dsh-plugin-capabilities 0.1.6 → 0.2.0

package/src/client/index.ts

@@ -1,10 +1,11 @@
 /** dsh-plugin-capabilities client entry: contributes the top-level
- * “技能与 MCP” section into Settings (beside 通用设置/模型, with Skills and
- * MCP as internal tabs). Calls the host routes with fetch. */
+ * “技能与 MCP” section into Settings (beside 通用设置/模型, with Skills, MCP,
+ * and 市场 as internal tabs). Calls the host routes with fetch. */
 
 import { createElement as h } from 'react'
 import { CapabilitiesSection } from './CapabilitiesSection.tsx'
 import type { McpInjected, McpRow } from './McpTab.tsx'
+import type { MarketInjected, RootRowView } from './MarketTab.tsx'
 import type { SkillsInjected, SkillRowView } from './SkillsTab.tsx'
 import { zh, en } from './locales.ts'
 
@@ -63,6 +64,12 @@ export interface ImportedServerView {
   headers?: Record<string, string>
 }
 
+/** Openable targets on the host (server resolves real paths). */
+export type OpenTarget =
+  | { target: 'user-skills' }
+  | { target: 'skill'; name: string }
+  | { target: 'root'; id: string }
+
 export function apply(ctx: CapabilitiesClientContext): void {
   ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-plugin-capabilities: dictionaries')
   const t = ctx.locale.bind(NS)
@@ -72,6 +79,13 @@ export function apply(ctx: CapabilitiesClientContext): void {
     get: (name: string) => fetchJson<SkillBody>(`/dsh-plugin-capabilities/skill?name=${encodeURIComponent(name)}`),
     save: (input: unknown) => post('/dsh-plugin-capabilities/skill/save', input) as Promise<{ ok: boolean }>,
     remove: (name: string) => post('/dsh-plugin-capabilities/skill/delete', { name }) as Promise<{ ok: boolean }>,
+    policy: (name: string, enabled: boolean) =>
+      post('/dsh-plugin-capabilities/skill/policy', { name, enabled }) as Promise<{ ok: boolean }>,
+    open: (target: OpenTarget) => post('/dsh-plugin-capabilities/open', target) as Promise<{ ok: boolean }>,
+    roots: () => fetchJson<{ roots: RootRowView[] }>('/dsh-plugin-capabilities/roots'),
+    addRoot: (input: { kind: 'local' | 'git'; path?: string; url?: string }) =>
+      post('/dsh-plugin-capabilities/roots/add', input) as Promise<{ ok: boolean; root: RootRowView }>,
+    removeRoot: (id: string) => post('/dsh-plugin-capabilities/roots/remove', { id }) as Promise<{ ok: boolean }>,
   }
 
   const mcpInjected: McpInjected = {
@@ -93,9 +107,19 @@ export function apply(ctx: CapabilitiesClientContext): void {
     desktop: window.dshDesktop !== undefined,
   }
 
