@nanmicoder/dsh-skills-hub 0.0.3 → 0.0.5

package/CONTRIBUTING.md

@@ -15,15 +15,15 @@ Commit regenerated `lib/` with source changes because Git installations consume
 For CLI users and local development, install a specific published version:
 
 ```sh
-dsh plugin --profile desktop add @nanmicoder/dsh-skills-hub@0.0.3
+dsh plugin --profile desktop add @nanmicoder/dsh-skills-hub@0.0.5
 ```
 
-Replace `desktop` with the target profile. To test a local source build:
+The `desktop` command requires the CLI bundled with the desktop installation. With the npm-installed CLI, replace `desktop` with a supported profile such as `web`. To test a local source build:
 
 ```sh
 pnpm install --frozen-lockfile
 pnpm pack --pack-destination artifacts
-dsh plugin --profile desktop add ./artifacts/nanmicoder-dsh-skills-hub-0.0.3.tgz
+dsh plugin --profile desktop add ./artifacts/nanmicoder-dsh-skills-hub-0.0.5.tgz
 ```
 
 Fully quit and reopen the target Harness instance after a CLI install. Advanced configuration is documented in [CONFIGURATION.md](./docs/CONFIGURATION.md).

package/README.md

@@ -19,7 +19,7 @@
 
 搜索 ClawHub 和 SkillHub 中的技能，阅读使用说明，再安装到 Harness。市场安装的技能和本机已有技能，都可以在「已安装技能」中查看和管理。
 
-当前版本：**0.0.3**。首页改为 398 个精选技能、13 个分类，详情页重新设计，并能说明技能安装后会做什么。[更新说明](./release-notes/v0.0.3.md)
+当前版本：**0.0.5**，适配 **DeepSeek Harness 0.2.1-rc.1 / rc.2**，修复 rc.2 安装兼容性，保留精选清单、预览和技能管理功能。[更新说明](./release-notes/v0.0.5.md)
 
 <p align="center">
   <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub 技能市场：分类、搜索、筛选和精选技能卡片。">
@@ -28,34 +28,38 @@
 | 功能 | 说明 |
 | --- | --- |
 | **精选清单** | 398 个 ClawHub 与 SkillHub 热门技能，按 13 个分类整理，随插件发布，打开即看。 |
-| **实时搜索** | 输入关键词即搜索两个市场的全部技能，同名技能按作者区分。 |
+| **实时搜索** | 先搜索精选清单，再点击「在全部市场中搜索」查询两个市场；ClawHub 详情与安装按作者定位。 |
 | **安装前预览** | 阅读说明和文件，查看上游安全扫描，以及技能会执行的命令、读取的密钥和访问的网络。 |
 | **管理已安装技能** | 搜索本机技能，查看来源与安装位置，确认后卸载。 |
 | **本地缓存** | 缓存已浏览的分页、详情和文件预览，重启后继续使用。 |
 
 ## 快速开始
 
-适用于 **DeepSeek Harness 0.2.0-rc.2**。[兼容版本](./docs/COMPATIBILITY.md)
+适用于 **DeepSeek Harness 0.2.1-rc.1 / rc.2**。[兼容版本](./docs/COMPATIBILITY.md)
 
-打开 **DeepSeek Harness 桌面端 → 插件 → 添加插件**，粘贴以下任意一种内容：
+打开 **DeepSeek Harness 桌面端 → 插件 → 添加插件**，将「安装源」切换为 **官方 npm 源**，再粘贴以下任意一种内容：
 
-**GitHub 仓库地址（推荐）**
+大陆镜像可能尚未同步新版本，出现「未找到相关插件」或解析到旧版时，请先切换安装源。切换 GitHub 的 Latest 标记不会刷新 npm 镜像。
+
+**npm 包名（推荐，固定版本）**
 
 ```text
-https://github.com/NanmiCoder/dsh-skills-hub
+@nanmicoder/dsh-skills-hub@0.0.5
 ```
 
-**或 npm 包名**
+**或 GitHub 仓库地址**
 
 ```text
-@nanmicoder/dsh-skills-hub@0.0.3
+https://github.com/NanmiCoder/dsh-skills-hub
 ```
 
