@zaimokuza/dsh-plugin-hub 0.1.2 → 0.2.1

package/package.json

@@ -1,23 +1,14 @@
 {
   "name": "@zaimokuza/dsh-plugin-hub",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "private": false,
-  "description": "Extensible DSH plugin marketplace and reusable enterprise marketplace runtime",
+  "description": "Native DSH resource hub: Skills, MCP, third-party plugins and experiments",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
     ".": "./src/index.js",
     "./client": "./lib/client.js",
-    "./package.json": "./package.json",
-    "./runtime": "./src/index.js",
-    "./catalog": "./src/catalog.js",
-    "./identity": "./src/identity.js",
-    "./client-entry": "./src/client/index.jsx",
-    "./source-plugin": "./src/source-plugin.js",
-    "./provider-api": {
-      "types": "./src/provider-api.d.ts",
-      "default": "./src/provider-api.js"
-    }
+    "./package.json": "./package.json"
   },
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -29,29 +20,31 @@
     "client": {
       "inject": [
         "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-ui-settings"
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-sidebar"
       ],
       "platform": "web"
     }
   },
   "scripts": {
     "build": "node scripts/build.mjs",
-    "test": "node --test tests/*.test.js",
-    "validate:catalog": "node scripts/validate-catalog.mjs"
+    "test": "node --test tests/*.test.js scripts/*.test.mjs",
+    "check": "npm test && npm run build && npm run pack && npm run verify:packed",
+    "pack": "node scripts/pack.mjs",
+    "verify:packed": "node scripts/verify-packed.mjs",
+    "verify:native": "node scripts/verify-native.mjs"
   },
   "dependencies": {
-    "registry-auth-token": "5.1.1",
-    "semver": "7.8.5",
-    "tar": "7.5.22",
-    "undici": "7.28.0",
-    "@zaimokuza/dsh-plugin-hub-catalog-demo": "0.1.2"
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "yaml": "2.9.1"
   },
   "devDependencies": {
     "esbuild": "0.28.1",
     "react": "18.3.1"
   },
   "files": [
-    "src",
+    "src/*.js",
     "lib/client.js",
     "cordis.patch.yml",
     "README.md",
@@ -67,8 +60,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/zaimokuza-yoshiteru/dsh-plugin-hub.git",
-    "directory": "packages/marketplace"
+    "url": "git+https://github.com/zaimokuza-yoshiteru/dsh-plugin-hub.git"
   },
   "homepage": "https://github.com/zaimokuza-yoshiteru/dsh-plugin-hub",
   "bugs": {
@@ -77,7 +69,8 @@
   "dshPluginHub": {
     "hostCompatibility": "capability-based",
     "testedDshVersions": [
-      "0.1.2-rc.1"
+      "0.1.5-rc.1",
+      "0.1.5-rc.2"
     ]
   }
 }

package/src/dsh.js

@@ -1,25 +1,34 @@
-import { spawn } from 'node:child_process';
 import { readFileSync, realpathSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
-import { collectHostPeers } from './host-peers.js';
-import { releaseAgeArgument } from './release-age.js';
 
