@nanmicoder/dsh-skills-hub 0.0.2 → 0.0.4

package/CONTRIBUTING.md

@@ -15,15 +15,19 @@ Commit regenerated `lib/` with source changes because Git installations consume
 For CLI users and local development, install a specific published version:
 
 ```sh
-dsh plugin --profile desktop add @nanmicoder/dsh-skills-hub@0.0.2
+dsh plugin --profile desktop add @nanmicoder/dsh-skills-hub@0.0.4
 ```
 
-Replace `desktop` with the target profile. To test a local source build:
+The `desktop` command requires the CLI bundled with the desktop installation. With the npm-installed CLI, replace `desktop` with a supported profile such as `web`. To test a local source build:
 
 ```sh
 pnpm install --frozen-lockfile
 pnpm pack --pack-destination artifacts
-dsh plugin --profile desktop add ./artifacts/nanmicoder-dsh-skills-hub-0.0.2.tgz
+dsh plugin --profile desktop add ./artifacts/nanmicoder-dsh-skills-hub-0.0.4.tgz
 ```
 
 Fully quit and reopen the target Harness instance after a CLI install. Advanced configuration is documented in [CONFIGURATION.md](./docs/CONFIGURATION.md).
+
+## Curated catalogue
+
+The marketplace home list comes from `catalog/curation.json` (editorial: which skills, category, Chinese summary, picks) and its generated snapshot `src/catalog/skills.json`. To add or remove a skill, edit the curation, run `node scripts/catalog-refresh.mjs`, review the entries it reports as dropped, then `pnpm build`. Selection and security rules are in `docs/CATALOG.md`.

package/README.md

@@ -19,46 +19,49 @@
 
 搜索 ClawHub 和 SkillHub 中的技能，阅读使用说明，再安装到 Harness。市场安装的技能和本机已有技能，都可以在「已安装技能」中查看和管理。
 
-当前版本：**0.0.2**。浏览过的列表、详情和文件预览默认缓存 60 分钟，退出桌面端后再次打开仍可复用。[更新说明](./release-notes/v0.0.2.md)
+当前版本：**0.0.4**，适配 **DeepSeek Harness 0.2.1-rc.1**，更新宿主依赖与请求鉴权接口，保留精选清单、预览和技能管理功能。[更新说明](./release-notes/v0.0.4.md)
 
 <p align="center">
-  <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub 技能市场：搜索、筛选和技能卡片。">
+  <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub 技能市场：分类、搜索、筛选和精选技能卡片。">
 </p>
 
 | 功能 | 说明 |
 | --- | --- |
-| **发现技能** | 聚合 ClawHub 与 SkillHub，支持搜索、筛选和滚动加载。 |
-| **安装前预览** | 阅读技能说明，查看文件内容和来源提供的安全报告。 |
+| **精选清单** | 398 个 ClawHub 与 SkillHub 热门技能，按 13 个分类整理，随插件发布，打开即看。 |
+| **实时搜索** | 先搜索精选清单，再点击「在全部市场中搜索」查询两个市场；ClawHub 详情与安装按作者定位。 |
+| **安装前预览** | 阅读说明和文件，查看上游安全扫描，以及技能会执行的命令、读取的密钥和访问的网络。 |
 | **管理已安装技能** | 搜索本机技能，查看来源与安装位置，确认后卸载。 |
 | **本地缓存** | 缓存已浏览的分页、详情和文件预览，重启后继续使用。 |
 
 ## 快速开始
 
-适用于 **DeepSeek Harness 0.2.0-rc.2**。[兼容版本](./docs/COMPATIBILITY.md)
+适用于 **DeepSeek Harness 0.2.1-rc.1**。[兼容版本](./docs/COMPATIBILITY.md)
 
 打开 **DeepSeek Harness 桌面端 → 插件 → 添加插件**，粘贴以下任意一种内容：
 
-**GitHub 仓库地址（推荐）**
+**npm 包名（推荐，固定版本）**
 
 ```text
-https://github.com/NanmiCoder/dsh-skills-hub
+@nanmicoder/dsh-skills-hub@0.0.4
 ```
 
-**或 npm 包名**
+**或 GitHub 仓库地址**
 
 ```text
-@nanmicoder/dsh-skills-hub@0.0.2
+https://github.com/NanmiCoder/dsh-skills-hub
 ```
 
-点击 **安装 → 立即启用**，然后从侧栏进入 **技能市场**。
+点击 **安装 → 立即启用**，然后从侧栏进入 **技能市场**。更新后若宿主提示重启，请完全退出再重新打开。
+
+仍使用 **Harness 0.2.0-rc.2** 时，请安装 `@nanmicoder/dsh-skills-hub@0.0.3`；0.0.4 仅声明支持 0.2.1-rc.1，不包含尚未验证的后续宿主版本。
 
 ## 使用
 
-1. **查找**：输入关键词，或按来源和安全状态筛选。
+1. **查找**：按分类浏览或搜索精选清单，需要更多结果时点击「在全部市场中搜索」。
 2. **预览**：打开技能，查看说明和文件内容。
 3. **安装与管理**：确认安装后，到「已安装技能」中查看或卸载。
 
