dsh-plugin 1.1.0 → 1.1.2

package/lib/http/routes.js

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Local HTTP routes exposing real installs to the in-app Plugin Hub UI.
  * The client fetches the same-origin `/dsh-plugin-hub/*` endpoints; the
  * install handler validates the target, then spawns the official dsh CLI
@@ -8,7 +12,7 @@ import { readFileSync } from 'node:fs';
 import { homedir, release } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
-import { activeTask, cancelTask, dumpLoaderEntries, getTask, githubTarget, hasQueuedTarget, listPendingRestarts, readProfileArg, startPluginMutation, validPackageName } from '../services/install.js';
+import { activeTask, cancelTask, dumpLoaderEntries, getTask, githubRepoOf, githubTarget, hasQueuedTarget, listPendingRestarts, readProfileArg, startPluginMutation, validPackageName } from '../services/install.js';
 import { recordInstalledVersion, recordResolvedNpmPackage, readInstalledVersions, removeInstalledVersion } from '../services/installed-versions.js';
 import { resolveNpmPackage } from '../services/npm-resolve.js';
 import { preflightTarget } from '../services/preflight.js';
@@ -64,11 +68,14 @@ function hostEnv(profile) {
         dshHome: process.env.DSH_HOME ?? join(homedir(), '.dsh'),
     };
 }
-/** Match an install target (`github:<owner>/<repo>`) against the installed table; returns the package name when already installed. */
+/** Match a GitHub install target against the installed table; returns the package name when already installed. */
 function installedByRepo(installed, target) {
-    const needle = target.toLowerCase();
+    const repo = githubRepoOf(target);
+    if (repo === null)
+        return null;
+    const needle = repo.toLowerCase();
     for (const [name, spec] of Object.entries(installed)) {
-        if (spec.toLowerCase().includes(needle))
+        if (githubRepoOf(spec)?.toLowerCase() === needle)
             return name;
     }
     return null;
@@ -164,7 +171,7 @@ export function mountPluginHubRoutes(webServer, profile, loader) {
                     const displayRepo = typeof body === 'object' && body !== null && typeof body.display === 'string'
                         ? body.display.trim()
                         : rawRepo;
-                    // 目标语法两态：owner/repo → github 源（走装前预检）；npm 包名（@scope/name 或 name）→ 信任 registry 直接安装
+                    // 目标语法两态：owner/repo → 显式 HTTPS Git 源（走装前预检）；npm 包名（@scope/name 或 name）→ 信任 registry 直接安装
                     const repoTarget = githubTarget(rawRepo);
                     let target = repoTarget ?? (repoTarget === null && validPackageName(rawRepo) ? rawRepo : null);
                     if (target === null) {
@@ -195,7 +202,7 @@ export function mountPluginHubRoutes(webServer, profile, loader) {
                     // 重复安装防护：非更新请求命中已安装目标时直接拒绝，不重复跑 CLI
                     // （否则 CLI 会因「已存在」失败，且用户看到的是莫名其妙的报错）；
                     // 更新请求（mode: 'update'）放行，CLI 的 add 对已存在依赖是 pnpm 原位覆盖重装。
-                    // 命中判定双通道：npm 包名按 dependencies 键直接命中，github: 目标按 spec 值匹配。
+                    // 命中判定双通道：npm 包名按 dependencies 键直接命中，GitHub 目标按仓库身份匹配。
                     const installed = readInstalled(profile);
                     const already = installedByRepo(installed, target) ?? (installed[target] !== undefined ? target : null);
                     if (already !== null && mode !== 'update') {
@@ -236,7 +243,7 @@ export function mountPluginHubRoutes(webServer, profile, loader) {
                         profile,
                         target,
                         // npm 安装时 target 是包名：displayTarget 固定展示仓库名，待重启行/前端恢复不受通道变化影响
-                        displayTarget: githubTarget(displayRepo) ?? undefined,
+                        displayTarget: githubRepoOf(displayRepo) ?? undefined,
                         // 已尝试的安装方式（npm 反查）：实际执行命令由 spawn 时追加，失败 issue 一并展示
                         attempts,
                         timeoutMs: COMMAND_TIMEOUT_MS,
@@ -283,7 +290,7 @@ export function mountPluginHubRoutes(webServer, profile, loader) {
                         profile,
                         target: name,
                         // 卸载的 mutation 目标是 npm 包名；待重启行要显示 owner/repo（与安装行一致），非法/缺失时回退包名
-                        displayTarget: githubTarget(repo) ?? undefined,
+                        displayTarget: githubRepoOf(repo) ?? undefined,
                         // 运行中 loader：卸载成功后主动移除条目，立即生效、无需重启
                         uninstallLoader: loader,
                         timeoutMs: COMMAND_TIMEOUT_MS,

