dsh-armory 2.3.0 → 2.3.2

package/lib/index.js

@@ -7,7 +7,7 @@ import { interpolate } from "@deepseek-ai/cordis-plugin-loader";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { appendSelectedBuiltinMcpServers, BUILTIN_MCP_SERVERS, builtinMcpCatalog, normalizeMcpImport, readManagedMcpServers, setManagedMcpDisabled, updateManagedMcpPatch } from "./mcp-config.js";
+import { normalizeMcpImport, readManagedMcpServers, setManagedMcpDisabled, updateManagedMcpPatch } from "./mcp-config.js";
 import { admitImportedServers } from "./import-admission.js";
 import { collectImportLocations, missingEnvNames, resolveImportLocation } from "./mcp-import-sources.js";
 import { deriveMcpPhase, formatMcpLog, sanitizeMcpLog } from "./mcp-observability.js";
@@ -16,12 +16,17 @@ import { allMcpEntries, entriesForName, projectToolSchema, revisionOf, toolInven
 import { removeSkillFromDisk } from "./skill-remove.js";
 import { WHATS_NEW } from "./whats-new.js";
 import { attachWhatsNewEnglish } from "./whats-new-en.js";
-import { probeMcpServersAuthorization, wbConnectorCatalog, wbConnectorCachedCount, wbConnectorPreview, wbSkillCatalog, wbSkillDetail, wbSkillInstall, wbSkillInstalled, wbSkillUninstall } from "./wb-market.js";
-// T03：多市场注册表（R4）与 codebuddy 插件市场（R5）的宿主侧数据层。
+import { probeMcpServersAuthorization, wbConnectorCatalog, wbConnectorCachedCount, wbConnectorIcon, wbConnectorPreview, wbSkillCatalog, wbSkillDetail, wbSkillInstall, wbSkillInstalled, wbSkillUninstall } from "./wb-market.js";
+// T03/R4：多市场注册表（连接器源）的宿主侧数据层。
 import { readRegistry, upsertMarketplace } from "./wb-registry.js";
-import { wbPluginCatalog, wbPluginDetail, wbPluginUpdateCheck } from "./wb-plugin-market.js";
 // T06/Awesome：DSH 社区插件市场（awesome-dsh-plugins）的宿主侧数据层。
 import { wbAwesomeCatalog, wbAwesomeDetail, wbAwesomeReadme, wbAwesomeUpdateCheck } from "./wb-awesome-market.js";
+// 社区元信息（维护者 / 最近提交 / issue / star）：打开详情时按需查，6 小时缓存。
+import { wbRepoMeta } from "./community-meta.js";
+// npm 近 30 天下载量：插件卡片底栏的「↓N」，目录里没有这个字段，只能去 npm 统计接口取。
+import { wbNpmDownloads } from "./npm-downloads.js";
+// 装备清单：只读汇总本机已装条目，校验与差异计算保持纯函数（lib/loadout.js）。
+import { buildLoadout, diffLoadout } from "./loadout.js";
 import { readState as readInstallState, record as recordInstallState, forget as forgetInstallState } from "./wb-install-state.js";
 // 自定义套件（Skill 看板）：读 / 整集合覆盖保存，数据层 lib/suites-registry.js。
 import { readSuites as readSkillSuites, saveSuites as writeSkillSuites } from "./suites-registry.js";
@@ -33,10 +38,12 @@ import {
 	cancelAuthorization as oauthCancel,
 	clearTokenRecord as oauthClearToken,
 	ensureAccessToken as oauthEnsureToken,
+	isSerializedGarbageCredential as oauthIsGarbageCredential,
+	isUsableBearerToken as oauthIsUsableToken,
 	saveManualToken as oauthSaveManualToken,
 	submitCallback as oauthSubmitCallback,
 } from "./mcp-oauth.js";
-import { hasTeamBridge, installExpertSkills, listExpertRecent, listExpertSkills, prepareExpertPersona, readExpertPresets, recordExpertRecent, removeExpertPreset, uninstallExpertSkills, uninstallTeamMemberPersonas, wbExpertCatalog, wbExpertDetail, writeExpertPreset } from "./expert-market.js";
+import { hasTeamBridge, installExpertSkills, listExpertRecent, listExpertSkills, prepareExpertPersona, readExpertDisplayNames, readExpertPresets, recordExpertRecent, removeExpertPreset, uninstallExpertSkills, uninstallTeamMemberPersonas, wbExpertCatalog, wbExpertDetail, writeExpertPreset } from "./expert-market.js";
 import { attachPersona, detachPersona, listPersonas, reconcilePersonas } from "./session-persona.js";
 // clearTextCache 的 import 已随 toolTailor 的「清空缓存」动作一起删掉（见下方 toolTailor 注释）。
 import { scanSessionLedger } from "./tool-ledger.js";
@@ -116,6 +123,24 @@ function withBearerHeader(rawServer, token) {
 	return { ...rawServer, headers };
 }
 
+/**
+ * 摘掉一个已经坏掉的 authorization 头（保留其它头、保留原键名大小写）。
+ * 只给「确认是序列化残骸」的配置用：历史版本把 `Bearer [object Object]` 写进了
+ * 用户的 patch，那条头不删掉，服务器就从「你没带凭据」(401) 变成「你凭据是坏的」(400)，
+ * 装前探测因此再也认不出这是鉴权问题，用户既装不上也看不到授权入口。
+ */
+function stripBearerHeader(rawServer) {
+	const container = rawServer && typeof rawServer.transport === "object" ? rawServer.transport : rawServer;
+	const headers = container?.headers;