-技能由第三方作者提供，安装前请确认来源并阅读说明；安全报告供参考。
+技能由第三方社区作者发布；Skills Hub 是社区插件，并非 DeepSeek 官方出品。精选清单只做整理推荐，不构成安全担保，安装前请查看安全报告与 SKILL.md。
 
 ## 已安装技能
 
@@ -66,4 +69,13 @@ https://github.com/NanmiCoder/dsh-skills-hub
 
 卸载前会显示具体位置，供你确认。若只想移除 Skills Hub 插件，在桌面端 **插件** 页面打开 **@nanmicoder/dsh-skills-hub**，点击 **卸载**；已安装的技能会保留。
 
+## 致谢与版权
+
+Skills Hub 的技能全部来自 [ClawHub](https://clawhub.ai) 和 [SkillHub](https://skillhub.cn)。感谢这两个平台的维护者，以及在上面发布技能的每一位作者。本插件只是让你在 Harness 里更方便地找到并安装这些技能。
+
+- **技能版权归原作者所有**，以每个技能自己声明的许可证为准。本仓库的 MIT 许可证只适用于 Skills Hub 插件自身的代码，不适用于任何技能。
+- **安装时从上游实时下载**。本仓库不托管、不转售任何技能内容。随插件发布的精选清单只包含名称、简介、分类和下载数等索引信息，用于展示，并附带指向原始页面的链接。
+- **ClawHub、SkillHub 及其标识归各自所有者所有**。Skills Hub 是独立的社区项目，与 ClawHub、SkillHub 及 DeepSeek 均无隶属或背书关系。
+- 如果你是技能作者或平台方，希望调整或移除展示的信息，请[提交 issue](https://github.com/NanmiCoder/dsh-skills-hub/issues)，我们会尽快处理。
+
 [反馈问题](https://github.com/NanmiCoder/dsh-skills-hub/issues) · [高级配置](./docs/CONFIGURATION.md) · [参与开发](./CONTRIBUTING.md) · [MIT 许可证](./LICENSE)

package/README_EN.md

@@ -19,46 +19,49 @@
 
 Search ClawHub and SkillHub, read a skill’s instructions, and install it into Harness. Manage marketplace installations and existing local skills together in **Installed**.
 
-Current version: **0.0.2**. Browsed lists, details and file previews are cached locally for 60 minutes by default and remain available after restarting the desktop app. [Release notes](./release-notes/v0.0.2.md)
+Current version: **0.0.4**, targeting **DeepSeek Harness 0.2.1-rc.1**. This release updates host dependencies and request authentication types while retaining the curated catalogue, previews and skill management. [Release notes](./release-notes/v0.0.4.md)
 
 <p align="center">
-  <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub marketplace with search, filters and skill cards.">
+  <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub marketplace with categories, search, filters and curated skill cards.">
 </p>
 
 | Feature | What it does |
 | --- | --- |
-| **Discover skills** | Search and filter ClawHub and SkillHub together, with more results as you scroll. |
-| **Preview before installing** | Read instructions, inspect files and check security reports from the source. |
+| **Curated catalogue** | 398 popular ClawHub and SkillHub skills in 13 categories, shipped with the plugin and shown instantly. |
+| **Live search** | Search the curated catalogue first, then choose the all-market search action; ClawHub details and installations are pinned to the author. |
+| **Preview before installing** | Read instructions and files, check upstream scans, and see the commands, secrets and network hosts a skill uses. |
 | **Manage installed skills** | Search local skills, inspect their source and installation path, and confirm removal. |
 | **Local cache** | Reuse browsed pages, details and file previews across desktop restarts. |
 
 ## Quick start
 
-Supports **DeepSeek Harness 0.2.0-rc.2**. [Compatible versions](./docs/COMPATIBILITY.md)
+Supports **DeepSeek Harness 0.2.1-rc.1**. [Compatible versions](./docs/COMPATIBILITY.md)
 
 Open **DeepSeek Harness desktop → Plugins → Add plugin** and paste either of the following:
 
-**GitHub repository URL (recommended)**
+**npm package name (recommended, pinned version)**
 
 ```text
-https://github.com/NanmiCoder/dsh-skills-hub
+@nanmicoder/dsh-skills-hub@0.0.4
 ```
 
-**Or the npm package name**
+**Or the GitHub repository URL**
 
 ```text
-@nanmicoder/dsh-skills-hub@0.0.2
+https://github.com/NanmiCoder/dsh-skills-hub
 ```
 
-Click **Install → Enable now**, then open **Skills Hub** from the sidebar.
+Click **Install → Enable now**, then open **Skills Hub** from the sidebar. If the host requests a restart after updating, fully quit and reopen it.
+
+For **Harness 0.2.0-rc.2**, use `@nanmicoder/dsh-skills-hub@0.0.3`. Version 0.0.4 declares support only for 0.2.1-rc.1; later untested host versions are not included.
 