package/lib/index.js

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * dsh-plugin host entry: mounts the Plugin Hub HTTP routes once the host
  * web server service is available. The browser bundle (src/client) talks to
  * these same-origin routes to perform real installs from inside the app.

package/lib/services/install-types.js

@@ -1,5 +1,11 @@
-/** 安装/卸载运行时的公共类型与常量（无依赖，供各服务模块复用）。 */
-/** Grammar of an accepted `github:<owner>/<repo>` install target. */
+/**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 安装/卸载运行时的公共类型与常量（无依赖，供各服务模块复用）。
+ */
+/** Grammar of a catalog GitHub repository identity (`owner/repo`). */
 export const REPO_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 /** Grammar of an npm package name (used for uninstall targets). */
 export const PACKAGE_RE = /^(?:@[a-z0-9._-]+\/)?[A-Za-z0-9._-]+$/;

package/lib/services/install.js

@@ -1,4 +1,4 @@
 export { addPendingRestart, clearPendingRestart, listPendingRestarts } from './pending-restart.js';
 export { dumpLoaderEntries, removeLoadedEntry } from './loader.js';
-export { addAllowBuildsKey, githubTarget, parseAllowBuildsKey, readProfileArg, validPackageName } from './profile.js';
+export { addAllowBuildsKey, githubRepoOf, githubTarget, parseAllowBuildsKey, readProfileArg, validPackageName } from './profile.js';
 export { activeTask, cancelTask, getTask, hasQueuedTarget, hasRunningTask, runPluginMutation, startPluginMutation } from './task-queue.js';

package/lib/services/installed-versions.js

@@ -1,8 +1,12 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Installed-plugin version tracking.
  *
  * The installed table (`readInstalled` in routes.ts) only knows the manifest
- * spec of each dependency (`github:<owner>/<repo>`), which carries no version.
+ * spec of each Git dependency, which carries no version.
  * To let the Plugin Hub tell "an update is available", we record the catalog
  * signal present at install time into a small per-profile JSON file, then
  * compare it against the catalog's current signal later.

package/lib/services/loader.js

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * 运行中 loader 的读取与停用：卸载成功后对匹配条目做 live-disable，
  * 使卸载立即生效（刷新页面不再加载已卸载的 client bundle，也无需重启）。
  */
@@ -44,13 +48,15 @@ function nameMatches(entryName, target) {
     return false;
 }
 /**
- * 卸载成功后从运行中 loader 停用指定包的条目，使卸载立即生效（刷新页面不再
- * 加载已卸载的 client bundle，也无需重启）。做法：按 name 扫描
+ * 卸载成功后从运行中 loader 停用指定包的条目。做法：按 name 扫描
  * `loader.entries()`（含嵌套子树），对每个匹配条目
  * `entry.update({ disabled: true })` 做 live-disable —— fiber 被 dispose，
  * client-modules 对账后不再把它写进 `__DSH_BOOT__`，页面刷新即恢复。
- * 返回 true = 无需重启（条目已停用，或本就没加载过）；false = 未能停用，
- * 需登记「待重启清理」兜底。宿主关键包（@deepseek-ai/* 与本插件自身）一律跳过。
+ * 返回 true = 无需重启（仅当宿主从未加载过它：磁盘已干净）；
+ * 其余一律 false = 需要重启：要么 disable 失败需「待重启清理」兜底，
+ * 要么 disable 成功但该插件曾在 loader 中存活——带 UI 的插件（侧边栏面板等
+ * 宿主启动时渲染的槽位）disable 后不会主动摘除，不重启面板一直残留。
+ * 宿主关键包（@deepseek-ai/* 与本插件自身）一律跳过。
  */
 export async function removeLoadedEntry(loader, name) {
     if (name === 'dsh-plugin' || name.startsWith('@deepseek-ai/'))
@@ -83,8 +89,13 @@ export async function removeLoadedEntry(loader, name) {
         if (!found) {
             // 运行中 loader 无该条目：宿主从未加载过它（装完未重启），磁盘已干净，无需重启
             console.log(`[hub-uninstall] no live entry for ${name}; nothing to disable`);
+            return true;
         }
-        return true;
+        // 找到并停用了 live entry：逻辑层已卸载（刷新页面不再加载其 client bundle），
+        // 但带 UI 的插件（侧边栏面板等）是宿主启动时渲染的槽位，disable 不会主动摘除，
+        // 不重启面板会一直残留 → 返回「需要重启」，弹窗给出「立即重启」，面板立即消失
+        console.log(`[hub-uninstall] disabled live entry for ${name}; UI may persist until restart`);
+        return false;
     })();
     const result = await Promise.race([
         removal.catch((error) => {

