@nanmicoder/dsh-skills-hub 0.0.2 → 0.0.3

package/CONTRIBUTING.md

@@ -15,7 +15,7 @@ Commit regenerated `lib/` with source changes because Git installations consume
 For CLI users and local development, install a specific published version:
 
 ```sh
-dsh plugin --profile desktop add @nanmicoder/dsh-skills-hub@0.0.2
+dsh plugin --profile desktop add @nanmicoder/dsh-skills-hub@0.0.3
 ```
 
 Replace `desktop` with the target profile. To test a local source build:
@@ -23,7 +23,11 @@ Replace `desktop` with the target profile. To test a local source build:
 ```sh
 pnpm install --frozen-lockfile
 pnpm pack --pack-destination artifacts
-dsh plugin --profile desktop add ./artifacts/nanmicoder-dsh-skills-hub-0.0.2.tgz
+dsh plugin --profile desktop add ./artifacts/nanmicoder-dsh-skills-hub-0.0.3.tgz
 ```
 
 Fully quit and reopen the target Harness instance after a CLI install. Advanced configuration is documented in [CONFIGURATION.md](./docs/CONFIGURATION.md).
+
+## Curated catalogue
+
+The marketplace home list comes from `catalog/curation.json` (editorial: which skills, category, Chinese summary, picks) and its generated snapshot `src/catalog/skills.json`. To add or remove a skill, edit the curation, run `node scripts/catalog-refresh.mjs`, review the entries it reports as dropped, then `pnpm build`. Selection and security rules are in `docs/CATALOG.md`.

package/README.md

@@ -19,16 +19,17 @@
 
 搜索 ClawHub 和 SkillHub 中的技能，阅读使用说明，再安装到 Harness。市场安装的技能和本机已有技能，都可以在「已安装技能」中查看和管理。
 
-当前版本：**0.0.2**。浏览过的列表、详情和文件预览默认缓存 60 分钟，退出桌面端后再次打开仍可复用。[更新说明](./release-notes/v0.0.2.md)
+当前版本：**0.0.3**。首页改为 398 个精选技能、13 个分类，详情页重新设计，并能说明技能安装后会做什么。[更新说明](./release-notes/v0.0.3.md)
 
 <p align="center">
-  <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub 技能市场：搜索、筛选和技能卡片。">
+  <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub 技能市场：分类、搜索、筛选和精选技能卡片。">
 </p>
 
 | 功能 | 说明 |
 | --- | --- |
-| **发现技能** | 聚合 ClawHub 与 SkillHub，支持搜索、筛选和滚动加载。 |
-| **安装前预览** | 阅读技能说明，查看文件内容和来源提供的安全报告。 |
+| **精选清单** | 398 个 ClawHub 与 SkillHub 热门技能，按 13 个分类整理，随插件发布，打开即看。 |
+| **实时搜索** | 输入关键词即搜索两个市场的全部技能，同名技能按作者区分。 |
+| **安装前预览** | 阅读说明和文件，查看上游安全扫描，以及技能会执行的命令、读取的密钥和访问的网络。 |
 | **管理已安装技能** | 搜索本机技能，查看来源与安装位置，确认后卸载。 |
 | **本地缓存** | 缓存已浏览的分页、详情和文件预览，重启后继续使用。 |
 
@@ -47,18 +48,18 @@ https://github.com/NanmiCoder/dsh-skills-hub
 **或 npm 包名**
 
 ```text
-@nanmicoder/dsh-skills-hub@0.0.2
+@nanmicoder/dsh-skills-hub@0.0.3
 ```
 
 点击 **安装 → 立即启用**，然后从侧栏进入 **技能市场**。
 
 ## 使用
 
-1. **查找**：输入关键词，或按来源和安全状态筛选。
+1. **查找**：按分类浏览精选清单，或输入关键词搜索全部技能。
 2. **预览**：打开技能，查看说明和文件内容。
 3. **安装与管理**：确认安装后，到「已安装技能」中查看或卸载。
 
-技能由第三方作者提供，安装前请确认来源并阅读说明；安全报告供参考。
+技能由第三方社区作者发布；Skills Hub 是社区插件，并非 DeepSeek 官方出品。精选清单只做整理推荐，不构成安全担保，安装前请查看安全报告与 SKILL.md。
 
 ## 已安装技能
 

package/README_EN.md

@@ -19,16 +19,17 @@
 
 Search ClawHub and SkillHub, read a skill’s instructions, and install it into Harness. Manage marketplace installations and existing local skills together in **Installed**.
 
