@noob-stupid/dsh-plugin-console 0.3.63 → 0.3.65

package/README.md

@@ -4,31 +4,54 @@
 
 <img width="1170" height="609" alt="image" src="https://github.com/user-attachments/assets/b802d606-14ba-4151-9956-ff642ed12b0a" />
 
-# DSH Plugin Hub (dsh-plugin-hub)
+# DSH Plugin Gating Hub (dsh-plugin-gating-hub)
+
+*Renamed from `dsh-plugin-hub` — old URLs redirect.*
 
 [![](https://img.shields.io/badge/powered_by-dsh-4D6BFE?style=flat-square&logo=deepseek&logoColor=white)](https://github.com/deepseek-ai/deepseek-harness)
 [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
-[![GitHub stars](https://img.shields.io/github/stars/Noob-stupid/dsh-plugin-hub?style=flat-square&logo=github)](https://github.com/Noob-stupid/dsh-plugin-hub/stargazers)
-[![License](https://img.shields.io/github/license/Noob-stupid/dsh-plugin-hub?style=flat-square)](LICENSE)
-[![Last commit](https://img.shields.io/github/last-commit/Noob-stupid/dsh-plugin-hub?style=flat-square)](https://github.com/Noob-stupid/dsh-plugin-hub/commits/main)
-[![Registry CI](https://img.shields.io/github/actions/workflow/status/Noob-stupid/dsh-plugin-hub/registry.yml?label=registry%20CI&style=flat-square)](https://github.com/Noob-stupid/dsh-plugin-hub/actions/workflows/registry.yml)
+[![GitHub stars](https://img.shields.io/github/stars/Noob-stupid/dsh-plugin-gating-hub?style=flat-square&logo=github)](https://github.com/Noob-stupid/dsh-plugin-gating-hub/stargazers)
+[![License](https://img.shields.io/github/license/Noob-stupid/dsh-plugin-gating-hub?style=flat-square)](LICENSE)
+[![Last commit](https://img.shields.io/github/last-commit/Noob-stupid/dsh-plugin-gating-hub?style=flat-square)](https://github.com/Noob-stupid/dsh-plugin-gating-hub/commits/main)
+[![Registry CI](https://img.shields.io/github/actions/workflow/status/Noob-stupid/dsh-plugin-gating-hub/registry.yml?label=registry%20CI&style=flat-square)](https://github.com/Noob-stupid/dsh-plugin-gating-hub/actions/workflows/registry.yml)
 [![topic: dsh-plugin](https://img.shields.io/badge/topic-dsh_plugin-4D6BFE?style=flat-square)](https://github.com/topics/dsh-plugin)
 [![npm version](https://img.shields.io/npm/v/@noob-stupid/dsh-plugin-console?style=flat-square)](https://www.npmjs.com/package/@noob-stupid/dsh-plugin-console)
 [![npm downloads](https://img.shields.io/npm/dm/@noob-stupid/dsh-plugin-console?style=flat-square)](https://www.npmjs.com/package/@noob-stupid/dsh-plugin-console)
-[![GitHub Release](https://img.shields.io/github/v/release/Noob-stupid/dsh-plugin-hub?style=flat-square)](https://github.com/Noob-stupid/dsh-plugin-hub/releases)[![dsh.so security](https://www.dsh.so/badge/dsh-plugin-hub.svg)](https://www.dsh.so/artifact/dsh-plugin-hub)
+[![GitHub Release](https://img.shields.io/github/v/release/Noob-stupid/dsh-plugin-gating-hub?style=flat-square)](https://github.com/Noob-stupid/dsh-plugin-gating-hub/releases)[![dsh.so security](https://www.dsh.so/badge/dsh-plugin-hub.svg)](https://www.dsh.so/artifact/dsh-plugin-hub)
 [![dsh.so install](https://www.dsh.so/badge/install/dsh-plugin-hub.svg)](https://www.dsh.so/artifact/dsh-plugin-hub)
 