 ## Use
 
-1. **Find**: enter a keyword or filter by source and security status.
+1. **Find**: browse or search the curated catalogue, then choose the all-market search action for more results.
 2. **Preview**: open a skill to read its instructions and inspect its files.
 3. **Install and manage**: confirm installation, then find or remove it in **Installed**.
 
-Skills come from third-party authors. Check the source and instructions before installing; security reports are provided for reference.
+Skills are published by third-party community authors. Skills Hub is a community plugin, not a DeepSeek product. The curated list is a recommendation, not a security guarantee; check the security report and SKILL.md before installing.
 
 ## Installed skills
 
@@ -66,4 +69,13 @@ Use **Installed** to view and remove marketplace installations and existing loca
 
 The removal dialog shows the exact location for you to confirm. To remove Skills Hub itself, open **@nanmicoder/dsh-skills-hub** on the desktop **Plugins** page and click **Uninstall**. Your installed skills will remain.
 
+## Acknowledgements and copyright
+
+Every skill in Skills Hub comes from [ClawHub](https://clawhub.ai) or [SkillHub](https://skillhub.cn). Thanks to the people who run both platforms and to every author who publishes there. This plugin only makes their skills easier to find and install from Harness.
+
+- **Skills belong to their authors** and are governed by each skill's own license. This repository's MIT license covers the Skills Hub plugin code only, not any skill.
+- **Skills are downloaded from upstream at install time.** This repository does not host or resell skill content. The curated list shipped with the plugin contains only index information (name, summary, category, download counts) for display, with links back to the original pages.
+- **ClawHub, SkillHub and their marks belong to their respective owners.** Skills Hub is an independent community project, not affiliated with or endorsed by ClawHub, SkillHub or DeepSeek.
+- Authors or platform operators who want displayed information changed or removed can [open an issue](https://github.com/NanmiCoder/dsh-skills-hub/issues), and we'll handle it promptly.
+
 [Report an issue](https://github.com/NanmiCoder/dsh-skills-hub/issues) · [Advanced configuration](./docs/CONFIGURATION.md) · [Contribute](./CONTRIBUTING.md) · [MIT license](./LICENSE)

package/README_ZH.md

@@ -2,6 +2,6 @@
 
 中文文档已成为仓库默认首页，请查看 [README.md](./README.md)。
 
-当前版本：**0.0.2**。[更新说明](./release-notes/v0.0.2.md)
+当前版本：**0.0.4**。[更新说明](./release-notes/v0.0.4.md)
 
 [English documentation](./README_EN.md)

package/compatibility.json

@@ -1,10 +1,10 @@
 {
   "schemaVersion": 1,
-  "pluginVersion": "0.0.2",
-  "recommendedHost": "0.2.0-rc.2",
-  "hostTag": "dsh-v0.2.0-rc.2",
-  "hostCommit": "639ed015397290b3745d163aafe02ffee4aa3f84",
-  "desktopReleaseLine": "0.2.0",
+  "pluginVersion": "0.0.4",
+  "recommendedHost": "0.2.1-rc.1",
+  "hostTag": "dsh-v0.2.1-rc.1",
+  "hostCommit": "1600d8a1e140dcde43a1a0941940a0480712c011",
+  "desktopReleaseLine": "0.2.1",
   "previewTag": "next",
-  "supportedHosts": ["0.2.0-rc.2"]
+  "supportedHosts": ["0.2.1-rc.1"]
 }

package/docs/CATALOG.md

@@ -0,0 +1,39 @@
+# Curated catalogue
+
+The marketplace home list is a curated catalogue of a few hundred skills, not the upstream registries' full feeds. ClawHub holds ~81k skills and SkillHub ~110k native ones; a reader cannot choose from that, and the long tail is dominated by near-duplicates, copies and abandoned experiments.
+
+## Files
+
+| File | Role |
+| --- | --- |
+| `catalog/curation.json` | Editorial source: categories, and for each skill its `source`, `slug`, `owner`, `category`, `featured`, Chinese `summary`, `tags`, and `allowSuspicious` when applicable. Edited by hand. |
+| `src/catalog/skills.json` | Snapshot generated from the curation plus upstream metadata (name, stats, version, icon, license, security verdict). Shipped in `lib/` and served as the home list. |
+| `scripts/catalog-refresh.mjs` | Regenerates the snapshot. `--check` reports without writing. |
+
+Run `node scripts/catalog-refresh.mjs`, review the dropped entries it prints, then rebuild (`pnpm build`) so `lib/catalog/skills.json` follows.
+
+## What is served from where
+
+- **List, categories, catalogue search:** the snapshot. No upstream request; the source bar shows the snapshot's `generatedAt` as the fetch time.
+- **Detail, files, install:** the owning registry, through the regular cache. Catalogue entries pin the ClawHub owner, because ClawHub slugs are not unique and the registry's first match for a popular slug is often a later copy by another author.
+- **"Search all markets":** an explicit live search across both registries (`scope=market`). Results are labelled as not curated.
+
+SkillHub's mirrors of ClawHub skills are not used for ClawHub entries: the mirror pipeline stopped on 2026-07-23, roughly one in ten mirrored skills lags its ClawHub version, and mirror files differ from the original (`skill-card.md` dropped, `_meta.json` added).
+
+## Selection policy
+
+Candidates were the top 1,500 ClawHub skills by downloads and the top 600 SkillHub native skills, reviewed per category for usefulness, popularity and distinctness (one or two per job, not five wrappers of the same API). Excluded:
+
+- skills only meaningful inside OpenClaw/Clawdbot (gateway hooks, OpenClaw configuration, Clawdbot channels);
+- paid versions, crypto trading or anything moving money automatically, fake engagement or mass account automation, adult content;
+- SkillHub slugs that resolve to a different owner than the curated one (SkillHub's detail route is slug-only);
+- ambiguous ClawHub slugs whose remaining owners are low-download copies (`summarize`, `find-skills`, `agent-browser`, `tavily-search`).
+
+## Security policy
+
+- ClawHub: the moderation verdict and the latest version's scan (VirusTotal, skillspector, LLM review). SkillHub: the vendor security reports.
+- `malicious` or blocked: never listed.
+- `suspicious`: listed only when the curation entry carries `allowSuspicious` with the reason, and shipped as `flagged` with that reason in `securityNote`. This is reserved for widely recommended skills whose finding is about disclosure or permission scope, not hidden behaviour. Skills that upload local content, update their own code from a remote source, or expose credentials are not exempted.
+- A refresh re-checks every entry; a newly suspicious skill without `allowSuspicious` drops out of the snapshot.
+
+A clean verdict is upstream's, not ours. Installing still shows the source and verdict, and installation never executes skill scripts.

