dsh-skill-hub 0.3.19 → 0.3.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.19",
+  "version": "0.3.20",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {
@@ -66,7 +66,8 @@
         "0.1.7-rc.1",
         "0.1.7-rc.2",
         "0.2.0-rc.1",
-        "0.2.0-rc.2"
+        "0.2.0-rc.2",
+        "0.2.1-alpha.2"
       ]
     },
     "capability": {
@@ -86,7 +87,7 @@
     "js-yaml": "^4.1.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2",
+    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2 || ^4.0.5-alpha.1",
     "@deepseek-ai/dsh-client-connection": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-locale": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-runtime": ">=0.1.7-alpha.1 <0.3.0-0",
@@ -100,7 +101,7 @@
     "@deepseek-ai/dsh-settings": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-skill": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-system-prompt": ">=0.1.7-alpha.1 <0.3.0-0",
-    "@deepseek-ai/schemastery": "^3.18.3",
+    "@deepseek-ai/schemastery": "^3.18.3 || ^3.18.5-alpha.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
@@ -113,22 +114,22 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-client-connection": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-locale": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-store": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-query": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-settings": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-skill": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.3",
+    "@deepseek-ai/cordis": "^4.0.5-alpha.1",
+    "@deepseek-ai/dsh-client-connection": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-store": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-query": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-skill": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.2.1-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.5-alpha.1",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",

package/src/client/api.ts

@@ -12,6 +12,7 @@ import {
   type DiagnosticFixResponse,
   type GroupsResponse,
   type MarketCheckResponse,
+  type MarketSourceAddResponse,
   type MarketSourceRefRequest,
   type MarketSourceRequest,
   type MarketSourceResponse,
@@ -156,9 +157,9 @@ export class SkillHubApi {
     return this.get<MarketSourcesResponse>(SKILL_HUB_API.market)
   }
 
-  /** Add a market source repo; resolves with the fresh list. */
-  addMarketSource(repo: string): Promise<MarketSourcesResponse> {
-    return this.post<MarketSourceResponse>(SKILL_HUB_API.marketSource, { repo } satisfies MarketSourceRequest)
+  /** Add a market source repo; resolves with the fresh list plus the resolved slug. */
+  addMarketSource(repo: string): Promise<MarketSourceAddResponse> {
+    return this.post<MarketSourceAddResponse>(SKILL_HUB_API.marketSource, { repo } satisfies MarketSourceRequest)
   }
 
   /** Remove a market source repo; resolves with the fresh list. */

package/src/client/panel/hooks/useMarketFlow.ts

@@ -75,8 +75,10 @@ export function useMarketFlow(
       setNewSourceName('')
       setRepoResult(null)
       setRepoSelected(new Set())
-      // 用服务端归一化后的 slug 扫描（URL/owner@repo 输入都能对上记录）。
-      const slug = result.repos[result.repos.length - 1].repo
+      // 用服务端回传的归一化 slug 扫描（URL/owner@repo 输入都能对上记录）。
+      // 不能猜 `repos` 的位置：重复添加一个已存在的源只改它的 ref、不重排，
+      // 取末位会扫到另一个源。
+      const slug = result.repo
       setScanningRepo(slug)
       setRepoDiscoverState({ status: 'scanning' })
       try {

package/src/client/settings-card.tsx

@@ -10,6 +10,7 @@ import { useState, type ReactElement } from 'react'
 import { IconChevronDownOutline14 } from './icons.tsx'
 import type { HubKey } from './locales.ts'
 import type { CardShell } from './settings-form.ts'
+import { HEX_COLOR_RE } from '../protocol.ts'
 import css from './settings-card.module.css'
 
