@omdp/dsh-connector 0.1.2 → 0.2.0

package/README.md

@@ -2,12 +2,18 @@
 
 ## Overview
 
-把 **MCP 服务器** 和 **用户 Skills** 的管理合并到 DSH Web UI 的同一个设置页
-（设置页标签：**Connector**）。适合需要在 DSH 里频繁增删改 MCP server / skills、
-又不想手改 `cordis.patch.yml` 的用户。
+把 **MCP 服务器**、**用户 Skills** 的管理和 **魔搭（ModelScope）市场浏览**
+合并到 DSH Web UI 的同一个设置页（设置页标签：**Connector**）。适合需要在
+DSH 里频繁增删改 MCP server / skills、又不想手改 `cordis.patch.yml` 的用户。
 
 - **MCP**：读取/编辑 `profiles/web/cordis.patch.yml` 中的 `mcp-*` 块（结构化表单）。保存后**重启 `dsh` 生效**。
 - **Skills**：列出/查看/编辑/删除 `~/.dsh/skills` 下的 `SKILL.md`。保存**即时生效**（filesystem provider 自动重新发现）。
+- **市场探索（0.2.0 新增）**：只读浏览魔搭社区 [Skills 中心](https://modelscope.cn/skills) 与 [MCP 广场](https://modelscope.cn/mcp)（匿名 OpenAPI，无需密钥）。
+  - 列表/详情：名称、作者、分类、下载/浏览数、认证标识（Hosted 官方托管 / 已认证）
+  - **一键复制** skill 安装命令（`npx / curl / modelscope` 三种）与 MCP 配置片段（`server_config` 的 `mcpServers` JSON）
+  - **Skill 更新提示**：把本地 skill 关联市场条目（写入 frontmatter 的 `source`/`sourceUpdated`）后，「检查更新」比对市场 `file_last_modified` 标出"有更新/最新"
+  - **零落盘**：市场数据只存在 DSH 进程内存（30 分钟 TTL 缓存），重启即清，从不写文件
+  - MCP 为部署模式、无版本概念，不提供更新提示（仅浏览与复制配置）
 
 设计上复用官方两款参考插件的方式：
 - 设置页槽位注册方式参照 [`dsh-mcp-manager`](https://github.com/hyqhyq3/dsh-mcp-manager)（`settings.section` + Package 私有 HTTP API）。
@@ -133,6 +139,13 @@ pnpm remove @omdp/dsh-connector
 2. **Skills** 区：
    - 列出 `~/.dsh/skills` 下的用户技能
    - 「编辑」改 frontmatter 与正文；「删除」移除目录；「＋ 新建」创建
+   - 「检查更新」：对已关联市场来源的 skill 比对魔搭更新时间，显示"有更新/最新"徽标
+3. **市场探索** 区：
+   - MCP 市场：输入关键词搜索魔搭 MCP 广场；条目显示作者/浏览数与"已配置"徽标；展开详情看
+     Hosted / 认证 / 环境变量 / 配置变体，**「复制配置」** 一键复制 `mcpServers` JSON 片段
+   - Skills 市场：搜索魔搭技能中心；展开详情看三条安装命令（逐个**复制**，自行执行），
+     「记录来源」把本地技能关联到该市场条目（写 frontmatter `source`/`sourceUpdated`）
+   - 全部数据经 host 30 分钟内存缓存代理，仅本机内存，不写盘
 
 ## 工作原理
 
@@ -149,6 +162,9 @@ pnpm remove @omdp/dsh-connector
 - 保存时按 `dsh-mcp-client` 的契约**校验**：`transport` 只能是 `stdio`/`streamable-http`；`serverName` 必须匹配 `[A-Za-z0-9_-]{1,32}`；stdio 的 `command` 必须是单个词且能在 PATH 中找到（或为绝对路径）；streamable-http 的 `url` 必须是合法 http(s)（`!!js` 表达式除外）；命令/URL/参数中不允许控制字符。任何一项不合法，保存会被拒绝（HTTP 400）并提示原因，**不会写入** `cordis.patch.yml`——坏配置永远到不了下次启动。
 - MCP 块解析为结构化提取，复杂嵌套 YAML（如多 env 变量）在表单里以单字段呈现；极复杂配置请直接在 `cordis.patch.yml` 编辑。
 - 不桥接 MCP 的 resources/prompts，只管理 server 配置。
+- **市场只读**：不做 MCP 部署、不做 skill 安装（MCP 部署/部分 skill 安装不是简单改配置）。安装命令/配置片段请复制后自行执行。
+- **版本提示仅限 skill**：魔搭 MCP 是部署模式、无版本概念，不提供更新提示；skill 的"有更新"以市场 `file_last_modified` 对比本地 `sourceUpdated` 判定（需先「记录来源」）。
+- 市场依赖 `modelscope.cn` 可达性；不可达时接口返回 502 提示，不影响 MCP/skill 本地管理。
 
 ## Troubleshooting
 
@@ -202,9 +218,10 @@ MIT License。安全问题请通过 GitHub Issues 私密报告（https://github.
 | 数据 | 访问方式 | 说明 |
 |---|---|---|
 | `profiles/web/cordis.patch.yml` | **读写** | MCP 块的结构化编辑（保留 `!!js`/env 原样） |
-| `~/.dsh/skills/**/SKILL.md` | **读写** | 用户技能文件的查看/编辑/删除/新建 |
+| `~/.dsh/skills/**/SKILL.md` | **读写** | 用户技能文件的查看/编辑/删除/新建；「记录来源」会写 `source`/`sourceUpdated` frontmatter |
 | `~/.dsh/settings.yaml` 等 | 只读 | 不主动读写 |
-| HTTP `/connector/api/*` | 本机监听 | 与 DSH GUI 同源，无外部网络请求（不调用外部 API） |
+| HTTP `/connector/api/*` | 本机监听 | 与 DSH GUI 同源，无额外鉴权 |
+| 魔搭 `modelscope.cn/openapi/v1` | **只读外部** | 市场浏览代理（匿名）；结果仅存进程内存（30 分钟 TTL），**不写文件、不落盘** |
 | 环境变量 | 只读引用 | 只读 `process.env.*`，不持久化 |
 
 **不收集**：无遥测、无外部上报、无用户数据离开本机。
@@ -222,5 +239,8 @@ MIT License。安全问题请通过 GitHub Issues 私密报告（https://github.
 | DSH 小更新/补丁 | ✅ 不会崩 |
 | DSH 大版本（`webServer` API 变化） | ✅ DSH 不崩；connector 需适配更新 |
 | yaml 版本 | ✅ 独立 npm 包，不受 DSH 更新影响 |
+| 魔搭市场不可达 | ✅ 市场接口报 502，本地 MCP/skill 管理不受影响 |
 