+	if (!headers || typeof headers !== "object" || Array.isArray(headers)) return rawServer;
+	const next = {};
+	for (const [key, value] of Object.entries(headers)) {
+		if (String(key).toLowerCase() !== "authorization") next[key] = value;
+	}
+	const patched = { ...container, headers: next };
+	return rawServer && typeof rawServer.transport === "object" ? { ...rawServer, transport: patched } : patched;
+}
+
 /**
  * 安装前把已落盘的 access_token 注进对应 server 的 headers。
  * 读不到 / 过期且刷不动就原样返回，交给 probe 去判定「需要授权」——
@@ -126,17 +151,27 @@ async function injectStoredOAuthTokens(mcpServers) {
 	const out = {};
 	for (const [serverName, rawServer] of Object.entries(mcpServers)) {
 		const spec = nestedServerSpec(rawServer);
-		if (!isOAuthCandidate(spec) || spec.headers.authorization) {
+		// 配置里已有的 authorization 一律优先：可能是用户手填的真令牌，也可能是 R7
+		// 的 ${...} 占位符（那种要原样保留、由 missingSlots 回报面板补填）。
+		const declared = spec.headers.authorization;
+		const poisoned = Boolean(declared) && oauthIsGarbageCredential(declared);
+		if (!isOAuthCandidate(spec) || (declared && !poisoned)) {
 			out[serverName] = rawServer;
 			continue;
 		}
 		let token = "";
 		try {
-			token = String((await oauthEnsureToken(spec.url)) || "");
+			// ensureAccessToken 回的是 {ok, accessToken, refreshed, error} 对象，不是字符串。
+			// 这里曾经直接对那个对象取字符串：得到 "[object Object]"，真值、非空，
+			// 于是每个 HTTP 连接器都被注进 `authorization: Bearer [object Object]`
+			// —— 装上必挂，还把服务器的 401 伪装成 400（见 test/auth-gate-regression.mjs 第 7 节）。
+			const result = await oauthEnsureToken(spec.url);
+			if (result?.ok && oauthIsUsableToken(result.accessToken)) token = String(result.accessToken).replace(/^Bearer\s+/i, "").trim();
 		} catch {
 			token = "";
 		}
-		out[serverName] = token ? withBearerHeader(rawServer, token) : rawServer;
+		if (token) out[serverName] = withBearerHeader(rawServer, token);
+		else out[serverName] = poisoned ? stripBearerHeader(rawServer) : rawServer;
 	}
 	return out;
 }
@@ -150,7 +185,12 @@ async function resolveOAuthTarget(connectorId, serverName) {
 	if (!rawServer) throw new Error(`连接器 ${connectorId} 里没有 server「${name || "（空）"}」`);
 	const spec = nestedServerSpec(rawServer);
 	if (!spec.url) throw new Error(`server「${name}」没有可授权的 URL（stdio 型不需要 OAuth 授权）`);
-	return { serverName: name, url: spec.url, headers: spec.headers, transport: spec.transport };
+	// 坏掉的 authorization 不能跟着去探测：带着 `Bearer [object Object]` 打过去，服务器
+	// 回的是 400「token parse failed」而不是 401「empty access token」，授权发现
+	// 那条路就在第一步被判定成「非鉴权错误」而中止。
+	const headers = { ...spec.headers };
+	if (headers.authorization && oauthIsGarbageCredential(headers.authorization)) delete headers.authorization;
+	return { serverName: name, url: spec.url, headers, transport: spec.transport };
 }
 
 /** 宿主 shell 服务的几种可能落点，逐个试；拿不到就返回 undefined 走系统兜底。 */
@@ -381,12 +421,6 @@ function externalMcpEntries(ctx, state) {
 		return !managedIds.has(entry.options.id) && !(!entry.options.group && managedNames.has(entry.options.config.serverName));
 	});
 }
-function effectiveMcpServers(ctx, state) {
-	return [
-		...state.servers,
-		...externalMcpEntries(ctx, state).map((entry) => ({ ...entry.options.config, name: entry.options.config.serverName })),
-	];
-}
 function revealRevision(state, groups) {
 	const values = [];
 	for (const current of state.servers) {
@@ -589,7 +623,6 @@ function summarize(entry, inventory, managed, conflict = false, lastLog = null)
 // 已经是不可用的终态证据），而不是去猜 mcp-client 的日志文案；日志只用来填 lastError 的
 // 具体原因。挂载失败（我们自己 setup 阶段就挂不上：配置求值为空、工具注册被拒）与连接
 // 失败（mcp-client 那边的事）分开标记，不混为一谈。
-// 已导出作为测试接缝（同 checkForUpdate）。
 function summarizeWorkspaceRow(ctx, wsPath, server, mountError) {
 	// 诊断通路就在这里被依赖，就在这里确保开着（按 root 幂等，与全局 list/status 同一份）。
 	ensureLogCapture(ctx);
@@ -1048,10 +1081,148 @@ async function listMcpServers(ctx) {
 	};
 }
 
+// ── 装备清单：本机条目收集（只读，只投影身份字段）────────────────────────
+// 导出与导入对比共用这一份收集逻辑，避免两个入口对「本机装了什么」给出不同答案。
+// 绝不把 env / headers 的值带出去：MCP 只保留键名，技能只保留名称与来源，
+// 专家从 profile 补丁的召唤预设读 plugin、从目录缓存补展示名，插件读安装账本。
+function endpointHostOf(value) {
+	if (typeof value !== "string" || !value) return "";
+	try {
+		return new URL(value).host || "";
+	} catch {
+		return "";
+	}
+}
+
+async function collectLoadoutItems(ctx) {
+	const items = [];
+	let records = [];