 /** Card-level chrome props. */
@@ -178,7 +179,7 @@ export interface ColorFieldProps extends FieldBaseProps {
 }
 
 export function ColorField(props: ColorFieldProps): ReactElement {
-  const value = /^#[0-9a-f]{6}$/i.test(props.text) ? props.text : props.defaultColor
+  const value = HEX_COLOR_RE.test(props.text) ? props.text : props.defaultColor
   return (
     <div className={css.field}>
       <FieldShell {...props} />

package/src/client/settings-form.ts

@@ -10,6 +10,9 @@
  */
 
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+// One definition of what a valid color/token looks like, shared with the host
+// routes that re-validate the same drafts.
+import { GITHUB_TOKEN_RE, HEX_COLOR_RE } from '../protocol.ts'
 
 /** One staged field: its draft text plus the clear/reset marker. */
 interface StagedEdit {
@@ -41,9 +44,9 @@ export function booleanField(field: string): FieldSpec {
 export function colorField(field: string): FieldSpec {
   return {
     field,
-    format: (value) => (typeof value === 'string' && /^#[0-9a-f]{6}$/i.test(value) ? value : ''),
+    format: (value) => (typeof value === 'string' && HEX_COLOR_RE.test(value) ? value : ''),
     parse: (text) => {
-      if (/^#[0-9a-f]{6}$/i.test(text)) return { kind: 'set', value: text }
+      if (HEX_COLOR_RE.test(text)) return { kind: 'set', value: text }
       return undefined
     },
   }
@@ -61,7 +64,7 @@ export function secretField(field: string): FieldSpec {
     parse: (text) => {
       const trimmed = text.trim()
       if (trimmed === '') return undefined
-      if (!/^[A-Za-z0-9_-]{8,255}$/.test(trimmed)) return undefined
+      if (!GITHUB_TOKEN_RE.test(trimmed)) return undefined
       return { kind: 'set', value: trimmed }
     },
   }

package/src/index.ts

@@ -163,7 +163,7 @@ export function apply(ctx: Context, config?: Config): void {
     }
     return out as Partial<HubConfig>
   }
-  const current = (): HubConfig => resolveHubConfig({}, readConfig())
+  const current = (): HubConfig => resolveHubConfig(readConfig())
 
   /** The Settings service, when this deployment mounts it. Absent ⇒ no user layer to read or write. */
   const settingsOf = (): SettingsForms | undefined => ctx.get('settings') as SettingsForms | undefined