 /** All knowledge about the DSH process and its profile lives in this adapter. */
-export function dshEnvironment(profile = 'web') {
-  if (!/^[a-zA-Z0-9_-]+$/.test(profile)) throw new Error('profile 名称无效');
-  const cli = realpathSync(process.argv[1]);
-  const manifest = JSON.parse(readFileSync(join(dirname(cli), '..', 'package.json'), 'utf8'));
-  if (manifest.name !== '@deepseek-ai/dsh') throw new Error('请通过 DSH CLI 启动此插件');
-  const configuredHome = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
-  const home = configuredHome === '~' ? homedir() : /^~[/\\]/.test(configuredHome) ? join(homedir(), configuredHome.slice(2)) : configuredHome;
-  const profileDir = resolve(home, 'profiles', profile);
-  const peers = collectHostPeers(join(dirname(cli), '..', 'package.json'));
-  return { cli, profileDir, profile, host: { dsh: manifest.version, node: process.versions.node, platform: process.platform, arch: process.arch, peers } };
+export function dshEnvironment(ctx, expectedProfile, runtime = process) {
+  // Only the boot root owns the active profile anchor; plugin baseUrl is its package.
+  const base = ctx.root?.baseUrl;
+  if (typeof base !== 'string' || !base.startsWith('file:')) throw new Error('无法确认当前实例的 profile，已停止管理操作');
+  const profileDir = realpathSync(fileURLToPath(base));
+  const configuredHome = runtime.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
+  const home = resolve(configuredHome === '~' ? homedir() : /^~[/\\]/.test(configuredHome) ? join(homedir(), configuredHome.slice(2)) : configuredHome);
+  const profile = basename(profileDir);
+  if (expectedProfile !== undefined && expectedProfile !== profile) throw new Error('Hub profile 配置与当前实例不一致');
+  let entryManifest, cli;
+  try {
+    const candidate = realpathSync(runtime.argv[1]);
+    const file = join(dirname(candidate), '..', 'package.json');
+    if (JSON.parse(readFileSync(file, 'utf8')).name === '@deepseek-ai/dsh') { cli = candidate; entryManifest = file; }
+  } catch { /* Desktop workers do not run through the CLI. */ }
+  entryManifest ??= createRequire(join(profileDir, 'package.json')).resolve('@deepseek-ai/dsh/package.json');
+  const manifest = JSON.parse(readFileSync(entryManifest, 'utf8'));
+  let cliProfile = false;
+  try { cliProfile = Boolean(cli) && realpathSync(join(home, 'profiles', profile)) === profileDir; } catch { /* Never redirect to another profile. */ }
+  return { cli, home, profileDir, profile, installation: cliProfile ? 'cli' : 'desktop',
+    host: { dsh: manifest.version, node: runtime.versions.node, platform: runtime.platform, arch: runtime.arch } };
 }
 
-export function createDshInstaller(environment, config) {
-  let child;
+export function createDshInventory(environment) {
   const installed = async () => {
     let manifest;
     try { manifest = JSON.parse(readFileSync(join(environment.profileDir, 'package.json'), 'utf8')); }
@@ -31,36 +40,5 @@ export function createDshInstaller(environment, config) {
     }
     return result;
   };
-  async function run(args, log) {
-    await new Promise((resolve, reject) => {
-        child = spawn(process.execPath, args, { cwd: process.cwd(), env: process.env, stdio: ['ignore', 'pipe', 'pipe'], shell: false, windowsHide: true });
-        const timer = setTimeout(() => { child.kill('SIGTERM'); reject(new Error('插件操作超时，请检查 profile 后重试')); }, 180000);
-        const onData = bytes => log(bytes.toString('utf8').replace(/Bearer\s+\S+/gi, 'Bearer [redacted]').slice(-1500));
-        child.stdout.on('data', onData); child.stderr.on('data', onData);
-        child.once('error', error => { clearTimeout(timer); reject(error); });
-        child.once('exit', code => { clearTimeout(timer); child = null; code === 0 ? resolve() : reject(new Error(`插件命令失败（退出码 ${code}）`)); });
-      });
-  }
-  return {
-    installed,
-    async install(packageName, version, log) {
-      const args = [...process.execArgv, environment.cli, 'plugin', '--profile', environment.profile, 'add', `${packageName}@${version}`, '--save-exact', `--registry=${config.registry}`, releaseAgeArgument(config)];
-      log(`安装 ${packageName}@${version}`);
-      await run(args, log);
-      if ((await installed())[packageName] !== version) throw new Error('安装命令结束，但实际版本不匹配');
-      const manifest = JSON.parse(readFileSync(join(environment.profileDir, 'package.json'), 'utf8'));
-      if (!manifest.dsh?.profile?.bundles?.includes(packageName)) throw new Error('包已下载，但尚未注册为 DSH bundle');
-      log('安装并注册完成，请手动重启 DSH 后验证加载');
-    },
-    async uninstall(packageName, log) {
-      if (!(await installed())[packageName]) throw new Error('该插件尚未安装');
-      const args = [...process.execArgv, environment.cli, 'plugin', '--profile', environment.profile, 'remove', packageName];
-      log(`卸载 ${packageName}`);
-      await run(args, log);
-      const manifest = JSON.parse(readFileSync(join(environment.profileDir, 'package.json'), 'utf8'));
-      if (manifest.dependencies?.[packageName] || manifest.dsh?.profile?.bundles?.includes(packageName)) throw new Error('卸载命令结束，但插件仍在 profile 中');
-      log('卸载并取消注册完成，请手动重启 DSH 结束已加载实例');
-    },
-    close() { child?.kill('SIGTERM'); },
-  };
+  return { installed };
 }