+	try {
+		const state = await readInstallState();
+		records = Array.isArray(state?.items) ? state.items : [];
+	} catch {
+		// 账本读不到仍然可以导出 MCP / 技能 / 专家；插件条目会缺，但不该整单失败。
+	}
+
+	// 1) MCP：以真实注册表为准；连接器账本用于补来源，名称对不上时保留账本条目。
+	try {
+		const { servers } = await listMcpServers(ctx);
+		const connectorByName = new Map();
+		for (const record of records) {
+			if (record?.kind !== "connector") continue;
+			const key = String(record.key || "").trim();
+			if (key) connectorByName.set(key, record);
+			const rowName = String(record.name || "").trim();
+			if (rowName) connectorByName.set(rowName, record);
+		}
+		const seen = new Set();
+		for (const server of servers) {
+			const name = String(server?.serverName || "").trim();
+			if (!name) continue;
+			seen.add(name);
+			const connector = connectorByName.get(name);
+			const configKeys = [
+				...Object.keys(server.env || {}),
+				...Object.keys(server.headers || {}),
+			].filter(Boolean);
+			const endpointHost = endpointHostOf(server.url);
+			items.push({
+				kind: "mcp",
+				name,
+				...(server.transport ? { transport: server.transport } : {}),
+				source: connector ? `connector:${connector.key}` : "manual",
+				...(endpointHost ? { endpointHost } : {}),
+				...(configKeys.length ? { configKeys: [...new Set(configKeys)] } : {}),
+				...(typeof server.enabled === "boolean" ? { enabled: server.enabled } : {}),
+			});
+		}
+		for (const record of records) {
+			if (record?.kind !== "connector") continue;
+			const key = String(record.key || "").trim();
+			const name = String(record.name || key).trim();
+			if (!name || seen.has(name) || (key && seen.has(key))) continue;
+			seen.add(name);
+			items.push({ kind: "mcp", name, source: `connector:${key || name}` });
+		}
+	} catch {
+		// MCP 注册表不可用时跳过这一组，其余组照常导出。
+	}
+
+	// 2) 技能：宿主 skill 注册表的全局视图；账本用于补市场来源与版本。
+	try {
+		const ledger = new Map();
+		for (const record of records) {
+			if (record?.kind === "skill") ledger.set(String(record.key || ""), record);
+		}
+		await withSkillScope(ctx, { scope: "global" }, async (registry, options) => {
+			if (typeof registry.list !== "function") return;
+			const rows = await registry.list(options);
+			for (const skill of rows) {
+				const name = String(skill?.name || "").trim();
+				if (!name) continue;
+				const record = ledger.get(name);
+				items.push({
+					kind: "skill",
+					name,
+					source: String(record?.source?.marketplace || skill.source || "local"),
+					...(record?.version ? { version: String(record.version) } : {}),
+				});
+			}
+		});
+	} catch {
+		// 宿主没挂 skill 注册表时跳过技能组。
+	}
+
+	// 3) 专家：profile 补丁里的召唤预设 + 目录缓存补展示名 / 更新时间。
+	try {
+		const patch = await readPatch(ctx);
+		const presets = readExpertPresets(patch.content);
+		let experts = [];
+		try {
+			const catalog = await wbExpertCatalog();
+			experts = Array.isArray(catalog?.experts) ? catalog.experts : [];
+		} catch {
+			// 目录拉不到就退回 plugin id 作名称。
+		}
+		const byPlugin = new Map(experts.map((expert) => [String(expert.plugin || ""), expert]));
+		for (const preset of presets) {
+			const plugin = String(preset?.plugin || "").trim();
+			if (!plugin) continue;
+			const expert = byPlugin.get(plugin);
+			items.push({
+				kind: "expert",
+				name: String(expert?.name || plugin),
+				plugin,
+				source: "workbuddy-expert",
+				...(expert?.updatedAt ? { updatedAt: String(expert.updatedAt) } : {}),
+			});
+		}
+	} catch {
+		// 没有 profile 补丁（或读不到）时跳过专家组。
+	}
+
+	// 4) 插件：只有客户端在安装成功后回写的账本知道装了什么。
+	for (const record of records) {
+		if (record?.kind !== "plugin") continue;
+		const key = String(record.key || "").trim();
+		const name = String(record.name || key).trim();
+		if (!name) continue;
+		items.push({
+			kind: "plugin",
+			name,
+			...(key ? { key } : {}),
+			source: String(record.source?.marketplace || ""),
+			...(record.version ? { version: String(record.version) } : {}),
+		});
+	}
+
+	return items;
+}
+
 let McpManagerGateway = (() => {
 	let _classSuper = TypertRemoteService;
 	let _instanceExtraInitializers = [];
