dsh-skill-hub 0.3.18 → 0.3.20

package/lib/types/repo/github-client.d.ts

@@ -30,6 +30,14 @@ export declare function githubAuthHeaders(): Record<string, string>;
 export declare const NO_COMPRESSION: Record<string, string>;
 /** JSON API 默认请求头（含鉴权）。 */
 export declare function apiHeaders(): Record<string, string>;
+/**
+ * When the response shows an exhausted GitHub rate limit, the instant it
+ * resets; otherwise undefined. Shared by the repo fetch layer and the plugin's
+ * own update check so both agree on what counts as a rate-limit rejection
+ * (403/429 + `x-ratelimit-remaining: 0` + a parseable `x-ratelimit-reset`)
+ * instead of each re-deriving it from the headers.
+ */
+export declare function rateLimitResetAt(response: Response): Date | undefined;
 /**
  * Build a RepoFetchError; when the response shows an exhausted rate limit,
  * report the reset time instead of a bare HTTP status.
@@ -46,10 +54,9 @@ export declare function fetchJson(url: string, fetchImpl: typeof fetch, context:
     response: Response;
 }>;
 /**
- * Load repo metadata and the recursive git tree at the given ref. The meta
- * request always resolves the default branch (used when ref is absent); the
- * tree is fetched at `ref ?? default_branch` so an explicit branch/tag scans
- * the exact same content a later download would fetch.
+ * Load one JSON document from the GitHub API, reusing an ETag when the URL was
+ * fetched before. `fetchImpl`/`context` exist so callers can stub the transport
+ * and shape the error text; the payload is whatever the endpoint returned.
  */
 export declare function fetchJsonCached(url: string, fetchImpl: typeof fetch, context: string): Promise<{
     json: unknown;

package/lib/types/repo.d.ts

@@ -12,7 +12,7 @@
  * The implementation now lives under `./repo/` (types, discovery, api,
  * install) and this module is a barrel that re-exports it.
  */
-export { NO_COMPRESSION, RepoFetchError, apiHeaders, fetchError, fetchJson, fetchJsonCached, githubAuthHeaders, isAbortError, setGithubToken } from './repo/github-client.ts';
+export { NO_COMPRESSION, RepoFetchError, apiHeaders, fetchError, fetchJson, fetchJsonCached, githubAuthHeaders, isAbortError, rateLimitResetAt, setGithubToken } from './repo/github-client.ts';
 export type { RepoRef, RepoTreeItem, RepoFile } from './repo/types.ts';
 export { REPO_ROOT, isRepoRoot, repoSlug, normalizeRepoInput, collectRepoSkillFiles, originForRoot, discoverRepoEntries, skillManifest, skillDirOf, skillFileAt, skillPathIn, relativeToSkillDir, diffRemoteSkills, repoSkillEntry, } from './repo/discovery.ts';
 export { loadRepoTree, getLatestReleaseTag, getRepoStats, listRepoReleases, listRepoBranches, getLatestCommit, loadRepoTreeAt, } from './repo/api.ts';

package/lib/types/routes/catalog-data.d.ts

@@ -6,8 +6,17 @@ import type { SkillDefinition } from '@deepseek-ai/dsh-skill';
 import { type CatalogResponse, type SkillDetail } from '../protocol.ts';
 import { type SkillInterface } from '../skillfs.ts';
 import { type SkillHubRouteDeps } from './deps.ts';
-/** 目录中存在的技能名集合（tag 成员校验用）：启用目录 ∪ 已禁用名单，避免成员因禁用而丢失。 */
-export declare function knownSkillNames(deps: SkillHubRouteDeps): Promise<Set<string>>;
+/**
+ * 目录中存在的技能名集合。默认（`includeDisabled` 未显式关闭）为「启用目录 ∪
+ * 已禁用名单」——tag 成员校验用：技能被禁用后不该从 tag 里掉出去。
+ *
+ * 导入去重必须传 `{ includeDisabled: false }`：禁用只意味着「暂不启用」，把它
+ * 算作「已存在」会让一次禁用产生「永久占名」的副作用，真技能再也导不进来
+ * （issue #16）。
+ */
+export declare function knownSkillNames(deps: SkillHubRouteDeps, options?: {
+    includeDisabled?: boolean;
+}): Promise<Set<string>>;
 /** 已知工作区条目（dsh 的 workspace.json 表）。 */
 export interface WorkspaceEntry {
     path: string;

