dsh-plugin-shop 0.4.9 → 0.4.11

package/README.md

@@ -6,6 +6,8 @@
 dsh plugins, install one with a single confirmation, and manage what you have, from a tab inside Settings.
 
 [![npm](https://img.shields.io/npm/v/dsh-plugin-shop?logo=npm&color=cb3837)](https://www.npmjs.com/package/dsh-plugin-shop)
+[![plugins](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2FLivXue.github.io%2Fdsh-plugin-shop%2Fv1%2Findex.json&query=count&label=plugins&color=blue)](https://LivXue.github.io/dsh-plugin-shop/v1/index.json)
+[![filtered](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2FLivXue.github.io%2Fdsh-plugin-shop%2Fv1%2Findex.json&query=rejected&label=filtered&color=orange)](https://LivXue.github.io/dsh-plugin-shop/v1/index.json)
 [![license](https://img.shields.io/npm/l/dsh-plugin-shop?color=blue)](https://github.com/LivXue/dsh-plugin-shop/blob/main/LICENSE)
 [![plugin CI](https://github.com/LivXue/dsh-plugin-shop/actions/workflows/plugin.yml/badge.svg)](https://github.com/LivXue/dsh-plugin-shop/actions/workflows/plugin.yml)
 [![catalog](https://github.com/LivXue/dsh-plugin-shop/actions/workflows/daily.yml/badge.svg)](https://github.com/LivXue/dsh-plugin-shop/actions/workflows/daily.yml)
@@ -50,9 +52,9 @@ install them once with `npm install -g @deepseek-ai/dsh pnpm` and verify with
 # holds back very recent releases, so a bare `add dsh-plugin-shop` can hand
 # you an older version for a while. Pin the current release — refresh it
 # with `npm view dsh-plugin-shop version`.
-dsh plugin --profile web add dsh-plugin-shop@0.4.9
+dsh plugin --profile web add dsh-plugin-shop@0.4.11
 # or straight through npx, nothing installed:
-npx -y @deepseek-ai/dsh plugin --profile web add dsh-plugin-shop@0.4.9
+npx -y @deepseek-ai/dsh plugin --profile web add dsh-plugin-shop@0.4.11
 ```
 
 Replace `web` with your profile if you use another one. Then restart `dsh` once — a
@@ -82,7 +84,7 @@ ls -1 "${DSH_HOME:-$HOME/.dsh}/profiles" | grep -v '^node_modules$'
 cooldown, and deterministic installs are the point of the agent path.
 
 ```sh
-dsh plugin --profile <profile> add dsh-plugin-shop@0.4.9
+dsh plugin --profile <profile> add dsh-plugin-shop@0.4.11
 ```
 
 **3. Verify — do not skip this.** A zero exit from step 2 means pnpm resolved the
@@ -144,7 +146,7 @@ Compromising the browser half buys an attacker those nine calls and nothing more
 
 Built daily from the public npm registry and published as static JSON:
 
-- [`/v1/index.json`](https://LivXue.github.io/dsh-plugin-shop/v1/index.json) — the pointer, carrying `schemaVersion`, `builtAt`, and the content hash
+- [`/v1/index.json`](https://LivXue.github.io/dsh-plugin-shop/v1/index.json) — the pointer, carrying `schemaVersion`, `builtAt`, the entry `count` and `rejected` totals (the badges above read them live), and the content hash
 - `/v1/plugins.<sha256>.json` — the data, content-addressed and safe to cache indefinitely
 
 The pointer is small enough to poll. The shop verifies the data file's sha256 against
@@ -163,7 +165,9 @@ actually given — so passing review once cannot buy trust for every future rele
 ## 🏷️ For plugin authors
 
 Add a harvest keyword — `"keywords": ["dsh-plugin"]` or `"keywords": ["deepseek-harness"]` — to
-`package.json` and publish. The daily build finds you; nothing is submitted to this project. Declare a `dsh.catalog` section to control
+`package.json` and publish. Or, without npm: add the keyword as a GitHub repo *topic* and keep a
+`package.json` at the root with a `name` and `dsh.bundle` — the catalog lists the repo and pins the
+default-branch commit as its version. The daily build finds you; nothing is submitted to this project. Declare a `dsh.catalog` section to control
 your own category, summary and capabilities — or omit it, and the catalog derives a
 listing from your npm `description`.
 

package/lib/client.js

@@ -4279,7 +4279,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				]),
 				"metadata": union([literal("declared"), literal("derived")]),
 				"review": union([_undefined(), object({
-					"reviewedVersion": string(),
+					"reviewedVersion": union([_undefined(), string()]).optional(),
+					"reviewedCommit": union([_undefined(), string()]).optional(),
 					"reviewer": string(),
 					"reviewCommit": string(),
 					"notes": string()
@@ -4298,7 +4299,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						"zh": union([_undefined(), string()]).optional()
 					}),
 					"capabilities": array(string())
-				})]).optional()
+				})]).optional(),
+				"source": union([literal("npm"), literal("github")]),
+				"repo": union([_undefined(), string()]).optional()
 			})),
 			"denied": array(object({
 				"name": string(),
@@ -4330,7 +4333,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				literal("not-in-catalog"),
 				literal("denied"),
 				literal("version-mismatch"),
-				literal("needs-acknowledgement")
+				literal("needs-acknowledgement"),
+				literal("git-missing")
 			]),
 			"detail": string()
 		})]);
@@ -4410,7 +4414,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 244,
+						"line": 270,
 						"column": 9
 					}
 				},
@@ -4428,7 +4432,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 319,
+						"line": 374,
 						"column": 9
 					}
 				},
@@ -4456,7 +4460,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 270,
+						"line": 296,
 						"column": 9
 					}
 				},
@@ -4483,7 +4487,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 308,
+						"line": 363,
 						"column": 3
 					}
 				},
@@ -4501,7 +4505,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 392,
+						"line": 469,
 						"column": 9
 					}
 				},
@@ -4528,7 +4532,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 213,
+						"line": 239,
 						"column": 3
 					}
 				},
@@ -4556,7 +4560,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 359,
+						"line": 429,
 						"column": 9
 					}
 				},
@@ -4583,7 +4587,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 441,
+						"line": 518,
 						"column": 9
 					}
 				},
@@ -4601,7 +4605,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 426,
+						"line": 503,
 						"column": 9
 					}
 				}
@@ -4617,12 +4621,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				case "community": return "tierCommunity";
 			}
 		}
-		/** A derived listing has no author-declared catalog section; the shop
-		* presents it as unclaimed, which is the signal that prompts an author to add
-		* one (§6.1). Never present a derived entry as though the author wrote it. */
-		function isUnclaimed(entry) {
-			return entry.metadata === "derived";
-		}
 		/** Spec §9.3 verbatim — the community-tier acknowledgement. The zh dictionary
 		* states the same facts in its own register; never soften this wording. */
 		const ACKNOWLEDGEMENT_EN = "Once installed, this plugin holds the same privileges as a built-in one: reading and writing your files, running shell commands, and reading and modifying the requests sent to the model. It has not been reviewed.";
@@ -4636,8 +4634,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				case "not-in-catalog": return "notInCatalogCode";
 				case "version-mismatch": return "versionMismatchCode";
 				case "needs-acknowledgement": return "needsAcknowledgementCode";
+				case "git-missing": return "gitMissingCode";
 			}
 		}
+		/** The version a card displays: full for npm, the short commit for github. */
+		function displayVersion(entry) {
+			return entry.source === "github" ? entry.version.slice(0, 7) : entry.version;
+		}
 		/** §7.2 once-per-second poll cadence, as a named constant. */
 		const INSTALL_POLL_MS = 1e3;
 		/** How long the check-update button reports "up to date" after a re-check
@@ -4695,10 +4698,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"shop",
 			"marketplace"
 		];
-		/** Competing marketplaces whose names carry no store/market keyword and so
-		* escape the pattern rules below. Named explicitly rather than guessed:
-		* `dsh-plugin` is the npm package of github.com/dshplugin/dsh-plugin-hub —
-		* a community plugin marketplace for DeepSeek Harness. */
 		/**
 		* Competing plugin marketplaces whose names carry no store/market keyword
 		* and so escape the pattern rules below (spec §7.2). Each is a real npm
@@ -4804,7 +4803,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			tierVerified: "已审核",
 			tierVerifiedStale: "审核版本过期",
 			tierCommunity: "社区",
-			unclaimed: "作者未认领",
 			capabilitiesNote: "作者自述，无强制约束",
 			install: "安装",
 			confirm: "确认",
@@ -4827,6 +4825,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			notInCatalogCode: "不在目录中",
 			versionMismatchCode: "版本不匹配",
 			needsAcknowledgementCode: "需要确认",
+			gitMissingCode: "缺少 git",
+			githubSource: "来自 GitHub 仓库安装",
 			installedSection: "已安装",
 			installedVersion: "已安装 v{version}",
 			latestVersion: "最新 v{version}",
@@ -4875,7 +4875,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			tierVerified: "Verified",
 			tierVerifiedStale: "Reviewed version stale",
 			tierCommunity: "Community",
-			unclaimed: "not claimed by its author",
 			capabilitiesNote: "self-declared by the author, not enforced",
 			install: "Install",
 			confirm: "Confirm",
@@ -4898,6 +4897,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			notInCatalogCode: "Not in the catalog",
 			versionMismatchCode: "Version mismatch",
 			needsAcknowledgementCode: "Acknowledgement required",
+			gitMissingCode: "git missing",
+			githubSource: "installed from a GitHub repository",
 			installedSection: "Installed",
 			installedVersion: "installed v{version}",
 			latestVersion: "latest v{version}",
@@ -5074,7 +5075,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		}
 		//#endregion
 		//#region \0dsh-plugin-shop-css:e3675a89
-		const css = "/* Shop tab styles — a market shelf inside the settings surface. The visual\n * language is the dsh theme's alias tokens ONLY (the four tokens the previous\n * styles referenced that do not exist — bg-layer-3, interactive-bg-hover,\n * state-error, state-success — are corrected to bg-layer-2 and the\n * state-*-primary set). The signature is the category spine: one HUE per\n * category (six fixed hues, not the brand token — the brand resolves to\n * near-black in the light theme, so six brand opacities read as six shades\n * of gray), with the category name as the cover label in the same hue. Class names are mapped to content-derived names at bundle time\n * (tsdown.s8583e3_client.s942a79_config.s5f67aa_ts) and stubbed in tests; only the keys are relied\n * on.\n *\n * One token rule the theme forces: the background LAYERS do not carry\n * contrast. In the light theme bg-base, bg-layer-1, bg-layer-2 and\n * bg-layer-3 all resolve to the same white; only the dark theme spreads them\n * (950/875/850/800). So a layer-2 fill on a layer-1 ground is invisible for\n * half of all users, and anything whose fill is its ONLY affordance — the\n * loading skeleton, the borderless capability chips — derives its fill from\n * label-primary instead, which inverts with the theme by construction.\n * Elements that also carry a border or text may keep a layer fill.