-点击 **安装 → 立即启用**，然后从侧栏进入 **技能市场**。
+点击 **安装 → 立即启用**，然后从侧栏进入 **技能市场**。更新后若宿主提示重启，请完全退出再重新打开。
+
+仍使用 **Harness 0.2.0-rc.2** 时，请安装 `@nanmicoder/dsh-skills-hub@0.0.3`；0.0.5 仅声明支持 0.2.1-rc.1 和 0.2.1-rc.2，不包含尚未验证的后续宿主版本。
 
 ## 使用
 
-1. **查找**：按分类浏览精选清单，或输入关键词搜索全部技能。
+1. **查找**：按分类浏览或搜索精选清单，需要更多结果时点击「在全部市场中搜索」。
 2. **预览**：打开技能，查看说明和文件内容。
 3. **安装与管理**：确认安装后，到「已安装技能」中查看或卸载。
 
@@ -67,4 +71,13 @@ https://github.com/NanmiCoder/dsh-skills-hub
 
 卸载前会显示具体位置，供你确认。若只想移除 Skills Hub 插件，在桌面端 **插件** 页面打开 **@nanmicoder/dsh-skills-hub**，点击 **卸载**；已安装的技能会保留。
 
+## 致谢与版权
+
+Skills Hub 的技能全部来自 [ClawHub](https://clawhub.ai) 和 [SkillHub](https://skillhub.cn)。感谢这两个平台的维护者，以及在上面发布技能的每一位作者。本插件只是让你在 Harness 里更方便地找到并安装这些技能。
+
+- **技能版权归原作者所有**，以每个技能自己声明的许可证为准。本仓库的 MIT 许可证只适用于 Skills Hub 插件自身的代码，不适用于任何技能。
+- **安装时从上游实时下载**。本仓库不托管、不转售任何技能内容。随插件发布的精选清单只包含名称、简介、分类和下载数等索引信息，用于展示，并附带指向原始页面的链接。
+- **ClawHub、SkillHub 及其标识归各自所有者所有**。Skills Hub 是独立的社区项目，与 ClawHub、SkillHub 及 DeepSeek 均无隶属或背书关系。
+- 如果你是技能作者或平台方，希望调整或移除展示的信息，请[提交 issue](https://github.com/NanmiCoder/dsh-skills-hub/issues)，我们会尽快处理。
+
 [反馈问题](https://github.com/NanmiCoder/dsh-skills-hub/issues) · [高级配置](./docs/CONFIGURATION.md) · [参与开发](./CONTRIBUTING.md) · [MIT 许可证](./LICENSE)

package/README_EN.md

@@ -19,7 +19,7 @@
 
 Search ClawHub and SkillHub, read a skill’s instructions, and install it into Harness. Manage marketplace installations and existing local skills together in **Installed**.
 
-Current version: **0.0.3**. The home page now opens on 398 curated skills in 13 categories, with a redesigned detail page that explains what a skill will do once installed. [Release notes](./release-notes/v0.0.3.md)
+Current version: **0.0.5**, targeting **DeepSeek Harness 0.2.1-rc.1 / rc.2**. This release fixes rc.2 installation compatibility while retaining the curated catalogue, previews and skill management. [Release notes](./release-notes/v0.0.5.md)
 
 <p align="center">
   <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub marketplace with categories, search, filters and curated skill cards.">
@@ -28,34 +28,38 @@ Current version: **0.0.3**. The home page now opens on 398 curated skills in 13
 | Feature | What it does |
 | --- | --- |
 | **Curated catalogue** | 398 popular ClawHub and SkillHub skills in 13 categories, shipped with the plugin and shown instantly. |
-| **Live search** | Type a keyword to search every skill on both marketplaces; same-name skills are told apart by author. |
+| **Live search** | Search the curated catalogue first, then choose the all-market search action; ClawHub details and installations are pinned to the author. |
 | **Preview before installing** | Read instructions and files, check upstream scans, and see the commands, secrets and network hosts a skill uses. |
 | **Manage installed skills** | Search local skills, inspect their source and installation path, and confirm removal. |
 | **Local cache** | Reuse browsed pages, details and file previews across desktop restarts. |
 