-Current version: **0.0.2**. Browsed lists, details and file previews are cached locally for 60 minutes by default and remain available after restarting the desktop app. [Release notes](./release-notes/v0.0.2.md)
+Current version: **0.0.3**. The home page now opens on 398 curated skills in 13 categories, with a redesigned detail page that explains what a skill will do once installed. [Release notes](./release-notes/v0.0.3.md)
 
 <p align="center">
-  <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub marketplace with search, filters and skill cards.">
+  <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub marketplace with categories, search, filters and curated skill cards.">
 </p>
 
 | Feature | What it does |
 | --- | --- |
-| **Discover skills** | Search and filter ClawHub and SkillHub together, with more results as you scroll. |
-| **Preview before installing** | Read instructions, inspect files and check security reports from the source. |
+| **Curated catalogue** | 398 popular ClawHub and SkillHub skills in 13 categories, shipped with the plugin and shown instantly. |
+| **Live search** | Type a keyword to search every skill on both marketplaces; same-name skills are told apart by author. |
+| **Preview before installing** | Read instructions and files, check upstream scans, and see the commands, secrets and network hosts a skill uses. |
 | **Manage installed skills** | Search local skills, inspect their source and installation path, and confirm removal. |
 | **Local cache** | Reuse browsed pages, details and file previews across desktop restarts. |
 
@@ -47,18 +48,18 @@ https://github.com/NanmiCoder/dsh-skills-hub
 **Or the npm package name**
 
 ```text
-@nanmicoder/dsh-skills-hub@0.0.2
+@nanmicoder/dsh-skills-hub@0.0.3
 ```
 
 Click **Install → Enable now**, then open **Skills Hub** from the sidebar.
 
 ## Use
 
-1. **Find**: enter a keyword or filter by source and security status.
+1. **Find**: browse the curated catalogue by category, or enter a keyword to search every skill.
 2. **Preview**: open a skill to read its instructions and inspect its files.
 3. **Install and manage**: confirm installation, then find or remove it in **Installed**.
 
-Skills come from third-party authors. Check the source and instructions before installing; security reports are provided for reference.
+Skills are published by third-party community authors. Skills Hub is a community plugin, not a DeepSeek product. The curated list is a recommendation, not a security guarantee; check the security report and SKILL.md before installing.
 
 ## Installed skills
 

package/README_ZH.md

@@ -2,6 +2,6 @@
 
 中文文档已成为仓库默认首页，请查看 [README.md](./README.md)。
 
-当前版本：**0.0.2**。[更新说明](./release-notes/v0.0.2.md)
+当前版本：**0.0.3**。[更新说明](./release-notes/v0.0.3.md)
 
 [English documentation](./README_EN.md)

package/compatibility.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "pluginVersion": "0.0.2",
+  "pluginVersion": "0.0.3",
   "recommendedHost": "0.2.0-rc.2",
   "hostTag": "dsh-v0.2.0-rc.2",
   "hostCommit": "639ed015397290b3745d163aafe02ffee4aa3f84",

