@1e0zj/dsh-plugin-mall 0.1.7 → 0.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1e0zj/dsh-plugin-mall",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "dsh 插件市场：搜索 GitHub dsh-plugin 话题下的插件仓库，一键安装到本地 dsh profile（agent 工具 + 设置页插件市场 tab）",
   "type": "module",
   "main": "src/index.js",

package/src/client.js

@@ -33,8 +33,10 @@ window.__ModuleLoader__.load({
       ".mkt_list{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px;align-items:stretch;min-width:0}",
       "@media (max-width:820px){.mkt_list{grid-template-columns:minmax(0,1fr)}}",
       ".mkt_listHead{grid-column:1/-1;font-size:12px;color:var(--dsw-alias-label-tertiary)}",
+      ".mkt_loadMore{grid-column:1/-1;text-align:center;font-size:12px;color:var(--dsw-alias-label-tertiary);padding:10px 0}",
       ".mkt_card{border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:10px 12px;background:var(--dsw-alias-bg-primary,#fff);display:flex;flex-direction:column;gap:6px;min-width:0}",
       ".mkt_cardHead{display:flex;align-items:baseline;gap:8px;flex-wrap:wrap}",
+      ".mkt_metaRow{display:flex;align-items:baseline;gap:8px;flex-wrap:wrap}",
       ".mkt_name{font-size:13.5px;font-weight:600;color:var(--dsw-alias-label-primary);overflow-wrap:anywhere}",
       ".mkt_meta{font-size:12px;color:var(--dsw-alias-label-tertiary)}",
       ".mkt_desc{font-size:12.5px;color:var(--dsw-alias-label-secondary);overflow-wrap:anywhere}",
@@ -44,12 +46,15 @@ window.__ModuleLoader__.load({
       ".mkt_pre{font-family:Consolas,Monaco,monospace;font-size:11.5px;line-height:16px;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-secondary,#f6f7f8);border-radius:6px;padding:8px;max-height:220px;overflow:auto;white-space:pre-wrap;word-break:break-all}",
       ".mkt_ok{color:var(--dsw-alias-state-success-primary,#2f855a)}",
       ".mkt_badge{display:inline-block;border-radius:999px;padding:1px 8px;font-size:11px;border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-tertiary)}",
+      ".mkt_badgeOk{border-color:var(--dsw-alias-state-success-primary,#2f855a);color:var(--dsw-alias-state-success-primary,#2f855a)}",
+      ".mkt_check{display:flex;align-items:center;gap:4px;font-size:12.5px;color:var(--dsw-alias-label-secondary);cursor:pointer;white-space:nowrap}",
       ".mkt_link{color:var(--dsw-alias-state-business-primary);font-size:12px;text-decoration:none;cursor:pointer}",
       ".mkt_installedHead{display:flex;align-items:center;gap:8px;width:100%;background:none;border:0;padding:0;margin:0;cursor:pointer;font:inherit;text-align:left}",
       ".mkt_installedHead:hover .mkt_panelTitle{color:var(--dsw-alias-state-business-primary)}",
       ".mkt_installedToggle{margin-left:auto}",
       ".mkt_depList{display:flex;flex-direction:column;gap:6px;margin-top:8px}",
       ".mkt_depRow{display:flex;justify-content:space-between;align-items:center;gap:8px}",
+      ".mkt_depActions{display:flex;align-items:center;gap:6px;flex-wrap:wrap}",
     ].join("\n");
     var tagId = "@1e0zj/dsh-plugin-mall/market-tab.css";
     if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
@@ -125,6 +130,18 @@ window.__ModuleLoader__.load({
       return { jobs: jobs, track: track };
     }
 
