dsh-himarket 0.1.1

package/README.md

@@ -0,0 +1,95 @@
+# dsh-himarket
+
+把 [HiMarket](https://github.com/higress-group/himarket)（企业 AI 能力市场）接入 [DeepSeek Harness（DSH）](https://github.com/deepseek-ai/deepseek-harness) 的桥接插件。
+
+- **同步已订阅的 MCP Server** → 自动注册成模型可调用的工具（`mcp__<name>__<tool>`）
+- **一键安装已发布的 Skill** → 落盘到 `~/.dsh/skills/`，装完即可用，无需重启
+- **小白友好**：设置页一个「HiMarket」卡片 + 对话式入口（说「同步 HiMarket」「安装 xx 技能」即可）
+
+## 给同事（小白）用：三步
+
+1. 打开 DSH Web → **设置 → HiMarket**。
+2. 填三样：**HiMarket 地址**、**用户名**、**密码**（找 HiMarket 管理员要开发者账号），点「保存」。
+3. 点「**同步能力**」，然后：
+   - 已订阅的 MCP 工具会自动出现在对话里，直接说「用 xxx 查一下…」即可；
+   - 想装技能，点技能卡片上的「**安装**」，装完在对话里说「帮我用 xx 技能…」。
+
+> 也可以在对话里直接说「同步 HiMarket」或「安装 xx 技能」，效果一样。
+
+## 给 DSH 管理员：安装
+
+```sh
+# 方式一：公司内网 registry 发布后
+dsh plugin --profile web add dsh-himarket
+
+# 方式二：本地源码（开发）
+dsh plugin --profile web add link:E:/path/to/dsh-himarket
+```
+
+然后在 `~/.dsh/profiles/web/cordis.patch.yml` 里加一行（`dsh plugin add` 会自动写）：
+
+```yaml
+- insert:
+    - id: himarket
+      name: dsh-himarket
+```
+
+重启 `dsh web`，刷新页面，设置里会出现「HiMarket」卡片。
+
+## 配置
+
+所有配置走 DSH 的 settings（`~/.dsh/settings.yaml`，热加载），也可以在桥接行里给默认值：
+
+```yaml
+- insert:
+    - id: himarket
+      name: dsh-himarket
+      config:
+        skillInstallDir: ''   # 留空 = ~/.dsh/skills；可改成公司统一技能目录
+```
+
+| 字段 | 默认 | 说明 |
+|---|---|---|
+| `baseUrl` | 空 | HiMarket 后端地址（不含尾斜杠），如 `http://10.0.0.8:8080` |
+| `username` | 空 | 开发者账号用户名 |
+| `password` | 空 | 开发者账号密码（明文，仅存本机 settings.yaml） |
+| `skillInstallDir` | 空 | Skill 安装根；留空回退 `~/.dsh/skills` |
+
+## 架构与实现要点
+
+- **不发布服务**：桥接只消费 `webServer`/`tools`/`settings`，放 host 平面、行 loose、无 isolate realm（与 `dsh-matrix` 同形）。
+- **MCP 复用官方客户端**：不重造 MCP 客户端，运行时经 `createRequire(ctx.baseUrl)` + 动态 `import()` 解析 `@deepseek-ai/dsh-mcp-client`，用 Cordis `ctx.plugin()` 动态建/拆 fiber，`serverName` 由 HiMarket `name` 清洗得到。
+- **Skill 靠写文件生效**：下载 ZIP → 系统 `bsdtar` 解压 → 定位 `SKILL.md` → 落盘 `~/.dsh/skills/<name>/`，由 DSH 自带的 `@deepseek-ai/dsh-skill-filesystem` 扫描发现（无需重启）。
+- **凭证走 settings**：与 DSH Web 的 Models 页同一机制，热加载、重启自动恢复。
+- **HiMarket API 契约**（由 HiMarket 后端提供，本插件只做字段容错）：
+  - `POST /developers/login` → `{code, data:{access_token}}`
+  - `GET /cli-providers/market-mcps` → `{data:{mcpServers:[{name,url,transportType}], authHeaders}}`
+  - `GET /cli-providers/market-skills` → `{data:{items:[{productId,name,description}]}}`
+  - `GET /skills/{productId}/download` → ZIP
+
+## 开发
+
+```sh
+pnpm install
+pnpm build        # tsc 编译 src → lib + esbuild 打包 client → lib/client.js
+pnpm test         # tsc + esbuild + node --test（单元测试）
+```
+
+- host 端源码在 `src/`（TypeScript，编译到 `lib/`）。
+- 浏览器端源码在 `src/client-main.js`（ES module，`import React`），由 `scripts/build-client.mjs` 用 esbuild 打包为 `lib/client.js`（`__ModuleLoader__.load` 格式，react 外部化），与 `dsh-matrix-agent` 同款。
+- 端到端冒烟：`node tests/mock-himarket.mjs 18080` 起假后端，再对运行中的 web 实例调 `/himarket/save-config`、`/himarket/sync`、`/himarket/install-skill`。
+
+## 发布
+
+推 `v*` tag（或手动触发）后，`.github/workflows/npm-publish.yml` 自动构建、测试、`npm publish` 并建 GitHub Release。需在仓库配 `NPM_TOKEN` secret。
+
+## 已知限制
+
+- `stdio` 型 MCP 暂不支持（HiMarket 的 `market-mcps` 目前只暴露 http 型 URL）。
+- 密码明文存本机 `settings.yaml`（与 DSH Models 页的 apiKey 同一风险等级）；后续可换 token 直填或系统凭据库。
+- `transportType: sse` 统一按 `streamable-http` 处理（官方 mcp-client 的 Streamable HTTP 传输兼容 SSE 端点）。
+- 清空配置需重启或重新 sync 才会完全清除内存态（token 已在 save-config 清空时一并处理）。
+
+## 许可
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,10 @@
+# dsh-himarket bundle layer: inserts the HiMarket bridge row into the composition.
+# The bridge publishes no service; it only consumes webServer/tools/settings, so it
+# sits loose in the host plane (same shape as dsh-matrix).
+- insert:
+    - id: himarket
+      name: dsh-himarket
+      config:
+        # 桥接包在运行时经 createRequire(ctx.baseUrl) 解析官方 @deepseek-ai/* 包，
+        # 无需在此声明它们；这里只放桥接自身可调的默认值。
+        skillInstallDir: ''

package/lib/client.js

@@ -0,0 +1,283 @@
+window.__ModuleLoader__.load({
+  id: "dsh-himarket",
+  factory: (require) => {
+    var module = { exports: {} };
+    var exports = module.exports;
+    Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client-main.js
+var client_main_exports = {};
+__export(client_main_exports, {
+  apply: () => apply,
+  inject: () => inject
+});
+module.exports = __toCommonJS(client_main_exports);
+var import_react = __toESM(require("react"), 1);
+var inject = ["slots", "locale"];
+var el = import_react.default.createElement;
+var NS = "settings.himarket";
+var zh = {
+  tab: "HiMarket",
+  title: "HiMarket \u80FD\u529B\u5E02\u573A",
+  subtitle: "\u586B\u4E00\u6B21\u5730\u5740\u548C\u8D26\u53F7\uFF0C\u70B9\u300C\u540C\u6B65\u300D\uFF0C\u5C31\u80FD\u5728\u5BF9\u8BDD\u91CC\u7528\u4E0A\u516C\u53F8\u4E0A\u67B6\u7684 MCP \u5DE5\u5177\u548C\u6280\u80FD\u3002",
+  configTitle: "\u2460 \u8FDE\u63A5\u914D\u7F6E",
+  baseUrlLabel: "HiMarket \u5730\u5740",
+  baseUrlPlaceholder: "\u4F8B\u5982 http://ai-market.ict.cmcc",
+  usernameLabel: "\u7528\u6237\u540D",
+  usernamePlaceholder: "\u5F00\u53D1\u8005\u8D26\u53F7\u7528\u6237\u540D",
+  passwordLabel: "\u5BC6\u7801",
+  passwordPlaceholder: "\u5F00\u53D1\u8005\u8D26\u53F7\u5BC6\u7801",
+  save: "\u4FDD\u5B58\u914D\u7F6E",
+  saved: "\u5DF2\u4FDD\u5B58",
+  sync: "\u540C\u6B65\u80FD\u529B",
+  syncing: "\u540C\u6B65\u4E2D\u2026",
+  mcpTitle: "\u2461 \u5DF2\u8BA2\u9605 MCP\uFF08\u540C\u6B65\u540E\u81EA\u52A8\u63A5\u5165\u4F1A\u8BDD\uFF09",
+  skillTitle: "\u2462 \u53EF\u5B89\u88C5\u6280\u80FD",
+  install: "\u5B89\u88C5",
+  installed: "\u5DF2\u88C5",
+  empty: "\u6682\u65E0\u6570\u636E\uFF0C\u8BF7\u5148\u300C\u540C\u6B65\u300D\u6216\u68C0\u67E5\u8D26\u53F7\u662F\u5426\u5DF2\u8BA2\u9605/\u4E0A\u67B6\u3002",
+  error: "\u51FA\u9519\u4E86",
+  ok: "\u5B8C\u6210"
+};
+var en = {
+  tab: "HiMarket",
+  title: "HiMarket Capability Market",
+  subtitle: "Configure once, sync, and use subscribed MCP tools and skills in chat.",
+  configTitle: "1. Connection",
+  baseUrlLabel: "HiMarket URL",
+  usernameLabel: "Username",
+  passwordLabel: "Password",
+  save: "Save",
+  saved: "Saved",
+  sync: "Sync",
+  syncing: "Syncing\u2026",
+  mcpTitle: "2. Subscribed MCP (auto-attached)",
+  skillTitle: "3. Installable Skills",
+  install: "Install",
+  installed: "Installed",
+  empty: "Nothing yet. Sync first, or check subscriptions/published items.",
+  error: "Error",
+  ok: "Done"
+};
+var CSS = [
+  ".hm_section{width:100%;max-width:760px;display:flex;flex-direction:column;gap:14px;color:var(--dsw-alias-label-primary)}",
+  ".hm_section h3{margin:0;font-size:13px;font-weight:600;line-height:20px}",
+  ".hm_message{color:var(--dsw-alias-label-tertiary);font-size:13px;line-height:20px;margin:0}",
+  ".hm_message[data-error=true]{color:var(--dsw-alias-state-error-primary)}",
+  ".hm_field{display:flex;flex-direction:column;gap:6px}",
+  ".hm_field label{font-size:12px;color:var(--dsw-alias-label-secondary)}",
+  ".hm_input{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:8px;padding:8px 10px;font-size:13px;color:var(--dsw-alias-label-primary)}",
+  ".hm_row{display:flex;gap:8px;align-items:center;flex-wrap:wrap}",
+  ".hm_btn{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);border-radius:8px;padding:6px 12px;font-size:13px;cursor:pointer}",
+  ".hm_btn:hover{background:var(--dsw-alias-bg-layer-2)}",
+  ".hm_btn[data-primary=true]{background:var(--dsw-alias-state-business-primary);border-color:var(--dsw-alias-state-business-primary);color:#fff}",
+  ".hm_list{margin:0;padding:0;list-style:none;display:grid;gap:8px}",