-**最后验证**：DSH `0.1.0-rc.8`（2026-08-20，已在本机运行实例活体验证 `/connector/api/skills` 返回 200）。
+**最后验证**：DSH `0.1.0-rc.8`（2026-08-20）；0.2.0 市场功能以 `node --check` +
+真实 HTTP 集成测试通过（11 项：skills/mcp 列表与详情、证书/Hosted 标识、安装命令、
+记录来源回写、更新判定），未改动 DSH 实例。

package/client.js

@@ -4,14 +4,21 @@
  * Installed-package client bundle: the harness serves this file at
  * /plugins/<id>/client.js and expects a single window.__ModuleLoader__.load
  * handoff whose factory receives `require`. We register one unified settings
- * tab ("Connector") that manages two things in a single page:
+ * tab ("Connector") with three panes:
  *   - MCP servers: read/edit the mcp-* block of cordis.patch.yml
  *   - user skills:  list/view/edit/remove SKILL.md files under ~/.dsh/skills
+ *   - marketplace:  read-only ModelScope Skills Center + MCP Plaza browser
+ *                   (30-min in-process cache on the host, nothing on disk)
  *
  * It talks to the host half over the Package-private HTTP API the host mounts
  * on the DSH GUI webserver (/connector/api/*), exactly like
  * dsh-mcp-manager's client does with fetch — not the dynamic-only host.call.
  *
+ * Visual language follows the DSH theme tokens (--dsw-alias-*): surfaces use
+ * layer-1/2 backgrounds, borders use border-l1/l2, accents use brand-primary,
+ * and badges reuse the state success/warn colors so the panel blends into the
+ * GUI in both light and dark themes.
+ *
  * @module @omdp/dsh-connector/client
  */
 
@@ -25,29 +32,59 @@ window.__ModuleLoader__.load({
     var createElement = react.createElement
 
     var css =
-      '.pm_root{display:flex;flex-direction:column;gap:20px;padding:0 24px 24px}' +
-      '.pm_tabs{display:flex;gap:8px;padding:0 24px}' +
+      /* layout */
+      '.pm_root{display:flex;flex-direction:column;gap:18px;padding:0 24px 28px}' +
+      '.pm_tabs{display:flex;gap:4px;padding:2px 24px 0;border-bottom:1px solid var(--dsw-alias-border-l1,rgba(128,128,128,.22));margin:0 -24px 4px}' +
+      '.pm_tab{cursor:pointer;font:inherit;font-size:13px;padding:8px 14px 10px;border:none;background:transparent;color:var(--dsw-alias-label-secondary,#9aa);border-bottom:2px solid transparent;margin-bottom:-1px}' +
+      '.pm_tab:hover{color:var(--dsw-alias-label-primary,#ddd)}' +
+      '.pm_tab.active{color:var(--dsw-alias-label-primary,#f4f4f4);border-bottom-color:var(--dsw-alias-brand-primary,#5b8cff);font-weight:600}' +
       '.pm_section{display:flex;flex-direction:column;gap:12px}' +
-      '.pm_sectionHead{font-weight:600;font-size:15px}' +
-      '.pm_row{display:flex;flex-direction:column;gap:8px;border:1px solid rgba(128,128,128,.3);border-radius:12px;padding:12px 14px}' +
-      '.pm_rowHead{display:flex;align-items:center;gap:10px}' +
-      '.pm_name{font-weight:600;font-size:14px}' +
-      '.pm_kind{font-size:11px;padding:2px 8px;border-radius:8px;border:1px solid rgba(128,128,128,.4);color:var(--dsw-alias-label-secondary,#888)}' +
-      '.pm_meta{font-size:12px;color:var(--dsw-alias-label-secondary,#888);word-break:break-all}' +
-      '.pm_actions{margin-left:auto;display:flex;gap:8px}' +
-      '.pm_btn{cursor:pointer;font-size:12px;padding:5px 12px;border-radius:8px;border:1px solid rgba(128,128,128,.5);background:transparent;color:inherit}' +
-      '.pm_btn:hover{background:rgba(128,128,128,.12)}' +
-      '.pm_btn:disabled{opacity:.5;cursor:default}' +
-      '.pm_btn.primary{border-color:transparent;background:var(--dsw-alias-interactive-bg-active,#2563eb);color:#fff}' +
-      '.pm_btn.danger{border-color:#c62828;color:#c62828}' +
-      '.pm_err{color:#c62828;font-size:12px}' +
+      '.pm_sectionHead{font-size:13px;font-weight:600;letter-spacing:.02em;color:var(--dsw-alias-label-primary,#eee);display:flex;align-items:center;gap:8px}' +
+      '.pm_sectionHead .pm_hint{margin-left:0}' +
+      /* cards */
+      '.pm_card{background:var(--dsw-alias-bg-layer-1,rgba(255,255,255,.035));border:1px solid var(--dsw-alias-border-l1,rgba(128,128,128,.22));border-radius:12px;padding:12px 14px;display:flex;flex-direction:column;gap:8px;transition:background .15s,border-color .15s}' +
+      '.pm_card:hover{background:var(--dsw-alias-bg-layer-2,rgba(255,255,255,.06));border-color:var(--dsw-alias-border-l2,rgba(128,128,128,.4))}' +
+      '.pm_cardHead{display:flex;align-items:center;gap:10px;flex-wrap:wrap}' +
+      '.pm_name{font-weight:600;font-size:14px;color:var(--dsw-alias-label-primary,#eee)}' +
+      '.pm_meta{font-size:12px;color:var(--dsw-alias-label-secondary,#9aa);word-break:break-all;line-height:1.5}' +
+      '.pm_desc{font-size:12.5px;color:var(--dsw-alias-label-secondary,#aab);line-height:1.6;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical;overflow:hidden}' +
+      /* badges */
+      '.pm_badge{display:inline-flex;align-items:center;gap:4px;font-size:11px;padding:2px 9px;border-radius:999px;border:1px solid currentColor;line-height:1.6;white-space:nowrap}' +
+      '.pm_badge.muted{color:var(--dsw-alias-label-secondary,#9aa)}' +
+      '.pm_badge.ok{color:var(--dsw-alias-state-success-primary,#4ade80)}' +
+      '.pm_badge.warn{color:var(--dsw-alias-state-warn-primary,#fbbf24)}' +
+      '.pm_badge.brand{color:var(--dsw-alias-brand-primary,#7aa2ff);border-color:var(--dsw-alias-brand-primary,#7aa2ff)}' +
+      '.pm_badge.err{color:var(--dsw-alias-state-error-primary,#f87171)}' +
+      /* buttons */
+      '.pm_actions{display:flex;gap:8px;align-items:center;flex-wrap:wrap}' +
+      '.pm_btn{cursor:pointer;font:inherit;font-size:12px;padding:5px 12px;border-radius:8px;border:1px solid var(--dsw-alias-border-l2,rgba(128,128,128,.4));background:transparent;color:inherit;transition:background .12s}' +
+      '.pm_btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-2,rgba(128,128,128,.14))}' +
+      '.pm_btn:disabled{opacity:.45;cursor:default}' +
+      '.pm_btn.primary{border-color:transparent;background:var(--dsw-alias-brand-primary,#5b8cff);color:#fff}' +
+      '.pm_btn.primary:hover:not(:disabled){filter:brightness(1.08)}' +
+      '.pm_btn.danger{color:var(--dsw-alias-state-error-primary,#f87171);border-color:currentColor}' +
+      '.pm_btn.ghost{border-style:dashed}' +
+      /* form */
       '.pm_form{display:grid;grid-template-columns:1fr 1fr;gap:10px}' +
-      '.pm_form label{display:flex;flex-direction:column;gap:4px;font-size:12px}' +
-      '.pm_form input,.pm_form textarea,.pm_form select{font:inherit;font-size:13px;padding:6px 8px;border-radius:8px;border:1px solid rgba(128,128,128,.4);background:transparent;color:inherit}' +
+      '.pm_form label{display:flex;flex-direction:column;gap:4px;font-size:12px;color:var(--dsw-alias-label-secondary,#9aa)}' +
+      '.pm_form input,.pm_form textarea,.pm_form select{font:inherit;font-size:13px;padding:6px 9px;border-radius:8px;border:1px solid var(--dsw-alias-border-l2,rgba(128,128,128,.35));background:var(--dsw-alias-bg-layer-1,rgba(255,255,255,.03));color:inherit}' +
+      '.pm_form input:focus,.pm_form textarea:focus,.pm_form select:focus{outline:2px solid var(--dsw-alias-brand-primary,rgba(91,140,255,.5));outline-offset:0;border-color:transparent}' +
       '.pm_form .wide{grid-column:1 / -1}' +
-      '.pm_add{border-style:dashed}' +
-      '.pm_hint{font-size:12px;color:var(--dsw-alias-label-secondary,#888)}' +
-      '.pm_textarea{font-family:ui-monospace,Menlo,Consolas,monospace;min-height:140px}'
+      '.pm_textarea{font-family:ui-monospace,Menlo,Consolas,monospace;min-height:140px}' +
+      /* market */
+      '.pm_search{display:flex;gap:8px}' +
+      '.pm_search input{flex:1;font:inherit;font-size:13px;padding:7px 11px;border-radius:9px;border:1px solid var(--dsw-alias-border-l2,rgba(128,128,128,.35));background:var(--dsw-alias-bg-layer-1,rgba(255,255,255,.03));color:inherit}' +
+      '.pm_search input:focus{outline:2px solid var(--dsw-alias-brand-primary,rgba(91,140,255,.5));border-color:transparent}' +
+      '.pm_groupHead{font-size:12px;font-weight:600;color:var(--dsw-alias-label-secondary,#9aa);text-transform:uppercase;letter-spacing:.08em;margin:8px 0 2px}' +
+      '.pm_code{font-family:ui-monospace,Menlo,Consolas,monospace;font-size:11.5px;line-height:1.55;background:var(--dsw-alias-bg-base,rgba(0,0,0,.25));border:1px solid var(--dsw-alias-border-l1,rgba(128,128,128,.2));border-radius:8px;padding:8px 10px;overflow:auto;max-height:220px;white-space:pre-wrap;word-break:break-all;color:var(--dsw-alias-label-secondary,#9aa)}' +
+      '.pm_envRow{display:flex;gap:8px;align-items:baseline;font-size:12px;color:var(--dsw-alias-label-secondary,#9aa)}' +
+      '.pm_envRow code{color:var(--dsw-alias-label-primary,#ddd)}' +
+      '.pm_spinner{display:inline-block;width:12px;height:12px;border:2px solid var(--dsw-alias-border-l2,rgba(128,128,128,.4));border-top-color:var(--dsw-alias-brand-primary,#5b8cff);border-radius:50%;animation:pm_spin .7s linear infinite;vertical-align:-2px}' +
+      '@keyframes pm_spin{to{transform:rotate(360deg)}}' +
+      '.pm_err{color:var(--dsw-alias-state-error-primary,#f87171);font-size:12px}' +
+      '.pm_ok{color:var(--dsw-alias-state-success-primary,#4ade80);font-size:12px}' +
+      '.pm_empty{font-size:12px;color:var(--dsw-alias-label-secondary,#888);padding:10px 2px}' +
+      '.pm_btnrow{display:flex;gap:8px;align-items:center;flex-wrap:wrap}'
 
