dsh-m 0.1.0 → 0.2.0

package/lib/core/versions.js

@@ -1,14 +1,49 @@
 /**
  * 最新版本解析（DESIGN.md §3：版本不写死，运行时实查）。
  * npm：registry /latest（pnpm 安装本身会按 lock integrity 校验 tarball）。
- * GitHub：api.github.com 解析 HEAD commit SHA（未认证限额 60 次/小时，自用足够）。
+ * GitHub：优先最新 release/tag（更新提示只跟稳定版走，不跟 main HEAD——中间提交可能不稳定）；
+ * 未认证限额 60 次/小时，自用足够。
  */
-import { fetchJsonLimited } from './httpx.js';
-export async function npmLatest(pkg, timeoutMs = 20_000) {
+import { fetchJsonLimited, HttpError } from './httpx.js';
+/** GitHub 匿名限额（60 次/小时/IP）用尽时返回可读提示（含重置等待分钟数），否则 null。 */
+function githubRateLimitMessage(err) {
+    if (err instanceof HttpError && err.status === 403 && err.headers?.get('x-ratelimit-remaining') === '0') {
+        const resetSec = Number(err.headers.get('x-ratelimit-reset'));
+        const waitMin = Number.isFinite(resetSec) && resetSec > 0
+            ? Math.max(1, Math.ceil((resetSec * 1000 - Date.now()) / 60_000))
+            : null;
+        return waitMin
+            ? `GitHub API 匿名限额已用尽（60 次/小时），约 ${waitMin} 分钟后自动重置`
+            : 'GitHub API 匿名限额已用尽（60 次/小时），请稍后重试';
+    }
+    return null;
+}
+/** 精确 semver：接受 prerelease/build metadata，拒绝 v 前缀、range、tag 与脏尾缀。 */
+const EXACT_VERSION_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+export function isExactVersion(version) {
+    return EXACT_VERSION_RE.test(version);
+}
+/** 读取该精确版本的 dist metadata（不使用 /latest endpoint）；integrity 缺失由调用方拒绝安装。 */
+export async function npmVersion(pkg, version, timeoutMs = 20_000, signal) {
+    if (!/^@?[A-Za-z0-9-._~]+(\/[A-Za-z0-9-._~]+)?$/.test(pkg))
+        throw new Error(`无效 npm 包名: ${pkg}`);
+    if (!isExactVersion(version))
+        throw new Error(`不是精确版本（拒绝 range/tag/前缀）: ${version}`);
+    const data = await fetchJsonLimited(`https://registry.npmjs.org/${encodeURIComponent(pkg)}/${version}`, { timeoutMs, signal });
+    const resolved = typeof data.version === 'string' ? data.version : '';
+    if (!resolved)
+        throw new Error(`npm 未返回版本: ${pkg}@${version}`);
+    return {
+        version: resolved,
+        integrity: typeof data.dist?.integrity === 'string' ? data.dist.integrity : undefined,
+        tarball: typeof data.dist?.tarball === 'string' ? data.dist.tarball : undefined,
+    };
+}
+export async function npmLatest(pkg, timeoutMs = 20_000, signal) {
     // 允许 scoped 包名：@scope/name（isSafePkgName 同款字符集）
     if (!/^@?[A-Za-z0-9-._~]+(\/[A-Za-z0-9-._~]+)?$/.test(pkg))
         throw new Error(`无效 npm 包名: ${pkg}`);
-    const data = await fetchJsonLimited(`https://registry.npmjs.org/${encodeURIComponent(pkg)}/latest`, { timeoutMs });
+    const data = await fetchJsonLimited(`https://registry.npmjs.org/${encodeURIComponent(pkg)}/latest`, { timeoutMs, signal });
     const version = typeof data.version === 'string' ? data.version : '';
     if (!version)
         throw new Error(`npm 未返回版本: ${pkg}`);
@@ -18,18 +53,54 @@ export async function npmLatest(pkg, timeoutMs = 20_000) {
         tarball: typeof data.dist?.tarball === 'string' ? data.dist.tarball : undefined,
     };
 }
-export async function githubHeadSha(repo, timeoutMs = 20_000) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+$/.test(repo))
-        throw new Error(`无效 GitHub 仓库: ${repo}`);
-    const data = await fetchJsonLimited(`https://api.github.com/repos/${repo}/commits/HEAD`, {
+export async function githubTagSha(repo, tag, timeoutMs = 20_000, signal) {
+    // commits/{ref} 会自动解引用 annotated tag，返回的才是可用于 #sha 锁定的 commit
+    const data = await fetchJsonLimited(`https://api.github.com/repos/${repo}/commits/${encodeURIComponent(tag)}`, {
         timeoutMs,
+        signal,
         headers: { accept: 'application/vnd.github+json' },
     });
     const sha = typeof data.sha === 'string' ? data.sha : '';
     if (!/^[0-9a-f]{40}$/.test(sha))
-        throw new Error(`GitHub 未返回有效 SHA: ${repo}`);
+        throw new Error(`GitHub 未返回有效 SHA: ${repo}@${tag}`);
     return sha;
 }
+/** GitHub 来源的“最新稳定点”：优先最新 release（排除 draft/prerelease），无则回退 tags 列表首项。 */
+export async function githubLatestTag(repo, timeoutMs = 20_000, signal) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+$/.test(repo))