package/src/experiment-definitions.js

@@ -0,0 +1,6 @@
+/** Shared presentation metadata; each host supplies its own capabilities and state. */
+export const agentTeams = Object.freeze({
+  id: 'agent-teams',
+  name: 'Agent Teams',
+  description: '实验性多 Agent 协作工具与团队面板。Web 切换后需重启 DSH；支持管理的 Desktop 会自动重启后端，会话数据保留。',
+});

package/src/experiments.js

@@ -0,0 +1,50 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createRequire } from 'node:module';
+import { spawn } from 'node:child_process';
+import { atomicWrite } from './profile-files.js';
+import { agentTeams } from './experiment-definitions.js';
+const bundles = ['@deepseek-ai/dsh-experimental-agent-team-profile', '@deepseek-ai/dsh-experimental-agent-team-web-profile'];
+export class Experiments {
+  constructor(environment) { this.environment = environment; this.file = join(environment.profileDir, 'package.json'); this.initial = undefined; this.busy = false; }
+  async snapshot() {
+    const manifest = JSON.parse(await readFile(this.file, 'utf8'));
+    const configuredBundles = manifest.dsh?.profile?.bundles;
+    const desktopSetting = manifest.dsh?.desktop?.agentTeams;
+    const enabled = this.environment.installation === 'desktop'
+      ? (typeof desktopSetting === 'boolean' ? desktopSetting : null)
+      : (Array.isArray(configuredBundles) ? bundles.every(name => configuredBundles.includes(name)) : null);
+    if (this.initial === undefined) this.initial = enabled;
+    const resolver = createRequire(this.file);
+    const installed = bundles.every(name => { try { resolver.resolve(name + '/package.json'); return true; } catch { return false; } });
+    return [{ ...agentTeams, installed, enabled, activeEnabled: this.environment.installation === 'cli' ? this.initial : null, supported: this.environment.installation === 'cli', pendingRestart: this.environment.installation === 'cli' && this.initial !== null && this.initial !== enabled, canToggle: this.environment.installation === 'cli' && Array.isArray(configuredBundles) && installed, canInstall: this.environment.installation === 'cli', busy: this.busy }];
+  }
+  async mutate(data) {
+    if (data.profile !== this.environment.profileDir || data.id !== 'agent-teams') throw new Error('实例或功能已变化，请刷新');
+    if (this.busy) throw new Error('实验性功能正在更新');
+    if (this.environment.installation !== 'cli') throw new Error('Desktop 实验性功能需通过宿主接口操作');
+    this.busy = true;
+    try {
+      if (data.expectedEnabled !== undefined && data.expectedEnabled !== (await this.snapshot())[0].enabled) throw new Error('实验性功能状态已变化，请刷新后重试');
+      if (data.action === 'install') {
+        for (const name of bundles) await new Promise((resolve, reject) => {
+          const child = spawn(process.execPath, [this.environment.cli, 'plugin', '--profile', this.environment.profile, 'add', `${name}@${this.environment.host.dsh}`, '--save-exact'], { cwd: this.environment.profileDir, env: { ...process.env, DSH_HOME: this.environment.home }, stdio: 'ignore', windowsHide: true, shell: false });
+          this.child = child;
+          const timer = setTimeout(() => { child.kill(); reject(new Error('安装超时，请检查 DSH 插件管理状态')); }, 180000);
+          child.once('error', error => { clearTimeout(timer); reject(error); });
+          child.once('exit', code => { clearTimeout(timer); code === 0 ? resolve() : reject(new Error('原生 DSH 安装失败，请确认此 DSH 版本提供 Agent Teams 包')); });
+        });
+      } else {
+        if (typeof data.enabled !== 'boolean') throw new Error('无效的开关值');
+        if (!(await this.snapshot())[0].installed) throw new Error('请先安装 Agent Teams');
+        const manifest = JSON.parse(await readFile(this.file, 'utf8'));
+        const current = manifest.dsh?.profile?.bundles;
+        if (!Array.isArray(current)) throw new Error('当前 profile 未提供原生 bundle 列表');
+        manifest.dsh.profile.bundles = data.enabled ? [...current.filter(name => !bundles.includes(name)), ...bundles] : current.filter(name => !bundles.includes(name));
+        await atomicWrite(this.file, JSON.stringify(manifest, null, 2) + '\n');
+      }
+      return await this.snapshot();
+    } finally { this.busy = false; this.child = null; }
+  }
+  close() { this.child?.kill(); }
+}