package/docs/CATALOG.md

@@ -0,0 +1,39 @@
+# Curated catalogue
+
+The marketplace home list is a curated catalogue of a few hundred skills, not the upstream registries' full feeds. ClawHub holds ~81k skills and SkillHub ~110k native ones; a reader cannot choose from that, and the long tail is dominated by near-duplicates, copies and abandoned experiments.
+
+## Files
+
+| File | Role |
+| --- | --- |
+| `catalog/curation.json` | Editorial source: categories, and for each skill its `source`, `slug`, `owner`, `category`, `featured`, Chinese `summary`, `tags`, and `allowSuspicious` when applicable. Edited by hand. |
+| `src/catalog/skills.json` | Snapshot generated from the curation plus upstream metadata (name, stats, version, icon, license, security verdict). Shipped in `lib/` and served as the home list. |
+| `scripts/catalog-refresh.mjs` | Regenerates the snapshot. `--check` reports without writing. |
+
+Run `node scripts/catalog-refresh.mjs`, review the dropped entries it prints, then rebuild (`pnpm build`) so `lib/catalog/skills.json` follows.
+
+## What is served from where
+
+- **List, categories, catalogue search:** the snapshot. No upstream request; the source bar shows the snapshot's `generatedAt` as the fetch time.
+- **Detail, files, install:** the owning registry, through the regular cache. Catalogue entries pin the ClawHub owner, because ClawHub slugs are not unique and the registry's first match for a popular slug is often a later copy by another author.
+- **"Search all markets":** an explicit live search across both registries (`scope=market`). Results are labelled as not curated.
+
+SkillHub's mirrors of ClawHub skills are not used for ClawHub entries: the mirror pipeline stopped on 2026-07-23, roughly one in ten mirrored skills lags its ClawHub version, and mirror files differ from the original (`skill-card.md` dropped, `_meta.json` added).
+
+## Selection policy
+
+Candidates were the top 1,500 ClawHub skills by downloads and the top 600 SkillHub native skills, reviewed per category for usefulness, popularity and distinctness (one or two per job, not five wrappers of the same API). Excluded:
+
+- skills only meaningful inside OpenClaw/Clawdbot (gateway hooks, OpenClaw configuration, Clawdbot channels);
+- paid versions, crypto trading or anything moving money automatically, fake engagement or mass account automation, adult content;
+- SkillHub slugs that resolve to a different owner than the curated one (SkillHub's detail route is slug-only);
+- ambiguous ClawHub slugs whose remaining owners are low-download copies (`summarize`, `find-skills`, `agent-browser`, `tavily-search`).
+
+## Security policy
+
+- ClawHub: the moderation verdict and the latest version's scan (VirusTotal, skillspector, LLM review). SkillHub: the vendor security reports.
+- `malicious` or blocked: never listed.
+- `suspicious`: listed only when the curation entry carries `allowSuspicious` with the reason, and shipped as `flagged` with that reason in `securityNote`. This is reserved for widely recommended skills whose finding is about disclosure or permission scope, not hidden behaviour. Skills that upload local content, update their own code from a remote source, or expose credentials are not exempted.
+- A refresh re-checks every entry; a newly suspicious skill without `allowSuspicious` drops out of the snapshot.
+
+A clean verdict is upstream's, not ours. Installing still shows the source and verdict, and installation never executes skill scripts.

package/docs/COMPATIBILITY.md

@@ -63,3 +63,15 @@ Automated regression uses the compiled plugin in separate Node HTTP host process
 Adversarial review also covered the actual HTTP install entry point (a withdrawn manifest is rejected despite a fresh disk snapshot), first-response installation annotations without an `/installed` warmup, browser revalidation and per-page provenance, configuration changes during asynchronous cache reads and multi-step installation, snapshot integrity, oversized replacement invalidation, and abandoned temporary writes. Regression tests cover each behavior.
 
