@nanmicoder/dsh-skills-hub 0.0.4 → 0.0.5

package/CONTRIBUTING.md

@@ -15,7 +15,7 @@ Commit regenerated `lib/` with source changes because Git installations consume
 For CLI users and local development, install a specific published version:
 
 ```sh
-dsh plugin --profile desktop add @nanmicoder/dsh-skills-hub@0.0.4
+dsh plugin --profile desktop add @nanmicoder/dsh-skills-hub@0.0.5
 ```
 
 The `desktop` command requires the CLI bundled with the desktop installation. With the npm-installed CLI, replace `desktop` with a supported profile such as `web`. To test a local source build:
@@ -23,7 +23,7 @@ The `desktop` command requires the CLI bundled with the desktop installation. Wi
 ```sh
 pnpm install --frozen-lockfile
 pnpm pack --pack-destination artifacts
-dsh plugin --profile desktop add ./artifacts/nanmicoder-dsh-skills-hub-0.0.4.tgz
+dsh plugin --profile desktop add ./artifacts/nanmicoder-dsh-skills-hub-0.0.5.tgz
 ```
 
 Fully quit and reopen the target Harness instance after a CLI install. Advanced configuration is documented in [CONFIGURATION.md](./docs/CONFIGURATION.md).

package/README.md

@@ -19,7 +19,7 @@
 
 搜索 ClawHub 和 SkillHub 中的技能，阅读使用说明，再安装到 Harness。市场安装的技能和本机已有技能，都可以在「已安装技能」中查看和管理。
 
-当前版本：**0.0.4**，适配 **DeepSeek Harness 0.2.1-rc.1**，更新宿主依赖与请求鉴权接口，保留精选清单、预览和技能管理功能。[更新说明](./release-notes/v0.0.4.md)
+当前版本：**0.0.5**，适配 **DeepSeek Harness 0.2.1-rc.1 / rc.2**，修复 rc.2 安装兼容性，保留精选清单、预览和技能管理功能。[更新说明](./release-notes/v0.0.5.md)
 
 <p align="center">
   <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub 技能市场：分类、搜索、筛选和精选技能卡片。">
@@ -35,14 +35,16 @@
 
 ## 快速开始
 
-适用于 **DeepSeek Harness 0.2.1-rc.1**。[兼容版本](./docs/COMPATIBILITY.md)
+适用于 **DeepSeek Harness 0.2.1-rc.1 / rc.2**。[兼容版本](./docs/COMPATIBILITY.md)
 
-打开 **DeepSeek Harness 桌面端 → 插件 → 添加插件**，粘贴以下任意一种内容：
+打开 **DeepSeek Harness 桌面端 → 插件 → 添加插件**，将「安装源」切换为 **官方 npm 源**，再粘贴以下任意一种内容：
+
+大陆镜像可能尚未同步新版本，出现「未找到相关插件」或解析到旧版时，请先切换安装源。切换 GitHub 的 Latest 标记不会刷新 npm 镜像。
 
 **npm 包名（推荐，固定版本）**
 
 ```text
-@nanmicoder/dsh-skills-hub@0.0.4
+@nanmicoder/dsh-skills-hub@0.0.5
 ```
 
 **或 GitHub 仓库地址**
@@ -53,7 +55,7 @@ https://github.com/NanmiCoder/dsh-skills-hub
 
 点击 **安装 → 立即启用**，然后从侧栏进入 **技能市场**。更新后若宿主提示重启，请完全退出再重新打开。
 
-仍使用 **Harness 0.2.0-rc.2** 时，请安装 `@nanmicoder/dsh-skills-hub@0.0.3`；0.0.4 仅声明支持 0.2.1-rc.1，不包含尚未验证的后续宿主版本。
+仍使用 **Harness 0.2.0-rc.2** 时，请安装 `@nanmicoder/dsh-skills-hub@0.0.3`；0.0.5 仅声明支持 0.2.1-rc.1 和 0.2.1-rc.2，不包含尚未验证的后续宿主版本。
 
 ## 使用
 

package/README_EN.md

@@ -19,7 +19,7 @@
 
 Search ClawHub and SkillHub, read a skill’s instructions, and install it into Harness. Manage marketplace installations and existing local skills together in **Installed**.
 
