@michengai/dsh-skills-manager 1.1.19 → 1.1.22

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.1.22 - 2026-10-16
+
+- Official DSH Design & Token Alignment: Align completely with official DSH design tokens and bridge Ant Design styles to host semantic CSS variables; adopt the official radius scale (R4/R8/R12/R16/R20/R28) and ensure seamless light/dark and frosted glass theme adaptation (#41).
+- Accessible Switch & Primitive Alignment: Refactor skill and category toggle switches to match host Switch primitive dimensions and interactions; replace forced red disabled states with host neutral dark tokens and brand active colors for WCAG contrast and full WAI-ARIA support; unify events on native onClick and align focus-ring tokens (#42).
+- Dropdown Polish: Elevate Select trigger style specificity to eliminate hover/open background flashes; align active focus state with host focus rings and apply prominent elevation tokens to popup menus.
+
+## 1.1.21 - 2026-10-15
+
+- Support DSH `0.2.1-alpha.3` while retaining all existing supported versions.
+- Allow ordinary user-level Shared Agent skills to be managed, trashed and restored without installation records, preserving discovery, loading and path safety while keeping other agent sources read-only.
+- Add real ClawHub / skills.sh search and individual skill installation, with ten-item download-ranking pages and an explicit load-more button.
+- Fix concurrent repository operations overwriting catalog state, lost workspace installation badges, and interference between same-name copies; preserve source identity through trash and restore.
+- Allow installation beyond 500 source records without discarding active copies or recoverable trash identities; retain the state file's byte-size limit.
+- Keep failed recovery from blocking listings and unrelated operations, preserve pending state with actionable warnings, and mark legacy identities with unknown locations rather than guessing directories.
+- Improve oversized-response diagnostics, stream cleanup, and cancellation on navigation or unmount; remove unused skill-array expansion.
+- Support explicit indentation indicators in YAML block scalars.
+- Source tracking above 16 MiB can still be reduced by removing Trash records or legacy identities, without deleting active installation copies. Further growth is rejected.
+- Permanent deletion removes Trash files only after source tracking is saved. A catalog skill with a known installation location no longer also shows an unknown-location badge.
+
 ## 1.1.19 - 2026-10-14
 
 - Adjust settings navigation section order to ensure stable placement and avoid conflicts with other plugins.

package/CHANGELOG.zh-CN.md

@@ -2,6 +2,25 @@
 
 [English](CHANGELOG.md)
 
+## 1.1.22 - 2026-10-16
+
+- 官方设计规范与 Token 统一：全面对齐 DSH 官方设计规范，统一桥接 Ant Design 样式与宿主语义变量；接入官方圆角体系（R4/R8/R12/R16/R20/R28），支持深浅主题无缝切换与第三方毛玻璃主题（如 Catppuccin）原生适配（#41）。
+- 开关无障碍与原语对齐：技能与分类开关完全对齐 DSH 宿主 Switch 原语尺寸与交互结构；彻底移除强制红色关态，改为宿主中性深灰底色，开态使用品牌色，形成清晰的明度反差并完整支持 WAI-ARIA 属性；统一以原生真实点击事件触发，对齐宿主焦点环（#42）。
+- 下拉组件细节调优：优化 Select 触发器样式权重，消除悬停与展开时的白底闪烁问题；激活态对齐宿主焦点环，下拉浮层统一采用小浮层专用的软投影令牌。
+
+## 1.1.21 - 2026-10-15
+
+- 支持 DSH `0.2.1-alpha.3`，继续兼容既有已支持版本。
+- 用户级公共 Agent（Shared Agent）统一开放普通技能管理，无安装记录的技能也可回收和恢复；保留原有发现、加载与路径安全保护，其他 Agent 来源仍只读。
+- 发现页接入 ClawHub / skills.sh 的真实搜索与单技能安装，下载榜按每页 10 条加载，并提供可点击的继续加载按钮。
+- 修复并发仓库操作覆盖目录安装状态、项目安装徽章丢失及同名不同位置副本相互影响；移入回收站与恢复保留对应来源身份。
+- 修复累计 500 条来源记录后无法继续安装的问题，保留有效副本与回收身份，继续按文件实际容量限制状态大小。
+- 安装恢复失败不再阻断列表和无关操作，保留文件及待确认状态并提示原因；旧来源记录显示位置未知，不自动猜测安装目录。
+- 完善目录响应超限诊断、流关闭、页面切换和卸载取消；移除无用的技能数组展开。
+- 支持 YAML 块标量的显式缩进指示符。
+- 安装来源状态超过 16 MiB 后仍可清理回收记录和旧身份，清理不会删除仍有效的安装副本；继续新增会被拒绝。
+- 永久删除在来源状态写入成功后才删除回收站文件。已有安装位置的目录技能不再同时显示“位置未知”。
+
 ## 1.1.19 - 2026-10-14
 