 The automated evidence above is process-restart coverage rather than a full native acceptance run. Separately, the user authorized installation into the active desktop: a locally packed build was installed using the desktop's bundled package manager while it was stopped, then DeepSeek Harness **0.2.0-rc.2** was relaunched. The actual market loaded 24 entries from each source and wrote two list snapshots with a 60-minute lifetime. This smoke check does not claim a native restart-after-warm acceptance of every cached path. The supported Harness cohort remains unchanged.
+
+### Curated catalogue, owner pinning and detail redesign
+
+The home list now comes from the shipped curated catalogue, ClawHub reads are pinned to the card's author, and the market detail page follows the redesign (header with stats, overview/files/security/changelog tabs, rule-based "what this skill does" and "when it triggers", redesigned install confirmation). Verified with **ego-browser** against the published `@deepseek-ai/dsh@0.2.0-rc.2` runtime (all 278 Harness packages on the same cohort) in a disposable Web profile with temporary `DSH_HOME`/`DSH_AGENTS_HOME`, macOS arm64 / Node 26.7.0, from a tarball of this revision; the user's real profile and desktop app were not touched.
+
+Recorded results: the home list rendered the 13 catalogue categories with counts and editor's picks dealt across categories, with no upstream list request. A flagged ClawHub skill (`self-improving-agent`) showed the suspicious scan chip, per-scanner reports including the LLM review text, the bundled `CHANGELOG.md` entry point, and an install dialog whose confirm button stayed disabled until the acknowledgement was checked. A SkillHub skill (`libai`) showed a passed scan, its catalogue category and sub-category tags. At a 720px panel the side rail moved below the document with no horizontal overflow; dark mode followed the host tokens. Installing `clawhub:weather` through the dialog wrote `"owner": "steipete"` to the sidecar and switched the page to installed; uninstalling removed the directory. `pnpm pack:check` passed 96 tests. Screenshots are kept locally in `artifacts/catalog-redesign-verify/`.
+
+The catalogue home and the installed inventory were then brought onto the same visual system (white top band over a grey canvas of 14px-radius cards, shared chips, mono counts, black primary actions), and both detail pages now share one `SkillDetailShell`. Re-verified the same way: the home shows the catalogue total and list date instead of live source health, which appears only for an explicit all-markets search (28 live results for `pdf`, with per-source status); installing from a card switched it to installed; the installed list and its detail rendered in the shared layout; a 720px panel had no horizontal overflow and dark mode followed the host tokens. `pnpm pack:check` passed 96 tests.
+
+## 0.0.3 release preparation — 2026-10-02
+
+The 0.0.3 release commit changes only version metadata, documentation and the README screenshot on top of the revisions recorded above. The README marketplace screenshot was retaken with ego-browser from the packed 0.0.3 tarball in an isolated Web profile (same `@deepseek-ai/dsh@0.2.0-rc.2` cohort, temporary `DSH_HOME`/`DSH_AGENTS_HOME`). It shows the curated home and the community-plugin disclaimer. `pnpm pack:check` was rerun on the release commit. No package was published and no tag was pushed.

package/docs/CONTRACT.md

@@ -1,10 +1,10 @@
-# Skills Hub 0.0.2 implementation contract
+# Skills Hub 0.0.3 implementation contract
 
 This document describes the shipped code, not a migration plan. The TypeScript models in `src/market/types.ts`, `src/skills/installed.ts` and `src/client/api.ts` define the detailed wire shapes. Update this document with API changes.
 
 ## 1. Package and host
 
-The package is `@nanmicoder/dsh-skills-hub`, version `0.0.2`. Its supported host package cohort is exactly `0.2.0-rc.2`; the desktop release line is 0.2.0. The exact upstream tag and commit are recorded in `compatibility.json` and [COMPATIBILITY.md](COMPATIBILITY.md).
+The package is `@nanmicoder/dsh-skills-hub`, version `0.0.3`. Its supported host package cohort is exactly `0.2.0-rc.2`; the desktop release line is 0.2.0. The exact upstream tag and commit are recorded in `compatibility.json` and [COMPATIBILITY.md](COMPATIBILITY.md).
 
 `cordis.patch.yml` inserts one row (`id: skills-hub`) named after the scoped package. `lib/index.js` is the host entry. `lib/client.js` is the browser factory registered with `window.__ModuleLoader__.load` under that same package name. The plugin adds a global sidebar panel and does not replace built-in components or require an agent session.
 