-	let _list_decorators, _status_decorators, _enable_decorators, _disable_decorators, _reconnect_decorators, _tools_decorators, _builtins_decorators, _installBuiltins_decorators, _add_decorators, _update_decorators, _remove_decorators, _reveal_decorators, _previewImport_decorators, _importJson_decorators, _listWorkspaces_decorators, _getWorkspaceView_decorators, _addWorkspaceServer_decorators, _updateWorkspaceServer_decorators, _removeWorkspaceServer_decorators, _setWorkspaceExclude_decorators, _installWorkspaceBuiltins_decorators, _previewWorkspaceImport_decorators, _importWorkspaceJson_decorators, _revealWorkspaceServer_decorators, _projectConnections_decorators, _reconnectWorkspaceServer_decorators, _updateHint_decorators, _whatsNew_decorators, _scanImportSources_decorators, _previewImportSource_decorators, _importSource_decorators, _toolTailor_decorators, _wbConnectorCatalog_decorators, _wbConnectorCachedCount_decorators, _wbConnectorPreview_decorators, _wbConnectorInstall_decorators, _wbOAuthBegin_decorators, _wbOAuthPoll_decorators, _wbOAuthCancel_decorators, _wbOAuthToken_decorators, _wbOAuthOverview_decorators, _wbOAuthOpen_decorators, _wbSkillCatalog_decorators, _wbSkillDetail_decorators, _wbSkillInstall_decorators, _wbSkillUninstall_decorators, _wbSkillInstalled_decorators, _wbMarketRegistry_decorators, _wbMarketRegistryUpsert_decorators, _wbPluginCatalog_decorators, _wbPluginDetail_decorators, _wbInstallState_decorators, _wbInstallStateRecord_decorators, _wbInstallStateForget_decorators, _wbPluginUpdateCheck_decorators, _wbAwesomeCatalog_decorators, _wbAwesomeDetail_decorators, _wbAwesomeReadme_decorators, _wbAwesomeUpdateCheck_decorators;
+	let _list_decorators, _status_decorators, _enable_decorators, _disable_decorators, _reconnect_decorators, _tools_decorators, _add_decorators, _update_decorators, _remove_decorators, _reveal_decorators, _previewImport_decorators, _importJson_decorators, _listWorkspaces_decorators, _getWorkspaceView_decorators, _addWorkspaceServer_decorators, _updateWorkspaceServer_decorators, _removeWorkspaceServer_decorators, _setWorkspaceExclude_decorators, _previewWorkspaceImport_decorators, _importWorkspaceJson_decorators, _revealWorkspaceServer_decorators, _projectConnections_decorators, _reconnectWorkspaceServer_decorators, _updateHint_decorators, _whatsNew_decorators, _scanImportSources_decorators, _previewImportSource_decorators, _importSource_decorators, _toolTailor_decorators, _wbConnectorCatalog_decorators, _wbConnectorCachedCount_decorators, _wbConnectorIcon_decorators, _wbConnectorPreview_decorators, _wbConnectorInstall_decorators, _wbOAuthBegin_decorators, _wbOAuthPoll_decorators, _wbOAuthCancel_decorators, _wbOAuthToken_decorators, _wbOAuthOverview_decorators, _wbOAuthOpen_decorators, _wbSkillCatalog_decorators, _wbSkillDetail_decorators, _wbSkillInstall_decorators, _wbSkillUninstall_decorators, _wbSkillInstalled_decorators, _wbMarketRegistry_decorators, _wbMarketRegistryUpsert_decorators, _wbInstallState_decorators, _wbInstallStateRecord_decorators, _wbInstallStateForget_decorators, _wbAwesomeCatalog_decorators, _wbAwesomeDetail_decorators, _wbAwesomeReadme_decorators, _wbAwesomeUpdateCheck_decorators, _wbRepoMeta_decorators, _wbNpmDownloads_decorators, _wbLoadoutExport_decorators, _wbLoadoutDiff_decorators;
 	return class McpManagerGateway extends _classSuper {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
@@ -1067,10 +1238,6 @@ let McpManagerGateway = (() => {
 			__esDecorate(this, null, _reconnect_decorators, { kind: "method", name: "reconnect", static: false, private: false, access: { has: (obj) => "reconnect" in obj, get: (obj) => obj.reconnect }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_tools_decorators = [Remote("tools")];
 			__esDecorate(this, null, _tools_decorators, { kind: "method", name: "tools", static: false, private: false, access: { has: (obj) => "tools" in obj, get: (obj) => obj.tools }, metadata: _metadata }, null, _instanceExtraInitializers);
-			_builtins_decorators = [Remote("builtins")];
-			__esDecorate(this, null, _builtins_decorators, { kind: "method", name: "builtins", static: false, private: false, access: { has: (obj) => "builtins" in obj, get: (obj) => obj.builtins }, metadata: _metadata }, null, _instanceExtraInitializers);
-			_installBuiltins_decorators = [Remote("installBuiltins")];