 - 调整技能管理在设置中的导航排序序号，避免与其他插件同级竞争导致菜单位置跳动。

package/README.md

@@ -14,7 +14,7 @@
   [![npm package](https://img.shields.io/npm/v/%40michengai%2Fdsh-skills-manager.svg?label=npm%20package)](https://www.npmjs.com/package/@michengai/dsh-skills-manager)
   [![npm downloads](https://img.shields.io/npm/dt/%40michengai%2Fdsh-skills-manager.svg?label=npm%20downloads)](https://www.npmjs.com/package/@michengai/dsh-skills-manager)
   [![DSH Web Plugin](https://img.shields.io/badge/DSH%20Web-Plugin-0f766e.svg)](https://github.com/MichengAI/dsh-skills-manager)
-  [![DSH supported through 0.2.1-alpha.2](https://img.shields.io/badge/DSH-up%20to%200.2.1--alpha.2-2563eb.svg)](#installation)
+  [![DSH supported through 0.2.1-alpha.3](https://img.shields.io/badge/DSH-up%20to%200.2.1--alpha.3-2563eb.svg)](#installation)
 </div>
 
 > DSH Skills Manager is a community-maintained DeepSeek Harness (DSH) plugin, not an official DeepSeek AI product.
@@ -75,7 +75,7 @@ dsh plugin --profile web add @michengai/dsh-skills-manager@latest --registry=htt
 
 Restart DSH, refresh the page, and open **Settings → Skills**. To update, select **Check for updates** or run the installation command again.
 
-- Plugin `1.1.19` is tested with DeepSeek Harness `0.1.2-rc.1`, `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.5-rc.3`, `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.2`.
+- Plugin `1.1.22` is tested with DeepSeek Harness `0.1.2-rc.1`, `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.5-rc.3`, `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.2`, `0.2.1-alpha.3`.
 
 ## Usage
 
@@ -93,7 +93,7 @@ Restart DSH, refresh the page, and open **Settings → Skills**. To update, sele
 
 - **Registered workspaces**: select a registered workspace from the project tab dropdown. Only that workspace is scanned, displayed and searched. Git repositories use the nearest Git root; other folders use the workspace directory, so no `git init` is required. Empty workspaces remain selectable; unavailable directories are disabled.
 - **Independent copies**: disabling a project copy allows another enabled copy to take over, and the panel identifies the active source. Disable all copies to turn the skill off completely.
-- **File management**: DSH skills can move to Trash from the general manager. Repository-installed copies in DSH, Shared Agent, or a registered workspace can also be uninstalled from **Repositories**. Codex, Claude and other external skills remain read-only. Creation, file import and repository install can write to DSH skills or Shared Agent in your user directory, or to a registered workspace's `.dsh/skills`. Creation, import and installation never preselect a workspace, and Shared Agent is not available for workspaces. The project tab viewing selection is not a write destination.
+- **File management**: User-level DSH and Shared Agent skills can move to Trash and be restored from the general manager without installation records. Project Shared Agent remains read-only. Shared Agent keeps recursive discovery and link reading; linked entries and unsafe paths are not writable. Repository-installed copies in DSH, Shared Agent, or a registered workspace can also be uninstalled from **Repositories**. Codex, Claude and other external skills remain read-only. Creation, file import and repository install can write to DSH skills or Shared Agent in your user directory, or to a registered workspace's `.dsh/skills`. Creation, import and installation never preselect a workspace, and Shared Agent is not available for workspaces. The project tab viewing selection is not a write destination.
 - **Restore**: retired repository provenance belongs to the specific Trash entry and is reactivated only by an explicit restore, including the destination and update/rollback history. A different same-name skill does not inherit repository management. Uninstalling a Shared Agent copy affects every agent using that directory.
 