@@ -55,7 +55,9 @@ After mutations the plugin refreshes its installed lookup. Harness's filesystem
 
 ## 4. Marketplace models and limits
 
-Providers normalize ClawHub and SkillHub into `NormalizedSkill`. A market ID is `clawhub:<slug>` or `skillhub:<slug>`. The model includes name/summary/author, statistics, tags, version, security status and installation state. SkillHub mirrors may be deduplicated into their ClawHub originals.
+Providers normalize ClawHub and SkillHub into `NormalizedSkill`. A market ID is `clawhub:<slug>` or `skillhub:<slug>`. The model includes name/summary/author, statistics, tags, category, version, security status and installation state. SkillHub mirrors may be deduplicated into their ClawHub originals.
+
+The home list is the curated catalogue (`docs/CATALOG.md`): a snapshot shipped in `lib/catalog/skills.json`, listed, categorised and searched locally with no upstream request. Its categories are the catalogue's own. Opening, previewing and installing a catalogue skill still read the owning registry; catalogue entries pin the ClawHub owner so an ambiguous slug resolves to the curated skill, and the detail overlays the catalogue's category, pick flag and Chinese summary on the live record. Live upstream listing and search remain available as the explicit `market` scope.
 
 `NormalizedSkillDetail` adds Markdown `description`, optional frontmatter/license, `files` and `totalSize`. File metadata includes relative path, byte size, language, optional hash/content type and `tooBig`. File previews include `content`, `size`, `language` and `truncated`.
 
@@ -83,10 +85,11 @@ All paths below are relative to `/api/skills-hub`.
 | --- | --- | --- |
 | GET | `/status` | `{ sources }` keyed by market source. |
 | GET | `/stats` | `{ stats }` cache counters: `hits`, `misses`, `staleServed`, `upstreamRequests`, `forcedRefreshes`. |
-| GET | `/skills?q=&source=&security=&installed=&cursor=&limit=&refresh=` | `{ items, nextCursor, sources }`. |
-| GET | `/skills/:source/:slug?refresh=` | `{ skill, sourceStatus }`. |
-| GET | `/skills/:source/:slug/file?path=…` | `{ file }`. |
-| POST | `/install`, JSON `{ id }` | `{ ok: true, installedPath, skill }`. |
+| GET | `/categories` | `{ items: MarketCategory[], status }`: catalogue categories with their skill counts; `status.fetchedAt` is the snapshot time. |
+| GET | `/skills?q=&scope=&category=&source=&security=&installed=&cursor=&limit=&refresh=` | `{ items, nextCursor, sources }`. |
+| GET | `/skills/:source/:slug?refresh=&owner=` | `{ skill, sourceStatus }`. |
+| GET | `/skills/:source/:slug/file?path=…&owner=` | `{ file }`. |
+| POST | `/install`, JSON `{ id, owner? }` | `{ ok: true, installedPath, skill }`. |
 | POST | `/uninstall`, JSON `{ id }` | `{ ok: true, removedPath, skill }`; market-managed installation only. |
 | GET | `/installed` | `{ items: InstalledSkillRecord[] }`; no provider request. |
 | GET | `/installed/detail?key=…` | `{ item, markdown, frontmatter, files }`; reads the selected local copy, its raw YAML header and its own file inventory. |
@@ -95,13 +98,15 @@ All paths below are relative to `/api/skills-hub`.
 
 `refresh` is `1`/`true` or `0`/`false` (absent means false); any other value is a `BAD_REQUEST`, because a refresh the Host cannot honour would let the panel present a cached answer as a fresh one. A refresh skips fresh cache entries for that request and rewrites them with what upstream returned.
 