-			__esDecorate(this, null, _installBuiltins_decorators, { kind: "method", name: "installBuiltins", static: false, private: false, access: { has: (obj) => "installBuiltins" in obj, get: (obj) => obj.installBuiltins }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_add_decorators = [Remote("add")];
 			__esDecorate(this, null, _add_decorators, { kind: "method", name: "add", static: false, private: false, access: { has: (obj) => "add" in obj, get: (obj) => obj.add }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_update_decorators = [Remote("update")];
@@ -1095,8 +1262,6 @@ let McpManagerGateway = (() => {
 			__esDecorate(this, null, _removeWorkspaceServer_decorators, { kind: "method", name: "removeWorkspaceServer", static: false, private: false, access: { has: (obj) => "removeWorkspaceServer" in obj, get: (obj) => obj.removeWorkspaceServer }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_setWorkspaceExclude_decorators = [Remote("setWorkspaceExclude")];
 			__esDecorate(this, null, _setWorkspaceExclude_decorators, { kind: "method", name: "setWorkspaceExclude", static: false, private: false, access: { has: (obj) => "setWorkspaceExclude" in obj, get: (obj) => obj.setWorkspaceExclude }, metadata: _metadata }, null, _instanceExtraInitializers);
-			_installWorkspaceBuiltins_decorators = [Remote("installWorkspaceBuiltins")];
-			__esDecorate(this, null, _installWorkspaceBuiltins_decorators, { kind: "method", name: "installWorkspaceBuiltins", static: false, private: false, access: { has: (obj) => "installWorkspaceBuiltins" in obj, get: (obj) => obj.installWorkspaceBuiltins }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_previewWorkspaceImport_decorators = [Remote("previewWorkspaceImport")];
 			__esDecorate(this, null, _previewWorkspaceImport_decorators, { kind: "method", name: "previewWorkspaceImport", static: false, private: false, access: { has: (obj) => "previewWorkspaceImport" in obj, get: (obj) => obj.previewWorkspaceImport }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_importWorkspaceJson_decorators = [Remote("importWorkspaceJson")];
@@ -1123,6 +1288,8 @@ let McpManagerGateway = (() => {
 			__esDecorate(this, null, _wbConnectorCatalog_decorators, { kind: "method", name: "wbConnectorCatalog", static: false, private: false, access: { has: (obj) => "wbConnectorCatalog" in obj, get: (obj) => obj.wbConnectorCatalog }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbConnectorCachedCount_decorators = [Remote("wbConnectorCachedCount")];
 			__esDecorate(this, null, _wbConnectorCachedCount_decorators, { kind: "method", name: "wbConnectorCachedCount", static: false, private: false, access: { has: (obj) => "wbConnectorCachedCount" in obj, get: (obj) => obj.wbConnectorCachedCount }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbConnectorIcon_decorators = [Remote("wbConnectorIcon")];
+			__esDecorate(this, null, _wbConnectorIcon_decorators, { kind: "method", name: "wbConnectorIcon", static: false, private: false, access: { has: (obj) => "wbConnectorIcon" in obj, get: (obj) => obj.wbConnectorIcon }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbConnectorPreview_decorators = [Remote("wbConnectorPreview")];
 			__esDecorate(this, null, _wbConnectorPreview_decorators, { kind: "method", name: "wbConnectorPreview", static: false, private: false, access: { has: (obj) => "wbConnectorPreview" in obj, get: (obj) => obj.wbConnectorPreview }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbConnectorInstall_decorators = [Remote("wbConnectorInstall")];
@@ -1154,11 +1321,6 @@ let McpManagerGateway = (() => {
 			__esDecorate(this, null, _wbMarketRegistry_decorators, { kind: "method", name: "wbMarketRegistry", static: false, private: false, access: { has: (obj) => "wbMarketRegistry" in obj, get: (obj) => obj.wbMarketRegistry }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbMarketRegistryUpsert_decorators = [Remote("wbMarketRegistryUpsert")];
 			__esDecorate(this, null, _wbMarketRegistryUpsert_decorators, { kind: "method", name: "wbMarketRegistryUpsert", static: false, private: false, access: { has: (obj) => "wbMarketRegistryUpsert" in obj, get: (obj) => obj.wbMarketRegistryUpsert }, metadata: _metadata }, null, _instanceExtraInitializers);