package/lib/types/routes/deps.d.ts

@@ -37,7 +37,12 @@ export interface SkillHubRouteDeps {
 }
 /** The resolved hub config a route sees (the shared resolver fills defaults). */
 export declare function configOf(deps: SkillHubRouteDeps): HubConfig;
-/** The raw saved config layer a route reports (empty when the owner omits it). */
+/**
+ * The raw saved config layer as persisted in the sidecar, reported for display
+ * only. Since dsh 0.1.7 the settings namespace is the one user layer, so this
+ * is legacy data: nothing writes it any more and the effective config above
+ * never merges it.
+ */
 export declare function savedOf(deps: SkillHubRouteDeps): Partial<HubConfig>;
 /** Refuse business routes while the master switch is off (the config route stays up). */
 export declare function disabledGate(deps: SkillHubRouteDeps, res: ServerResponse): boolean;

package/lib/types/routes/route-state.d.ts

@@ -40,6 +40,11 @@ export interface ImportJob {
         name: string;
         error: string;
     }>;
+    /**
+     * 导入时被移入回收站让位的「已禁用同名占位」名字（issue #16）。占位已挪走
+     * 即计入，即使随后的下载失败也在列 —— 否则用户不知道自己的占位不见了。
+     */
+    replaced: string[];
     status: 'running' | 'done' | 'cancelled' | 'error';
     error?: string;
     controller: AbortController;

package/lib/types/skillfs/scan.d.ts

@@ -1,4 +1,4 @@
-import type { DiagnosticEntry, WritableRoot } from '../protocol.ts';
+import { type DiagnosticEntry, type WritableRoot } from '../protocol.ts';
 /** One discoverable skill file in a scanned root. */
 export interface SkillEntry {
     /** Absolute path of the discovery file (SKILL.md or the flat .md). */
@@ -39,9 +39,10 @@ export declare function readSkillInterface(directory: string): Promise<SkillInte
  */
 export declare function findProjectRoot(cwd: string): Promise<string>;
 /**
- * Scan one writable root for files the provider ignores, so the GUI can
- * show why a skill never appears — a
- * missing frontmatter must be visible, not silent). .disabled files belong
- * to the hub and are skipped.
+ * Scan one writable root for files the provider ignores, so the GUI can show
+ * why a skill never appears — a missing frontmatter, a name that disagrees
+ * with the discovery path, and the like must be visible, not silent. Files the
+ * hub itself disabled (`.disabled`) are skipped: they are a toggle state, not
+ * a defect.
  */
 export declare function scanDiagnostics(root: WritableRoot, home?: string): Promise<DiagnosticEntry[]>;