package/src/identity.js

@@ -1,25 +1,6 @@
 export const MARKET_PACKAGE = '@zaimokuza/dsh-plugin-hub';
-export const CATALOG_PACKAGE = '@zaimokuza/dsh-plugin-hub-catalog-demo';
-export function normalizeRegistry(value) {
-  let url;
-  try { if (typeof value !== 'string') throw new Error(); url = new URL(value); } catch { throw new Error('npm registry must be an HTTPS URL without credentials / npm registry 必须是无凭据的 HTTPS 地址'); }
-  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash) throw new Error('npm registry must be an HTTPS URL without credentials / npm registry 必须是无凭据的 HTTPS 地址');
-  return url.href.replace(/\/?$/, '/');
-}
-export function catalogVerification(value = 'if-present') {
-  if (!['if-present', 'required', 'none'].includes(value)) throw new Error('catalogVerification must be if-present, required or none');
-  return value;
-}
 export const DEFAULT_BRAND = Object.freeze({ title: 'Plugin Hub', subTitle: 'DSH EXTENSIONS', primaryColor: '#596579', navTitle: 'Plugin Hub' });
 export function marketIdentity(id = 'hub') {
   if (typeof id !== 'string' || !/^[a-z][a-z0-9-]{0,47}$/.test(id)) throw new Error('marketId must be a lowercase identifier (max 48 characters)');
-  return { id, service: 'dshPluginHub_' + id.replaceAll('-', '_'), api: `/dsh-plugin-hub/${id}/api/`, help: `/dsh-plugin-hub/${id}/demo/help` };
-}
-export function normalizeBrand(value = {}) {
-  const brand = { ...DEFAULT_BRAND, ...value };
-  for (const key of ['title', 'subTitle', 'navTitle']) if (typeof brand[key] !== 'string' || !brand[key].trim() || brand[key].length > 80) throw new Error(`Invalid brand ${key}`);
-  const colors = { red: '#c92536', blue: '#2563eb', green: '#16805d', purple: '#7c3aed', orange: '#c65d0b' };
-  brand.primaryColor = colors[brand.primaryColor] ?? brand.primaryColor;
-  if (!/^#[a-f\d]{6}$/i.test(brand.primaryColor)) throw new Error('primaryColor must be #RRGGBB or red/blue/green/purple/orange');
-  return Object.fromEntries(['title','subTitle','navTitle','primaryColor'].map(key => [key, brand[key]]));
+  return { id, service: 'dshPluginHub_' + id.replaceAll('-', '_') };
 }