+  ".hm_item{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:10px;padding:10px 12px;display:flex;flex-direction:column;gap:6px}",
+  ".hm_itemTop{display:flex;align-items:center;gap:8px}",
+  ".hm_name{font-size:13px;font-weight:600;flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}",
+  ".hm_desc{font-size:12px;color:var(--dsw-alias-label-tertiary);margin:0}",
+  ".hm_tag{border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-tertiary);border-radius:999px;padding:1px 8px;font-size:11px;line-height:16px;flex:none}",
+  ".hm_tag[data-ok=true]{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary)}"
+].join("\n");
+function injectCss() {
+  const tagId = "dsh-himarket/client.css";
+  if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
+    const tag = document.createElement("style");
+    tag.dataset.plugin = "dsh-himarket";
+    tag.dataset.pluginCss = tagId;
+    tag.textContent = CSS;
+    document.head.appendChild(tag);
+  }
+}
+function call(path, body) {
+  return fetch(path, body === void 0 ? {} : { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) }).then((res) => res.json()).then((data) => {
+    if (data && data.ok === false) throw new Error(data.error || "request failed");
+    return data;
+  });
+}
+function HimarketTab(props) {
+  const t = props.t;
+  const [state, setState] = import_react.default.useState({ status: "loading" });
+  const [message, setMessage] = import_react.default.useState(null);
+  const [busy, setBusy] = import_react.default.useState(false);
+  const [baseUrl, setBaseUrl] = import_react.default.useState("");
+  const [username, setUsername] = import_react.default.useState("");
+  const [password, setPassword] = import_react.default.useState("");
+  const refresh = import_react.default.useCallback(function() {
+    call("/himarket/state").then(function(data2) {
+      setState({ status: "ready", data: data2 });
+      if (data2 && data2.baseUrl) setBaseUrl(data2.baseUrl);
+      if (data2 && data2.username) setUsername(data2.username);
+    }, function(err) {
+      setState({ status: "error", error: err.message });
+    });
+  }, []);
+  import_react.default.useEffect(function() {
+    refresh();
+  }, [refresh]);
+  function saveConfig() {
+    setBusy(true);
+    call("/himarket/save-config", { baseUrl, username, password }).then(
+      function() {
+        setMessage(t("saved"));
+        setBusy(false);
+        refresh();
+      },
+      function(err) {
+        setMessage(t("error") + "\uFF1A" + err.message);
+        setBusy(false);
+      }
+    );
+  }
+  function doSync() {
+    setBusy(true);
+    setMessage(t("syncing"));
+    call("/himarket/sync", {}).then(function(data2) {
+      setMessage(data2.summary || t("ok"));
+      setBusy(false);
+      refresh();
+    }, function(err) {
+      setMessage(t("error") + "\uFF1A" + err.message);
+      setBusy(false);
+    });
+  }
+  function installSkill(nameOrId) {
+    setBusy(true);
+    call("/himarket/install-skill", { nameOrId }).then(function(data2) {
+      setMessage(data2.summary || t("ok"));
+      setBusy(false);
+      refresh();
+    }, function(err) {
+      setMessage(t("error") + "\uFF1A" + err.message);
+      setBusy(false);
+    });
+  }
+  const data = state.status === "ready" ? state.data : null;
+  const mcpServers = data && data.mcpServers || [];
+  const activeNames = data && data.activeMcpNames || [];
+  const publishedSkills = data && data.publishedSkills || [];
+  const installedSkills = data && data.installedSkills || [];
+  function isInstalled(skill) {
+    const name = skill && skill.name;
+    return installedSkills.indexOf(name) >= 0;
+  }
+  return el(
+    "div",
+    { className: "hm_section" },
+    el("h3", null, t("title")),
