dsh-skill-hub 0.3.19 → 0.3.21

package/lib/types/client/api.d.ts

@@ -2,7 +2,7 @@
  * Browser-side API client for the /api/skill-hub route family. The only
  * data access path the panel uses — plain fetch, same origin.
  */
-import { type CatalogResponse, type ConfigResponse, type CreateRequest, type CreateResponse, type DiagnosticFixResponse, type GroupsResponse, type MarketCheckResponse, type MarketSourcesResponse, type MarketSourceVersionsResponse, type MarketStatsResponse, type MarketSyncResponse, type RepoDiscoverResponse, type RepoImportCancelResponse, type RepoImportProgressResponse, type RepoImportResponse, type SkillDetail, type SkillDeleteResponse, type SkillTag, type SourceCheckResponse, type SourceDeleteResponse, type SourceRestoreResponse, type SourceTrashClearResponse, type SourcesResponse, type SourceSyncResponse, type StatsResponse, type TagSaveRequest, type ToggleBatchResponse, type UpdateCheckResponse } from '../protocol.ts';
+import { type CatalogResponse, type ConfigResponse, type CreateRequest, type CreateResponse, type DiagnosticFixResponse, type GroupsResponse, type MarketCheckResponse, type MarketSourceAddResponse, type MarketSourcesResponse, type MarketSourceVersionsResponse, type MarketStatsResponse, type MarketSyncResponse, type RepoDiscoverResponse, type RepoImportCancelResponse, type RepoImportProgressResponse, type RepoImportResponse, type SkillDetail, type SkillDeleteResponse, type SkillTag, type SourceCheckResponse, type SourceDeleteResponse, type SourceRestoreResponse, type SourceTrashClearResponse, type SourcesResponse, type SourceSyncResponse, type StatsResponse, type TagSaveRequest, type ToggleBatchResponse, type UpdateCheckResponse } from '../protocol.ts';
 /** Error carrying the route's JSON error message. */
 export declare class SkillHubApiError extends Error {
     constructor(message: string);
@@ -31,8 +31,8 @@ export declare class SkillHubApi {
     toggleBatch(names: string[], enabled: boolean): Promise<ToggleBatchResponse>;
     /** The user's added market sources. */
     market(): Promise<MarketSourcesResponse>;
-    /** Add a market source repo; resolves with the fresh list. */
-    addMarketSource(repo: string): Promise<MarketSourcesResponse>;
+    /** Add a market source repo; resolves with the fresh list plus the resolved slug. */
+    addMarketSource(repo: string): Promise<MarketSourceAddResponse>;
     /** Remove a market source repo; resolves with the fresh list. */
     removeMarketSource(repo: string): Promise<MarketSourcesResponse>;
     /** Stars + downloads per market source (hourly server-side cache; refresh=1 refetches stale entries). */

