@nanmicoder/dsh-skills-hub 0.0.2 → 0.0.4

package/lib/market/clawhub-provider.js

@@ -7,7 +7,11 @@
  *  - GET /api/v1/skills/{slug}                        → {skill, latestVersion, owner, metadata, moderation}
  *  - GET /api/v1/skills/{slug}/versions/{v}           → {version:{license, files[], security}}
  *  - GET /api/v1/skills/{slug}/file?path=             → raw file text
+ *
+ * Slugs are not unique: every endpoint accepts `?owner=`, and without it a
+ * shared slug answers 409 AMBIGUOUS_SKILL_SLUG. See `clawhubOwnerFor`.
  */
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { getProviderBase, providerFetch, providerFetchJson, readResponseTextWithLimit, MarketHttpError, } from "./provider-fetch.js";
 import { markSourceHealth } from "./cache.js";
 import { detectMarketLanguage, MARKET_ERROR_CODES, MARKET_LIMITS, MarketUpstreamError, skillId, } from "./types.js";
@@ -344,14 +348,77 @@ function usableFileEntries(files) {
     }
     return out;
 }
-// ClawHub slugs are not unique across owners. Ambiguous slugs return
-// 409 AMBIGUOUS_SKILL_SLUG with candidate owners; disambiguate via ?owner=
-// (first match = primary listing) and remember the resolution.
+// ClawHub slugs are not unique across owners. Every read is therefore made
+// for one owner, chosen in this order:
+//  1. the owner the reader's request names (the card it came from);
+//  2. the owner the curated catalogue pins for that slug;
+//  3. an owner resolved earlier for the slug (remembered below);
+//  4. otherwise, on 409 AMBIGUOUS_SKILL_SLUG, the most-downloaded candidate.
+// The registry lists candidates oldest-first, and for popular slugs that is
+// routinely a later copy by another author — "first match" opened (and
+// installed) somebody else's skill.
 const ownerCache = new Map();
+/**
+ * Owners the curated catalogue already knows. A catalogue entry names the exact
+ * skill it recommends, so its owner must win over any guessing.
+ */
+const ownerHints = new Map();
+/** The owner one detail/file/install operation was asked for. */
+const requestedOwner = new AsyncLocalStorage();
+/** Shape of a ClawHub owner handle (also the route's validation rule). */
+export const CLAWHUB_OWNER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
+/** Most candidates probed when resolving an ambiguous slug without an owner. */
+const MAX_AMBIGUOUS_PROBES = 8;
+export function setClawhubOwnerHints(hints) {
+    ownerHints.clear();
+    for (const [slug, owner] of hints)
+        ownerHints.set(slug, owner);
+}
+/**
+ * Run one operation pinned to `owner` for `slug`. Without an owner the
+ * operation runs unpinned and falls back to the hint/cache/probe order.
+ */
+export function withClawhubOwner(slug, owner, operation) {
+    if (!owner)
+        return operation();
+    return requestedOwner.run({ slug, owner }, operation);
+}
+/** The owner a read of `slug` will use right now, if one is known before asking upstream. */
+export function clawhubOwnerFor(slug) {
+    const requested = requestedOwner.getStore();
+    if (requested?.slug === slug)
+        return requested.owner;
+    return ownerHints.get(slug) ?? ownerCache.get(slug);
+}
+/**
+ * Pick the candidate readers most plausibly mean: the most-downloaded one.
+ * Probes are owner-qualified detail reads; a candidate that fails to answer
+ * simply does not compete.
+ */
+async function resolveAmbiguousOwner(slug, candidates) {
+    const base = getProviderBase('clawhub');
+    const probed = await Promise.all(candidates.slice(0, MAX_AMBIGUOUS_PROBES).map(async (owner) => {
+        const url = new URL(`/api/v1/skills/${encodeURIComponent(slug)}`, base);
+        url.searchParams.set('owner', owner);
+        try {
+            const res = await providerFetch('clawhub', url.toString());
+            if (!res.ok)
+                return { owner, downloads: -1 };
+            const { content } = await readResponseTextWithLimit('clawhub', res, MARKET_LIMITS.maxTotalSize, 'ambiguous-slug probe');
+            const parsed = JSON.parse(content);
+            return { owner, downloads: asNumber(parsed.skill?.stats?.downloads) ?? 0 };
+        }
+        catch {
+            return { owner, downloads: -1 };
+        }
+    }));
+    const best = probed.filter((entry) => entry.downloads >= 0).sort((a, b) => b.downloads - a.downloads)[0];
+    return best?.owner;
+}
 async function clawhubFetch(url, slug) {
-    const cachedOwner = ownerCache.get(slug);
-    if (cachedOwner && !url.searchParams.has('owner')) {
-        url.searchParams.set('owner', cachedOwner);
+    const knownOwner = clawhubOwnerFor(slug);
+    if (knownOwner && !url.searchParams.has('owner')) {
+        url.searchParams.set('owner', knownOwner);
     }
     const res = await providerFetch('clawhub', url.toString());
     if (res.status !== 409)
@@ -371,7 +438,13 @@ async function clawhubFetch(url, slug) {
             throw error;
         body = null;
     }
-    const resolvedOwner = body?.code === 'AMBIGUOUS_SKILL_SLUG' ? asString(body.matches?.[0]?.ownerHandle) : undefined;
+    const candidates = body?.code === 'AMBIGUOUS_SKILL_SLUG'
+        ? (body.matches ?? []).map((match) => asString(match?.ownerHandle)).filter((owner) => owner !== undefined)
+        : [];
+    // A pinned owner that still answers 409 is not a guess we may widen.