-			// T03/R5：codebuddy 插件市场（列表 / 详情）。
-			_wbPluginCatalog_decorators = [Remote("wbPluginCatalog")];
-			__esDecorate(this, null, _wbPluginCatalog_decorators, { kind: "method", name: "wbPluginCatalog", static: false, private: false, access: { has: (obj) => "wbPluginCatalog" in obj, get: (obj) => obj.wbPluginCatalog }, metadata: _metadata }, null, _instanceExtraInitializers);
-			_wbPluginDetail_decorators = [Remote("wbPluginDetail")];
-			__esDecorate(this, null, _wbPluginDetail_decorators, { kind: "method", name: "wbPluginDetail", static: false, private: false, access: { has: (obj) => "wbPluginDetail" in obj, get: (obj) => obj.wbPluginDetail }, metadata: _metadata }, null, _instanceExtraInitializers);
 			// T04/R8：安装状态登记（connector/skill/plugin 三类安装的统一账本）。
 			_wbInstallState_decorators = [Remote("wbInstallState")];
 			__esDecorate(this, null, _wbInstallState_decorators, { kind: "method", name: "wbInstallState", static: false, private: false, access: { has: (obj) => "wbInstallState" in obj, get: (obj) => obj.wbInstallState }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -1166,8 +1328,6 @@ let McpManagerGateway = (() => {
 			__esDecorate(this, null, _wbInstallStateRecord_decorators, { kind: "method", name: "wbInstallStateRecord", static: false, private: false, access: { has: (obj) => "wbInstallStateRecord" in obj, get: (obj) => obj.wbInstallStateRecord }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbInstallStateForget_decorators = [Remote("wbInstallStateForget")];
 			__esDecorate(this, null, _wbInstallStateForget_decorators, { kind: "method", name: "wbInstallStateForget", static: false, private: false, access: { has: (obj) => "wbInstallStateForget" in obj, get: (obj) => obj.wbInstallStateForget }, metadata: _metadata }, null, _instanceExtraInitializers);
-			_wbPluginUpdateCheck_decorators = [Remote("wbPluginUpdateCheck")];
-			__esDecorate(this, null, _wbPluginUpdateCheck_decorators, { kind: "method", name: "wbPluginUpdateCheck", static: false, private: false, access: { has: (obj) => "wbPluginUpdateCheck" in obj, get: (obj) => obj.wbPluginUpdateCheck }, metadata: _metadata }, null, _instanceExtraInitializers);
 			// T06/Awesome：DSH 社区插件市场（awesome-dsh-plugins）。
 			_wbAwesomeCatalog_decorators = [Remote("wbAwesomeCatalog")];
 			__esDecorate(this, null, _wbAwesomeCatalog_decorators, { kind: "method", name: "wbAwesomeCatalog", static: false, private: false, access: { has: (obj) => "wbAwesomeCatalog" in obj, get: (obj) => obj.wbAwesomeCatalog }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -1177,6 +1337,14 @@ let McpManagerGateway = (() => {
 			__esDecorate(this, null, _wbAwesomeReadme_decorators, { kind: "method", name: "wbAwesomeReadme", static: false, private: false, access: { has: (obj) => "wbAwesomeReadme" in obj, get: (obj) => obj.wbAwesomeReadme }, metadata: _metadata }, null, _instanceExtraInitializers);
 			_wbAwesomeUpdateCheck_decorators = [Remote("wbAwesomeUpdateCheck")];
 			__esDecorate(this, null, _wbAwesomeUpdateCheck_decorators, { kind: "method", name: "wbAwesomeUpdateCheck", static: false, private: false, access: { has: (obj) => "wbAwesomeUpdateCheck" in obj, get: (obj) => obj.wbAwesomeUpdateCheck }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbRepoMeta_decorators = [Remote("wbRepoMeta")];
+			__esDecorate(this, null, _wbRepoMeta_decorators, { kind: "method", name: "wbRepoMeta", static: false, private: false, access: { has: (obj) => "wbRepoMeta" in obj, get: (obj) => obj.wbRepoMeta }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbNpmDownloads_decorators = [Remote("wbNpmDownloads")];
+			__esDecorate(this, null, _wbNpmDownloads_decorators, { kind: "method", name: "wbNpmDownloads", static: false, private: false, access: { has: (obj) => "wbNpmDownloads" in obj, get: (obj) => obj.wbNpmDownloads }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbLoadoutExport_decorators = [Remote("wbLoadoutExport")];
+			__esDecorate(this, null, _wbLoadoutExport_decorators, { kind: "method", name: "wbLoadoutExport", static: false, private: false, access: { has: (obj) => "wbLoadoutExport" in obj, get: (obj) => obj.wbLoadoutExport }, metadata: _metadata }, null, _instanceExtraInitializers);