 ### Repository boundaries

package/README.zh-CN.md

@@ -75,7 +75,7 @@ dsh plugin --profile web add @michengai/dsh-skills-manager@latest --registry=htt
 
 安装后重启 DSH 并刷新页面，打开「设置 → 技能」即可使用。更新时可点击「检查更新」，或重新执行安装命令。
 
-- `1.1.19` 已验证兼容 DeepSeek Harness `0.1.2-rc.1`、`0.1.5-rc.1`、`0.1.5-rc.2`、`0.1.5-rc.3`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-alpha.2`。
+- `1.1.22` 已验证兼容 DeepSeek Harness `0.1.2-rc.1`、`0.1.5-rc.1`、`0.1.5-rc.2`、`0.1.5-rc.3`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-alpha.2`、`0.2.1-alpha.3`。
 
 ## 使用说明
 
@@ -93,7 +93,7 @@ dsh plugin --profile web add @michengai/dsh-skills-manager@latest --registry=htt
 
 - **按已登记工作区查看**：项目页顶部下拉列出 DSH 里已登记的工作区，选中后只读取并显示这一项的技能，搜索也只针对所选工作区。Git 仓库使用最近的 Git 根目录；普通文件夹使用工作区目录，无需 `git init`。没有技能的工作区也可选择，失效目录不可选。
 - **同名技能独立启停**：停用项目副本后，其他已启用副本仍可接管，页面会提示实际来源。要完全关闭该技能，需停用全部副本。
-- **文件管理范围**：DSH 来源的技能可从管理页移入回收站；从仓库安装到 DSH、公共 Agent 或已登记工作区的副本也可从「技能仓库」卸载。Codex、Claude 等其他外部技能仍只读。创建、文件导入和仓库安装可以写入用户目录下的 DSH skills 或公共 Agent（Shared Agent），也可以写入某个已登记工作区的 `.dsh/skills`。创建、导入和安装时，工作区不会被预先选中，也不能选 Shared Agent；项目页的只读查看选择不作为写入目标。
+- **文件管理范围**：用户级 DSH 和公共 Agent（Shared Agent）来源的普通技能均可从管理页移入回收站并恢复，不要求安装来源记录；项目 Shared Agent 仍只读。公共 Agent 保留递归发现和链接读取，链接条目及不安全路径不允许文件写入；从仓库安装到 DSH、公共 Agent 或已登记工作区的副本也可从「技能仓库」卸载。Codex、Claude 等其他外部技能仍只读。创建、文件导入和仓库安装可以写入用户目录下的 DSH skills 或公共 Agent（Shared Agent），也可以写入某个已登记工作区的 `.dsh/skills`。创建、导入和安装时，工作区不会被预先选中，也不能选 Shared Agent；项目页的只读查看选择不作为写入目标。
 - **恢复**：已卸载副本的仓库来源绑定到具体回收站条目；仅显式恢复后重新启用来源、安装位置和更新/恢复历史。其他同名技能不会继承仓库管理权限。卸载公共 Agent 副本会影响使用该目录的所有 Agent。
 