package/src/protocol/config.ts

@@ -89,29 +89,30 @@ export const HUB_CONFIG_DEFAULTS = {
 } as const
 
 /**
- * Resolve the effective hub config: saved sidecar overrides win over the
- * cordis composition entry (the web card owns runtime config), missing
- * booleans fall back to HUB_CONFIG_DEFAULTS, and dot colors pass through
- * (saved first, then base) only when set. Numeric stats knobs are clamped to
- * their sane ranges (window ≥ 0, scan interval ≥ 1 minute).
+ * Fill a raw settings value into the effective hub config: schema defaults for
+ * anything missing, and the numeric stats knobs clamped to sane ranges
+ * (window ≥ 0, scan interval ≥ 1 minute).
+ *
+ * There is deliberately no "saved sidecar layer" parameter. Until dsh 0.1.7 the
+ * hub kept its own runtime overrides in the sidecar and merged them here; the
+ * settings namespace is now the only user layer (`updateConfig` writes through
+ * `ctx.settings.mutate`), so a merge against a sidecar layer could never
+ * observe anything but `{}` — see the git history of `resolveHubConfig`.
  */
-export function resolveHubConfig(saved: Partial<HubConfig>, base: Partial<HubConfig> = {}): HubConfig {
-  const dotModelColor = saved.dotModelColor !== undefined ? saved.dotModelColor : base.dotModelColor
-  const dotUserColor = saved.dotUserColor !== undefined ? saved.dotUserColor : base.dotUserColor
-  const githubToken = saved.githubToken !== undefined ? saved.githubToken : base.githubToken
-  const windowDays = clampNumber(saved.statsWindowDays ?? base.statsWindowDays, 0) ?? HUB_CONFIG_DEFAULTS.statsWindowDays
-  const scanMinutes = clampNumber(saved.statsScanMinutes ?? base.statsScanMinutes, 1) ?? HUB_CONFIG_DEFAULTS.statsScanMinutes
+export function resolveHubConfig(base: Partial<HubConfig> = {}): HubConfig {
+  const windowDays = clampNumber(base.statsWindowDays, 0) ?? HUB_CONFIG_DEFAULTS.statsWindowDays
+  const scanMinutes = clampNumber(base.statsScanMinutes, 1) ?? HUB_CONFIG_DEFAULTS.statsScanMinutes
   return {
-    enabled: saved.enabled ?? base.enabled ?? HUB_CONFIG_DEFAULTS.enabled,
-    announceToAgent: saved.announceToAgent ?? base.announceToAgent ?? HUB_CONFIG_DEFAULTS.announceToAgent,
-    showUseCount: saved.showUseCount ?? base.showUseCount ?? HUB_CONFIG_DEFAULTS.showUseCount,
-    showUseTime: saved.showUseTime ?? base.showUseTime ?? HUB_CONFIG_DEFAULTS.showUseTime,
-    showGroupSummary: saved.showGroupSummary ?? base.showGroupSummary ?? HUB_CONFIG_DEFAULTS.showGroupSummary,
+    enabled: base.enabled ?? HUB_CONFIG_DEFAULTS.enabled,
+    announceToAgent: base.announceToAgent ?? HUB_CONFIG_DEFAULTS.announceToAgent,
+    showUseCount: base.showUseCount ?? HUB_CONFIG_DEFAULTS.showUseCount,
+    showUseTime: base.showUseTime ?? HUB_CONFIG_DEFAULTS.showUseTime,
+    showGroupSummary: base.showGroupSummary ?? HUB_CONFIG_DEFAULTS.showGroupSummary,
     statsWindowDays: windowDays,
     statsScanMinutes: scanMinutes,
-    ...(dotModelColor !== undefined ? { dotModelColor } : {}),
-    ...(dotUserColor !== undefined ? { dotUserColor } : {}),
-    ...(githubToken !== undefined ? { githubToken } : {}),
+    ...(base.dotModelColor !== undefined ? { dotModelColor: base.dotModelColor } : {}),
+    ...(base.dotUserColor !== undefined ? { dotUserColor: base.dotUserColor } : {}),
+    ...(base.githubToken !== undefined ? { githubToken: base.githubToken } : {}),
   }
 }
 
@@ -148,7 +149,13 @@ export interface ConfigResponse {
   githubTokenSet: boolean
 }
 
-/** POST /api/skill-hub/config — a partial patch; omitted fields keep their values. */
+/**
+ * POST /api/skill-hub/config — a partial patch; omitted fields keep their values.
+ *
+ * Only the fields the handler actually parses belong here: the stats knobs are
+ * owned by the settings namespace (`statsWindowDays` / `statsScanMinutes` are
+ * still part of {@link HubSettingsValue}), not by this route.
+ */
 export interface ConfigRequest {
   /** Set the field; null clears the saved override so it re-inherits the default. */
   enabled?: boolean | null
@@ -164,10 +171,6 @@ export interface ConfigRequest {
   dotModelColor?: string | null
   /** Set the dot color; null clears the saved override so it re-inherits the default. */
   dotUserColor?: string | null
-  /** 统计滚动窗口天数（0 = 全部历史）；null 清除覆盖回默认。 */
-  statsWindowDays?: number | null
-  /** 自动统计扫描间隔（分钟）；null 清除覆盖回默认。 */
-  statsScanMinutes?: number | null
   /** Set the GitHub token; null/empty clears it back to anonymous. */
   githubToken?: string | null
 }

package/src/protocol/market.ts

@@ -27,6 +27,18 @@ export interface MarketSourceResponse {
   repos: MarketSourceRecord[]
 }
 
