@chatcode/cco-market 1.45.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 fkysly and dsh-market contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,146 @@
+<p align="center">
+  <img src="assets/logo.svg" width="96" alt="ChatCode CLI Market logo">
+</p>
+
+# ChatCode CLI Plugin Market
+
+English | [中文](README.zh.md)
+
+[![npm](https://img.shields.io/npm/v/@chatcode/cco-market)](https://www.npmjs.com/package/@chatcode/cco-market)
+[![stars](https://img.shields.io/github/stars/dsh-market/dsh-market?style=flat)](https://github.com/dsh-market/dsh-market)
+
+The plugin market for ChatCode CLI. Open Settings → **Plugin Market** → browse, search, one-click install.
+
+![ChatCode CLI Plugin Market](assets/demo-en.png)
+
+One-click themes: install, switch live, no restart.
+
+## Install
+
+```sh
+chatcode-cli plugin --profile web add @chatcode/cco-market
+```
+
+Restart `chatcode-cli web`, then open **Settings → Plugin Market**.
+
+The same package also provides **Settings → Skill Market** in Web and `/skill-market` in the TUI. A project install goes to the nearest Git repository's `.chatcode-cli/skills/<name>` directory; a user install goes to `$CHATCODE_CLI_HOME/skills/<name>` (or `~/.chatcode-cli/skills/<name>` when `CHATCODE_CLI_HOME` is unset). Web resolves the target from the selected live session, while the TUI uses its current channel workspace.
+
+Skill archives are size-capped, reject path traversal and symbolic links, require exactly one valid `SKILL.md`, and never replace a same-named skill without matching `.skill-market.json` ownership metadata. The public catalog base URL and archive limits can be changed under `config.skillMarket`.
+
+**Requires ChatCode CLI 0.1.0-rc.6 or newer.** On an older host the market
+disables itself and says so in the browser console rather than rendering
+against primitives that are not there — if the Plugin Market entry never
+appears, that is usually why. Worth checking when a desktop build bundles
+its own host package: it may be older than the one `npm` would give you (#139).
+
+## What you get
+
+- **Browse & search** the full community catalog (2300+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
+- **Skill Market** — browse and install Agent skills from Web or `/skill-market` without another plugin; choose project or user scope and let ChatCode CLI discover the files
+- **Host-aware discovery** — cards show the DSH requirement declared by `engines.dsh` or lockstep `@deepseek-ai/dsh-*` peers; an opt-in filter hides only confirmed mismatches with the running host. Undeclared, malformed, unavailable, and GitHub-only entries remain visible rather than being guessed incompatible
+- **Screenshots** — AppStore-style screenshots, auto-carousel when there's more than one, click to preview full-size: author-curated shots show right on the card (zero extra requests); plugins without curated shots fall back to automatic README extraction once you open the install dialog. Images load from GitHub hosting only
+- **Comments** — every card opens the plugin's discussion thread in place. It is the same thread its pages on [dshmarket.com](https://dshmarket.com) and the [catalog](https://awesome-dsh-plugin.com) show, so a plugin has one conversation rather than three. Backed by GitHub Discussions through giscus: it loads when you open it, needs a GitHub account only to post, and the note above it says plainly that opening it contacts giscus.app and GitHub. In ChatCode CLI Web, reading stays embedded while a dedicated GitHub action opens the exact discussion in a new tab for sign-in and posting, so the cross-site return never carries or depends on the host session
+- **Favorites** — bookmark plugins and themes from Discover or the Themes tab; a dedicated Favorites tab lists them with search, sort, and install actions. Bookmarks persist in the profile's market state (`state.json`); entries that leave the catalog can be cleared in one click
+- **Themes** — a dedicated tab for community themes and skins: install → active immediately, switch with one click (themes are mutually exclusive, your choice survives restarts), uninstall to revert
+- **One-click install** — confirm the source, watch live progress; most plugins go live after a page refresh, no restart