 ### 仓库使用边界

package/lib/catalog-skill.js

@@ -0,0 +1,142 @@
+import { parseSkillDoc } from "./core.js";
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const SAFE_PATH = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9._/-]+$/;
+const MAX_TEXT_BYTES = 1 << 20;
+const MAX_ARCHIVE_BYTES = 8 << 20;
+const MAX_FILES = 100;
+function catalogError(message, statusCode, code) {
+  return Object.assign(new Error(message), { statusCode, code });
+}
+function identifier(value) {
+  return typeof value === "string" && IDENTIFIER.test(value) ? value : void 0;
+}
+function skillshParts(input) {
+  const source = typeof input.source === "string" ? input.source : "";
+  const [owner, repo, extra] = source.split("/");
+  const skillId = identifier(input.skillId);
+  if (!identifier(owner) || !identifier(repo) || extra !== void 0 || !skillId) return void 0;
+  return { owner, repo, skillId, source };
+}
+function catalogUrls(input) {
+  if (!input || input.catalog === "clawhub") {
+    const owner = identifier(input?.owner);
+    const slug = identifier(input?.slug);
+    if (input?.catalog !== "clawhub" || !owner || !slug) throw catalogError("\u76EE\u5F55\u6280\u80FD\u6807\u8BC6\u65E0\u6548", 400, "error.catalog.identity");
+    const detail = new URL(`https://clawhub.ai/api/v1/skills/${encodeURIComponent(slug)}/file`);
+    detail.searchParams.set("path", "SKILL.md");
+    detail.searchParams.set("owner", owner);
+    const download = new URL("https://clawhub.ai/api/v1/download");
+    download.searchParams.set("slug", slug);
+    download.searchParams.set("owner", owner);
+    return { detail: detail.toString(), download: download.toString(), origin: `${owner}/${slug}` };
+  }
+  if (input.catalog === "skillsh") {
+    const parts = skillshParts(input);
+    if (!parts) throw catalogError("\u76EE\u5F55\u6280\u80FD\u6807\u8BC6\u65E0\u6548", 400, "error.catalog.identity");
+    const download = `https://skills.sh/api/download/${encodeURIComponent(parts.owner)}/${encodeURIComponent(parts.repo)}/${encodeURIComponent(parts.skillId)}`;
+    return { detail: download, download, origin: `${parts.source}/${parts.skillId}` };
+  }
+  throw catalogError("\u76EE\u5F55\u6280\u80FD\u6807\u8BC6\u65E0\u6548", 400, "error.catalog.identity");
+}
+async function readBounded(response, limit) {
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > limit) {
+    await response.body?.cancel().catch(() => void 0);
+    throw catalogError("\u76EE\u5F55\u6280\u80FD\u5185\u5BB9\u8FC7\u5927", 502, "error.catalog.response");
+  }
+  const reader = response.body?.getReader();
+  if (!reader) return new Uint8Array();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > limit) {
+        throw catalogError("\u76EE\u5F55\u6280\u80FD\u5185\u5BB9\u8FC7\u5927", 502, "error.catalog.response");
+      }
+      chunks.push(value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => void 0);
+    if (error instanceof Error && "code" in error && error.code === "error.catalog.response" && "statusCode" in error && error.statusCode === 502) throw error;
+    throw catalogError("\u76EE\u5F55\u6280\u80FD\u54CD\u5E94\u65E0\u6548\u6216\u8BFB\u53D6\u4E2D\u65AD", 502, "error.catalog.response");
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, size);
+}
+function parseFilesJson(bytes) {
+  let payload;
+  try {
+    payload = JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    throw catalogError("\u76EE\u5F55\u6280\u80FD\u8FD4\u56DE\u4E86\u65E0\u6548 JSON", 502, "error.catalog.response");
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw catalogError("\u76EE\u5F55\u6280\u80FD\u6587\u4EF6\u65E0\u6548", 502, "error.catalog.response");
+  const files = payload.files;
+  if (!Array.isArray(files) || !files.length || files.length > MAX_FILES) throw catalogError("\u76EE\u5F55\u6280\u80FD\u6587\u4EF6\u65E0\u6548\u6216\u8FC7\u591A", 502, "error.catalog.response");
+  for (const file of files) {