\n * `css-tokens.s8583e3_client.sfd9d8a_spec.s5f67aa_ts` pins this. */\n\n.s255e5a_panel {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n}\n\n.s44a3ec_stateLine {\n  margin: 0;\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n}\n\n/* Visually hidden but screen-reader readable (the loading copy while the\n * skeleton stands in visually). */\n.s3a0ece_srOnly {\n  position: absolute;\n  width: 1px;\n  height: 1px;\n  margin: -1px;\n  padding: 0;\n  border: 0;\n  clip: rect(0 0 0 0);\n  clip-path: inset(50%);\n  overflow: hidden;\n  white-space: nowrap;\n}\n\n/* The loading shelf: ghost cards with the same geometry as the real grid, so\n * the swap to content is a same-shape handoff instead of a jump. */\n.se0c3b4_skeletonGrid {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));\n  gap: 12px;\n}\n\n.s520416_skeletonCard {\n  position: relative;\n  display: flex;\n  flex-direction: column;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-1);\n  overflow: hidden;\n}\n\n/* The shimmer sweep: one gradient band travels across each ghost card while\n * the bars breathe, so the loading state reads as \"the shelf is scanning\". */\n.s520416_skeletonCard::after {\n  content: '';\n  position: absolute;\n  inset: 0;\n  background: linear-gradient(\n    100deg,\n    transparent 25%,\n    color-mix(in srgb, var(--dsw-alias-label-primary) 14%, transparent) 50%,\n    transparent 75%\n  );\n  transform: translateX(-100%);\n  animation: dshShopSkeletonSweep 1.4s ease-in-out infinite;\n  pointer-events: none;\n}\n\n@keyframes dshShopSkeletonSweep {\n  to { transform: translateX(100%); }\n}\n\n.s30e662_skeletonCover {\n  display: block;\n  height: 26px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 10%, transparent);\n}\n\n.s8c7d6f_skeletonName {\n  width: 55%;\n  height: 14px;\n  margin: 12px 12px 0;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 8%, transparent);\n}\n\n.sf5179e_skeletonSummary {\n  width: 92%;\n  height: 12px;\n  margin: 10px 12px 0;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 8%, transparent);\n}\n\n.sbb0d25_skeletonSummaryShort {\n  width: 68%;\n  height: 12px;\n  margin: 6px 12px 14px;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 8%, transparent);\n}\n\n.s520416_skeletonCard span {\n  animation: dshShopSkeletonPulse 1.6s ease-in-out infinite;\n}\n\n@keyframes dshShopSkeletonPulse {\n  0%, 100% { opacity: 0.5; }\n  50% { opacity: 1; }\n}\n\n@media (prefers-reduced-motion: reduce) {\n  .s520416_skeletonCard span { animation: none; opacity: 0.75; }\n  .s520416_skeletonCard::after { content: none; }\n}\n\n.s73242a_actionButton {\n  align-self: flex-start;\n  padding: 5px 14px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-layer-2);\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n  cursor: pointer;\n}\n\n.s73242a_actionButton:hover {\n  border-color: color-mix(in srgb, var(--dsw-alias-brand-primary) 45%, var(--dsw-alias-border-l2));\n  color: var(--dsw-alias-brand-primary);\n}\n\n.s73242a_actionButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.s646509_toolbar {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  flex-wrap: wrap;\n}\n\n.s745e3c_toolbarRight {\n  display: flex;\n  align-items: center;\n  gap: 12px;\n  flex-wrap: wrap;\n}\n\n/* The shop's own version, right of the search box: `v0.4.4`, plus the\n * update button when the version check found a newer release. */\n.s4fe61f_versionBlock {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n}\n\n.sb9b924_versionText {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 12px;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sa04455_updateSelfButton {\n  padding: 2px 10px;\n  border: 1px solid var(--dsw-alias-brand-primary);\n  border-radius: 999px;\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);\n  color: var(--dsw-alias-brand-primary);\n  font-size: 12px;\n  font-weight: 600;\n  cursor: pointer;\n}\n\n.sa04455_updateSelfButton:hover {\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 20%, transparent);\n}\n\n.sa04455_updateSelfButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* The on-demand re-check next to the version number: a quiet pill; the\n * border and text carry it in the light theme where bg layers are white. */\n.s614a38_checkUpdateButton {\n  padding: 2px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 999px;\n  background: var(--dsw-alias-bg-layer-2);\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.s614a38_checkUpdateButton:hover {\n  border-color: var(--dsw-alias-label-secondary);\n  color: var(--dsw-alias-label-primary);\n}\n\n.s614a38_checkUpdateButton:disabled {\n  opacity: 0.6;\n  cursor: default;\n}\n\n.s614a38_checkUpdateButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* The project's GitHub mark, right of the version row: a quiet icon link.\n * The octocat carries itself — color shift on hover, no text, no border. */\n.sa987f7_githubLink {\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  padding: 3px;\n  border-radius: 6px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sa987f7_githubLink:hover {\n  color: var(--dsw-alias-label-primary);\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n.sa987f7_githubLink:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* The self-update's expanded states (running log / done + restart /\n * failure detail) sit under the toolbar, above the category bar. */\n.sb81ba5_selfUpdatePanel {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin-top: 8px;\n}\n\n.s232ec4_searchInput {\n  width: min(280px, 100%);\n  padding: 6px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n}\n\n.s232ec4_searchInput:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.s1555aa_staleBlock {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n}\n\n.s3946f1_staleBadge {\n  padding: 2px 8px;\n  border-radius: 999px;\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 14%, transparent);\n  border: 1px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary) 40%, transparent);\n  color: var(--dsw-alias-state-warn-primary);\n  font-size: 12px;\n}\n\n.sb2c859_categoryBar {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n  margin-top: 6px;\n}\n\n.s26d58e_categoryButton {\n  padding: 3px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 999px;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.s26d58e_categoryButton:hover {\n  border-color: color-mix(in srgb, var(--dsw-alias-brand-primary) 45%, var(--dsw-alias-border-l2));\n  color: var(--dsw-alias-brand-primary);\n}\n\n.s5f68c4_categoryButtonOn {\n  border-color: var(--dsw-alias-brand-primary);\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);\n  color: var(--dsw-alias-brand-primary);\n  font-weight: 600;\n}\n\n.s26d58e_categoryButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.s668774_catalogHeading {\n  margin: 2px 0 0;\n  font-size: 16px;\n  font-weight: 600;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-primary);\n}\n\n.sccc4d1_catalogStats {\n  margin: 6px 0 0;\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 12px;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s6de1ab_emptyLine {\n  margin: 0;\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n}\n\n/* The shelf: a responsive grid of cards. */\n.sf657f5_cards {\n  display: grid;\n  grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));\n  gap: 12px;\n  list-style: none;\n  margin: 0;\n  padding: 0;\n  animation: dshShopCardsIn 220ms ease;\n}\n\n@keyframes dshShopCardsIn {\n  from { opacity: 0; transform: translateY(3px); }\n  to { opacity: 1; transform: none; }\n}\n\n@media (prefers-reduced-motion: reduce) {\n  .sf657f5_cards { animation: none; }\n}\n\n.s65f383_card {\n  position: relative;\n  display: flex;\n  flex-direction: column;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-1);\n  overflow: hidden;\n  transition: border-color 120ms ease, transform 120ms ease, box-shadow 120ms ease;\n  /* Off-screen cards skip layout and paint; the placeholder keeps scrollbar\n   * estimation sane before the browser has measured the real height. */\n  content-visibility: auto;\n  contain-intrinsic-size: auto 240px;\n}\n\n/* The sentinel that triggers the next shelf batch: zero visual footprint. */\n.sd7ee01_cardsSentry {\n  height: 1px;\n  margin: 0;\n  padding: 0;\n}\n\n.s705cc6_showingLine {\n  margin: 0;\n  font-size: 12px;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s65f383_card:hover {\n  border-color: color-mix(in srgb, var(--dsw-alias-brand-primary) 45%, var(--dsw-alias-border-l1));\n  transform: translateY(-1px);\n  box-shadow: 0 2px 8px color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);\n}\n\n@media (prefers-reduced-motion: reduce) {\n  .s65f383_card { transition: none; }\n  .s65f383_card:hover { transform: none; }\n}\n\n/* The signature: a spine and cover in the category's own hue. The hues are\n * fixed mid-bright colors that read on both themes; `other` deliberately\n * stays a neutral gray so the fallback category does not compete. */\n.s4ce25d_cardSpine {\n  position: absolute;\n  top: 0;\n  bottom: 0;\n  left: 0;\n  width: 3px;\n  background: var(--spine-hue, #8B8E96);\n}\n\n.s65f383_card[data-category='tool'] { --spine-hue: #4C8DFF; }\n.s65f383_card[data-category='provider'] { --spine-hue: #A78BFA; }\n.s65f383_card[data-category='ui'] { --spine-hue: #2DD4BF; }\n.s65f383_card[data-category='workflow'] { --spine-hue: #F59E0B; }\n.s65f383_card[data-category='integration'] { --spine-hue: #34D399; }\n.s65f383_card[data-category='other'] { --spine-hue: #8B8E96; }\n\n.s9e2bec_cardCover {\n  display: block;\n  padding: 5px 12px 5px 12px;\n  border-bottom: 1px solid var(--dsw-alias-border-l1);\n  background: color-mix(in srgb, var(--spine-hue, #8B8E96) 12%, transparent);\n}\n\n.s1a7c5b_coverLabel {\n  display: block;\n  font-size: 11px;\n  font-weight: 600;\n  letter-spacing: 0.08em;\n  text-transform: uppercase;\n  color: var(--spine-hue, #8B8E96);\n}\n\n.sa97234_entryHeader {\n  display: flex;\n  flex-direction: column;\n  align-items: stretch;\n  gap: 8px;\n  padding: 10px 12px 6px;\n  border: none;\n  background: transparent;\n  color: inherit;\n  font: inherit;\n  text-align: left;\n  cursor: pointer;\n}\n\n.sa97234_entryHeader:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: -2px;\n}\n\n/* The name owns the full header width; badges sit on their own line below. */\n.sc3f149_name {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 13px;\n  font-weight: 600;\n  overflow-wrap: anywhere;\n  color: var(--dsw-alias-label-primary);\n}\n\n.s513026_badges {\n  display: flex;\n  align-items: center;\n  flex-wrap: wrap;\n  gap: 6px;\n}\n\n.s5e82cb_tierBadge {\n  padding: 1px 7px;\n  border-radius: 999px;\n  font-size: 11px;\n  line-height: 1.6;\n}\n\n.s5e82cb_tierBadge[data-tier='verified'] {\n  color: var(--dsw-alias-state-success-primary);\n  background: color-mix(in srgb, var(--dsw-alias-state-success-primary) 14%, transparent);\n  border: 1px solid color-mix(in srgb, var(--dsw-alias-state-success-primary) 40%, transparent);\n}\n\n.s5e82cb_tierBadge[data-tier='verified-stale'] {\n  color: var(--dsw-alias-state-warn-primary);\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 14%, transparent);\n  border: 1px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary) 40%, transparent);\n}\n\n.s5e82cb_tierBadge[data-tier='community'] {\n  color: var(--dsw-alias-label-secondary);\n  background: var(--dsw-alias-bg-layer-2);\n  border: 1px solid var(--dsw-alias-border-l2);\n}\n\n.s23e3e1_unclaimedBadge {\n  padding: 1px 7px;\n  border-radius: 999px;\n  border: 1px dashed var(--dsw-alias-border-l2);\n  font-size: 11px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sff43b4_starsBadge {\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s73f7fb_chevron, .s61393c_chevronOpen {\n  color: var(--dsw-alias-label-secondary);\n  transition: transform 120ms ease;\n}\n\n.s61393c_chevronOpen { transform: rotate(180deg); }\n\n@media (prefers-reduced-motion: reduce) {\n  .s73f7fb_chevron, .s61393c_chevronOpen { transition: none; }\n}\n\n.s820ebf_body {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  padding: 0 12px 12px;\n}\n\n.sb8fbc8_summary {\n  margin: 0;\n  font-size: 13px;\n  line-height: 1.5;\n  color: var(--dsw-alias-label-primary);\n  display: -webkit-box;\n  -webkit-line-clamp: 2;\n  -webkit-box-orient: vertical;\n  overflow: hidden;\n}\n\n.se507db_summaryZh {\n  margin: -4px 0 0;\n  font-size: 12px;\n  line-height: 1.5;\n  color: var(--dsw-alias-label-secondary);\n  