+    // ── plugin verification badge ───────────────────────────────────────────
+    // verified 来自 /market verify 端点（node 侧拉 raw package.json 判定
+    // dsh.bundle/dsh.client 声明，进程内缓存）。unknown 不显示徽章。
+    function verifyBadge(verified) {
+      if (verified === undefined || verified === null) return null;
+      if (verified.kind === "bundle") return h("span", { className: "mkt_badge mkt_badgeOk" }, "宿主插件");
+      if (verified.kind === "client") return h("span", { className: "mkt_badge mkt_badgeOk" }, "UI插件");
+      if (verified.kind === "plain") return h("span", { className: "mkt_badge" }, "未声明");
+      if (verified.kind === "no-manifest") return h("span", { className: "mkt_badge" }, "无package.json");
+      return null;
+    }
+
     // ── repo card ───────────────────────────────────────────────────────────
     function RepoCard(props) {
       var item = props.item;
@@ -134,24 +151,27 @@ window.__ModuleLoader__.load({
       var installDisabled = installing;
       if (!installing && job) {
         if (job.status === "running") { installLabel = "安装中…"; installDisabled = true; }
-        else if (job.status === "completed") { installLabel = "✓ 已装 · 重启生效"; installDisabled = true; }
+        else if (job.status === "completed") { installLabel = "已装 · 重启生效"; installDisabled = true; }
         else if (job.status === "failed") { installLabel = "安装失败 · 见任务日志"; }
         else { installLabel = "已取消 · 重试"; }
       }
       return h("div", { className: "mkt_card" },
         h("div", { className: "mkt_cardHead" },
           h("span", { className: "mkt_name" }, item.fullName),
+          verifyBadge(props.verified),
+          item.archived ? h("span", { className: "mkt_badge" }, "archived") : null
+        ),
+        item.description ? h("div", { className: "mkt_desc" }, clip(item.description, 180)) : null,
+        h("div", { className: "mkt_metaRow" },
           h("span", { className: "mkt_meta" }, "★" + item.stars),
           item.language ? h("span", { className: "mkt_meta" }, item.language) : null,
           item.license ? h("span", { className: "mkt_meta" }, item.license) : null,
-          item.archived ? h("span", { className: "mkt_badge" }, "archived") : null
+          h("span", { className: "mkt_meta" }, "更新 " + (item.updatedAt || "").slice(0, 10))
         ),
-        item.description ? h("div", { className: "mkt_desc" }, clip(item.description, 180)) : null,
-        h("div", { className: "mkt_meta" }, "更新 " + (item.updatedAt || "").slice(0, 10)),
         h("div", { className: "mkt_cardActions" },
           h("button", { className: "mkt_btn mkt_btnPrimary", disabled: installDisabled, onClick: function () { props.onInstall(item.fullName); } },
             installLabel),
-          h("a", { className: "mkt_btn", href: item.htmlUrl, target: "_blank", rel: "noreferrer" }, "前往仓库 ↗")
+          h("a", { className: "mkt_btn", href: item.htmlUrl, target: "_blank", rel: "noreferrer" }, "前往仓库")
         )
       );
     }
@@ -170,7 +190,7 @@ window.__ModuleLoader__.load({
               id + " · " + clip(job.spec || "", 40) + " · " + (job.status || "running")),
             job.detail ? h("div", { className: "mkt_desc" }, job.detail) : null,
             done && job.status === "completed"
-              ? h("div", { className: "mkt_ok" }, "✓ 完成 — 重启 dsh 后生效")
+              ? h("div", { className: "mkt_ok" }, "完成 — 重启 dsh 后生效")
               : job.status === "failed"
                 ? h("div", { className: "mkt_error" }, "失败，见下方输出")
                 : null,
@@ -197,7 +217,7 @@ window.__ModuleLoader__.load({
         },
           h("span", { className: "mkt_panelTitle" }, "已装插件"),
           h("span", { className: "mkt_badge" }, count + " 个"),
-          h("span", { className: "mkt_meta mkt_installedToggle" }, open ? "收起 ▲" : "展开 ▼")
+          h("span", { className: "mkt_meta mkt_installedToggle" }, open ? "收起" : "展开")
         ),
         installed.error
           ? h("div", { className: "mkt_error" }, installed.error)
@@ -206,14 +226,20 @@ window.__ModuleLoader__.load({
             ? h("div", { className: "mkt_meta" }, "还没有装过插件")
             : h("div", { className: "mkt_depList" }, (installed.deps || []).map(function (dep) {
               var busy = (props.removing || {})[dep.name] === true;
+              var upd = (props.updates || {})[dep.name];
               return h("div", { key: dep.name, className: "mkt_depRow" },
                 h("span", { className: "mkt_desc" }, dep.name + "@" + dep.version),
-                h("span", { className: "mkt_badge" }, kindLabel(dep.kind)),
-                h("button", {
-                  className: "mkt_btn mkt_btnDanger mkt_btnSm",
-                  disabled: busy,
-                  onClick: function () { props.onUninstall(dep.name); },
-                }, busy ? "卸载中…" : "卸载"));
+                h("span", { className: "mkt_depActions" },
+                  h("span", { className: "mkt_badge" }, kindLabel(dep.kind)),
+                  upd && upd.hasUpdate ? h("button", {
+                    className: "mkt_btn mkt_btnSm",
+                    onClick: function () { props.onInstallSpec(dep.name); },
+                  }, "更新至 " + upd.latest) : null,
+                  h("button", {
+                    className: "mkt_btn mkt_btnDanger mkt_btnSm",
+                    disabled: busy,
+                    onClick: function () { props.onUninstall(dep.name); },
+                  }, busy ? "卸载中…" : "卸载")));
             }))
       );
     }
@@ -245,6 +271,28 @@ window.__ModuleLoader__.load({
       var _removing = useState({});
       var removing = _removing[0];
       var setRemoving = _removing[1];
+      var _page = useState(1);
+      var page = _page[0];
+      var setPage = _page[1];
+      var _loadingMore = useState(false);
+      var loadingMore = _loadingMore[0];
+      var setLoadingMore = _loadingMore[1];
+      var sentinelRef = useRef(null);
+      var _verified = useState({});
+      var verified = _verified[0];
+      var setVerified = _verified[1];
+      var _verifiedOnly = useState(true);
+      var verifiedOnly = _verifiedOnly[0];
+      var setVerifiedOnly = _verifiedOnly[1];
+      var _updates = useState(null);
+      var updates = _updates[0];
+      var setUpdates = _updates[1];
+      var _reachedLimit = useState(false);
+      var reachedLimit = _reachedLimit[0];
+      var setReachedLimit = _reachedLimit[1];
+      var _retryAt = useState(0);
+      var retryAt = _retryAt[0];
+      var setRetryAt = _retryAt[1];
 