-> Manage all your DeepSeek Harness plugins in one panel: one-click enable/disable,
-> a 500+ plugin & skill marketplace with one-click install, and one-click framework
-> upgrade with auto-rollback.
-
-## Why DSH Plugin Hub
-
-- 🧩 **Plugin & skill hub** — auto-collected index of `dsh-plugin` repos (500+ by
-  stars) plus a Skills tab; browse, search, one-click install, **zero GitHub API
-  calls** (served via CDN).
-- 🚀 **One-click framework upgrade** — backup → online install (service stays up) →
-  verify → **auto-rollback on failure**. Tested end-to-end.
+> **Framework upgrade safety & plugin version gating for DeepSeek Harness (DSH)**: one-click
+> framework upgrade with **auto-rollback on failure** → **one-click rollback to the previous
+> version** after an upgrade → plugins the new framework cannot load are **auto-disabled** →
+> the **plugin upgrade gate** refuses a version the host can't take.
+> A **built-in multi-source plugin market & index** (500+ plugins / 300+ skills, zero GitHub
+> API calls) rides on top as the **discovery layer** — and **every source is swappable**: install
+> source (incl. a private intranet registry), search source (URL template + headers), index source
+> (self-hosted intranet index), Git source (incl. a local `file://` bare repo), so plugins can be
+> installed on an **intranet-only or fully offline** machine.
+
+## Why DSH Plugin Gating Hub
+
+- 🛡️ **Framework upgrade safety, end-to-end** — one-click upgrade: config backup + full-tree
+  checkpoint (rollback point) → online install (service stays up, page never disconnects) →
+  version verification → auto-restart. A failed install **auto-rolls the whole tree back**,
+  version check catches fake success, 15-min hard timeout + stall detection — the framework is
+  never left broken. → [details](docs/upgrade-safety-adapt-gate.md)
+- ↩️ **One-click rollback to the previous version** — after an upgrade the framework card keeps
+  a 「roll back to previous」 button: stop service → restore full tree → relaunch → health check,
+  state visible throughout.
+- 🚫 **Incompatible plugins auto-disabled** — the **adapt gate** force-disables plugins the new
+  framework cannot load (enable locked; the server rejects `/toggle` with 409 — unbypassable);
+  「Check update → Update & adapt」auto-verifies and unlocks them.
+- 🔒 **Plugin upgrade gating** — a version/declaration gate (`dsh.engines.framework` /
+  `engines.dsh` + `@deepseek-ai/*` ranges, built-in zero-dependency semver engine) decides
+  whether a plugin version may run on this host, so an upgrade can't silently take plugins out.
+- 🧩 **Built-in discovery layer** — multi-source plugin market (GitHub / Gitee / custom sources)
+  plus the static index of `dsh-plugin` repos (500+ by stars) and a Skills tab (up to 300);
+  browse, search, one-click install, **zero GitHub API calls** (served via CDN).
+  **Every source is swappable** — private intranet npm registry, custom search source (URL template +
+  headers), self-hosted index source, Git source (incl. local `file://` bare repo) — so an
+  **intranet-only / offline** machine can still browse and install.
 - 🤖 **AI Empower** — give the console a package name or GitHub repo, the local AI
   reads its docs and drafts a safe, confirmable deployment plan (install / config /
   start / health-check); server components get an automatic control card.
@@ -106,7 +129,7 @@ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host
 - [Compatibility](#compatibility)
 - [Project layout](#project-layout)
 - [HTTP endpoints](#http-endpoints)
-- [Security](#security)
+- [安全](#security)
 - [Known limitations](#known-limitations)
 - [Help & Ecosystem](#help--ecosystem)
 - [Contributing](#contributing)
@@ -121,7 +144,7 @@ Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host
 1. Restart DSH → open the Web GUI → **Settings → Plugins → Plugin Console**.
 2. **Installed list**: toggle plugins on/off (HMR applies within ~1s), search by name/id,
    expand details (version, repository, README summary).
-3. **Marketplace**: empty query on the GitHub source opens the static index (instant);
+3. **市场**: empty query on the GitHub source opens the static index (instant);
    type a query to search live. Switch sources via the login pill (GitHub / Gitee / custom);
    `⊞` merges all sources; `★` filters to `dsh plugin add`-installable packages.
 4. **Skills tab**: switch 插件/技能 next to the search box to browse and install skills
@@ -220,6 +243,8 @@ The floating "Sources" button (right of the title row, semi-transparent) opens t
 
 ---
 
+<img width="393" height="525" alt="56ccd0b3-f174-4365-848b-64013b27d604" src="https://github.com/user-attachments/assets/5a2816ce-12d9-4001-b895-1e422c11d423" />
+
 ## Documentation
 
 - [AI Empower 与服务器组件控制](docs/ai-empower.md)
@@ -244,7 +269,7 @@ The floating "Sources" button (right of the title row, semi-transparent) opens t
 
 ---
 
-## Help
+##帮助
 
 - **Panel missing**: restart dsh → refresh → Settings → Plugins → Plugin Console.
 - **Toggle does nothing**: infrastructure rows are "Protected" (by design); normal toggles
@@ -311,4 +336,4 @@ The layered-refactor preview lives in its **own repository**: [**`Noob-stupid/ds
 - **What it is**: the monolithic `lib/index.js` (8547 lines) split into layers — `lib/index.js` **141 lines** + `lib/server/**` **38 modules**; **feature-equivalent to `0.3.57`**, maintainability only;
 - **Verified**: 19 test suites green · 8 architecture-guard assertions · **route inventory identical** (`status` + response fields) against the stable build;
 - **Not yet exercised**: real framework upgrade / rollback, restart guardian, component start/stop, real AI run, Gitee OAuth (~10–25% long-tail risk, subjective);
-- **For everyday use** stick to npm `@noob-stupid/dsh-plugin-console@0.3.63`, or `main` of this repo.
+- **For everyday use** stick to npm `@noob-stupid/dsh-plugin-console@0.3.65`, or `main` of this repo.

