@deepseek-ai/dsh-client-ui-plugin-market 0.0.0-stage → 0.2.1-alpha.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,34 @@
+# Bilingual-pair consistency record for README.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/client/ui-plugin-market/README.md
+/:
+  en: af3fe4b70bddbc1b
+  zh: ac1c4326165266d9
+/deepseek-ai-dsh-client-ui-plugin-market:
+  en: 62972eb0dff8c145
+  zh: 682cc03b492cd730
+/deepseek-ai-dsh-client-ui-plugin-market/summary:
+  en: f95719fc57b4e921
+  zh: bf8a63b54127c147
+/deepseek-ai-dsh-client-ui-plugin-market/table-of-contents:
+  en: 76368b6b1da79c80
+  zh: 52384aee991ac542
+/deepseek-ai-dsh-client-ui-plugin-market/use-this-package:
+  en: 2690b95e156cc473
+  zh: 0d9e897ad628f9dd
+/deepseek-ai-dsh-client-ui-plugin-market/understand-the-implementation:
+  en: c56790cb58083f85
+  zh: a3d4ad4bad08e483
+/deepseek-ai-dsh-client-ui-plugin-market/model-experience:
+  en: 08d25ab9cbdd7567
+  zh: 26e6e75c123951ee
+/deepseek-ai-dsh-client-ui-plugin-market/model-experience/kv-cache-effect:
+  en: 4f0eadf94828e66e
+  zh: 4f8a6ec170ebbfb6
+/deepseek-ai-dsh-client-ui-plugin-market/known-limitations-and-deferred-work:
+  en: 5e98bb00293c12e3
+  zh: 279b09a42c515d17
+/deepseek-ai-dsh-client-ui-plugin-market/known-limitations-and-deferred-work/dev-note:
+  en: e67f633dc6fe7773
+  zh: 3bb0c20c93f16f98

package/README.md

@@ -1,3 +1,72 @@
-# Temporary Holding Version
+---
+description: "Discover tab of the Web Plugins page: search configured plugin market indexes, read an entry, and install it."
+kind: "package-reference"
+---
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @deepseek-ai/dsh-client-ui-plugin-market
+
+English | [中文](README.zh.md)
+
+## Summary
+
+Discover is the second tab of the **Plugins** page, after **Installed**. It lists the bundles that plugin market indexes offer; users manage index sources, switch between markets, search, filter by category and label, sort, open an entry's page, and install an entry after confirming it. The Host [`pluginMarket`](../../boot/plugin-market/README.md) service fetches and validates indexes; this package only presents them.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+Open **Plugins** and select **Discover**. With no index source, the tab shows an empty state whose **Add index source** button opens the **Index sources** dialog. The dialog lists each source by market title, or by host before the first read, with its URL, the error of its last failed read, and a remove button, and keeps a notice that indexes come from third parties. A refused URL keeps the draft and says why: an unsupported scheme, credentials, or fragment; a URL already listed; or a deployment that cannot save sources. A newly added source becomes the selected market.
+
+The toolbar holds the market menu, which switches markets and ends with **Manage index sources…**; the search field; a **Labels** menu with multi-select checkmarks when the market declares labels; the **Sort** menu; and a refresh button. Category pills, with **All** first, follow when the market declares categories.
+
+Each card shows the icon, localized title, label tags, a one-line description, and the default version, author, and publish date, with one action: **Install** for an installable entry; a disabled **Install** whose tooltip says no version is compatible with the running DSH when the plugin has no default version and its highest version is neither compatible nor exempted; or **Installed**, **Update available**, or **Provided by DSH**, which switches to the Installed tab and opens that bundle's page when that tab lists it. Selecting a card opens the entry's page with its full description, compatibility notice, and the default version's facts: author; homepage and source code repository, as links that open in a new tab, with the package directory beside the repository; the npm package and registry, or the Git repository, full commit, and directory; publish date; category; labels; and market. A **Versions** list follows in descending SemVer order; each row tags the recommended, prerelease, installed, incompatible, and exempted versions and offers **Install** for any other version installation accepts, except for a bundle DSH provides. The page's back link returns to the list with its search, filters, and sort intact.
+
+**Install** chooses the default version and opens a confirmation dialog with the entry's icon, title, that version, the author, its source facts, an exemption notice when one applies, and a trust notice. Confirming opens the Plugins install dialog at its check screen with the entry's exact spec and registry; there is no spec form, and a refusal offers **Retry**. The registry an entry names applies to that install only.