+- **Backup & restore** — export your profile's plugin list and configuration as readable JSON, import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist; restores **merge** (plugins installed after the backup are kept), validate before writing, and roll back on failure
+- **Updates** — per-plugin update checks (npm version or pinned commit vs HEAD), one-click update, or update everything at once; the market updates itself the same way
+- **Resilient GitHub routes** — in the China download region, Git refs, README content, and avatars each keep their own fallback order. The market remembers the last working route, switches only after transport/HTTP/payload validation fails, and rejects proxy error pages disguised as HTTP 200. If every built-in route fails, **Settings → Plugins → Plugin configuration → GitHub acceleration** accepts one persistent custom HTTPS prefix; `CHATCODE_CLI_MARKET_GITHUB_PROXY` is the operator-owned override (legacy `DSHM_GITHUB_PROXY` is still read)
+- **Public update API** — plugin-owned settings pages can use the versioned, capability-gated [update API v1](UPDATE-API-V1.md) (beta) instead of copying package-manager logic or depending on private Market UI responses
+- **Uninstall** — two-step confirm; plugins installed this session are removed live
+- **Hot disable / enable** — toggles write `- id: …` + `disabled: true|false` into the profile's `cordis.patch.yml` (the official patch layer, mechanism ported from [dsh-plugin-hub](https://github.com/Noob-stupid/dsh-plugin-hub)): ChatCode CLI re-composes within ~1s, no restart, and the loader re-applies the choice on every boot; hand-edited patch rows show as badges, host-infrastructure plugins are protected from toggling, and a malformed patch file is never made worse
+- **Restart when needed** — changes that cannot hot-load show a one-click restart beside the pending-change banner; the action is restricted to same-origin loopback requests
+- **Zero jargon** — if a component is missing (pnpm), the market detects it and offers a one-click automatic setup
+- **Log export** — one click produces a sanitized plain-text log for bug reports (home paths and credential shapes are masked; nothing is ever sent anywhere). The market's version sits next to the page heading, so a screenshot of a problem already carries it
+- **Settings card** — on ChatCode CLI 0.1.0-rc.7 and newer the market manages *itself* from **Settings → Plugins → Plugin configuration**, next to every other plugin: see the running version, pick a **release channel** (stable, or beta to try builds still being verified — the market only, never your other plugins; a third *dev* channel appears once developer mode is switched on, and carries builds published straight off a branch), update, or remove the market — with an opt-in cleanup that also drops the disable rows it wrote, so plugins it switched off start running again rather than staying off with no UI left to switch them back on
+- **Diagnostics** — the plugin load order and conflict surface, one page: bundle stack with official/community badges, duplicate loader entries, dependency version mismatches, multi-version core packages, overrides and invalid config entries. Plain-language terms, problem blocks highlighted, everything collapsible
+
+- **Load order** — drag community bundles into the order you want, or take the suggested one derived from the plugins' own before/after rules. Nothing is written until a trial composition passes, and the panel tells you what the new order would change (overrides, invalid or duplicate entries) before you apply it
+- **AI fix** — one click copies a diagnostics-driven fix prompt (errors/warnings/order conflicts + conservative scope instructions) to the clipboard; you paste it into a new conversation and decide whether to send. The prompt first asks the agent to detect whether it is itself the ChatCode CLI instance running this profile — if so it hard-forbids mutating the live composition, upgrading/restarting ChatCode CLI or core packages, or reinstalling deps, and instead has it write an idempotent `apply` script plus a `rollback` script, have you run them in an external terminal, and paste the output back
+
+## Speed
+
+Installs prefer repo-verified npm packages, then author-supplied prebuilt GitHub Release tarballs, before falling back to full-repo GitHub source downloads. Prebuilt installs are typically seconds and do not need local build scripts; source-only plugins depend on your connection to GitHub.