package/docs/COMPATIBILITY.md

@@ -1,6 +1,6 @@
 # Harness compatibility
 
-The build and peer dependency baseline is **`0.2.0-rc.2`** for every `@deepseek-ai/dsh-*` package. The source reference is tag `dsh-v0.2.0-rc.2`, commit `639ed015397290b3745d163aafe02ffee4aa3f84` in `deepseek-ai/deepseek-harness`. These are the precise package coordinates behind the requested desktop 0.2.0 release line; an untagged future `0.2.0` package is not silently covered.
+The build and peer dependency baseline is **`0.2.1-rc.1`** for every `@deepseek-ai/dsh-*` package. The source reference is tag `dsh-v0.2.1-rc.1`, commit `1600d8a1e140dcde43a1a0941940a0480712c011` in `deepseek-ai/deepseek-harness`. These are the precise package coordinates behind the requested desktop 0.2.1 release line; an untagged future `0.2.1` package is not silently covered.
 
 The referenced packages were confirmed on npm. A clean install resolves one cohort, with `autoInstallPeers: false`; missing host peers used by development packages are explicitly provided at the same version. No local workspace overrides or private filesystem paths are needed.
 
@@ -20,6 +20,24 @@ Use the exact source tag or installed desktop cohort, a temporary `DSH_HOME`, an
 
 `pnpm pack:check` covers static typing, source and manifest contracts, regression tests, clean build, release metadata and tarball import closure. It does not by itself certify a running desktop session or upstream network availability. Future host cohorts must repeat this acceptance before widening peer ranges.
 
+## 0.0.4 / Harness 0.2.1-rc.1 acceptance — 2026-10-17
+
+Target: [official release `dsh-v0.2.1-rc.1`](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.1), commit `1600d8a1e140dcde43a1a0941940a0480712c011`. The supplied source checkout was clean at that tag and was used only as reference. Plugin validation used the working changes on base commit `990840138d22d681f46e54fd2e876f0d6acd8398`; it was not a published release commit.
+
+All Harness development packages and peers now target the exact new cohort. Cordis and Schemastery development versions are 4.0.5 and 3.18.5. The upstream source no longer contains `dsh-invariants`, and npm has no 0.2.1-rc.1 release of that retired package; the unused development dependency was removed. The slot registrations, module factory and user skill roots remain compatible. The HTTP trust predicate now imports the actual host type instead of casting its numeric status to a boolean contract.
+
+The unchanged baseline passed 96 tests on the old cohort. After migration, `pnpm install --frozen-lockfile` and `pnpm pack:check` passed, including 97 tests, typechecking, regenerated `lib/`, metadata and tarball closure checks. The new integration test uses real Cordis, WebServer and HostConnectionService instances (only cookie verification is a fixture), verifies 401/403/200 responses, route disposal and reactivation. The lockfile contains no old Harness cohort or local source override.
+
+Runtime acceptance used the published npm `@deepseek-ai/dsh@0.2.1-rc.1`, with all 293 installed Harness packages pinned to that cohort, on macOS arm64 / Node 26.7.0. The plugin tarball was installed through `dsh plugin --profile web add <tarball>`, then booted through `dsh web --no-open --port 0`, using disposable `DSH_HOME` and `DSH_AGENTS_HOME`. Ego Lite drove the real host browser UI:
+
+- The sidebar entry mounted the curated home with 398 skills and 13 categories.
+- Searching for weather returned the curated results; opening Weather showed a loading skeleton, live ClawHub detail, rendered Markdown and its two-file inventory.
+- Confirmed installation wrote the two files and the `steipete` owner sidecar to the isolated skills root. The Installed page showed the actual local copy. Confirmed removal from its detail returned the inventory to zero and deleted the directory.
+- A disposable Markdown skill under the isolated shared agents root appeared after refresh. Its detail rendered a GFM table; confirmed local removal deleted that directory too.
+- Light mode and a 1000px-wide dark host window rendered without horizontal viewport overflow.
+
+Screenshots and runtime logs are local-only under ignored `artifacts/`. This verifies the published host's shared Web surface and plugin protocol. Native Electron packaging, Windows/Linux runtime acceptance, and model-driven skill invocation were not exercised. No package publication, tag push or active user-profile modification was performed. Historical records below describe older plugin revisions, not an additional supported peer range for 0.0.4.
+
 ## 0.0.1 acceptance record — 2026-09-30
 