+    el("p", { className: "hm_message" }, t("subtitle")),
+    el("h3", null, t("configTitle")),
+    el(
+      "div",
+      { className: "hm_field" },
+      el("label", null, t("baseUrlLabel")),
+      el("input", { className: "hm_input", type: "text", placeholder: t("baseUrlPlaceholder"), value: baseUrl, onChange: (e) => setBaseUrl(e.target.value) })
+    ),
+    el(
+      "div",
+      { className: "hm_field" },
+      el("label", null, t("usernameLabel")),
+      el("input", { className: "hm_input", type: "text", placeholder: t("usernamePlaceholder"), value: username, onChange: (e) => setUsername(e.target.value) })
+    ),
+    el(
+      "div",
+      { className: "hm_field" },
+      el("label", null, t("passwordLabel")),
+      el("input", { className: "hm_input", type: "password", placeholder: t("passwordPlaceholder"), value: password, onChange: (e) => setPassword(e.target.value) })
+    ),
+    el(
+      "div",
+      { className: "hm_row" },
+      el("button", { className: "hm_btn", type: "button", disabled: busy, onClick: saveConfig }, t("save")),
+      el("button", { className: "hm_btn", type: "button", "data-primary": "true", disabled: busy, onClick: doSync }, busy ? t("syncing") : t("sync"))
+    ),
+    message !== null ? el("p", { className: "hm_message", "data-error": message.indexOf(t("error")) === 0 ? "true" : void 0 }, message) : null,
+    el("h3", null, t("mcpTitle")),
+    mcpServers.length === 0 && activeNames.length === 0 ? el("p", { className: "hm_message" }, t("empty")) : el(
+      "ul",
+      { className: "hm_list" },
+      mcpServers.map((mm) => {
+        const active = activeNames.indexOf(mm.name) >= 0;
+        return el(
+          "li",
+          { className: "hm_item", key: mm.name },
+          el(
+            "div",
+            { className: "hm_itemTop" },
+            el("span", { className: "hm_name" }, mm.name),
+            el("span", { className: "hm_tag", "data-ok": active ? "true" : void 0 }, active ? "\u5DF2\u63A5\u5165" : "\u672A\u8FDE\u63A5")
+          ),
+          mm.description ? el("p", { className: "hm_desc" }, mm.description) : null
+        );
+      })
+    ),
+    el("h3", null, t("skillTitle")),
+    publishedSkills.length === 0 ? el("p", { className: "hm_message" }, t("empty")) : el(
+      "ul",
+      { className: "hm_list" },
+      publishedSkills.map((sk) => {
+        const done = isInstalled(sk);
+        return el(
+          "li",
+          { className: "hm_item", key: sk.productId },
+          el(
+            "div",
+            { className: "hm_itemTop" },
+            el("span", { className: "hm_name" }, sk.name),
+            el("button", { className: "hm_btn", type: "button", disabled: busy || done, onClick: () => installSkill(sk.productId) }, done ? t("installed") : t("install"))
+          ),
+          sk.description ? el("p", { className: "hm_desc" }, sk.description) : null
+        );
+      })
+    ),
+    state.status === "error" ? el("p", { className: "hm_message", "data-error": "true" }, t("error") + "\uFF1A" + state.error) : null
+  );
+}
+function apply(ctx) {
+  ctx.effect(function() {
+    return ctx.locale.register(NS, { zh, en });
+  }, "himarket: dictionaries");
+  const t = ctx.locale.bind(NS);
+  injectCss();
+  ctx.slots.inject("settings.plugins.tab", function() {
+    return ctx.slots.register({
+      name: "settings.plugins.tab",
+      id: "himarket",
+      order: 30,
+      label: () => t("tab"),
+      locale: NS,
+      inject: () => ({ t })
+    }, HimarketTab);
+  });
+}
+    return module.exports;
+  }
+});

package/lib/himarket-client.d.ts

@@ -0,0 +1,62 @@
+/**
+ * HiMarket REST 客户端：登录 + 拉取已订阅 MCP + 拉取已发布 Skill + 下载 Skill ZIP。
+ *
+ * 契约（由同事部署的 HiMarket 后端提供，本模块只做字段容错）：