package/src/index.js

@@ -1,84 +1,49 @@
-import { MARKET_PACKAGE, CATALOG_PACKAGE, marketIdentity, normalizeBrand, catalogVerification } from './identity.js';
-import { readFile } from 'node:fs/promises';
-import { createRequire } from 'node:module';
+import { MARKET_PACKAGE, marketIdentity } from './identity.js';
 import { join } from 'node:path';
-import { createRegistryFetch } from './registry.js';
-import { Marketplace } from './service.js';
-import { dshEnvironment, createDshInstaller } from './dsh.js';
-import { PACKAGE_NAME, validateCatalog } from './catalog.js';
-import { createProviderApi } from './provider-api.js';
-import { readReleaseAge } from './release-age.js';
-import { readRegistry } from './registry-config.js';
+import { dshEnvironment, createDshInventory } from './dsh.js';
+import { NativeResources } from './resources.js';
+import { Experiments } from './experiments.js';
 
 export const name = MARKET_PACKAGE;
-export const inject = ['webServer', 'connection'];
-
-
-const json = (res, status, value) => { res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' }); res.end(JSON.stringify(value)); };
-
-async function body(req) {
-  const buffers = []; let size = 0;
-  for await (const bytes of req) { size += bytes.length; if (size > 16384) throw new Error('请求过大'); buffers.push(bytes); }
-  return JSON.parse(Buffer.concat(buffers).toString('utf8'));
-}
+export const inject = ['connection', 'loader', 'skills', 'workspaceRegistry', 'agentPresets'];
 