+  const marketInjected: MarketInjected = {
+    skillsIndex: () => fetchJson<{ source: 'remote' | 'bundled'; repos: Array<MarketRepoView & { installedId: string | null }> }>('/dsh-plugin-capabilities/market/skills'),
+    mcpIndex: () => fetchJson<{ source: 'remote' | 'bundled'; servers: Array<MarketServerView & { installed: boolean }> }>('/dsh-plugin-capabilities/market/mcp'),
+    installSkillRepo: (url: string) =>
+      post('/dsh-plugin-capabilities/market/skills/install', { url }) as Promise<{ ok: boolean; root: RootRowView }>,
+    installMcp: (id: string) =>
+      post('/dsh-plugin-capabilities/market/mcp/install', { id }) as Promise<{ ok: boolean; id: string }>,
+    removeRoot: skillsInjected.removeRoot,
+  }
+
   // One top-level nav entry (between 模型 and 插件), not a tab under the
-  // Plugins section — the section component owns its internal Skills/MCP
-  // tabs directly, so nothing registers into settings.plugins.tab anymore.
+  // Plugins section — the section component owns its internal tabs directly,
+  // so nothing registers into settings.plugins.tab anymore.
   ctx.slots.inject('settings.section', () => {
     return ctx.slots.register({
       name: 'settings.section',
@@ -103,6 +127,35 @@ export function apply(ctx: CapabilitiesClientContext): void {
       order: 12,
       label: () => t('sectionNav'),
       locale: NS,
-    }, () => h(CapabilitiesSection, { t, skills: skillsInjected, mcp: mcpInjected }))
+    }, () => h(CapabilitiesSection, { t, skills: skillsInjected, mcp: mcpInjected, market: marketInjected }))
   })
 }
+
+/** One skills-market repository as the browser sees it. */
+export interface MarketRepoView {
+  id: string
+  name: string
+  nameZh?: string
+  description: string
+  descriptionZh?: string
+  url: string
+  homepage?: string
+  skillCount?: number
+}
+
+/** One MCP-market server as the browser sees it. */
+export interface MarketServerView {
+  id: string
+  name: string
+  nameZh?: string
+  description: string
+  descriptionZh?: string
+  transport: 'stdio' | 'streamable-http'
+  command?: string
+  args?: string[]
+  envKeys?: string[]
+  url?: string
+  homepage: string
+  category?: string
+  runtime?: string
+}