-List `source` is `all`, `clawhub` or `skillhub`. `security` is `all`, `verified`, `benign`, `unknown` or `flagged`. `installed` is `all`, `installed` or `installable`; this filters the remote catalog and is distinct from the independent Installed view. `limit` is 1–100, defaulting to configured `pageSize`. Cursors are opaque and `null` means exhausted.
+ClawHub slugs are shared across authors, so `clawhub:<slug>` does not name one skill. `owner` (`[A-Za-z0-9][A-Za-z0-9_.-]{0,63}`; malformed is `BAD_REQUEST`) pins detail, file and install reads to the author of the card the reader opened; the panel sends it for every ClawHub card, list items carry it in `author.handle`, and the install sidecar records it so the installed view reopens the same skill. Without one, the Host uses the catalogue's pinned owner, then an owner it resolved earlier, and only then resolves a 409 `AMBIGUOUS_SKILL_SLUG` to the most-downloaded candidate — never the registry's first-listed match, which for popular slugs is routinely a later copy. Detail and file cache keys include the owner. An install whose detail resolves to a different author than requested is refused. A live search page shows one card per slug; a SkillHub mirror folds into a ClawHub original only when both name the same author.
+
+List `scope` is `catalog` (default) or `market`. With `catalog`, every filter runs on the snapshot before pagination and `sources` carry the snapshot time with `fromCache: true`; `refresh` has nothing to re-read. With `market`, the list is the live merged upstream feed described above and `category` is ignored. `category` is absent, `all`, or a category key (`[a-z0-9][a-z0-9-]{0,63}`). List `source` is `all`, `clawhub` or `skillhub`. `security` is `all`, `verified`, `benign`, `unknown` or `flagged`. `installed` is `all`, `installed` or `installable`; this filters the remote catalog and is distinct from the independent Installed view. `limit` is 1–100, defaulting to configured `pageSize`. Cursors are opaque and `null` means exhausted.
 
 ### 5.3 Interaction contract
 
 The marketplace shows skeleton cards on initial loading and a detail skeleton immediately after opening a card. An intersection observer inside the actual list scroll area loads the next page as the sentinel approaches view. It preserves loaded cards, deduplicates results and avoids concurrent duplicate loads. Pagination failures expose retry without discarding existing results.
 
-Search/filter changes cancel superseded requests, reset pagination and reject stale responses. Installed management has its own loading, empty, error, search and refresh states. Its local detail reads the exact selected entry, and removal requires a confirmation showing its path; symlink removals explain that the target is preserved. Successful mutations update the displayed list and installed state. Buttons expose disabled/pending state during mutations.
+A category bar above the filters shows the catalogue categories. A catalogue search offers to repeat the query across all markets (`scope=market`, labelled as not curated); clearing the query returns to the catalogue. Search/filter/category changes cancel superseded requests, reset pagination and reject stale responses. Installed management has its own loading, empty, error, search and refresh states. Its local detail reads the exact selected entry, and removal requires a confirmation showing its path; symlink removals explain that the target is preserved. Successful mutations update the displayed list and installed state. Buttons expose disabled/pending state during mutations.
 
 Both detail pages are full-panel views built on one shell (`SkillDetailShell`): the list is replaced, focus moves to the heading, and a back control returns to it. The market page keeps its tab and selected file in `MarketState`; the local page keeps them in its own state and never unmounts the inventory list, so the query and rows survive the round trip. The local page shows only what the filesystem proves — path, provenance, size, installed time, layout, the rendered SKILL.md and its own files — and omits market-only rows (author, downloads, security reports) rather than showing zeros. A skill with valid market provenance also offers "view in marketplace", which switches to the market section and opens its provider-backed page: upstream facts stay upstream, and the local page stays readable offline.
 

package/docs/RELEASE.md

@@ -1,6 +1,6 @@
-# Release 0.0.2
+# Release 0.0.3
 
-Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.2`. npm channel: `latest`. This plugin release is independent of the host's `0.2.0-rc.2` version and retains that exact compatibility cohort.
+Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.3`. npm channel: `latest`. This plugin release is independent of the host's `0.2.0-rc.2` version and retains that exact compatibility cohort.
 
 ## Before publication
 
@@ -11,7 +11,7 @@ Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`.
 
 ## GitHub Actions publication
 
-Publication runs online in `.github/workflows/release.yml`, matching the AgentTeams release model. Push `v0.0.2` to trigger it, or dispatch the workflow with an explicit version. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
+Publication runs online in `.github/workflows/release.yml`, matching the AgentTeams release model. Push `v0.0.3` to trigger it, or dispatch the workflow with an explicit version. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
 
 Configure npm Trusted Publishing for GitHub owner `NanmiCoder`, repository `dsh-skills-hub`, workflow `release.yml`, environment `npm`, allowing direct publication. OIDC uses `id-token: write`; routine releases need no local npm login and no stored npm token. The existing AgentTeams trust binding is package-specific and does not authorize this new package.
 