       var call = useCallback(function (endpoint, payload) {
         return rpc.call("/market", endpoint, payload || {}).then(function (res) {
@@ -253,21 +301,82 @@ window.__ModuleLoader__.load({
         });
       }, [rpc]);
 
+      // 每页搜索结果到货后批量验证（node 侧 raw CDN，带缓存），失败静默——
+      // 徽章缺失可接受，不该打断浏览。
+      var verifyPage = useCallback(function (items) {
+        var repos = (items || []).map(function (it) { return it.fullName; });
+        if (repos.length === 0) return;
+        call("verify", { repos: repos }).then(function (value) {
+          setVerified(function (prev) { return Object.assign({}, prev, value.results); });
+        }).catch(function () { /* 徽章缺失即可 */ });
+      }, [call]);
+
       var doSearch = useCallback(function () {
         setLoading(true);
         setError(null);
+        setPage(1);
+        setReachedLimit(false);
+        setRetryAt(0);
         call("search", { query: query, sort: sort, perPage: 20 }).then(function (value) {
           setResults(value);
+          setVerified({});
+          verifyPage(value.items);
         }).catch(function (e) {
           setError(errorText(e));
         }).finally(function () {
           setLoading(false);
         });
-      }, [call, query, sort]);
+      }, [call, query, sort, verifyPage]);
+
+      // 无限滚动：哨兵进入视口时拉下一页并追加。GitHub topic 的翻页间数据
+      // 可能移动造成重复，按 fullName 去重；已显示数追上 total 即到底。
+      var canLoadMore = results !== null && results.items.length < results.total && !reachedLimit;
+      var loadMore = useCallback(function () {
+        if (!canLoadMore || loading || loadingMore) return;
+        // 限流熔断：失败后 60s 内不再自动请求（哨兵重渲染会反复触发
+        // IntersectionObserver，不熔断会连环 500 直到限流窗口过去）。
+        if (Date.now() < retryAt) return;
+        setLoadingMore(true);
+        call("search", { query: query, sort: sort, perPage: 20, page: page + 1 }).then(function (value) {
+          if (value.truncated === true) { setReachedLimit(true); return; }
+          setPage(page + 1);
+          verifyPage(value.items);
+          setResults(function (prev) {
+            if (prev === null) return value;
+            var seen = {};
+            var merged = [];
+            prev.items.concat(value.items).forEach(function (it) {
+              if (seen[it.fullName] === true) return;
+              seen[it.fullName] = true;
+              merged.push(it);
+            });
+            return { total: value.total, items: merged };
+          });
+        }).catch(function (e) {
+          setError(errorText(e));
+          setRetryAt(Date.now() + 60000);
+        }).finally(function () {
+          setLoadingMore(false);
+        });
+      }, [call, canLoadMore, loading, loadingMore, page, query, sort, retryAt]);
+
+      useEffect(function () {
+        var node = sentinelRef.current;
+        if (node === null || node === undefined) return undefined;
+        if (typeof IntersectionObserver === "undefined") return undefined;
+        var observer = new IntersectionObserver(function (entries) {
+          for (var index = 0; index < entries.length; index++) {
+            if (entries[index].isIntersecting) { loadMore(); break; }
+          }
+        }, { rootMargin: "300px" });
+        observer.observe(node);
+        return function () { observer.disconnect(); };
+      }, [loadMore]);
 