+
+## Security
+
+- Installs are restricted to sources listed in the curated [awesome-dsh-plugin](https://awesome-dsh-plugin.com) registry — anything else is rejected
+- Build scripts stay blocked by default (pnpm ≥10); allowing one is your explicit per-package choice
+- Terminal/CLI-surface plugins are flagged before you install them into the web profile
+- The install endpoint accepts same-origin POST only; the market never phones home
+- Skill installation accepts same-origin POST only in Web, derives its destination from the live session instead of a browser-supplied path, and validates the downloaded ZIP before writing a skill root
+- Backups can contain credentials from your profile config — the UI warns before export and upload; WebDAV sync is https-only, refuses private-network targets, and never stores your password in the browser
+- Authenticated Gist requests always go directly to `api.github.com`; bearer tokens are never sent to a public GitHub acceleration service. GitHub source archives also stay on canonical codeload URLs so pnpm's integrity policy remains in force
+- The restart endpoint additionally requires a direct loopback client (forwarded requests are rejected) and relaunches the exact ChatCode CLI entry, arguments, environment, and working directory
+- One-click restart launches a detached replacement. **When this host is systemd's own service process the button is hidden automatically** — the market would otherwise kill the takeover process along with the unit's cgroup and the service would not come back. The pending-change notice stays visible and says so. Detection requires both a systemd marker AND being the unit's main process, because `INVOCATION_ID` is inherited by every descendant of a unit (an ordinary terminal included) and hiding the button for those would be the worse bug. pm2 and launchd are not detected, so those deployments need the explicit setting below. Either flip **Allow restart** off in **Settings → Plugins → Plugin configuration**, or write it into the profile patch — where it has to sit under `config:`, because the loader passes only that sub-object to a plugin and a top-level `allowRestart:` is silently ignored (#227 by @Fantasymax):
+
+  ```yaml
+  - id: dsh-market
+    name: dshmarket
+    config:
+      allowRestart: false   # NOT at the top level beside `name:`
+  ```
+
+  `GET /dsh-market/status` reports `"restart": false` once it has taken effect.
+- For terminal-attached launches, the detached replacement keeps running after the original terminal closes
+- Listing ≠ endorsement: plugins are third-party code, install sources you trust
+
+## Submit your plugin
+
+**This repo is the market app, not the catalog.** The plugin list comes from the curated [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) registry — to get your plugin listed in the market, open a PR **there** (one entry in the list; the site and this market pick it up automatically, usually within a day). Please don't PR plugin entries against this repo.
+
+## Roadmap & feedback
+
+- **Bugs** go in [issues](https://github.com/dsh-market/dsh-market/issues) — attaching the market's "Export log" makes diagnosis roughly ten times faster
+- **Feature ideas** go on the [Roadmap](https://github.com/orgs/dsh-market/projects/1). Issues are kept for things that are broken, so a proposal filed as an issue gets moved there and closed; the discussion stays where you wrote it either way
+- Every roadmap item welcomes community PRs — say so on the item before starting, so two people don't build it twice
+
+## Data source
+
+Fetched live on every open from [awesome-dsh-plugin.com/plugins.json](https://awesome-dsh-plugin.com/plugins.json) — curated entries, npm mapping, and star counts refreshed daily by CI, with no stale cache behind it. A failure reports the actual reason and elapsed time, with a Retry button.
+
+There is deliberately no bundled snapshot to fall back on: for a catalog that grows daily, a stale answer is not a degraded one but a wrong one — a plugin published this morning would read as "does not exist".
+
+**If that host is unreachable from your network**, point the market at a mirror instead. Set `CHATCODE_CLI_MARKET_REGISTRY_URL` in the ChatCode CLI environment to anything serving the same `plugins.json` shape (legacy `DSHM_REGISTRY_URL` remains accepted):
+
+```sh
+CHATCODE_CLI_MARKET_REGISTRY_URL=https://your-mirror.example/plugins.json chatcode-cli web
+```
+
+## Friends
+
+### DSH Desktop (dataelement)
+
+[dsh-desktop](https://github.com/dataelement/dsh-desktop) — a desktop app for DeepSeek Harness: run and manage a local Harness without installing Node.js yourself. Ships with this plugin market preset as the default. [dshdesktop.com](https://dshdesktop.com)
+
+### DeepSeek Harness Desktop (hairyf)
+
+[deepseek-harness-desktop](https://github.com/hairyf/deepseek-harness-desktop) — a native desktop app for DeepSeek Harness built with **Tauri** (Rust + Web): one-click local install and launch with no Node.js setup required. On first run it offers to install this plugin market as a recommended preset.
+
+### DeepSeek Harness Desktop (anywhere-labs)
+
+[deepseek-harness-desktop](https://github.com/anywhere-labs/deepseek-harness-desktop) — an Electron desktop app for DeepSeek Harness built around the idea that everything is a plugin, including the desktop itself: profile switching, a bundled Node and pnpm, and a recoverable install path that snapshots the profile before a change. [dshdesktop.cn](https://dshdesktop.cn)
+
+### DSH App
+
+[dsh-app](https://github.com/RyensX/dsh-app) — a DeepSeek Harness desktop client built on Tauri 2 rather than Electron, so it ships a much smaller binary and uses the system webview. AGPL-3.0.