@@ -21,4 +21,4 @@ Before tagging, commit all source and generated artifacts, confirm the version a
 
 ## After publication / recovery
 
-Install `@nanmicoder/dsh-skills-hub@0.0.2` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.
+Install `@nanmicoder/dsh-skills-hub@0.0.3` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.

package/lib/catalog/catalog.js

@@ -0,0 +1,89 @@
+/**
+ * Curated catalogue — the marketplace's home list.
+ *
+ * The upstream registries hold ~80k ClawHub and ~110k SkillHub skills; nobody
+ * chooses from that. The home list is instead a few hundred skills reviewed in
+ * this repository (`catalog/curation.json`) and snapshotted by
+ * `scripts/catalog-refresh.mjs` into `skills.json`, which ships with the plugin.
+ *
+ * Only the *list* comes from the snapshot. Opening a card, reading a file and
+ * installing still go to the owning registry (through the usual cache), so a
+ * reader never installs the snapshot's version of anything.
+ */
+import data from './skills.json' with { type: 'json' };
+import { skillId, } from "../market/types.js";
+const catalog = data;
+export function getCatalog() {
+    return catalog;
+}
+const bySkillId = new Map(catalog.skills.map((entry) => [skillId(entry.source, entry.slug), entry]));
+export function catalogEntryFor(source, slug) {
+    return bySkillId.get(skillId(source, slug));
+}
+/** Category bar entries, in editorial order, with how many skills each holds. */
+export function catalogCategories() {
+    const counts = new Map();
+    for (const entry of catalog.skills)
+        counts.set(entry.category, (counts.get(entry.category) ?? 0) + 1);
+    return catalog.categories
+        .map((category, index) => ({ ...category, sortOrder: index, count: counts.get(category.key) ?? 0 }))
+        .filter((category) => category.count > 0);
+}
+/** ClawHub owners the catalogue pins, for the provider's slug disambiguation. */
+export function catalogClawhubOwners() {
+    return catalog.skills.filter((entry) => entry.source === 'clawhub').map((entry) => [entry.slug, entry.owner]);
+}
+export function catalogEntryToSkill(entry) {
+    return {
+        id: skillId(entry.source, entry.slug),
+        source: entry.source,
+        slug: entry.slug,
+        name: entry.name,
+        summary: entry.summary,
+        author: { handle: entry.owner },
+        stats: { ...entry.stats },
+        tags: [...entry.tags],
+        category: entry.category,
+        version: entry.version,
+        updatedAt: entry.updatedAt,
+        iconUrl: entry.iconUrl,
+        securityStatus: entry.security,
+        requiresApiKey: entry.requiresApiKey,
+        featured: entry.featured === true ? true : undefined,
+        installState: 'installable',
+    };
+}
+/** Fold case and width so `GitHub`, `github` and full-width input all match. */
+function fold(text) {
+    return text.normalize('NFKC').toLowerCase();
+}
+/**
+ * Entries matching every whitespace-separated term, in catalogue order.
+ *
+ * A name/slug hit ranks above a summary or tag hit: typing a skill's name
+ * should put that skill first, not the one that mentions it most.
+ */
+export function filterCatalog(params) {
+    const terms = fold(params.q ?? '').split(/\s+/).filter(Boolean);
+    const strong = [];
+    const weak = [];
+    for (const entry of catalog.skills) {
+        if (params.category && entry.category !== params.category)
+            continue;
+        if (params.source && params.source !== 'all' && entry.source !== params.source)
+            continue;
+        if (terms.length === 0) {
+            strong.push(entry);
+            continue;
+        }
+        const head = fold(`${entry.name} ${entry.slug}`);
+        const body = fold(`${entry.summary} ${entry.summaryEn ?? ''} ${entry.tags.join(' ')} ${entry.owner}`);
+        if (!terms.every((term) => head.includes(term) || body.includes(term)))
+            continue;
+        if (terms.every((term) => head.includes(term)))
+            strong.push(entry);
+        else
+            weak.push(entry);
+    }
+    return [...strong, ...weak];
+}