display: -webkit-box;\n  -webkit-line-clamp: 1;\n  -webkit-box-orient: vertical;\n  overflow: hidden;\n}\n\n/* Expanded cards show the full summary: the clamp is lifted, never raised —\n * a higher number would still truncate the author's text, just later. */\n.s10baf0_summaryExpanded {\n  -webkit-line-clamp: unset;\n  display: block;\n}\n\n.sb9dba9_summaryZhExpanded {\n  -webkit-line-clamp: unset;\n  display: block;\n}\n\n.s9d2029_capabilitiesBlock {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n}\n\n.s3bdbd5_capabilitiesNote {\n  margin: 0;\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s441702_capabilities {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 4px;\n  list-style: none;\n  margin: 0;\n  padding: 0;\n}\n\n.s441702_capabilities li {\n  padding: 1px 6px;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 6%, transparent);\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sde3f0c_detail {\n  border-top: 1px solid var(--dsw-alias-border-l1);\n  padding-top: 8px;\n}\n\n.se98179_detailRows {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n  margin: 0;\n}\n\n.sfb4d2f_detailRow {\n  display: flex;\n  justify-content: space-between;\n  gap: 12px;\n  font-size: 12px;\n}\n\n.sfb4d2f_detailRow dt {\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sfb4d2f_detailRow dd {\n  margin: 0;\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  overflow-wrap: anywhere;\n  text-align: right;\n  color: var(--dsw-alias-label-primary);\n}\n\n.sfb4d2f_detailRow a {\n  color: var(--dsw-alias-brand-primary);\n  text-decoration: none;\n}\n\n.sfb4d2f_detailRow a:hover {\n  text-decoration: underline;\n}\n\n.sfb4d2f_detailRow a:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.sd58c6d_reviewedLine {\n  margin: 8px 0 0;\n  padding: 6px 8px;\n  border-radius: 6px;\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 12%, transparent);\n  font-size: 12px;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n/* Install flow. */\n.s4d374c_installPanel {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin-top: 2px;\n}\n\n.se7aaed_installButton, .sb43a49_confirmButton, .s6e45d1_cancelButton {\n  align-self: flex-start;\n  padding: 5px 14px;\n  border-radius: 6px;\n  font-size: 13px;\n  cursor: pointer;\n}\n\n.se7aaed_installButton {\n  border: 1px solid var(--dsw-alias-brand-primary);\n  background: var(--dsw-alias-brand-primary);\n  color: var(--dsw-alias-bg-base);\n}\n\n.se7aaed_installButton:hover {\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 88%, var(--dsw-alias-label-primary));\n}\n\n.sb43a49_confirmButton {\n  border: 1px solid var(--dsw-alias-brand-primary);\n  background: var(--dsw-alias-brand-primary);\n  color: var(--dsw-alias-bg-base);\n}\n\n.sb43a49_confirmButton:hover {\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 88%, var(--dsw-alias-label-primary));\n}\n\n.s6e45d1_cancelButton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  background: var(--dsw-alias-bg-layer-2);\n  color: var(--dsw-alias-label-primary);\n}\n\n.s6e45d1_cancelButton:hover {\n  border-color: var(--dsw-alias-label-secondary);\n}\n\n.se7aaed_installButton:focus-visible, .sb43a49_confirmButton:focus-visible, .s6e45d1_cancelButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* The shelf card of a plugin that is installed and current carries this\n * non-interactive label instead of an install button. Border + text do the\n * work in the light theme, where every bg-layer token resolves to white. */\n.sb6fc74_installedLabel {\n  align-self: flex-start;\n  margin: 0;\n  padding: 5px 14px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  font-size: 13px;\n  color: var(--dsw-alias-label-secondary);\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n/* An installed card's controls: the installed label or the update button,\n * plus the uninstall button. The install panel's running/failed states are\n * column layouts and sit as one item of this row. */\n.sf53ca0_installedActions {\n  display: flex;\n  align-items: flex-start;\n  flex-wrap: wrap;\n  gap: 8px;\n}\n\n/* Uninstall revokes privilege; the quiet outline keeps it from competing\n * with the primary action, and the error tint says \"removes\". */\n.s96967f_uninstallButton {\n  align-self: flex-start;\n  padding: 5px 14px;\n  border: 1px solid color-mix(in srgb, var(--dsw-alias-state-error-primary) 55%, transparent);\n  border-radius: 6px;\n  background: transparent;\n  color: var(--dsw-alias-state-error-primary);\n  font-size: 13px;\n  cursor: pointer;\n}\n\n.s96967f_uninstallButton:hover {\n  background: color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);\n}\n\n.s96967f_uninstallButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-state-error-primary);\n  outline-offset: 1px;\n}\n\n/* The restart dsh button on a done install: quiet outline, same rank as\n * the other secondary actions. */\n.s6ac237_restartButton {\n  align-self: flex-start;\n  padding: 5px 14px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-layer-2);\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n  cursor: pointer;\n}\n\n.s6ac237_restartButton:hover {\n  border-color: var(--dsw-alias-label-secondary);\n}\n\n.s6ac237_restartButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.sc4f2ac_gate {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  padding: 10px;\n  border: 1px solid var(--dsw-alias-state-warn-primary);\n  border-radius: 8px;\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 8%, transparent);\n}\n\n.s559c38_gateTitle {\n  margin: 0;\n  font-size: 13px;\n  font-weight: 600;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.s3c0ace_gateBody {\n  margin: 0;\n  font-size: 12px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-primary);\n}\n\n.s4b2373_gateActions {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 8px;\n}\n\n.s52b5a5_installing {\n  margin: 0;\n  font-size: 12px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s64ab71_log {\n  max-height: 160px;\n  overflow: auto;\n  margin: 0;\n  padding: 8px;\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-base);\n  border: 1px solid var(--dsw-alias-border-l1);\n  list-style: none;\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 11px;\n  line-height: 1.5;\n}\n\n.s1531a8_logLine {\n  white-space: pre-wrap;\n  word-break: break-all;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sf20dda_notice {\n  margin: 0;\n  font-size: 12px;\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.seb9b08_failedHeading {\n  margin: 0;\n  font-size: 12px;\n  font-weight: 600;\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.sfd3021_failedDetail {\n  margin: 0;\n  font-size: 12px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-primary);\n}\n\n.s50ba35_rejectedCode {\n  margin: 0;\n  font-size: 12px;\n  font-weight: 600;\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.se75489_rejectedDetail {\n  margin: 0;\n  font-size: 12px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-primary);\n}\n\n/* Installed section. */\n.sa276cf_outdatedSection {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin-top: 6px;\n}\n\n.sceae6e_outdatedList {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  list-style: none;\n  margin: 0;\n  padding: 0;\n}\n\n.s8d2072_outdatedRow {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  flex-wrap: wrap;\n  padding: 10px 12px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-layer-1);\n}\n\n.s5c2545_outdatedInfo {\n  display: flex;\n  flex-direction: column;\n  gap: 2px;\n  min-width: 0;\n}\n\n.s5c2545_outdatedInfo strong {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 13px;\n  word-break: break-all;\n  color: var(--dsw-alias-label-primary);\n}\n\n.s877c68_outdatedVersions {\n  font-size: 12px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sa1f556_outdatedActions {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n}\n\n/* The enable/disable switch. */\n.s11c019_switch {\n  position: relative;\n  width: 32px;\n  height: 18px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 999px;\n  background: var(--dsw-alias-bg-layer-2);\n  cursor: pointer;\n  transition: background 120ms ease, border-color 120ms ease;\n}\n\n.s7580e8_switchOn {\n  border-color: var(--dsw-alias-state-success-primary);\n  background: color-mix(in srgb, var(--dsw-alias-state-success-primary) 55%, transparent);\n}\n\n.saab2b3_switchKnob {\n  position: absolute;\n  top: 2px;\n  left: 2px;\n  width: 12px;\n  height: 12px;\n  border-radius: 999px;\n  background: var(--dsw-alias-label-primary);\n  transition: transform 120ms ease, background 120ms ease;\n}\n\n.s7580e8_switchOn .saab2b3_switchKnob {\n  transform: translateX(14px);\n  background: var(--dsw-alias-bg-base);\n}\n\n.s11c019_switch:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n@media (prefers-reduced-motion: reduce) {\n  .s11c019_switch, .saab2b3_switchKnob { transition: none; }\n}\n";
+		const css = "/* Shop tab styles — a market shelf inside the settings surface. The visual\n * language is the dsh theme's alias tokens ONLY (the four tokens the previous\n * styles referenced that do not exist — bg-layer-3, interactive-bg-hover,\n * state-error, state-success — are corrected to bg-layer-2 and the\n * state-*-primary set). The signature is the category spine: one HUE per\n * category (six fixed hues, not the brand token — the brand resolves to\n * near-black in the light theme, so six brand opacities read as six shades\n * of gray), with the category name as the cover label in the same hue. Class names are mapped to content-derived names at bundle time\n * (tsdown.s8583e3_client.s942a79_config.s5f67aa_ts) and stubbed in tests; only the keys are relied\n * on.\n *\n * One token rule the theme forces: the background LAYERS do not carry\n * contrast. In the light theme bg-base, bg-layer-1, bg-layer-2 and\n * bg-layer-3 all resolve to the same white; only the dark theme spreads them\n * (950/875/850/800). So a layer-2 fill on a layer-1 ground is invisible for\n * half of all users, and anything whose fill is its ONLY affordance — the\n * loading skeleton, the borderless capability chips — derives its fill from\n * label-primary instead, which inverts with the theme by construction.\n * Elements that also carry a border or text may keep a layer fill.