package/lib/types/skillfs.d.ts

@@ -29,6 +29,22 @@ export declare function createSkill(root: WritableRoot, name: string, descriptio
 export declare function disableSkill(path: string): Promise<string>;
 /** Re-enable a previously disabled file (reverse of disableSkill). */
 export declare function enableSkill(disabledPath: string): Promise<string>;
+/**
+ * Move one already-resolved skill (a bundle directory or a flat .md file) into
+ * its root's trash as `<root>/.trash/<name>-<timestamp>`.
+ *
+ * The layout is the restore contract, not an implementation detail:
+ * `restoreSkill` renames the entry back and only proves the parent is `.trash`,
+ * and `clearTrash` deletes in place. Every producer of a trash entry must go
+ * through here — skill delete, the hub-disabled whole-group delete, and repo
+ * import's placeholder replacement all move skills for the same recovery flow.
+ *
+ * @returns the trashed path plus the original path that was moved.
+ */
+export declare function moveIntoTrash(source: string): Promise<{
+    path: string;
+    source: string;
+}>;
 /**
  * Move a skill (directory bundle or flat .md file) into the root's trash.
  * The skill stays recoverable: the source is renamed into
@@ -44,5 +60,13 @@ export declare function trashSkill(sourcePath: string): Promise<{
 export declare function restoreSkill(entry: TrashEntry, home?: string): Promise<string>;
 /** Permanently delete one trashed skill (directory or flat file). */
 export declare function clearTrash(entry: TrashEntry, home?: string): Promise<string>;
-/** Repair one file on disk when its frontmatter is auto-fixable. Returns the new text. */
+/**
+ * Repair one file on disk when its frontmatter is auto-fixable. Returns the new text.
+ *
+ * The write is atomic (sibling temp file + rename), matching the sidecar's
+ * persist path: this rewrites a real skill file in place, and a crash midway
+ * through a plain write would leave a truncated SKILL.md — exactly the failure
+ * the store layer already guards against. The `.tmp` sibling is never picked
+ * up by discovery (only `SKILL.md` and `*.md` are scanned).
+ */
 export declare function fixDiagnosticFile(path: string, home?: string): Promise<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {
@@ -65,7 +65,9 @@
         "0.1.7-alpha.2",
         "0.1.7-rc.1",
         "0.1.7-rc.2",
-        "0.2.0-rc.1"
+        "0.2.0-rc.1",
+        "0.2.0-rc.2",
+        "0.2.1-alpha.2"
       ]
     },
     "capability": {
@@ -85,7 +87,7 @@
     "js-yaml": "^4.1.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2",
+    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2 || ^4.0.5-alpha.1",
     "@deepseek-ai/dsh-client-connection": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-locale": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-runtime": ">=0.1.7-alpha.1 <0.3.0-0",
@@ -99,7 +101,7 @@
     "@deepseek-ai/dsh-settings": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-skill": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-system-prompt": ">=0.1.7-alpha.1 <0.3.0-0",
-    "@deepseek-ai/schemastery": "^3.18.3",
+    "@deepseek-ai/schemastery": "^3.18.3 || ^3.18.5-alpha.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
@@ -112,22 +114,22 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-client-connection": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-store": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-session": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-session-query": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-skill": "^0.2.0-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.2.0-rc.1",
-    "@deepseek-ai/schemastery": "^3.18.3",
+    "@deepseek-ai/cordis": "^4.0.5-alpha.1",
+    "@deepseek-ai/dsh-client-connection": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-store": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-query": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-skill": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.2.1-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.5-alpha.1",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",

package/src/client/api.ts

@@ -12,6 +12,7 @@ import {
   type DiagnosticFixResponse,
   type GroupsResponse,
   type MarketCheckResponse,
+  type MarketSourceAddResponse,
   type MarketSourceRefRequest,
   type MarketSourceRequest,
   type MarketSourceResponse,
@@ -156,9 +157,9 @@ export class SkillHubApi {
     return this.get<MarketSourcesResponse>(SKILL_HUB_API.market)
   }
 
-  /** Add a market source repo; resolves with the fresh list. */
-  addMarketSource(repo: string): Promise<MarketSourcesResponse> {
-    return this.post<MarketSourceResponse>(SKILL_HUB_API.marketSource, { repo } satisfies MarketSourceRequest)
+  /** Add a market source repo; resolves with the fresh list plus the resolved slug. */
+  addMarketSource(repo: string): Promise<MarketSourceAddResponse> {
+    return this.post<MarketSourceAddResponse>(SKILL_HUB_API.marketSource, { repo } satisfies MarketSourceRequest)
   }
 
   /** Remove a market source repo; resolves with the fresh list. */

package/src/client/locales/market.ts

@@ -70,6 +70,7 @@ export const zhMarket = {
   'repo.files': '{count} 个文件 · {size}',
   'repo.imported': '导入成功 {count} 个',
   'repo.skippedExisting': '跳过已存在 {count} 个',
+  'repo.replaced': '已替换禁用占位 {count} 个（旧目录已移入回收站）',
   'repo.failed': '失败 {count} 个',
   'repo.cancel': '取消',
   'repo.cancelled': '已取消 · 已导入 {imported}/{total} 已保留，临时文件已清理',
@@ -151,6 +152,7 @@ export const enMarket: Record<keyof typeof zhMarket, string> = {
   'repo.files': '{count} files · {size}',
   'repo.imported': 'Imported {count}',
   'repo.skippedExisting': 'Skipped existing {count}',
+  'repo.replaced': 'Replaced {count} disabled placeholder(s) — old dir moved to trash',
   'repo.failed': 'Failed {count}',
   'repo.cancel': 'Cancel',
   'repo.cancelled': 'Cancelled · {imported}/{total} kept, temp files cleaned',