     if (typeof document !== 'undefined' && document.querySelector('style[data-plugin-css="@omdp/dsh-connector/section"]') === null) {
       var tag = document.createElement('style')
@@ -66,6 +103,45 @@ window.__ModuleLoader__.load({
       })
     }
 
+    // Clipboard with a fallback: 127.0.0.1 is a secure context so
+    // navigator.clipboard normally works; execCommand covers edge cases.
+    function copyText(text, done) {
+      function fallback() {
+        try {
+          var ta = document.createElement('textarea')
+          ta.value = text
+          ta.style.position = 'fixed'
+          ta.style.opacity = '0'
+          document.body.appendChild(ta)
+          ta.focus()
+          ta.select()
+          var ok = document.execCommand('copy')
+          document.body.removeChild(ta)
+          done(ok === true)
+        } catch (e) {
+          done(false)
+        }
+      }
+      if (navigator.clipboard && navigator.clipboard.writeText) {
+        navigator.clipboard.writeText(text).then(function () { done(true) }, fallback)
+      } else {
+        fallback()
+      }
+    }
+
+    function useCopied() {
+      var _a = react.useState('')
+      var copied = _a[0]
+      var setCopied = _a[1]
+      function copy(text) {
+        copyText(text, function (ok) {
+          setCopied(ok ? '已复制 ✓' : '复制失败')
+          setTimeout(function () { setCopied('') }, 1600)
+        })
+      }
+      return { copied: copied, copy: copy }
+    }
+
     // Server ids must stay kebab-case under the fixed `mcp-` prefix: the host
     // parser and dsh-mcp-client both key on it, so the prefix is not optional.
     var MCP_ID_RE = /^mcp-[a-z0-9]+(?:-[a-z0-9]+)*$/
@@ -91,6 +167,10 @@ window.__ModuleLoader__.load({
       )
     }
 
+    function badge(text, kind) {
+      return createElement('span', { className: 'pm_badge ' + kind }, text)
+    }
+
     function ManageTab() {
       var _a = react.useState('mcp')
       var tab = _a[0]
@@ -122,16 +202,21 @@ window.__ModuleLoader__.load({
 
       return createElement('div', { className: 'pm_root' },
         createElement('div', { className: 'pm_tabs' },
-          createElement('button', { className: 'pm_btn' + (tab === 'mcp' ? ' primary' : ''), onClick: function () { setTab('mcp') } }, 'MCP 服务器 MCP Servers'),
-          createElement('button', { className: 'pm_btn' + (tab === 'skills' ? ' primary' : ''), onClick: function () { setTab('skills') } }, 'Skills 技能'),
+          createElement('button', { className: 'pm_tab' + (tab === 'mcp' ? ' active' : ''), onClick: function () { setTab('mcp') } }, 'MCP 服务器'),
+          createElement('button', { className: 'pm_tab' + (tab === 'skills' ? ' active' : ''), onClick: function () { setTab('skills') } }, 'Skills 技能'),
+          createElement('button', { className: 'pm_tab' + (tab === 'market' ? ' active' : ''), onClick: function () { setTab('market') } }, '市场探索'),
         ),
         error ? createElement('div', { className: 'pm_err' }, error) : null,
         tab === 'mcp'
           ? createElement(McpPane, { mcp: mcp, busy: busy, onChanged: refresh })
-          : createElement(SkillPane, { skills: skills, busy: busy, onChanged: refresh }),
+          : tab === 'skills'
+            ? createElement(SkillPane, { skills: skills, busy: busy, onChanged: refresh })
+            : createElement(MarketPane, { skills: skills, onChanged: refresh }),
       )
     }
 