package/src/client/locales.ts

@@ -4,8 +4,9 @@ export const zh = {
   sectionNav: '技能与 MCP',
   skillsTab: '技能',
   mcpTab: 'MCP',
+  marketTab: '市场',
   skillsTitle: '技能管理',
-  skillsIntro: '查看与编辑 dsh 发现的技能；用户级技能（DSH_HOME/skills）可在此新建、修改、删除，文件被监听，保存即生效。若存在 ~/.claude/skills 或 ~/.codex/skills，会自动纳入扫描（零拷贝、实时同步）。',
+  skillsIntro: '查看与编辑 dsh 发现的技能；用户级技能（DSH_HOME/skills）可在此新建、修改、删除，文件被监听，保存即生效。若存在 ~/.claude/skills 或 ~/.codex/skills，会自动纳入扫描（零拷贝、实时同步）。卡片上的开关控制是否加载：停用即从模型与用户目录同时摘除，开启恢复默认。',
   newSkill: '新建技能',
   editSkill: '编辑技能',
   viewSkill: '查看技能',
@@ -35,6 +36,35 @@ export const zh = {
   confirmDelete: '确认删除技能？',
   deleteWarn: '将删除 DSH_HOME/skills 下的整个技能目录，此操作不可撤销。',
   saved: '已保存，技能目录被监听，稍候即可在会话中使用。',
+  searchSkills: '搜索技能名称或描述',
+  filterAll: '全部',
+  noMatch: '没有匹配的技能',
+  refresh: '刷新',
+  skillDisabled: '已停用',
+  skillUserOnly: '仅用户可用',
+  skillModelOnly: '仅模型可用',
+  skillEnabled: '已启用，稍候在列表中生效。',
+  skillDisabledMsg: '已停用：模型与 / 命令都不会再加载它。',
+  toggleSkill: '切换技能加载',
+  toggleSkillHint: '停用会在该技能的 SKILL.md 里写入 disable-model-invocation 与 user-invocable，同时从模型与用户目录摘除；开启则恢复默认策略。文件其余内容不变。',
+  openFolder: '打开目录',
+  openUserSkills: '打开技能目录',
+  rootsTitle: '技能仓库',
+  rootsIntro: '手动添加技能仓库：本地目录直接扫描（零拷贝），GitHub 仓库下载压缩包后解包到 DSH_HOME 内（无需安装 git）。也可以在「市场」页一键安装精选仓库。',
+  emptyRoots: '还没有添加自定义技能仓库',
+  addRoot: '添加仓库',
+  rootLocal: '本地',
+  rootLocalPlaceholder: 'D:\\path\\to\\skills',
+  rootKind: '仓库类型',
+  rootPlaceholder: '仓库地址',
+  add: '添加',
+  rootAdded: '仓库已添加，目录实时生效。',
+  rootRemoved: '仓库已移除。',
+  rootStale: '目录缺失',
+  rootGitHint: '支持 https://github.com/owner/repo、owner/repo，可用 #分支 或 /tree/分支 指定版本。',
+  rootLocalHint: '指向一个技能目录（内含 SKILL.md）或装着多个技能目录的文件夹。',
+  confirmRemoveRoot: '确认移除该仓库？',
+  removeRootWarn: '将取消扫描该仓库并删除下载到 DSH_HOME 的副本（本地目录本身不受影响）。',
   mcpTitle: 'MCP 服务器',
   mcpIntro: '管理 profile 中的 MCP 服务器行（@deepseek-ai/dsh-mcp-client）。新增、修改或删除后需要重启 dsh 才生效。',
   addServer: '添加服务器',
@@ -70,14 +100,40 @@ export const zh = {
   restarting: '正在重启，恢复后将自动刷新页面…',
   restartPortHint: '若重启后页面长时间未恢复，可能是端口已变化：在终端查看新地址后打开。',
   failed: '操作失败',
+  formatTitle: '完整格式与快速填充',
+  formatPaste: '粘贴 JSON 配置（mcpServers 包装或单条目均可）',
+  formatFill: '解析并填充表单',
+  formatYamlHint: '保存后将写入 profile patch 的完整行（实时预览）：',
+  formatJsonHint: '等价的 mcpServers JSON 写法（可粘贴到其他工具）：',
+  pasteTransportMismatch: '该行的传输方式已锁定，与粘贴配置的类型不一致。',
+  marketTitle: '市场',
+  marketIntro: '精选的技能仓库与 MCP 服务器，一键安装。列表来自插件仓库的在线索引，离线时回退到包内快照。',
+  marketSkills: '技能市场',
+  marketMcp: 'MCP 市场',
+  marketSkillsIntro: '安装技能仓库（GitHub 下载解包，实时进入扫描目录）；已安装的仓库可在「技能」页管理。',
+  marketMcpIntro: '添加 MCP 服务器行（与「MCP」页同一存储，添加后需重启生效）；需要密钥的服务在安装后于列表中补填环境变量。',
+  marketEmpty: '市场列表为空或不可用',
+  marketOffline: '在线索引不可达，当前展示包内快照（可能与最新列表有差异）。',
+  marketSkillCount: '{n} 个技能',
+  marketInstall: '安装',
+  marketAdd: '添加',
+  marketInstalling: '进行中…',
+  marketInstalled: '已安装',
+  marketUninstall: '移除',
+  marketHome: '主页',
+  marketNeedsEnv: '需要环境变量',
+  marketRepoInstalled: '仓库已安装，技能稍候出现在「技能」页列表。',
+  marketUninstallConfirm: '确认移除？',
+  marketUninstallRootWarn: '将取消扫描该仓库并删除下载的副本（移除后可重新安装）。',
 }
 