 ## Quick start
 
-Supports **DeepSeek Harness 0.2.0-rc.2**. [Compatible versions](./docs/COMPATIBILITY.md)
+Supports **DeepSeek Harness 0.2.1-rc.1 / rc.2**. [Compatible versions](./docs/COMPATIBILITY.md)
 
-Open **DeepSeek Harness desktop → Plugins → Add plugin** and paste either of the following:
+Open **DeepSeek Harness desktop → Plugins → Add plugin**, select the **official npm registry** as the installation source, and paste either of the following:
 
-**GitHub repository URL (recommended)**
+The mainland mirror may lag behind new releases. If the plugin is not found or an older version is selected, switch registries first. Changing GitHub’s Latest release does not refresh npm mirrors.
+
+**npm package name (recommended, pinned version)**
 
 ```text
-https://github.com/NanmiCoder/dsh-skills-hub
+@nanmicoder/dsh-skills-hub@0.0.5
 ```
 
-**Or the npm package name**
+**Or the GitHub repository URL**
 
 ```text
-@nanmicoder/dsh-skills-hub@0.0.3
+https://github.com/NanmiCoder/dsh-skills-hub
 ```
 
-Click **Install → Enable now**, then open **Skills Hub** from the sidebar.
+Click **Install → Enable now**, then open **Skills Hub** from the sidebar. If the host requests a restart after updating, fully quit and reopen it.
+
+For **Harness 0.2.0-rc.2**, use `@nanmicoder/dsh-skills-hub@0.0.3`. Version 0.0.5 declares support only for 0.2.1-rc.1 and 0.2.1-rc.2; later untested host versions are not included.
 
 ## Use
 
-1. **Find**: browse the curated catalogue by category, or enter a keyword to search every skill.
+1. **Find**: browse or search the curated catalogue, then choose the all-market search action for more results.
 2. **Preview**: open a skill to read its instructions and inspect its files.
 3. **Install and manage**: confirm installation, then find or remove it in **Installed**.
 
@@ -67,4 +71,13 @@ Use **Installed** to view and remove marketplace installations and existing loca
 
 The removal dialog shows the exact location for you to confirm. To remove Skills Hub itself, open **@nanmicoder/dsh-skills-hub** on the desktop **Plugins** page and click **Uninstall**. Your installed skills will remain.
 
+## Acknowledgements and copyright
+
+Every skill in Skills Hub comes from [ClawHub](https://clawhub.ai) or [SkillHub](https://skillhub.cn). Thanks to the people who run both platforms and to every author who publishes there. This plugin only makes their skills easier to find and install from Harness.
+
+- **Skills belong to their authors** and are governed by each skill's own license. This repository's MIT license covers the Skills Hub plugin code only, not any skill.
+- **Skills are downloaded from upstream at install time.** This repository does not host or resell skill content. The curated list shipped with the plugin contains only index information (name, summary, category, download counts) for display, with links back to the original pages.
+- **ClawHub, SkillHub and their marks belong to their respective owners.** Skills Hub is an independent community project, not affiliated with or endorsed by ClawHub, SkillHub or DeepSeek.
+- Authors or platform operators who want displayed information changed or removed can [open an issue](https://github.com/NanmiCoder/dsh-skills-hub/issues), and we'll handle it promptly.
+
 [Report an issue](https://github.com/NanmiCoder/dsh-skills-hub/issues) · [Advanced configuration](./docs/CONFIGURATION.md) · [Contribute](./CONTRIBUTING.md) · [MIT license](./LICENSE)

package/README_ZH.md

@@ -2,6 +2,6 @@
 
 中文文档已成为仓库默认首页，请查看 [README.md](./README.md)。
 
-当前版本：**0.0.3**。[更新说明](./release-notes/v0.0.3.md)
+当前版本：**0.0.5**。[更新说明](./release-notes/v0.0.5.md)
 
