@nanmicoder/dsh-skills-hub 0.0.2 → 0.0.4

package/lib/web-routes.js

@@ -1,7 +1,7 @@
 /**
  * Skills Hub HTTP surface.
  *
- * One `prefix` route (`/api/skills-hub`) owns the seven endpoints the panel
+ * One `prefix` route (`/api/skills-hub`) owns the endpoints the panel
  * needs; every response is JSON with `Cache-Control: no-store`, because the
  * panel polls and every payload is either live upstream data or live disk state.
  *
@@ -16,8 +16,9 @@
  *    otherwise be reachable by a cross-site request or a DNS-rebound page.
  */
 import { installMarketSkill, MarketInstallError, uninstallMarketSkill, } from "./market/install-service.js";
-import { getMarketFileContent, getMarketSkillDetail, getMarketStatus, isValidMarketFilePath, listMarketSkills, } from "./market/market-service.js";
+import { getMarketFileContent, getMarketSkillDetail, getMarketStatus, isValidMarketFilePath, listMarketCategories, listMarketSkills, } from "./market/market-service.js";
 import { getMarketStats } from "./market/cache.js";
+import { CLAWHUB_OWNER_PATTERN } from "./market/clawhub-provider.js";
 import { readInstalledFile, readInstalledSkill, removeInstalledSkill } from "./skills/management.js";
 import { scanInstalledSkills } from "./skills/installed.js";
 import { resolveSkillsScanRoots } from "./skills/root.js";
@@ -116,19 +117,9 @@ function sendFailure(res, error) {
     const failure = toHttpFailure(error);
     sendJson(res, failure.status, errorPayload(failure.code, failure.message), failure.allow === undefined ? undefined : { allow: failure.allow });
 }
-/**
- * Run the browser-trust gate and return the rejection status, if any.
- *
- * The frozen gate type says `boolean`, the real service answers `401 | 403 |
- * undefined`; both are accepted so the envelope can report the true status when
- * the plugin is wired to the real Connection service, while a plain predicate
- * still works.
- */
-function evaluateGate(gate, req, res) {
-    const outcome = gate.requestRejection(req, res);
-    if (outcome === undefined || outcome === false || outcome === null)
-        return undefined;
-    return typeof outcome === 'number' ? outcome : 403;
+/** Preserve the host's authentication (401) and origin (403) rejections. */
+function evaluateGate(gate, req) {
+    return gate.requestRejection(req);
 }
 /**
  * Read a bounded JSON object body.
@@ -248,6 +239,30 @@ function enumQuery(url, name, allowed, fallback) {
         return raw;
     throw new RouteError(400, 'BAD_REQUEST', `Invalid ${name} filter: ${raw}`);
 }
+/** Shape of a catalogue category key. */
+const CATEGORY_KEY_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/** `category` query parameter: a catalogue category key, shape-checked only. */
+function parseCategory(url) {
+    const raw = url.searchParams.get('category');
+    if (raw === null || raw === '' || raw === 'all')
+        return undefined;
+    if (!CATEGORY_KEY_PATTERN.test(raw))
+        throw new RouteError(400, 'BAD_REQUEST', `Invalid category: ${raw}`);
+    return raw;
+}
+/**
+ * Optional registry owner. ClawHub slugs are shared across authors, so the
+ * panel names the author of the card it opened; a malformed owner is refused
+ * rather than silently dropped (that would fall back to guessing).
+ */
+function parseOwner(raw) {
+    if (raw === undefined || raw === null || raw === '')
+        return undefined;
+    if (typeof raw !== 'string' || !CLAWHUB_OWNER_PATTERN.test(raw)) {
+        throw new RouteError(400, 'BAD_REQUEST', `Invalid owner: ${String(raw)}`);
+    }
+    return raw;
+}
 /** `limit` query parameter, clamped into the documented range. */
 function parseLimit(url) {
     const raw = url.searchParams.get('limit');
@@ -293,6 +308,8 @@ async function handleStats(res) {
 async function handleList(url, res) {
     const params = {
         q: optionalQuery(url, 'q', MAX_QUERY_LENGTH),
+        scope: enumQuery(url, 'scope', ['catalog', 'market'], 'catalog'),
+        category: parseCategory(url),
         source: enumQuery(url, 'source', ['all', ...MARKET_SOURCES], 'all'),
         security: enumQuery(url, 'security', ['all', ...SECURITY_FILTERS], 'all'),
         installed: enumQuery(url, 'installed', INSTALLED_FILTERS, 'all'),