package/src/client/panel/RepoScanCard.tsx

@@ -55,7 +55,7 @@ export function RepoScanCard(props: { hub: SkillHubState }): JSX.Element | null
     // 导入后 catalog 已包含新技能，但 scan 快照的 existing 仍为 false，需用实时 catalog + 本次导入结果兜底，避免已导入仍可选
     const installedNames = new Set<string>([
       ...((hub.catalog?.skills ?? []).map((s) => s.name)),
-      ...((hub.catalog?.disabled ?? []).map((d) => d.name)),
+      // 已禁用不算「已存在」：禁用只该影响启用态，不该永久占名堵住导入（issue #16）。
       ...((repoResult?.imported ?? []).map((r) => r.name)),
       ...((repoResult?.skipped ?? []).map((r) => r.name)),
     ])
@@ -174,6 +174,7 @@ export function RepoScanCard(props: { hub: SkillHubState }): JSX.Element | null
   {repoResult !== null && repoResult.status !== 'running' ? (
     <div className={repoResult.status === 'cancelled' ? css.errorBanner + ' ' + css.actionsTop : css.formSuccess + ' ' + css.actionsTop}>
       {repoResult.status === 'cancelled' ? tt('repo.cancelled', { imported: repoResult.imported.length, total: repoResult.total }) : `${tt('repo.imported', { count: repoResult.imported.length })} · ${tt('repo.skippedExisting', { count: repoResult.skipped.length })} · ${tt('repo.failed', { count: repoResult.failed.length })}`}
+      {(repoResult.replaced?.length ?? 0) > 0 ? <span> · {tt('repo.replaced', { count: repoResult.replaced?.length ?? 0 })}</span> : null}
       {repoResult.failed.length > 0 ? <div style={{marginTop:6}}>{repoResult.failed.map(f => `${f.name}: ${f.error}`).join('; ')}</div> : null}
       {repoResult.status === 'error' && repoResult.error ? <div style={{marginTop:6}}>{repoResult.error}</div> : null}
     </div>

package/src/client/panel/hooks/useMarketFlow.ts

@@ -75,8 +75,10 @@ export function useMarketFlow(
       setNewSourceName('')
       setRepoResult(null)
       setRepoSelected(new Set())
-      // 用服务端归一化后的 slug 扫描（URL/owner@repo 输入都能对上记录）。
-      const slug = result.repos[result.repos.length - 1].repo
+      // 用服务端回传的归一化 slug 扫描（URL/owner@repo 输入都能对上记录）。
+      // 不能猜 `repos` 的位置：重复添加一个已存在的源只改它的 ref、不重排，
+      // 取末位会扫到另一个源。
+      const slug = result.repo
       setScanningRepo(slug)
       setRepoDiscoverState({ status: 'scanning' })
       try {

package/src/client/panel/panel.module.css

@@ -4,9 +4,17 @@
    on :root, with dark overrides on body[data-ds-dark-theme]). Every var()
    keeps the colour this file used before the token pass as its fallback, so a
    host without the theme package renders exactly as before. Sizes, spacing,
-   radii, fonts and layout are deliberately untouched. */
+   radii, fonts and layout are deliberately untouched.
 