+    /* ─────────────────────────── MCP servers ─────────────────────────── */
+
     function McpPane(props) {
       var _a = react.useState(null)
       var editing = _a[0]
@@ -163,10 +248,10 @@ window.__ModuleLoader__.load({
       }
 
       var rows = props.mcp.servers.map(function (s) {
-        return createElement('div', { className: 'pm_row', key: s.id },
-          createElement('div', { className: 'pm_rowHead' },
+        return createElement('div', { className: 'pm_card', key: s.id },
+          createElement('div', { className: 'pm_cardHead' },
             createElement('span', { className: 'pm_name' }, s.name || s.id),
-            createElement('span', { className: 'pm_kind' }, s.transport || 'stdio'),
+            badge(s.transport || 'stdio', 'muted'),
           ),
           createElement('div', { className: 'pm_meta' }, s.url ? 'url: ' + s.url : (s.command ? 'cmd: ' + s.command : '')),
           createElement('div', { className: 'pm_actions' },
@@ -177,13 +262,16 @@ window.__ModuleLoader__.load({
       })
 
       return createElement('div', { className: 'pm_section' },
-        createElement('div', { className: 'pm_sectionHead' }, 'MCP 服务器 MCP Servers'),
+        createElement('div', { className: 'pm_sectionHead' },
+          'MCP 服务器 MCP Servers',
+          props.busy ? createElement('span', { className: 'pm_spinner' }) : null,
+        ),
         err ? createElement('div', { className: 'pm_err' }, err) : null,
-        createElement('div', { className: 'pm_hint' },
+        createElement('div', { className: 'pm_meta' },
           props.mcp.exists ? '编辑 profiles/web/cordis.patch.yml 中的 mcp-* 块。保存后重启 dsh 生效。Edit the mcp-* block in cordis.patch.yml; restart dsh to apply.' : '未找到 cordis.patch.yml。cordis.patch.yml not found.'),
         rows,
         editing === null
-          ? createElement('button', { className: 'pm_btn pm_add', onClick: function () { setEditing({ id: 'mcp-new', customId: '', name: '', transport: 'stdio', serverName: '', url: '', command: '', args: '' }) } }, '＋ 添加 MCP 服务器 Add MCP Server')
+          ? createElement('button', { className: 'pm_btn pm_btn ghost', onClick: function () { setEditing({ id: 'mcp-new', customId: '', name: '', transport: 'stdio', serverName: '', url: '', command: '', args: '' }) } }, '＋ 添加 MCP 服务器 Add MCP Server')
           : createElement(ServerForm, { value: editing, onSave: save, onCancel: function () { setEditing(null) } }),
       )
     }
@@ -272,7 +360,7 @@ window.__ModuleLoader__.load({
         }
       }
 
-      return createElement('div', { className: 'pm_row' },
+      return createElement('div', { className: 'pm_card' },
         err ? createElement('div', { className: 'pm_err' }, err) : null,
         createElement('div', { className: 'pm_form' },
           field('名称 (serverName) Name', v.serverName, set('serverName')),
@@ -298,6 +386,8 @@ window.__ModuleLoader__.load({
       )
     }
 
+    /* ───────────────────────────── Skills ────────────────────────────── */
+
     function SkillPane(props) {
       var _a = react.useState(null)
       var editing = _a[0]
@@ -305,6 +395,12 @@ window.__ModuleLoader__.load({
       var _b = react.useState('')
       var err = _b[0]
       var setErr = _b[1]
+      var _c = react.useState(null)
+      var updates = _c[0]
+      var setUpdates = _c[1]
+      var _d = react.useState(false)
+      var checking = _d[0]
+      var setChecking = _d[1]
 
       function open(name) {
         api('/skills/' + encodeURIComponent(name), { method: 'GET' }).then(function (skill) {
@@ -328,11 +424,22 @@ window.__ModuleLoader__.load({
           props.onChanged()
         })
       }
+      function checkUpdates() {
+        setChecking(true)
+        setErr('')
+        api('/skills/check-updates', { method: 'GET' }).then(function (r) {
+          if (r && r.error) { setErr(r.error); setUpdates(null); return }
+          setUpdates(r.items || [])
+        }).finally(function () { setChecking(false) })
+      }
 
       var rows = props.skills.map(function (s) {
-        return createElement('div', { className: 'pm_row', key: s.name },
-          createElement('div', { className: 'pm_rowHead' },
+        var update = updates ? updates.find(function (u) { return u.name === s.name }) : null
+        return createElement('div', { className: 'pm_card', key: s.name },
+          createElement('div', { className: 'pm_cardHead' },
             createElement('span', { className: 'pm_name' }, s.name),
+            s.source ? badge('来源 ' + s.source, 'muted') : null,
+            update ? (update.updateAvailable ? badge('有更新', 'warn') : badge('最新', 'ok')) : null,
           ),
           createElement('div', { className: 'pm_meta' }, s.description || ''),
           createElement('div', { className: 'pm_actions' },
@@ -343,12 +450,18 @@ window.__ModuleLoader__.load({
       })
 
       return createElement('div', { className: 'pm_section' },
-        createElement('div', { className: 'pm_sectionHead' }, '用户 Skills (~/.dsh/skills) User Skills'),
+        createElement('div', { className: 'pm_sectionHead' },
+          '用户 Skills (~/.dsh/skills) User Skills',
+          props.busy ? createElement('span', { className: 'pm_spinner' }) : null,
+          createElement('span', { className: 'pm_actions', style: { marginLeft: 'auto' } },
+            createElement('button', { className: 'pm_btn', disabled: checking, onClick: checkUpdates }, checking ? '检查中…' : '检查更新'),
+          ),
+        ),
         err ? createElement('div', { className: 'pm_err' }, err) : null,
-        createElement('div', { className: 'pm_hint' }, '读写用户技能目录，保存即生效（skill catalog 自动刷新）。Read/write user skills; saved changes take effect immediately.'),
+        createElement('div', { className: 'pm_meta' }, '读写用户技能目录，保存即生效（skill catalog 自动刷新）。带来源的 skill 可与魔搭市场比对更新时间。Read/write user skills; saved changes take effect immediately.'),
         rows,
         editing === null
-          ? createElement('button', { className: 'pm_btn pm_add', onClick: function () { setEditing({ name: '', description: '', content: '' }) } }, '＋ 新建 Skill New Skill')
+          ? createElement('button', { className: 'pm_btn pm_btn ghost', onClick: function () { setEditing({ name: '', description: '', content: '' }) } }, '＋ 新建 Skill New Skill')
           : createElement(SkillForm, { value: editing, onSave: save, onCancel: function () { setEditing(null) } }),
       )
     }
@@ -370,7 +483,7 @@ window.__ModuleLoader__.load({
         props.onSave(Object.assign({}, v, { name: name }))
       }
 
-      return createElement('div', { className: 'pm_row' },
+      return createElement('div', { className: 'pm_card' },
         err ? createElement('div', { className: 'pm_err' }, err) : null,
         createElement('div', { className: 'pm_form' },
           field('名称 (kebab-case) Name', v.name, set('name')),
@@ -387,6 +500,266 @@ window.__ModuleLoader__.load({
       )
     }
 