+    const resolvedOwner = knownOwner === undefined && candidates.length > 0
+        ? await resolveAmbiguousOwner(slug, candidates)
+        : undefined;
     if (!resolvedOwner) {
         throw new MarketHttpError('clawhub', 409, MARKET_ERROR_CODES.upstreamError, `clawhub responded 409 for ${url.pathname}`);
     }
@@ -392,24 +465,61 @@ async function clawhubFetchJson(url, slug) {
         throw new MarketUpstreamError('clawhub', MARKET_ERROR_CODES.upstreamBadResponse, 'clawhub returned invalid JSON');
     }
 }
+/**
+ * ClawHub's scan of one version: an overall status plus per-scanner verdicts
+ * (VirusTotal, skillspector, an LLM review). The overall status decides the
+ * badge; each scanner becomes its own report so the reader sees which one
+ * objected and why.
+ */
 function mapSecurity(security) {
     const vendorStatus = asString(security?.status);
     if (!vendorStatus)
         return { status: 'unknown', reports: [] };
     const clean = vendorStatus === 'clean';
-    return {
-        status: clean ? 'benign' : 'flagged',
-        reports: [
-            {
-                vendor: 'clawhub-scan',
-                status: vendorStatus,
-                statusText: clean
-                    ? security?.hasWarnings === true ? 'Clean (with warnings)' : 'Clean'
-                    : `Scan status: ${vendorStatus}`,
-                reportUrl: asString(security?.virustotalUrl),
-            },
-        ],
-    };
+    const reports = [
+        {
+            vendor: 'clawhub-scan',
+            status: vendorStatus,
+            statusText: clean
+                ? security?.hasWarnings === true ? 'Clean (with warnings)' : 'Clean'
+                : `Scan status: ${vendorStatus}`,
+            reportUrl: asString(security?.virustotalUrl),
+        },
+    ];
+    const scanners = [
+        ['VirusTotal', security?.scanners?.vt],
+        ['skillspector', security?.scanners?.skillspector],
+        ['LLM review', security?.scanners?.llm],
+    ];
+    for (const [vendor, scanner] of scanners) {
+        const status = asString(scanner?.normalizedStatus) ?? asString(scanner?.status);
+        if (!status)
+            continue;
+        const recommendation = asString(scanner?.recommendation);
+        const summary = asString(scanner?.summary);
+        const reportUrl = vendor === 'VirusTotal' ? asString(security?.virustotalUrl) : undefined;
+        reports.push({
+            vendor,
+            status,
+            statusText: recommendation ? `${status} · ${recommendation}` : status,
+            ...(summary ? { summary } : {}),
+            ...(reportUrl ? { reportUrl } : {}),
+        });
+    }
+    return { status: clean ? 'benign' : 'flagged', reports };
+}
+function changelogOf(version, latest) {
+    const text = meaningfulChangelog(latest?.changelog);
+    return text ? { changelog: { version, text, publishedAt: asNumber(latest?.createdAt) } } : {};
+}
+/** A release note worth showing: registries stamp placeholders on synced versions. */
+export function meaningfulChangelog(text) {
+    const value = asString(text)?.trim();
+    if (!value)
+        return undefined;
+    if (/^synced by .*pipeline$/i.test(value))
+        return undefined;
+    return value;
 }
 function normalizeListItem(item) {
     return {
@@ -418,7 +528,7 @@ function normalizeListItem(item) {
         slug: item.slug,
         name: asString(item.displayName) || item.slug,
         summary: asString(item.summary) ?? '',
-        author: { handle: '' },
+        author: { handle: asString(item.ownerHandle) || '' },
         stats: {
             downloads: asNumber(item.stats?.downloads) ?? 0,
             installs: asNumber(item.stats?.installs),
@@ -505,7 +615,11 @@ export const clawhubProvider = {
         }
         const nativeResults = usable.filter((result) => (result.source === undefined || result.source === 'clawhub')
             && (result.install?.kind === undefined || result.install.kind === 'clawhub'));
-        return { items: nativeResults.slice(0, limit).map(normalizeSearchResult) };
+        // A card id is `clawhub:<slug>`, so a page can hold one owner per slug: the
+        // most relevant (first) result keeps the slot and carries its owner.
+        const seen = new Set();
+        const distinct = nativeResults.filter((result) => !seen.has(result.slug) && Boolean(seen.add(result.slug)));
+        return { items: distinct.slice(0, limit).map(normalizeSearchResult) };
     },
     async detail(slug) {
         const base = getProviderBase('clawhub');
@@ -549,6 +663,7 @@ export const clawhubProvider = {
             frontmatter = parsed.frontmatter;
         }
         const item = normalizeListItem(data.skill);
+        const owner = asString(data.owner?.handle);
         return {
             ...item,
             version,
@@ -559,6 +674,8 @@ export const clawhubProvider = {
             },
             securityStatus: security.status,
             securityReports: security.reports.length ? security.reports : undefined,
+            ...changelogOf(version, data.latestVersion),
+            ...(owner ? { pageUrl: `https://clawhub.ai/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}` } : {}),
             description: body,
             descriptionFrontmatter: frontmatter,
             license,