+        throw new Error(`无效 GitHub 仓库: ${repo}`);
+    const headers = { accept: 'application/vnd.github+json' };
+    try {
+        // 1) 最新 release（404 = 仓库从未发过 release → 回退 tags）
+        try {
+            const rel = await fetchJsonLimited(`https://api.github.com/repos/${repo}/releases/latest`, { timeoutMs, signal, headers });
+            const tag = typeof rel.tag_name === 'string' ? rel.tag_name.trim() : '';
+            if (tag)
+                return { tag, sha: await githubTagSha(repo, tag, timeoutMs, signal) };
+        }
+        catch (err) {
+            const status = err.status;
+            if (status !== 404)
+                throw err;
+        }
+        // 2) 回退：tags 列表（GitHub 按创建时间倒序，首项即最新）
+        const tags = await fetchJsonLimited(`https://api.github.com/repos/${repo}/tags`, { timeoutMs, signal, headers });
+        if (!Array.isArray(tags) || !tags.length)
+            throw new Error(`仓库没有任何 tag: ${repo}`);
+        const first = tags[0];
+        const name = typeof first.name === 'string' ? first.name : '';
+        const sha = first.commit && typeof first.commit.sha === 'string' ? first.commit.sha : '';
+        if (!name || !/^[0-9a-f]{40}$/.test(sha))
+            throw new Error(`tag 信息无效: ${repo}`);
+        return { tag: name, sha };
+    }
+    catch (err) {
+        const rateLimit = githubRateLimitMessage(err);
+        if (rateLimit)
+            throw new Error(rateLimit);
+        throw err;
+    }
+}
 export function isNewerVersion(candidate, current) {
     const parse = (v) => String(v || '')
         .replace(/^v/i, '')

package/lib/host.js

@@ -1,8 +1,9 @@
 import { createRequire } from 'node:module';
 import Schema from '@deepseek-ai/schemastery';
-import { installFromRegistry, listInstalledWithMeta, listMarket, uninstallPlugin, upgradePlugin, withMutationLock, } from './core/market.js';
+import { withMutationLock } from './core/market.js';
+import { createApiDispatcher } from './core/host-api.js';
 import { bindLoaderHost } from './core/live-plugin.js';
-import { scheduleRestart, servingPort, trustedRestartRequest } from './core/restart.js';
+import { createRegistryController } from './core/registry-controller.js';
 import { registerTools } from './tools.js';
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
@@ -10,178 +11,38 @@ export const name = 'dshm';
 // dshm_* 七个工具（src/tools.ts）
 export const inject = ['tools'];
 export const Config = Schema.object({
-    registryUrl: Schema.string().description('registry 源覆盖（默认 jsDelivr @main）'),
+    registryUrl: Schema.string().description('registry 地址：空值使用默认官方清单；支持 HTTPS URL、loopback HTTP URL 或本机绝对路径/file://（整体覆盖默认清单，live 生效）'),
     timeoutMs: Schema.number().default(20000).description('上游请求超时（毫秒）'),
     cacheTtlMin: Schema.number().default(60).description('registry 缓存时长（分钟）'),
 });
 export function apply(ctx, config) {
-    const cfg = { ...config };
     // 卸载前的 live-disable 依赖 loader（skillhub 同款）
     bindLoaderHost(ctx);
-    // dshm_* 七个 agent 工具 + systemPrompt 注入
-    registerTools(ctx, cfg);
-    // 本地 API：单路由 + method 分发（skillhub 同款）
+    // registry controller：active config / configured / pending / rejected 分离 + generation fence；
+    // tools 与 Host API 共用同一 active config object（apply 原地更新字段，live 生效）
+    const controller = createRegistryController(config);
+    registerTools(ctx, controller.config);
+    // 设置页（GUI 设置卡片的宿主命名空间）：applies 'live'，scope 提供 get/update/watch
+    ctx.inject(['settings'], (c) => {
+        const settings = c.settings;
+        const scope = settings.register('dshm', Config, { base: config, applies: 'live' });
+        const store = {
+            get: () => scope.get(),
+            update: (patch) => scope.update(patch),
+            watch: (callback) => scope.watch(callback),
+        };
+        controller.attachStore(store);
+    });
+    // 本地 API：单路由 + method 分发（防护与状态映射在 core/host-api.ts）
     ctx.inject(['webServer'], (c) => {
         const server = c.webServer;
+        const handleApi = createApiDispatcher({ controller, pkg, onMutation: withMutationLock });