 [English documentation](./README_EN.md)

package/compatibility.json

@@ -1,10 +1,13 @@
 {
   "schemaVersion": 1,
-  "pluginVersion": "0.0.3",
-  "recommendedHost": "0.2.0-rc.2",
-  "hostTag": "dsh-v0.2.0-rc.2",
-  "hostCommit": "639ed015397290b3745d163aafe02ffee4aa3f84",
-  "desktopReleaseLine": "0.2.0",
+  "pluginVersion": "0.0.5",
+  "recommendedHost": "0.2.1-rc.2",
+  "hostTag": "dsh-v0.2.1-rc.2",
+  "hostCommit": "687f282e8625c6b8d11ff58211a90524be2e4317",
+  "desktopReleaseLine": "0.2.1",
   "previewTag": "next",
-  "supportedHosts": ["0.2.0-rc.2"]
+  "supportedHosts": [
+    "0.2.1-rc.1",
+    "0.2.1-rc.2"
+  ]
 }

package/docs/COMPATIBILITY.md

@@ -1,6 +1,6 @@
 # Harness compatibility
 
-The build and peer dependency baseline is **`0.2.0-rc.2`** for every `@deepseek-ai/dsh-*` package. The source reference is tag `dsh-v0.2.0-rc.2`, commit `639ed015397290b3745d163aafe02ffee4aa3f84` in `deepseek-ai/deepseek-harness`. These are the precise package coordinates behind the requested desktop 0.2.0 release line; an untagged future `0.2.0` package is not silently covered.
+The build dependency baseline is **`0.2.1-rc.2`** for every `@deepseek-ai/dsh-*` package. Peer dependencies explicitly accept **`0.2.1-rc.1 || 0.2.1-rc.2`**. The source reference is tag `dsh-v0.2.1-rc.2`, commit `687f282e8625c6b8d11ff58211a90524be2e4317` in `deepseek-ai/deepseek-harness`. An untagged future `0.2.1` package is not silently covered.
 
 The referenced packages were confirmed on npm. A clean install resolves one cohort, with `autoInstallPeers: false`; missing host peers used by development packages are explicitly provided at the same version. No local workspace overrides or private filesystem paths are needed.
 
@@ -20,6 +20,34 @@ Use the exact source tag or installed desktop cohort, a temporary `DSH_HOME`, an
 
 `pnpm pack:check` covers static typing, source and manifest contracts, regression tests, clean build, release metadata and tarball import closure. It does not by itself certify a running desktop session or upstream network availability. Future host cohorts must repeat this acceptance before widening peer ranges.
 