-.panel { padding: 28px 20px 44px; display: flex; flex-direction: column; gap: 14px; max-width: 720px; margin: 0 auto; font-family: -apple-system, BlinkMacSystemFont, 'SF Pro Text', 'Helvetica Neue', sans-serif; -webkit-font-smoothing: antialiased; color-scheme: light dark; /* Dot colors mirror src/client/SkillHubSettingsCard.tsx (DEFAULT_DOT_MODEL_COLOR / DEFAULT_DOT_USER_COLOR) — CSS cannot import TS, so keep the two in sync. */ --hub-model: #2f81f7; --hub-user: #3fb950; /* Host theme tokens (--dsw-alias-*, dsh-client-ui-theme). Each var() carries the pre-token colour of this file as its fallback, so a missing theme package changes nothing. */ --hub-accent: var(--dsw-alias-state-business-primary, #2f81f7); --hub-text: var(--dsw-alias-label-primary, currentColor); --hub-text-2: var(--dsw-alias-label-secondary, #61666b); --hub-text-3: var(--dsw-alias-label-tertiary, #81858c); --hub-text-4: var(--dsw-alias-label-caption, #adb2b8); --hub-surface: var(--dsw-alias-bg-module-platform, rgba(128,128,128,.06)); --hub-hover: var(--dsw-alias-interactive-bg-hover, rgba(128,128,128,.08)); --hub-active: var(--dsw-alias-interactive-bg-active, rgba(128,128,128,.16)); --hub-border: var(--dsw-alias-border-l2, rgba(128,128,128,.13)); --hub-border-2: var(--dsw-alias-border-l3, rgba(128,128,128,.2)); --hub-danger: var(--dsw-alias-state-error-primary, #d1242f); --hub-success: var(--dsw-alias-state-success-primary, #3fb950); --hub-warn: var(--dsw-alias-state-warn-primary, #d29922); --hub-on-accent: var(--dsw-alias-label-primary-foreground, #fff); --hub-skeleton: var(--dsw-alias-bg-skeleton, rgba(128,128,128,.1)); }
+   color-scheme is deliberately NOT declared here. The host layout writes the
+   *resolved* scheme to document.documentElement.style.colorScheme; declaring
+   `light dark` locally overrides that and makes native controls (<select>
+   popups, scrollbars) follow the *OS* preference instead — with a manually
+   selected dark theme on a light OS the <option> list renders light while
+   .select inherits light text, i.e. invisible (issue #13). Inheriting from the
+   root keeps both dark paths (manual + system) correct. */
+
+.panel { padding: 28px 20px 44px; display: flex; flex-direction: column; gap: 14px; max-width: 720px; margin: 0 auto; font-family: -apple-system, BlinkMacSystemFont, 'SF Pro Text', 'Helvetica Neue', sans-serif; -webkit-font-smoothing: antialiased; /* Dot colors mirror src/client/SkillHubSettingsCard.tsx (DEFAULT_DOT_MODEL_COLOR / DEFAULT_DOT_USER_COLOR) — CSS cannot import TS, so keep the two in sync. */ --hub-model: #2f81f7; --hub-user: #3fb950; /* Host theme tokens (--dsw-alias-*, dsh-client-ui-theme). Each var() carries the pre-token colour of this file as its fallback, so a missing theme package changes nothing. */ --hub-accent: var(--dsw-alias-state-business-primary, #2f81f7); --hub-text: var(--dsw-alias-label-primary, currentColor); --hub-text-2: var(--dsw-alias-label-secondary, #61666b); --hub-text-3: var(--dsw-alias-label-tertiary, #81858c); --hub-text-4: var(--dsw-alias-label-caption, #adb2b8); --hub-surface: var(--dsw-alias-bg-module-platform, rgba(128,128,128,.06)); --hub-hover: var(--dsw-alias-interactive-bg-hover, rgba(128,128,128,.08)); --hub-active: var(--dsw-alias-interactive-bg-active, rgba(128,128,128,.16)); --hub-border: var(--dsw-alias-border-l2, rgba(128,128,128,.13)); --hub-border-2: var(--dsw-alias-border-l3, rgba(128,128,128,.2)); --hub-danger: var(--dsw-alias-state-error-primary, #d1242f); --hub-success: var(--dsw-alias-state-success-primary, #3fb950); --hub-warn: var(--dsw-alias-state-warn-primary, #d29922); --hub-on-accent: var(--dsw-alias-label-primary-foreground, #fff); --hub-skeleton: var(--dsw-alias-bg-skeleton, rgba(128,128,128,.1)); }
 .header { display: flex; align-items: baseline; gap: 10px; flex-wrap: wrap; }
 .title { font-size: 24px; font-weight: 700; letter-spacing: -0.02em; margin: 0; }
 .hint { font-size: 12px; color: var(--hub-text-3); }

package/src/client/settings-card.tsx

@@ -10,6 +10,7 @@ import { useState, type ReactElement } from 'react'
 import { IconChevronDownOutline14 } from './icons.tsx'
 import type { HubKey } from './locales.ts'
 import type { CardShell } from './settings-form.ts'
+import { HEX_COLOR_RE } from '../protocol.ts'
 import css from './settings-card.module.css'
 
 /** Card-level chrome props. */
@@ -178,7 +179,7 @@ export interface ColorFieldProps extends FieldBaseProps {
 }
 
 export function ColorField(props: ColorFieldProps): ReactElement {
-  const value = /^#[0-9a-f]{6}$/i.test(props.text) ? props.text : props.defaultColor
+  const value = HEX_COLOR_RE.test(props.text) ? props.text : props.defaultColor
   return (
     <div className={css.field}>
       <FieldShell {...props} />

package/src/client/settings-form.ts

@@ -10,6 +10,9 @@
  */
 
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+// One definition of what a valid color/token looks like, shared with the host
+// routes that re-validate the same drafts.
+import { GITHUB_TOKEN_RE, HEX_COLOR_RE } from '../protocol.ts'
 