         server.register({
             kind: 'exact',
             path: '/dshm',
             handler: (req, res) => {
-                void handleApi(req, res, cfg);
+                void handleApi(req, res);
             },
         });
     });
-    // 设置页（GUI 设置卡片的宿主命名空间）
-    ctx.inject(['settings'], (c) => {
-        const settings = c.settings;
-        settings.register('dshm', Config, { base: config });
-    });
-}
-async function handleApi(req, res, cfg) {
-    try {
-        const url = new URL(req.url || '/', 'http://127.0.0.1');
-        const body = req.method === 'POST' ? await readBody(req) : {};
-        const method = String(body.method || url.searchParams.get('method') || 'ping');
-        switch (method) {
-            case 'ping':
-                return sendJson(res, 200, {
-                    ok: true,
-                    plugin: pkg.name,
-                    version: pkg.version,
-                    node: process.version,
-                    boot: `${process.pid}`,
-                });
-            case 'self-check': {
-                try {
-                    const { npmLatest } = await import('./core/versions.js');
-                    const latest = await npmLatest(pkg.name, cfg.timeoutMs ?? 20_000);
-                    const { isNewerVersion } = await import('./core/versions.js');
-                    return sendJson(res, 200, {
-                        ok: true,
-                        current: pkg.version,
-                        latest: latest.version,
-                        outdated: isNewerVersion(latest.version, pkg.version),
-                    });
-                }
-                catch (err) {
-                    return sendJson(res, 200, {
-                        ok: true,
-                        current: pkg.version,
-                        latest: null,
-                        outdated: false,
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                }
-            }
-            case 'self-upgrade': {
-                const { npmLatest } = await import('./core/versions.js');
-                const latest = await npmLatest(pkg.name, cfg.timeoutMs ?? 20_000);
-                const result = await withMutationLock(async () => {
-                    const { addDshPlugin } = await import('./core/dsh-cli.js');
-                    return addDshPlugin(`${pkg.name}@${latest.version}`);
-                });
-                return sendJson(res, 200, {
-                    ok: true,
-                    pkg: pkg.name,
-                    version: latest.version,
-                    usedAllowAllBuilds: result.usedAllowAllBuilds,
-                    needsRestart: true,
-                });
-            }
-            case 'registry': {
-                const loaded = await loadRegistrySafe(cfg, boolArg(body.force));
-                return sendJson(res, 200, {
-                    ok: true,
-                    plugins: loaded.registry.plugins,
-                    source: loaded.source,
-                    fetchedAt: loaded.fetchedAt,
-                    errors: loaded.errors,
-                });
-            }
-            case 'market': {
-                const result = await listMarket(cfg, { force: boolArg(body.force) });
-                return sendJson(res, 200, { ok: true, ...result });
-            }
-            case 'installed': {
-                const result = await listInstalledWithMeta(cfg);
-                return sendJson(res, 200, { ok: true, ...result });
-            }
-            case 'install': {
-                const id = String(body.id || '').trim();
-                if (!id)
-                    return sendJson(res, 400, { ok: false, error: '缺少 id' });
-                const version = typeof body.version === 'string' ? body.version : undefined;
-                const result = await withMutationLock(() => installFromRegistry(id, cfg, { version }));
-                return sendJson(res, 200, { ok: true, ...result });
-            }
-            case 'uninstall': {
-                const target = String(body.pkg || '').trim();