+
+### Local DSH
+
+[local-dsh](https://github.com/liangchen-harold/local-dsh) — a DeepSeek Harness desktop client that can run the model on your own machine: it bundles llama.cpp next to Node, pnpm and DSH, so a downloaded GGUF model answers without any external API. Built on Tauri; Apple Silicon Macs for now. [localdsh.com](https://localdsh.com)
+
+### DSH Get
+
+[DSH Get](https://www.dshget.com/) — a searchable web directory for discovering DeepSeek Harness plugins: category filters, bilingual descriptions, install commands and per-plugin detail pages. Its normalized catalog snapshot is public at [bobby-sheng/dshget-data](https://github.com/bobby-sheng/dshget-data).
+
+### modlens
+
+[modlens](https://github.com/liustack/modlens) — the first vision plugin for DeepSeek Harness: bolts visual understanding onto text-only models like DeepSeek and GLM. Paste an image, get structured JSON evidence back — OCR, layout, semantics. Available right in this market:
+
+```sh
+chatcode-cli plugin --profile web add @liustack/modlens
+```
+
+## License
+
+MIT · [dshmarket.com](https://dshmarket.com)

package/README.zh.md

@@ -0,0 +1,143 @@
+<p align="center">
+  <img src="assets/logo.svg" width="96" alt="ChatCode CLI 插件市场 logo">
+</p>
+
+# ChatCode CLI 插件市场
+
+[English](README.md) | 中文
+
+[![npm](https://img.shields.io/npm/v/@chatcode/cco-market)](https://www.npmjs.com/package/@chatcode/cco-market)
+[![stars](https://img.shields.io/github/stars/dsh-market/dsh-market?style=flat)](https://github.com/dsh-market/dsh-market)
+
+ChatCode CLI 的插件市场。打开设置 → **插件市场** → 逛一逛，点一下，装好。
+
+![ChatCode CLI 插件市场](assets/demo-zh.png)
+
+主题一键换：装完即生效，点一下切换，不用重启。
+
+## 安装
+
+```sh
+chatcode-cli plugin --profile web add @chatcode/cco-market
+```
+
+重启 `chatcode-cli web`，打开 **设置 → 插件市场**。
+
+同一个包还会在 Web 提供**设置 → 技能市场**，并在 TUI 提供 `/skill-market`。项目安装写入最近 Git 仓库的 `.chatcode-cli/skills/<name>`；个人安装写入 `$CHATCODE_CLI_HOME/skills/<name>`（未设置时为 `~/.chatcode-cli/skills/<name>`）。Web 从选中的活动会话解析目标目录，TUI 使用当前 channel 的工作区。
+
+技能压缩包有下载与解压大小限制，会拒绝路径穿越和符号链接，必须且只能包含一个有效 `SKILL.md`，并且不会覆盖缺少匹配 `.skill-market.json` 所有权信息的同名技能。可在 `config.skillMarket` 下修改公开目录地址和压缩包限制。
+
+**需要 ChatCode CLI 0.1.0-rc.6 或更新版本。** 宿主太旧时市场会自我禁用，并在浏览器
+控制台说明原因，而不是拿缺失的原语去渲染——如果设置里根本没出现「插件市场」这
+一项，通常就是这个原因。桌面端要留意：它可能内置了比 `npm` 装到的更旧的宿主版本（#139）。