\n * `css-tokens.s8583e3_client.sfd9d8a_spec.s5f67aa_ts` pins this. */\n\n.s255e5a_panel {\n  display: flex;\n  flex-direction: column;\n  gap: 14px;\n  /* The shelf never scrolls sideways: a card too wide for its track wraps\n   * its badges rather than widening the panel. */\n  overflow-x: hidden;\n}\n\n.s44a3ec_stateLine {\n  margin: 0;\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n}\n\n/* Visually hidden but screen-reader readable (the loading copy while the\n * skeleton stands in visually). */\n.s3a0ece_srOnly {\n  position: absolute;\n  width: 1px;\n  height: 1px;\n  margin: -1px;\n  padding: 0;\n  border: 0;\n  clip: rect(0 0 0 0);\n  clip-path: inset(50%);\n  overflow: hidden;\n  white-space: nowrap;\n}\n\n/* The loading shelf: ghost cards with the same geometry as the real grid, so\n * the swap to content is a same-shape handoff instead of a jump. */\n.se0c3b4_skeletonGrid {\n  display: grid;\n  grid-template-columns: 1fr;\n  gap: 8px;\n}\n\n.s520416_skeletonCard {\n  position: relative;\n  display: flex;\n  flex-direction: column;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-1);\n  overflow: hidden;\n}\n\n/* The shimmer sweep: one gradient band travels across each ghost card while\n * the bars breathe, so the loading state reads as \"the shelf is scanning\". */\n.s520416_skeletonCard::after {\n  content: '';\n  position: absolute;\n  inset: 0;\n  background: linear-gradient(\n    100deg,\n    transparent 25%,\n    color-mix(in srgb, var(--dsw-alias-label-primary) 14%, transparent) 50%,\n    transparent 75%\n  );\n  transform: translateX(-100%);\n  animation: dshShopSkeletonSweep 1.4s ease-in-out infinite;\n  pointer-events: none;\n}\n\n@keyframes dshShopSkeletonSweep {\n  to { transform: translateX(100%); }\n}\n\n.s8c7d6f_skeletonName {\n  width: 55%;\n  height: 14px;\n  margin: 10px 12px 0;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 8%, transparent);\n}\n\n.sf5179e_skeletonSummary {\n  width: 92%;\n  height: 12px;\n  margin: 10px 12px 0;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 8%, transparent);\n}\n\n.sbb0d25_skeletonSummaryShort {\n  width: 68%;\n  height: 12px;\n  margin: 6px 12px 10px;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 8%, transparent);\n}\n\n/* The ghost of the action line, right where the real buttons land. */\n.s96e910_skeletonActions {\n  display: block;\n  width: 84px;\n  height: 24px;\n  margin: 0 12px 10px;\n  border-radius: 999px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 8%, transparent);\n}\n\n.s520416_skeletonCard span {\n  animation: dshShopSkeletonPulse 1.6s ease-in-out infinite;\n}\n\n@keyframes dshShopSkeletonPulse {\n  0%, 100% { opacity: 0.5; }\n  50% { opacity: 1; }\n}\n\n@media (prefers-reduced-motion: reduce) {\n  .s520416_skeletonCard span { animation: none; opacity: 0.75; }\n  .s520416_skeletonCard::after { content: none; }\n}\n\n.s73242a_actionButton {\n  align-self: flex-start;\n  padding: 5px 14px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-layer-2);\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n  cursor: pointer;\n}\n\n.s73242a_actionButton:hover {\n  border-color: color-mix(in srgb, var(--dsw-alias-brand-primary) 45%, var(--dsw-alias-border-l2));\n  color: var(--dsw-alias-brand-primary);\n}\n\n.s73242a_actionButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.s646509_toolbar {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  flex-wrap: wrap;\n}\n\n.s745e3c_toolbarRight {\n  display: flex;\n  align-items: center;\n  gap: 12px;\n  flex-wrap: wrap;\n}\n\n/* The shop's own version, right of the search box: `v0.4.4`, plus the\n * update button when the version check found a newer release. */\n.s4fe61f_versionBlock {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n}\n\n.sb9b924_versionText {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 12px;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sa04455_updateSelfButton {\n  padding: 2px 10px;\n  border: 1px solid var(--dsw-alias-brand-primary);\n  border-radius: 999px;\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);\n  color: var(--dsw-alias-brand-primary);\n  font-size: 12px;\n  font-weight: 600;\n  cursor: pointer;\n}\n\n.sa04455_updateSelfButton:hover {\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 20%, transparent);\n}\n\n.sa04455_updateSelfButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* The on-demand re-check next to the version number: a quiet pill; the\n * border and text carry it in the light theme where bg layers are white. */\n.s614a38_checkUpdateButton {\n  padding: 2px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 999px;\n  background: var(--dsw-alias-bg-layer-2);\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.s614a38_checkUpdateButton:hover {\n  border-color: var(--dsw-alias-label-secondary);\n  color: var(--dsw-alias-label-primary);\n}\n\n.s614a38_checkUpdateButton:disabled {\n  opacity: 0.6;\n  cursor: default;\n}\n\n.s614a38_checkUpdateButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* The project's GitHub mark, right of the version row: a quiet icon link.\n * The octocat carries itself — color shift on hover, no text, no border. */\n.sa987f7_githubLink {\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  padding: 3px;\n  border-radius: 6px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sa987f7_githubLink:hover {\n  color: var(--dsw-alias-label-primary);\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n.sa987f7_githubLink:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* The self-update's expanded states (running log / done + restart /\n * failure detail) sit under the toolbar, above the category bar. */\n.sb81ba5_selfUpdatePanel {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin-top: 8px;\n}\n\n.s232ec4_searchInput {\n  width: min(280px, 100%);\n  padding: 6px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n}\n\n.s232ec4_searchInput:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.s1555aa_staleBlock {\n  display: flex;\n  align-items: center;\n  gap: 8px;\n}\n\n.s3946f1_staleBadge {\n  padding: 2px 8px;\n  border-radius: 999px;\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 14%, transparent);\n  border: 1px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary) 40%, transparent);\n  color: var(--dsw-alias-state-warn-primary);\n  font-size: 12px;\n}\n\n.sb2c859_categoryBar {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 6px;\n  margin-top: 6px;\n}\n\n.s26d58e_categoryButton {\n  padding: 3px 10px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 999px;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-secondary);\n  font-size: 12px;\n  cursor: pointer;\n}\n\n.s26d58e_categoryButton:hover {\n  border-color: color-mix(in srgb, var(--dsw-alias-brand-primary) 45%, var(--dsw-alias-border-l2));\n  color: var(--dsw-alias-brand-primary);\n}\n\n.s5f68c4_categoryButtonOn {\n  border-color: var(--dsw-alias-brand-primary);\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);\n  color: var(--dsw-alias-brand-primary);\n  font-weight: 600;\n}\n\n.s26d58e_categoryButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.s668774_catalogHeading {\n  margin: 2px 0 0;\n  font-size: 16px;\n  font-weight: 600;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-primary);\n}\n\n.sccc4d1_catalogStats {\n  margin: 6px 0 0;\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 12px;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s6de1ab_emptyLine {\n  margin: 0;\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n}\n\n/* The shelf: a responsive grid of cards. */\n/* Single-line rows: one full-width column, one plugin per line. */\n.sf657f5_cards {\n  display: grid;\n  grid-template-columns: 1fr;\n  max-width: 100%;\n  gap: 8px;\n  list-style: none;\n  margin: 0;\n  padding: 0;\n  animation: dshShopCardsIn 220ms ease;\n}\n\n@keyframes dshShopCardsIn {\n  from { opacity: 0; transform: translateY(3px); }\n  to { opacity: 1; transform: none; }\n}\n\n@media (prefers-reduced-motion: reduce) {\n  .sf657f5_cards { animation: none; }\n}\n\n.s65f383_card {\n  position: relative;\n  display: flex;\n  flex-direction: column;\n  /* A grid item's min-width is auto by default: its content would widen the\n   * 1fr track past the panel and overflow horizontally. */\n  min-width: 0;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 10px;\n  background: var(--dsw-alias-bg-layer-1);\n  overflow: hidden;\n  transition: border-color 120ms ease, transform 120ms ease, box-shadow 120ms ease;\n  /* Off-screen cards skip layout and paint; the placeholder keeps scrollbar\n   * estimation sane before the browser has measured the real height. */\n  content-visibility: auto;\n  contain-intrinsic-size: auto 140px;\n}\n\n/* The sentinel that triggers the next shelf batch: zero visual footprint. */\n.sd7ee01_cardsSentry {\n  height: 1px;\n  margin: 0;\n  padding: 0;\n}\n\n.s705cc6_showingLine {\n  margin: 0;\n  font-size: 12px;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s65f383_card:hover {\n  border-color: color-mix(in srgb, var(--dsw-alias-brand-primary) 45%, var(--dsw-alias-border-l1));\n  transform: translateY(-1px);\n  box-shadow: 0 2px 8px color-mix(in srgb, var(--dsw-alias-brand-primary) 12%, transparent);\n}\n\n@media (prefers-reduced-motion: reduce) {\n  .s65f383_card { transition: none; }\n  .s65f383_card:hover { transform: none; }\n}\n\n/* The signature: a spine and cover in the category's own hue. The hues are\n * fixed mid-bright colors that read on both themes; `other` deliberately\n * stays a neutral gray so the fallback category does not compete. */\n.s4ce25d_cardSpine {\n  position: absolute;\n  top: 0;\n  bottom: 0;\n  left: 0;\n  width: 3px;\n  background: var(--spine-hue, #8B8E96);\n}\n\n.s65f383_card[data-category='tool'] { --spine-hue: #4C8DFF; }\n.s65f383_card[data-category='provider'] { --spine-hue: #A78BFA; }\n.s65f383_card[data-category='ui'] { --spine-hue: #2DD4BF; }\n.s65f383_card[data-category='workflow'] { --spine-hue: #F59E0B; }\n.s65f383_card[data-category='integration'] { --spine-hue: #34D399; }\n.s65f383_card[data-category='other'] { --spine-hue: #8B8E96; }\n\n/* The category sits in the badge row as a quiet chip in the category's own\n * hue — the border carries it where the light theme's white layers cannot\n * (the same lesson as the check button). */\n.s9c8eaa_categoryBadge {\n  padding: 1px 7px;\n  border: 1px solid color-mix(in srgb, var(--spine-hue, #8B8E96) 45%, transparent);\n  border-radius: 999px;\n  font-size: 11px;\n  font-weight: 600;\n  letter-spacing: 0.08em;\n  text-transform: uppercase;\n  color: var(--spine-hue, #8B8E96);\n  white-space: nowrap;\n}\n\n.sa97234_entryHeader {\n  display: flex;\n  flex-direction: row;\n  align-items: center;\n  gap: 12px;\n  min-width: 0;\n  padding: 8px 12px 2px;\n  border: none;\n  background: transparent;\n  color: inherit;\n  font: inherit;\n  text-align: left;\n  cursor: pointer;\n}\n\n.sa97234_entryHeader:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: -2px;\n}\n\n/* The name fills the row and truncates rather than wraps; the badges stay\n * intact beside it. */\n.sc3f149_name {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 13px;\n  font-weight: 600;\n  flex: 1 1 auto;\n  min-width: 0;\n  white-space: nowrap;\n  overflow: hidden;\n  text-overflow: ellipsis;\n  color: var(--dsw-alias-label-primary);\n}\n\n.s513026_badges {\n  display: flex;\n  align-items: center;\n  flex-wrap: wrap;\n  gap: 6px;\n}\n\n/* The action line: buttons side by side; an active install/uninstall flow\n * (gate, log, notices) takes the full width below them. */\n.s9b5048_cardActions {\n  display: flex;\n  flex-direction: row;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  padding: 8px 12px 10px;\n}\n\n.s9b5048_cardActions > .sc4f2ac_gate,\n.s9b5048_cardActions > .s4d374c_installPanel,\n.s9b5048_cardActions > .sf53ca0_installedActions {\n  flex-basis: 100%;\n}\n\n/* The entry's version, always visible on the card (the expanded detail\n * repeats it in the version row) — the same quiet mono as the toolbar. */\n.sc6ec6e_cardVersion {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 12px;\n  letter-spacing: 0.02em;\n  color: var(--dsw-alias-label-secondary);\n}\n\n/* The octocat marking a github-sourced entry, beside its short commit. */\n.s71f10f_sourceBadge {\n  display: inline-flex;\n  align-items: center;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s5e82cb_tierBadge {\n  padding: 1px 7px;\n  border-radius: 999px;\n  font-size: 11px;\n  line-height: 1.6;\n}\n\n.s5e82cb_tierBadge[data-tier='verified'] {\n  color: var(--dsw-alias-state-success-primary);\n  background: color-mix(in srgb, var(--dsw-alias-state-success-primary) 14%, transparent);\n  border: 1px solid color-mix(in srgb, var(--dsw-alias-state-success-primary) 40%, transparent);\n}\n\n.s5e82cb_tierBadge[data-tier='verified-stale'] {\n  color: var(--dsw-alias-state-warn-primary);\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 14%, transparent);\n  border: 1px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary) 40%, transparent);\n}\n\n.s5e82cb_tierBadge[data-tier='community'] {\n  color: var(--dsw-alias-label-secondary);\n  background: var(--dsw-alias-bg-layer-2);\n  border: 1px solid var(--dsw-alias-border-l2);\n}\n\n.sff43b4_starsBadge {\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s73f7fb_chevron, .s61393c_chevronOpen {\n  color: var(--dsw-alias-label-secondary);\n  transition: transform 120ms ease;\n}\n\n.s61393c_chevronOpen { transform: rotate(180deg); }\n\n@media (prefers-reduced-motion: reduce) {\n  .s73f7fb_chevron, .s61393c_chevronOpen { transition: none; }\n}\n\n.s820ebf_body {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  padding: 0 12px;\n}\n\n.sb8fbc8_summary {\n  margin: 0;\n  font-size: 13px;\n  line-height: 1.5;\n  color: var(--dsw-alias-label-primary);\n  display: -webkit-box;\n  -webkit-line-clamp: 2;\n  -webkit-box-orient: vertical;\n  overflow: hidden;\n}\n\n.se507db_summaryZh {\n  margin: -4px 0 0;\n  font-size: 12px;\n  line-height: 1.5;\n  color: var(--dsw-alias-label-secondary);\n  display: -webkit-box;\n  -webkit-line-clamp: 1;\n  -webkit-box-orient: vertical;\n  overflow: hidden;\n}\n\n/* Expanded cards show the full summary: the clamp is lifted, never raised —\n * a higher number would still truncate the author's text, just later. */\n.s10baf0_summaryExpanded {\n  -webkit-line-clamp: unset;\n  display: block;\n}\n\n.sb9dba9_summaryZhExpanded {\n  -webkit-line-clamp: unset;\n  display: block;\n}\n\n.s9d2029_capabilitiesBlock {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n}\n\n.s3bdbd5_capabilitiesNote {\n  margin: 0;\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s441702_capabilities {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 4px;\n  list-style: none;\n  margin: 0;\n  padding: 0;\n}\n\n.s441702_capabilities li {\n  padding: 1px 6px;\n  border-radius: 4px;\n  background: color-mix(in srgb, var(--dsw-alias-label-primary) 6%, transparent);\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 11px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sde3f0c_detail {\n  border-top: 1px solid var(--dsw-alias-border-l1);\n  padding-top: 8px;\n}\n\n.se98179_detailRows {\n  display: flex;\n  flex-direction: column;\n  gap: 4px;\n  margin: 0;\n}\n\n.sfb4d2f_detailRow {\n  display: flex;\n  justify-content: space-between;\n  gap: 12px;\n  font-size: 12px;\n}\n\n.sfb4d2f_detailRow dt {\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sfb4d2f_detailRow dd {\n  margin: 0;\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  overflow-wrap: anywhere;\n  text-align: right;\n  color: var(--dsw-alias-label-primary);\n}\n\n.sfb4d2f_detailRow a {\n  color: var(--dsw-alias-brand-primary);\n  text-decoration: none;\n}\n\n.sfb4d2f_detailRow a:hover {\n  text-decoration: underline;\n}\n\n.sfb4d2f_detailRow a:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.sd58c6d_reviewedLine {\n  margin: 8px 0 0;\n  padding: 6px 8px;\n  border-radius: 6px;\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 12%, transparent);\n  font-size: 12px;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n/* Install flow. */\n.s4d374c_installPanel {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin-top: 2px;\n}\n\n.se7aaed_installButton, .sb43a49_confirmButton, .s6e45d1_cancelButton {\n  align-self: flex-start;\n  padding: 5px 14px;\n  border-radius: 6px;\n  font-size: 13px;\n  cursor: pointer;\n}\n\n.se7aaed_installButton {\n  border: 1px solid var(--dsw-alias-brand-primary);\n  background: var(--dsw-alias-brand-primary);\n  color: var(--dsw-alias-bg-base);\n}\n\n.se7aaed_installButton:hover {\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 88%, var(--dsw-alias-label-primary));\n}\n\n.sb43a49_confirmButton {\n  border: 1px solid var(--dsw-alias-brand-primary);\n  background: var(--dsw-alias-brand-primary);\n  color: var(--dsw-alias-bg-base);\n}\n\n.sb43a49_confirmButton:hover {\n  background: color-mix(in srgb, var(--dsw-alias-brand-primary) 88%, var(--dsw-alias-label-primary));\n}\n\n.s6e45d1_cancelButton {\n  border: 1px solid var(--dsw-alias-border-l2);\n  background: var(--dsw-alias-bg-layer-2);\n  color: var(--dsw-alias-label-primary);\n}\n\n.s6e45d1_cancelButton:hover {\n  border-color: var(--dsw-alias-label-secondary);\n}\n\n.se7aaed_installButton:focus-visible, .sb43a49_confirmButton:focus-visible, .s6e45d1_cancelButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n/* The shelf card of a plugin that is installed and current carries this\n * non-interactive label instead of an install button. Border + text do the\n * work in the light theme, where every bg-layer token resolves to white. */\n.sb6fc74_installedLabel {\n  align-self: flex-start;\n  margin: 0;\n  padding: 5px 14px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  font-size: 13px;\n  color: var(--dsw-alias-label-secondary);\n  background: var(--dsw-alias-bg-layer-2);\n}\n\n/* An installed card's controls: the installed label or the update button,\n * plus the uninstall button. The install panel's running/failed states are\n * column layouts and sit as one item of this row. */\n.sf53ca0_installedActions {\n  display: flex;\n  align-items: flex-start;\n  flex-wrap: wrap;\n  gap: 8px;\n}\n\n/* Uninstall revokes privilege; the quiet outline keeps it from competing\n * with the primary action, and the error tint says \"removes\". */\n.s96967f_uninstallButton {\n  align-self: flex-start;\n  padding: 5px 14px;\n  border: 1px solid color-mix(in srgb, var(--dsw-alias-state-error-primary) 55%, transparent);\n  border-radius: 6px;\n  background: transparent;\n  color: var(--dsw-alias-state-error-primary);\n  font-size: 13px;\n  cursor: pointer;\n}\n\n.s96967f_uninstallButton:hover {\n  background: color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);\n}\n\n.s96967f_uninstallButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-state-error-primary);\n  outline-offset: 1px;\n}\n\n/* The restart dsh button on a done install: quiet outline, same rank as\n * the other secondary actions. */\n.s6ac237_restartButton {\n  align-self: flex-start;\n  padding: 5px 14px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-layer-2);\n  color: var(--dsw-alias-label-primary);\n  font-size: 13px;\n  cursor: pointer;\n}\n\n.s6ac237_restartButton:hover {\n  border-color: var(--dsw-alias-label-secondary);\n}\n\n.s6ac237_restartButton:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n.sc4f2ac_gate {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  padding: 10px;\n  border: 1px solid var(--dsw-alias-state-warn-primary);\n  border-radius: 8px;\n  background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 8%, transparent);\n}\n\n.s559c38_gateTitle {\n  margin: 0;\n  font-size: 13px;\n  font-weight: 600;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.s3c0ace_gateBody {\n  margin: 0;\n  font-size: 12px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-primary);\n}\n\n.s4b2373_gateActions {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 8px;\n}\n\n.s52b5a5_installing {\n  margin: 0;\n  font-size: 12px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.s64ab71_log {\n  max-height: 160px;\n  overflow: auto;\n  margin: 0;\n  padding: 8px;\n  border-radius: 6px;\n  background: var(--dsw-alias-bg-base);\n  border: 1px solid var(--dsw-alias-border-l1);\n  list-style: none;\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 11px;\n  line-height: 1.5;\n}\n\n.s1531a8_logLine {\n  white-space: pre-wrap;\n  word-break: break-all;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sf20dda_notice {\n  margin: 0;\n  font-size: 12px;\n  color: var(--dsw-alias-state-success-primary);\n}\n\n.seb9b08_failedHeading {\n  margin: 0;\n  font-size: 12px;\n  font-weight: 600;\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.sfd3021_failedDetail {\n  margin: 0;\n  font-size: 12px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-primary);\n}\n\n.s50ba35_rejectedCode {\n  margin: 0;\n  font-size: 12px;\n  font-weight: 600;\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.se75489_rejectedDetail {\n  margin: 0;\n  font-size: 12px;\n  line-height: 1.6;\n  color: var(--dsw-alias-label-primary);\n}\n\n/* Installed section. */\n.sa276cf_outdatedSection {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  margin-top: 6px;\n}\n\n.sceae6e_outdatedList {\n  display: flex;\n  flex-direction: column;\n  gap: 8px;\n  list-style: none;\n  margin: 0;\n  padding: 0;\n}\n\n.s8d2072_outdatedRow {\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 12px;\n  flex-wrap: wrap;\n  padding: 10px 12px;\n  border: 1px solid var(--dsw-alias-border-l1);\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-layer-1);\n}\n\n.s5c2545_outdatedInfo {\n  display: flex;\n  flex-direction: column;\n  gap: 2px;\n  min-width: 0;\n}\n\n.s5c2545_outdatedInfo strong {\n  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n  font-size: 13px;\n  word-break: break-all;\n  color: var(--dsw-alias-label-primary);\n}\n\n.s877c68_outdatedVersions {\n  font-size: 12px;\n  color: var(--dsw-alias-label-secondary);\n}\n\n.sa1f556_outdatedActions {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n}\n\n/* The enable/disable switch. */\n.s11c019_switch {\n  position: relative;\n  width: 32px;\n  height: 18px;\n  border: 1px solid var(--dsw-alias-border-l2);\n  border-radius: 999px;\n  background: var(--dsw-alias-bg-layer-2);\n  cursor: pointer;\n  transition: background 120ms ease, border-color 120ms ease;\n}\n\n.s7580e8_switchOn {\n  border-color: var(--dsw-alias-state-success-primary);\n  background: color-mix(in srgb, var(--dsw-alias-state-success-primary) 55%, transparent);\n}\n\n.saab2b3_switchKnob {\n  position: absolute;\n  top: 2px;\n  left: 2px;\n  width: 12px;\n  height: 12px;\n  border-radius: 999px;\n  background: var(--dsw-alias-label-primary);\n  transition: transform 120ms ease, background 120ms ease;\n}\n\n.s7580e8_switchOn .saab2b3_switchKnob {\n  transform: translateX(14px);\n  background: var(--dsw-alias-bg-base);\n}\n\n.s11c019_switch:focus-visible {\n  outline: 2px solid var(--dsw-alias-brand-primary);\n  outline-offset: 1px;\n}\n\n@media (prefers-reduced-motion: reduce) {\n  .s11c019_switch, .saab2b3_switchKnob { transition: none; }\n}\n";
 		if (typeof document !== "undefined" && !document.querySelector("style[data-plugin-css=\"e3675a89\"]")) {
 			const tag = document.createElement("style");
 			tag.dataset.pluginCss = "e3675a89";
@@ -5091,10 +5092,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"srOnly": "s3a0ece_srOnly",
 			"skeletonGrid": "se0c3b4_skeletonGrid",
 			"skeletonCard": "s520416_skeletonCard",
-			"skeletonCover": "s30e662_skeletonCover",
 			"skeletonName": "s8c7d6f_skeletonName",
 			"skeletonSummary": "sf5179e_skeletonSummary",
 			"skeletonSummaryShort": "sbb0d25_skeletonSummaryShort",
+			"skeletonActions": "s96e910_skeletonActions",
 			"actionButton": "s73242a_actionButton",
 			"toolbar": "s646509_toolbar",
 			"toolbarRight": "s745e3c_toolbarRight",
@@ -5118,13 +5119,17 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"cardsSentry": "sd7ee01_cardsSentry",
 			"showingLine": "s705cc6_showingLine",
 			"cardSpine": "s4ce25d_cardSpine",
-			"cardCover": "s9e2bec_cardCover",
-			"coverLabel": "s1a7c5b_coverLabel",
+			"categoryBadge": "s9c8eaa_categoryBadge",
 			"entryHeader": "sa97234_entryHeader",
 			"name": "sc3f149_name",
 			"badges": "s513026_badges",
+			"cardActions": "s9b5048_cardActions",
+			"gate": "sc4f2ac_gate",
+			"installPanel": "s4d374c_installPanel",
+			"installedActions": "sf53ca0_installedActions",
+			"cardVersion": "sc6ec6e_cardVersion",
+			"sourceBadge": "s71f10f_sourceBadge",
 			"tierBadge": "s5e82cb_tierBadge",
-			"unclaimedBadge": "s23e3e1_unclaimedBadge",
 			"starsBadge": "sff43b4_starsBadge",
 			"chevron": "s73f7fb_chevron",
 			"chevronOpen": "s61393c_chevronOpen",
@@ -5140,15 +5145,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"detailRows": "se98179_detailRows",
 			"detailRow": "sfb4d2f_detailRow",
 			"reviewedLine": "sd58c6d_reviewedLine",
-			"installPanel": "s4d374c_installPanel",