-                if (!target)
-                    return sendJson(res, 400, { ok: false, error: '缺少 pkg' });
-                const result = await withMutationLock(() => uninstallPlugin(target, cfg));
-                return sendJson(res, 200, { ok: true, ...result });
-            }
-            case 'upgrade': {
-                const target = String(body.pkg || '').trim();
-                if (!target)
-                    return sendJson(res, 400, { ok: false, error: '缺少 pkg' });
-                const result = await withMutationLock(() => upgradePlugin(target, cfg));
-                return sendJson(res, 200, { ok: true, ...result });
-            }
-            case 'restart': {
-                if (!trustedRestartRequest(req)) {
-                    return sendJson(res, 403, { ok: false, error: '拒绝跨源重启请求' });
-                }
-                const result = scheduleRestart(servingPort(req));
-                return sendJson(res, 200, { ok: true, ...result });
-            }
-            default:
-                return sendJson(res, 404, { ok: false, error: `未知 method: ${method}` });
-        }
-    }
-    catch (err) {
-        return sendJson(res, 500, { ok: false, error: err instanceof Error ? err.message : String(err) });
-    }
-}
-async function loadRegistrySafe(cfg, force) {
-    const { loadRegistry } = await import('./core/registry.js');
-    return loadRegistry(cfg, { force });
-}
-function boolArg(v) {
-    return v === true || v === 'true' || v === 1 || v === '1';
-}
-function readBody(req, maxBytes = 1 << 20) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let size = 0;
-        req.on('data', (c) => {
-            size += c.length;
-            if (size > maxBytes) {
-                reject(new Error('请求体过大'));
-                req.destroy();
-                return;
-            }
-            chunks.push(c);
-        });
-        req.on('end', () => {
-            if (!chunks.length)
-                return resolve({});
-            try {
-                resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
-            }
-            catch {
-                resolve({});
-            }
-        });
-        req.on('error', reject);
-    });
-}
-function sendJson(res, status, value) {
-    const body = JSON.stringify(value);
-    res.writeHead(status, {
-        'content-type': 'application/json; charset=utf-8',
-        'content-length': Buffer.byteLength(body),
-        'cache-control': 'no-store',
-    });
-    res.end(body);
 }

package/lib/tools.js

@@ -1,6 +1,6 @@
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { installTimeoutMs } from './core/env.js';
-import { installFromRegistry, listInstalledWithMeta, uninstallPlugin, upgradePlugin, withMutationLock } from './core/market.js';
+import { installFromRegistry, listInstalledWithMeta, listMarket, uninstallPlugin, upgradePlugin, withMutationLock, } from './core/market.js';
 import { scheduleRestart } from './core/restart.js';
 export const CATEGORY_LABELS = {
     market: '市场',
@@ -13,6 +13,9 @@ export const CATEGORY_LABELS = {
 function cloneJson(value) {
     return JSON.parse(JSON.stringify(value));
 }
+function summaryOf(state) {
+    return { isDefault: state.isDefault, status: state.status, stale: state.stale };
+}
 function matchInstalledByEntry(entry, installed) {
     return installed.find((it) => {
         if (entry.npm && (it.pkg === entry.npm || it.name === entry.npm))
@@ -25,8 +28,15 @@ function matchInstalledByEntry(entry, installed) {
         return false;
     });
 }
-export function registerTools(ctx, cfg) {
+export function registerTools(ctx, cfg, deps = {}) {
     const timeoutMs = cfg.timeoutMs ?? 20_000;
+    const m = {
+        listMarket: deps.listMarket ?? listMarket,
+        listInstalledWithMeta: deps.listInstalledWithMeta ?? listInstalledWithMeta,
+        installFromRegistry: deps.installFromRegistry ?? installFromRegistry,
+        uninstallPlugin: deps.uninstallPlugin ?? uninstallPlugin,
+        upgradePlugin: deps.upgradePlugin ?? upgradePlugin,
+    };
     ctx.tools.register(defineTool({