 export const en = {
   sectionNav: 'Skills & MCP',
   skillsTab: 'Skills',
   mcpTab: 'MCP',
+  marketTab: 'Market',
   skillsTitle: 'Skills',
-  skillsIntro: 'View and edit the skills dsh discovers; user-level skills (DSH_HOME/skills) can be created, edited, and deleted here — the directory is watched, saves apply without a restart. ~/.claude/skills and ~/.codex/skills are scanned too when present (zero-copy, live-synced).',
+  skillsIntro: 'View and edit the skills dsh discovers; user-level skills (DSH_HOME/skills) can be created, edited, and deleted here — the directory is watched, saves apply without a restart. ~/.claude/skills and ~/.codex/skills are scanned too when present (zero-copy, live-synced). The switch on each card toggles loading: disabling removes the skill from both the model and user catalogs; enabling restores the default policy.',
   newSkill: 'New skill',
   editSkill: 'Edit skill',
   viewSkill: 'View skill',
@@ -107,6 +163,35 @@ export const en = {
   confirmDelete: 'Delete this skill?',
   deleteWarn: 'Removes the whole skill directory under DSH_HOME/skills. This cannot be undone.',
   saved: 'Saved. The skills directory is watched; the skill is usable in sessions shortly.',
+  searchSkills: 'Search name or description',
+  filterAll: 'All',
+  noMatch: 'No skills match',
+  refresh: 'Refresh',
+  skillDisabled: 'disabled',
+  skillUserOnly: 'user-only',
+  skillModelOnly: 'model-only',
+  skillEnabled: 'Enabled — the list reflects it shortly.',
+  skillDisabledMsg: 'Disabled: neither the model nor / commands will load it.',
+  toggleSkill: 'Toggle skill loading',
+  toggleSkillHint: 'Disabling writes disable-model-invocation and user-invocable into the skill\u2019s SKILL.md, removing it from both catalogs; enabling restores the default policy. The rest of the file is untouched.',
+  openFolder: 'Open folder',
+  openUserSkills: 'Open skills folder',
+  rootsTitle: 'Skill repositories',
+  rootsIntro: 'Add skill repositories by hand: local folders are scanned in place (zero-copy), GitHub repos arrive as a downloaded copy inside DSH_HOME (no git needed). The Market tab offers curated repos with one click.',
+  emptyRoots: 'No custom skill repositories yet',
+  addRoot: 'Add repository',
+  rootLocal: 'Local',
+  rootLocalPlaceholder: 'D:\\path\\to\\skills',
+  rootKind: 'Repository type',
+  rootPlaceholder: 'Repository address',
+  add: 'Add',
+  rootAdded: 'Repository added — the catalog follows live.',
+  rootRemoved: 'Repository removed.',
+  rootStale: 'missing',
+  rootGitHint: 'Accepts https://github.com/owner/repo and owner/repo; pick a version with #branch or /tree/branch.',
+  rootLocalHint: 'Point at one skill folder (with SKILL.md) or a folder of skill folders.',
+  confirmRemoveRoot: 'Remove this repository?',
+  removeRootWarn: 'Stops scanning the repository and deletes the copy downloaded into DSH_HOME (a local folder itself is untouched).',
   mcpTitle: 'MCP servers',
   mcpIntro: 'Manage the MCP server rows (@deepseek-ai/dsh-mcp-client) in this profile. Additions, edits, and removals take effect after a dsh restart.',
   addServer: 'Add server',
@@ -142,4 +227,29 @@ export const en = {
   restarting: 'Restarting — the page will reload once the host is back…',
   restartPortHint: 'If the page does not recover, the port may have changed: check the terminal for the new URL.',
   failed: 'Operation failed',
+  formatTitle: 'Full format & quick fill',
+  formatPaste: 'Paste a JSON config (mcpServers wrapper or a bare entry)',
+  formatFill: 'Parse and fill the form',
+  formatYamlHint: 'The complete row as it will land in the profile patch (live preview):',
+  formatJsonHint: 'Equivalent mcpServers JSON (paste-ready for other tools):',
+  pasteTransportMismatch: 'This row\u2019s transport is locked and differs from the pasted config.',
+  marketTitle: 'Market',
+  marketIntro: 'Curated skill repositories and MCP servers, installable with one click. The list comes from the plugin repository\u2019s online index, falling back to the bundled snapshot offline.',
+  marketSkills: 'Skills market',
+  marketMcp: 'MCP market',
+  marketSkillsIntro: 'Installs skill repositories (GitHub download, live catalog); manage installed ones on the Skills tab.',
+  marketMcpIntro: 'Adds MCP server rows (same storage as the MCP tab; restart to apply). Servers needing keys get their environment filled in on the row after install.',
+  marketEmpty: 'Market list is empty or unavailable',
+  marketOffline: 'Online index unreachable — showing the bundled snapshot, which may lag behind.',
+  marketSkillCount: '{n} skills',
+  marketInstall: 'Install',
+  marketAdd: 'Add',
+  marketInstalling: 'Working…',
+  marketInstalled: 'installed',
+  marketUninstall: 'Uninstall',
+  marketHome: 'Homepage',
+  marketNeedsEnv: 'Needs environment variables',
+  marketRepoInstalled: 'Repository installed — its skills appear on the Skills tab shortly.',
+  marketUninstallConfirm: 'Uninstall?',
+  marketUninstallRootWarn: 'Stops scanning the repository and deletes the downloaded copy (you can reinstall later).',
 }