 /** One staged field: its draft text plus the clear/reset marker. */
 interface StagedEdit {
@@ -41,9 +44,9 @@ export function booleanField(field: string): FieldSpec {
 export function colorField(field: string): FieldSpec {
   return {
     field,
-    format: (value) => (typeof value === 'string' && /^#[0-9a-f]{6}$/i.test(value) ? value : ''),
+    format: (value) => (typeof value === 'string' && HEX_COLOR_RE.test(value) ? value : ''),
     parse: (text) => {
-      if (/^#[0-9a-f]{6}$/i.test(text)) return { kind: 'set', value: text }
+      if (HEX_COLOR_RE.test(text)) return { kind: 'set', value: text }
       return undefined
     },
   }
@@ -61,7 +64,7 @@ export function secretField(field: string): FieldSpec {
     parse: (text) => {
       const trimmed = text.trim()
       if (trimmed === '') return undefined
-      if (!/^[A-Za-z0-9_-]{8,255}$/.test(trimmed)) return undefined
+      if (!GITHUB_TOKEN_RE.test(trimmed)) return undefined
       return { kind: 'set', value: trimmed }
     },
   }

package/src/index.ts

@@ -163,7 +163,7 @@ export function apply(ctx: Context, config?: Config): void {
     }
     return out as Partial<HubConfig>
   }
-  const current = (): HubConfig => resolveHubConfig({}, readConfig())
+  const current = (): HubConfig => resolveHubConfig(readConfig())
 
   /** The Settings service, when this deployment mounts it. Absent ⇒ no user layer to read or write. */
   const settingsOf = (): SettingsForms | undefined => ctx.get('settings') as SettingsForms | undefined

package/src/protocol/config.ts

@@ -89,29 +89,30 @@ export const HUB_CONFIG_DEFAULTS = {
 } as const
 
 /**
- * Resolve the effective hub config: saved sidecar overrides win over the
- * cordis composition entry (the web card owns runtime config), missing
- * booleans fall back to HUB_CONFIG_DEFAULTS, and dot colors pass through
- * (saved first, then base) only when set. Numeric stats knobs are clamped to
- * their sane ranges (window ≥ 0, scan interval ≥ 1 minute).
+ * Fill a raw settings value into the effective hub config: schema defaults for
+ * anything missing, and the numeric stats knobs clamped to sane ranges
+ * (window ≥ 0, scan interval ≥ 1 minute).
+ *
+ * There is deliberately no "saved sidecar layer" parameter. Until dsh 0.1.7 the
+ * hub kept its own runtime overrides in the sidecar and merged them here; the
+ * settings namespace is now the only user layer (`updateConfig` writes through
+ * `ctx.settings.mutate`), so a merge against a sidecar layer could never
+ * observe anything but `{}` — see the git history of `resolveHubConfig`.
  */
-export function resolveHubConfig(saved: Partial<HubConfig>, base: Partial<HubConfig> = {}): HubConfig {
-  const dotModelColor = saved.dotModelColor !== undefined ? saved.dotModelColor : base.dotModelColor
-  const dotUserColor = saved.dotUserColor !== undefined ? saved.dotUserColor : base.dotUserColor
-  const githubToken = saved.githubToken !== undefined ? saved.githubToken : base.githubToken
-  const windowDays = clampNumber(saved.statsWindowDays ?? base.statsWindowDays, 0) ?? HUB_CONFIG_DEFAULTS.statsWindowDays
-  const scanMinutes = clampNumber(saved.statsScanMinutes ?? base.statsScanMinutes, 1) ?? HUB_CONFIG_DEFAULTS.statsScanMinutes
+export function resolveHubConfig(base: Partial<HubConfig> = {}): HubConfig {
+  const windowDays = clampNumber(base.statsWindowDays, 0) ?? HUB_CONFIG_DEFAULTS.statsWindowDays
+  const scanMinutes = clampNumber(base.statsScanMinutes, 1) ?? HUB_CONFIG_DEFAULTS.statsScanMinutes
   return {
-    enabled: saved.enabled ?? base.enabled ?? HUB_CONFIG_DEFAULTS.enabled,
-    announceToAgent: saved.announceToAgent ?? base.announceToAgent ?? HUB_CONFIG_DEFAULTS.announceToAgent,
-    showUseCount: saved.showUseCount ?? base.showUseCount ?? HUB_CONFIG_DEFAULTS.showUseCount,
-    showUseTime: saved.showUseTime ?? base.showUseTime ?? HUB_CONFIG_DEFAULTS.showUseTime,
-    showGroupSummary: saved.showGroupSummary ?? base.showGroupSummary ?? HUB_CONFIG_DEFAULTS.showGroupSummary,
+    enabled: base.enabled ?? HUB_CONFIG_DEFAULTS.enabled,
+    announceToAgent: base.announceToAgent ?? HUB_CONFIG_DEFAULTS.announceToAgent,
+    showUseCount: base.showUseCount ?? HUB_CONFIG_DEFAULTS.showUseCount,
+    showUseTime: base.showUseTime ?? HUB_CONFIG_DEFAULTS.showUseTime,
+    showGroupSummary: base.showGroupSummary ?? HUB_CONFIG_DEFAULTS.showGroupSummary,
     statsWindowDays: windowDays,
     statsScanMinutes: scanMinutes,
-    ...(dotModelColor !== undefined ? { dotModelColor } : {}),
-    ...(dotUserColor !== undefined ? { dotUserColor } : {}),
-    ...(githubToken !== undefined ? { githubToken } : {}),
+    ...(base.dotModelColor !== undefined ? { dotModelColor: base.dotModelColor } : {}),
+    ...(base.dotUserColor !== undefined ? { dotUserColor: base.dotUserColor } : {}),
+    ...(base.githubToken !== undefined ? { githubToken: base.githubToken } : {}),
   }
 }
 