package/lib/market/install-service.js

@@ -22,7 +22,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { clawhubProvider } from "./clawhub-provider.js";
 import { skillhubProvider } from "./skillhub-provider.js";
-import { getMarketSkillDetail, resolveMarketSkill } from "./market-service.js";
+import { getMarketSkillDetail, resolveMarketSkill, withMarketOwner } from "./market-service.js";
 import { withProviderConfiguration } from "./provider-fetch.js";
 import { INSTALL_META_FILE, parseInstalledMeta, readSkillHeadline, } from "../skills/installed.js";
 import { MARKET_ERROR_CODES, MARKET_LIMITS, sanitizeDirName, skillId, } from "./types.js";
@@ -104,8 +104,14 @@ function hasErrorCode(error, code) {
     return typeof error === 'object' && error !== null && error.code === code;
 }
 /** The upstream detail for a skill, or the market's own "not installable" verdict. */
-async function loadDetail(source, slug) {
-    return resolveMarketSkill(source, slug);
+async function loadDetail(source, slug, owner) {
+    const detail = await resolveMarketSkill(source, slug, owner);
+    // The bytes must belong to the author the reader chose: a registry that
+    // answers for another owner is refused rather than installed.
+    if (owner && detail.author.handle && detail.author.handle !== owner) {
+        throw new MarketInstallError(409, MARKET_ERROR_CODES.notInstallable, `Skill ${slug} resolved to ${detail.author.handle}, not the requested ${owner}`);
+    }
+    return detail;
 }
 /**
  * Refuse to publish over anything we do not own.
@@ -156,7 +162,8 @@ async function readJsonIfExists(filePath) {
  *   unwrapped so the route can classify them (404 vs 502).
  */
 export function installMarketSkill(source, slug, options) {
-    return withProviderConfiguration(() => installMarketSkillWithConfiguration(source, slug, options));
+    // One owner for the manifest, the file list and every file read.
+    return withProviderConfiguration(() => withMarketOwner(source, slug, options.owner, () => installMarketSkillWithConfiguration(source, slug, options)));
 }
 async function installMarketSkillWithConfiguration(source, slug, options) {
     const dirName = sanitizeDirName(slug);
@@ -171,7 +178,7 @@ async function installMarketSkillWithConfiguration(source, slug, options) {
     if (inFlight.has(lockKey)) {
         throw new MarketInstallError(409, MARKET_ERROR_CODES.installInProgress, `Install already in progress: ${id}`);
     }
-    const task = performInstall(source, slug, dirName, id, options.skillsRoot);
+    const task = performInstall(source, slug, dirName, id, options.skillsRoot, options.owner);
     // Store a settled-safe copy: the lock exists to reject *concurrent* work, and
     // an unhandled rejection here would crash the host on every failed install.
     inFlight.set(lockKey, task.catch(() => undefined));
@@ -182,9 +189,9 @@ async function installMarketSkillWithConfiguration(source, slug, options) {
         inFlight.delete(lockKey);
     }
 }
-async function performInstall(source, slug, dirName, id, skillsRootInput) {
+async function performInstall(source, slug, dirName, id, skillsRootInput, requestedOwner) {
     const skillsRoot = path.resolve(skillsRootInput);
-    const detail = await loadDetail(source, slug);
+    const detail = await loadDetail(source, slug, requestedOwner);
     if (detail.installState === 'installed') {
         throw new MarketInstallError(409, MARKET_ERROR_CODES.alreadyInstalled, `Skill already installed: ${id}`);
     }
@@ -252,10 +259,14 @@ async function performInstall(source, slug, dirName, id, skillsRootInput) {
             ledger.push({ path: segments.join('/'), sha256: digest });
         }
         const installedAt = new Date().toISOString();
+        // The author is recorded so "view in marketplace" and later reads find this
+        // exact skill again, not another one sharing its slug.
+        const owner = detail.author.handle || requestedOwner;
         const meta = {
             id,
             source,
             slug,
+            ...(owner ? { owner } : {}),
             ...(detail.version === undefined ? {} : { version: detail.version }),
             installedAt,
             files: ledger,
@@ -371,7 +382,7 @@ export async function uninstallMarketSkill(source, slug, options) {
  */
 async function refreshRemovedSkill(source, slug, id, dirName, meta, headline) {
     try {
-        const { skill } = await getMarketSkillDetail(source, slug);
+        const { skill } = await getMarketSkillDetail(source, slug, { owner: meta.owner });
         return { ...skill, installState: 'installable', notInstallableReason: undefined, installedInfo: undefined };
     }
     catch {