+    if (!file || typeof file !== "object" || Array.isArray(file) || typeof file.path !== "string" || typeof file.contents !== "string") throw catalogError("\u76EE\u5F55\u6280\u80FD\u6587\u4EF6\u65E0\u6548", 502, "error.catalog.response");
+  }
+  return { files };
+}
+function skillDocSummary(markdown) {
+  const parsed = parseSkillDoc(markdown);
+  const name = parsed.map.name?.trim();
+  const description = parsed.map.description?.trim();
+  return { name, description, body: parsed.body };
+}
+async function fetchFixed(url, fetchImpl, accept) {
+  let response;
+  try {
+    response = await fetchImpl(url, { headers: { accept }, redirect: "error", signal: AbortSignal.timeout(15e3) });
+  } catch {
+    throw catalogError("\u76EE\u5F55\u6280\u80FD\u6682\u65F6\u65E0\u6CD5\u8BFB\u53D6", 502, "error.catalog.upstream");
+  }
+  if (!response.ok) throw catalogError("\u76EE\u5F55\u6280\u80FD\u6682\u65F6\u65E0\u6CD5\u8BFB\u53D6", 502, "error.catalog.upstream");
+  return response;
+}
+async function readCatalogSkill(input, fetchImpl = fetch) {
+  const urls = catalogUrls(input);
+  if (input.catalog === "clawhub") {
+    const response2 = await fetchFixed(urls.detail, fetchImpl, "text/markdown, text/plain");
+    const markdown = new TextDecoder().decode(await readBounded(response2, MAX_TEXT_BYTES));
+    const parsed2 = skillDocSummary(markdown);
+    if (!parsed2.name || !parsed2.description) throw catalogError("\u76EE\u5F55\u6280\u80FD\u8BF4\u660E\u65E0\u6548", 502, "error.catalog.response");
+    return { name: parsed2.name, description: parsed2.description, body: parsed2.body, origin: urls.origin };
+  }
+  const response = await fetchFixed(urls.download, fetchImpl, "application/json");
+  const payload = parseFilesJson(await readBounded(response, MAX_TEXT_BYTES));
+  const document = payload.files?.find((file) => file.path === "SKILL.md" && typeof file.contents === "string");
+  if (!document || typeof document.contents !== "string") throw catalogError("\u76EE\u5F55\u6280\u80FD\u8BF4\u660E\u65E0\u6548", 502, "error.catalog.response");
+  const parsed = skillDocSummary(document.contents);
+  if (!parsed.name || !parsed.description) throw catalogError("\u76EE\u5F55\u6280\u80FD\u8BF4\u660E\u65E0\u6548", 502, "error.catalog.response");
+  return { name: parsed.name, description: parsed.description, body: parsed.body, origin: urls.origin };
+}
+async function loadCatalogPackage(input, fetchImpl = fetch) {
+  const urls = catalogUrls(input);
+  if (input.catalog === "clawhub") {
+    const response2 = await fetchFixed(urls.download, fetchImpl, "application/zip");
+    const bytes = await readBounded(response2, MAX_ARCHIVE_BYTES);
+    const detail2 = await readCatalogSkill(input, fetchImpl);
+    return { name: detail2.name, zip: Buffer.from(bytes).toString("base64") };
+  }
+  const response = await fetchFixed(urls.download, fetchImpl, "application/json");
+  const payload = parseFilesJson(await readBounded(response, MAX_ARCHIVE_BYTES));
+  if (!Array.isArray(payload.files) || !payload.files.length || payload.files.length > MAX_FILES) throw catalogError("\u76EE\u5F55\u6280\u80FD\u6587\u4EF6\u65E0\u6548\u6216\u8FC7\u591A", 502, "error.catalog.response");
+  const entries = payload.files.map((file) => {
+    if (typeof file.path !== "string" || !SAFE_PATH.test(file.path) || typeof file.contents !== "string") throw catalogError("\u76EE\u5F55\u6280\u80FD\u5305\u542B\u975E\u6CD5\u6587\u4EF6\u8DEF\u5F84", 502, "error.catalog.response");
+    return { path: file.path, data: Buffer.from(file.contents, "utf8").toString("base64") };
+  });
+  if (!entries.some((entry) => entry.path === "SKILL.md")) throw catalogError("\u76EE\u5F55\u6280\u80FD\u7F3A\u5C11 SKILL.md", 502, "error.catalog.response");
+  const detail = skillDocSummary(Buffer.from(entries.find((entry) => entry.path === "SKILL.md").data, "base64").toString("utf8"));
+  if (!detail.name) throw catalogError("\u76EE\u5F55\u6280\u80FD\u8BF4\u660E\u65E0\u6548", 502, "error.catalog.response");
+  return { name: detail.name, entries };
+}
+export {
+  catalogUrls,
+  loadCatalogPackage,
+  readCatalogSkill
+};