 export async function apply(ctx, options = {}) {
-  for (const [name, fn] of [['connection.requestRejection', ctx.connection?.requestRejection], ['webServer.register', ctx.webServer?.register], ['provide', ctx.provide], ['effect', ctx.effect]]) {
-    if (typeof fn !== 'function') throw new Error(`Plugin Hub cannot start: required DSH API ${name} is unavailable. / 市场无法启动：当前 DSH 缺少必要接口 ${name}。`);
+  for (const [name, fn] of [['connection.fetch.register', ctx.connection?.fetch?.register], ['loader.entries', ctx.loader?.entries], ['provide', ctx.provide], ['effect', ctx.effect]]) {
+    if (typeof fn !== 'function') throw new Error(`Plugin Hub cannot start: required DSH API ${name} is unavailable. / Hub 无法启动：当前 DSH 缺少必要接口 ${name}。`);
   }
   const identity = marketIdentity(options.marketId);
-  const API = identity.api;
-  const brand = normalizeBrand(options.brand);
-  const environment = dshEnvironment(options.profile ?? 'web');
-  const source = { kind: 'npm', packageName: options.catalogPackage ?? CATALOG_PACKAGE };
-  if (options.source) throw new Error('目录来源已改为 Nexus npm 包，请使用 catalogPackage 配置');
-  if (!PACKAGE_NAME.test(source.packageName)) throw new Error('目录 npm 包名无效');
-  const [registry, releaseAge] = await Promise.all([readRegistry(options.registry, environment.profileDir), readReleaseAge(environment.profileDir)]);
-  const sources = options.catalogSources ?? [{ id: 'company', displayName: source.packageName === CATALOG_PACKAGE ? 'Demo catalog' : brand.title, ...source, priority: 100 }];
-  if (!Array.isArray(sources) || sources.length > 20 || sources.some(s => s?.kind !== 'npm')) throw new Error('catalogSources must contain at most 20 npm sources; JSON providers register through the plugin API');
-  const config = { source, sources, brand, identity, catalogVerification: catalogVerification(options.catalogVerification), packageName: options.packageName ?? MARKET_PACKAGE, registry, cacheDir: join(environment.profileDir, '.dsh-plugin-hub', identity.id), ...releaseAge };
-  const installer = createDshInstaller(environment, config);
-  const market = new Marketplace({ config, host: environment.host, fetcher: createRegistryFetch(config.registry), installer });
-  // The public package ships an independent catalog snapshot for first-open discovery.
-  // Enterprise wrappers do not read it: their catalog name differs from CATALOG_PACKAGE.
-  if (source.packageName === CATALOG_PACKAGE && !options.catalogSources) {
-    try {
-      const file = createRequire(import.meta.url).resolve(CATALOG_PACKAGE + '/plugins.json');
-      market.providers.entries.get('company').value = { catalog: validateCatalog(JSON.parse(await readFile(file, 'utf8'))), source: CATALOG_PACKAGE, version: 'bundled', updatedAt: null };
-    } catch { /* A registry refresh remains available if a snapshot is absent. */ }
+  const environment = dshEnvironment(ctx, options.profile);
+  const inventory = createDshInventory(environment);
+  const resources = new NativeResources(ctx, environment, join(environment.profileDir, '.dsh-plugin-hub', identity.id), inventory);
+  const experiments = new Experiments(environment);
+  ctx.effect(() => () => { experiments.close(); return resources.close(); }, 'Plugin Hub: lifecycle');
+  await resources.init();
+  await experiments.snapshot();
+  const dispatch = async (path, data = {}, signal) => {
+    if (!data || typeof data !== 'object' || Array.isArray(data) || JSON.stringify(data).length > 32768) throw new Error('无效或过大的请求');
+    if (path === 'resources') return resources.snapshot(data.workspaceId, data.presetId);
+    if (path === 'resource-mutate') return resources.mutate(data);
+    if (path === 'mcp-config') return resources.configuration(data);
+    if (path === 'mcp-format') return resources.formatConfiguration(data);
+    if (path === 'mcp-test') return resources.test(data, signal);
+    if (path === 'open-directory') return resources.open(data);
+    if (path === 'skill-file') return resources.skillFile(data);
+    if (path === 'experiments') return experiments.snapshot();
+    if (path === 'experiment-mutate') return experiments.mutate(data);
+    throw new Error('接口不存在');
+  };
+  // The shared RPC interceptor belongs to DSH's Gateway. Exact Fetch routes
+  // compose ahead of it on both the HTTP carrier and Desktop's worker carrier.
+  for (const path of ['resources', 'resource-mutate', 'mcp-config', 'mcp-format', 'mcp-test', 'open-directory', 'skill-file', 'experiments', 'experiment-mutate']) {
+    ctx.effect(() => ctx.connection.fetch.register({ path: `/api/${identity.service}/${path}`, methods: ['POST'], requestBody: 'buffered', async fetch(request) {
+      let envelope;
+      try { envelope = await request.json(); } catch { return Response.json({ error: 'Invalid JSON' }, { status: 400 }); }
+      if (envelope?.type !== 'client-request' || typeof envelope.rpcId !== 'string' || envelope.method !== `${identity.service}/${path}`) return Response.json({ error: 'Invalid RPC envelope' }, { status: 400 });
+      let result;
+      try { result = { ok: true, value: await dispatch(path, envelope.payload, request.signal) }; }
+      catch (error) { result = { ok: false, error: { code: 'plugin-hub/request-failed', message: error.message, details: {} } }; }
+      return Response.json({ type: 'server-response', rpcId: envelope.rpcId, result }, { headers: { 'cache-control': 'no-store' } });
+    } }), 'Plugin Hub: native Connection ' + path);
   }
-  if (options.initialCatalog) market.providers.registerSource({ id: 'bundled', displayName: brand.title, kind: 'json', getCatalog: async () => options.initialCatalog }, { primary: true });
-  // Registry availability must not delay or fail DSH boot.
-  await market.init({ refresh: false });
-  ctx.provide(identity.service, createProviderApi(market.providers));
-  void market.refresh().catch(error => { market.catalogError = error.message; });
-  ctx.effect(() => () => { installer.close(); return market.close(); }, 'Plugin Hub: lifecycle');
-  ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: API.slice(0, -1), async handler(req, res) {
-    const rejection = ctx.connection.requestRejection(req);
-    if (rejection) { json(res, rejection, { error: '请先登录当前 DSH 实例' }); return; }
-    if (req.method === 'POST') {
-      let origin;
-      try { origin = new URL(req.headers.origin).host; } catch { origin = null; }
-      if (!origin || origin !== req.headers.host) { json(res, 403, { error: '请求来源不匹配' }); return; }
-    }
-    try {
-      const path = new URL(req.url, 'http://localhost').pathname.slice(API.length);
-      if (path === 'state' && req.method === 'GET') { json(res, 200, await market.snapshot()); return; }
-      if (req.method !== 'POST') { json(res, 405, { error: '不支持的请求方法' }); return; }
-      if (path === 'refresh-start' && req.method === 'POST') { void market.refresh().catch(error => { market.catalogError = error.message; }); json(res, 202, await market.snapshot()); return; }
-      if (path === 'refresh') { await market.refresh(); json(res, 200, await market.snapshot()); return; }
-      const data = await body(req);
-      if (path === 'releases') { void market.loadReleases(data.packageNames).catch(error => { market.catalogError = error.message; }); json(res, 202, await market.snapshot()); return; }
-      if (path === 'install') { json(res, 202, await market.enqueue(data.packageName, data.version)); return; }
-      if (path === 'uninstall') { json(res, 202, await market.enqueue(data.packageName, undefined, 'uninstall')); return; }
-      json(res, 404, { error: '接口不存在' });
-    } catch (error) { json(res, 400, { error: error.message }); }
-  } }), 'Plugin Hub: HTTP routes');
-
-}
 