package/lib/services/npm-resolve.js

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * npm 包反查：git 分发不完整（缺构建产物/子模块）导致安装失败时，用 npm
  * registry 的搜索接口按 repository 地址反查该仓库对应的官方 npm 包。
  *

package/lib/services/pending-restart.js

@@ -2,7 +2,7 @@ const pendingRestarts = [];
 /**
  * 登记一条待重启记录（同一目标去重）。
  * - 卸载：目标刚装完未重启（已有待重启记录）→ 宿主从未加载过它，卸完磁盘已干净、
- *   loader 无残留，无需再提醒重启，直接移除该条；否则（此前已被宿主加载过）登记「卸载后待重启清理」。
+ *   loader 无残留，无需再提醒重启，直接移除该条；否则（已被宿主加载过）登记「卸载后待重启清理」。
  * - 安装：已有记录则刷新为安装语义（如卸载后未重启又重装），否则新登记。
  */
 export function addPendingRestart(target, kind) {

package/lib/services/preflight.js

@@ -1,5 +1,9 @@
 /**
- * 安装前预检：对 `github:` 源的插件，检查其分发（codeload tarball）里是否
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 安装前预检：对 GitHub 源的插件，检查其分发（codeload tarball）里是否
  * 真的包含 package.json 声明的入口文件（main / exports["."].default）。
  * git 分发常不提交构建产物（lib/ 等），这类残缺包装完会让宿主重启加载插件树时
  * ERR_MODULE_NOT_FOUND 直接崩溃 —— 预检在动手安装前就把它们拦下，避免白装一次。
@@ -13,12 +17,13 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { promisify } from 'node:util';
+import { githubRepoOf } from './profile.js';
 const execFileAsync = promisify(execFile);
 export async function preflightTarget(target) {
-    const m = /^github:([^/]+)\/([^/]+)$/.exec(target);
-    if (m === null)
+    const source = githubRepoOf(target);
+    if (source === null)
         return { ok: true, missing: null };
-    const [, owner, repo] = m;
+    const [owner, repo] = source.split('/');
     let commit = '';
     try {
         const { stdout } = await execFileAsync('git', ['ls-remote', `https://github.com/${owner}/${repo}.git`, 'HEAD']);