+
+## 你会得到
+
+- **逛与搜**——完整社区目录（2300+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
+- **技能市场**——Web 和 `/skill-market` 共用一个实现，不需要新增插件；可选择项目或个人目录，安装后的文件由 ChatCode CLI 自动发现
+- **按宿主发现**——卡片展示插件通过 `engines.dsh` 或同版本线 `@deepseek-ai/dsh-*` peer 声明的 DSH 要求；可选筛选只隐藏与当前宿主明确不匹配的插件。未声明、格式异常、暂时取不到清单及仅 GitHub 发布的条目仍保持可见，不猜成不兼容
+- **截图展示**——App Store 式截图，多图自动轮播，点开还能看大图；作者在 registry 里策展的截图列表卡片就直接显示（零额外请求），没有策展的插件则在打开安装弹窗时自动从 README 抽取；图片仅从 GitHub 图床加载
+- **评论**——每张卡片都能就地打开该插件的讨论。它和插件在 [dshmarket.com](https://dshmarket.com) 与[目录站](https://awesome-dsh-plugin.com)上的页面共用同一条讨论，一个插件只有一处对话，而不是三处。底层是 GitHub Discussions（经由 giscus）：打开即加载，只有发表评论才需要 GitHub 账号；说明里也直说打开会连接 giscus.app 与 GitHub。ChatCode CLI Web 继续内嵌评论供阅读，登录和发表则通过专用 GitHub 入口在新标签页打开当前插件的精确讨论，不让跨站回跳携带或依赖宿主会话
+- **收藏**——在「发现」或「主题」页点书签即可收藏插件/主题；「收藏」Tab 集中展示，支持搜索、排序与安装。书签写入 profile 的市场状态（`state.json`）；已下架条目可一键清除
+- **主题**——独立主题页：装完立即生效，点一下切换（主题互斥、选择跨重启保留），卸载即恢复
+- **一键安装**——确认来源，实时进度；多数插件刷新页面即可用，无需重启
+- **备份与恢复**——把 profile 的插件清单与配置导出为可读 JSON，换机导入，存到 WebDAV 并每日自动备份，或通过私有 GitHub Gist 跨机器同步；恢复采用**合并**方式（备份之后新装的插件会保留），写入前校验、失败自动回滚
+- **更新**——逐插件检测（npm 版本或锁定 commit 对比 HEAD），一键更新或全部更新；市场自己也走同一通道升级
+- **GitHub 多线路容错**——中国大陆下载区域会为 Git ref、README 与头像分别维护 fallback 顺序，记住上次可用线路，只在传输、HTTP 状态或响应内容校验失败后换线，并拒绝公共反代伪装成 HTTP 200 的 HTML 错误页。内置线路全部失效时，可到**设置 → 插件 → 插件配置 → GitHub 加速**填写一个持久化的自定义 HTTPS 前缀；运维设置的 `CHATCODE_CLI_MARKET_GITHUB_PROXY` 始终优先（仍兼容读取 `DSHM_GITHUB_PROXY`）
+- **公共更新接口**——插件自己的设置页可调用带版本号、能力探测和回滚状态的[更新 API v1](UPDATE-API-V1.md)（beta），无需复制包管理逻辑，也不依赖市场 UI 的私有响应字段
+- **卸载**——两步确认防误触；本次会话装的插件即点即卸
+- **热禁用 / 启用**——开关会往 profile 的 `cordis.patch.yml`（官方补丁层，机制移植自 [dsh-plugin-hub](https://github.com/Noob-stupid/dsh-plugin-hub)）写入 `- id: …` + `disabled: true|false`：ChatCode CLI 约 1 秒内重新组合，无需重启，loader 每次启动都会重新应用这个选择；手工改过的补丁行会显示成徽标，宿主基础设施插件禁止开关，补丁文件格式不对时绝不会被写得更糟
+- **按需重启**——无法热加载的变更会在待重启提示旁显示一键重启；操作仅接受本机同源请求
+- **零术语**——缺组件（pnpm）时市场自己发现、一键自动装好，全程不见命令行
+- **导出日志**——一键生成脱敏纯文本日志方便反馈（home 路径与密钥形状已打码；任何数据都不会被上传）。市场版本号就在标题旁边，截图反馈时自带版本信息
+- **设置卡片**——ChatCode CLI 0.1.0-rc.7 起，市场在 **设置 → 插件 → 插件配置** 里管理**它自己**，和其它插件并排：看当前版本、选择**更新通道**（稳定版，或 Beta 抢先试用还在验证中的版本——只影响市场自己，不影响你装的其它插件；打开开发者模式后还会多出「开发版」通道，直接取开发分支上的构建）、更新、或者移除市场。移除时可勾选一并清理——包括市场写进补丁层的停用行，被它关掉的插件会恢复运行，而不是保持停用却再没有界面能打开它们