package/README.zh.md

@@ -4,16 +4,34 @@
 
 <img width="1170" height="609" alt="image" src="https://github.com/user-attachments/assets/b802d606-14ba-4151-9956-ff642ed12b0a" />
 
-# DSH 插件中心（dsh-plugin-hub）
-
-> 一站式管理你的 DeepSeek Harness 插件：一键启用/停用、500+ 插件与技能市场一键安装、
-> 框架一键升级（失败自动回滚）。
-
-## 为什么是 DSH 插件中心
-
-- 🧩 **插件 + 技能双市场** — 自动收录 `dsh-plugin` 仓库（按 star **500+**）外加技能 tab；
-  浏览、搜索、一键安装，**零 GitHub API 调用**（CDN 分发，秒开零限流）。
-- 🚀 **框架一键升级** — 备份 → 在线安装（服务不中断）→ 校验 → **失败自动回滚**，端到端实测。
+# DSH 插件门控中心（dsh-plugin-gating-hub）
+
+*原名 `dsh-plugin-hub`，已改名；旧链接 301 跳转有效。*
+
+> **DSH 框架升级安全与插件升级门控**：一键框架升级（**失败自动回滚**）→ 升级后**一键回滚到
+> 上一版** → 新框架带不动的插件**自动禁用** → **插件升级门控**按版本/声明拒绝装不上的插件版本。
+> **内置多源插件市场与自定义索引**（500+ 插件 / 300+ 技能，零 GitHub API 调用）作为**发现层**——
+> 而且**每一条源都能换成你自己的**：安装源（含内网私有 registry）、搜索源（URL 模板 + 请求头）、
+> 索引源（内网自建索引）、Git 源（含 `file://` 本地裸仓库），**纯内网 / 断网也能装插件**。
+
+## 为什么是 DSH 插件门控中心
+
+- 🛡️ **一键框架升级，失败自动回滚** — 备份配置 + 升级前全树 checkpoint（回滚点）→ 在线安装
+  （服务不中断、页面不断开）→ 版本校验 → 自动重启生效；安装失败**自动全树回滚**，
+  版本校验防假成功，15 分钟硬超时 + 卡死检测——框架绝不处于损坏状态。
+  → [详见](docs/upgrade-safety-adapt-gate.zh.md)
+- ↩️ **升级后一键回滚到上一版** — 升级成功后框架卡片保留「回滚到上一版」：停服 → 全树恢复 →
+  自动拉起 → 健康检测，全程状态可见。
+- 🚫 **旧插件不适配自动禁用** — 适配门把新框架加载不了的插件**强制禁用**（启用按钮锁定，
+  服务端 `/toggle` 直接 409、无法绕过）；「检测更新 → 更新并适配」自动校验后解锁。
+- 🔒 **插件升级门控** — 按 `dsh.engines.framework` / `engines.dsh` 声明与 `@deepseek-ai/*`
+  依赖范围（内置零依赖 semver 判定器）判定插件版本能否在本宿主运行，
+  避免框架升级把插件悄悄带下线。
+- 🧩 **内置发现层：多源插件市场** — GitHub / Gitee / 自定义源，外加静态索引（按 star 收录
+  `dsh-plugin` 仓库 **500+**）与技能 tab（最多 300）；浏览、搜索、一键安装，
+  **零 GitHub API 调用**（CDN 分发，秒开零限流）。
+  **每条源都能换成你自己的** —— 内网私有 npm registry、自定义搜索源（URL 模板 + 请求头）、
+  内网自建索引源、Git 源（含 `file://` 本地裸仓库），**纯内网 / 断网环境照样浏览与安装**。
 - 🤖 **AI 赋能** — 输入 npm 包名或 GitHub 仓库，本地 AI 读文档生成**部署计划**
   （安装/写配置/启动服务/健康检查），你确认后安全执行；服务器组件自动生成控制卡片。
   → [详见](docs/ai-empower.zh.md)
@@ -187,6 +205,9 @@ git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console
   （gitee.com → 数据管理 → 第三方应用，权限勾选 user_info、projects）后填入
   client_id / client_secret → 保存 → 授权登录。
 
+<img width="393" height="525" alt="image" src="https://github.com/user-attachments/assets/caacbe78-034b-4151-b1d1-2b67b73a5de6" />
+
+
 ---
 