       var refreshInstalled = useCallback(function () {
         call("installed", {}).then(function (value) {
           setInstalled(value);
+          call("updates", {}).then(setUpdates).catch(function () { setUpdates(null); });
         }).catch(function (e) {
           setInstalled({ error: errorText(e) });
         });
@@ -283,10 +392,12 @@ window.__ModuleLoader__.load({
         // eslint-disable-next-line react-hooks/exhaustive-deps
       }, []);
 
-      var doInstall = useCallback(function (repo) {
-        var spec = "github:" + repo;
+      // 通用安装入口：spec 可以是 github:owner/repo（卡片按钮）或 npm 包名
+      // （已装面板的更新按钮）。后端会把同源发布的 github spec 改写为 npm
+      // tarball 安装（更快），job 里记录的是最终 spec。
+      var doInstallSpec = useCallback(function (spec) {
         setInstalling(function (prev) {
-          var next = Object.assign({}, prev, { [repo]: true });
+          var next = Object.assign({}, prev, { [spec]: true });
           return next;
         });
         setError(null);
@@ -297,12 +408,16 @@ window.__ModuleLoader__.load({
         }).finally(function () {
           setInstalling(function (prev) {
             var next = Object.assign({}, prev);
-            delete next[repo];
+            delete next[spec];
             return next;
           });
         });
       }, [call, track]);
 
+      var doInstall = useCallback(function (repo) {
+        doInstallSpec("github:" + repo);
+      }, [doInstallSpec]);
+
       var doUninstall = useCallback(function (name) {
         setRemoving(function (prev) {
           var next = Object.assign({}, prev, { [name]: true });
@@ -330,6 +445,15 @@ window.__ModuleLoader__.load({
       var jobsActive = false;
       for (var jid in jobs) { if (jobs[jid] && jobs[jid].status === "running") { jobsActive = true; break; } }
 