 			"installButton": "se7aaed_installButton",
 			"confirmButton": "sb43a49_confirmButton",
 			"cancelButton": "s6e45d1_cancelButton",
 			"installedLabel": "sb6fc74_installedLabel",
-			"installedActions": "sf53ca0_installedActions",
 			"uninstallButton": "s96967f_uninstallButton",
 			"restartButton": "s6ac237_restartButton",
-			"gate": "sc4f2ac_gate",
 			"gateTitle": "s559c38_gateTitle",
 			"gateBody": "s3c0ace_gateBody",
 			"gateActions": "s4b2373_gateActions",
@@ -5193,7 +5195,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			});
 		}
 		/** One entry card: the category spine and cover band, the expandable header
-		* (name, tier, category, unclaimed marker), the plain-text summary in both
+		* (name, tier, category), the plain-text summary in both
 		* languages, the self-declared capabilities, the detail section, and the
 		* install controls. An installed plugin's card carries its installed row:
 		* current → the non-interactive installed label, behind → the update button;
@@ -5212,14 +5214,6 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						className: _dsh_plugin_shop_css_e3675a89_default.cardSpine,
 						"aria-hidden": "true"
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: _dsh_plugin_shop_css_e3675a89_default.cardCover,
-						"aria-hidden": "true",
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: _dsh_plugin_shop_css_e3675a89_default.coverLabel,
-							children: t(categoryKey(entry))
-						})
-					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
 						type: "button",
 						className: _dsh_plugin_shop_css_e3675a89_default.entryHeader,
@@ -5232,15 +5226,33 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 							className: _dsh_plugin_shop_css_e3675a89_default.badges,
 							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: _dsh_plugin_shop_css_e3675a89_default.categoryBadge,
+									children: t(categoryKey(entry))
+								}),
+								entry.source === "github" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: _dsh_plugin_shop_css_e3675a89_default.sourceBadge,
+									role: "img",
+									"aria-label": t("githubSource"),
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("svg", {
+										viewBox: "0 0 16 16",
+										width: "12",
+										height: "12",
+										"aria-hidden": "true",
+										fill: "currentColor",
+										children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", { d: "M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8Z" })
+									})
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+									className: _dsh_plugin_shop_css_e3675a89_default.cardVersion,
+									"data-card-version": true,
+									children: ["v", displayVersion(entry)]
+								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 									className: _dsh_plugin_shop_css_e3675a89_default.tierBadge,
 									"data-tier": entry.tier,
 									children: t(tierKey(entry.tier))
 								}),
-								isUnclaimed(entry) && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-									className: _dsh_plugin_shop_css_e3675a89_default.unclaimedBadge,
-									children: t("unclaimed")
-								}),
 								stars !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 									className: _dsh_plugin_shop_css_e3675a89_default.starsBadge,
 									role: "img",
@@ -5262,7 +5274,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 								className: open ? `${_dsh_plugin_shop_css_e3675a89_default.summaryZh} ${_dsh_plugin_shop_css_e3675a89_default.summaryZhExpanded}` : _dsh_plugin_shop_css_e3675a89_default.summaryZh,
 								children: summary.zh
 							}),
-							entry.catalog !== void 0 && entry.catalog.capabilities.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							open && entry.catalog !== void 0 && entry.catalog.capabilities.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: _dsh_plugin_shop_css_e3675a89_default.capabilitiesBlock,
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									className: _dsh_plugin_shop_css_e3675a89_default.capabilitiesNote,
@@ -5303,39 +5315,39 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 										current: entry.version
 									})
 								})]
-							}),
-							installed === void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(InstallPanel, {
-								name: entry.name,
-								version: entry.version,
-								tier: entry.tier,
-								t,
-								install,
-								installStatus,
-								restart
-							}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: _dsh_plugin_shop_css_e3675a89_default.installedActions,
-								children: [installed.outdated ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(InstallPanel, {
-									name: entry.name,
-									version: entry.version,
-									tier: entry.tier,
-									variant: "update",
-									t,
-									install,
-									installStatus,
-									restart
-								}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-									className: _dsh_plugin_shop_css_e3675a89_default.installedLabel,
-									"data-shop-installed": true,
-									children: t("installed")
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(UninstallPanel, {
-									name: entry.name,
-									t,
-									uninstall,
-									installStatus,
-									restart
-								})]
 							})
 						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: _dsh_plugin_shop_css_e3675a89_default.cardActions,
+						children: installed === void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(InstallPanel, {
+							name: entry.name,
+							version: entry.version,
+							tier: entry.tier,
+							t,
+							install,
+							installStatus,
+							restart
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [installed.outdated ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(InstallPanel, {
+							name: entry.name,
+							version: entry.version,
+							tier: entry.tier,
+							variant: "update",
+							t,
+							install,
+							installStatus,
+							restart
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: _dsh_plugin_shop_css_e3675a89_default.installedLabel,
+							"data-shop-installed": true,
+							children: t("installed")
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(UninstallPanel, {
+							name: entry.name,
+							t,
+							uninstall,
+							installStatus,
+							restart
+						})] })
 					})
 				]
 			});
@@ -5616,7 +5628,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		* installed-state RPC behind it — the tab assumes an installed plugin is on,
 		* so the first toggle sends the inverted value. After a successful `setEnabled`
 		* the §8 hot note renders. */
-		function OutdatedRow({ row, tier, t, setEnabled, install, installStatus, restart }) {
+		function OutdatedRow({ row, tier, source, t, setEnabled, install, installStatus, restart }) {
 			const [enabled, setEnabledState] = (0, react.useState)(true);
 			const [toggle, setToggle] = (0, react.useState)({ kind: "idle" });
 			const onToggle = async () => {
@@ -5655,7 +5667,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 							className: _dsh_plugin_shop_css_e3675a89_default.outdatedVersions,
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 								className: _dsh_plugin_shop_css_e3675a89_default.outdatedVersion,
-								children: t("installedVersion", { version: row.installed })
+								children: t("installedVersion", { version: source === "github" ? row.installed.slice(0, 7) : row.installed })
 							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 								className: _dsh_plugin_shop_css_e3675a89_default.outdatedVersion,
 								children: t("latestVersion", { version: row.latest })
@@ -5705,7 +5717,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		* tier for the update gate is looked up from the catalog by name (community →
 		* acknowledgement); an entry absent from the catalog defaults to the
 		* community gate (the safer read). */
-		function OutdatedSection({ state, tiers, t, setEnabled, install, installStatus, restart }) {
+		function OutdatedSection({ state, tiers, sources, t, setEnabled, install, installStatus, restart }) {
 			if (state.kind === "loading") return null;
 			if (state.kind === "error") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 				className: _dsh_plugin_shop_css_e3675a89_default.stateLine,
@@ -5725,6 +5737,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					children: outdated.map((row) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(OutdatedRow, {
 						row,
 						tier: tiers.get(row.name) ?? "community",
+						source: sources.get(row.name) ?? "npm",
 						t,
 						setEnabled,
 						install,
@@ -5827,7 +5840,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				if (catalogState.kind !== "ready") return [];
 				const q = query.trim().toLowerCase();
 				return catalogState.result.plugins.filter((entry) => {
-					if (isShopLike(entry.name)) return false;
+					if (isShopLike(entry.name) || entry.repo !== void 0 && isShopLike(entry.repo)) return false;
 					if (category === "installed") {
 						if (!installedByName.has(entry.name)) return false;
 					} else if (category !== null && categoryKey(entry) !== categoryLocaleKey(category)) return false;
@@ -5863,7 +5876,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			const categoryCounts = (0, react.useMemo)(() => {
 				const counts = /* @__PURE__ */ new Map();
 				if (catalogState.kind === "ready") for (const entry of catalogState.result.plugins) {
-					if (isShopLike(entry.name)) continue;
+					if (isShopLike(entry.name) || entry.repo !== void 0 && isShopLike(entry.repo)) continue;
 					const key = categoryKey(entry);
 					const bare = CATEGORY_ORDER.find((c) => categoryLocaleKey(c) === key);
 					if (bare !== void 0) counts.set(bare, (counts.get(bare) ?? 0) + 1);
@@ -5879,6 +5892,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				if (catalogState.kind === "ready") for (const entry of catalogState.result.plugins) map.set(entry.name, entry.tier);
 				return map;
 			}, [catalogState]);
+			const sources = (0, react.useMemo)(() => {
+				const map = /* @__PURE__ */ new Map();
+				if (catalogState.kind === "ready") for (const entry of catalogState.result.plugins) map.set(entry.name, entry.source);
+				return map;
+			}, [catalogState]);
 			if (catalogState.kind === "loading") return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: _dsh_plugin_shop_css_e3675a89_default.panel,
 				"data-shop-tab": true,
@@ -5893,10 +5911,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					children: Array.from({ length: 8 }, (_, i) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: _dsh_plugin_shop_css_e3675a89_default.skeletonCard,
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: _dsh_plugin_shop_css_e3675a89_default.skeletonCover }),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: _dsh_plugin_shop_css_e3675a89_default.skeletonName }),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: _dsh_plugin_shop_css_e3675a89_default.skeletonSummary }),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: _dsh_plugin_shop_css_e3675a89_default.skeletonSummaryShort })
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: _dsh_plugin_shop_css_e3675a89_default.skeletonSummaryShort }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: _dsh_plugin_shop_css_e3675a89_default.skeletonActions })
 						]
 					}, i))
 				})]
@@ -6107,7 +6125,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						className: _dsh_plugin_shop_css_e3675a89_default.cards,
 						children: [visible.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(EntryCard, {
 							entry,
-							stars: stars[entry.name],
+							stars: stars[entry.repo ?? entry.name],
 							installed: installedByName.get(entry.name),
 							t,
 							install,
@@ -6131,6 +6149,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(OutdatedSection, {