package/lib/market/market-service.js

@@ -12,13 +12,17 @@
  */
 import { getSourceHealth, markSourceHealth, marketCache, noteMarketStat } from "./cache.js";
 import { getProviderBase, withProviderConfiguration } from "./provider-fetch.js";
-import { clawhubProvider } from "./clawhub-provider.js";
+import { clawhubOwnerFor, clawhubProvider, setClawhubOwnerHints, withClawhubOwner } from "./clawhub-provider.js";
+import { catalogCategories, catalogClawhubOwners, catalogEntryFor, catalogEntryToSkill, filterCatalog, getCatalog, } from "../catalog/catalog.js";
 import { skillhubProvider } from "./skillhub-provider.js";
 import { MARKET_LIMITS, MARKET_SOURCES, detectMarketLanguage, sanitizeDirName, skillId, } from "./types.js";
 const providers = {
     clawhub: clawhubProvider,
     skillhub: skillhubProvider,
 };
+// Catalogue entries name an exact ClawHub owner; detail, files and install must
+// resolve the same skill the card showed.
+setClawhubOwnerHints(catalogClawhubOwners());
 /** Nothing is installed until the host installs its real lookup. */
 const EMPTY_INSTALLED_LOOKUP = {
     has: () => false,
@@ -129,7 +133,9 @@ export function dedupeSkills(items) {
     for (const item of copies) {
         if (item.source === 'skillhub' && item.upstream?.slug) {
             const original = byClawhubSlug.get(item.upstream.slug);
-            if (original) {
+            // Same slug, different author: the mirror copies another skill.
+            const sameAuthor = !item.upstream.owner || !original?.author.handle || item.upstream.owner === original.author.handle;
+            if (original && sameAuthor) {
                 original.mirrors = [...(original.mirrors ?? []), item.id];
                 // Enrich the original with SkillHub-only data.
                 if (!original.iconUrl && item.iconUrl)
@@ -206,6 +212,8 @@ async function fetchProviderPage(source, params, cache, options = {}) {
     }
 }
 export function listMarketSkills(params) {
+    if (params.scope !== 'market')
+        return Promise.resolve(listCatalogSkills(params));
     const cache = marketCache;
     return withProviderConfiguration(() => listMarketSkillsWithCache(params, cache));
 }
@@ -256,13 +264,68 @@ async function listMarketSkillsWithCache(params, cache) {
     }
     return { items: merged, nextCursor: encodeCursor(nextCursor), sources };
 }
+// ─── Curated catalogue ───────────────────────────────────────────────────────
+const CATALOG_CURSOR_PREFIX = 'catalog:';
+/** Provenance of every catalogue answer: one snapshot, read when it was generated. */
+function catalogStatus() {
+    return { status: 'ok', fetchedAt: getCatalog().generatedAt, fromCache: true };
+}
+/**
+ * One page of the curated catalogue.
+ *
+ * Everything is local, so every filter — security and installed included — runs
+ * before pagination: a page is always full until the list is exhausted, which
+ * is what keeps infinite scroll from stalling on a filtered-out page.
+ */
+export function listCatalogSkills(params) {
+    let items = filterCatalog({ q: params.q, category: params.category, source: params.source })
+        .map(catalogEntryToSkill)
+        .map((item) => annotateInstallState(item));
+    if (params.security !== 'all')
+        items = items.filter((item) => item.securityStatus === params.security);
+    if (params.installed !== 'all') {
+        items = items.filter((item) => params.installed === 'installed' ? item.installState === 'installed' : item.installState !== 'installed');
+    }
+    const raw = params.cursor?.startsWith(CATALOG_CURSOR_PREFIX) ? params.cursor.slice(CATALOG_CURSOR_PREFIX.length) : '';
+    const offset = Math.max(0, Number.parseInt(raw, 10) || 0);
+    const end = offset + params.limit;
+    const status = catalogStatus();
+    return {
+        items: items.slice(offset, end),
+        nextCursor: end < items.length ? `${CATALOG_CURSOR_PREFIX}${end}` : null,
+        total: items.length,
+        sources: { clawhub: status, skillhub: status },
+    };
+}
+export function listMarketCategories() {