+
+The Host [`pluginMarket.search`](../../boot/plugin-market/README.md#use-this-package) matches, filters, orders, and pages; the tab sends the search text 250 ms after typing stops. Search matches names, authors, keywords, and every language of titles, descriptions, categories, and labels, fuzzily. Label filters must all match. **Sort** offers **Best match** while there is search text, **Default order**, **Publish date**, and each declared sort key, which starts in its declared direction; a directed sort adds a row that reverses it. Typing switches **Default order** to **Best match**, and clearing the text switches back. Categories, labels, and sort keys are listed by localized title. The list loads 50 entries and adds 50 with each **Show more**.
+
+Reading a market shows card skeletons. A failed read shows a short sentence with **Retry**, the Host's reason appears under the source in **Index sources**, and keeps the market's last listing; a failed read of the source list shows **Retry** in place of the tab. Discover re-reads sources on `plugin-market/changed` and connection reset, and recomputes installation status on `plugin-manager/changed`.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+The plugin registers the `discover` entry, labelled **Discover**, into `plugins.tab`, the tab slot that [`ui-plugin-manager`](../ui-plugin-manager/README.md) declares; the owner props provide `install({ spec, registry?, title, version })` and `openPackage(name)`; Discover passes the entry's localized title and the chosen version. A React-free controller owns source reads, source edits, and the selected index's query and loaded pages in a snapshot store; selecting another market starts from the initial query. Later pages send the first page's `fetchedAt`, and a page from a replaced document reloads the list once; a second replacement fails the read. The listing keeps the query its results answer, so the empty-state wording follows the shown results while a new query loads or after it fails, and **Retry** repeats the read that failed: the first pages of a query or the next page. A change to the profile's bundles reloads every loaded page to refresh installation status, and a filter or sort key the index no longer declares leaves the query. The unsent search text, the open entry, and the confirmation are component state. Pure helpers in `presentation.ts` derive the query order from the text, drop undeclared ids, order declarations with `Intl.Collator` in the active UI language, and list source facts. Icons load lazily with `referrerpolicy="no-referrer"` and fall back to the default artwork.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+None, as this package renders Host data in the browser and adds nothing to model requests.
+
+#### KV Cache effect
+
+None.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **No upgrade action** — an available update is shown as a status only.
+- **Remote icons** — URL icons are requested by the browser, which discloses the user's IP address to the image host. When the Web UI is served over HTTPS, the browser blocks or upgrades `http:` icons from an `http:` index, and a failed icon shows the default artwork.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+None.