+## 0.0.5 / Harness 0.2.1-rc.2 acceptance — 2026-10-18
+
+The reported desktop was already 0.2.1-rc.2. Official npm served plugin 0.0.4 (rc.1-only peers), while the mainland mirror still served latest 0.0.3 and had no 0.0.4 metadata. These are separate causes: switching registry cannot make an incompatible peer range compatible.
+
+Compared upstream tags rc.1 and rc.2 at the source reference above: no source changes in the consumed connection, locale, UI slots/layout/primitives/sidebar, host webserver, skill filesystem or home paths packages. The runtime bundles rebuild unchanged. Development dependencies now use one exact rc.2 cohort; peers retain rc.1 and explicitly add rc.2 rather than an open-ended range.
+
+`pnpm pack:check` passed all 97 tests, types, clean build, release metadata and tarball closure checks. Acceptance used the published npm rc.2 host with all Harness dependencies pinned to rc.2, macOS arm64 / Node 26.7.0, a packed 0.0.5 plugin and disposable home/agents directories. The host CLI accepted the tarball. Ego Lite verified the market mount, weather search, live Weather installation, installed detail with rendered Markdown and two files, and confirmed uninstall returning the inventory to zero; the skill directory was also removed. The same tarball was accepted by the rc.1 host CLI; the unchanged runtime's rc.1 UI coverage is recorded below. Native Electron packaging and Windows/Linux were not tested.
+
+This is release preparation, not publication. The plugin is intended for npm `latest` after merge. A GitHub Release marker does not update npm mirror metadata; README now directs users to the official registry when versions are missing or stale.
+
+## 0.0.4 / Harness 0.2.1-rc.1 acceptance — 2026-10-17
+
+Target: [official release `dsh-v0.2.1-rc.1`](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.1), commit `1600d8a1e140dcde43a1a0941940a0480712c011`. The supplied source checkout was clean at that tag and was used only as reference. Plugin validation used the working changes on base commit `990840138d22d681f46e54fd2e876f0d6acd8398`; it was not a published release commit.
+
+All Harness development packages and peers now target the exact new cohort. Cordis and Schemastery development versions are 4.0.5 and 3.18.5. The upstream source no longer contains `dsh-invariants`, and npm has no 0.2.1-rc.1 release of that retired package; the unused development dependency was removed. The slot registrations, module factory and user skill roots remain compatible. The HTTP trust predicate now imports the actual host type instead of casting its numeric status to a boolean contract.
+
+The unchanged baseline passed 96 tests on the old cohort. After migration, `pnpm install --frozen-lockfile` and `pnpm pack:check` passed, including 97 tests, typechecking, regenerated `lib/`, metadata and tarball closure checks. The new integration test uses real Cordis, WebServer and HostConnectionService instances (only cookie verification is a fixture), verifies 401/403/200 responses, route disposal and reactivation. The lockfile contains no old Harness cohort or local source override.
+
+Runtime acceptance used the published npm `@deepseek-ai/dsh@0.2.1-rc.1`, with all 293 installed Harness packages pinned to that cohort, on macOS arm64 / Node 26.7.0. The plugin tarball was installed through `dsh plugin --profile web add <tarball>`, then booted through `dsh web --no-open --port 0`, using disposable `DSH_HOME` and `DSH_AGENTS_HOME`. Ego Lite drove the real host browser UI:
+
+- The sidebar entry mounted the curated home with 398 skills and 13 categories.
+- Searching for weather returned the curated results; opening Weather showed a loading skeleton, live ClawHub detail, rendered Markdown and its two-file inventory.
+- Confirmed installation wrote the two files and the `steipete` owner sidecar to the isolated skills root. The Installed page showed the actual local copy. Confirmed removal from its detail returned the inventory to zero and deleted the directory.
+- A disposable Markdown skill under the isolated shared agents root appeared after refresh. Its detail rendered a GFM table; confirmed local removal deleted that directory too.
+- Light mode and a 1000px-wide dark host window rendered without horizontal viewport overflow.
+
+Screenshots and runtime logs are local-only under ignored `artifacts/`. This verifies the published host's shared Web surface and plugin protocol. Native Electron packaging, Windows/Linux runtime acceptance, and model-driven skill invocation were not exercised. No package publication, tag push or active user-profile modification was performed. Historical records below describe older plugin revisions, not an additional supported peer range for 0.0.4.
+
 ## 0.0.1 acceptance record — 2026-09-30
 
 Validation used the published npm `@deepseek-ai/dsh@0.2.0-rc.2` runtime with every Harness dependency overridden to the same cohort, on macOS arm64 / Node 26.7.0. The plugin was installed from its npm tarball into a disposable Web profile, with isolated `DSH_HOME` and `DSH_AGENTS_HOME`. The complete published host started without startup warnings. The earlier source-checkout trial lacked unrelated built host packages and is not the compatibility evidence.

package/docs/CONTRACT.md

@@ -1,10 +1,10 @@
-# Skills Hub 0.0.3 implementation contract
+# Skills Hub 0.0.5 implementation contract
 
 This document describes the shipped code, not a migration plan. The TypeScript models in `src/market/types.ts`, `src/skills/installed.ts` and `src/client/api.ts` define the detailed wire shapes. Update this document with API changes.
 
 ## 1. Package and host
 
-The package is `@nanmicoder/dsh-skills-hub`, version `0.0.3`. Its supported host package cohort is exactly `0.2.0-rc.2`; the desktop release line is 0.2.0. The exact upstream tag and commit are recorded in `compatibility.json` and [COMPATIBILITY.md](COMPATIBILITY.md).
+The package is `@nanmicoder/dsh-skills-hub`, version `0.0.5`. Its supported host package cohorts are exactly `0.2.1-rc.1` and `0.2.1-rc.2`; the desktop release line is 0.2.1. The exact upstream tag and commit are recorded in `compatibility.json` and [COMPATIBILITY.md](COMPATIBILITY.md).
 
 `cordis.patch.yml` inserts one row (`id: skills-hub`) named after the scoped package. `lib/index.js` is the host entry. `lib/client.js` is the browser factory registered with `window.__ModuleLoader__.load` under that same package name. The plugin adds a global sidebar panel and does not replace built-in components or require an agent session.
 