+/**
+ * POST /api/skill-hub/market/source — same list, plus the slug the host
+ * resolved from the input. Clients must scan *this* slug rather than assume
+ * the acted-on source sits at some position in `repos`: re-adding a repo the
+ * user already tracks only updates its `ref` in place and never reorders the
+ * list.
+ */
+export interface MarketSourceAddResponse extends MarketSourceResponse {
+  /** Normalized `owner/repo` the host recorded for the submitted input. */
+  repo: string
+}
+
 /** POST /api/skill-hub/market/source/ref — pin a market source to an explicit ref. */
 export interface MarketSourceRefRequest {
   repo: string

package/src/protocol.ts

@@ -36,6 +36,7 @@ export type {
   MarketSourceRecord,
   MarketSourcesResponse,
   MarketSourceRequest,
+  MarketSourceAddResponse,
   MarketSourceResponse,
   MarketSourceRefRequest,
   MarketSourceVersionsResponse,

package/src/repo/github-client.ts

@@ -66,21 +66,34 @@ function etagCacheSet(url: string, etag: string, json: unknown): void {
   }
   etagCache.set(url, { etag, json })
 }
+
+/**
+ * When the response shows an exhausted GitHub rate limit, the instant it
+ * resets; otherwise undefined. Shared by the repo fetch layer and the plugin's
+ * own update check so both agree on what counts as a rate-limit rejection
+ * (403/429 + `x-ratelimit-remaining: 0` + a parseable `x-ratelimit-reset`)
+ * instead of each re-deriving it from the headers.
+ */
+export function rateLimitResetAt(response: Response): Date | undefined {
+  if (response.status !== 403 && response.status !== 429) return undefined
+  if (response.headers.get('x-ratelimit-remaining') !== '0') return undefined
+  const reset = response.headers.get('x-ratelimit-reset')
+  if (reset === null) return undefined
+  const at = new Date(Number(reset) * 1000)
+  return Number.isNaN(at.getTime()) ? undefined : at
+}
+
 /**
  * Build a RepoFetchError; when the response shows an exhausted rate limit,
  * report the reset time instead of a bare HTTP status.
  */
 export function fetchError(context: string, response: Response, fallbackStatus = 502): RepoFetchError {
-  const remaining = response.headers.get('x-ratelimit-remaining')
-  const reset = response.headers.get('x-ratelimit-reset')
-  if (response.status === 403 || response.status === 429) {
-    if (remaining === '0' && reset !== null) {
-      const at = new Date(Number(reset) * 1000)
-      return new RepoFetchError(
-        'github rate limit reached (anonymous quota exhausted); retry after ' + at.toLocaleTimeString() + ' or set GITHUB_TOKEN',
-        403,
-      )
-    }
+  const resetAt = rateLimitResetAt(response)
+  if (resetAt !== undefined) {
+    return new RepoFetchError(
+      'github rate limit reached (anonymous quota exhausted); retry after ' + resetAt.toLocaleTimeString() + ' or set GITHUB_TOKEN',
+      403,
+    )
   }
   return new RepoFetchError(context + ' (HTTP ' + response.status + ')', response.status === 404 ? 404 : fallbackStatus)
 }
@@ -111,10 +124,9 @@ export async function fetchJson(url: string, fetchImpl: typeof fetch, context: s
 }
 
 /**
- * Load repo metadata and the recursive git tree at the given ref. The meta
- * request always resolves the default branch (used when ref is absent); the
- * tree is fetched at `ref ?? default_branch` so an explicit branch/tag scans
- * the exact same content a later download would fetch.
+ * Load one JSON document from the GitHub API, reusing an ETag when the URL was
+ * fetched before. `fetchImpl`/`context` exist so callers can stub the transport
+ * and shape the error text; the payload is whatever the endpoint returned.
  */
 export async function fetchJsonCached(url: string, fetchImpl: typeof fetch, context: string): Promise<{ json: unknown; response: Response }> {
   const cached = etagCache.get(url)