package/lib/types/protocol/config.d.ts

@@ -83,13 +83,17 @@ export declare const HUB_CONFIG_DEFAULTS: {
     readonly statsScanMinutes: 5;
 };
 /**
- * Resolve the effective hub config: saved sidecar overrides win over the
- * cordis composition entry (the web card owns runtime config), missing
- * booleans fall back to HUB_CONFIG_DEFAULTS, and dot colors pass through
- * (saved first, then base) only when set. Numeric stats knobs are clamped to
- * their sane ranges (window ≥ 0, scan interval ≥ 1 minute).
+ * Fill a raw settings value into the effective hub config: schema defaults for
+ * anything missing, and the numeric stats knobs clamped to sane ranges
+ * (window ≥ 0, scan interval ≥ 1 minute).
+ *
+ * There is deliberately no "saved sidecar layer" parameter. Until dsh 0.1.7 the
+ * hub kept its own runtime overrides in the sidecar and merged them here; the
+ * settings namespace is now the only user layer (`updateConfig` writes through
+ * `ctx.settings.mutate`), so a merge against a sidecar layer could never
+ * observe anything but `{}` — see the git history of `resolveHubConfig`.
  */
-export declare function resolveHubConfig(saved: Partial<HubConfig>, base?: Partial<HubConfig>): HubConfig;
+export declare function resolveHubConfig(base?: Partial<HubConfig>): HubConfig;
 /**
  * Drop the GitHub token from a config-shaped object. Returns a copy, so the
  * caller's own config layer keeps the token. Shared by the config route's GET
@@ -112,7 +116,13 @@ export interface ConfigResponse {
     /** True when a GitHub token is in effect (saved override or the base/env layer). */
     githubTokenSet: boolean;
 }
-/** POST /api/skill-hub/config — a partial patch; omitted fields keep their values. */
+/**
+ * POST /api/skill-hub/config — a partial patch; omitted fields keep their values.
+ *
+ * Only the fields the handler actually parses belong here: the stats knobs are
+ * owned by the settings namespace (`statsWindowDays` / `statsScanMinutes` are
+ * still part of {@link HubSettingsValue}), not by this route.
+ */
 export interface ConfigRequest {
     /** Set the field; null clears the saved override so it re-inherits the default. */
     enabled?: boolean | null;
@@ -128,10 +138,6 @@ export interface ConfigRequest {
     dotModelColor?: string | null;
     /** Set the dot color; null clears the saved override so it re-inherits the default. */
     dotUserColor?: string | null;
-    /** 统计滚动窗口天数（0 = 全部历史）；null 清除覆盖回默认。 */
-    statsWindowDays?: number | null;
-    /** 自动统计扫描间隔（分钟）；null 清除覆盖回默认。 */
-    statsScanMinutes?: number | null;
     /** Set the GitHub token; null/empty clears it back to anonymous. */
     githubToken?: string | null;
 }

package/lib/types/protocol/market.d.ts

@@ -23,6 +23,17 @@ export interface MarketSourceResponse {
     ok: true;
     repos: MarketSourceRecord[];
 }
+/**
+ * POST /api/skill-hub/market/source — same list, plus the slug the host
+ * resolved from the input. Clients must scan *this* slug rather than assume
+ * the acted-on source sits at some position in `repos`: re-adding a repo the
+ * user already tracks only updates its `ref` in place and never reorders the
+ * list.
+ */
+export interface MarketSourceAddResponse extends MarketSourceResponse {
+    /** Normalized `owner/repo` the host recorded for the submitted input. */
+    repo: string;
+}
 /** POST /api/skill-hub/market/source/ref — pin a market source to an explicit ref. */
 export interface MarketSourceRefRequest {
     repo: string;

package/lib/types/protocol/sources.d.ts

@@ -134,6 +134,11 @@ export interface SourceTrashClearResponse {
         name: string;
         error: string;
     }>;
+    /**
+     * `.trash` 里没有对应记录的残留目录（同名技能先后两次入站时，旧记录被覆盖，
+     * 目录却留了下来）。清空回收站时一并回收，这里上报它们的路径；没有则省略。
+     */
+    orphans?: string[];
 }
 /** 项目级技能来源（它们有 workspace 归属，不属于「个人」组）。 */
 export declare function isProjectSource(source: string): boolean;