         name: 'dshm_search',
         description: 'Search your personal DSH plugin marketplace (dsh-m) and show clickable plugin cards. ALWAYS call this instead of web_search or bash when the user wants to find/recommend/browse their curated DSH plugins (插件). Call EXACTLY ONCE per user message; extract a real keyword (主题, 搜索) rather than pasting the whole sentence. Omit query to browse all listings. After cards appear, reply with AT MOST one short sentence. Do not print install commands.',
@@ -56,44 +66,43 @@ export function registerTools(ctx, cfg) {
         }),
         timeoutMs: timeoutMs + 5000,
         async execute(args) {
-            const registry = await import('./core/registry.js');
+            const category = typeof args.category === 'string' && args.category ? args.category : null;
+            const rawLimit = Number(args.limit);
+            const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? clamp(rawLimit, 1, 80) : undefined;
+            // metadata-only：agent 卡片不需要 latest；与 Host GUI 共用 host namespace
+            const result = await m.listMarket(cfg, {
+                query: String(args.query || ''),
+                category,
+                offset: 0,
+                limit,
+                withLatest: false,
+                namespace: 'host',
+            });
             const installed = await import('./core/installed.js');
-            const loaded = await registry.loadRegistry(cfg);
             const inst = await installed.listInstalledPlugins();
-            const query = String(args.query || '').trim().toLowerCase();
-            const category = typeof args.category === 'string' && args.category ? args.category : null;
-            let items = loaded.registry.plugins.filter((e) => {
-                if (category && e.category !== category)
-                    return false;
-                if (!query)
-                    return true;
-                const hay = `${e.id} ${e.name} ${e.description} ${e.tags.join(' ')}`.toLowerCase();
-                return hay.includes(query);
+            const merged = result.items.map((e) => {
+                const i = matchInstalledByEntry(e, inst.items);
+                return { ...e, installed: Boolean(i), installedPkg: i?.pkg, installedVersion: i?.version };
             });
-            const total = items.length;
-            const limit = Number.isFinite(Number(args.limit)) && Number(args.limit) > 0 ? clamp(Number(args.limit), 1, 80) : total;
-            items = items.slice(0, limit);
             return cloneJson({
                 query: String(args.query || ''),
                 category,
-                total,
-                items: items.map((e) => {
-                    const i = matchInstalledByEntry(e, inst.items);
-                    return {
-                        id: e.id,
-                        name: e.name,
-                        description: e.description,
-                        category: e.category,
-                        tags: e.tags,
-                        source: e.source,
-                        npm: e.npm,
-                        github: e.github,
-                        homepage: e.homepage,
-                        installed: Boolean(i),
-                        installedPkg: i?.pkg,
-                        installedVersion: i?.version,
-                    };
-                }),
+                total: result.total,
+                registry: summaryOf(result.registryState),
+                items: merged.map((e) => ({
+                    id: e.id,
+                    name: e.name,
+                    description: e.description,
+                    category: e.category,
+                    tags: e.tags,
+                    source: e.source,
+                    npm: e.npm,
+                    github: e.github,
+                    homepage: e.homepage,
+                    installed: e.installed,
+                    installedPkg: e.installedPkg,
+                    installedVersion: e.installedVersion,
+                })),
             });
         },
     }));