+    return { items: catalogCategories(), status: catalogStatus() };
+}
 // ─── Detail / file content ───────────────────────────────────────────────────
 export function getMarketSkillDetail(source, slug, options = {}) {
     const cache = marketCache;
-    return withProviderConfiguration(() => getMarketSkillDetailWithCache(source, slug, options, cache));
+    return withProviderConfiguration(() => withMarketOwner(source, slug, options.owner, () => getMarketSkillDetailWithCache(source, slug, options, cache))).then((result) => ({ ...result, skill: withCatalogMetadata(result.skill) }));
+}
+/**
+ * Overlay the catalogue's editorial fields on a live detail.
+ *
+ * Upstream stays authoritative for everything it owns (version, files,
+ * security, stats); the catalogue only adds what upstream does not have — our
+ * category, the editor's pick and the reader-facing Chinese summary.
+ */
+function withCatalogMetadata(detail) {
+    const entry = catalogEntryFor(detail.source, detail.slug);
+    if (!entry)
+        return detail;
+    return {
+        ...detail,
+        category: entry.category,
+        featured: entry.featured === true ? true : undefined,
+        summary: entry.summary || detail.summary,
+        tags: detail.tags.length > 0 ? detail.tags : [...entry.tags],
+    };
 }
 async function getMarketSkillDetailWithCache(source, slug, options, cache) {
-    const cacheKey = `detail:${source}:${JSON.stringify([getProviderBase(source), slug])}`;
+    const cacheKey = `detail:${source}:${JSON.stringify([getProviderBase(source), slug, ...ownerKeyPart(source, slug)])}`;
     const forced = options.force === true;
     if (forced)
         noteMarketStat('forcedRefreshes');
@@ -310,14 +373,30 @@ export function isValidMarketFilePath(filePath) {
         return false;
     return true;
 }
-export function getMarketFileContent(source, slug, filePath) {
+export function getMarketFileContent(source, slug, filePath, owner) {
     const cache = marketCache;
-    return withProviderConfiguration(() => getMarketFileContentWithCache(source, slug, filePath, cache));
+    return withProviderConfiguration(() => withMarketOwner(source, slug, owner, () => getMarketFileContentWithCache(source, slug, filePath, cache)));
+}
+/**
+ * Pin a ClawHub read to the owner the reader asked for. ClawHub slugs are
+ * shared across authors, so `clawhub:<slug>` alone does not name one skill.
+ */
+export function withMarketOwner(source, slug, owner, operation) {
+    return source === 'clawhub' ? withClawhubOwner(slug, owner, operation) : operation();
+}
+/**
+ * Cache keys of owner-dependent reads carry the owner the read will use, so a
+ * snapshot of one author's skill is never served for another's. Appended only
+ * when known, keeping unambiguous slugs' keys unchanged.
+ */
+function ownerKeyPart(source, slug) {
+    const owner = source === 'clawhub' ? clawhubOwnerFor(slug) : undefined;
+    return owner ? [`owner=${owner}`] : [];
 }
 async function getMarketFileContentWithCache(source, slug, filePath, cache) {
     // JSON-encoded for the same reason as the list keys: slug and filePath are
     // both caller-controlled, so a `:`-joined key is ambiguous.
-    const cacheKey = `file:${source}:${JSON.stringify([getProviderBase(source), slug, filePath])}`;
+    const cacheKey = `file:${source}:${JSON.stringify([getProviderBase(source), slug, filePath, ...ownerKeyPart(source, slug)])}`;
     const cached = await cache.getRecord(cacheKey);
     if (cached) {
         noteMarketStat('hits');
@@ -356,7 +435,7 @@ export function getMarketStatus() {
  * right now — the file bytes are fetched fresh and hash-verified against the
  * list, so the list must come from the same generation as those bytes.
  */
-export async function resolveMarketSkill(source, slug) {
-    const { skill } = await getMarketSkillDetail(source, slug, { force: true, allowStale: false });
+export async function resolveMarketSkill(source, slug, owner) {
+    const { skill } = await getMarketSkillDetail(source, slug, { force: true, allowStale: false, owner });
     return skill;
 }