package/lib/types/protocol.d.ts

@@ -12,7 +12,7 @@ export type { WritableRoot, HubInvocation, CatalogSkill, DisabledSkill, Diagnost
 export type { SkillStat, StatsResponse, SkillStatsCheckpoint } from './protocol/stats.ts';
 export type { ErrorResponse, HubConfig, HubSettingsValue, RedactedHubConfig, ConfigResponse, ConfigRequest } from './protocol/config.ts';
 export { HUB_CONFIG_DEFAULTS, HUB_ENTRY_ID, HEX_COLOR_RE, GITHUB_TOKEN_RE, resolveHubConfig, redactGithubToken } from './protocol/config.ts';
-export type { MarketSourceRecord, MarketSourcesResponse, MarketSourceRequest, MarketSourceResponse, MarketSourceRefRequest, MarketSourceVersionsResponse, MarketStatsSnapshot, MarketStatsResponse, MarketCheckResponse, MarketSyncResponse, } from './protocol/market.ts';
+export type { MarketSourceRecord, MarketSourcesResponse, MarketSourceRequest, MarketSourceAddResponse, MarketSourceResponse, MarketSourceRefRequest, MarketSourceVersionsResponse, MarketStatsSnapshot, MarketStatsResponse, MarketCheckResponse, MarketSyncResponse, } from './protocol/market.ts';
 export type { RepoSkillEntry, RepoRoot, RepoDiscoverResponse, RepoImportRequest, RepoImportResponse, RepoImportProgressResponse, RepoImportCancelRequest, RepoImportCancelResponse, UpdateCheckResponse, } from './protocol/repo.ts';
 export type { SkillTag, CollectionGroup, GroupsResponse, TagSaveRequest, TagSaveResponse, TagDeleteRequest, TagDeleteResponse, TagMembersRequest, TagMembersResponse, TagReorderRequest, TagReorderResponse, CollectionReorderRequest, CollectionReorderResponse, SourceGroupReorderRequest, SourceGroupReorderResponse, } from './protocol/groups.ts';
 export type { SourceRecord, TrashEntry, SourcesResponse, SourceCheckRequest, SourceCheckResult, SourceCheckResponse, SourceSyncRequest, SourceSyncResponse, SourceDeleteRequest, SourceDeleteResponse, SourceRestoreRequest, SourceRestoreResponse, SourceTrashClearResponse, } from './protocol/sources.ts';

package/lib/types/reconcile.d.ts

@@ -15,6 +15,10 @@ export interface DisabledReconcileStore {
     listDisabled(): Promise<DisabledSkill[]>;
     addDisabled(entry: DisabledSkill): Promise<void>;
 }
+/** Narrow store view used by the reverse reconcile (adds record removal). */
+export interface DisabledPruneStore extends DisabledReconcileStore {
+    removeDisabled(name: string): Promise<void>;
+}
 /**
  * Add sidecar disabled records for every `.disabled` discovery file that has
  * none yet. Existing records (matched by path or by name) win, so this never
@@ -22,3 +26,23 @@ export interface DisabledReconcileStore {
  * in the diagnostics scan instead). Returns the records added.
  */
 export declare function reconcileDisabledSkills(store: DisabledReconcileStore, home?: string): Promise<DisabledSkill[]>;
+/** 反向对账的结果：修好路径的记录 + 被清掉的死记录。 */
+export interface DisabledPruneResult {
+    /** 记录还在、但 path 指向的文件已不在：已改指向现存的 `.disabled` 文件。 */
+    repaired: DisabledSkill[];
+    /** 文件与禁用占位都已不存在：记录已删除，名字被释放。 */
+    removed: string[];
+}
+/**
+ * 反向对账：`reconcileDisabledSkills` 只处理「磁盘有 `.disabled`、sidecar 没记录」。
+ * 反方向（sidecar 有记录、磁盘上那个文件已经不在了）以前永不清理，于是留下一条
+ * 干掉不掉的记录：`/toggle` 启用会 rename 失败，`/create` 被 409 挡住，`/skill/delete`
+ * 也 rename 失败 —— 名字被永久锁死（issue #16 类，实测 G5）。
+ *
+ * 两种处理，都不动启用态技能：
+ * - 名字在该 root 下仍有 `.disabled` 占位（目录包或扁平形态）→ 把记录指向真实文件；
+ * - 一个都没有 → 删记录，把名字还给用户。
+ *
+ * 只处理合法可写 root 的记录；root 值异常（历史损坏数据）时原样保留，不擅自删。
+ */
+export declare function pruneStaleDisabledSkills(store: DisabledPruneStore, home?: string): Promise<DisabledPruneResult>;

