# Project environment, skills and resources Project trust and dynamic resource discovery — the two places where the host, not the package, owns the decision. Skills declared by a Pi package are loaded through DSH's own skill filesystem. MCP server definitions in Pi config are translated into official `dsh-mcp-client` entries by `pi2dsh mcp-config`. A deliberately installed Pi MCP capability package is a different case: its own transport, cache, OAuth and resource/prompt behavior continues to run, while pi2dsh maps only its public host surfaces into DSH. **4 upstream-shaped Pi rule rows** — 2 same semantics · 1 mapped, difference stated · 1 not available. | Pi surface | Kind | Status | What it does on DSH | |---|---|---|---| | [`events`](#events-pi) | `pi.*` | Same semantics | Pi's cross-extension event bus: one shared bus per agent, so every Pi package mounted for the same agent hears every other package's emits — matching Pi's one-bus-per-session loader contract. Different agents have different buses. | | [`project_trust`](#project_trust-event) | `event` | Not available | Project trust must remain owned by the DSH host; the handler is accepted but never consulted. | | [`resources_discover`](#resources_discover-event) | `event` | Mapped, difference stated | Fires right after session_start with the session cwd, as in Pi. Returned skillPaths that are directories are mounted into DSH's skills registry through the official filesystem provider (dsh-skill-filesystem), once per root per package, so dynamically discovered skills (a project's .claude/skills) list and load like static package skills. promptPaths and themePaths have no DSH seat and are reported rather than mounted; a single SKILL.md file path (no root) is reported too. | | [`isProjectTrusted`](#isprojecttrusted-ctx) | `ctx.*` | Same semantics | Reports the DSH host's own trust decision: true for an agent session's working directory, false for the host anchor and detached contexts. | ## How each one is built Every surface below names the DSH mechanism that carries it — the seam, service or waterfall — so the mapping can be checked against the harness rather than taken on trust. ### `events` `pi.*` · Same semantics The bus is keyed on the owning agent in shared host state (host/anchor instances share the host bus). Each instance unwinds only its own subscriptions on dispose/reload, never the other packages'. ### `project_trust` `event` · Not available Accepted and never consulted. Trust is a host decision in DSH, and letting a package answer it would move the decision to the code being trusted. ### `resources_discover` `event` · Mapped, difference stated DSH's skills registry is a host service fed by providers; the bridge translates each discovered root into one dsh-skill-filesystem provider instead of re-implementing skill parsing. Pi prompt templates and TUI themes are not DSH resources. ### `isProjectTrusted` `ctx.*` · Same semantics Host-semantic translation, not a constant. On DSH the trust act is opening a workspace — the host already runs its own bash/edit/write in the session's directory without a further prompt — so an agent-scoped context answers true for exactly that directory. Contexts with no agent (the host anchor, detached projections) stay fail-closed. The earlier hardcoded false claimed the host actively distrusts every project — a stronger statement than DSH makes anywhere — and packages honor it literally: pi-lens disables every language-server spawn on an explicit false while treating a missing accessor as unknown-and-allowed. Pi's own ProjectTrustStore stays vendored for packages that manage their own per-path trust. --- Back to the [capability index](README.md) · the whole verdict in [pi-abi-coverage.md](../pi-abi-coverage.md).