package/lib/clawhub-catalog.js

@@ -0,0 +1,134 @@
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function count(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function skillItem(value) {
+  const candidate = record(value);
+  if (!candidate) return void 0;
+  const owner = candidate.ownerHandle ?? record(candidate.owner)?.handle;
+  const slug = candidate.slug;
+  const identifier = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+  if (typeof owner !== "string" || !identifier.test(owner) || typeof slug !== "string" || !identifier.test(slug)) return void 0;
+  const item = {
+    ownerHandle: owner,
+    slug,
+    displayName: typeof candidate.displayName === "string" && candidate.displayName && candidate.displayName.length <= 256 ? candidate.displayName : slug,
+    summary: typeof candidate.summary === "string" && candidate.summary.length <= 8192 ? candidate.summary : ""
+  };
+  const stats = record(candidate.stats) ?? record(record(record(candidate.native)?.skill)?.stats);
+  if (stats) {
+    item.stats = {};
+    for (const key of ["downloads", "installs", "stars"]) {
+      const number = count(stats[key]);
+      if (number !== void 0) item.stats[key] = number;
+    }
+  }
+  return item;
+}
+async function searchClawHub(query, options = {}, fetchImpl = fetch) {
+  const normalized = typeof query === "string" ? query.trim() : "";
+  if (!normalized || normalized.length > 100 || !record(options)) throw catalogError("\u76EE\u5F55\u641C\u7D22\u53C2\u6570\u65E0\u6548", 400, "error.catalog.query");
+  const limit = requestLimit(options.limit, 100);
+  const url = new URL("https://clawhub.ai/api/v1/search");
+  url.searchParams.set("q", normalized);
+  url.searchParams.set("limit", String(limit));
+  const payload = await fetchJson(url, fetchImpl);
+  if (!Array.isArray(payload.results)) throw catalogError("\u76EE\u5F55\u641C\u7D22\u54CD\u5E94\u65E0\u6548", 502, "error.catalog.response");
+  const results = [];
+  for (const value of payload.results) {
+    const candidate = record(value);
+    if (!candidate || candidate.source !== void 0 && candidate.source !== "clawhub") continue;
+    const item = skillItem(candidate);
+    if (!item) continue;
+    const result = { ...item, source: "clawhub" };
+    if (typeof candidate.id === "string" && candidate.id && candidate.id.length <= 768) result.id = candidate.id;
+    const downloads = count(candidate.downloads);
+    if (downloads !== void 0) result.downloads = downloads;
+    results.push(result);
+    if (results.length >= limit) break;
+  }
+  return { results };
+}
+function catalogError(message, statusCode, code) {
+  return Object.assign(new Error(message), { statusCode, code });
+}
+async function fetchJson(url, fetchImpl) {
+  let response;
+  try {
+    response = await fetchImpl(url, { headers: { accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(1e4) });
+  } catch {
+    throw catalogError("ClawHub \u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528", 502, "error.catalog.upstream");
+  }
+  if (!response.ok) throw catalogError("ClawHub \u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528", 502, "error.catalog.upstream");
+  const maxBytes = 1 << 20;
+  if (Number(response.headers.get("content-length")) > maxBytes) {