package/lib/market/skillhub-provider.js

@@ -13,7 +13,7 @@ import { getProviderBase, providerFetch, providerFetchJson, readResponseTextWith
 import { detectMarketLanguage, MARKET_ERROR_CODES, MARKET_LIMITS, MarketUpstreamError, skillId, } from "./types.js";
 // The frontmatter parser is shared with the ClawHub provider: both sources hand
 // us a raw SKILL.md and the detail contract promises a frontmatter-free body.
-import { parseFrontmatter } from "./clawhub-provider.js";
+import { meaningfulChangelog, parseFrontmatter } from "./clawhub-provider.js";
 import { markSourceHealth } from "./cache.js";
 /**
  * Vendor statuses that mean "no findings". Anything else (suspicious,
@@ -88,8 +88,9 @@ function parseUpstream(item) {
     try {
         const segments = new URL(upstreamUrl).pathname.split('/').filter(Boolean);
         const slug = segments[segments.length - 1];
+        const owner = segments.length > 1 ? segments[segments.length - 2] : undefined;
         if (slug)
-            return { source: 'clawhub', slug };
+            return { source: 'clawhub', slug, ...(owner ? { owner } : {}) };
     }
     catch {
         // Malformed upstream URL — treat as a native entry.
@@ -200,6 +201,7 @@ export const skillhubProvider = {
         }
         const security = mapSecurity(data.securityReports, data.skill.verified === undefined ? undefined : Boolean(data.skill.verified));
         const version = asString(data.latestVersion?.version) || item.version;
+        const changelog = meaningfulChangelog(data.latestVersion?.changelog);
         let files = [];
         try {
             files = await skillhubProvider.listFiles(slug);
@@ -242,6 +244,8 @@ export const skillhubProvider = {
             },
             securityStatus: security.status,
             securityReports: security.reports.length ? security.reports : undefined,
+            ...(changelog ? { changelog: { version, text: changelog, publishedAt: asNumber(data.latestVersion?.createdAt) } } : {}),
+            pageUrl: `https://skillhub.cn/skills/${encodeURIComponent(slug)}`,
             description,
             ...(descriptionFrontmatter ? { descriptionFrontmatter } : {}),
             files: files.map((file) => ({