+- **诊断**——插件加载顺序与冲突一页看全：bundle 栈（官方/社区徽标）、重复的 loader 条目、依赖版本不一致、核心包多版本共存、覆盖项与非法配置条目。术语说人话，问题块高亮，全部可折叠
+- **加载顺序**——拖拽调整社区 bundle 的顺序，或直接采用按插件自身 before/after 规则推导出的建议顺序。写入前先跑一次静态组合校验，通过才落盘；应用之前面板会告诉你这个顺序会改变什么（多少处覆盖、多少无效或重复条目）
+- **AI 修复**——一键把诊断结果生成的修复 prompt（错误/警告/顺序冲突 + 保守的改动范围约束）复制到剪贴板，你粘进新对话，自己决定发不发。提示词会先让 Agent 判断自己是不是就是这个 profile 所在的 ChatCode CLI 实例——若是，则严禁改动运行中组合、升级/重启 ChatCode CLI 或核心包、重装依赖，而是让它生成一份幂等的 `apply` 修改脚本和一份 `rollback` 回滚脚本，由你在外部终端执行并把输出拷回给它
+
+## 速度
+
+安装依次优先使用经仓库验证的 npm 包、作者提供的 GitHub Release 预构建 tarball，最后才回退到整仓 GitHub 源码下载。预构建安装通常只需数秒且无需执行本地构建脚本；仅提供源码的插件仍取决于你到 GitHub 的网络。
+
+## 安全
+
+- 只允许安装 [awesome-dsh-plugin](https://awesome-dsh-plugin.com) 精选列表内的来源,其它一律拒绝
+- 构建脚本默认禁止执行（pnpm ≥10）,放行与否由你按包显式决定
+- 终端/命令行类插件装进网页版前会被明确提醒
+- 安装接口只接受同源 POST;市场不会向任何地方上报数据
+- Web 技能安装只接受同源 POST，目标路径由活动会话解析而不是由浏览器指定，下载的 ZIP 校验通过后才写入技能目录
+- 备份可能包含 profile 配置里的密钥——导出与上传前 UI 会明确提醒;WebDAV 同步仅限 https、拒绝内网地址,且密码永不落盘浏览器
+- 带鉴权的 Gist 请求始终直连 `api.github.com`，Bearer token 不会交给公共 GitHub 加速服务；GitHub 源码归档也保持 canonical codeload URL，以保留 pnpm 的完整性校验边界
+- 重启接口还要求客户端直接来自环回地址（拒绝代理转发请求），并使用原入口、参数、环境和工作目录重新启动 ChatCode CLI
+- 一键重启会启动脱离终端的替代进程。**当本进程就是 systemd 服务的主进程时，按钮会自动隐藏**——否则市场重启会连带杀掉 cgroup 里的接管进程，服务起不来，待重启提示会说明原因。判定要求「systemd 标记」和「本进程是该 unit 的主进程」同时成立：`INVOCATION_ID` 会被 unit 的所有后代继承（包括普通终端），只看它会误伤一大批本来能正常重启的机器。pm2 和 launchd 不做检测，这类部署需要下面的显式配置。两种做法：在**设置 → 插件 → 插件配置**里关掉「允许重启」，或者写进 profile 补丁——注意必须嵌在 `config:` 下面，因为 loader 只把这个子对象传给插件，写在顶层会静默失效（#227，感谢 @Fantasymax）：
+
+  ```yaml
+  - id: dsh-market
+    name: dshmarket
+    config:
+      allowRestart: false   # 不要和 `name:` 并排写在顶层
+  ```
+
+  生效后 `GET /dsh-market/status` 会返回 `"restart": false`。
+- 从终端启动时，替代进程脱离原终端，关闭原终端后仍会继续运行
+- 收录 ≠ 背书:插件是第三方代码,请只安装你信任的来源
+
+## 提交你的插件
+
+**这个仓库是市场应用本身，不是插件目录。** 市场里的插件列表来自精选列表 [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin)——想让你的插件上架，请去**那边**提 PR（在列表里加一条即可，站点和本市场会自动收录，通常一天内生效）。请不要往本仓库提插件条目。
+
+## 路线图与反馈
+
+- **Bug** 提 [issue](https://github.com/dsh-market/dsh-market/issues)，附上市场页面的「导出日志」能让排查快十倍
+- **功能建议**放 [Roadmap](https://github.com/orgs/dsh-market/projects/1)。issues 只留「坏掉的东西」，所以提成 issue 的建议会被移到那边并关闭；讨论仍留在你写的地方
+- 路线图上的每一项都欢迎社区 PR——动手前在对应条目里说一声，免得两个人重复造
+
+## 数据源
+
+每次打开都实时请求 [awesome-dsh-plugin.com/plugins.json](https://awesome-dsh-plugin.com/plugins.json)——精选条目、npm 映射、star 数由 CI 每日刷新，不使用过期缓存兜底；连不上时会给出具体原因和耗时，并提供「重试」按钮。