 Validation used the published npm `@deepseek-ai/dsh@0.2.0-rc.2` runtime with every Harness dependency overridden to the same cohort, on macOS arm64 / Node 26.7.0. The plugin was installed from its npm tarball into a disposable Web profile, with isolated `DSH_HOME` and `DSH_AGENTS_HOME`. The complete published host started without startup warnings. The earlier source-checkout trial lacked unrelated built host packages and is not the compatibility evidence.
@@ -63,3 +81,15 @@ Automated regression uses the compiled plugin in separate Node HTTP host process
 Adversarial review also covered the actual HTTP install entry point (a withdrawn manifest is rejected despite a fresh disk snapshot), first-response installation annotations without an `/installed` warmup, browser revalidation and per-page provenance, configuration changes during asynchronous cache reads and multi-step installation, snapshot integrity, oversized replacement invalidation, and abandoned temporary writes. Regression tests cover each behavior.
 
 The automated evidence above is process-restart coverage rather than a full native acceptance run. Separately, the user authorized installation into the active desktop: a locally packed build was installed using the desktop's bundled package manager while it was stopped, then DeepSeek Harness **0.2.0-rc.2** was relaunched. The actual market loaded 24 entries from each source and wrote two list snapshots with a 60-minute lifetime. This smoke check does not claim a native restart-after-warm acceptance of every cached path. The supported Harness cohort remains unchanged.
+
+### Curated catalogue, owner pinning and detail redesign
+
+The home list now comes from the shipped curated catalogue, ClawHub reads are pinned to the card's author, and the market detail page follows the redesign (header with stats, overview/files/security/changelog tabs, rule-based "what this skill does" and "when it triggers", redesigned install confirmation). Verified with **ego-browser** against the published `@deepseek-ai/dsh@0.2.0-rc.2` runtime (all 278 Harness packages on the same cohort) in a disposable Web profile with temporary `DSH_HOME`/`DSH_AGENTS_HOME`, macOS arm64 / Node 26.7.0, from a tarball of this revision; the user's real profile and desktop app were not touched.
+
+Recorded results: the home list rendered the 13 catalogue categories with counts and editor's picks dealt across categories, with no upstream list request. A flagged ClawHub skill (`self-improving-agent`) showed the suspicious scan chip, per-scanner reports including the LLM review text, the bundled `CHANGELOG.md` entry point, and an install dialog whose confirm button stayed disabled until the acknowledgement was checked. A SkillHub skill (`libai`) showed a passed scan, its catalogue category and sub-category tags. At a 720px panel the side rail moved below the document with no horizontal overflow; dark mode followed the host tokens. Installing `clawhub:weather` through the dialog wrote `"owner": "steipete"` to the sidecar and switched the page to installed; uninstalling removed the directory. `pnpm pack:check` passed 96 tests. Screenshots are kept locally in `artifacts/catalog-redesign-verify/`.
+
+The catalogue home and the installed inventory were then brought onto the same visual system (white top band over a grey canvas of 14px-radius cards, shared chips, mono counts, black primary actions), and both detail pages now share one `SkillDetailShell`. Re-verified the same way: the home shows the catalogue total and list date instead of live source health, which appears only for an explicit all-markets search (28 live results for `pdf`, with per-source status); installing from a card switched it to installed; the installed list and its detail rendered in the shared layout; a 720px panel had no horizontal overflow and dark mode followed the host tokens. `pnpm pack:check` passed 96 tests.
+
+## 0.0.3 release preparation — 2026-10-02
+
+The 0.0.3 release commit changes only version metadata, documentation and the README screenshot on top of the revisions recorded above. The README marketplace screenshot was retaken with ego-browser from the packed 0.0.3 tarball in an isolated Web profile (same `@deepseek-ai/dsh@0.2.0-rc.2` cohort, temporary `DSH_HOME`/`DSH_AGENTS_HOME`). It shows the curated home and the community-plugin disclaimer. `pnpm pack:check` was rerun on the release commit. No package was published and no tag was pushed.

package/docs/CONTRACT.md

@@ -1,10 +1,10 @@
-# Skills Hub 0.0.2 implementation contract
+# Skills Hub 0.0.4 implementation contract
 
 This document describes the shipped code, not a migration plan. The TypeScript models in `src/market/types.ts`, `src/skills/installed.ts` and `src/client/api.ts` define the detailed wire shapes. Update this document with API changes.
 