+ *  - 统一响应包装 Response<T> = { code: 'SUCCESS', message?, data }
+ *  - POST /developers/login          data = { access_token, token_type, expires_in }
+ *  - GET  /cli-providers/market-mcps data = { mcpServers: [{name,url,transportType,description}], authHeaders }
+ *  - GET  /cli-providers/market-skills data = [{ productId, name, description, skillTags }]
+ *  - GET  /skills/{productId}/download  二进制 ZIP（@PublicAccess）
+ *
+ * @module dsh-himarket/himarket-client
+ */
+/** 单个已订阅 MCP Server（market-mcps 条目）。 */
+export interface SubscribedMcp {
+    productId: string;
+    name: string;
+    url: string;
+    transportType: string;
+    description: string;
+}
+/** 单个已发布 Skill（market-skills 条目）。 */
+export interface PublishedSkill {
+    productId: string;
+    name: string;
+    description: string;
+    skillTags: string[];
+}
+export declare class HimarketError extends Error {
+}
+/**
+ * HiMarket REST 客户端。持有 baseUrl + 用户名/密码 + 缓存 token，
+ * 401 自动重登一次。所有方法抛 HimarketError（含可读中文原因）。
+ */
+export declare class HimarketClient {
+    private readonly baseUrl;
+    private readonly username;
+    private readonly password;
+    private token;
+    private fetchFn;
+    constructor(opts: {
+        baseUrl: string;
+        username: string;
+        password: string;
+        token?: string;
+        fetchFn?: typeof fetch;
+    });
+    get hasToken(): boolean;
+    get currentToken(): string;
+    /** 登录并缓存 token；返回 access_token。 */
+    login(): Promise<string>;
+    /** 拉取已订阅（且已批准）的 MCP 列表 + 认证头。 */
+    listSubscribedMcps(): Promise<{
+        mcpServers: SubscribedMcp[];
+        authHeaders: Record<string, string>;
+    }>;
+    /** 拉取已发布 Skill 清单。 */
+    listPublishedSkills(): Promise<PublishedSkill[]>;
+    /** 下载 Skill ZIP，返回字节。 */
+    downloadSkill(productId: string): Promise<Uint8Array>;
+    /** 通用请求：带 401 自动重登一次；解析 {code,data} 包装。 */
+    private request;
+}

package/lib/himarket-client.js

@@ -0,0 +1,129 @@
+/**
+ * HiMarket REST 客户端：登录 + 拉取已订阅 MCP + 拉取已发布 Skill + 下载 Skill ZIP。
+ *
+ * 契约（由同事部署的 HiMarket 后端提供，本模块只做字段容错）：
+ *  - 统一响应包装 Response<T> = { code: 'SUCCESS', message?, data }
+ *  - POST /developers/login          data = { access_token, token_type, expires_in }
+ *  - GET  /cli-providers/market-mcps data = { mcpServers: [{name,url,transportType,description}], authHeaders }
+ *  - GET  /cli-providers/market-skills data = [{ productId, name, description, skillTags }]
+ *  - GET  /skills/{productId}/download  二进制 ZIP（@PublicAccess）
+ *
+ * @module dsh-himarket/himarket-client
+ */
+export class HimarketError extends Error {
+}
+/** 真实 HiMarket 后端的 API 前缀（前端同域反向代理到 /api/v1）。 */
+const API_PREFIX = '/api/v1';
+/** 规范 baseUrl（去尾斜杠；空则抛）。 */
+function normalizeBaseUrl(baseUrl) {
+    const trimmed = baseUrl.trim().replace(/\/+$/u, '');
+    if (trimmed === '')
+        throw new HimarketError('未配置 HiMarket 地址（baseUrl 为空）');
+    return trimmed;
+}
+/**
+ * HiMarket REST 客户端。持有 baseUrl + 用户名/密码 + 缓存 token，
+ * 401 自动重登一次。所有方法抛 HimarketError（含可读中文原因）。
+ */
+export class HimarketClient {
+    baseUrl;
+    username;
+    password;
+    token;
+    fetchFn;
+    constructor(opts) {
+        this.baseUrl = normalizeBaseUrl(opts.baseUrl);
+        this.username = opts.username;
+        this.password = opts.password;
+        this.token = opts.token ?? '';
+        this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+    }
+    get hasToken() {
+        return this.token !== '';
+    }
+    get currentToken() {
+        return this.token;
+    }
+    /** 登录并缓存 token；返回 access_token。 */
+    async login() {
+        const wrapped = await this.request('/developers/login', {
+            method: 'POST',
+            body: JSON.stringify({ username: this.username, password: this.password }),