@@ -303,15 +320,20 @@ async function handleList(url, res) {
     const result = await listMarketSkills(params);
     sendJson(res, 200, result);
 }
+async function handleCategories(res) {
+    sendJson(res, 200, listMarketCategories());
+}
 async function handleDetail(source, slug, url, res) {
-    sendJson(res, 200, await getMarketSkillDetail(source, slug, { force: parseRefresh(url) }));
+    const owner = parseOwner(url.searchParams.get('owner'));
+    sendJson(res, 200, await getMarketSkillDetail(source, slug, { force: parseRefresh(url), owner }));
 }
 async function handleFile(source, slug, url, res) {
     const filePath = url.searchParams.get('path') ?? '';
     if (!isValidMarketFilePath(filePath)) {
         throw new RouteError(400, 'BAD_REQUEST', `Invalid file path: ${filePath}`);
     }
-    sendJson(res, 200, { file: await getMarketFileContent(source, slug, filePath) });
+    const owner = parseOwner(url.searchParams.get('owner'));
+    sendJson(res, 200, { file: await getMarketFileContent(source, slug, filePath, owner) });
 }
 /**
  * List installed skills from disk.
@@ -326,10 +348,12 @@ async function handleInstalled(deps, res) {
     sendJson(res, 200, { items: (await scanInstalledSkills(roots)).map(item => ({ ...item, removable: deps.allowUninstall() })) });
 }
 async function handleInstall(req, deps, res) {
-    const { source, slug } = parseBodyId(await readJsonBody(req));
+    const body = await readJsonBody(req);
+    const { source, slug } = parseBodyId(body);
     const result = await installMarketSkill(source, slug, {
         skillsRoot: await deps.skillsRoot(),
         allowUninstall: deps.allowUninstall(),
+        owner: parseOwner(body['owner']),
     });
     // Refresh before answering, so the next /skills or /installed call is correct.
     await deps.rescan().catch(() => undefined);
@@ -352,7 +376,7 @@ async function handle(req, res, gate, deps) {
     // leaving the whole marketplace readable and installable from any web page.
     const resolvedGate = gate();
     if (resolvedGate !== undefined) {
-        const rejection = evaluateGate(resolvedGate, req, res);
+        const rejection = evaluateGate(resolvedGate, req);
         if (rejection !== undefined) {
             sendJson(res, rejection, errorPayload(rejection === 401 ? 'UNAUTHORIZED' : 'FORBIDDEN', rejection === 401 ? 'unauthorized' : 'forbidden'));
             return;
@@ -368,6 +392,11 @@ async function handle(req, res, gate, deps) {
         await handleStatus(res);
         return;
     }
+    if (head === 'categories' && segments.length === 1) {
+        requireMethod(method, 'GET');
+        await handleCategories(res);
+        return;
+    }
     if (head === 'stats' && segments.length === 1) {
         requireMethod(method, 'GET');
         await handleStats(res);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanmicoder/dsh-skills-hub",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Skills Hub for DeepSeek Harness: browse, preview, install and remove third-party skills from ClawHub and SkillHub inside the DSH Web GUI.",
   "type": "module",
   "main": "lib/index.js",
@@ -62,14 +62,14 @@
     "pack:check": "pnpm check && node scripts/pack-check.mjs"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-client-connection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.1",
+    "@deepseek-ai/schemastery": "~3.18.5",
     "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
@@ -102,24 +102,23 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.4",
-    "@deepseek-ai/dsh-client-connection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-store": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-invariants": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-skill": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-skill-filesystem": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "3.18.4",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-skill": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-skill-filesystem": "0.2.1-rc.1",
+    "@deepseek-ai/schemastery": "3.18.5",
     "@types/node": "^24.13.3",
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.7",