@@ -73,7 +73,7 @@ Current market limits are 5 MiB per file, 20 MiB total and 200 files per install
 
 ### 5.1 Transport and validation
 
-One host prefix route serves the endpoints below. Responses are JSON with `Cache-Control: no-store`. Failures use `{ "error": { "code": "…", "message": "…" } }` and an appropriate non-2xx status. Methods, route depth, IDs, enum filters, body sizes and paths are validated. The connection gate can reject requests with 401/403.
+One host prefix route serves the endpoints below. Responses are JSON with `Cache-Control: no-store`. Failures use `{ "error": { "code": "…", "message": "…" } }` and an appropriate non-2xx status. Methods, route depth, IDs, enum filters, body sizes and paths are validated. The connection gate uses the host `HostConnectionService.requestRejection(request)` type directly: `undefined` admits the request, 401 rejects missing authentication and 403 rejects an untrusted authority/origin. The service is still resolved for each request.
 
 The browser surfaces transport failures as `NETWORK_ERROR`; invalid successful JSON becomes `MARKET_UPSTREAM_BAD_RESPONSE`. Aborted superseded reads are control flow and must not appear as user-visible errors.
 

package/docs/RELEASE.md

@@ -1,6 +1,6 @@
-# Release 0.0.3
+# Release 0.0.5
 
-Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.3`. npm channel: `latest`. This plugin release is independent of the host's `0.2.0-rc.2` version and retains that exact compatibility cohort.
+Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.5`. npm channel: `latest`. This plugin release is independent of the host version and supports the exact `0.2.1-rc.1` and `0.2.1-rc.2` cohorts.
 
 ## Before publication
 
@@ -11,7 +11,7 @@ Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`.
 
 ## GitHub Actions publication
 
-Publication runs online in `.github/workflows/release.yml`, matching the AgentTeams release model. Push `v0.0.3` to trigger it, or dispatch the workflow with an explicit version. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
+Publish after the compatibility PR is merged into `main`. Revalidate the merged commit, then create and push `v0.0.5` from that commit to run `.github/workflows/release.yml`. Creating the PR alone does not publish. A manual workflow dispatch with version `0.0.5` also publishes npm, but the GitHub Release job runs only for a tag push; prefer the tag flow for the complete release. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
 
 Configure npm Trusted Publishing for GitHub owner `NanmiCoder`, repository `dsh-skills-hub`, workflow `release.yml`, environment `npm`, allowing direct publication. OIDC uses `id-token: write`; routine releases need no local npm login and no stored npm token. The existing AgentTeams trust binding is package-specific and does not authorize this new package.
 
@@ -21,4 +21,4 @@ Before tagging, commit all source and generated artifacts, confirm the version a
 
 ## After publication / recovery
 
-Install `@nanmicoder/dsh-skills-hub@0.0.3` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.
+Install `@nanmicoder/dsh-skills-hub@0.0.5` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.

package/lib/types/web-routes.d.ts

@@ -16,6 +16,7 @@
  *    otherwise be reachable by a cross-site request or a DNS-rebound page.
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { HostConnectionService } from '@deepseek-ai/dsh-client-connection';
 /** Path prefix of the whole Skills Hub API. */
 export declare const ROUTE_PREFIX = "/api/skills-hub";
 /** Structural Web server contract (mirrors `WebServer.register`). */
@@ -33,18 +34,8 @@ export interface SkillsHubRoutesDeps {
     /** Initial local inventory scan, required before annotating persisted data. */
     ready?: () => Promise<void>;
 }
-/**
- * Browser-trust gate, structurally equal to the frozen contract's predicate.
- *
- * The real `HostConnectionService.requestRejection` returns `401 | 403 |
- * undefined` rather than a boolean (see
- * `@deepseek-ai/dsh-client-connection/lib/types/rpc.d.ts`), so this plugin
- * accepts both shapes: see {@link evaluateGate} for why the numeric form is
- * worth preserving.
- */
-export interface SkillsHubRequestGate {
-    requestRejection(req: IncomingMessage, res: ServerResponse): boolean;
-}
+/** Use the host's actual trust predicate; this import is erased from the runtime. */
+export type SkillsHubRequestGate = Pick<HostConnectionService, 'requestRejection'>;
 /**
  * Resolves the gate for one request.
  *