package/lib/types/repo/github-client.d.ts

@@ -30,6 +30,14 @@ export declare function githubAuthHeaders(): Record<string, string>;
 export declare const NO_COMPRESSION: Record<string, string>;
 /** JSON API 默认请求头（含鉴权）。 */
 export declare function apiHeaders(): Record<string, string>;
+/**
+ * When the response shows an exhausted GitHub rate limit, the instant it
+ * resets; otherwise undefined. Shared by the repo fetch layer and the plugin's
+ * own update check so both agree on what counts as a rate-limit rejection
+ * (403/429 + `x-ratelimit-remaining: 0` + a parseable `x-ratelimit-reset`)
+ * instead of each re-deriving it from the headers.
+ */
+export declare function rateLimitResetAt(response: Response): Date | undefined;
 /**
  * Build a RepoFetchError; when the response shows an exhausted rate limit,
  * report the reset time instead of a bare HTTP status.
@@ -46,10 +54,9 @@ export declare function fetchJson(url: string, fetchImpl: typeof fetch, context:
     response: Response;
 }>;
 /**
- * Load repo metadata and the recursive git tree at the given ref. The meta
- * request always resolves the default branch (used when ref is absent); the
- * tree is fetched at `ref ?? default_branch` so an explicit branch/tag scans
- * the exact same content a later download would fetch.
+ * Load one JSON document from the GitHub API, reusing an ETag when the URL was
+ * fetched before. `fetchImpl`/`context` exist so callers can stub the transport
+ * and shape the error text; the payload is whatever the endpoint returned.
  */
 export declare function fetchJsonCached(url: string, fetchImpl: typeof fetch, context: string): Promise<{
     json: unknown;

package/lib/types/repo.d.ts

@@ -12,7 +12,7 @@
  * The implementation now lives under `./repo/` (types, discovery, api,
  * install) and this module is a barrel that re-exports it.
  */
-export { NO_COMPRESSION, RepoFetchError, apiHeaders, fetchError, fetchJson, fetchJsonCached, githubAuthHeaders, isAbortError, setGithubToken } from './repo/github-client.ts';
+export { NO_COMPRESSION, RepoFetchError, apiHeaders, fetchError, fetchJson, fetchJsonCached, githubAuthHeaders, isAbortError, rateLimitResetAt, setGithubToken } from './repo/github-client.ts';
 export type { RepoRef, RepoTreeItem, RepoFile } from './repo/types.ts';
 export { REPO_ROOT, isRepoRoot, repoSlug, normalizeRepoInput, collectRepoSkillFiles, originForRoot, discoverRepoEntries, skillManifest, skillDirOf, skillFileAt, skillPathIn, relativeToSkillDir, diffRemoteSkills, repoSkillEntry, } from './repo/discovery.ts';
 export { loadRepoTree, getLatestReleaseTag, getRepoStats, listRepoReleases, listRepoBranches, getLatestCommit, loadRepoTreeAt, } from './repo/api.ts';

package/lib/types/routes/deps.d.ts

@@ -37,7 +37,12 @@ export interface SkillHubRouteDeps {
 }
 /** The resolved hub config a route sees (the shared resolver fills defaults). */
 export declare function configOf(deps: SkillHubRouteDeps): HubConfig;
-/** The raw saved config layer a route reports (empty when the owner omits it). */
+/**
+ * The raw saved config layer as persisted in the sidecar, reported for display
+ * only. Since dsh 0.1.7 the settings namespace is the one user layer, so this
+ * is legacy data: nothing writes it any more and the effective config above
+ * never merges it.
+ */
 export declare function savedOf(deps: SkillHubRouteDeps): Partial<HubConfig>;
 /** Refuse business routes while the master switch is off (the config route stays up). */
 export declare function disabledGate(deps: SkillHubRouteDeps, res: ServerResponse): boolean;