+    await response.body?.cancel().catch(() => void 0);
+    throw catalogError("ClawHub \u54CD\u5E94\u8FC7\u5927", 502, "error.catalog.response");
+  }
+  const reader = response.body?.getReader();
+  const chunks = [];
+  let size = 0;
+  if (reader) {
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > maxBytes) {
+          throw catalogError("ClawHub \u54CD\u5E94\u8FC7\u5927", 502, "error.catalog.response");
+        }
+        chunks.push(value);
+      }
+    } catch (error) {
+      await reader.cancel().catch(() => void 0);
+      if (error instanceof Error && "code" in error && error.code === "error.catalog.response" && "statusCode" in error && error.statusCode === 502) throw error;
+      throw catalogError("ClawHub \u54CD\u5E94\u65E0\u6548\u6216\u8FC7\u5927", 502, "error.catalog.response");
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.concat(chunks, size).toString("utf8"));
+  } catch {
+    throw catalogError("ClawHub \u54CD\u5E94\u4E0D\u662F\u6709\u6548 JSON", 502, "error.catalog.response");
+  }
+  const object = record(payload);
+  if (!object) throw catalogError("ClawHub \u54CD\u5E94\u7ED3\u6784\u65E0\u6548", 502, "error.catalog.response");
+  return object;
+}
+function requestLimit(value, max) {
+  if (value === void 0) return max;
+  const number = typeof value === "string" && /^[0-9]{1,3}$/.test(value) ? Number(value) : value;
+  if (typeof number !== "number" || !Number.isInteger(number) || number < 1 || number > max) throw catalogError("\u76EE\u5F55\u67E5\u8BE2 limit \u65E0\u6548", 400, "error.catalog.query");
+  return number;
+}
+async function listClawHub(options = {}, fetchImpl = fetch) {
+  if (!options || typeof options !== "object" || Array.isArray(options)) throw catalogError("\u76EE\u5F55\u67E5\u8BE2\u53C2\u6570\u65E0\u6548", 400, "error.catalog.query");
+  const limit = requestLimit(options.limit, 10);
+  const sort = options.sort === void 0 ? "downloads" : options.sort;
+  if (sort !== "downloads") throw catalogError("\u76EE\u5F55\u699C\u5355\u6392\u5E8F\u65E0\u6548", 400, "error.catalog.query");
+  if (options.cursor !== void 0 && (typeof options.cursor !== "string" || !options.cursor || options.cursor.length > 4096)) throw catalogError("\u76EE\u5F55\u5206\u9875\u6807\u8BC6\u65E0\u6548", 400, "error.catalog.query");
+  const url = new URL("https://clawhub.ai/api/v1/skills");
+  url.searchParams.set("sort", sort);
+  url.searchParams.set("limit", String(limit));
+  if (options.cursor !== void 0) url.searchParams.set("cursor", options.cursor);
+  const payload = await fetchJson(url, fetchImpl);
+  if (!Array.isArray(payload.items)) throw catalogError("\u76EE\u5F55\u699C\u5355\u54CD\u5E94\u65E0\u6548", 502, "error.catalog.response");
+  const nextCursor = payload.nextCursor;
+  if (nextCursor !== void 0 && nextCursor !== null && (typeof nextCursor !== "string" || nextCursor.length > 4096)) throw catalogError("\u76EE\u5F55\u5206\u9875\u54CD\u5E94\u65E0\u6548", 502, "error.catalog.response");
+  const items = [];
+  for (const value of payload.items) {
+    const item = skillItem(value);
+    if (!item) continue;
+    items.push(item);
+    if (items.length >= limit) break;
+  }
+  return { items, nextCursor: typeof nextCursor === "string" && nextCursor ? nextCursor : null };
+}
+export {
+  listClawHub,
+  searchClawHub
+};