package/lib/web-routes.js

@@ -117,19 +117,9 @@ function sendFailure(res, error) {
     const failure = toHttpFailure(error);
     sendJson(res, failure.status, errorPayload(failure.code, failure.message), failure.allow === undefined ? undefined : { allow: failure.allow });
 }
-/**
- * Run the browser-trust gate and return the rejection status, if any.
- *
- * The frozen gate type says `boolean`, the real service answers `401 | 403 |
- * undefined`; both are accepted so the envelope can report the true status when
- * the plugin is wired to the real Connection service, while a plain predicate
- * still works.
- */
-function evaluateGate(gate, req, res) {
-    const outcome = gate.requestRejection(req, res);
-    if (outcome === undefined || outcome === false || outcome === null)
-        return undefined;
-    return typeof outcome === 'number' ? outcome : 403;
+/** Preserve the host's authentication (401) and origin (403) rejections. */
+function evaluateGate(gate, req) {
+    return gate.requestRejection(req);
 }
 /**
  * Read a bounded JSON object body.
@@ -386,7 +376,7 @@ async function handle(req, res, gate, deps) {
     // leaving the whole marketplace readable and installable from any web page.
     const resolvedGate = gate();
     if (resolvedGate !== undefined) {
-        const rejection = evaluateGate(resolvedGate, req, res);
+        const rejection = evaluateGate(resolvedGate, req);
         if (rejection !== undefined) {
             sendJson(res, rejection, errorPayload(rejection === 401 ? 'UNAUTHORIZED' : 'FORBIDDEN', rejection === 401 ? 'unauthorized' : 'forbidden'));
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanmicoder/dsh-skills-hub",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Skills Hub for DeepSeek Harness: browse, preview, install and remove third-party skills from ClawHub and SkillHub inside the DSH Web GUI.",
   "type": "module",
   "main": "lib/index.js",
@@ -62,14 +62,14 @@
     "pack:check": "pnpm check && node scripts/pack-check.mjs"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-client-connection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "~3.18.5",
     "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
@@ -102,24 +102,23 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.4",
-    "@deepseek-ai/dsh-client-connection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-store": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-invariants": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-skill": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-skill-filesystem": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "3.18.4",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-store": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill-filesystem": "0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "3.18.5",
     "@types/node": "^24.13.3",
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.7",

package/release-notes/v0.0.4.md

@@ -0,0 +1,11 @@
+# Skills Hub 0.0.4
+
+`@nanmicoder/dsh-skills-hub` for DeepSeek Harness **0.2.1-rc.1**.
+
+- Move the exact Harness dependency and peer cohort to `0.2.1-rc.1`, with Cordis 4.0.5 and Schemastery 3.18.5. Remove the retired `dsh-invariants` development dependency.
+- Type the HTTP trust gate against the host connection service, preserving authentication (401) and origin (403) rejection statuses without an unchecked boolean adapter.
+- Retain the existing sidebar, curated catalogue, Markdown previews, persistent cache and skill installation/removal flows.
+
+This release targets the exact candidate host version; it does not claim compatibility with an unreleased stable 0.2.1. See [COMPATIBILITY.md](../docs/COMPATIBILITY.md) for validation evidence and limitations.
+
+After publication, install `@nanmicoder/dsh-skills-hub@0.0.4` from the host plugin manager. Release preparation does not publish the package.

package/release-notes/v0.0.5.md

@@ -0,0 +1,9 @@
+# Skills Hub 0.0.5
+
+Fix installation on DeepSeek Harness **0.2.1-rc.2**, retaining support for **0.2.1-rc.1**. Version 0.0.4 declared only rc.1, so rc.2 hosts rejected it during compatibility validation.
+
+- Develop against the exact rc.2 cohort and allow both verified candidate host versions in peer dependencies.
+- Document selecting the official npm registry: mainland mirror metadata can remain on 0.0.3 and cannot resolve newer versions until synchronized.
+- Continue publishing stable plugin releases to npm `latest`; host candidate versions and plugin publication channels are separate.
+
+After publication, select the official npm source in Add plugin and install `@nanmicoder/dsh-skills-hub@0.0.5`. Existing skills are preserved. This does not claim support for future untested host versions.