package/lib/types/routes/route-state.d.ts

@@ -54,5 +54,25 @@ export declare const importJobs: Map<string, ImportJob>;
 export declare const IMPORT_JOB_TTL_MS: number;
 export declare const IMPORT_JOB_MAX = 100;
 export declare function gcImportJobs(): void;
-/** Replace one skill directory with a fresh download; restores the old dir on failure. */
-export declare function replaceSkillDir(targetDir: string, download: () => Promise<void>): Promise<void>;
+/**
+ * Replace whatever currently occupies a skill slot with a fresh download;
+ * restores the previous state on failure.
+ *
+ * `target` is the entry to move aside — a bundle **directory** or a flat
+ * `<name>.md` file, whichever the download is replacing (the rename/rm below
+ * are form-neutral). The backup is dot-prefixed (discovery skips dot entries),
+ * so even a failed cleanup can never register as a duplicate skill.
+ */
+export declare function replaceInPlace(target: string, download: () => Promise<unknown>): Promise<void>;
+/**
+ * 让位：把一个名字下的「非启用态占位」移入回收站并清掉它的 sidecar 禁用记录。
+ * 只动这两类，**启用的技能一律不碰**：
+ * - 禁用发现文件（`<name>/SKILL.md.disabled` 或 `<name>.md.disabled`，两种形态都认）；
+ * - 同名目录存在但既无 `SKILL.md` 也无 `SKILL.md.disabled`（导入中断/手工删除的空壳）。
+ *
+ * 回收站按名字索引，所以多形态只会记下最后一条的恢复指针；其余的那份会在
+ * 「清空回收站」时被孤儿回收扫掉（见 sourceTrashClear）。
+ *
+ * @returns 被移入回收站的路径列表，没有可让位的东西时 undefined。
+ */
+export declare function retireNamePlaceholders(deps: SkillHubRouteDeps, base: string, name: string): Promise<string[] | undefined>;

package/lib/types/skillfs/scan.d.ts

@@ -1,4 +1,4 @@
-import type { DiagnosticEntry, WritableRoot } from '../protocol.ts';
+import { type DiagnosticEntry, type WritableRoot } from '../protocol.ts';
 /** One discoverable skill file in a scanned root. */
 export interface SkillEntry {
     /** Absolute path of the discovery file (SKILL.md or the flat .md). */
@@ -39,9 +39,36 @@ export declare function readSkillInterface(directory: string): Promise<SkillInte
  */
 export declare function findProjectRoot(cwd: string): Promise<string>;
 /**
- * Scan one writable root for files the provider ignores, so the GUI can
- * show why a skill never appears — a
- * missing frontmatter must be visible, not silent). .disabled files belong
- * to the hub and are skipped.
+ * Scan one writable root for files the provider ignores, so the GUI can show
+ * why a skill never appears — a missing frontmatter, a name that disagrees
+ * with the discovery path, and the like must be visible, not silent. Files the
+ * hub itself disabled (`.disabled`) are skipped: they are a toggle state, not
+ * a defect.
  */
 export declare function scanDiagnostics(root: WritableRoot, home?: string): Promise<DiagnosticEntry[]>;
+/**
+ * 某个名字在一个 root 下现存的禁用发现文件（两种形态都认），没有则 undefined。
+ * 目录包形态优先（`<name>/SKILL.md.disabled`），其次扁平 `<name>.md.disabled`。
+ * 单点定义「禁用态在磁盘上长什么样」，避免各处再拼一次路径（issue #16 类）。
+ */
+export declare function disabledOccupancyIn(base: string, name: string): Promise<string | undefined>;
+/**
+ * 一个名字在某个 root 下的全部磁盘占位。技能名是系统里唯一的身份，但同一个名字
+ * 可以被两种形态（目录包 `<name>/SKILL.md` / 扁平 `<name>.md`）× 两种状态
+ * （启用 / `.disabled` 改名）占据，而且两种形态可以**同时存在** —— 注册表只会
+ * 给出其中一个，另一个静默不可达。所有按名字操作文件的路径都应该从这里取值，
+ * 而不是各自拼一次路径（issue #16 类的根因）。
+ *
+ * 两个数组都按「目录包优先」排序：目录包是 hub 自己写入的形态（导入、创建、
+ * 同步都建目录包），冲突时它是更「权威」的那份。
+ */
+export interface NameOccupancy {
+    /** 启用态发现文件（目录包 `<name>/SKILL.md` 在前，扁平 `<name>.md` 在后）。 */
+    enabled: string[];
+    /** 禁用态发现文件（`<name>/SKILL.md.disabled` 在前，`<name>.md.disabled` 在后）。 */
+    disabled: string[];
+    /** `<name>/` 存在，但既没有 `SKILL.md` 也没有 `SKILL.md.disabled`（空壳/残留目录）。 */
+    bareDir?: string;
+}
+/** 读一个名字在某个 skills root 下的全部占位。只读，不修改磁盘。 */
+export declare function occupancyOf(base: string, name: string): Promise<NameOccupancy>;