package/src/index.ts

@@ -1,7 +1,10 @@
 /** dsh-plugin-capabilities host entry: mount the manager's HTTP routes once
  * the profile composes both the web server and the skill registry, and mount
  * a host-plane filesystem skill provider so the Settings page sees a live
- * catalog (the web composition deliberately leaves the host row to presets). */
+ * catalog (the web composition deliberately leaves the host row to presets).
+ * The provider's custom roots also take the user-registered skill
+ * repositories from the plugin state file, and remount whenever those
+ * change — the catalog follows without a dsh restart. */
 
 import type { Context } from '@deepseek-ai/cordis'
 import { existsSync } from 'node:fs'
@@ -10,6 +13,7 @@ import { fileURLToPath } from 'node:url'
 import { agentSkillRoots } from './agents.ts'
 import { argvProfile, profileDir } from './profile.ts'
 import { mountCapabilitiesRoutes } from './routes.ts'
+import { loadState } from './state.ts'
 import type { CapabilitiesHost } from './types.ts'
 
 export const name = 'dsh-plugin-capabilities'
@@ -38,6 +42,11 @@ interface FilesystemSkillPlugin {
   apply(context: Context, config?: unknown): void
 }
 
+/** The disposable fiber `ctx.plugin()` returns, as far as we use it. */
+interface PluginFiber {
+  dispose(): Promise<void>
+}
+
 export function apply(ctx: Context, config?: Config): void {
   const profile = config?.profile ?? argvProfile() ?? 'web'
   ctx.inject(['webServer', 'skills'], (hostCtx: Context) => {
@@ -48,25 +57,56 @@ export function apply(ctx: Context, config?: Config): void {
     // providers are exactly what that layer is for — agents read the merged
     // catalog), and preset layers keep their semantics (nearest layer still
     // wins duplicate names). Custom roots, in scan order: the package's own
-    // vendored skills (read-only, update with the plugin), then other agents'
-    // skill roots (~/.claude/skills, ~/.codex/skills) — zero-copy, live-synced
-    // both ways. A failed load only means an empty catalog — the routes keep
-    // serving.
-    void (async () => {
-      try {
-        const mod = (await import('@deepseek-ai/dsh-skill-filesystem')) as unknown as
-          (FilesystemSkillPlugin & { default?: FilesystemSkillPlugin })
-        const plugin = mod.default ?? mod
-        const roots = [packagedSkillsDir(), ...agentSkillRoots()].filter(dir => existsSync(dir))
-        hostCtx.plugin(plugin, roots.length > 0 ? { customSkillDirs: roots } : {})
-      } catch {
-        // Unresolvable provider: skills list stays empty; MCP tab unaffected.
+    // vendored skills (read-only, update with the plugin), the user's
+    // registered repositories (local paths and GitHub checkouts, managed
+    // from the Settings page), then other agents' skill roots
+    // (~/.claude/skills, ~/.codex/skills) — zero-copy, live-synced both
+    // ways. Registering or removing a repository remounts the provider with
+    // the new root set; a failed load only means an empty catalog — the
+    // routes keep serving.
+    let providerFiber: PluginFiber | undefined
+    let disposed = false
+    ctx.effect(() => {
+      const disposer = (): void => { disposed = true }
+      let chain: Promise<void> = Promise.resolve()
+      const remountProvider = (): Promise<void> => {
+        // Serialize remounts; concurrent add/remove requests must not
+        // interleave dispose and re-plugin on the same provider.
+        chain = chain.then(async () => {
+          if (disposed) return
+          const mod = (await import('@deepseek-ai/dsh-skill-filesystem')) as unknown as
+            (FilesystemSkillPlugin & { default?: FilesystemSkillPlugin })
+          const plugin = mod.default ?? mod
+          if (providerFiber !== undefined) {
+            const old = providerFiber
+            providerFiber = undefined
+            try { await old.dispose() } catch { /* unloading raced us */ }
+          }
+          if (disposed) return
+          const roots = [
+            packagedSkillsDir(),
+            ...loadState().skillRoots.flatMap(entry => entry.roots),
+            ...agentSkillRoots(),
+          ].filter(dir => existsSync(dir))
+          try {
+            providerFiber = hostCtx.plugin(plugin, roots.length > 0 ? { customSkillDirs: roots } : {}) as PluginFiber
+          } catch {
+            // Context already disposed: nothing left to mount for.
+          }
+        })
+        chain = chain.catch(() => undefined)
+        return chain
       }
-    })()
+      void remountProvider()
 