+
+</details>

package/README.zh.md

@@ -0,0 +1,72 @@
+---
+description: "Web 插件页的「发现」标签页：搜索已配置的插件市场索引，查看条目并安装。"
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-client-ui-plugin-market
+
+[English](README.md) | 中文
+
+## 概述
+
+「发现」是**插件**页的第二个标签页，位于**已安装**之后。它列出插件市场索引提供的组合包（bundle）；用户可以管理索引源、在插件市场之间切换、搜索、按分类和标签筛选、排序、打开条目页面，并在确认后安装条目。Host 的 [`pluginMarket`](../../boot/plugin-market/README.zh.md) 服务负责获取和校验索引；本包只负责展示。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [理解实现](#understand-the-implementation)
+- [模型体验](#model-experience)
+- [已知限制与延期工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+打开**插件**并选择**发现**。没有索引源时，该标签页显示空状态，其中的**添加索引源**按钮打开**索引源**对话框。对话框按插件市场标题列出每个索引源（首次读取前按主机名），并显示其 URL、最近一次读取失败的错误和删除按钮，同时保留一条提示，说明索引由第三方提供。URL 被拒绝时保留草稿并说明原因：不支持的协议、包含凭据或片段、URL 已在列表中，或当前部署无法保存索引源。新添加的索引源成为所选插件市场。
+
+工具栏包含：插件市场菜单，用于切换插件市场，最后一项为**管理索引源…**；搜索框；插件市场声明了标签时显示的**标签**菜单，以勾选标记支持多选；**排序**菜单；以及刷新按钮。插件市场声明了分类时，其后显示分类按钮，**全部**排在第一位。
+
+每张卡片显示图标、本地化标题、标签、一行描述，以及默认版本、作者和发布日期，并只有一个操作：可安装的条目显示**安装**；没有默认版本、且最高版本既不兼容也未豁免的条目显示禁用的**安装**，其提示框说明没有与当前运行的 DSH 兼容的版本；其余条目显示**已安装**、**有新版本**或**随 DSH 提供**，点击后切换到「已安装」标签页，并在该标签页列出该组合包时打开其页面。选择卡片会打开条目页面，显示其完整描述、兼容性提示和默认版本的信息：作者；主页和源代码仓库（在新标签页中打开的链接，仓库旁显示包所在目录）；npm 包和注册表，或 Git 仓库、完整提交和目录；发布日期；分类；标签；以及插件市场。其后是按 SemVer 降序排列的**版本**列表；每行标出推荐、预发布、已安装、不兼容和已豁免的版本，并为安装检查接受的其他版本提供**安装**，DSH 随附的组合包除外。页面的返回链接回到列表，搜索、筛选和排序保持不变。
+
+**安装**选择默认版本并打开确认对话框，显示条目的图标、标题、该版本、作者、来源信息、适用时的豁免提示，以及信任提示。确认后，插件页的安装对话框以该条目的精确 spec 和注册表在检查界面打开；不显示 spec 表单，被拒绝时提供**重试**。条目指定的注册表只用于这一次安装。
+
+Host 的 [`pluginMarket.search`](../../boot/plugin-market/README.zh.md#use-this-package) 负责匹配、过滤、排序和分页；标签页在停止输入 250 毫秒后发送搜索文本。搜索模糊匹配名称、作者、关键词，以及标题、描述、分类和标签的所有语言。所选标签必须全部匹配。有搜索文本时，**排序**提供**最佳匹配**，此外还提供**默认顺序**、**发布时间**以及每个已声明的排序键，排序键以其声明的方向开始；有方向的排序会额外显示一行，用于反转方向。输入文本会把**默认顺序**切换为**最佳匹配**，清空文本时切换回来。分类、标签和排序键按本地化标题列出。列表加载 50 个条目，每次点击**显示更多**再增加 50 个。
+
+读取插件市场时显示卡片骨架屏。读取失败时显示一句简短说明和**重试**，Host 给出的原因显示在**索引源**中对应索引源的下方，并保留该插件市场上一次的列表；读取索引源列表失败时，在该标签页的位置显示**重试**。「发现」在收到 `plugin-market/changed` 和连接重置时重新读取索引源，在收到 `plugin-manager/changed` 时重新计算安装状态。
+
+-----
+
+<a id="understand-the-implementation"></a>
+## 理解实现
+
+本插件把标签为**发现**的 `discover` 条目注册到 `plugins.tab`，即 [`ui-plugin-manager`](../ui-plugin-manager/README.zh.md) 声明的标签页 slot；owner props 提供 `install({ spec, registry?, title, version })` 和 `openPackage(name)`；发现页传入条目的本地化标题和所选版本。一个不依赖 React 的控制器在快照存储中拥有索引源读取、索引源编辑，以及所选索引的查询和已加载的页；选择另一个插件市场时从初始查询开始。之后的页发送第一页的 `fetchedAt`，来自已替换文档的页会让列表重新加载一次；再次被替换时读取失败。列表保留其结果所回答的查询，因此新查询加载期间或失败后，空状态文案仍与显示的结果一致；**重试**重新执行失败的读取：某个查询的前几页，或下一页。profile 的组合包变化时，重新加载所有已加载的页以刷新安装状态；索引不再声明的过滤条件或排序键会从查询中移除。尚未发送的搜索文本、打开的条目和确认对话框是组件状态。`presentation.ts` 中的纯函数根据文本得出查询顺序、移除未声明的 id、使用当前界面语言的 `Intl.Collator` 对声明排序，以及列出来源信息。图标以 `referrerpolicy="no-referrer"` 延迟加载，失败时回退到默认插画。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+无，本包在浏览器中渲染 Host 数据，不向模型请求添加任何内容。
+
+#### KV Cache 影响
+
+无。
+
+## 已知限制与延期工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **没有升级操作**——可用更新只显示为状态。
+- **远程图标**——URL 图标由浏览器请求，会向图片主机暴露用户的 IP 地址。Web UI 通过 HTTPS 提供时，浏览器会拦截或升级来自 `http:` 索引的 `http:` 图标，加载失败的图标显示默认插画。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者的工作上下文——点击展开</summary>
+
+无。
+
+</details>