+    /* ─────────────────────────── marketplace ─────────────────────────── */
+
+    function MarketPane(props) {
+      var _a = react.useState('')
+      var mcpSearch = _a[0]
+      var setMcpSearch = _a[1]
+      var _b = react.useState(null)
+      var mcpResult = _b[0]
+      var setMcpResult = _b[1]
+      var _c = react.useState(false)
+      var mcpBusy = _c[0]
+      var setMcpBusy = _c[1]
+      var _d = react.useState({})
+      var mcpDetail = _d[0]
+      var setMcpDetail = _d[1]
+      var _e = react.useState('')
+      var skillSearch = _e[0]
+      var setSkillSearch = _e[1]
+      var _f = react.useState(null)
+      var skillResult = _f[0]
+      var setSkillResult = _f[1]
+      var _g = react.useState(false)
+      var skillBusy = _g[0]
+      var setSkillBusy = _g[1]
+      var _h = react.useState({})
+      var skillDetail = _h[0]
+      var setSkillDetail = _h[1]
+      var _i = react.useState('')
+      var err = _i[0]
+      var setErr = _i[1]
+
+      function findMcp() {
+        setMcpBusy(true)
+        setErr('')
+        api('/market/mcp?search=' + encodeURIComponent(mcpSearch.trim()), { method: 'GET' }).then(function (r) {
+          if (r && r.error) { setErr(r.error); setMcpResult(null); return }
+          setMcpResult(r)
+        }).finally(function () { setMcpBusy(false) })
+      }
+      function findSkills() {
+        setSkillBusy(true)
+        setErr('')
+        api('/market/skills?search=' + encodeURIComponent(skillSearch.trim()), { method: 'GET' }).then(function (r) {
+          if (r && r.error) { setErr(r.error); setSkillResult(null); return }
+          setSkillResult(r)
+        }).finally(function () { setSkillBusy(false) })
+      }
+      function openMcp(id) {
+        api('/market/mcp/' + encodeURIComponent(id), { method: 'GET' }).then(function (r) {
+          if (r && r.error) { setErr(r.error); return }
+          var next = Object.assign({}, mcpDetail)
+          next[id] = r.item
+          setMcpDetail(next)
+        })
+      }
+      function openSkill(id) {
+        api('/market/skills/' + encodeURIComponent(id), { method: 'GET' }).then(function (r) {
+          if (r && r.error) { setErr(r.error); return }
+          var next = Object.assign({}, skillDetail)
+          next[id] = r.item
+          setSkillDetail(next)
+        })
+      }
+
+      var mcpRows = mcpResult && mcpResult.items
+        ? mcpResult.items.map(function (s) {
+            var d = mcpDetail[s.id]
+            return createElement(McpMarketItem, {
+              key: s.id, item: s, detail: d,
+              onOpen: function () { if (!d) openMcp(s.id) },
+            })
+          })
+        : []
+
+      var skillRows = skillResult && skillResult.items
+        ? skillResult.items.map(function (s) {
+            var d = skillDetail[s.id]
+            return createElement(SkillMarketItem, {
+              key: s.id, item: s, detail: d, skills: props.skills,
+              onOpen: function () { if (!d) openSkill(s.id) },
+              onChanged: props.onChanged,
+            })
+          })
+        : []
+
+      return createElement('div', { className: 'pm_section' },
+        createElement('div', { className: 'pm_sectionHead' }, '市场探索 Marketplace'),
+        createElement('div', { className: 'pm_meta' },
+          '浏览魔搭社区（ModelScope）技能中心与 MCP 广场。列表数据缓存在 DSH 进程内存（30 分钟），不写任何文件；安装/部署请复制命令自行执行。Browse ModelScope Skills Center & MCP Plaza; cached in-process only, nothing saved to disk.'),
+        err ? createElement('div', { className: 'pm_err' }, err) : null,
+
+        createElement('div', { className: 'pm_groupHead' }, 'MCP 市场 MCP Plaza'),
+        createElement('div', { className: 'pm_search' },
+          createElement('input', {
+            placeholder: '搜索 MCP 服务，如 map / github / fetch Search…',
+            value: mcpSearch,
+            onChange: function (e) { setMcpSearch(e.target.value) },
+            onKeyDown: function (e) { if (e.key === 'Enter') findMcp() },
+          }),
+          createElement('button', { className: 'pm_btn primary', disabled: mcpBusy, onClick: findMcp }, mcpBusy ? '搜索中…' : '搜索'),
+        ),
+        mcpRows.length ? mcpRows : (mcpResult ? createElement('div', { className: 'pm_empty' }, '没有匹配的 MCP 服务。No matching MCP servers.') : null),
+
+        createElement('div', { className: 'pm_groupHead', style: { marginTop: '18px' } }, 'Skills 市场 Skills Center'),
+        createElement('div', { className: 'pm_search' },
+          createElement('input', {
+            placeholder: '搜索技能，如 code-review / deploy Search…',
+            value: skillSearch,
+            onChange: function (e) { setSkillSearch(e.target.value) },
+            onKeyDown: function (e) { if (e.key === 'Enter') findSkills() },
+          }),
+          createElement('button', { className: 'pm_btn primary', disabled: skillBusy, onClick: findSkills }, skillBusy ? '搜索中…' : '搜索'),
+        ),
+        skillRows.length ? skillRows : (skillResult ? createElement('div', { className: 'pm_empty' }, '没有匹配的技能。No matching skills.') : null),
+      )
+    }
+
+    // One MCP market entry with a lazy detail panel.
+    function McpMarketItem(props) {
+      var item = props.item
+      var d = props.detail
+      var _a = react.useState(null)
+      var variant = _a[0]
+      var setVariant = _a[1]
+      var copied = useCopied()
+      var configs = d && Array.isArray(d.serverConfig) ? d.serverConfig : []
+      var cfgText = ''
+      if (configs.length) {
+        var sel = variant !== null && variant < configs.length ? configs[variant] : configs[0]
+        cfgText = JSON.stringify(sel, null, 2)
+      }
+
+      return createElement('div', { className: 'pm_card', key: item.id },
+        createElement('div', { className: 'pm_cardHead' },
+          createElement('span', { className: 'pm_name' }, item.name || item.id),
+          item.configured ? badge('已配置', 'ok') : null,
+          badge(item.id, 'muted'),
+        ),
+        createElement('div', { className: 'pm_desc' }, item.description || ''),
+        createElement('div', { className: 'pm_meta' },
+          'by ' + (item.publisher || '—'),
+          item.views !== undefined ? ' · ' + item.views + ' 浏览' : '',
+        ),
+        createElement('div', { className: 'pm_actions' },
+          createElement('button', { className: 'pm_btn', onClick: props.onOpen }, d ? '收起' : '详情'),
+          d && configs.length
+            ? createElement('button', { className: 'pm_btn primary', onClick: function () { copied.copy(cfgText) } },
+                copied.copied || '复制配置 Copy config')
+            : null,
+        ),
+        d ? createElement('div', { className: 'pm_section', style: { marginTop: '4px' } },
+          createElement('div', { className: 'pm_actions' },
+            d.hosted ? badge('Hosted 官方托管', 'brand') : null,
+            d.verified ? badge('已认证 Verified', 'brand') : null,
+            d.stars !== undefined && d.stars !== null ? badge('★ ' + d.stars, 'muted') : null,
+            (d.categories && d.categories.length) ? badge(d.categories.slice(0, 3).join(' / '), 'muted') : null,
+          ),
+          (d.envSchema && d.envSchema.length)
+            ? createElement('div', { className: 'pm_meta' },
+                '环境变量 Env vars: ',
+                d.envSchema.map(function (ev) {
+                  return createElement('span', { key: ev.key, className: 'pm_envRow' },
+                    createElement('code', null, ev.key),
+                    ev.required ? badge('必填', 'warn') : null,
+                  )
+                }),
+              )
+            : null,
+          configs.length
+            ? createElement('div', { className: 'pm_section' },
+                configs.length > 1
+                  ? selectField('配置变体 Config variant', variant === null ? 0 : variant, configs.map(function (_, i) { return 'variant ' + (i + 1) }), function (i) { setVariant(Number(i)) })
+                  : null,
+                createElement('div', { className: 'pm_code' }, cfgText),
+              )
+            : null,
+          d.readme ? createElement('div', { className: 'pm_meta' }, d.readme.slice(0, 240) + (d.readme.length > 240 ? ' …' : '')) : null,
+          d.source ? createElement('div', { className: 'pm_meta' }, '来源: ' + d.source) : null,
+        ) : null,
+      )
+    }
+
+    // One market skill entry with install commands and local "record source".
+    function SkillMarketItem(props) {
+      var item = props.item
+      var d = props.detail
+      var copied = useCopied()
+      var _a = react.useState('')
+      var linkErr = _a[0]
+      var setLinkErr = _a[1]
+      var _b = react.useState('')
+      var linkOk = _b[0]
+      var setLinkOk = _b[1]
+      var _c = react.useState(null)
+      var target = _c[0]
+      var setTarget = _c[1]
+
+      var alreadyLinked = props.skills.some(function (s) { return s.source === item.id })
+      var installs = d && Array.isArray(d.installCommand) ? d.installCommand : []
+
+      function recordSource() {
+        setLinkErr('')
+        setLinkOk('')
+        if (!target) { setLinkErr('请先选择一个本地技能 Please pick a local skill'); return }
+        api('/skills/' + encodeURIComponent(target) + '/source', {
+          method: 'POST',
+          body: JSON.stringify({ marketId: item.id, modified: d ? d.fileModified : undefined }),
+        }).then(function (r) {
+          if (r && r.error) { setLinkErr(r.error); return }
+          setLinkOk('已关联 ' + target + ' ✓')
+          props.onChanged()
+        })
+      }
+
+      return createElement('div', { className: 'pm_card', key: item.id },
+        createElement('div', { className: 'pm_cardHead' },
+          createElement('span', { className: 'pm_name' }, item.name || item.id),
+          item.installed || alreadyLinked ? badge('已安装', 'ok') : null,
+          item.developer ? badge('by ' + item.developer, 'muted') : null,
+          item.category ? badge(item.category, 'muted') : null,
+        ),
+        createElement('div', { className: 'pm_desc' }, item.description || ''),
+        createElement('div', { className: 'pm_meta' },
+          item.downloads !== undefined ? item.downloads + ' 下载' : '',
+          item.views !== undefined ? ' · ' + item.views + ' 浏览' : '',
+          item.license ? ' · ' + item.license : '',
+        ),
+        createElement('div', { className: 'pm_actions' },
+          createElement('button', { className: 'pm_btn', onClick: props.onOpen }, d ? '收起' : '详情'),
+          d && d.updateAvailable ? badge('有更新', 'warn') : null,
+        ),
+        d ? createElement('div', { className: 'pm_section', style: { marginTop: '4px' } },
+          createElement('div', { className: 'pm_meta' },
+            '市场更新时间 Market modified: ' + (d.fileModified || '—'),
+            d.localSkill ? ' · 本地记录: ' + d.localSkill.sourceUpdated : '',
+          ),
+          installs.length
+            ? createElement('div', { className: 'pm_section' },
+                createElement('div', { className: 'pm_meta' }, '安装命令 Install command（复制后自行执行）:'),
+                installs.map(function (cmd, i) {
+                  return createElement('div', { key: i, className: 'pm_btnrow' },
+                    createElement('div', { className: 'pm_code', style: { flex: 1 } }, cmd),
+                    createElement('button', { className: 'pm_btn', onClick: function () { copied.copy(cmd) } }, copied.copied || '复制 Copy'),
+                  )
+                }),
+              )
+            : null,
+          alreadyLinked
+            ? createElement('div', { className: 'pm_ok' }, '已关联到本地技能 ✓ Linked to a local skill.')
+            : createElement('div', { className: 'pm_btnrow' },
+                selectField('关联本地技能 Link to local skill', target || '', props.skills.map(function (s) { return s.name }), setTarget),
+                createElement('button', { className: 'pm_btn', onClick: recordSource }, '记录来源 Record source'),
+              ),
+          linkErr ? createElement('div', { className: 'pm_err' }, linkErr) : null,
+          linkOk ? createElement('div', { className: 'pm_ok' }, linkOk) : null,
+          d.source ? createElement('div', { className: 'pm_meta' }, '来源: ' + d.source) : null,
+        ) : null,
+      )
+    }
+
     function apply(ctx) {
       var slots = ctx.get('slots')
       if (slots === undefined) return
@@ -401,4 +774,4 @@ window.__ModuleLoader__.load({
     exports.apply = apply
     return module.exports
   },
-})
+})