 ## 1. Package and host
 
-The package is `@nanmicoder/dsh-skills-hub`, version `0.0.2`. Its supported host package cohort is exactly `0.2.0-rc.2`; the desktop release line is 0.2.0. The exact upstream tag and commit are recorded in `compatibility.json` and [COMPATIBILITY.md](COMPATIBILITY.md).
+The package is `@nanmicoder/dsh-skills-hub`, version `0.0.4`. Its supported host package cohort is exactly `0.2.1-rc.1`; the desktop release line is 0.2.1. The exact upstream tag and commit are recorded in `compatibility.json` and [COMPATIBILITY.md](COMPATIBILITY.md).
 
 `cordis.patch.yml` inserts one row (`id: skills-hub`) named after the scoped package. `lib/index.js` is the host entry. `lib/client.js` is the browser factory registered with `window.__ModuleLoader__.load` under that same package name. The plugin adds a global sidebar panel and does not replace built-in components or require an agent session.
 
@@ -55,7 +55,9 @@ After mutations the plugin refreshes its installed lookup. Harness's filesystem
 
 ## 4. Marketplace models and limits
 
-Providers normalize ClawHub and SkillHub into `NormalizedSkill`. A market ID is `clawhub:<slug>` or `skillhub:<slug>`. The model includes name/summary/author, statistics, tags, version, security status and installation state. SkillHub mirrors may be deduplicated into their ClawHub originals.
+Providers normalize ClawHub and SkillHub into `NormalizedSkill`. A market ID is `clawhub:<slug>` or `skillhub:<slug>`. The model includes name/summary/author, statistics, tags, category, version, security status and installation state. SkillHub mirrors may be deduplicated into their ClawHub originals.
+
+The home list is the curated catalogue (`docs/CATALOG.md`): a snapshot shipped in `lib/catalog/skills.json`, listed, categorised and searched locally with no upstream request. Its categories are the catalogue's own. Opening, previewing and installing a catalogue skill still read the owning registry; catalogue entries pin the ClawHub owner so an ambiguous slug resolves to the curated skill, and the detail overlays the catalogue's category, pick flag and Chinese summary on the live record. Live upstream listing and search remain available as the explicit `market` scope.
 
 `NormalizedSkillDetail` adds Markdown `description`, optional frontmatter/license, `files` and `totalSize`. File metadata includes relative path, byte size, language, optional hash/content type and `tooBig`. File previews include `content`, `size`, `language` and `truncated`.
 
@@ -71,7 +73,7 @@ Current market limits are 5 MiB per file, 20 MiB total and 200 files per install
 
 ### 5.1 Transport and validation
 
-One host prefix route serves the endpoints below. Responses are JSON with `Cache-Control: no-store`. Failures use `{ "error": { "code": "…", "message": "…" } }` and an appropriate non-2xx status. Methods, route depth, IDs, enum filters, body sizes and paths are validated. The connection gate can reject requests with 401/403.
+One host prefix route serves the endpoints below. Responses are JSON with `Cache-Control: no-store`. Failures use `{ "error": { "code": "…", "message": "…" } }` and an appropriate non-2xx status. Methods, route depth, IDs, enum filters, body sizes and paths are validated. The connection gate uses the host `HostConnectionService.requestRejection(request)` type directly: `undefined` admits the request, 401 rejects missing authentication and 403 rejects an untrusted authority/origin. The service is still resolved for each request.
 
 The browser surfaces transport failures as `NETWORK_ERROR`; invalid successful JSON becomes `MARKET_UPSTREAM_BAD_RESPONSE`. Aborted superseded reads are control flow and must not appear as user-visible errors.
 
@@ -83,10 +85,11 @@ All paths below are relative to `/api/skills-hub`.
 | --- | --- | --- |
 | GET | `/status` | `{ sources }` keyed by market source. |
 | GET | `/stats` | `{ stats }` cache counters: `hits`, `misses`, `staleServed`, `upstreamRequests`, `forcedRefreshes`. |
-| GET | `/skills?q=&source=&security=&installed=&cursor=&limit=&refresh=` | `{ items, nextCursor, sources }`. |
-| GET | `/skills/:source/:slug?refresh=` | `{ skill, sourceStatus }`. |
-| GET | `/skills/:source/:slug/file?path=…` | `{ file }`. |
-| POST | `/install`, JSON `{ id }` | `{ ok: true, installedPath, skill }`. |
+| GET | `/categories` | `{ items: MarketCategory[], status }`: catalogue categories with their skill counts; `status.fetchedAt` is the snapshot time. |
+| GET | `/skills?q=&scope=&category=&source=&security=&installed=&cursor=&limit=&refresh=` | `{ items, nextCursor, sources }`. |
+| GET | `/skills/:source/:slug?refresh=&owner=` | `{ skill, sourceStatus }`. |
+| GET | `/skills/:source/:slug/file?path=…&owner=` | `{ file }`. |
+| POST | `/install`, JSON `{ id, owner? }` | `{ ok: true, installedPath, skill }`. |
 | POST | `/uninstall`, JSON `{ id }` | `{ ok: true, removedPath, skill }`; market-managed installation only. |
 | GET | `/installed` | `{ items: InstalledSkillRecord[] }`; no provider request. |
 | GET | `/installed/detail?key=…` | `{ item, markdown, frontmatter, files }`; reads the selected local copy, its raw YAML header and its own file inventory. |
@@ -95,13 +98,15 @@ All paths below are relative to `/api/skills-hub`.
 