 						state: installedState,
 						tiers,
+						sources,
 						t,
 						setEnabled,
 						install,

package/lib/index.js

@@ -1,12 +1,12 @@
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { loadOptionalPatches, readProfileManifest, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { lt, minVersion, valid } from "semver";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { basename, dirname, join } from "node:path";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
-import { spawn } from "node:child_process";
 import { dump } from "js-yaml";
 //#region src/own-version.ts
 /** The shop's own published version, read from the package.json that ships
@@ -37,7 +37,8 @@ const entrySchema = z.object({
 	]),
 	metadata: z.enum(["declared", "derived"]),
 	review: z.object({
-		reviewedVersion: z.string(),
+		reviewedVersion: z.string().optional(),
+		reviewedCommit: z.string().optional(),
 		reviewer: z.string(),
 		reviewCommit: z.string(),
 		notes: z.string()
@@ -56,7 +57,9 @@ const entrySchema = z.object({
 			zh: z.string().optional()
 		}),
 		capabilities: z.array(z.string())
-	}).optional()
+	}).optional(),
+	source: z.enum(["npm", "github"]).default("npm"),
+	repo: z.string().optional()
 });
 const dataSchema = z.object({
 	schemaVersion: z.number(),
@@ -140,13 +143,13 @@ async function loadCatalog(options) {
 	const readCached = () => {
 		try {
 			const pointer = pointerSchema.parse(JSON.parse(fsImpl.read(indexPath)));
-			if (pointer.schemaVersion > 2) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (2)`);
+			if (pointer.schemaVersion > 3) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (3)`);
 			const dataPath = join(cacheDir, basename(pointer.plugins.url));
 			const dataText = fsImpl.read(dataPath);
 			const actual = createHash("sha256").update(dataText).digest("hex");
 			if (actual !== pointer.plugins.sha256) throw new Error(`cached catalog data failed integrity check: expected ${pointer.plugins.sha256}, got ${actual}`);
 			const data = dataSchema.parse(JSON.parse(dataText));
-			if (data.schemaVersion > 2) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (2)`);
+			if (data.schemaVersion > 3) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (3)`);
 			let stars = {};
 			if (pointer.stars !== void 0) try {
 				const starsText = fsImpl.read(join(cacheDir, basename(pointer.stars.url)));
@@ -187,7 +190,7 @@ async function loadCatalog(options) {
 		throw error;
 	}
 	const pointer = pointerSchema.parse(JSON.parse(pointerText));
-	if (pointer.schemaVersion > 2) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (2)`);
+	if (pointer.schemaVersion > 3) throw new Error(`catalog schemaVersion ${pointer.schemaVersion} is newer than this build supports (3)`);
 	const dataUrl = resolveDataUrl(baseUrl, pointer.plugins.url);
 	let dataText;
 	try {
@@ -205,7 +208,7 @@ async function loadCatalog(options) {
 	const actual = createHash("sha256").update(dataText).digest("hex");
 	if (actual !== pointer.plugins.sha256) throw new Error(`catalog data failed integrity check: expected ${pointer.plugins.sha256}, got ${actual}`);
 	const data = dataSchema.parse(JSON.parse(dataText));
-	if (data.schemaVersion > 2) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (2)`);
+	if (data.schemaVersion > 3) throw new Error(`catalog schemaVersion ${data.schemaVersion} is newer than this build supports (3)`);
 	let stars = {};
 	if (pointer.stars !== void 0) try {
 		const starsResponse = await fetchImpl(resolveDataUrl(baseUrl, pointer.stars.url));
@@ -497,6 +500,25 @@ async function fetchLatestVersion(fetchFn = fetch) {
 	}
 }
 //#endregion
+//#region src/host/repo-pins.ts
+/** Read the pins file; any irregularity degrades to an empty record. */
+function readRepoPins(fs, path) {
+	if (!fs.exists(path)) return {};
+	try {
+		const parsed = JSON.parse(fs.read(path));
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
+		const out = {};
+		for (const [name, commit] of Object.entries(parsed)) if (typeof commit === "string" && /^[0-9a-f]{40}$/.test(commit)) out[name] = commit;
+		return out;
+	} catch {
+		return {};
+	}
+}
+/** Write the pins file atomically enough for its purpose (a cache). */
+function writeRepoPins(fs, path, pins) {
+	fs.write(path, `${JSON.stringify(pins, null, 2)}\n`);
+}
+//#endregion
 //#region src/host/profile.ts
 /** Profile directory discovery and user-layer writes (§8: hot enable/disable). */
 /**
@@ -759,6 +781,8 @@ let ShopGateway = (() => {
 		restartExitDelayMs;
 		restartParentPid;
 		latestVersion;
+		hasGit;
+		pinFs;
 		/** The install gate runs against the last loaded snapshot, never a fresh
 		* fetch per request (§7.2: the Host's cached snapshot is the truth). */
 		/** Finished install records retained, so a poll sees the true terminal
@@ -786,6 +810,19 @@ let ShopGateway = (() => {
 			this.restartExitDelayMs = options.restartExitDelayMs ?? ShopGateway.RESTART_EXIT_DELAY_MS;
 			this.restartParentPid = options.restartParentPid ?? process.pid;
 			this.latestVersion = options.fetchLatestVersion ?? (() => fetchLatestVersion());
+			this.hasGit = options.hasGit ?? (() => spawnSync("git", ["--version"], { stdio: "ignore" }).status === 0);
+			this.pinFs = options.pinFs ?? {
+				exists: (path) => existsSync(path),
+				read: (path) => readFileSync(path, "utf8"),
+				write: (path, data) => {
+					mkdirSync(dirname(path), { recursive: true });
+					writeFileSync(path, data);
+				}
+			};
+		}
+		/** The pins file lives in the shop's own cache, next to the catalog cache. */
+		pinsPath() {
+			return join(this.rowConfig().cacheDir, "github-pins.json");
 		}
 		/** The boot's Loader root directory (the active profile's `cordis.yml`
 		* directory, carried on `ctx.baseUrl`), when present. A `link:` install
@@ -882,12 +919,39 @@ let ShopGateway = (() => {
 				code: verdict.code,
 				detail: verdict.detail
 			};
+			const entry = this.lastSnapshot.entries.find((e) => e.name === args.name);
+			if (entry === void 0) return {
+				ok: false,
+				code: "not-in-catalog",
+				detail: `dsh-plugin-shop: ${args.name} is not in the catalog`
+			};
+			let spec;
+			if (entry.source === "github") {
+				if (entry.repo === void 0 || !/^[0-9a-f]{40}$/.test(args.version)) return {
+					ok: false,
+					code: "version-mismatch",
+					detail: `dsh-plugin-shop: ${args.name} has no installable commit`
+				};
+				if (!this.hasGit()) return {
+					ok: false,
+					code: "git-missing",
+					detail: "dsh-plugin-shop: git is not on PATH, which github installs require; install git and retry"
+				};
+				spec = `github:${entry.repo}#${args.version}`;
+			} else spec = `${args.name}@${args.version}`;
 			const running = startInstall({
 				profile: this.profile,
-				spec: `${args.name}@${args.version}`,
+				spec,
 				dshBin: this.dshBin,
 				expectedName: args.name
 			});
+			if (entry.source === "github") {
+				const pins = readRepoPins(this.pinFs, this.pinsPath());
+				writeRepoPins(this.pinFs, this.pinsPath(), {
+					...pins,
+					[args.name]: args.version
+				});
+			}
 			this.installs.set(running.installId, running);
 			this.installOrder.push(running.installId);
 			this.evictFinishedInstalls();
@@ -936,11 +1000,20 @@ let ShopGateway = (() => {
 				this.lastSnapshot = snapshot;
 			}
 			const dependencies = readProfileManifest("dsh-plugin-shop", this.profileDirResolved()).dependencies ?? {};
+			const pins = readRepoPins(this.pinFs, this.pinsPath());
 			const installed = [];
 			for (const entry of this.lastSnapshot.entries) {
 				const spec = dependencies[entry.name];
 				if (spec === void 0) continue;
-				installed.push({
+				if (entry.source === "github") {
+					const pin = pins[entry.name];
+					installed.push({
+						name: entry.name,
+						installed: pin ?? spec,
+						latest: entry.version,
+						outdated: pin !== void 0 && pin !== entry.version
+					});
+				} else installed.push({
 					name: entry.name,
 					installed: spec,
 					latest: entry.version,
@@ -992,6 +1065,11 @@ let ShopGateway = (() => {
 				dshBin: this.dshBin,
 				expectedName: args.name
 			});
+			const pins = readRepoPins(this.pinFs, this.pinsPath());
+			if (pins[args.name] !== void 0) {
+				delete pins[args.name];
+				writeRepoPins(this.pinFs, this.pinsPath(), pins);
+			}
 			this.installs.set(running.installId, running);
 			this.installOrder.push(running.installId);
 			this.evictFinishedInstalls();

package/lib/typert.host.js

@@ -18,7 +18,8 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
   'tier': z.union([z.literal("verified"), z.literal("verified-stale"), z.literal("community")]),
   'metadata': z.union([z.literal("declared"), z.literal("derived")]),
   'review': z.union([z.undefined(), z.object({
-  'reviewedVersion': z.string(),
+  'reviewedVersion': z.union([z.undefined(), z.string()]).optional(),
+  'reviewedCommit': z.union([z.undefined(), z.string()]).optional(),
   'reviewer': z.string(),
   'reviewCommit': z.string(),
   'notes': z.string(),
@@ -31,6 +32,8 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
 }),
   'capabilities': z.array(z.string()),
 })]).optional(),
+  'source': z.union([z.literal("npm"), z.literal("github")]),
+  'repo': z.union([z.undefined(), z.string()]).optional(),
 })),
   'denied': z.array(z.object({
   'name': z.string(),
@@ -54,7 +57,7 @@ const dsh_plugin_shop_shop_installStart_result$schema = z.union([z.object({
   'installId': z.string(),
 }), z.object({
   'ok': z.literal(false),
-  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement")]),
+  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement"), z.literal("git-missing")]),
   'detail': z.string(),
 })])
 const dsh_plugin_shop_shop_installStatus_parameter_0$schema = z.object({
@@ -137,7 +140,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":244,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":270,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -152,7 +155,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":319,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":374,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -178,7 +181,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":270,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":296,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -203,7 +206,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":308,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":363,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -218,7 +221,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":392,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":469,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -243,7 +246,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":213,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":239,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -269,7 +272,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":359,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":429,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/updateStart',
@@ -294,7 +297,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUpdateResult',
         schema: dsh_plugin_shop_shop_updateStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":441,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":518,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/version',
@@ -309,7 +312,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopVersionResult',
         schema: dsh_plugin_shop_shop_version_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":426,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":503,"column":9},
     },
   ],
   model: {
@@ -395,7 +398,7 @@ export const TYPERT = {
         "types": [
           {
             "name": "CatalogEntry",