package/src/repo.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from 'vitest'
 import { mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { NO_COMPRESSION, apiHeaders, collectRepoSkillFiles, diffRemoteSkills, discoverRepoEntries, downloadGitHubFile, downloadRepoSkill, getLatestReleaseTag, getRepoStats, listRepoBranches, normalizeRepoInput, originForRoot, relativeToSkillDir, repoSkillEntry, repoSlug, skillDirOf, skillFileAt, skillManifest } from './repo.ts'
+import { NO_COMPRESSION, apiHeaders, collectRepoSkillFiles, diffRemoteSkills, discoverRepoEntries, downloadGitHubFile, downloadRepoSkill, getLatestReleaseTag, getRepoStats, listRepoBranches, normalizeRepoInput, originForRoot, rateLimitResetAt, relativeToSkillDir, repoSkillEntry, repoSlug, skillDirOf, skillFileAt, skillManifest } from './repo.ts'
 import type { RepoTreeItem } from './repo.ts'
 import type { RepoSkillEntry } from './protocol.ts'
 
@@ -449,3 +449,22 @@ describe('GitHub 请求头', () => {
     expect(apiHeaders().accept).toBe('application/vnd.github+json')
   })
 })
+
+describe('rateLimitResetAt', () => {
+  const response = (status: number, headers: Record<string, string>): Response => new Response('', { status, headers })
+  const exhausted = { 'x-ratelimit-remaining': '0', 'x-ratelimit-reset': '1700000000' }
+
+  it('reports the reset instant for an exhausted 403 or 429', () => {
+    expect(rateLimitResetAt(response(403, exhausted))?.getTime()).toBe(1700000000 * 1000)
+    expect(rateLimitResetAt(response(429, exhausted))?.getTime()).toBe(1700000000 * 1000)
+  })
+
+  it('is undefined for anything that is not an exhausted rate limit', () => {
+    expect(rateLimitResetAt(response(500, exhausted))).toBeUndefined()
+    expect(rateLimitResetAt(response(404, exhausted))).toBeUndefined()
+    expect(rateLimitResetAt(response(403, { 'x-ratelimit-remaining': '57', 'x-ratelimit-reset': '1700000000' }))).toBeUndefined()
+    expect(rateLimitResetAt(response(403, { 'x-ratelimit-remaining': '0' }))).toBeUndefined()
+    // 头部存在但不是数字：宁可退回普通 HTTP 文案，也不要报 "Invalid Date"。
+    expect(rateLimitResetAt(response(403, { 'x-ratelimit-remaining': '0', 'x-ratelimit-reset': 'nope' }))).toBeUndefined()
+  })
+})

package/src/repo.ts

@@ -14,7 +14,7 @@
  */
 
 // 后向兼容：老 `from './repo.ts'` 写法继续可用，新代码可直引 github-client。
-export { NO_COMPRESSION, RepoFetchError, apiHeaders, fetchError, fetchJson, fetchJsonCached, githubAuthHeaders, isAbortError, setGithubToken } from './repo/github-client.ts'
+export { NO_COMPRESSION, RepoFetchError, apiHeaders, fetchError, fetchJson, fetchJsonCached, githubAuthHeaders, isAbortError, rateLimitResetAt, setGithubToken } from './repo/github-client.ts'
 
 export type { RepoRef, RepoTreeItem, RepoFile } from './repo/types.ts'
 

package/src/routes/catalog-data.ts

@@ -199,10 +199,13 @@ export async function buildCatalog(deps: SkillHubRouteDeps, cwd?: string): Promi
     if (iface !== undefined) applyInterface(row, iface)
     return row
   })
-  const diagnostics = [
-    ...(await scanDiagnostics('user-dsh', home)),
-    ...(await scanDiagnostics('user-agents', home)),
-  ]
+  // 两个 root 的诊断扫描互不依赖：面板每 5 秒轮询一次 /catalog，串行会让响应
+  // 随技能数量线性变慢。扫描内部的逐条读盘也已是并发的（见 scanDiagnostics）。
+  const [userDshDiagnostics, userAgentsDiagnostics] = await Promise.all([
+    scanDiagnostics('user-dsh', home),
+    scanDiagnostics('user-agents', home),
+  ])
+  const diagnostics = [...userDshDiagnostics, ...userAgentsDiagnostics]
   return {
     ok: true,
     pluginVersion: CURRENT_VERSION,