package/lib/services/profile.js

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * 宿主 profile 与目标校验工具：解析当前 profile、目录定位、安装目标语法校验，
  * 以及 pnpm allowBuilds 白名单的写入（失败恢复路径）。
  */
@@ -16,11 +20,34 @@ export function readProfileArg(fallback = 'web') {
 export function profileDirectory(profile) {
     return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), 'profiles', profile);
 }
-/** Build a safe `github:<owner>/<repo>` target, or null when the repo is unsafe. */
+/** Build a safe explicit HTTPS Git target, or null when the repo is unsafe. */
 export function githubTarget(repo) {
     if (typeof repo !== 'string' || !REPO_RE.test(repo))
         return null;
-    return `github:${repo}`;
+    return `git+https://github.com/${repo}.git`;
+}
+/** Extract an owner/repo identity from a catalog value or an installed Git spec. */
+export function githubRepoOf(value) {
+    if (typeof value !== 'string')
+        return null;
+    const input = value.trim();
+    if (REPO_RE.test(input))
+        return input;
+    const patterns = [
+        /^github:([^/]+)\/([^/]+)$/i,
+        /^(?:git\+)?https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:[?#].*)?$/i,
+        /^(?:git\+)?ssh:\/\/(?:git@)?github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:[?#].*)?$/i,
+        /^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?(?:[?#].*)?$/i,
+    ];
+    for (const pattern of patterns) {
+        const match = pattern.exec(input);
+        if (match === null)
+            continue;
+        const repo = `${match[1]}/${match[2]}`;
+        if (REPO_RE.test(repo))
+            return repo;
+    }
+    return null;
 }
 /** Validate an npm package name (uninstall target grammar). */
 export function validPackageName(name) {
@@ -28,7 +55,7 @@ export function validPackageName(name) {
 }
 /**
  * The exact `allowBuilds` key pnpm printed in its
- * `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` hint. For `github:` installs pnpm
+ * `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` hint. For Git installs pnpm
  * matches against `name@<resolved fetch URL>` — the URL it actually fetches,
  * e.g. `https://codeload.github.com/<owner>/<repo>/tar.gz/<commit>` — not the
  * `git+ssh://`/branch spec. A bare name or a `git+` spec does not match, so

package/lib/services/progress.js

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Pure progress-estimation helpers shared by the install runner.
  *
  * The dsh CLI wraps pnpm, which refreshes its `Progress: …` line in place