-    ctx.effect(
-      () => mountCapabilitiesRoutes(hostCtx as unknown as CapabilitiesHost, { profileDirPath: profileDir(profile) }),
-      'dsh-plugin-capabilities: http routes',
-    )
+      ctx.effect(
+        () => mountCapabilitiesRoutes(hostCtx as unknown as CapabilitiesHost, {
+          profileDirPath: profileDir(profile),
+          remountProvider,
+        }),
+        'dsh-plugin-capabilities: http routes',
+      )
+      return disposer
+    }, 'dsh-plugin-capabilities: skill provider')
   })
 }

package/src/market.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest'
+import { bundledMarketPath, loadMarketIndex, marketIndexUrl } from './market.ts'
+import { readFileSync } from 'node:fs'
+
+const okJson = (body: unknown): typeof fetch =>
+  (async () => ({ ok: true, json: async () => body }) as unknown as Response) as unknown as typeof fetch
+
+describe('loadMarketIndex', () => {
+  it('prefers a valid remote index', async () => {
+    const index = await loadMarketIndex('skills', {
+      fetcher: okJson({ repos: [{ id: 'r1', name: 'Repo', description: 'd', url: 'https://github.com/a/b' }] }),
+    })
+    expect(index?.source).toBe('remote')
+    expect(index?.skills?.[0]?.id).toBe('r1')
+  })
+
+  it('falls back to the bundled snapshot when remote is unreachable or invalid', async () => {
+    const failing = (async () => { throw new Error('offline') }) as unknown as typeof fetch
+    const index = await loadMarketIndex('skills', { fetcher: failing })
+    expect(index?.source).toBe('bundled')
+    expect(index?.skills?.length).toBeGreaterThan(0)
+    expect(index?.skills?.every(repo => typeof repo.url === 'string')).toBe(true)
+
+    const garbage = await loadMarketIndex('skills', { fetcher: okJson({ repos: [] }) })
+    expect(garbage?.source).toBe('bundled')
+  })
+
+  it('validates entries and drops malformed ones', async () => {
+    const index = await loadMarketIndex('mcp', {
+      fetcher: okJson({
+        servers: [
+          { id: 'ok', name: 'OK', description: 'd', transport: 'stdio', command: 'npx', args: ['-y', 'x'], envKeys: ['K'], homepage: 'https://x' },
+          { id: 'no-command', name: 'Bad', description: 'd', transport: 'stdio', homepage: 'https://x' },
+          { id: 'no-home', name: 'Bad2', description: 'd', transport: 'stdio', command: 'npx' },
+          'not an object',
+        ],
+      }),
+    })
+    expect(index?.source).toBe('remote')
+    expect(index?.servers).toHaveLength(1)
+    expect(index?.servers?.[0]).toMatchObject({ id: 'ok', envKeys: ['K'] })
+  })
+
+  it('ships parseable bundled snapshots with expected top-level shape', () => {
+    for (const kind of ['skills', 'mcp'] as const) {
+      const parsed = JSON.parse(readFileSync(bundledMarketPath(kind), 'utf8')) as Record<string, unknown>
+      expect(parsed.version).toBe(1)
+      expect(Array.isArray(kind === 'skills' ? parsed.repos : parsed.servers)).toBe(true)
+      expect(marketIndexUrl(kind)).toContain(`https://raw.githubusercontent.com/qinyre/dsh-plugin-capabilities/main/market/${kind}.json`)
+    }
+  })
+
+  it('marks nothing installed and returns null entries-safe data offline for mcp too', async () => {
+    const index = await loadMarketIndex('mcp', { fetcher: okJson({ servers: [{ id: 'http1', name: 'H', description: 'd', transport: 'streamable-http', url: 'https://e/mcp', homepage: 'https://x' }] }) })
+    expect(index?.servers?.[0]).toMatchObject({ transport: 'streamable-http', url: 'https://e/mcp' })
+  })
+})