-/** Generated brands use this factory without activating the default demo bundle. */
-export function createMarketplace(defaults) {
-  marketIdentity(defaults.marketId);
-  return { name: defaults.packageName, inject, apply: (ctx, options = {}) => apply(ctx, { ...defaults, ...options, brand: { ...defaults.brand, ...options.brand }, marketId: defaults.marketId, packageName: defaults.packageName }) };
 }

package/src/mcp-config.js

@@ -0,0 +1,65 @@
+import { parseDocument, stringify } from 'yaml';
+const object = value => value && typeof value === 'object' && !Array.isArray(value);
+// This is the same serialized expression shape used by Cordis. Only environment
+// references are accepted here; Hub never evaluates arbitrary JavaScript.
+function envExpression(expr) {
+  const direct = /^process\.env\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(expr);
+  if (direct) return { name: direct[1], prefix: '', suffix: '' };
+  const template = /^`([^`$]*)\$\{process\.env\.([A-Za-z_][A-Za-z0-9_]*)\}([^`$]*)`$/.exec(expr);
+  if (template) return { name: template[2], prefix: template[1], suffix: template[3] };
+  throw new Error('仅支持 process.env.NAME 或带此前缀的模板字符串，不执行任意 JavaScript');
+}
+export const jsTag = {
+  tag: 'tag:yaml.org,2002:js',
+  identify: value => object(value) && Object.keys(value).length === 1 && typeof value.__jsExpr === 'string',
+  resolve: value => ({ __jsExpr: value }),
+  stringify: item => JSON.stringify(item.value.__jsExpr),
+};
+export function parseConfigText(text) {
+  if (typeof text !== 'string' || text.length > 24000) throw new Error('配置文本最长 24000 字符');
+  const doc = parseDocument(text, { uniqueKeys: true, schema: 'core', customTags: [jsTag] });
+  if (doc.errors.length || doc.warnings.length) throw new Error('JSON / YAML 格式无效，请检查缩进、引号和重复字段');
+  let value;
+  try { value = doc.toJS({ maxAliasCount: 0 }); } catch { throw new Error('配置不支持 YAML 别名'); }
+  if (!object(value)) throw new Error('请提供一个 MCP 配置对象');
+  // Validate reference syntax without resolving values or adding defaults.
+  resolveEnvironment(value, {}, true);
+  return value;
+}
+export function parseMcpDocument(text) {
+  let value = parseConfigText(text);
+  if (Object.hasOwn(value, 'mcpServers')) {
+    if (!object(value.mcpServers) || Object.keys(value).length !== 1 || Object.keys(value.mcpServers).length !== 1) throw new Error('每次请粘贴一个 mcpServers 服务配置');
+    const [name, config] = Object.entries(value.mcpServers)[0];
+    if (!object(config)) throw new Error('MCP 配置必须是对象');
+    value = { serverName: name, ...config };
+  } else if (value.name === '@deepseek-ai/dsh-mcp-client' && object(value.config)) {
+    if (Object.keys(value).some(key => !['name', 'config', 'id'].includes(key))) throw new Error('请仅编辑 MCP 的 config 段，启停使用卡片开关');
+    value = value.config;
+  }
+  const config = { ...value };
+  if (config.type !== undefined) {
+    const transport = config.type === 'http' ? 'streamable-http' : config.type;
+    if (config.transport && config.transport !== transport) throw new Error('type 与 transport 不一致');
+    config.transport = transport; delete config.type;
+  }
+  config.transport ??= config.command ? 'stdio' : config.url ? 'streamable-http' : undefined;
+  return config;
+}
+export function resolveEnvironment(value, env = process.env, syntaxOnly = false) {
+  if (Array.isArray(value)) return value.map(item => resolveEnvironment(item, env, syntaxOnly));
+  if (!object(value)) return value;
+  if (Object.hasOwn(value, '__jsExpr')) {
+    if (Object.keys(value).length !== 1 || typeof value.__jsExpr !== 'string') throw new Error('环境变量引用无效');
+    const ref = envExpression(value.__jsExpr);
+    if (syntaxOnly) return 'environment-reference';
+    if (typeof env[ref.name] !== 'string') throw new Error(`启动 DSH 的环境中未设置 ${ref.name}`);
+    return ref.prefix + env[ref.name] + ref.suffix;
+  }
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, resolveEnvironment(item, env, syntaxOnly)]));
+}
+export function formatMcpDocument(config, format) {
+  if (format === 'json') return JSON.stringify(config, null, 2);
+  if (format === 'yaml') return stringify(config, { lineWidth: 0, customTags: [jsTag] });
+  throw new Error('格式必须为 JSON 或 YAML');
+}

