return c.json({ ok: false, error }, 500)
-        }
-        let body: unknown = {}
-        if (text.trim()) {
-          try {
-            body = JSON.parse(text)
-          } catch {
-            return c.json({ ok: false, error: "Request body is not valid JSON." }, 400)
-          }
-        }
-        if (body === null || typeof body !== "object" || Array.isArray(body)) {
-          return c.json({ ok: false, error: "Request body must be a JSON object." }, 400)
-        }
-        const raw = (body as Record<string, unknown>).sessionID
+        const read = await readJsonObject(() => c.req.text(), "workspace refresh")
+        if ("failure" in read) return c.json(read.failure.body, read.failure.status)
+        const body = read.body
+        const raw = body.sessionID
         if (raw !== undefined && (typeof raw !== "string" || !raw)) {
           return c.json({ ok: false, error: "sessionID must be a non-empty string." }, 400)
         }
@@ -1080,6 +1117,107 @@ export namespace Server {
         }
       })
       // altimate_change end
+      // altimate_change start — GET /altimate/skill/publishable, POST /altimate/skill/publish
+      // The CLI's `skill publish <name>` for the IDE extension. Only `serve` holds the extension's
+      // pin, so publishing here targets the workspace selected in the panel — through the same
+      // engine, ledger and error wording as the CLI and TUI.
+      .get("/altimate/skill/publishable", async (c) => {
+        const refused = workspaceRouteRefusal(c.req.header("origin"), c.req.header("host"))
+        if (refused) return c.json(refused.body, refused.status)
+        try {
+          const { projectRootFor, publishEligibility } = await import("../altimate/workspace/publishable")
+          const registry = await reloadSkills()
+          const root = projectRootFor(Instance.directory, Instance.worktree)
+          const skills = (await registry.all())
+            .filter((skill) => publishEligibility(skill.location, Instance.directory, root) === "publishable")
+            // `description` is optional in frontmatter; sent as "" so every entry has the same shape.
+            .map((skill) => ({ name: skill.name, description: skill.description ?? "", location: skill.location }))
+            .sort((a, b) => a.name.localeCompare(b.name))
+          return c.json({ ok: true as const, skills })
+        } catch (err) {
+          const error = err instanceof Error ? err.message : String(err)
+          log.error("skill publishable: failed", { error })
+          return c.json({ ok: false, error }, 500)
+        }
+      })
+      .post("/altimate/skill/publish", async (c) => {
+        const refused = workspaceRouteRefusal(c.req.header("origin"), c.req.header("host"))
+        if (refused) return c.json(refused.body, refused.status)
+        const read = await readJsonObject(() => c.req.text(), "skill publish")
+        if ("failure" in read) return c.json(read.failure.body, read.failure.status)
+        const name = read.body.name
+        if (typeof name !== "string" || !name.trim()) {
+          return c.json({ ok: false, error: "name must be a non-empty string." }, 400)
+        }
+        try {
+          const { explainIneligible, projectRootFor, publishEligibility } = await import(
+            "../altimate/workspace/publishable"
+          )
+          const { describePublish, explainPublishError, publishSkill } = await import(
+            "../altimate/workspace/skill-publish"
+          )
+          const registry = await reloadSkills()
+          const skill = await registry.get(name.trim())
+          if (!skill) {
+            // Lookup is exact; a name that differs only in case is almost always what was meant.
+            const wanted = name.trim().toLowerCase()
+            const near = (await registry.all()).find((s) => s.name.toLowerCase() === wanted)
+            return c.json(
+              {
+                ok: false,
+                error: `Skill "${name.trim()}" not found in this project.${near ? ` Did you mean "${near.name}"?` : ""}`,
+              },
+              404,
+            )
+          }
+          const root = projectRootFor(Instance.directory, Instance.worktree)
+          const ineligible = explainIneligible(
+            skill.name,
+            skill.location,
+            publishEligibility(skill.location, Instance.directory, root),
+          )
+          if (ineligible) {
+            log.info("skill publish: refused", { skill: skill.name, reason: ineligible })
+            return c.json({ ok: false, error: ineligible }, 422)
+          }
+          try {
+            const report = await publishSkill({
+              projectDirectory: Instance.directory,
+              projectRoot: root,
+              skillDirectory: nodePath.dirname(skill.location),
+              name: skill.name,
+              description: skill.description ?? "",
+            })
+            try {
+              const { Telemetry } = await import("../altimate/telemetry")
+              Telemetry.track({
+                type: "skill_published",
+                timestamp: Date.now(),
+                session_id: Telemetry.getContext().sessionId || "",
+                skill_name: skill.name,
+                action: report.action,
+                file_count: report.files,
+                source: "serve",
+              })
+            } catch {}
+            return c.json({ ok: true as const, report, message: describePublish(report) })
+          } catch (err) {
+            // A refusal the engine raised on purpose already says what to do; 422, since 409 is
+            // the pilot gate's. Anything else is a failure, reported as the engine gave it.
+            const known = explainPublishError(err)
+            if (known) {
+              log.info("skill publish: refused by the engine", { skill: skill.name, reason: known })
+              return c.json({ ok: false, error: known }, 422)
+            }
+            throw err
+          }
+        } catch (err) {
+          const error = err instanceof Error ? err.message : String(err)
+          log.error("skill publish: failed", { error })
+          return c.json({ ok: false, error }, 500)
+        }
+      })
+      // altimate_change end
       .all("/*", async (c) => {
         const path = c.req.path
 
 
@@ -2,6 +2,9 @@ import { LayerNode } from "@opencode-ai/core/effect/layer-node"
 // altimate_change start — makeRuntime for the restored Promise wrapper (see bottom of file)
 import { makeRuntime } from "@/effect/run-service"
 // altimate_change end
+// altimate_change start — workspace snapshot precedence in `add`
+import { isInWorkspaceSnapshot } from "@/altimate/workspace/snapshot-path"
+// altimate_change end
 import path from "path"
 import { pathToFileURL } from "url"
 import { Effect, Layer, Context, Schema } from "effect"
@@ -149,6 +152,20 @@ const add = Effect.fnUntraced(function* (state: State, match: string, events: Ev
   if (!isSkillFrontmatter(md.data)) return
 
   if (state.skills[md.data.name]) {
+    // altimate_change start — a workspace-synced copy never shadows a project skill of the same name.
+    // The snapshot is scanned after `.claude`/`.agents`, so a skill the user wrote there and then
+    // published was replaced by the workspace's copy of it on the next sync: the agent read the
+    // stale copy, and publishing an update was refused as "a skill this workspace sent to you".
+    // A snapshot scanned first is still overridden by the project skill found later, as before.
+    if (isInWorkspaceSnapshot(match) && !isInWorkspaceSnapshot(state.skills[md.data.name].location)) {
+      yield* Effect.logWarning("workspace skill shadowed by a project skill of the same name", {
+        name: md.data.name,
+        project: state.skills[md.data.name].location,
+        workspace: match,
+      })
+      return
+    }
+    // altimate_change end
     yield* Effect.logWarning("duplicate skill name", {
       name: md.data.name,
       existing: state.skills[md.data.name].location,