package/index.js

@@ -348,6 +348,10 @@ function serializeSkill(skill) {
   if (skill.whenToUse !== undefined) fm.whenToUse = skill.whenToUse
   if (skill.modelInvocable !== undefined) fm.modelInvocable = skill.modelInvocable
   if (skill.userInvocable !== undefined) fm.userInvocable = skill.userInvocable
+  // Marketplace provenance: set by "record source" in the UI, consumed by the
+  // update check (compares market file_last_modified against sourceUpdated).
+  if (skill.source !== undefined) fm.source = skill.source
+  if (skill.sourceUpdated !== undefined) fm.sourceUpdated = skill.sourceUpdated
   const head = '---\n' + stringifyYaml(fm) + '---\n'
   return head + (skill.content || '')
 }
@@ -369,6 +373,9 @@ async function readUserSkill(home, name) {
     whenToUse: fm.data.whenToUse,
     modelInvocable: fm.data.modelInvocable,
     userInvocable: fm.data.userInvocable,
+    // Marketplace provenance survives read so edits keep it unless replaced.
+    source: fm.data.source,
+    sourceUpdated: fm.data.sourceUpdated,
     content: fm.body,
   }
 }
@@ -386,7 +393,7 @@ async function listUserSkills() {
   for (const entry of entries) {
     if (!entry.isDirectory()) continue
     const skill = await readUserSkill(resolveHome(), entry.name)
-    if (skill) out.push({ name: skill.name, description: skill.description || '' })
+    if (skill) out.push({ name: skill.name, description: skill.description || '', source: skill.source, sourceUpdated: skill.sourceUpdated })
   }
   return out
 }
@@ -400,9 +407,18 @@ async function saveUserSkill(home, skill) {
   if (skill.content && /(^|\n)\s*---\s*(\n|$)/.test(skill.content)) {
     throw new Error('skill content must not contain a standalone "---" line')
   }
+  // Keep marketplace provenance when an edit does not carry it: the editor
+  // round-trips content only, so dropping source here would silently sever
+  // the update-check link on every save.
+  const existing = await readUserSkill(home, skill.name).catch(() => undefined)
+  const merged = {
+    ...skill,
+    source: skill.source !== undefined ? skill.source : existing?.source,
+    sourceUpdated: skill.sourceUpdated !== undefined ? skill.sourceUpdated : existing?.sourceUpdated,
+  }
   const dir = join(skillsRoot(), skill.name)
   const file = join(dir, 'SKILL.md')
-  const serialized = serializeSkill(skill)
+  const serialized = serializeSkill(merged)
   // Round-trip check: the file we are about to write must parse back into a
   // valid skill (name + at least one closing delimiter). If not, refuse.
   if (!parseFrontmatter(serialized)) {
@@ -418,6 +434,247 @@ async function removeUserSkill(home, name) {
   await rm(join(skillsRoot(), name), { recursive: true, force: true })
 }
 