@@ -148,7 +149,13 @@ export interface ConfigResponse {
   githubTokenSet: boolean
 }
 
-/** POST /api/skill-hub/config — a partial patch; omitted fields keep their values. */
+/**
+ * POST /api/skill-hub/config — a partial patch; omitted fields keep their values.
+ *
+ * Only the fields the handler actually parses belong here: the stats knobs are
+ * owned by the settings namespace (`statsWindowDays` / `statsScanMinutes` are
+ * still part of {@link HubSettingsValue}), not by this route.
+ */
 export interface ConfigRequest {
   /** Set the field; null clears the saved override so it re-inherits the default. */
   enabled?: boolean | null
@@ -164,10 +171,6 @@ export interface ConfigRequest {
   dotModelColor?: string | null
   /** Set the dot color; null clears the saved override so it re-inherits the default. */
   dotUserColor?: string | null
-  /** 统计滚动窗口天数（0 = 全部历史）；null 清除覆盖回默认。 */
-  statsWindowDays?: number | null
-  /** 自动统计扫描间隔（分钟）；null 清除覆盖回默认。 */
-  statsScanMinutes?: number | null
   /** Set the GitHub token; null/empty clears it back to anonymous. */
   githubToken?: string | null
 }

package/src/protocol/market.ts

@@ -27,6 +27,18 @@ export interface MarketSourceResponse {
   repos: MarketSourceRecord[]
 }
 
+/**
+ * POST /api/skill-hub/market/source — same list, plus the slug the host
+ * resolved from the input. Clients must scan *this* slug rather than assume
+ * the acted-on source sits at some position in `repos`: re-adding a repo the
+ * user already tracks only updates its `ref` in place and never reorders the
+ * list.
+ */
+export interface MarketSourceAddResponse extends MarketSourceResponse {
+  /** Normalized `owner/repo` the host recorded for the submitted input. */
+  repo: string
+}
+
 /** POST /api/skill-hub/market/source/ref — pin a market source to an explicit ref. */
 export interface MarketSourceRefRequest {
   repo: string

package/src/protocol/repo.ts

@@ -95,6 +95,12 @@ export interface RepoImportProgressResponse {
   imported: Array<{ name: string; origin: string; path: string }>
   skipped: Array<{ name: string; reason: 'exists' }>
   failed: Array<{ name: string; error: string }>
+  /**
+   * 本次导入中「让位的已禁用同名占位」名字（issue #16）：这些条目的旧目录已
+   * 移入回收站，新技能随后落地。旧目录挪走即计入，下载失败时也在列。老客户端
+   * 不认这个字段时忽略即可，故为可选。
+   */
+  replaced?: string[]
   /** error 状态时的原因 */
   error?: string
 }