package/release-notes/v0.0.3.md

@@ -0,0 +1,12 @@
+# Skills Hub 0.0.3
+
+`@nanmicoder/dsh-skills-hub` for DeepSeek Harness **0.2.0-rc.2**.
+
+- **Curated catalogue.** The home page now opens on 398 hand-picked skills from ClawHub and SkillHub, grouped into 13 categories (agents, research, development, office, productivity, content, media, data, marketing, finance, professional, life, security) with editor's picks first. The list ships with the plugin, so it renders instantly and offline; details, files and installs are still read live from upstream and cached. Searching switches to live results from both marketplaces.
+- **Redesigned detail page.** Header with downloads, installs, stars and file count; Overview, Files, Security and Changelog tabs; a rule-based "what this skill will do" panel (shell commands, hooks, secrets, network hosts, workspace writes, required binaries) and "when it triggers" list, both derived from the skill's own files; per-scanner security reports from upstream.
+- **Install confirmation.** The dialog lists what the skill will be able to do, where it will be installed, and requires an explicit acknowledgement for skills that are unscanned or flagged by upstream scanners.
+- **Same-name skills resolved by author.** ClawHub slugs can be shared by several authors. Details, file previews and installs are now pinned to the author shown on the card, live search shows one entry per slug, and a mirror is only folded into an original by the same author. Installed skills record their author.
+- **Unified look.** Marketplace home, detail pages and Installed share one visual system, and fit the docked 720px panel in light and dark themes.
+- Copy now states plainly that Skills Hub is a community plugin, not a DeepSeek product, and that the curated list is a recommendation rather than a security guarantee.
+
+Install in **DeepSeek Harness desktop → Plugins → Add plugin** using `@nanmicoder/dsh-skills-hub@0.0.3`, then enable the plugin. Existing skills and cache settings remain in place. Catalogue policy is documented in [CATALOG.md](../docs/CATALOG.md).

package/release-notes/v0.0.4.md

@@ -0,0 +1,11 @@
+# Skills Hub 0.0.4
+
+`@nanmicoder/dsh-skills-hub` for DeepSeek Harness **0.2.1-rc.1**.
+
+- Move the exact Harness dependency and peer cohort to `0.2.1-rc.1`, with Cordis 4.0.5 and Schemastery 3.18.5. Remove the retired `dsh-invariants` development dependency.
+- Type the HTTP trust gate against the host connection service, preserving authentication (401) and origin (403) rejection statuses without an unchecked boolean adapter.
+- Retain the existing sidebar, curated catalogue, Markdown previews, persistent cache and skill installation/removal flows.
+
+This release targets the exact candidate host version; it does not claim compatibility with an unreleased stable 0.2.1. See [COMPATIBILITY.md](../docs/COMPATIBILITY.md) for validation evidence and limitations.
+
+After publication, install `@nanmicoder/dsh-skills-hub@0.0.4` from the host plugin manager. Release preparation does not publish the package.

package/lib/types/client/components/InstallStateBadge.d.ts

@@ -1,11 +0,0 @@
-import type { InstallState } from '../../market/types.ts';
-/**
- * Local install state chip.
- *
- * The three labels come from dictionary keys the contract already fixes —
- * `installed`, `installed.installable` and `notInstallable` — so this badge
- * adds no vocabulary of its own.
- */
-export declare function InstallStateBadge(props: {
-    state: InstallState;
-}): JSX.Element;

package/lib/types/client/components/SecurityBadge.d.ts

@@ -1,16 +0,0 @@
-import type { SecurityReport, SecurityStatus } from '../../market/types.ts';
-/**
- * Audit verdict chip.
- *
- * Shows a shield for every verdict except `flagged`, which uses the warning
- * triangle: a scan that found something must not look like a scan that merely
- * ran, and shape reads faster than color alone.
- *
- * `reports` supplies the upstream status line for the hover title, so the chip
- * can stay a two-word summary without hiding what the vendor actually said.
- */
-export declare function SecurityBadge(props: {
-    status: SecurityStatus;
-    reports?: SecurityReport[];
-    compact?: boolean;
-}): JSX.Element;

package/lib/types/client/components/SkillDetailView.d.ts

@@ -1,19 +0,0 @@
-import type { NormalizedSkillDetail } from '../../market/types.ts';
-import type { MarketController, MarketState } from '../state.ts';
-/**
- * Market skill detail page.
- *
- * Like the home page this component owns no data: the tab, the selected file
- * and the file contents all live in `MarketState`, so switching tabs or
- * re-opening a skill does not lose its place. The reading surface itself — back
- * affordance, header, tabs, facts rail — is `SkillDetailShell`, which the local
- * installed page uses too.
- *
- * The bundled GFM renderer handles catalogue Markdown without relying on a
- * host renderer delegate. Raw HTML is disabled and URLs use its safe default.
- */
-export declare function SkillDetailView(props: {
-    detail: NormalizedSkillDetail;
-    state: MarketState;
-    controller: MarketController;
-}): JSX.Element;