package/lib/services/task-queue.js

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * 后台安装/卸载任务队列：内存任务注册表 + FIFO 串行 worker + 子进程生命周期管理。
  * 每个任务一次 `dsh plugin --profile <profile> <action> <target>` 子进程，
  * 输出流式收集到任务上；卸载成功时尝试从运行中 loader 即时停用（见 loader.ts）。
@@ -10,7 +14,7 @@ import { CAPTURE_LIMIT_BYTES, MAX_TASKS, MAX_TASK_LINES } from './install-types.
 import { cleanLine, estimateProgress } from './progress.js';
 import { removeLoadedEntry } from './loader.js';
 import { addPendingRestart, clearPendingRestart } from './pending-restart.js';
-import { addAllowBuildsKey, parseAllowBuildsKey, profileDirectory } from './profile.js';
+import { addAllowBuildsKey, githubRepoOf, parseAllowBuildsKey, profileDirectory } from './profile.js';
 /** In-memory task registry, keyed by task id. */
 const tasks = new Map();
 let nextTaskId = 1;
@@ -142,7 +146,7 @@ function stopChild(child) {
  * Progress is visible through `getTask(id)` / `activeTask()` until done.
  */
 export function startPluginMutation(options) {
-    const task = { id: nextTaskId, target: options.target, displayTarget: options.displayTarget, action: options.action, status: 'pending', timedOut: false, exitCode: null, progress: 0, lines: [], attempts: options.attempts ?? [] };
+    const task = { id: nextTaskId, target: options.target, displayTarget: options.displayTarget, action: options.action, status: 'pending', timedOut: false, exitCode: null, progress: 0, lines: [], attempts: options.attempts ?? [], needsRestart: false };
     nextTaskId = nextTaskId >= Number.MAX_SAFE_INTEGER ? 1 : nextTaskId + 1;
     tasks.set(task.id, task);
     if (tasks.size > MAX_TASKS) {
@@ -185,7 +189,7 @@ function spawnMutation(options) {
     const { action, profile, target, timeoutMs = 5 * 60 * 1000, env, task, displayTarget, uninstallLoader } = options;
     const invocation = cliInvocation();
     const args = [...invocation.prefixArgs, 'plugin', '--profile', profile, action, target];
-    // 记录实际执行的命令（npm 通道显示包名，git 通道显示 github: 源）：失败提 Issue 时
+    // 记录实际执行的命令（npm 通道显示包名，git 通道显示 HTTPS 源）：失败提 Issue 时
     // 「已尝试的安装方式」如实展示完整命令链，作者一眼看清我们跑过什么
     const executed = `dsh plugin --profile ${profile} ${action} ${target}`;
     if (task && !task.attempts.includes(executed)) {
@@ -275,8 +279,7 @@ function spawnMutation(options) {
         child.stderr?.on('data', (chunk) => collect('stderr', chunk));
         child.once('exit', () => {
             // dsh 内部会 fork pnpm：pnpm 退出后仍攥着 stdout/stderr 管道时，
-            // close 事件永不到来（历史队列卡死根因——取消路径曾因此卡死，用整组 SIGKILL 解决；
-            // 自然失败路径没有兜底）。exit 后给 close 一段宽限，未按时触发则整组清理强制结束，
+            // close 事件不会到来。exit 后给 close 一段宽限，未按时触发则整组清理强制结束，
             // 保证任务必然进入终态、后续排队任务自动启动。
             exitWatch = setTimeout(() => {
                 if (settled)
@@ -316,9 +319,13 @@ function spawnMutation(options) {
                         if (task.status === 'done') {
                             task.progress = 100;
                             if (action === 'remove' && uninstallLoader) {
-                                // 卸载成功 → 主动从运行中 loader 移除该包条目，立即生效、无需重启；
-                                // 移除失败（或从未加载过但 loader 不可用）才登记「待重启清理」兜底
+                                // 卸载成功 → 主动从运行中 loader 停用该包条目；
+                                // 仅当宿主从未加载过它（磁盘已干净）才判「无需重启」；
+                                // 只要曾在 loader 中存活（停用过 live entry）就仍要求重启——
+                                // 带 UI 的插件（侧边栏面板等宿主启动时渲染的槽位）disable 后不会
+                                // 主动消失，重启才能立即摘除面板
                                 const removed = await removeLoadedEntry(uninstallLoader, target);
+                                task.needsRestart = !removed;
                                 if (removed)
                                     clearPendingRestart(displayTarget ?? target);
                                 else
@@ -327,6 +334,7 @@ function spawnMutation(options) {
                             else {
                                 // 安装成功（或卸载但无 loader 引用）→ 登记待重启：
                                 // 插件要宿主重启才会挂载/卸载干净，重启前一直提醒；展示目标用 displayTarget（owner/repo）
+                                task.needsRestart = true;
                                 addPendingRestart(displayTarget ?? target, action === 'add' ? 'install' : 'uninstall');
                             }
                         }
@@ -355,8 +363,11 @@ export function verifyInstalledEntry(profile, target) {
         return { name: null, missing: null };
     }
     const deps = (profilePkg?.dependencies ?? {});
-    // target 自身是依赖名（npm 包），或通过 github: specifier 反查依赖名
-    const name = deps[target] !== undefined ? target : Object.keys(deps).find((k) => deps[k] === target);
+    // target 自身是依赖名（npm 包），或通过 Git specifier 反查依赖名
+    const targetRepo = githubRepoOf(target)?.toLowerCase();
+    const name = targetRepo !== undefined
+        ? Object.keys(deps).find((k) => githubRepoOf(deps[k])?.toLowerCase() === targetRepo)
+        : deps[target] !== undefined ? target : Object.keys(deps).find((k) => deps[k] === target);
     if (!name)
         return { name: null, missing: null };
     const pkgDir = join(profileDirectory(profile), 'node_modules', name);
@@ -423,7 +434,7 @@ export async function runPluginMutation(options) {
         // 输出解析不到时回退用目标名（插件自身构建脚本被拦的 npm 场景）。
         if (output.includes('ERR_PNPM_IGNORED_BUILDS')) {
             const keys = ignoredBuildKeys(output);
-            if (keys.length === 0 && !options.target.startsWith('github:'))
+            if (keys.length === 0 && githubRepoOf(options.target) === null)
                 keys.push(options.target);
             if (keys.length > 0) {
                 if (options.task) {

package/lib/types/index.d.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * dsh-plugin host entry: mounts the Plugin Hub HTTP routes once the host
  * web server service is available. The browser bundle (src/client) talks to
  * these same-origin routes to perform real installs from inside the app.