+      // "只看已验证"开关下的可见项：verify 判定 bundle/client 的才算插件。
+      // verifyPending：当前加载的仓库里还有未验证完的（verified map 尚未覆盖）。
+      var visibleItems = results === null ? [] : results.items.filter(function (it) {
+        if (verifiedOnly !== true) return true;
+        var v = verified[it.fullName];
+        return v !== undefined && (v.kind === "bundle" || v.kind === "client");
+      });
+      var verifyPending = results !== null && results.items.some(function (it) { return verified[it.fullName] === undefined; });
+
       return h("div", { className: "mkt_root" },
         h("div", { className: "mkt_head" },
           h("div", { className: "mkt_title" }, "插件市场"),
@@ -353,10 +477,13 @@ window.__ModuleLoader__.load({
             h("option", { value: "forks" }, "按 fork")
           ),
           h("button", { className: "mkt_btn mkt_btnPrimary", disabled: loading, onClick: doSearch }, loading ? "搜索中…" : "搜索"),
-          h("button", { className: "mkt_btn", onClick: refreshInstalled }, "刷新已装")
+          h("button", { className: "mkt_btn", onClick: refreshInstalled }, "刷新已装"),
+          h("label", { className: "mkt_check" },
+            h("input", { type: "checkbox", checked: verifiedOnly, onChange: function (e) { setVerifiedOnly(e.target.checked); } }),
+            "只看已验证插件")
         ),
         error ? h("div", { className: "mkt_error" }, error) : null,
-        h(InstalledPanel, { installed: installed, removing: removing, onUninstall: doUninstall }),
+        h(InstalledPanel, { installed: installed, removing: removing, updates: updates, onUninstall: doUninstall, onInstallSpec: doInstallSpec }),
         jobsActive ? h(JobsPanel, { jobs: jobs }) : null,
         h("div", { className: "mkt_list" },
           results == null
@@ -364,8 +491,13 @@ window.__ModuleLoader__.load({
             : results.items.length === 0
               ? h("div", { className: "mkt_meta mkt_listHead" }, "没有匹配的仓库。")
               : h(React.Fragment, null,
-                h("div", { className: "mkt_meta mkt_listHead" }, "共 " + results.total + " 个仓库（显示 " + results.items.length + " 个）"),
-                results.items.map(function (item) {
+                h("div", { className: "mkt_meta mkt_listHead" }, verifiedOnly
+                  ? "已验证插件 " + visibleItems.length + " 个 · 已加载 " + results.items.length + "/" + results.total + " 个仓库（star≥1）" + (verifyPending ? " · 验证中…" : "")
+                  : "共 " + results.total + " 个仓库（star≥1）· 已显示 " + results.items.length + " 个"),
+                visibleItems.length === 0 && verifiedOnly
+                  ? h("div", { className: "mkt_meta mkt_listHead" }, verifyPending ? "正在验证仓库是否为 dsh 插件…" : "当前加载的结果里没有已验证的 dsh 插件，下滑加载更多。")
+                  : null,
+                visibleItems.map(function (item) {
                   var installJob = null;
                   for (var jobId in jobs) {
                     if (jobs[jobId] && jobs[jobId].spec === "github:" + item.fullName) { installJob = jobs[jobId]; break; }
@@ -373,11 +505,15 @@ window.__ModuleLoader__.load({
                   return h(RepoCard, {
                     key: item.fullName,
                     item: item,
-                    installing: installing[item.fullName] === true,
+                    installing: installing[item.fullName] === true || installing["github:" + item.fullName] === true,
                     installJob: installJob,
+                    verified: verified[item.fullName],
                     onInstall: doInstall,
                   });
-                })
+                }),
+                canLoadMore
+                  ? h("div", { className: "mkt_loadMore", ref: sentinelRef }, loadingMore ? "加载中…" : Date.now() < retryAt ? "GitHub 限流中，稍后再下滑加载" : "下滑加载更多")
+                  : h("div", { className: "mkt_loadMore" }, reachedLimit ? "已达 GitHub 搜索上限（前 1000 个结果）" : "已显示全部 " + results.items.length + " 个")
               )
         ),
         jobsActive ? null : h(JobsPanel, { jobs: jobs })

package/src/github.js

@@ -3,6 +3,8 @@
 // standalone (node src/github.js --self-test).
 
 const SEARCH_TOPIC = "topic:dsh-plugin";
+/** GitHub search never serves past the first 1000 results. */
+const SEARCH_WINDOW = 1000;
 
 export function buildHeaders(token) {
   const headers = {
@@ -14,8 +16,11 @@ export function buildHeaders(token) {
   return headers;
 }
 
+const DEFAULT_API_BASE = "https://api.github.com";
+
 function apiUrl(apiBase, path) {
-  const base = apiBase.endsWith("/") ? apiBase : `${apiBase}/`;
+  const raw = typeof apiBase === "string" && apiBase.length > 0 ? apiBase : DEFAULT_API_BASE;
+  const base = raw.endsWith("/") ? raw : `${raw}/`;
   return `${base}${path.replace(/^\//, "")}`;
 }
 