-Current version: **0.0.4**, targeting **DeepSeek Harness 0.2.1-rc.1**. This release updates host dependencies and request authentication types while retaining the curated catalogue, previews and skill management. [Release notes](./release-notes/v0.0.4.md)
+Current version: **0.0.5**, targeting **DeepSeek Harness 0.2.1-rc.1 / rc.2**. This release fixes rc.2 installation compatibility while retaining the curated catalogue, previews and skill management. [Release notes](./release-notes/v0.0.5.md)
 
 <p align="center">
   <img src="./assets/readme/marketplace.png" width="100%" alt="Skills Hub marketplace with categories, search, filters and curated skill cards.">
@@ -35,14 +35,16 @@ Current version: **0.0.4**, targeting **DeepSeek Harness 0.2.1-rc.1**. This rele
 
 ## Quick start
 
-Supports **DeepSeek Harness 0.2.1-rc.1**. [Compatible versions](./docs/COMPATIBILITY.md)
+Supports **DeepSeek Harness 0.2.1-rc.1 / rc.2**. [Compatible versions](./docs/COMPATIBILITY.md)
 
-Open **DeepSeek Harness desktop → Plugins → Add plugin** and paste either of the following:
+Open **DeepSeek Harness desktop → Plugins → Add plugin**, select the **official npm registry** as the installation source, and paste either of the following:
+
+The mainland mirror may lag behind new releases. If the plugin is not found or an older version is selected, switch registries first. Changing GitHub’s Latest release does not refresh npm mirrors.
 
 **npm package name (recommended, pinned version)**
 
 ```text
-@nanmicoder/dsh-skills-hub@0.0.4
+@nanmicoder/dsh-skills-hub@0.0.5
 ```
 
 **Or the GitHub repository URL**
@@ -53,7 +55,7 @@ https://github.com/NanmiCoder/dsh-skills-hub
 
 Click **Install → Enable now**, then open **Skills Hub** from the sidebar. If the host requests a restart after updating, fully quit and reopen it.
 
-For **Harness 0.2.0-rc.2**, use `@nanmicoder/dsh-skills-hub@0.0.3`. Version 0.0.4 declares support only for 0.2.1-rc.1; later untested host versions are not included.
+For **Harness 0.2.0-rc.2**, use `@nanmicoder/dsh-skills-hub@0.0.3`. Version 0.0.5 declares support only for 0.2.1-rc.1 and 0.2.1-rc.2; later untested host versions are not included.
 
 ## Use
 

package/README_ZH.md

@@ -2,6 +2,6 @@
 
 中文文档已成为仓库默认首页，请查看 [README.md](./README.md)。
 
-当前版本：**0.0.4**。[更新说明](./release-notes/v0.0.4.md)
+当前版本：**0.0.5**。[更新说明](./release-notes/v0.0.5.md)
 
 [English documentation](./README_EN.md)

package/compatibility.json

@@ -1,10 +1,13 @@
 {
   "schemaVersion": 1,
-  "pluginVersion": "0.0.4",
-  "recommendedHost": "0.2.1-rc.1",
-  "hostTag": "dsh-v0.2.1-rc.1",
-  "hostCommit": "1600d8a1e140dcde43a1a0941940a0480712c011",
+  "pluginVersion": "0.0.5",
+  "recommendedHost": "0.2.1-rc.2",
+  "hostTag": "dsh-v0.2.1-rc.2",
+  "hostCommit": "687f282e8625c6b8d11ff58211a90524be2e4317",
   "desktopReleaseLine": "0.2.1",
   "previewTag": "next",
-  "supportedHosts": ["0.2.1-rc.1"]
+  "supportedHosts": [
+    "0.2.1-rc.1",
+    "0.2.1-rc.2"
+  ]
 }

package/docs/COMPATIBILITY.md

@@ -1,6 +1,6 @@
 # Harness compatibility
 
-The build and peer dependency baseline is **`0.2.1-rc.1`** for every `@deepseek-ai/dsh-*` package. The source reference is tag `dsh-v0.2.1-rc.1`, commit `1600d8a1e140dcde43a1a0941940a0480712c011` in `deepseek-ai/deepseek-harness`. These are the precise package coordinates behind the requested desktop 0.2.1 release line; an untagged future `0.2.1` package is not silently covered.
+The build dependency baseline is **`0.2.1-rc.2`** for every `@deepseek-ai/dsh-*` package. Peer dependencies explicitly accept **`0.2.1-rc.1 || 0.2.1-rc.2`**. The source reference is tag `dsh-v0.2.1-rc.2`, commit `687f282e8625c6b8d11ff58211a90524be2e4317` in `deepseek-ai/deepseek-harness`. An untagged future `0.2.1` package is not silently covered.
 