package/lib/skills/installed.js

@@ -57,6 +57,9 @@ export function parseInstalledMeta(value) {
     const version = typeof candidate['version'] === 'string' && candidate['version'] !== ''
         ? candidate['version']
         : undefined;
+    const owner = typeof candidate['owner'] === 'string' && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(candidate['owner'])
+        ? candidate['owner']
+        : undefined;
     const files = [];
     const rawFiles = candidate['files'];
     if (Array.isArray(rawFiles)) {
@@ -75,6 +78,7 @@ export function parseInstalledMeta(value) {
         id,
         source: source,
         slug,
+        ...(owner === undefined ? {} : { owner }),
         ...(version === undefined ? {} : { version }),
         installedAt,
         files,
@@ -289,6 +293,7 @@ async function readDirectorySkill(rootPath, dirName) {
         id: meta.id,
         source: meta.source,
         slug: meta.slug,
+        ...(meta.owner === undefined ? {} : { owner: meta.owner }),
         ...(version === undefined ? {} : { version }),
         installedAt: meta.installedAt,
         ...shared,

package/lib/types/catalog/catalog.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Curated catalogue — the marketplace's home list.
+ *
+ * The upstream registries hold ~80k ClawHub and ~110k SkillHub skills; nobody
+ * chooses from that. The home list is instead a few hundred skills reviewed in
+ * this repository (`catalog/curation.json`) and snapshotted by
+ * `scripts/catalog-refresh.mjs` into `skills.json`, which ships with the plugin.
+ *
+ * Only the *list* comes from the snapshot. Opening a card, reading a file and
+ * installing still go to the owning registry (through the usual cache), so a
+ * reader never installs the snapshot's version of anything.
+ */
+import { type MarketCategory, type MarketSource, type NormalizedSkill, type SecurityStatus } from '../market/types.ts';
+export type CatalogEntry = {
+    source: MarketSource;
+    slug: string;
+    /** Registry owner; disambiguates ClawHub slugs shared by several authors. */
+    owner: string;
+    name: string;
+    /** Reader-facing summary (zh-CN). */
+    summary: string;
+    /** Original upstream summary, kept for English readers and search. */
+    summaryEn?: string;
+    /** Key into `categories`. */
+    category: string;
+    tags: string[];
+    /** Editor's pick: listed first and marked on the card. */
+    featured?: boolean;
+    stats: {
+        downloads: number;
+        installs?: number;
+        stars?: number;
+    };
+    version?: string;
+    updatedAt?: number;
+    iconUrl?: string;
+    security: SecurityStatus;
+    /** Why the security verdict is what it is, when it is not clean. */
+    securityNote?: string;
+    requiresApiKey?: boolean;
+    license?: string;
+};
+export type CatalogFile = {
+    version: 1;
+    /** Epoch millis of the upstream reads behind this snapshot. */
+    generatedAt: number;
+    categories: Array<{
+        key: string;
+        name: string;
+        nameEn: string;
+    }>;
+    skills: CatalogEntry[];
+};
+export declare function getCatalog(): CatalogFile;
+export declare function catalogEntryFor(source: MarketSource, slug: string): CatalogEntry | undefined;
+/** Category bar entries, in editorial order, with how many skills each holds. */
+export declare function catalogCategories(): Array<MarketCategory & {
+    count: number;
+}>;
+/** ClawHub owners the catalogue pins, for the provider's slug disambiguation. */
+export declare function catalogClawhubOwners(): Array<readonly [string, string]>;
+export declare function catalogEntryToSkill(entry: CatalogEntry): NormalizedSkill;
+/**
+ * Entries matching every whitespace-separated term, in catalogue order.
+ *
+ * A name/slug hit ranks above a summary or tag hit: typing a skill's name
+ * should put that skill first, not the one that mentions it most.
+ */
+export declare function filterCatalog(params: {
+    q?: string;
+    category?: string;
+    source?: 'all' | MarketSource;
+}): CatalogEntry[];