 `refresh` is `1`/`true` or `0`/`false` (absent means false); any other value is a `BAD_REQUEST`, because a refresh the Host cannot honour would let the panel present a cached answer as a fresh one. A refresh skips fresh cache entries for that request and rewrites them with what upstream returned.
 
-List `source` is `all`, `clawhub` or `skillhub`. `security` is `all`, `verified`, `benign`, `unknown` or `flagged`. `installed` is `all`, `installed` or `installable`; this filters the remote catalog and is distinct from the independent Installed view. `limit` is 1–100, defaulting to configured `pageSize`. Cursors are opaque and `null` means exhausted.
+ClawHub slugs are shared across authors, so `clawhub:<slug>` does not name one skill. `owner` (`[A-Za-z0-9][A-Za-z0-9_.-]{0,63}`; malformed is `BAD_REQUEST`) pins detail, file and install reads to the author of the card the reader opened; the panel sends it for every ClawHub card, list items carry it in `author.handle`, and the install sidecar records it so the installed view reopens the same skill. Without one, the Host uses the catalogue's pinned owner, then an owner it resolved earlier, and only then resolves a 409 `AMBIGUOUS_SKILL_SLUG` to the most-downloaded candidate — never the registry's first-listed match, which for popular slugs is routinely a later copy. Detail and file cache keys include the owner. An install whose detail resolves to a different author than requested is refused. A live search page shows one card per slug; a SkillHub mirror folds into a ClawHub original only when both name the same author.
+
+List `scope` is `catalog` (default) or `market`. With `catalog`, every filter runs on the snapshot before pagination and `sources` carry the snapshot time with `fromCache: true`; `refresh` has nothing to re-read. With `market`, the list is the live merged upstream feed described above and `category` is ignored. `category` is absent, `all`, or a category key (`[a-z0-9][a-z0-9-]{0,63}`). List `source` is `all`, `clawhub` or `skillhub`. `security` is `all`, `verified`, `benign`, `unknown` or `flagged`. `installed` is `all`, `installed` or `installable`; this filters the remote catalog and is distinct from the independent Installed view. `limit` is 1–100, defaulting to configured `pageSize`. Cursors are opaque and `null` means exhausted.
 
 ### 5.3 Interaction contract
 
 The marketplace shows skeleton cards on initial loading and a detail skeleton immediately after opening a card. An intersection observer inside the actual list scroll area loads the next page as the sentinel approaches view. It preserves loaded cards, deduplicates results and avoids concurrent duplicate loads. Pagination failures expose retry without discarding existing results.
 
-Search/filter changes cancel superseded requests, reset pagination and reject stale responses. Installed management has its own loading, empty, error, search and refresh states. Its local detail reads the exact selected entry, and removal requires a confirmation showing its path; symlink removals explain that the target is preserved. Successful mutations update the displayed list and installed state. Buttons expose disabled/pending state during mutations.
+A category bar above the filters shows the catalogue categories. A catalogue search offers to repeat the query across all markets (`scope=market`, labelled as not curated); clearing the query returns to the catalogue. Search/filter/category changes cancel superseded requests, reset pagination and reject stale responses. Installed management has its own loading, empty, error, search and refresh states. Its local detail reads the exact selected entry, and removal requires a confirmation showing its path; symlink removals explain that the target is preserved. Successful mutations update the displayed list and installed state. Buttons expose disabled/pending state during mutations.
 
 Both detail pages are full-panel views built on one shell (`SkillDetailShell`): the list is replaced, focus moves to the heading, and a back control returns to it. The market page keeps its tab and selected file in `MarketState`; the local page keeps them in its own state and never unmounts the inventory list, so the query and rows survive the round trip. The local page shows only what the filesystem proves — path, provenance, size, installed time, layout, the rendered SKILL.md and its own files — and omits market-only rows (author, downloads, security reports) rather than showing zeros. A skill with valid market provenance also offers "view in marketplace", which switches to the market section and opens its provider-backed page: upstream facts stay upstream, and the local page stays readable offline.
 

package/docs/RELEASE.md

@@ -1,6 +1,6 @@
-# Release 0.0.2
+# Release 0.0.4
 
-Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.2`. npm channel: `latest`. This plugin release is independent of the host's `0.2.0-rc.2` version and retains that exact compatibility cohort.
+Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.4`. npm channel: `latest`. This plugin release is independent of the host's `0.2.1-rc.1` version and retains that exact compatibility cohort.
 