@@ -54,6 +59,7 @@ function pickRepo(item) {
     description: item.description ?? "",
     stars: item.stargazers_count ?? 0,
     forks: item.forks_count ?? 0,
+    isFork: item.fork === true,
     language: item.language,
     license: item.license?.spdx_id,
     topics: item.topics ?? [],
@@ -66,14 +72,32 @@ function pickRepo(item) {
 /**
  * Search repositories tagged `topic:dsh-plugin`, optionally narrowed by
  * keywords (name/description/readme match), star-ranked by default.
+ * `minStars` (default 1) is pushed into the query as `stars:>=N` so the
+ * topic's noise (empty/demo repos riding the tag) is filtered server-side
+ * and `total` stays accurate; pass 0 to disable.
  */
-export async function searchPlugins({ query, sort = "stars", perPage = 10, page = 1, apiBase, token, signal }) {
+export async function searchPlugins({ query, sort = "stars", perPage = 10, page = 1, minStars, apiBase, token, signal }) {
   const trimmed = typeof query === "string" ? query.trim() : "";
-  const q = trimmed.length > 0 ? `${SEARCH_TOPIC} ${trimmed}` : SEARCH_TOPIC;
+  const parts = [SEARCH_TOPIC];
+  if (trimmed.length > 0) parts.push(trimmed);
+  const safeMinStars = Math.max(Math.trunc(Number(minStars ?? 1)) || 0, 0);
+  if (safeMinStars > 0) parts.push(`stars:>=${safeMinStars}`);
+  const q = parts.join(" ");
   const safePerPage = Math.min(Math.max(Math.trunc(perPage) || 10, 1), 100);
   const safePage = Math.max(Math.trunc(page) || 1, 1);
   const path = `/search/repositories?q=${encodeURIComponent(q)}&sort=${encodeURIComponent(sort)}&order=desc&per_page=${safePerPage}&page=${safePage}`;
-  const body = await requestJson(path, { apiBase, token, signal });
+  let body;
+  try {
+    body = await requestJson(path, { apiBase, token, signal });
+  } catch (error) {
+    // Past the first 1000 results GitHub 422s with "Only the first 1000
+    // search results are available" — surface that as a clean empty
+    // truncated page instead of a hard error.
+    if (/first 1000 search results/i.test(String(error?.message ?? ""))) {
+      return { total: SEARCH_WINDOW, page: safePage, perPage: safePerPage, items: [], truncated: true };
+    }
+    throw error;
+  }
   return {
     total: body.total_count ?? 0,
     page: safePage,
@@ -82,6 +106,154 @@ export async function searchPlugins({ query, sort = "stars", perPage = 10, page
   };
 }
 