package/lib/types/skillfs.d.ts

@@ -29,11 +29,35 @@ export declare function createSkill(root: WritableRoot, name: string, descriptio
 export declare function disableSkill(path: string): Promise<string>;
 /** Re-enable a previously disabled file (reverse of disableSkill). */
 export declare function enableSkill(disabledPath: string): Promise<string>;
+/**
+ * Move one already-resolved skill (a bundle directory or a flat .md file) into
+ * its root's trash as `<root>/.trash/<name>-<timestamp>`.
+ *
+ * The layout is the restore contract, not an implementation detail:
+ * `restoreSkill` renames the entry back and only proves the parent is `.trash`,
+ * and `clearTrash` deletes in place. Every producer of a trash entry must go
+ * through here — skill delete, the hub-disabled whole-group delete, and repo
+ * import's placeholder replacement all move skills for the same recovery flow.
+ *
+ * @returns the trashed path plus the original path that was moved.
+ */
+export declare function moveIntoTrash(source: string): Promise<{
+    path: string;
+    source: string;
+}>;
+/**
+ * The filesystem entry behind a discovery file: a directory bundle is addressed
+ * by its `SKILL.md` (or `SKILL.md.disabled`) and moved as a whole directory, a
+ * flat `<name>.md` file is moved as itself. Single definition of that mapping —
+ * delete, restore, sync-replace and placeholder retirement must all agree on it,
+ * or one of them moves a bundle's discovery file and leaves an empty directory.
+ */
+export declare function trashSourceOf(discoveryPath: string): string;
 /**
  * Move a skill (directory bundle or flat .md file) into the root's trash.
  * The skill stays recoverable: the source is renamed into
  * <root>/.trash/<name>-<timestamp>. A directory bundle is addressed by its
- * SKILL.md path and moved as a whole directory.
+ * SKILL.md (or SKILL.md.disabled) path and moved as a whole directory.
  * @returns the trashed path plus the original path that was moved.
  */
 export declare function trashSkill(sourcePath: string): Promise<{
@@ -44,5 +68,13 @@ export declare function trashSkill(sourcePath: string): Promise<{
 export declare function restoreSkill(entry: TrashEntry, home?: string): Promise<string>;
 /** Permanently delete one trashed skill (directory or flat file). */
 export declare function clearTrash(entry: TrashEntry, home?: string): Promise<string>;
-/** Repair one file on disk when its frontmatter is auto-fixable. Returns the new text. */
+/**
+ * Repair one file on disk when its frontmatter is auto-fixable. Returns the new text.
+ *
+ * The write is atomic (sibling temp file + rename), matching the sidecar's
+ * persist path: this rewrites a real skill file in place, and a crash midway
+ * through a plain write would leave a truncated SKILL.md — exactly the failure
+ * the store layer already guards against. The `.tmp` sibling is never picked
+ * up by discovery (only `SKILL.md` and `*.md` are scanned).
+ */
 export declare function fixDiagnosticFile(path: string, home?: string): Promise<string>;

package/lib/types/store/migrate.d.ts

@@ -31,7 +31,7 @@ export interface HydratedState {
     tagsById: Map<string, SkillTag>;
     sourcesByRepo: Map<string, SourceRecord>;
     marketSources: MarketSourceRecord[];
-    trashByName: Map<string, TrashEntry>;
+    trashByPath: Map<string, TrashEntry>;
     skillStats: SkillStatsCheckpoint | undefined;
     marketStats: MarketStatsSnapshot | undefined;
     collectionOrder: string[];