+			_wbLoadoutDiff_decorators = [Remote("wbLoadoutDiff")];
+			__esDecorate(this, null, _wbLoadoutDiff_decorators, { kind: "method", name: "wbLoadoutDiff", static: false, private: false, access: { has: (obj) => "wbLoadoutDiff" in obj, get: (obj) => obj.wbLoadoutDiff }, metadata: _metadata }, null, _instanceExtraInitializers);
 			if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
 		}
 		static inject = ["loader", "tools"];
@@ -1253,27 +1421,6 @@ let McpManagerGateway = (() => {
 			const wsPath = typeof rawPath === "string" && rawPath ? canonicalWorkspacePath(rawPath) : undefined;
 			return { tools: workspaceToolSchemas(this.ctx, value, wsPath).map(projectToolSchema), ambiguous: false };
 		}
-		async builtins() {
-			const state = await managedState(this.ctx);
-			return { builtins: builtinMcpCatalog(effectiveMcpServers(this.ctx, state)) };
-		}
-		async installBuiltins(payload) {
-			return withPatchWrite(this.ctx, async () => {
-				const state = await managedState(this.ctx);
-				const result = appendSelectedBuiltinMcpServers(
-					state.content,
-					effectiveMcpServers(this.ctx, state),
-					payload?.ids,
-					{ reservedIds: reservedEntryIds(this.ctx) },
-				);
-				if (result.content !== state.content) await writePatch(state, result.content);
-				const notes = [];
-				if (result.added.length) notes.push(`已追加：${result.added.join(", ")}`);
-				if (result.skipped.length) notes.push(`已存在并跳过：${result.skipped.join(", ")}`);
-				const { content: _content, ...summary } = result;
-				return { ...summary, note: notes.join("；") || "未修改配置" };
-			});
-		}
 		async add(spec) {
 			if (containsRedactedValue(spec)) throw new Error("新增 MCP 不能包含保留原值标记");
 			const normalized = normalizeOne(spec);
@@ -1511,36 +1658,6 @@ let McpManagerGateway = (() => {
 			catch (error) { this.ctx.logger?.error?.(`mcp-manager: 屏蔽已写入，但对齐会话作用域失败（下次挂载会重试）: ${error?.message ?? error}`); }
 			return result;
 		}
-		async installWorkspaceBuiltins(payload) {
-			const wsPath = canonicalWorkspacePath(String(payload?.wsPath || ""));
-			const ids = payload?.ids;
-			if (!Array.isArray(ids) || !ids.length || !ids.every((id) => typeof id === "string")) throw new Error("内置 MCP ids 必须是非空字符串数组");
-			const result = await withWorkspaceWrite(wsPath, async () => {
-				const config = await readWorkspaceConfigCached(this.ctx, wsPath);
-				if (config.error) throw new Error(config.error);
-				const known = new Map(BUILTIN_MCP_SERVERS.map((builtin) => [builtin.id, builtin]));
-				const unknown = ids.filter((id) => !known.has(id));
-				if (unknown.length) throw new Error(`未知的内置 MCP：${unknown.join(", ")}`);
-				const existing = new Set(config.servers.map((server) => server.name));
-				const added = [];
-				const skipped = [];
-				for (const id of ids) {
-					const builtin = known.get(id);
-					if (existing.has(builtin.name)) { skipped.push(id); continue; }
-					const spec = { name: builtin.name };
-					for (const field of ["transport", "command", "args", "env", "cwd", "url", "headers", "toolCallTimeoutMs", "failOnStartupError", "reconnect"]) {
-						if (builtin[field] !== undefined) spec[field] = structuredClone(builtin[field]);
-					}
-					added.push(spec);
-				}
-				if (!added.length) return { note: skipped.length ? `已存在并跳过：${skipped.join(", ")}` : "未修改配置", unchanged: true };
-				await writeWorkspaceConfigFile(wsPath, [...config.servers, ...added], config.exclude);
-				return { note: `已追加：${added.map((server) => server.name).join(", ")}${skipped.length ? `；已存在并跳过：${skipped.join(", ")}` : ""}` };
-			});
-			// 没写盘就不用对齐（否则每次点"安装内置"都会白跑一遍挂载）。
-			if (!result.unchanged) await alignWorkspaceConnections(this.ctx, wsPath);
-			return { note: result.note };
-		}
 		async previewWorkspaceImport(payload) {
 			const wsPath = canonicalWorkspacePath(String(payload?.wsPath || ""));
 			const json = typeof payload?.json === "string" ? JSON.parse(payload.json) : payload?.json;
@@ -1731,6 +1848,10 @@ let McpManagerGateway = (() => {
 	async wbConnectorPreview(payload) {
 		return wbConnectorPreview(payload?.connectorId);
 	}
+	// 某条连接器的图标（data URL）。市场卡片进视口才调，payload 形状同 wbConnectorPreview。
+	async wbConnectorIcon(payload) {
+		return wbConnectorIcon(payload?.connectorId);