package/src/profile-files.js

@@ -0,0 +1,44 @@
+import { readFile, writeFile, realpath, rename, rm } from 'node:fs/promises';
+import { join, relative, isAbsolute } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { parseDocument, isSeq, isMap } from 'yaml';
+import { jsTag } from './mcp-config.js';
+export async function ownedFile(profile, file) {
+  try { const path = await realpath(file); const rel = relative(profile, path); return !isAbsolute(rel) && !rel.startsWith('..') && !rel.split(/[\\/]/).includes('node_modules') ? path : null; } catch { return null; }
+}
+export async function atomicWrite(file, content) {
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  await writeFile(temporary, content, { mode: 0o600, flag: 'wx' });
+  try { await rename(temporary, file); }
+  catch (error) { await rm(temporary, { force: true }); throw error; }
+}
+// Delete only a concrete, uniquely identified definition owned by this profile.
+// Preserve all other YAML nodes, comments and native expression tags.
+export async function findMcpDefinition(profile, entry) {
+  if (!entry) return null;
+  const candidates = [...new Set([entry.parent.tree.filename, join(profile, 'cordis.patch.yml'), join(profile, 'cordis.yml')].filter(Boolean))];
+  for (const file of candidates) {
+    const path = await ownedFile(profile, file); if (!path) continue;
+    const original = await readFile(path, 'utf8'); const doc = parseDocument(original, { customTags: [jsTag] });
+    if (doc.errors.length || doc.warnings.length) continue;
+    const matches = [];
+    function walk(node) {
+      if (isSeq(node)) node.items.forEach((item, index) => {
+        if (isMap(item) && item.get('id') === entry.options.id && item.get('name') === '@deepseek-ai/dsh-mcp-client') matches.push({ node, index });
+        else walk(item);
+      });
+      else if (isMap(node)) node.items.forEach(pair => walk(pair.value));
+    }
+    walk(doc.contents);
+    if (matches.length === 1) return { path, original, doc, ...matches[0] };
+  }
+  return null;
+}
+export async function deleteMcpDefinition(profile, entry) {
+  const found = await findMcpDefinition(profile, entry);
+  if (!found) throw new Error('此 MCP 来自共享配置或宿主包，请在来源处删除；Hub 可禁用它');
+  if (await readFile(found.path, 'utf8') !== found.original) throw new Error('来源配置已变化，请刷新重试');
+  found.node.items.splice(found.index, 1);
+  await atomicWrite(found.path, String(found.doc));
+  await entry.parent.remove(entry.options.id);
+}