@@ -114,8 +123,9 @@ export function registerTools(ctx, cfg) {
         }),
         timeoutMs: timeoutMs + 5000,
         async execute() {
-            const result = await listInstalledWithMeta(cfg);
+            const result = await m.listInstalledWithMeta(cfg, { namespace: 'host' });
             return cloneJson({
+                registry: summaryOf(result.registryState),
                 profileDir: result.profileDir,
                 others: result.others,
                 items: result.items.map((it) => ({
@@ -154,7 +164,7 @@ export function registerTools(ctx, cfg) {
             if (!id)
                 throw new Error('缺少收录 id');
             const version = typeof args.version === 'string' && args.version.trim() ? args.version.trim() : undefined;
-            return cloneJson(await withMutationLock(() => installFromRegistry(id, cfg, { version })));
+            return cloneJson(await withMutationLock(() => m.installFromRegistry(id, cfg, { version, namespace: 'host' })));
         },
     }));
     ctx.tools.register(defineTool({
@@ -179,7 +189,7 @@ export function registerTools(ctx, cfg) {
             const target = String(args.pkg || '').trim();
             if (!target)
                 throw new Error('缺少 pkg');
-            return cloneJson(await withMutationLock(() => uninstallPlugin(target, cfg)));
+            return cloneJson(await withMutationLock(() => m.uninstallPlugin(target, cfg, { namespace: 'host' })));
         },
     }));
     ctx.tools.register(defineTool({
@@ -199,16 +209,21 @@ export function registerTools(ctx, cfg) {
         },
         timeoutMs: timeoutMs + 10_000,
         async execute() {
-            const result = await listInstalledWithMeta(cfg);
+            const result = await m.listInstalledWithMeta(cfg, { namespace: 'host' });
             const items = result.items.map((it) => ({
                 pkg: it.pkg,
                 name: it.name,
                 version: it.version,
                 source: it.source,
                 latestVersion: it.latestVersion ?? null,
+                latestTag: it.latestTag ?? null,
                 outdated: it.outdated,
             }));
-            return cloneJson({ items, outdatedCount: items.filter((it) => it.outdated).length });
+            return cloneJson({
+                registry: summaryOf(result.registryState),
+                items,
+                outdatedCount: items.filter((it) => it.outdated).length,
+            });
         },
     }));
     ctx.tools.register(defineTool({
@@ -233,7 +248,7 @@ export function registerTools(ctx, cfg) {
             const target = String(args.pkg || '').trim();
             if (!target)
                 throw new Error('缺少 pkg');
-            return cloneJson(await withMutationLock(() => upgradePlugin(target, cfg)));
+            return cloneJson(await withMutationLock(() => m.upgradePlugin(target, cfg, { namespace: 'host' })));
         },
     }));
     ctx.tools.register(defineTool({
@@ -322,7 +337,7 @@ function renderOutdated(out) {
         return 'web profile 没有已装插件。';
     if (!outdated.length)
         return `全部 ${out.items.length} 个插件均已是最新版本。对用户一句短话。`;
-    const lines = outdated.map((it) => `${it.name} (${it.pkg})：v${it.version} → ${it.latestVersion || '最新'}`);
+    const lines = outdated.map((it) => `${it.name} (${it.pkg})：v${it.version} → ${it.latestTag || (it.latestVersion ? `v${it.latestVersion}` : '最新')}`);
     return [
         `${outdated.length}/${out.items.length} 个插件可升级：`,
         lines.join('\n'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "DSH Marketplace — 个人自用的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件",
   "license": "MIT",
   "type": "module",
@@ -19,7 +19,8 @@
     "cordis.patch.yml",
     "registry.json",
     "README.md",
-    "DESIGN.md",
+    "README.en.md",
+    "docs/DESIGN.md",
     "LICENSE"
   ],
   "keywords": [
@@ -43,6 +44,7 @@
   "scripts": {
     "build": "node scripts/build.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "node --test tests/*.test.mjs",
     "prepare": "npm run build"
   },
   "dsh": {

package/registry.json