package/lib/types/services/install-types.d.ts

@@ -1,4 +1,10 @@
-/** 安装/卸载运行时的公共类型与常量（无依赖，供各服务模块复用）。 */
+/**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 安装/卸载运行时的公共类型与常量（无依赖，供各服务模块复用）。
+ */
 /** 一个 pnpm 安装子进程的结果快照。 */
 export interface InstallResult {
     exitCode: number | null;
@@ -9,7 +15,7 @@ export interface InstallResult {
 }
 export interface InstallTask {
     id: number;
-    /** 操作目标：`github:<owner>/<repo>`（安装）或 npm 包名（卸载），冲突/恢复时需要展示给用户 */
+    /** 操作目标：显式 HTTPS Git URL（安装）或 npm 包名（卸载），冲突/恢复时需要展示给用户 */
     target: string;
     /** 展示用目标（owner/repo）：npm 安装时 target 是包名，前端恢复用此字段显示仓库名，保持用户无感知 */
     displayTarget?: string;
@@ -26,6 +32,8 @@ export interface InstallTask {
     progress: number;
     /** Newest output lines first (consumer shows the tail). */
     lines: string[];
+    /** 完成后是否仍需宿主重启才生效：卸载时 loader 已即时移除 → false；否则 true（弹窗据此给重启选项） */
+    needsRestart: boolean;
 }
 /** 子进程启动参数（复用宿主 dsh 入口，或回退到 PATH 上的 `dsh`）。 */
 export interface Invocation {
@@ -50,14 +58,14 @@ export interface QueueItem {
  * 它自然清空，正好等于「重启后提醒消失」的语义，无需任何重启探测。
  */
 export interface PendingRestart {
-    /** `github:<owner>/<repo>` 安装目标（与任务一致；卸载时为展示用的 owner/repo） */
+    /** Git 安装目标（与任务一致；卸载时为展示用的 owner/repo） */
     target: string;
     /** 待重启语义：install 装完等挂载生效 / uninstall 卸完等清理 loader 残留 */
     kind: 'install' | 'uninstall';
     /** 任务完成时刻（epoch ms） */
     at: number;
 }
-/** Grammar of an accepted `github:<owner>/<repo>` install target. */
+/** Grammar of a catalog GitHub repository identity (`owner/repo`). */
 export declare const REPO_RE: RegExp;
 /** Grammar of an npm package name (used for uninstall targets). */
 export declare const PACKAGE_RE: RegExp;

package/lib/types/services/install.d.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Install runner 的统一出口：执行真实插件变更（spawn 官方 dsh CLI 子进程）。
  * 实现按职责拆分在同目录子模块，本文件只做公共 API 的 re-export，保持外部
  * import 面稳定（routes.ts / index.ts 仍从 `services/install.ts` 引入）。
@@ -14,5 +18,5 @@ export type { InstallResult, InstallTask, Invocation, PendingRestart, QueueItem
 export type { LoaderHandle } from './loader.ts';
 export { addPendingRestart, clearPendingRestart, listPendingRestarts } from './pending-restart.ts';
 export { dumpLoaderEntries, removeLoadedEntry } from './loader.ts';
-export { addAllowBuildsKey, githubTarget, parseAllowBuildsKey, readProfileArg, validPackageName } from './profile.ts';
+export { addAllowBuildsKey, githubRepoOf, githubTarget, parseAllowBuildsKey, readProfileArg, validPackageName } from './profile.ts';
 export { activeTask, cancelTask, getTask, hasQueuedTarget, hasRunningTask, runPluginMutation, startPluginMutation } from './task-queue.ts';