 ## 文档
@@ -279,5 +300,5 @@ MIT
 - **已验证**：19 套测试全绿 · 8 条架构守卫断言 · 与稳定版逐条对打**路由清单一致**（`status` + 响应字段）；
 - **已实测**（2026-09-20 真装真卸演练）：普通插件 / bundle 插件 / 无 npm 仓库 / 套装 / 技能 / 聚合仓库子包 / 仓库落地 / 服务器组件启停；
 - **尚未实测**：真框架升级 / 真回滚、重启守护链路、AI 真跑、Gitee OAuth 回调（长尾风险主观估计 **10%~25%**）；
-- **日常使用请继续用**：npm `@noob-stupid/dsh-plugin-console@0.3.63`，或本仓库 `main`。
+- **日常使用请继续用**：npm `@noob-stupid/dsh-plugin-console@0.3.65`，或本仓库 `main`。
 - 请多反馈问题

package/lib/index.js

@@ -942,11 +942,11 @@ export const DEFAULT_SOURCES = {
   // （另一位用户实测报「市场索引加载失败：网络不可达（2 个索引源全部失败）：GitHub 请求超时」）。
   // jsDelivr 官方多入口互为主备：cdn（主）/ gcore / fastly；再加 ghproxy 与 raw 直连兜底。
   indexSources: [
-    { id: 'jsdelivr', name: 'jsDelivr CDN', url: 'https://cdn.jsdelivr.net/gh/Noob-stupid/dsh-plugin-hub@main/marketplace/index.json', primary: true },
-    { id: 'jsdelivr-gcore', name: 'jsDelivr (gcore)', url: 'https://gcore.jsdelivr.net/gh/Noob-stupid/dsh-plugin-hub@main/marketplace/index.json', primary: false },
-    { id: 'jsdelivr-fastly', name: 'jsDelivr (fastly)', url: 'https://fastly.jsdelivr.net/gh/Noob-stupid/dsh-plugin-hub@main/marketplace/index.json', primary: false },
-    { id: 'ghproxy', name: 'ghproxy 镜像', url: 'https://ghproxy.net/https://raw.githubusercontent.com/Noob-stupid/dsh-plugin-hub/main/marketplace/index.json', primary: false },
-    { id: 'raw', name: 'GitHub raw 直连', url: 'https://raw.githubusercontent.com/Noob-stupid/dsh-plugin-hub/main/marketplace/index.json', primary: false },
+    { id: 'jsdelivr', name: 'jsDelivr CDN', url: 'https://cdn.jsdelivr.net/gh/Noob-stupid/dsh-plugin-gating-hub@main/marketplace/index.json', primary: true },
+    { id: 'jsdelivr-gcore', name: 'jsDelivr (gcore)', url: 'https://gcore.jsdelivr.net/gh/Noob-stupid/dsh-plugin-gating-hub@main/marketplace/index.json', primary: false },
+    { id: 'jsdelivr-fastly', name: 'jsDelivr (fastly)', url: 'https://fastly.jsdelivr.net/gh/Noob-stupid/dsh-plugin-gating-hub@main/marketplace/index.json', primary: false },
+    { id: 'ghproxy', name: 'ghproxy 镜像', url: 'https://ghproxy.net/https://raw.githubusercontent.com/Noob-stupid/dsh-plugin-gating-hub/main/marketplace/index.json', primary: false },
+    { id: 'raw', name: 'GitHub raw 直连', url: 'https://raw.githubusercontent.com/Noob-stupid/dsh-plugin-gating-hub/main/marketplace/index.json', primary: false },
   ],
   // Git 克隆源（{owner}/{repo} 占位符；按主→备依次尝试）。
   // 可替换为 Gitee / GitLab / 自建 Gitea / 任意镜像代理，实现「换一个网站下载仓库内容」。

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.3.63",
-  "description": "DSH plugin management panel & marketplace: one-click enable/disable, multi-source market (GitHub/Gitee/custom), static-index market (500+ plugins / 300 skills), skills, suites, and one-click framework upgrade.",
+  "version": "0.3.65",
+  "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",
-    "url": "https://github.com/Noob-stupid/dsh-plugin-hub"
+    "url": "https://github.com/Noob-stupid/dsh-plugin-gating-hub"
   },
   "type": "module",
   "main": "./lib/index.js",
@@ -16,7 +16,21 @@
   "keywords": [
     "dsh-plugin",
     "deepseek-harness",
-    "plugin-manager"
+    "plugin-manager",
+    "dsh",
+    "dsh-plugins",
+    "plugin-market",
+    "plugin-console",
+    "marketplace",
+    "framework-upgrade",
+    "rollback",
+    "auto-rollback",
+    "upgrade-safety",
+    "gating",
+    "插件市场",
+    "框架升级",
+    "自动回滚",
+    "插件升级门控"
   ],
   "dsh": {
     "bundle": {