+	}
 	async wbConnectorInstall(payload) {
 		const connectorId = String(payload?.connectorId || "").trim();
 		if (!connectorId) throw new Error("缺少 connectorId");
@@ -1798,6 +1919,10 @@ let McpManagerGateway = (() => {
 				error: started?.error || "授权流程启动失败",
 				mode: started?.mode || "",
 				redirectUri: started?.redirectUri || "",
+				// 授权页这条路走不通（服务器不提供 OAuth 发现、动态注册被拒…）时，
+				// 手填令牌仍然是可用通道：把它交给面板，别只留一行红字。
+				manualTokenOnly: started?.manualTokenOnly === true,
+				serverUrl: started?.serverUrl || target.url,
 			};
 		}
 		// 默认由宿主直接把授权页推给系统浏览器；open:false 留给面板自己渲染链接。
@@ -1902,15 +2027,6 @@ let McpManagerGateway = (() => {
 	async wbMarketRegistryUpsert(payload) {
 		return upsertMarketplace(payload || {});
 	}
-	// ── T03/R5：codebuddy 插件市场 ──────────────────────────────────────
-	// 数据层在 lib/wb-plugin-market.js；这里只做 RPC 转发（下载/缓存/解析都在那边）。
-	async wbPluginCatalog() {
-		return wbPluginCatalog();
-	}
-	async wbPluginDetail(payload) {
-		return wbPluginDetail(payload?.name);
-	}
-
 	// ── T04/R8：安装状态账本（connector / skill / plugin 三类安装的统一登记） ──
 	async wbInstallState() {
 		return readInstallState();
@@ -1930,9 +2046,6 @@ let McpManagerGateway = (() => {
 		return { note: `已移除安装状态：${kind}/${key}` };
 	}
 
-	async wbPluginUpdateCheck() {
-		return wbPluginUpdateCheck();
-	}
 	// ── T06/Awesome：DSH 社区插件市场（awesome-dsh-plugins）──────────────
 	// 数据层在 lib/wb-awesome-market.js；这里只做 RPC 转发。
 	async wbAwesomeCatalog(payload) {
@@ -1947,6 +2060,35 @@ let McpManagerGateway = (() => {
 	async wbAwesomeUpdateCheck() {
 		return wbAwesomeUpdateCheck();
 	}
+	// ── 社区元信息：仓库「人味」信号（维护者 / 最近提交 / issue / star）────────
+	// 详情弹层按需调用，只读公开接口，6 小时缓存；不接收也不保存任何凭据。
+	async wbRepoMeta(payload) {
+		return wbRepoMeta(payload || {});
+	}
+	// ── npm 近 30 天下载量（只读）───────────────────────────────────────
+	// 卡片进视口才按需批量取，7 天缓存；只读公开统计接口，不接收也不保存任何凭据。
+	async wbNpmDownloads(payload) {
+		return wbNpmDownloads(payload || {});
+	}
+	// ── 装备清单（只读）────────────────────────────────────────────────
+	// 导出：收集本机全局 MCP / 技能 / 已召唤专家 / 已装插件，只留身份字段。
+	// 对比：校验用户贴入的清单并与本机做差异，返回逐条状态；不安装、不写盘。
+	async wbLoadoutExport(payload) {
+		const items = await collectLoadoutItems(this.ctx);
+		return {
+			ok: true,
+			loadout: buildLoadout({
+				name: payload?.name,
+				items,
+				appVersion: pluginVersion(),
+			}),
+		};
+	}
+	async wbLoadoutDiff(payload) {
+		const raw = payload?.loadout ?? payload?.text ?? payload;
+		const items = await collectLoadoutItems(this.ctx);
+		return { ok: true, ...diffLoadout(raw, items) };
+	}
 	// ── WorkBuddy 专家直连（召唤预设 + 捆绑技能）────────────────────────
 	// 数据与安装逻辑都在 lib/expert-market.js；这里只做 RPC 转发与 patch 写盘收尾。
 	// 召唤 = 往 profile patch 插入一条独立 @deepseek-ai/dsh-agent-preset 行（persona.prefix
@@ -2088,7 +2230,31 @@ let McpManagerGateway = (() => {
 		// 不存在的 TeamCreate/Agent（成员开不出来）。标记桥接判定放前端（需要市场目录的
 		// expertType），这里只把 personaText 原样带出去。
 		const patch = await readPatch(this.ctx);
-		return { presets: readExpertPresets(patch.content), skills: await listExpertSkills() };
+		const presets = readExpertPresets(patch.content);
+		// patch 只记 plugin / presetId，中英显示名在专家目录缓存里。这里补上两个字段，
+		// 客户端按宿主语言挑：中文名给中文界面，英文名给英文界面。读缓存失败只回落
+		// plugin 名，不影响「已召唤 / 已装技能」本身的状态判断。
+		// 回落有三层（目录缓存 → 预设行自带的名字 → 英文标识名）：召唤那一刻
+		// `WorkBuddy 专家 · <显示名>` 就写进了 patch 行，readExpertPresets 剥前缀即得，
+		// 所以目录没落盘 / 专家已下架时菜单仍能出「吴八哥」，而不是 senior-developer。
+		let displayNames = new Map();
+		try {
+			displayNames = await readExpertDisplayNames();
+		} catch (error) {
+			this.ctx.logger?.warn?.(`wb-expert: 读取专家显示名失败：${error?.message ?? error}`);
+		}
+		return {
+			presets: presets.map((row) => {
+				const info = displayNames.get(row.plugin) || {};
+				return {
+					...row,
+					...info,
+					nameZh: info.nameZh || row.displayName || "",
+					nameEn: info.nameEn || row.displayName || "",
+				};
+			}),
+			skills: await listExpertSkills(),
+		};
 	}
 	// 最近使用记录（输入框召唤菜单的数据源）：召唤/送还时自动记录专家；技能与 MCP 由
 	// 客户端在用户从菜单里显式选用时上报（recordUse）。只存展示所需最小字段。
@@ -2103,4 +2269,4 @@ let McpManagerGateway = (() => {
 	};
 })();
 
-export { checkForUpdate, McpManagerGateway, McpManagerGateway as default, summarizeWorkspaceRow };
+export { McpManagerGateway, McpManagerGateway as default };