 The referenced packages were confirmed on npm. A clean install resolves one cohort, with `autoInstallPeers: false`; missing host peers used by development packages are explicitly provided at the same version. No local workspace overrides or private filesystem paths are needed.
 
@@ -20,6 +20,16 @@ Use the exact source tag or installed desktop cohort, a temporary `DSH_HOME`, an
 
 `pnpm pack:check` covers static typing, source and manifest contracts, regression tests, clean build, release metadata and tarball import closure. It does not by itself certify a running desktop session or upstream network availability. Future host cohorts must repeat this acceptance before widening peer ranges.
 
+## 0.0.5 / Harness 0.2.1-rc.2 acceptance — 2026-10-18
+
+The reported desktop was already 0.2.1-rc.2. Official npm served plugin 0.0.4 (rc.1-only peers), while the mainland mirror still served latest 0.0.3 and had no 0.0.4 metadata. These are separate causes: switching registry cannot make an incompatible peer range compatible.
+
+Compared upstream tags rc.1 and rc.2 at the source reference above: no source changes in the consumed connection, locale, UI slots/layout/primitives/sidebar, host webserver, skill filesystem or home paths packages. The runtime bundles rebuild unchanged. Development dependencies now use one exact rc.2 cohort; peers retain rc.1 and explicitly add rc.2 rather than an open-ended range.
+
+`pnpm pack:check` passed all 97 tests, types, clean build, release metadata and tarball closure checks. Acceptance used the published npm rc.2 host with all Harness dependencies pinned to rc.2, macOS arm64 / Node 26.7.0, a packed 0.0.5 plugin and disposable home/agents directories. The host CLI accepted the tarball. Ego Lite verified the market mount, weather search, live Weather installation, installed detail with rendered Markdown and two files, and confirmed uninstall returning the inventory to zero; the skill directory was also removed. The same tarball was accepted by the rc.1 host CLI; the unchanged runtime's rc.1 UI coverage is recorded below. Native Electron packaging and Windows/Linux were not tested.
+
+This is release preparation, not publication. The plugin is intended for npm `latest` after merge. A GitHub Release marker does not update npm mirror metadata; README now directs users to the official registry when versions are missing or stale.
+
 ## 0.0.4 / Harness 0.2.1-rc.1 acceptance — 2026-10-17
 
 Target: [official release `dsh-v0.2.1-rc.1`](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-rc.1), commit `1600d8a1e140dcde43a1a0941940a0480712c011`. The supplied source checkout was clean at that tag and was used only as reference. Plugin validation used the working changes on base commit `990840138d22d681f46e54fd2e876f0d6acd8398`; it was not a published release commit.

package/docs/CONTRACT.md

@@ -1,10 +1,10 @@
-# Skills Hub 0.0.4 implementation contract
+# Skills Hub 0.0.5 implementation contract
 
 This document describes the shipped code, not a migration plan. The TypeScript models in `src/market/types.ts`, `src/skills/installed.ts` and `src/client/api.ts` define the detailed wire shapes. Update this document with API changes.
 
 ## 1. Package and host
 
-The package is `@nanmicoder/dsh-skills-hub`, version `0.0.4`. Its supported host package cohort is exactly `0.2.1-rc.1`; the desktop release line is 0.2.1. The exact upstream tag and commit are recorded in `compatibility.json` and [COMPATIBILITY.md](COMPATIBILITY.md).
+The package is `@nanmicoder/dsh-skills-hub`, version `0.0.5`. Its supported host package cohorts are exactly `0.2.1-rc.1` and `0.2.1-rc.2`; the desktop release line is 0.2.1. The exact upstream tag and commit are recorded in `compatibility.json` and [COMPATIBILITY.md](COMPATIBILITY.md).
 