package/lib/types/services/loader.d.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * 运行中 loader 的读取与停用：卸载成功后对匹配条目做 live-disable，
  * 使卸载立即生效（刷新页面不再加载已卸载的 client bundle，也无需重启）。
  */
@@ -32,12 +36,14 @@ export declare function dumpLoaderEntries(loader: LoaderHandle | undefined): Arr
     name?: string;
 }>;
 /**
- * 卸载成功后从运行中 loader 停用指定包的条目，使卸载立即生效（刷新页面不再
- * 加载已卸载的 client bundle，也无需重启）。做法：按 name 扫描
+ * 卸载成功后从运行中 loader 停用指定包的条目。做法：按 name 扫描
  * `loader.entries()`（含嵌套子树），对每个匹配条目
  * `entry.update({ disabled: true })` 做 live-disable —— fiber 被 dispose，
  * client-modules 对账后不再把它写进 `__DSH_BOOT__`，页面刷新即恢复。
- * 返回 true = 无需重启（条目已停用，或本就没加载过）；false = 未能停用，
- * 需登记「待重启清理」兜底。宿主关键包（@deepseek-ai/* 与本插件自身）一律跳过。
+ * 返回 true = 无需重启（仅当宿主从未加载过它：磁盘已干净）；
+ * 其余一律 false = 需要重启：要么 disable 失败需「待重启清理」兜底，
+ * 要么 disable 成功但该插件曾在 loader 中存活——带 UI 的插件（侧边栏面板等
+ * 宿主启动时渲染的槽位）disable 后不会主动摘除，不重启面板一直残留。
+ * 宿主关键包（@deepseek-ai/* 与本插件自身）一律跳过。
  */
 export declare function removeLoadedEntry(loader: LoaderHandle, name: string): Promise<boolean>;

package/lib/types/services/pending-restart.d.ts

@@ -1,9 +1,15 @@
-/** 待重启列表的内存态管理（宿主进程一重启自然清空）。 */
+/**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 待重启列表的内存态管理（宿主进程一重启自然清空）。
+ */
 import type { PendingRestart } from './install-types.ts';
 /**
  * 登记一条待重启记录（同一目标去重）。
  * - 卸载：目标刚装完未重启（已有待重启记录）→ 宿主从未加载过它，卸完磁盘已干净、
- *   loader 无残留，无需再提醒重启，直接移除该条；否则（此前已被宿主加载过）登记「卸载后待重启清理」。
+ *   loader 无残留，无需再提醒重启，直接移除该条；否则（已被宿主加载过）登记「卸载后待重启清理」。
  * - 安装：已有记录则刷新为安装语义（如卸载后未重启又重装），否则新登记。
  */
 export declare function addPendingRestart(target: string, kind: 'install' | 'uninstall'): void;

package/lib/types/services/profile.d.ts

@@ -2,13 +2,15 @@
 export declare function readProfileArg(fallback?: string): string;
 /** Resolve a profile directory (`DSH_HOME` or `~/.dsh`). */
 export declare function profileDirectory(profile: string): string;
-/** Build a safe `github:<owner>/<repo>` target, or null when the repo is unsafe. */
+/** Build a safe explicit HTTPS Git target, or null when the repo is unsafe. */
 export declare function githubTarget(repo: string): string | null;
+/** Extract an owner/repo identity from a catalog value or an installed Git spec. */
+export declare function githubRepoOf(value: string): string | null;
 /** Validate an npm package name (uninstall target grammar). */
 export declare function validPackageName(name: string): boolean;
 /**
  * The exact `allowBuilds` key pnpm printed in its
- * `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` hint. For `github:` installs pnpm
+ * `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` hint. For Git installs pnpm
  * matches against `name@<resolved fetch URL>` — the URL it actually fetches,
  * e.g. `https://codeload.github.com/<owner>/<repo>/tar.gz/<commit>` — not the
  * `git+ssh://`/branch spec. A bare name or a `git+` spec does not match, so

package/lib/types/services/progress.d.ts

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Pure progress-estimation helpers shared by the install runner.
  *
  * The dsh CLI wraps pnpm, which refreshes its `Progress: …` line in place