package/src/protocol.ts

@@ -36,6 +36,7 @@ export type {
   MarketSourceRecord,
   MarketSourcesResponse,
   MarketSourceRequest,
+  MarketSourceAddResponse,
   MarketSourceResponse,
   MarketSourceRefRequest,
   MarketSourceVersionsResponse,

package/src/repo/github-client.ts

@@ -66,21 +66,34 @@ function etagCacheSet(url: string, etag: string, json: unknown): void {
   }
   etagCache.set(url, { etag, json })
 }
+
+/**
+ * When the response shows an exhausted GitHub rate limit, the instant it
+ * resets; otherwise undefined. Shared by the repo fetch layer and the plugin's
+ * own update check so both agree on what counts as a rate-limit rejection
+ * (403/429 + `x-ratelimit-remaining: 0` + a parseable `x-ratelimit-reset`)
+ * instead of each re-deriving it from the headers.
+ */
+export function rateLimitResetAt(response: Response): Date | undefined {
+  if (response.status !== 403 && response.status !== 429) return undefined
+  if (response.headers.get('x-ratelimit-remaining') !== '0') return undefined
+  const reset = response.headers.get('x-ratelimit-reset')
+  if (reset === null) return undefined
+  const at = new Date(Number(reset) * 1000)
+  return Number.isNaN(at.getTime()) ? undefined : at
+}
+
 /**
  * Build a RepoFetchError; when the response shows an exhausted rate limit,
  * report the reset time instead of a bare HTTP status.
  */
 export function fetchError(context: string, response: Response, fallbackStatus = 502): RepoFetchError {
-  const remaining = response.headers.get('x-ratelimit-remaining')
-  const reset = response.headers.get('x-ratelimit-reset')
-  if (response.status === 403 || response.status === 429) {
-    if (remaining === '0' && reset !== null) {
-      const at = new Date(Number(reset) * 1000)
-      return new RepoFetchError(
-        'github rate limit reached (anonymous quota exhausted); retry after ' + at.toLocaleTimeString() + ' or set GITHUB_TOKEN',
-        403,
-      )
-    }
+  const resetAt = rateLimitResetAt(response)
+  if (resetAt !== undefined) {
+    return new RepoFetchError(
+      'github rate limit reached (anonymous quota exhausted); retry after ' + resetAt.toLocaleTimeString() + ' or set GITHUB_TOKEN',
+      403,
+    )
   }
   return new RepoFetchError(context + ' (HTTP ' + response.status + ')', response.status === 404 ? 404 : fallbackStatus)
 }
@@ -111,10 +124,9 @@ export async function fetchJson(url: string, fetchImpl: typeof fetch, context: s
 }
 
 /**
- * Load repo metadata and the recursive git tree at the given ref. The meta
- * request always resolves the default branch (used when ref is absent); the
- * tree is fetched at `ref ?? default_branch` so an explicit branch/tag scans
- * the exact same content a later download would fetch.
+ * Load one JSON document from the GitHub API, reusing an ETag when the URL was
+ * fetched before. `fetchImpl`/`context` exist so callers can stub the transport
+ * and shape the error text; the payload is whatever the endpoint returned.
  */
 export async function fetchJsonCached(url: string, fetchImpl: typeof fetch, context: string): Promise<{ json: unknown; response: Response }> {
   const cached = etagCache.get(url)

package/src/repo/install.ts

@@ -34,8 +34,11 @@ export async function downloadGitHubFile(repo: string, ref: string, path: string
   }
   if (response === null || !response.ok) {
     if (signal?.aborted) throw new DOMException('aborted', 'AbortError')
-    // Fallback: api.github.com/contents with the raw media type.
-    const apiUrl = `https://api.github.com/repos/${repo}/contents/${encodedPath}`
+    // Fallback: api.github.com/contents with the raw media type. The `?ref=`
+    // is mandatory — without it /contents/ serves the default branch, so a
+    // transient raw failure would silently mix default-branch content into a
+    // tag-pinned import (issue #15).
+    const apiUrl = `https://api.github.com/repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(ref)}`
     try {
       response = await fetchImpl(apiUrl, { headers: { accept: 'application/vnd.github.raw', ...NO_COMPRESSION, ...githubAuthHeaders() }, ...(signal !== undefined ? { signal } : {}) })
     } catch (error) {