+
+刻意不做本地快照兜底：目录每天都在增长，过期的答案不是「差一点」而是「错的」——今早刚发布的插件会显示成「不存在」。
+
+**如果你的网络访问不了这个域名**，可以改指到镜像：在 ChatCode CLI 运行环境里设置 `CHATCODE_CLI_MARKET_REGISTRY_URL`，指向任何提供相同 `plugins.json` 结构的地址（仍兼容读取 `DSHM_REGISTRY_URL`）：
+
+```sh
+CHATCODE_CLI_MARKET_REGISTRY_URL=https://your-mirror.example/plugins.json chatcode-cli web
+```
+
+## 友情链接
+
+### DSH Desktop（dataelement）
+
+[dsh-desktop](https://github.com/dataelement/dsh-desktop)——DeepSeek Harness 桌面客户端：无需自装 Node.js 即可运行和管理本地 Harness，并默认预置本插件市场。[dshdesktop.com](https://dshdesktop.com)
+
+### DeepSeek Harness Desktop（hairyf）
+
+[deepseek-harness-desktop](https://github.com/hairyf/deepseek-harness-desktop)——基于 **Tauri**（Rust + Web）构建的 DeepSeek Harness 原生桌面客户端：一键本地安装并启动，无需自装 Node.js；首次启动可选择安装本插件市场作为推荐插件。
+
+### DeepSeek Harness Desktop（anywhere-labs）
+
+[deepseek-harness-desktop](https://github.com/anywhere-labs/deepseek-harness-desktop)——基于 Electron 的 DeepSeek Harness 桌面客户端，理念是「万物皆插件，桌面本身也是插件」：支持 profile 切换、内置 Node 与 pnpm，安装前会先给 profile 拍快照以便回滚。[dshdesktop.cn](https://dshdesktop.cn)
+
+### DSH App
+
+[dsh-app](https://github.com/RyensX/dsh-app)——基于 Tauri 2（而非 Electron）的 DeepSeek Harness 桌面客户端，因此安装包小得多，界面走系统 webview。AGPL-3.0。
+
+### Local DSH
+
+[local-dsh](https://github.com/liangchen-harold/local-dsh)——可以把模型跑在本机的 DeepSeek Harness 桌面客户端：发行包内置 llama.cpp 与 Node、pnpm、DSH，下载一个 GGUF 模型就能对话，不必接外部 API。基于 Tauri 构建；目前支持 Apple 芯片的 Mac。[localdsh.com](https://localdsh.com)
+
+### DSH Get
+
+[DSH Get](https://www.dshget.com/)——DeepSeek Harness 插件的网页检索目录：分类筛选、中英描述、安装命令与插件详情页；其规范化的目录快照公开在 [bobby-sheng/dshget-data](https://github.com/bobby-sheng/dshget-data)。
+
+### modlens
+
+[modlens](https://github.com/liustack/modlens)——全网第一个 DeepSeek Harness 视觉插件，为 DeepSeek、GLM 等纯文本模型外挂视觉能力，粘贴图片即得结构化 JSON 证据（OCR、版面、语义）。本市场内即可直接安装：
+
+```sh
+chatcode-cli plugin --profile web add @liustack/modlens
+```
+
+## 许可
+
+MIT · [dshmarket.com](https://dshmarket.com)

package/UPDATE-API-V1.md

@@ -0,0 +1,132 @@
+# Public plugin update API v1
+
+> **Status: beta.** The shape described here may still change between
+> releases. `GET /dsh-market/api/v1/capabilities` reports
+> `"stability": "beta"` while that is true, and `"stable"` once it stops
+> moving — read that field rather than assuming from the `v1` in the path.