+/* ──────────────────── ModelScope marketplace proxy ───────────────────────
+ * Read-only browsing of the ModelScope Skills Center and MCP Plaza. All
+ * market data lives in a 30-minute in-process cache — nothing is written to
+ * disk, no files ever accumulate, and a restart clears it. Install / deploy
+ * are NOT performed: the UI only lists entries and copies install commands /
+ * server config for the user to run themselves. Browsing uses anonymous
+ * endpoints; no MODELSCOPE_API_KEY is required.
+ * ───────────────────────────────────────────────────────────────────────── */
+
+const MARKET_BASE = process.env.DSH_CONNECTOR_MARKET ?? 'https://modelscope.cn/openapi/v1'
+const MARKET_TTL = 30 * 60 * 1000 // 30 minutes in-process cache
+const marketCache = new Map()
+
+async function marketFetch(key, path, init) {
+  const hit = marketCache.get(key)
+  if (hit !== undefined && Date.now() - hit.at < MARKET_TTL) return hit.value
+  const res = await fetch(MARKET_BASE + path, {
+    ...init,
+    headers: { accept: 'application/json', ...(init?.headers ?? {}) },
+    signal: AbortSignal.timeout(15000),
+  })
+  if (!res.ok) throw new Error(`market returned HTTP ${res.status}`)
+  const data = await res.json()
+  marketCache.set(key, { at: Date.now(), value: data })
+  return data
+}
+
+function marketError(res, error) {
+  return json(res, 502, { error: `market unavailable: ${String(error?.message ?? error)}` })
+}
+
+// Skill ids come back as `@author/name` and appear in URLs verbatim. Only
+// accept the safe alphabet so a crafted id can never escape the path.
+const MARKET_ID = /^@?[a-zA-Z0-9_-]+\/[a-zA-Z0-9_-]+$/
+
+// GET /api/market/skills?search=&category=&page=
+async function marketSkillsList(req, res, params) {
+  const search = params.get('search')?.trim()
+  const category = params.get('category')?.trim()
+  const page = Math.max(1, Number(params.get('page')) || 1)
+  const qs = new URLSearchParams({ page_number: String(page), page_size: '20' })
+  if (search) qs.set('search', search)
+  if (category) qs.set('filter.category', category)
+  let data
+  try {
+    data = await marketFetch(`skills?${qs}`, `/skills?${qs}`)
+  } catch (error) {
+    return marketError(res, error)
+  }
+  const local = await listUserSkills().catch(() => [])
+  const items = (data?.data?.skills ?? []).map((s) => ({
+    id: s.id,
+    name: s.display_name,
+    description: s.description,
+    developer: s.developer,
+    category: s.category,
+    license: s.license,
+    views: s.view_count,
+    downloads: s.downloads,
+    source: s.source_url,
+    logo: s.logo_url,
+    installed: local.some((l) => l.source === s.id),
+  }))
+  return json(res, 200, { ok: true, items })
+}
+
+// GET /api/market/skills/:id  (id is `@author/name`, may contain a slash)
+async function marketSkillDetail(res, id) {
+  let data
+  try {
+    data = await marketFetch(`skills/${id}`, `/skills/${id}`)
+  } catch (error) {
+    return marketError(res, error)
+  }
+  const d = data?.data ?? {}
+  const local = (await listUserSkills().catch(() => [])).find((l) => l.source === id)
+  let updateAvailable = false
+  if (local && d.file_last_modified && local.sourceUpdated) {
+    updateAvailable = new Date(d.file_last_modified).getTime() > new Date(local.sourceUpdated).getTime()
+  }
+  return json(res, 200, {
+    ok: true,
+    item: {
+      id: d.id,
+      name: d.display_name,
+      description: d.description,
+      owner: d.owner || d.developer,
+      developer: d.developer,
+      category: d.category,
+      license: d.license,
+      tags: Array.isArray(d.tags) ? d.tags.filter((t) => !t.startsWith('category:') && !t.startsWith('developer:') && !t.startsWith('custom_tag:')) : [],
+      views: d.view_count,
+      downloads: d.downloads,
+      source: d.source_url,
+      logo: d.logo_url,
+      private: d.private === true,
+      installCommand: Array.isArray(d.install_command) ? d.install_command : [],
+      fileModified: d.file_last_modified ?? null,
+      lastModified: d.last_modified ?? null,
+      updateAvailable,
+      localSkill: local ? { name: local.name, sourceUpdated: local.sourceUpdated ?? null } : null,
+    },
+  })
+}
+
+// GET /api/market/mcp?search=&page=
+async function marketMcpList(req, res, params) {
+  const search = params.get('search')?.trim()
+  const page = Math.max(1, Number(params.get('page')) || 1)
+  const body = { page_number: page, page_size: 20 }
+  if (search) body.search = search
+  const key = `mcp?${JSON.stringify(body)}`
+  let data
+  try {
+    data = await marketFetch(key, '/mcp/servers', {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+  } catch (error) {
+    return marketError(res, error)
+  }
+  // "configured" = already present in the local patch's mcp-* block (matched
+  // by the server's own id/args/url text appearing in a local entry).
+  let localMatches = []
+  try {
+    const text = await readFile(patchPath(), 'utf8')
+    const found = findMcpBlock(text)
+    if (found) {
+      const configured = parseMcpServers(found.blockText).map((s) => (s.command + ' ' + (Array.isArray(s.args) ? s.args.join(' ') : s.args || '') + ' ' + (s.url || '')).toLowerCase())
+      localMatches = configured.filter(Boolean)
+    }
+  } catch {
+    // patch missing/unreadable: no configured markers, market still works
+  }
+  const items = (data?.data?.mcp_server_list ?? []).map((s) => ({
+    id: s.id,
+    name: s.chinese_name || s.name,
+    description: s.description,
+    publisher: s.publisher,
+    tags: s.tags,
+    logo: s.logo_url,
+    views: s.view_count,
+    categories: s.categories,
+    configured: localMatches.some((local) => local.includes(s.id.toLowerCase())),
+  }))
+  return json(res, 200, { ok: true, items })
+}
+
+// Reduce a JSONSchema env block to its variable list (never ship the raw
+// schema wholesale — it can be large and contains no browsing value).
+function envSchemaSummary(schema) {
+  if (!schema || typeof schema !== 'object' || !schema.properties || typeof schema.properties !== 'object') return undefined
+  const required = Array.isArray(schema.required) ? schema.required : []
+  return Object.entries(schema.properties).map(([key, v]) => ({
+    key,
+    required: required.includes(key),
+    hint: typeof v === 'object' && v ? (v.title || v.description || '') : '',
+  }))
+}
+
+// GET /api/market/mcp/:id
+async function marketMcpDetail(res, id) {
+  let data
+  try {
+    data = await marketFetch(`mcp/${id}`, `/mcp/servers/${id}`)
+  } catch (error) {
+    return marketError(res, error)
+  }
+  const d = data?.data ?? {}
+  return json(res, 200, {
+    ok: true,
+    item: {
+      id: d.id,
+      name: d.chinese_name || d.name,
+      description: d.description,
+      author: d.author,
+      publisher: d.publisher,
+      owner: d.owner,
+      hosted: d.is_hosted === true, // "Hosted" tick on the plaza page
+      verified: d.is_verified === true, // certification tick
+      stars: d.github_stars,
+      source: d.source_url,
+      logo: d.logo_url,
+      categories: d.categories,
+      tags: d.tags,
+      envSchema: envSchemaSummary(d.env_schema),
+      // server_config holds ready-to-paste { mcpServers: {...} } variants.
+      serverConfig: Array.isArray(d.server_config) ? d.server_config : undefined,
+      readme: typeof d.readme === 'string' ? d.readme.slice(0, 2000) : '',
+    },
+  })
+}
+
+// GET /api/skills/check-updates
+// For every installed skill that carries a `source`, pull the market detail
+// (cache-backed) and compare its file_last_modified against the locally
+// recorded sourceUpdated. No files are touched.
+async function checkSkillUpdates(res) {
+  const local = (await listUserSkills().catch(() => [])).filter((s) => s.source)
+  const out = []
+  for (const skill of local) {
+    const id = skill.source
+    let marketModified = null
+    let updateAvailable = false
+    try {
+      const data = await marketFetch(`skills/${id}`, `/skills/${id}`)
+      marketModified = data?.data?.file_last_modified ?? null
+      if (marketModified && skill.sourceUpdated) {
+        updateAvailable = new Date(marketModified).getTime() > new Date(skill.sourceUpdated).getTime()
+      }
+    } catch {
+      // market unreachable: report the entry without an update verdict
+    }
+    out.push({
+      name: skill.name,
+      source: id,
+      sourceUpdated: skill.sourceUpdated ?? null,
+      marketModified,
+      updateAvailable,
+    })
+  }
+  return json(res, 200, { ok: true, items: out })
+}
+
+// POST /api/skills/:name/source  { marketId, modified }
+// Links an installed skill to its marketplace entry by writing `source` and
+// `sourceUpdated` into that skill's own frontmatter — the only disk write in
+// the whole market feature, and it happens only on an explicit user action.
+async function recordSkillSource(res, name, body) {
+  if (!SKILL_NAME.test(name)) return json(res, 400, { error: 'invalid skill name' })
+  const marketId = typeof body?.marketId === 'string' && MARKET_ID.test(body.marketId) ? body.marketId : null
+  if (!marketId) return json(res, 400, { error: 'invalid marketId (expect @author/name)' })
+  const skill = await readUserSkill(resolveHome(), name)
+  if (!skill) return json(res, 404, { error: 'skill not found' })
+  skill.source = marketId
+  skill.sourceUpdated = typeof body.modified === 'string' && body.modified ? body.modified : new Date().toISOString().slice(0, 19) + 'Z'
+  await saveUserSkill(resolveHome(), skill)
+  return json(res, 200, { ok: true, source: marketId })
+}
+
 /* ─────────────────────── MCP server validation ─────────────────────────
  * The authoritative gate between the UI and the patch file: every field the
  * user can type is checked against the exact contract dsh-mcp-client enforces
@@ -619,6 +876,46 @@ export function apply(ctx) {
         return json(res, 200, { ok: true, path: written.path })
       }
 