package/src/market.ts

@@ -0,0 +1,166 @@
+/**
+ * Market indexes for the Settings “市场” tab: a remote JSON list per kind
+ * (skills repositories, MCP servers) fetched from the plugin's GitHub repo,
+ * with the copy bundled inside the package as an offline fallback. Entries
+ * are validated before they reach the browser; a bad remote index degrades
+ * to the bundled one instead of erroring the page.
+ */
+
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/** Which catalog a request wants. */
+export type MarketKind = 'skills' | 'mcp'
+
+/** One installable skill repository in the skills index. */
+export interface MarketSkillRepo {
+  id: string
+  name: string
+  nameZh?: string
+  description: string
+  descriptionZh?: string
+  url: string
+  homepage?: string
+  skillCount?: number
+}
+
+/** One installable server in the MCP index. */
+export interface MarketMcpServer {
+  id: string
+  name: string
+  nameZh?: string
+  description: string
+  descriptionZh?: string
+  transport: 'stdio' | 'streamable-http'
+  command?: string
+  args?: string[]
+  envKeys?: string[]
+  url?: string
+  homepage: string
+  category?: string
+  /** Runtime hint shown next to stdio commands (npx / uvx). */
+  runtime?: string
+}
+
+export interface MarketIndex {
+  source: 'remote' | 'bundled'
+  skills?: MarketSkillRepo[]
+  servers?: MarketMcpServer[]
+}
+
+/** Remote source of truth, one file per kind under the plugin repo. */
+export function marketIndexUrl(kind: MarketKind): string {
+  return `https://raw.githubusercontent.com/qinyre/dsh-plugin-capabilities/main/market/${kind}.json`
+}
+
+/** The snapshot shipped inside the package (src/../market in tests, lib/../market installed). */
+export function bundledMarketPath(kind: MarketKind): string {
+  return join(dirname(fileURLToPath(import.meta.url)), '..', 'market', `${kind}.json`)
+}
+
+const isString = (value: unknown): value is string => typeof value === 'string' && value !== ''
+const isStringArray = (value: unknown): value is string[] => Array.isArray(value) && value.every(isString)
+
+function parseSkillsIndex(parsed: unknown): MarketSkillRepo[] | null {
+  if (typeof parsed !== 'object' || parsed === null) return null
+  const repos = (parsed as { repos?: unknown }).repos
+  if (!Array.isArray(repos)) return null
+  const out: MarketSkillRepo[] = []
+  for (const entry of repos) {
+    if (typeof entry !== 'object' || entry === null) continue
+    const record = entry as Record<string, unknown>
+    if (!isString(record.id) || !isString(record.name) || !isString(record.description) || !isString(record.url)) continue
+    out.push({
+      id: record.id,
+      name: record.name,
+      ...isString(record.nameZh) ? { nameZh: record.nameZh } : {},
+      description: record.description,
+      ...isString(record.descriptionZh) ? { descriptionZh: record.descriptionZh } : {},
+      url: record.url,
+      ...isString(record.homepage) ? { homepage: record.homepage } : {},
+      ...(typeof record.skillCount === 'number' ? { skillCount: record.skillCount } : {}),
+    })
+  }
+  return out.length > 0 ? out : null
+}
+
+function parseMcpIndex(parsed: unknown): MarketMcpServer[] | null {
+  if (typeof parsed !== 'object' || parsed === null) return null
+  const servers = (parsed as { servers?: unknown }).servers
+  if (!Array.isArray(servers)) return null
+  const out: MarketMcpServer[] = []
+  for (const entry of servers) {
+    if (typeof entry !== 'object' || entry === null) continue
+    const record = entry as Record<string, unknown>
+    if (!isString(record.id) || !isString(record.name) || !isString(record.description) || !isString(record.homepage)) continue