 `cordis.patch.yml` inserts one row (`id: skills-hub`) named after the scoped package. `lib/index.js` is the host entry. `lib/client.js` is the browser factory registered with `window.__ModuleLoader__.load` under that same package name. The plugin adds a global sidebar panel and does not replace built-in components or require an agent session.
 

package/docs/RELEASE.md

@@ -1,6 +1,6 @@
-# Release 0.0.4
+# Release 0.0.5
 
-Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.4`. npm channel: `latest`. This plugin release is independent of the host's `0.2.1-rc.1` version and retains that exact compatibility cohort.
+Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`. Tag: `v0.0.5`. npm channel: `latest`. This plugin release is independent of the host version and supports the exact `0.2.1-rc.1` and `0.2.1-rc.2` cohorts.
 
 ## Before publication
 
@@ -11,7 +11,7 @@ Package: `@nanmicoder/dsh-skills-hub`. Repository: `NanmiCoder/dsh-skills-hub`.
 
 ## GitHub Actions publication
 
-Publish after the compatibility PR is merged into `main`. Revalidate the merged commit, then create and push `v0.0.4` from that commit to run `.github/workflows/release.yml`. Creating the PR alone does not publish. A manual workflow dispatch with version `0.0.4` also publishes npm, but the GitHub Release job runs only for a tag push; prefer the tag flow for the complete release. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
+Publish after the compatibility PR is merged into `main`. Revalidate the merged commit, then create and push `v0.0.5` from that commit to run `.github/workflows/release.yml`. Creating the PR alone does not publish. A manual workflow dispatch with version `0.0.5` also publishes npm, but the GitHub Release job runs only for a tag push; prefer the tag flow for the complete release. Both Node 22.19 and 24 must pass validation. The Node 24 job uploads the built tarball and SHA-256 checksum; the publication job verifies and publishes that exact artifact using npm 11.19.0. It does not rebuild during publication. A GitHub Release is published only after npm succeeds.
 
 Configure npm Trusted Publishing for GitHub owner `NanmiCoder`, repository `dsh-skills-hub`, workflow `release.yml`, environment `npm`, allowing direct publication. OIDC uses `id-token: write`; routine releases need no local npm login and no stored npm token. The existing AgentTeams trust binding is package-specific and does not authorize this new package.
 
@@ -21,4 +21,4 @@ Before tagging, commit all source and generated artifacts, confirm the version a
 
 ## After publication / recovery
 
-Install `@nanmicoder/dsh-skills-hub@0.0.4` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.
+Install `@nanmicoder/dsh-skills-hub@0.0.5` into an isolated profile and repeat the smoke flow. Compare the downloaded package and expected version before announcing availability. If a release is faulty, publish a new fixed version or deprecate the faulty version with a clear message; do not rewrite published Git tags or assume deleting a GitHub Release retracts npm. Preserve user skills when removing or replacing the plugin.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanmicoder/dsh-skills-hub",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Skills Hub for DeepSeek Harness: browse, preview, install and remove third-party skills from ClawHub and SkillHub inside the DSH Web GUI.",
   "type": "module",
   "main": "lib/index.js",
@@ -63,12 +63,12 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.1 || 0.2.1-rc.2",
     "@deepseek-ai/schemastery": "~3.18.5",
     "react": "^18.2.0"
   },
@@ -103,21 +103,21 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.5",
-    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-store": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-fs": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-scope": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-session": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-skill": "0.2.1-rc.1",
-    "@deepseek-ai/dsh-skill-filesystem": "0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-store": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill-filesystem": "0.2.1-rc.2",
     "@deepseek-ai/schemastery": "3.18.5",
     "@types/node": "^24.13.3",
     "@types/react": "~18.3.1",

package/release-notes/v0.0.5.md

@@ -0,0 +1,9 @@
+# Skills Hub 0.0.5
+
+Fix installation on DeepSeek Harness **0.2.1-rc.2**, retaining support for **0.2.1-rc.1**. Version 0.0.4 declared only rc.1, so rc.2 hosts rejected it during compatibility validation.
+
+- Develop against the exact rc.2 cohort and allow both verified candidate host versions in peer dependencies.
+- Document selecting the official npm registry: mainland mirror metadata can remain on 0.0.3 and cannot resolve newer versions until synchronized.
+- Continue publishing stable plugin releases to npm `latest`; host candidate versions and plugin publication channels are separate.
+
+After publication, select the official npm source in Add plugin and install `@nanmicoder/dsh-skills-hub@0.0.5`. Existing skills are preserved. This does not claim support for future untested host versions.