+            auth: false,
+        });
+        const token = wrapped.access_token;
+        if (token === undefined || token === '') {
+            throw new HimarketError('登录成功但未返回 access_token');
+        }
+        this.token = token;
+        return token;
+    }
+    /** 拉取已订阅（且已批准）的 MCP 列表 + 认证头。 */
+    async listSubscribedMcps() {
+        const data = await this.request('/cli-providers/market-mcps', { auth: true });
+        const mcpServers = (data.mcpServers ?? [])
+            .filter((m) => typeof m.name === 'string' && m.name !== '' && typeof m.url === 'string' && m.url !== '')
+            .map((m) => ({
+            productId: String(m.productId ?? ''),
+            name: String(m.name),
+            url: String(m.url),
+            transportType: String(m.transportType ?? 'streamable-http'),
+            description: String(m.description ?? ''),
+        }));
+        return { mcpServers, authHeaders: data.authHeaders ?? {} };
+    }
+    /** 拉取已发布 Skill 清单。 */
+    async listPublishedSkills() {
+        const data = await this.request('/cli-providers/market-skills', { auth: true });
+        const list = Array.isArray(data) ? data : (data.items ?? []);
+        return list
+            .filter((s) => typeof s.productId === 'string' && s.productId !== '' && typeof s.name === 'string' && s.name !== '')
+            .map((s) => ({
+            productId: String(s.productId),
+            name: String(s.name),
+            description: String(s.description ?? ''),
+            skillTags: Array.isArray(s.skillTags) ? s.skillTags.filter((t) => typeof t === 'string') : [],
+        }));
+    }
+    /** 下载 Skill ZIP，返回字节。 */
+    async downloadSkill(productId) {
+        const url = `${this.baseUrl}${API_PREFIX}/skills/${encodeURIComponent(productId)}/download`;
+        const res = await this.fetchFn(url, { method: 'GET' });
+        if (!res.ok) {
+            throw new HimarketError(`下载技能失败（HTTP ${res.status}）`);
+        }
+        const buf = new Uint8Array(await res.arrayBuffer());
+        if (buf.length === 0)
+            throw new HimarketError('下载到的技能包为空');
+        return buf;
+    }
+    /** 通用请求：带 401 自动重登一次；解析 {code,data} 包装。 */
+    async request(path, opts) {
+        const doFetch = async () => {
+            const headers = { 'Content-Type': 'application/json' };
+            if (opts.auth && this.token !== '')
+                headers.Authorization = `Bearer ${this.token}`;
+            const res = await this.fetchFn(this.baseUrl + API_PREFIX + path, {
+                method: opts.method ?? 'GET',
+                headers,
+                ...(opts.body !== undefined ? { body: opts.body } : {}),
+            });
+            return res;
+        };
+        let res = await doFetch();
+        if (res.status === 401 && opts.auth) {
+            await this.login();
+            res = await doFetch();
+        }
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            throw new HimarketError(`HiMarket 请求失败（HTTP ${res.status}）${body.slice(0, 200)}`);
+        }
+        const wrapped = (await res.json().catch(() => ({ code: 'PARSE_ERROR' })));
+        if (wrapped.code !== undefined && wrapped.code !== 'SUCCESS') {
+            throw new HimarketError(wrapped.message ?? `HiMarket 返回错误码 ${wrapped.code}`);
+        }
+        return (wrapped.data ?? wrapped);
+    }
+}
+//# sourceMappingURL=himarket-client.js.map