+// ── npm registry (prefer-npm installs + update checks) ──────────────────────
+//
+// npm tarballs beat GitHub whole-repo tarballs: smaller (files field only),
+// faster, integrity-checked. `preferNpmSpec` rewrites a github: install spec
+// to its npm package name — but only when the registry entry's repository URL
+// points back at that GitHub repo, which doubles as an anti-squatting check
+// (an unrelated package squatting the name never matches, install falls back
+// to the explicit github: spec).
+
+const NPM_REGISTRY = "https://registry.npmjs.org";
+const npmCache = new Map(); // name -> {latest, repositoryUrl} | null (unknown/not found)
+
+/**
+ * Look up a package on the npm registry (abbreviated metadata). Cached for
+ * the process lifetime; null means "not on npm / unreachable".
+ */
+export async function npmPackageInfo(name) {
+  const clean = String(name ?? "").trim();
+  if (clean.length === 0 || !/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i.test(clean)) return null;
+  if (npmCache.has(clean)) return npmCache.get(clean);
+  let info = null;
+  try {
+    const response = await fetch(`${NPM_REGISTRY}/${clean.replace("/", "%2F")}`, {
+      headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/vnd.npm.install-v1+json" },
+    });
+    if (response.ok) {
+      const body = await response.json();
+      const latest = body?.["dist-tags"]?.latest;
+      if (typeof latest === "string") {
+        const rawRepository = body?.repository;
+        const repositoryUrl = typeof rawRepository === "string" ? rawRepository : rawRepository?.url;
+        info = { latest, repositoryUrl: typeof repositoryUrl === "string" ? repositoryUrl : undefined };
+      }
+    }
+  } catch {
+    info = null; // registry unreachable — caller falls back
+  }
+  npmCache.set(clean, info);
+  return info;
+}
+
+/**
+ * Rewrite "github:owner/repo" (or "owner/repo") to the npm package name when
+ * that package exists on npm AND its repository URL points back at the repo
+ * (anti-squatting). Anything else passes through untouched.
+ */
+export async function preferNpmSpec({ spec }) {
+  const raw = String(spec ?? "");
+  const githubMatch = /^(?:github:)?([^/\s]+\/[^/\s]+?)(?:\.git)?$/i.exec(raw);
+  if (githubMatch === null) return raw;
+  const repo = githubMatch[1];
+  const { results } = await verifyPlugins({ repos: [repo] }); // cache hit after first verify
+  const declaredName = results[repo]?.name;
+  if (typeof declaredName !== "string") return raw;
+  const info = await npmPackageInfo(declaredName);
+  if (info === null || info.repositoryUrl === undefined) return raw;
+  const pointsBack = new RegExp(`github\\.com[/:]${repo.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(/|\\.git|$)`, "i").test(info.repositoryUrl);
+  return pointsBack ? declaredName : raw;
+}
+
+/** Loose semver-ish comparison: "0.2.10" vs "0.2.9" → 1. Non-numeric parts read as 0. */
+export function compareVersions(a, b) {
+  const pa = String(a ?? "").split(".");
+  const pb = String(b ?? "").split(".");
+  for (let index = 0; index < Math.max(pa.length, pb.length); index++) {
+    const na = Number(pa[index]) || 0;
+    const nb = Number(pb[index]) || 0;
+    if (na !== nb) return na < nb ? -1 : 1;
+  }
+  return 0;
+}
+// ── plugin verification (raw CDN, no API quota) ─────────────────────────────
+//
+// The topic carries thousands of repos that are not dsh plugins at all. The
+// authoritative signal is a package.json declaring `dsh.bundle.patch` (host
+// bundle) or `dsh.client` (browser UI plugin) — the same contract
+// classifyPackage applies locally. package.json is fetched from
+// raw.githubusercontent.com (a CDN that does not consume REST API quota), so a
+// page of 20 verifies in one burst even without a token. Results are cached
+// for the process lifetime; a fetch failure caches "unknown" rather than
+// retrying forever.
+
+const RAW_BASE = "https://raw.githubusercontent.com";
+const VERIFY_CONCURRENCY = 8;
+const verifyCache = new Map();
+
+// package.json is fetched from CDNs, not the REST API, so verification never
+// burns API quota. jsDelivr first (reachable where raw.githubusercontent.com
+// is blocked), raw as fallback; a 404 only means "no manifest" once EVERY
+// reachable source 404s (jsDelivr lags new pushes, so one 404 is not final).
+const RAW_SOURCES = [
+  (repo) => `https://cdn.jsdelivr.net/gh/${repo}@HEAD/package.json`,
+  (repo) => `${RAW_BASE}/${repo}/HEAD/package.json`,
+];
+
+async function fetchRawPackageJson(repo, signal) {
+  let saw404 = false;
+  let lastError;
+  for (const buildUrl of RAW_SOURCES) {
+    try {
+      const response = await fetch(buildUrl(repo), {
+        headers: { "User-Agent": "dsh-plugin-mall", Accept: "application/json" },
+        signal,
+      });
+      if (response.status === 404) { saw404 = true; continue; }
+      if (!response.ok) throw new Error(`source returned ${response.status}`);
+      return await response.json();
+    } catch (error) {
+      if (error?.name === "AbortError") throw error;
+      lastError = error;
+    }
+  }
+  if (saw404) return undefined;
+  throw lastError ?? new Error("no raw source reachable");
+}
+
+/**
+ * Verify repositories as real dsh plugins by their package.json declaration.
+ * @param {{repos: string[], signal?: AbortSignal}} options - "owner/name" list.
+ * @returns the {results} map: fullName -> {kind: "bundle"|"client"|"plain"|"no-manifest"|"unknown", name?, version?}.
+ */
+export async function verifyPlugins({ repos, signal }) {
+  const wanted = [...new Set((Array.isArray(repos) ? repos : []).map(String)
+    .filter((repo) => /^[^/\s]+\/[^/\s]+$/.test(repo) && !repo.includes("..")))];
+  const pending = wanted.filter((repo) => !verifyCache.has(repo));
+  let cursor = 0;
+  const worker = async () => {
+    while (cursor < pending.length) {
+      const repo = pending[cursor++];
+      try {
+        const pkg = await fetchRawPackageJson(repo, signal);
+        const kind = pkg === undefined ? "no-manifest"
+          : typeof pkg.dsh?.bundle?.patch === "string" ? "bundle"
+            : pkg.dsh?.client !== undefined ? "client"
+              : "plain";
+        verifyCache.set(repo, { kind, name: pkg?.name, version: pkg?.version });
+      } catch (error) {
+        if (error?.name === "AbortError") throw error;
+        verifyCache.set(repo, { kind: "unknown" });
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(VERIFY_CONCURRENCY, pending.length) }, worker));
+  const results = {};
+  for (const repo of wanted) results[repo] = verifyCache.get(repo) ?? { kind: "unknown" };
+  return { results };
+}
+
 /**
  * Fetch one repository's metadata plus its package.json (base64-decoded),
  * which is what tells us whether it declares a dsh bundle patch.