-            "declaration": "export interface CatalogEntry {\n    name: string;\n    version: string;\n    integrity: string | null;\n    publishedAt: string | null;\n    repository: string | null;\n    license: string | null;\n    tier: 'verified' | 'verified-stale' | 'community';\n    metadata: 'declared' | 'derived';\n    review?: { reviewedVersion: string; reviewer: string; reviewCommit: string; notes: string; };\n    catalog?: CatalogSection;\n}"
+            "declaration": "export interface CatalogEntry {\n    name: string;\n    version: string;\n    integrity: string | null;\n    publishedAt: string | null;\n    repository: string | null;\n    license: string | null;\n    tier: 'verified' | 'verified-stale' | 'community';\n    metadata: 'declared' | 'derived';\n    review?: { reviewedVersion?: string; reviewedCommit?: string; reviewer: string; reviewCommit: string; notes: string; };\n    catalog?: CatalogSection;\n    source: 'npm' | 'github';\n    repo?: string;\n}"
           },
           {
             "name": "CatalogSection",
@@ -415,7 +418,7 @@ export const TYPERT = {
           },
           {
             "name": "InstallRejectionCode",
-            "declaration": "export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement';"
+            "declaration": "export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'git-missing';"
           },
           {
             "name": "InstallState",

package/lib/typert.remote-client.js

@@ -18,7 +18,8 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
   'tier': z.union([z.literal("verified"), z.literal("verified-stale"), z.literal("community")]),
   'metadata': z.union([z.literal("declared"), z.literal("derived")]),
   'review': z.union([z.undefined(), z.object({
-  'reviewedVersion': z.string(),
+  'reviewedVersion': z.union([z.undefined(), z.string()]).optional(),
+  'reviewedCommit': z.union([z.undefined(), z.string()]).optional(),
   'reviewer': z.string(),
   'reviewCommit': z.string(),
   'notes': z.string(),
@@ -31,6 +32,8 @@ const dsh_plugin_shop_shop_catalog_result$schema = z.object({
 }),
   'capabilities': z.array(z.string()),
 })]).optional(),
+  'source': z.union([z.literal("npm"), z.literal("github")]),
+  'repo': z.union([z.undefined(), z.string()]).optional(),
 })),
   'denied': z.array(z.object({
   'name': z.string(),
@@ -54,7 +57,7 @@ const dsh_plugin_shop_shop_installStart_result$schema = z.union([z.object({
   'installId': z.string(),
 }), z.object({
   'ok': z.literal(false),
-  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement")]),
+  'code': z.union([z.literal("not-in-catalog"), z.literal("denied"), z.literal("version-mismatch"), z.literal("needs-acknowledgement"), z.literal("git-missing")]),
   'detail': z.string(),
 })])
 const dsh_plugin_shop_shop_installStatus_parameter_0$schema = z.object({
@@ -134,7 +137,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":244,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":270,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -149,7 +152,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":319,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":374,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -175,7 +178,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":270,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":296,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -200,7 +203,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":308,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":363,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -215,7 +218,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":392,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":469,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -240,7 +243,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":213,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":239,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -266,7 +269,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":359,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":429,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/updateStart',
@@ -291,7 +294,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUpdateResult',
         schema: dsh_plugin_shop_shop_updateStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":441,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":518,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/version',
@@ -306,7 +309,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopVersionResult',
         schema: dsh_plugin_shop_shop_version_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":426,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":503,"column":9},
     },
   ],
 }

package/lib/types/client/locales.d.ts

@@ -44,6 +44,8 @@ export declare const zh: {
     notInCatalogCode: string;
     versionMismatchCode: string;
     needsAcknowledgementCode: string;
+    gitMissingCode: string;
+    githubSource: string;
     installedSection: string;
     installedVersion: string;
     latestVersion: string;
@@ -65,6 +67,7 @@ export declare const zh: {
     updateTransportFailed: string;
     checkUpdate: string;
     upToDate: string;
+    github: string;
     enabledSwitch: string;
     toggleFailed: string;
     hotApplyNote: string;
@@ -116,6 +119,8 @@ export declare const en: {
     notInCatalogCode: string;
     versionMismatchCode: string;
     needsAcknowledgementCode: string;
+    gitMissingCode: string;
+    githubSource: string;
     installedSection: string;
     installedVersion: string;
     latestVersion: string;
@@ -137,6 +142,7 @@ export declare const en: {
     updateTransportFailed: string;
     checkUpdate: string;
     upToDate: string;
+    github: string;
     enabledSwitch: string;
     toggleFailed: string;
     hotApplyNote: string;

package/lib/types/client/present.d.ts

@@ -17,6 +17,11 @@ export declare const ACKNOWLEDGEMENT_ZH = "\u5B89\u88C5\u540E\uFF0C\u6B64\u63D2\
 /** Install rejection code → locale key, for the rejected-state code label
  * (§7.2): every rejection the host can return has a human label here. */
 export declare function rejectionCodeKey(code: InstallRejectionCode): ShopLocaleKey;
+/** The version a card displays: full for npm, the short commit for github. */
+export declare function displayVersion(entry: {
+    source: 'npm' | 'github';
+    version: string;
+}): string;
 /** One polled install status (§7.3 wire data), structural. */
 export interface InstallStatusShape {
     found: boolean;

package/lib/types/host/catalog.d.ts

@@ -1,7 +1,8 @@
 /** Catalog fetch, verification, and disk cache — the Host's only network path. */
 import type { CatalogEntry, DeniedEntry } from './types.ts';
-/** Highest schemaVersion this build understands; a higher one is refused (§10). */
-export declare const SUPPORTED_SCHEMA_VERSION = 2;
+/** Highest schemaVersion this build understands; a higher one is refused (§10).
+ * 3 adds `source` and repo entries (github install channel). */
+export declare const SUPPORTED_SCHEMA_VERSION = 3;
 export interface CatalogSnapshot {
     schemaVersion: number;
     builtAt: string;

package/lib/types/host/index.d.ts

@@ -6,6 +6,7 @@ import type { CatalogEntry, DeniedEntry } from './types.ts';
 import { type InstallArgs, type InstallRejectionCode } from './install.ts';
 import { type InstallStatus } from './executor.ts';
 import { type RestartOutcome } from './restart.ts';
+import { type RepoPinFs } from './repo-pins.ts';
 export type { InstallArgs, InstallRejectionCode } from './install.ts';
 export type { CatalogEntry } from './types.ts';
 /** One Loader inventory entry, structurally — the shop never depends on
@@ -46,6 +47,11 @@ export interface ShopGatewayOptions {
     /** How long the gateway waits after a successful restart response before
      * exiting the old process; test-only shortening, production uses 2s. */
     restartExitDelayMs?: number;
+    /** Whether `git` is on PATH — a github entry cannot install without it;
+     * test-only injection, production probes the real binary. */
+    hasGit?: () => boolean;
+    /** Test-only injection: the pins file's filesystem; production uses node:fs. */
+    pinFs?: RepoPinFs;
 }
 /** `shop/installStart` result (§7.3): rejections are typed wire values with an
  * author-readable `detail`, not thrown RPC errors. */
@@ -138,6 +144,8 @@ export declare class ShopGateway extends TypertRemoteService {
     private readonly restartExitDelayMs;
     private readonly restartParentPid;
     private readonly latestVersion;
+    private readonly hasGit;
+    private readonly pinFs;
     /** The install gate runs against the last loaded snapshot, never a fresh
      * fetch per request (§7.2: the Host's cached snapshot is the truth). */
     /** Finished install records retained, so a poll sees the true terminal
@@ -154,6 +162,8 @@ export declare class ShopGateway extends TypertRemoteService {
     /** Every install id in insertion order, oldest first; finished-record eviction walks this from the front. */
     private readonly installOrder;
     constructor(ctx: Context, options?: ShopGatewayOptions);
+    /** The pins file lives in the shop's own cache, next to the catalog cache. */
+    private pinsPath;
     /** The boot's Loader root directory (the active profile's `cordis.yml`
      * directory, carried on `ctx.baseUrl`), when present. A `link:` install
      * keeps this package at its source location, so the walk-up from

package/lib/types/host/install.d.ts

@@ -1,6 +1,6 @@
 /** Install gate: the four rejection paths of §7.2, as a pure function. */
 import type { CatalogSnapshot } from './catalog.ts';
-export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement';
+export type InstallRejectionCode = 'not-in-catalog' | 'denied' | 'version-mismatch' | 'needs-acknowledgement' | 'git-missing';
 export interface InstallArgs {
     name: string;
     version: string;

package/lib/types/host/repo-pins.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The Host's memory of which commit it installed for each github entry.
+ *
+ * pnpm writes the manifest dependency as `github:owner/slug` — no commit —
+ * and the resolved commit lives only in the lockfile. The shop records the
+ * commit it pinned at install time in its own cache so `installed()` can
+ * report `outdated` honestly without parsing pnpm's lockfile. The profile
+ * manifest remains the source of truth for *presence*: a pin whose bundle
+ * is not a manifest dependency is a leftover from a failed install and is
+ * never reported.
+ */
+export interface RepoPinFs {
+    exists: (path: string) => boolean;
+    read: (path: string) => string;
+    write: (path: string, data: string) => void;
+}
+/** Bundle name to the pinned commit. */
+export type RepoPins = Record<string, string>;
+/** Read the pins file; any irregularity degrades to an empty record. */
+export declare function readRepoPins(fs: RepoPinFs, path: string): RepoPins;
+/** Write the pins file atomically enough for its purpose (a cache). */
+export declare function writeRepoPins(fs: RepoPinFs, path: string, pins: RepoPins): void;

package/lib/types/host/types.d.ts

@@ -18,12 +18,17 @@ export interface CatalogEntry {
     tier: 'verified' | 'verified-stale' | 'community';
     metadata: 'declared' | 'derived';
     review?: {
-        reviewedVersion: string;
+        reviewedVersion?: string;
+        reviewedCommit?: string;
         reviewer: string;
         reviewCommit: string;
         notes: string;
     };
     catalog?: CatalogSection;
+    /** Where the entry installs from. */
+    source: 'npm' | 'github';
+    /** `owner/slug`; present exactly when `source` is github. */
+    repo?: string;
 }
 export interface DeniedEntry {
     name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "repository": {
     "type": "git",