package/lib/himarket-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"himarket-client.js","sourceRoot":"","sources":["../src/himarket-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA4CH,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG;AAE3C,iDAAiD;AACjD,MAAM,UAAU,GAAG,SAAS,CAAA;AAE5B,4BAA4B;AAC5B,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACnD,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,6BAA6B,CAAC,CAAA;IAC1E,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,cAAc;IACR,OAAO,CAAQ;IACf,QAAQ,CAAQ;IAChB,QAAQ,CAAQ;IACzB,KAAK,CAAQ;IACb,OAAO,CAAc;IAE7B,YAAY,IAMX;QACC,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAA;IACjD,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAW,mBAAmB,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1E,IAAI,EAAE,KAAK;SACZ,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAA;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,aAAa,CAAC,uBAAuB,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,kBAAkB;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAiB,4BAA4B,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7F,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC;aACvG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YACpC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YAClB,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,iBAAiB,CAAC;YAC3D,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;SACzC,CAAC,CAAC,CAAA;QACL,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAA;IAC5D,CAAC;IAED,sBAAsB;IACtB,KAAK,CAAC,mBAAmB;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,8BAA8B,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACjG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAuC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QAChG,OAAO,IAAI;aACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;aACnH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;YACxC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAC3G,CAAC,CAAC,CAAA;IACP,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,UAAU,WAAW,kBAAkB,CAAC,SAAS,CAAC,WAAW,CAAA;QAC3F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QACtD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,eAAe,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,WAAW,CAAC,CAAA;QAC1D,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,2CAA2C;IACnC,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,IAAuD;QAC5F,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE;YAC5C,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;YAC9E,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAA;YAClF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,UAAU,GAAG,IAAI,EAAE;gBAC/D,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;gBAC5B,OAAO;gBACP,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAA;YACF,OAAO,GAAG,CAAA;QACZ,CAAC,CAAA;QAED,IAAI,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YAClB,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;QACvB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC7C,MAAM,IAAI,aAAa,CAAC,sBAAsB,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAe,CAAA;QACvF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,IAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,OAAwB,CAAM,CAAA;IACzD,CAAC;CACF"}

package/lib/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * dsh-himarket 宿主端：HiMarket 桥接的编排器。
+ *
+ * 职责：
+ *  - 注册 settings 命名空间持久化凭证；
+ *  - 注册环回 HTTP 路由 /himarket/* 供设置页卡片调用（state/save-config/sync/install-skill）；
+ *  - 注册对话式工具 himarket_sync / himarket_install_skill；
+ *  - 用 McpManager 把已订阅 MCP 映射为官方 dsh-mcp-client 动态 fiber；
+ *  - 用 installSkill 把 Skill ZIP 落盘到 ~/.dsh/skills/。
+ *
+ * 归属：host 平面、不发布服务（只消费 webServer/tools/settings），行 loose、无 isolate realm。
+ *
+ * @module dsh-himarket
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "himarket";
+/** cordis.patch.yml 行 config（默认值，settings 覆盖）。 */
+export interface Config {
+    skillInstallDir: string;
+}
+export declare function apply(ctx: Context, config: Config): void;
+export { defaultSkillRoot } from './skill.js';
+export { sanitizeServerName } from './mcp.js';