+      // GET /api/skills/check-updates — update hints for sourced skills
+      if (req.method === 'GET' && path === API_PREFIX + '/skills/check-updates') {
+        return checkSkillUpdates(res)
+      }
+
+      // POST /api/skills/:name/source — link an installed skill to a market id
+      const srcMatch = path.match(new RegExp('^' + API_PREFIX + '/skills/([^/]+)/source$'))
+      if (req.method === 'POST' && srcMatch) {
+        const body = await readBody(req)
+        return recordSkillSource(res, decodeURIComponent(srcMatch[1]), body)
+      }
+
+      /* ── marketplace (read-only ModelScope proxy) ── */
+
+      // GET /api/market/skills?search=&category=&page=
+      if (req.method === 'GET' && path === API_PREFIX + '/market/skills') {
+        return marketSkillsList(req, res, new URL(req.url, 'http://localhost').searchParams)
+      }
+
+      // GET /api/market/skills/:id  (id `@author/name` contains a slash)
+      const mktSkill = path.match(new RegExp('^' + API_PREFIX + '/market/skills/(.+)$'))
+      if (req.method === 'GET' && mktSkill) {
+        const id = decodeURIComponent(mktSkill[1])
+        if (!MARKET_ID.test(id)) return json(res, 400, { error: 'invalid market id' })
+        return marketSkillDetail(res, id)
+      }
+
+      // GET /api/market/mcp?search=&page=
+      if (req.method === 'GET' && path === API_PREFIX + '/market/mcp') {
+        return marketMcpList(req, res, new URL(req.url, 'http://localhost').searchParams)
+      }
+
+      // GET /api/market/mcp/:id
+      const mktMcp = path.match(new RegExp('^' + API_PREFIX + '/market/mcp/(.+)$'))
+      if (req.method === 'GET' && mktMcp) {
+        const id = decodeURIComponent(mktMcp[1])
+        if (!MARKET_ID.test(id)) return json(res, 400, { error: 'invalid market id' })
+        return marketMcpDetail(res, id)
+      }
+
       const skMatch = path.match(new RegExp('^' + API_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '/skills/([^/]+)$'))
 
       // GET /api/skills/:name — get one

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@omdp/dsh-connector",
-  "version": "0.1.2",
-  "description": "Unified DeepSeek Harness connector: edit MCP servers (cordis.patch.yml) and user skills (~/.dsh/skills) from one Web UI settings page.",
+  "version": "0.2.0",
+  "description": "Unified DeepSeek Harness connector: edit MCP servers (cordis.patch.yml), user skills (~/.dsh/skills) and browse the ModelScope MCP/Skills marketplaces from one Web UI settings page.",
   "type": "module",
   "main": "index.js",
   "exports": {