package/src/routes/catalog.ts

@@ -3,8 +3,8 @@
  * create / stats。从 routes.ts 原样搬出，handler 逻辑不变。
  */
 
-import { mkdir, readFile, rename, stat } from 'node:fs/promises'
-import { basename, dirname, join } from 'node:path'
+import { readFile, stat } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
 import type { SkillDefinition } from '@deepseek-ai/dsh-skill'
 import { isSkillName } from '@deepseek-ai/dsh-skill'
 import {
@@ -18,7 +18,7 @@ import {
   type ToggleResponse,
   type WritableRoot,
 } from '../protocol.ts'
-import { createSkill, disableSkill, enableSkill, parseFrontmatter, readSkillInterface, rootOfPath, rootPath, trashSkill } from '../skillfs.ts'
+import { createSkill, disableSkill, enableSkill, moveIntoTrash, parseFrontmatter, readSkillInterface, rootOfPath, rootPath, trashSkill } from '../skillfs.ts'
 import { errorText } from '../error-text.ts'
 import {
   applyInterface,
@@ -156,12 +156,7 @@ export function catalogRoutes(deps: SkillHubRouteDeps): RouteSpec[] {
             }
             // 禁用态：SKILL.md.disabled 或 *.md.disabled，直接将其所在技能整体移入回收站
             const isBundleDisabled = disabled.path.endsWith('SKILL.md.disabled')
-            const sourceToTrash = isBundleDisabled ? dirname(disabled.path) : disabled.path
-            const trashDir = join(dirname(sourceToTrash), '.trash')
-            await mkdir(trashDir, { recursive: true })
-            const target = join(trashDir, basename(sourceToTrash) + '-' + Date.now())
-            await rename(sourceToTrash, target)
-            trashResult = { path: target, source: sourceToTrash }
+            trashResult = await moveIntoTrash(isBundleDisabled ? dirname(disabled.path) : disabled.path)
           } else {
             writeError(res, resolved.status, resolved.error); return
           }

package/src/routes/deps.ts

@@ -43,10 +43,15 @@ export interface SkillHubRouteDeps {
 
 /** The resolved hub config a route sees (the shared resolver fills defaults). */
 export function configOf(deps: SkillHubRouteDeps): HubConfig {
-  return resolveHubConfig({}, deps.config?.() ?? {})
+  return resolveHubConfig(deps.config?.() ?? {})
 }
 
-/** The raw saved config layer a route reports (empty when the owner omits it). */
+/**
+ * The raw saved config layer as persisted in the sidecar, reported for display
+ * only. Since dsh 0.1.7 the settings namespace is the one user layer, so this
+ * is legacy data: nothing writes it any more and the effective config above
+ * never merges it.
+ */
 export function savedOf(deps: SkillHubRouteDeps): Partial<HubConfig> {
   return deps.saved?.() ?? {}
 }