@@ -12,15 +12,103 @@
       "homepage": "https://github.com/iasiv5/skins"
     },
     {
-      "id": "dsh-web-search",
-      "name": "DSH Web Search",
-      "description": "多提供商网页搜索（SearXNG → Tavily → Brave → 免密 DuckDuckGo 自动回退）与 URL 内容抽取，接入 web_search 工具缝。",
+      "id": "modsearch",
+      "name": "ModSearch",
+      "description": "免费网页搜索、X 搜索与页面抓取插件，支持 Firecrawl、Tavily、Exa 等引擎自动故障切换。",
       "category": "search",
-      "tags": ["搜索", "web"],
+      "tags": ["搜索", "网页抓取", "X"],
       "source": "npm",
-      "npm": "dsh-web-search",
-      "github": "haibinwang9/dsh-web-search",
-      "homepage": "https://github.com/haibinwang9/dsh-web-search"
+      "npm": "@liustack/modsearch",
+      "github": "liustack/modsearch",
+      "homepage": "https://github.com/liustack/modsearch"
+    },
+    {
+      "id": "deepseek-harness-lark",
+      "name": "DeepSeek Harness Lark",
+      "description": "飞书 / Lark 文本与图片通道插件：把飞书消息桥接进 DeepSeek Harness 对话。",
+      "category": "other",
+      "tags": ["飞书", "Lark", "通道"],
+      "source": "npm",
+      "npm": "deepseek-harness-lark",
+      "github": "sliverp/DeepSeek-harness-lark",
+      "homepage": "https://github.com/sliverp/DeepSeek-harness-lark"
+    },
+    {
+      "id": "deepseek-harness-qqbot",
+      "name": "DeepSeek Harness QQBot",
+      "description": "QQ Bot 文本与图片通道插件：把 QQ 机器人消息桥接进 DeepSeek Harness 对话。",
+      "category": "other",
+      "tags": ["QQ", "通道"],
+      "source": "npm",
+      "npm": "deepseek-harness-qqbot",
+      "github": "sliverp/DeepSeek-harness-qqbot",
+      "homepage": "https://github.com/sliverp/DeepSeek-harness-qqbot"
+    },
+    {
+      "id": "deepseek-harness-weixin",
+      "name": "DeepSeek Harness Weixin",
+      "description": "微信通道插件：扫码登录，收发文本与图片消息，桥接进 DeepSeek Harness 对话。",
+      "category": "other",
+      "tags": ["微信", "通道"],
+      "source": "npm",
+      "npm": "deepseek-harness-weixin",
+      "github": "sliverp/DeepSeek-harness-weixin",
+      "homepage": "https://github.com/sliverp/DeepSeek-harness-weixin"
+    },
+    {
+      "id": "deepseek-harness-wecom",
+      "name": "DeepSeek Harness WeCom",
+      "description": "企业微信 AI Bot 文本与图片通道桥，桥接进 DeepSeek Harness 对话。",
+      "category": "other",
+      "tags": ["企业微信", "通道"],
+      "source": "npm",
+      "npm": "deepseek-harness-wecom",
+      "github": "sliverp/DeepSeek-harness-wecom",
+      "homepage": "https://github.com/sliverp/DeepSeek-harness-wecom"
+    },
+    {
+      "id": "deepseek-harness-dingtalk",
+      "name": "DeepSeek Harness DingTalk",
+      "description": "钉钉 Stream 文本与图片通道插件，桥接进 DeepSeek Harness 对话。",
+      "category": "other",
+      "tags": ["钉钉", "通道"],
+      "source": "npm",
+      "npm": "deepseek-harness-dingtalk",
+      "github": "sliverp/DeepSeek-harness-dingtalk",
+      "homepage": "https://github.com/sliverp/DeepSeek-harness-dingtalk"
+    },
+    {
+      "id": "dsh-auth",
+      "name": "DSH Auth",
+      "description": "DSH Web 管理员认证插件：Argon2id 口令、可撤销会话、双语界面，经 Caddy forward_auth 边缘保护页面/API/下载/SSE/WebSocket，Harness 保持仅回环监听。",
+      "category": "tools",
+      "tags": ["认证", "安全"],
+      "source": "npm",
+      "npm": "dsh-auth",
+      "github": "hxy91819/dsh-auth",
+      "homepage": "https://github.com/hxy91819/dsh-auth"
+    },
+    {
+      "id": "dsh-copilot-auth",
+      "name": "DSH Copilot Auth",
+      "description": "为 DSH 内置 GitHub Copilot 提供方补上设备码（device flow）登录/注销设置页，并预置开箱即用的 Copilot 路由；凭据托管 DSH 内置凭据库，模型目录自动同步，中英双语。",
+      "category": "tools",
+      "tags": ["Copilot", "认证", "模型接入"],
+      "source": "npm",
+      "npm": "@inventec/dsh-copilot-auth",
+      "github": "iasiv5/dsh-copilot-auth",
+      "homepage": "https://github.com/iasiv5/dsh-copilot-auth"
+    },
+    {
+      "id": "dsh-m",
+      "name": "DSH Marketplace",
+      "description": "个人自用的 DeepSeek Harness 插件市场：收录、安装、卸载、升级 DSH 插件，含 Web 界面、agent 工具与 CLI。",
+      "category": "market",
+      "tags": ["市场", "插件管理"],
+      "source": "npm",
+      "npm": "dsh-m",
+      "github": "iasiv5/dsh-m",
+      "homepage": "https://github.com/iasiv5/dsh-m"
     }
   ]
 }