package/lib/types/client/api.d.ts

@@ -9,7 +9,7 @@
  * never a value from the Host's `src/market/*`, which would drag Node code into
  * the browser bundle (contract §2).
  */
-import type { MarketFileContent, MarketListResult, MarketSource, NormalizedSkill, NormalizedSkillDetail, SecurityStatus, SourceStatusInfo } from '../market/types.ts';
+import type { MarketCategoriesResult, MarketFileContent, MarketListResult, MarketSource, NormalizedSkill, NormalizedSkillDetail, SecurityStatus, SourceStatusInfo } from '../market/types.ts';
 /**
  * Structural mirror of the Host's `InstalledSkillRecord`
  * (`src/skills/installed.ts`, contract §5.2).
@@ -29,6 +29,8 @@ export interface InstalledSkillRecord {
     id: string;
     source: MarketSource | 'local';
     slug: string;
+    /** Registry author recorded at install time, when known. */
+    owner?: string;
     name: string;
     dirName: string;
     dirPath: string;
@@ -43,6 +45,10 @@ export interface InstalledSkillRecord {
 /** List query accepted by `GET /api/skills-hub/skills`. */
 export interface MarketQuery {
     q?: string;
+    /** `catalog` (default): the curated list. `market`: live upstream search. */
+    scope?: 'catalog' | 'market';
+    /** Catalogue category key; `'all'` (or absent) means no category filter. */
+    category?: string;
     source: 'all' | MarketSource;
     security: 'all' | SecurityStatus;
     installed: 'all' | 'installed' | 'installable';
@@ -71,15 +77,18 @@ export declare function isAbortError(error: unknown): boolean;
 export declare function fetchMarketList(query: MarketQuery, signal?: AbortSignal, options?: {
     refresh?: boolean;
 }): Promise<MarketListResult>;
+/** The category bar's entries (curated catalogue), with the snapshot's provenance. */
+export declare function fetchMarketCategories(signal?: AbortSignal): Promise<MarketCategoriesResult>;
 /** One skill's full detail plus the health of the source that served it. */
 export declare function fetchSkillDetail(id: string, signal?: AbortSignal, options?: {
     refresh?: boolean;
+    owner?: string;
 }): Promise<{
     skill: NormalizedSkillDetail;
     sourceStatus: SourceStatusInfo;
 }>;
 /** One file of a skill, for the Files tab. */
-export declare function fetchSkillFile(id: string, path: string, signal?: AbortSignal): Promise<MarketFileContent>;
+export declare function fetchSkillFile(id: string, path: string, signal?: AbortSignal, owner?: string): Promise<MarketFileContent>;
 /** Health of every market source, refreshed independently of the list. */
 export declare function fetchSourceStatus(signal?: AbortSignal): Promise<Record<MarketSource, SourceStatusInfo>>;
 /**
@@ -89,7 +98,7 @@ export declare function fetchSourceStatus(signal?: AbortSignal): Promise<Record<
  */
 export declare function fetchInstalled(signal?: AbortSignal): Promise<InstalledSkillRecord[]>;
 /** Install a market skill into the local skills directory. */
-export declare function installSkill(id: string): Promise<{
+export declare function installSkill(id: string, owner?: string): Promise<{
     installedPath: string;
     skill: NormalizedSkill;
 }>;

package/lib/types/client/components/CategoryBar.d.ts

@@ -0,0 +1,13 @@
+import type { MarketCategory } from '../../market/types.ts';
+/**
+ * Category chips above the curated catalogue.
+ *
+ * The categories are the catalogue's own, so every chip has skills behind it
+ * and its count is exact. Rendered only once they loaded.
+ */
+export declare function CategoryBar(props: {
+    categories: MarketCategory[];
+    active: string;
+    disabled: boolean;
+    onSelect: (category: string) => void;
+}): JSX.Element | null;