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "A community plugin marketplace for DeepSeek Harness, built to the official plugin spec — browse, search and install 4000+ human-curated community plugins without leaving the app. · DeepSeek Harness 社区插件市场（遵循官方开发规范）：4000+ 人工精选社区插件，每日更新。",
   "type": "module",
   "main": "lib/index.js",

package/src/client/components/AboutModal.tsx

@@ -0,0 +1,76 @@
+/**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
+ * 头部「关注我们」弹窗：介绍 DSH-Plugin Hub 是干什么的 + 用户反馈群二维码。
+ * 内容以 Markdown 形式由 dsh-update Worker 的 /about 接口下发（key = hub:about），
+ * 作者想怎么写就怎么写、随写随推，客户端只负责渲染 —— 非写死。
+ * 图片（反馈群二维码）经 renderMarkdown 的 ![](url) 语法嵌入，居中、最大高度受控。
+ */
+import { createElement as h } from 'react'
+import type { MouseEvent } from 'react'
+import styles from '../styles/Modal.module.css'
+import type { HubAboutInfo } from '../lib/catalog.ts'
+import type { LocaleId, Translate } from '../types.ts'
+import { renderMarkdown } from '../lib/renderMarkdown.ts'
+import { CloseIcon } from './icons.tsx'
+
+export function AboutModal({ info, lang, t, onClose }: {
+  info: HubAboutInfo | null
+  lang: LocaleId
+  t: Translate
+  onClose: () => void
+}) {
+  // 内容：字符串直接使用；{zh,en} 对象按界面语言取，缺哪种补哪种，全缺则展示兜底文案。
+  // Worker 未推送（info 为 null / content 为空）时弹窗仍能打开，显示「暂未发布」而非报错。
+  const contentRaw = info
+    ? typeof info.content === 'string'
+      ? info.content
+      : info.content && typeof info.content === 'object'
+        ? lang === 'en'
+          ? (info.content.en ?? info.content.zh ?? '')
+          : (info.content.zh ?? info.content.en ?? '')
+        : ''
+    : ''
+  const contentHtml = contentRaw.trim() ? renderMarkdown(contentRaw) : null
+  // 更新时间：ISO 字符串转本地可读格式；非法值静默隐藏
+  let updated: string | null = null
+  if (info?.updatedAt) {
+    const d = new Date(info.updatedAt)
+    if (!Number.isNaN(d.getTime())) {
+      updated = d.toLocaleString(lang === 'en' ? 'en-US' : 'zh-CN')
+    }
+  }
+
+  return h('div', {
+    className: styles.overlay,
+    onClick: (e: MouseEvent<HTMLDivElement>) => {
+      if (e.target === e.currentTarget) onClose()
+    },
+  },
+    h('div', { className: `${styles.modal} ${styles.aboutModal}`, role: 'dialog', 'aria-modal': 'true' },
+      h('div', { className: styles.modalHead },
+        h('div', { className: styles.modalTitle }, t('aboutTitle')),
+        h('button', {
+          className: styles.modalClose,
+          'aria-label': t('confirmCancel'),
+          onClick: () => onClose(),
+        }, h(CloseIcon)),
+      ),
+      h('div', { className: styles.modalDesc }, t('aboutDesc')),
+      contentHtml
+        ? h('div', {
+          className: styles.aboutContent,
+          dangerouslySetInnerHTML: { __html: contentHtml },
+        })
+        : h('div', { className: styles.aboutContent }, t('aboutEmpty')),
+      updated
+        ? h('div', { className: styles.aboutMeta }, `${t('aboutUpdated')} ${updated}`)
+        : null,
+      h('div', { className: styles.modalActions },
+        h('button', { className: styles.modalInstall, onClick: onClose }, t('doneBtn')),
+      ),
+    ),
+  )
+}

package/src/client/components/CatalogControls.tsx

@@ -1,4 +1,8 @@
 /**
+ * DSH-Plugin Hub — the community plugin marketplace for DeepSeek Harness.
+ * Website: https://dsh-plugin.org
+ * GitHub: https://github.com/dshplugin/dsh-plugin-hub
+ *
  * Toolbar above the list: search input + sort dropdown + installed / not
  * installed filter buttons + the notifications entry. All buttons share the
  * same size (24px high, like the notification entry button).