 ## Before publication
 
@@ -11,7 +11,7 @@ Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`.
 
 ## GitHub Actions publication
 
-Publication runs online in `.github/workflows/release.yml`, matching the AgentTeams release model. Push `v0.0.2` to trigger it, or dispatch the workflow with an explicit version. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
+Publish after the compatibility PR is merged into `main`. Revalidate the merged commit, then create and push `v0.0.4` from that commit to run `.github/workflows/release.yml`. Creating the PR alone does not publish. A manual workflow dispatch with version `0.0.4` also publishes npm, but the GitHub Release job runs only for a tag push; prefer the tag flow for the complete release. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
 
 Configure npm Trusted Publishing for GitHub owner `NanmiCoder`, repository `dsh-skills-hub`, workflow `release.yml`, environment `npm`, allowing direct publication. OIDC uses `id-token: write`; routine releases need no local npm login and no stored npm token. The existing AgentTeams trust binding is package-specific and does not authorize this new package.
 
@@ -21,4 +21,4 @@ Before tagging, commit all source and generated artifacts, confirm the version a
 
 ## After publication / recovery
 
-Install `@nanmicoder/dsh-skills-hub@0.0.2` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.
+Install `@nanmicoder/dsh-skills-hub@0.0.4` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.

package/lib/catalog/catalog.js

@@ -0,0 +1,89 @@
+/**
+ * Curated catalogue — the marketplace's home list.
+ *
+ * The upstream registries hold ~80k ClawHub and ~110k SkillHub skills; nobody
+ * chooses from that. The home list is instead a few hundred skills reviewed in
+ * this repository (`catalog/curation.json`) and snapshotted by
+ * `scripts/catalog-refresh.mjs` into `skills.json`, which ships with the plugin.
+ *
+ * Only the *list* comes from the snapshot. Opening a card, reading a file and
+ * installing still go to the owning registry (through the usual cache), so a
+ * reader never installs the snapshot's version of anything.
+ */
+import data from './skills.json' with { type: 'json' };
+import { skillId, } from "../market/types.js";
+const catalog = data;
+export function getCatalog() {
+    return catalog;
+}
+const bySkillId = new Map(catalog.skills.map((entry) => [skillId(entry.source, entry.slug), entry]));
+export function catalogEntryFor(source, slug) {
+    return bySkillId.get(skillId(source, slug));
+}
+/** Category bar entries, in editorial order, with how many skills each holds. */
+export function catalogCategories() {
+    const counts = new Map();
+    for (const entry of catalog.skills)
+        counts.set(entry.category, (counts.get(entry.category) ?? 0) + 1);
+    return catalog.categories
+        .map((category, index) => ({ ...category, sortOrder: index, count: counts.get(category.key) ?? 0 }))
+        .filter((category) => category.count > 0);
+}
+/** ClawHub owners the catalogue pins, for the provider's slug disambiguation. */
+export function catalogClawhubOwners() {
+    return catalog.skills.filter((entry) => entry.source === 'clawhub').map((entry) => [entry.slug, entry.owner]);
+}
+export function catalogEntryToSkill(entry) {
+    return {
+        id: skillId(entry.source, entry.slug),
+        source: entry.source,
+        slug: entry.slug,
+        name: entry.name,
+        summary: entry.summary,
+        author: { handle: entry.owner },
+        stats: { ...entry.stats },
+        tags: [...entry.tags],
+        category: entry.category,
+        version: entry.version,
+        updatedAt: entry.updatedAt,
+        iconUrl: entry.iconUrl,
+        securityStatus: entry.security,
+        requiresApiKey: entry.requiresApiKey,
+        featured: entry.featured === true ? true : undefined,
+        installState: 'installable',
+    };
+}
+/** Fold case and width so `GitHub`, `github` and full-width input all match. */
+function fold(text) {
+    return text.normalize('NFKC').toLowerCase();
+}
+/**
+ * Entries matching every whitespace-separated term, in catalogue order.
+ *
+ * A name/slug hit ranks above a summary or tag hit: typing a skill's name
+ * should put that skill first, not the one that mentions it most.
+ */
+export function filterCatalog(params) {
+    const terms = fold(params.q ?? '').split(/\s+/).filter(Boolean);
+    const strong = [];
+    const weak = [];
+    for (const entry of catalog.skills) {
+        if (params.category && entry.category !== params.category)
+            continue;
+        if (params.source && params.source !== 'all' && entry.source !== params.source)
+            continue;
+        if (terms.length === 0) {
+            strong.push(entry);
+            continue;
+        }
+        const head = fold(`${entry.name} ${entry.slug}`);
+        const body = fold(`${entry.summary} ${entry.summaryEn ?? ''} ${entry.tags.join(' ')} ${entry.owner}`);
+        if (!terms.every((term) => head.includes(term) || body.includes(term)))
+            continue;
+        if (terms.every((term) => head.includes(term)))
+            strong.push(entry);
+        else
+            weak.push(entry);
+    }
+    return [...strong, ...weak];
+}