package/src/index.js

@@ -18,7 +18,7 @@ import { defineTool } from "@deepseek-ai/dsh-tools";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { repoInfo, searchPlugins } from "./github.js";
+import { repoInfo, searchPlugins, verifyPlugins, preferNpmSpec, npmPackageInfo, compareVersions } from "./github.js";
 import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, createJobTracker } from "./installer.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
@@ -154,11 +154,35 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         sort: payload?.sort ?? "stars",
         perPage,
         page: payload?.page ?? 1,
+        minStars: payload?.minStars,
         apiBase,
         token,
       });
       return rpcOk(result);
     }
+    case "verify": {
+      const result = await verifyPlugins({ repos: payload?.repos });
+      return rpcOk(result);
+    }
+    case "updates": {
+      const profile = String(payload?.profile ?? defaultProfile).trim();
+      let deps;
+      try {
+        resolveProfileDir(profile);
+        deps = listInstalled(profile).deps;
+      } catch (error) {
+        return rpcFail(new Error(`invalid profile: ${error.message}`));
+      }
+      const results = {};
+      await Promise.all(deps.map(async (dep) => {
+        if (dep.kind === "missing") { results[dep.name] = { latest: null }; return; }
+        const info = await npmPackageInfo(dep.name);
+        results[dep.name] = info === null
+          ? { latest: null }
+          : { latest: info.latest, hasUpdate: compareVersions(info.latest, dep.version) > 0 };
+      }));
+      return rpcOk(results);
+    }
     case "info": {
       const result = await repoInfo({ repo: payload?.repo, apiBase, token });
       return rpcOk(result);
@@ -180,6 +204,9 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
       } catch (error) {
         return rpcFail(error);
       }
+      // npm tarball 优先（小而快、带 integrity）；registry 条目不同源的包名
+      // 视为抢注，回退 github: 全仓库 spec。
+      spec = await preferNpmSpec({ spec });
       try {
         const profileDir = resolveProfileDir(profile);
         if (!existsSync(join(profileDir, "package.json"))) ensureProfile(profile);
@@ -243,7 +270,17 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
 function registerRpcChannel(ctx, config, token) {
   const tracker = createJobTracker();
   ctx.inject(["connection"], (connectionCtx) => {
-    connectionCtx.connection.rpc.handle("/market", (endpoint, payload, signal) => rpcDispatch(ctx, endpoint, payload ?? {}, config, token, tracker), { authority: "loopback" });
+    connectionCtx.connection.rpc.handle("/market", async (endpoint, payload, signal) => {
+      try {
+        return await rpcDispatch(ctx, endpoint, payload ?? {}, config, token, tracker);
+      } catch (error) {
+        // 没有这层兜底时连接层只会回一个 HTTP 500 "transport failure"，
+        // 真实异常既到不了浏览器也不留痕。透传错误文本，同时把堆栈
+        // 打进 dsh 进程的 stderr（前台运行时可见）。
+        console.error(`[dsh-plugin-mall] /market/${String(endpoint)} failed:`, error);
+        return rpcFail(error);
+      }
+    }, { authority: "loopback" });
   });
 }
 
@@ -357,7 +394,7 @@ export function apply(ctx, config = {}) {
     },
     async execute(args, exec) {
       const profile = String(args.profile ?? defaultProfile).trim();
-      const spec = normalizeSpec(args.spec);
+      const spec = await preferNpmSpec({ spec: normalizeSpec(args.spec) });
       let profileDir;
       try {
         profileDir = resolveProfileDir(profile);