package/src/routes/market.ts

@@ -7,6 +7,7 @@
 import {
   SKILL_HUB_API,
   type MarketCheckResponse,
+  type MarketSourceAddResponse,
   type MarketSourceResponse,
   type MarketSourcesResponse,
   type MarketSourceVersionsResponse,
@@ -60,6 +61,13 @@ export function marketRoutes(deps: SkillHubRouteDeps): RouteSpec[] {
       }
       try {
         const latestTag = await getLatestReleaseTag(source.repo)
+        // Book the attempt as soon as the GitHub call has been spent, before
+        // the unpinned branch below can `continue`: otherwise an unpinned
+        // source never records a timestamp and the 5-minute throttle promised
+        // above never applies to it (every check re-hits /releases/latest).
+        // A call that throws is deliberately not booked, so a failing repo is
+        // retried on the next check — same as the source check in sources.ts.
+        lastMarketCheck.set(source.repo, now)
         if (source.ref === undefined) {
           // Not pinned yet: report the latest release so the UI can
           // suggest pinning, but never claim an update.
@@ -67,7 +75,6 @@ export function marketRoutes(deps: SkillHubRouteDeps): RouteSpec[] {
           continue
         }
         const latest = await getLatestCommit(source.repo, source.ref)
-        lastMarketCheck.set(source.repo, now)
         const commitMoved = source.commitSha !== undefined && latest.commitSha !== source.commitSha
         const newRelease = latestTag !== undefined && latestTag !== source.ref
         results.push({ ...base, updateAvailable: commitMoved || newRelease, commitSha: latest.commitSha, ...(newRelease ? { latestTag } : {}) })
@@ -99,7 +106,11 @@ export function marketRoutes(deps: SkillHubRouteDeps): RouteSpec[] {
         // An explicit @ref pins the source immediately (e.g. repo@v1.2.3);
         // otherwise the first scan resolves latest-release / branch choice.
         const ref = parsed.ref
-        writeJson(res, 200, { ok: true, repos: await deps.store.addMarketSource(repoSlug(parsed), ref) } satisfies MarketSourceResponse)
+        const slug = repoSlug(parsed)
+        // Return the normalized slug explicitly: the client scans it right
+        // away, and `repos` order carries no "this one" signal (re-adding an
+        // existing repo only rewrites its ref in place).
+        writeJson(res, 200, { ok: true, repo: slug, repos: await deps.store.addMarketSource(slug, ref) } satisfies MarketSourceAddResponse)
       },
     },
     {

package/src/routes/repo-import.ts

@@ -3,7 +3,7 @@
  * cancel 取消。从 routes.ts 原样搬出，handler 逻辑不变。
  */
 
-import { mkdir, rename } from 'node:fs/promises'
+import { mkdir } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
 import { randomUUID } from 'node:crypto'
 import {
@@ -28,7 +28,7 @@ import {
   skillManifest,
   skillPathIn,
 } from '../repo.ts'
-import { rootPath } from '../skillfs.ts'
+import { moveIntoTrash, rootPath } from '../skillfs.ts'
 import { errorText } from '../error-text.ts'
 import {
   homeOf,
@@ -60,11 +60,8 @@ async function clearDisabledPlaceholder(deps: SkillHubRouteDeps, targetRoot: str
   if (sourceToTrash !== dir) return false
   // 目录里还有 SKILL.md 说明它其实是启用态的真实技能，不动。
   if (await pathExists(join(dir, 'SKILL.md'))) return false
-  // 与 skill/delete 的回收站语义一致：同级 .trash/ 下按「名字-时间戳」落盘，可恢复。
-  const trashDir = join(targetRoot, '.trash')
-  await mkdir(trashDir, { recursive: true })
-  const target = join(trashDir, name + '-' + Date.now())
-  await rename(sourceToTrash, target)
+  // 与 skill/delete 走同一个回收站落盘规则（moveIntoTrash），恢复流程依赖它。
+  const { path: target } = await moveIntoTrash(sourceToTrash)
   await deps.store.addTrash({ name, path: target, movedAt: Date.now(), sourcePath: sourceToTrash })
   await deps.store.removeDisabled(name)
   return true

package/src/routes.test.ts

@@ -5,6 +5,7 @@ import type { IncomingMessage } from 'node:http'
 import type { SkillDefinition, SkillSummary } from '@deepseek-ai/dsh-skill'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { makeRoutes, type SkillHubRouteDeps } from './routes.ts'
+import { lastMarketCheck } from './routes/route-state.ts'
 import { SkillHubStore, statePath } from './store.ts'
 import { SKILL_HUB_API, SKILL_HUB_API_ROOT, type CatalogResponse, type ConfigResponse, type ErrorResponse, type HubConfig } from './protocol.ts'
 
@@ -645,6 +646,73 @@ describe('skill-hub routes', () => {
     expect((del.json() as import('./protocol.ts').MarketSourceResponse).repos).toEqual([{ repo: 'other/repo', ref: 'v2.0.0' }])
   })
 