+    const transport = record.transport === 'streamable-http' ? 'streamable-http' : 'stdio'
+    if (transport === 'stdio' && !isString(record.command)) continue
+    if (transport === 'streamable-http' && !isString(record.url)) continue
+    out.push({
+      id: record.id,
+      name: record.name,
+      ...isString(record.nameZh) ? { nameZh: record.nameZh } : {},
+      description: record.description,
+      ...isString(record.descriptionZh) ? { descriptionZh: record.descriptionZh } : {},
+      transport,
+      ...(isString(record.command) ? { command: record.command } : {}),
+      ...(isStringArray(record.args) ? { args: record.args } : {}),
+      ...(isStringArray(record.envKeys) ? { envKeys: record.envKeys } : {}),
+      ...(isString(record.url) ? { url: record.url } : {}),
+      homepage: record.homepage,
+      ...isString(record.category) ? { category: record.category } : {},
+      ...isString(record.runtime) ? { runtime: record.runtime } : {},
+    })
+  }
+  return out.length > 0 ? out : null
+}
+
+export interface LoadMarketOptions {
+  fetcher?: typeof fetch
+  /** Remote fetch timeout; the bundled fallback has none. */
+  timeoutMs?: number
+  dshHome?: string
+}
+
+/** Load one market index: remote first, bundled snapshot as fallback. */
+export async function loadMarketIndex(kind: MarketKind, options: LoadMarketOptions = {}): Promise<MarketIndex | null> {
+  const doFetch = options.fetcher ?? fetch
+  if (kind === 'skills') {
+    const remote = await fetchIndex(doFetch, 'skills', parseSkillsIndex, options)
+    if (remote !== null) return { source: 'remote', skills: remote }
+  } else {
+    const remote = await fetchIndex(doFetch, 'mcp', parseMcpIndex, options)
+    if (remote !== null) return { source: 'remote', servers: remote }
+  }
+  const bundled = bundledMarketPath(kind)
+  if (!existsSync(bundled)) return null
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(bundled, 'utf8'))
+    if (kind === 'skills') {
+      const skills = parseSkillsIndex(parsed)
+      return skills === null ? null : { source: 'bundled', skills }
+    }
+    const servers = parseMcpIndex(parsed)
+    return servers === null ? null : { source: 'bundled', servers }
+  } catch {
+    return null
+  }
+}
+
+/** Fetch and validate one remote index; null on any failure. */
+async function fetchIndex<T>(
+  doFetch: typeof fetch,
+  kind: MarketKind,
+  parse: (parsed: unknown) => T[] | null,
+  options: LoadMarketOptions,
+): Promise<T[] | null> {
+  try {
+    const response = await doFetch(marketIndexUrl(kind), { signal: AbortSignal.timeout(options.timeoutMs ?? 8000) })
+    if (!response.ok) return null
+    return parse(await response.json())
+  } catch {
+    // Network unavailable or slow: the bundled snapshot takes over.
+    return null
+  }
+}

package/src/opener.ts

@@ -0,0 +1,26 @@
+/**
+ * Open a directory in the OS file manager, from the dsh sidecar process.
+ * Spawned detached with all stdio ignored — a GUI file manager needs no
+ * pipes, and explorer.exe reports failure through exit codes we must not
+ * await (it exits non-zero even on success in several Windows versions).
+ */
+
+import { spawn } from 'node:child_process'
+import { statSync } from 'node:fs'
+
+/** Open one directory; resolves true when a launcher was started. */
+export function openDirectory(dir: string): boolean {
+  try {
+    if (!statSync(dir).isDirectory()) return false
+  } catch {
+    return false
+  }
+  const launcher = process.platform === 'win32' ? 'explorer' : process.platform === 'darwin' ? 'open' : 'xdg-open'
+  try {
+    const child = spawn(launcher, [dir], { detached: true, stdio: 'ignore', windowsHide: true })
+    child.unref()
+    return true
+  } catch {
+    return false
+  }
+}