+>
+> Nothing here is going away; what is not yet promised is that field names
+> and response shapes will survive untouched. If you ship against it now,
+> say so in an issue: a shape somebody depends on is a much stronger reason
+> not to move it, and it is how this reaches `stable`.
+
+
+`dshmarket` exposes a small, versioned, same-origin JSON API for plugin-owned
+update surfaces. It lets a plugin show its own update button without spawning a
+package manager, copying the Market installation algorithm, or binding to the
+Market UI's private response fields.
+
+All responses carry:
+
+```json
+{ "schema": "dsh-market/update-api/v1" }
+```
+
+Clients must discover the API before enabling mutation controls:
+
+```http
+GET /dsh-market/api/v1/capabilities
+```
+
+The response names the Market version, profile, runtime (`web` or `desktop`),
+supported features, restart owner and endpoint paths. A client must hide its
+restart button when `restart.supported` is false. Desktop and supervised hosts
+normally delegate restart to their owning shell or operator.
+
+## Check one installed package
+
+```http
+GET /dsh-market/api/v1/updates?name=dsh-mcp-connector&force=1
+```
+
+The response includes the installed version, target version, source kind and
+whether the target is a forward update. Omitting `force=1` allows the Market's
+short update-check cache.
+
+## Start and observe an update
+
+Mutation requests require the same-origin protection used by the Market UI.
+
+```http
+POST /dsh-market/api/v1/updates
+Content-Type: application/json
+
+{ "packageName": "dsh-mcp-connector" }
+```
+
+An accepted request returns HTTP `202` immediately with an `operationId`.
+Passing `"force": true` opts this one operation out of the registry release-age
+wait; clients should offer it only after the normal operation reports
+`RELEASE_TOO_FRESH` or `VERSION_UNCHANGED`.
+
+Poll the operation by id:
+
+```http
+GET /dsh-market/api/v1/operations?operationId=<id>
+```
+
+States are `queued`, `running`, `succeeded`, `failed`, `cancelled` and
+`rolled-back`. Running operations include structured package progress when
+pnpm provides it. Terminal operations include:
+
+- the before and actually installed versions;
+- `refreshRequired` and `restartRequired` outcomes;
+- a stable failure code, bounded user-facing message and retryability;
+- whether a compatibility rollback is currently available.
+
+For npm updates, Market verifies the package version that pnpm actually placed
+on disk before reporting success. This prevents pnpm's release-age policy or a
+lagging registry mirror from silently turning `@latest` into an older or
+unexpected build. A mismatch is restored from the pre-update recovery point
+and reported as one of these stable failures:
+
+- `DOWNGRADE_DETECTED`: the resolved version is older than the version present
+  before the operation; not retryable without a new target.
+- `RESOLVED_VERSION_MISMATCH`: the resolved version is BELOW the registry
+  target checked immediately before installation; retryable after registry or
+  mirror convergence. A version above that target is accepted — `latest` can
+  move forward while the install is still running.
+
+Provider clients should still compare `beforeVersion`, the target they showed
+to the user, and `installedVersion` before offering restart. That independent
+check protects clients connected to another compatible provider implementation.
+
+Up to 50 operation records live in the current Host process. A boot id is
+embedded in every operation id, so a client never mistakes a stale browser
+record for a task belonging to the replacement process.
+
+## Roll back
+
+```http
+POST /dsh-market/api/v1/rollback
+Content-Type: application/json
+
+{ "operationId": "<id>" }
+```
+
+Rollback is intentionally capability- and operation-scoped. It is available
+only when the Market's compatibility verification retained a recovery point;
+a later mutation may supersede it. The normalized result is written back to
+the same operation record.
+
+## Restart
+
+```http
+POST /dsh-market/api/v1/restart
+Content-Type: application/json
+
+{}
+```
+
+This preserves the Market's stricter restart guard: direct loopback,
+same-origin, no forwarding headers, no package mutation in progress, and a Host
+whose lifecycle is not owned by Desktop or a supervisor. Clients must feature
+detect it; they must not invent an alternative process-control path.
+
+## Compatibility policy
+
+- New optional response fields may be added within v1.
+- Existing v1 fields and meanings are not repurposed.
+- A breaking change uses a new path and schema version.
+- When discovery is unavailable, plugin UIs should fall back to opening the
+  Market rather than calling legacy `/dsh-market/*` mutation routes directly.