+  // 回归：重复添加一个已存在的源只改它的 ref、不重排列表，所以响应必须回传
+  // 服务端归一化的 slug —— 客户端不能靠 `repos[repos.length - 1]` 猜操作对象。
+  it('returns the resolved slug of the added market source, not a list position', async () => {
+    const add = async (repo: string): Promise<import('./protocol.ts').MarketSourceAddResponse> => {
+      const res = new FakeResponse()
+      await routeFor(SKILL_HUB_API.marketSource).handler(fakeReq('POST', SKILL_HUB_API.marketSource, { repo }), res as never)
+      expect(res.status).toBe(200)
+      return res.json() as import('./protocol.ts').MarketSourceAddResponse
+    }
+    await add('first/repo')
+    await add('second/repo')
+    const again = await add('first/repo@v9.9.9')
+    expect(again.repo).toBe('first/repo')
+    // 本次操作对象并不在末位：按位置猜会拿到 second/repo。
+    expect(again.repos[again.repos.length - 1].repo).toBe('second/repo')
+    expect(again.repos).toEqual([{ repo: 'first/repo', ref: 'v9.9.9' }, { repo: 'second/repo' }])
+    // URL 输入也归一到同一个 slug。
+    expect((await add('https://github.com/third/repo')).repo).toBe('third/repo')
+  })
+
+  // 回归：未定版的市场源也必须吃 5 分钟节流。曾经把节流时间戳写在「未定版
+  // 早退」之后，于是未定版的源每次检查都重新打 GitHub /releases/latest。
+  it('throttles the market check for an unpinned source as well', async () => {
+    lastMarketCheck.clear()
+    await store.addMarketSource('unpinned/throttle-target')
+    let releaseLookups = 0
+    vi.stubGlobal('fetch', vi.fn(async (url: string) => {
+      if (url.includes('/releases/latest')) {
+        releaseLookups += 1
+        return jsonResponse({ tag_name: 'v3.1.4' })
+      }
+      return new Response('unexpected url: ' + url, { status: 599 })
+    }))
+    try {
+      const first = new FakeResponse()
+      await routeFor(SKILL_HUB_API.marketCheck).handler(fakeReq('GET', SKILL_HUB_API.marketCheck), first as never)
+      const firstBody = first.json() as import('./protocol.ts').MarketCheckResponse
+      expect(firstBody.results[0]).toMatchObject({ repo: 'unpinned/throttle-target', latestTag: 'v3.1.4' })
+      expect(firstBody.results[0].throttled).toBeUndefined()
+
+      const second = new FakeResponse()
+      await routeFor(SKILL_HUB_API.marketCheck).handler(fakeReq('GET', SKILL_HUB_API.marketCheck), second as never)
+      const secondBody = second.json() as import('./protocol.ts').MarketCheckResponse
+      expect(secondBody.results[0].throttled).toBe(true)
+      // 第二次没有发生任何上游查询。
+      expect(releaseLookups).toBe(1)
+    } finally {
+      vi.unstubAllGlobals()
+      lastMarketCheck.clear()
+    }
+  })
+
+  // resolveHubConfig 收敛为单参数后，越界值仍必须回落到 schema 默认，
+  // 而不是被写进有效配置。
+  it('clamps the numeric stats knobs and fills the remaining defaults', async () => {
+    const routes = makeRoutes({
+      ...deps,
+      config: () => ({ enabled: true, announceToAgent: true, statsWindowDays: -5, statsScanMinutes: 0 }),
+    })
+    const res = new FakeResponse()
+    await routes.find((r) => r.path === SKILL_HUB_API.config)?.handler(fakeReq('GET', SKILL_HUB_API.config), res as never)
+    expect(res.status).toBe(200)
+    const body = res.json() as ConfigResponse
+    expect(body.config.statsWindowDays).toBe(14)
+    expect(body.config.statsScanMinutes).toBe(5)
+  })
+
   // ------------------------------------------------------- repo import (B方案 job+轮询)
   it('imports repo skills and records the upstream source', async () => {
     const skillMd = '---\nname: code-review\ndescription: Reviews code\n---\n\nbody'