package/lib/types/store/store.d.ts

@@ -7,7 +7,7 @@ export declare class SkillHubStore {
     private tagsById;
     private sourcesByRepo;
     private marketSources;
-    private trashByName;
+    private trashByPath;
     private skillStats;
     private marketStats;
     private collectionOrder;
@@ -119,12 +119,17 @@ export declare class SkillHubStore {
     setMarketSourceCommit(repo: string, commitSha: string): Promise<void>;
     /** All trashed skills, newest first. */
     listTrash(): Promise<TrashEntry[]>;
-    /** One trash entry by skill name (undefined when absent). */
+    /** One trash entry by skill name — the newest when a name has several. */
     getTrash(name: string): Promise<TrashEntry | undefined>;
-    /** Record a trashed skill. */
+    /**
+     * Record a trashed skill, keyed by its trashed path. Keying by name used to
+     * silently drop the previous record when the same name landed in the trash
+     * twice (a re-delete, or the two on-disk discovery forms), orphaning its
+     * directory with nothing left pointing at it.
+     */
     addTrash(entry: TrashEntry): Promise<void>;
-    /** Remove a trash record (after restore). */
-    removeTrash(name: string): Promise<void>;
+    /** Remove a trash record by its trashed path (after restore or permanent clear). */
+    removeTrash(path: string): Promise<void>;
     /** The persisted usage-statistics checkpoint (undefined until first saved). */
     getSkillStatsState(): Promise<SkillStatsCheckpoint | undefined>;
     /** Persist a usage-statistics checkpoint (after every completed scan; cadence follows the scan TTL). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {
@@ -66,7 +66,8 @@
         "0.1.7-rc.1",
         "0.1.7-rc.2",
         "0.2.0-rc.1",
-        "0.2.0-rc.2"
+        "0.2.0-rc.2",
+        "0.2.1-alpha.2"
       ]
     },
     "capability": {
@@ -86,7 +87,7 @@
     "js-yaml": "^4.1.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2",
+    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2 || ^4.0.5-alpha.1",
     "@deepseek-ai/dsh-client-connection": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-locale": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-runtime": ">=0.1.7-alpha.1 <0.3.0-0",
@@ -100,7 +101,7 @@
     "@deepseek-ai/dsh-settings": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-skill": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-system-prompt": ">=0.1.7-alpha.1 <0.3.0-0",
-    "@deepseek-ai/schemastery": "^3.18.3",
+    "@deepseek-ai/schemastery": "^3.18.3 || ^3.18.5-alpha.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
@@ -113,22 +114,22 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-client-connection": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-locale": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-store": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-query": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-settings": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-skill": "^0.2.0-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.3",
+    "@deepseek-ai/cordis": "^4.0.5-alpha.1",
+    "@deepseek-ai/dsh-client-connection": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-store": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-query": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-skill": "^0.2.1-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.2.1-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.5-alpha.1",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",

package/src/client/api.ts

@@ -12,6 +12,7 @@ import {
   type DiagnosticFixResponse,
   type GroupsResponse,
   type MarketCheckResponse,
+  type MarketSourceAddResponse,
   type MarketSourceRefRequest,
   type MarketSourceRequest,
   type MarketSourceResponse,
@@ -156,9 +157,9 @@ export class SkillHubApi {
     return this.get<MarketSourcesResponse>(SKILL_HUB_API.market)
   }
 
-  /** Add a market source repo; resolves with the fresh list. */
-  addMarketSource(repo: string): Promise<MarketSourcesResponse> {
-    return this.post<MarketSourceResponse>(SKILL_HUB_API.marketSource, { repo } satisfies MarketSourceRequest)
+  /** Add a market source repo; resolves with the fresh list plus the resolved slug. */
+  addMarketSource(repo: string): Promise<MarketSourceAddResponse> {
+    return this.post<MarketSourceAddResponse>(SKILL_HUB_API.marketSource, { repo } satisfies MarketSourceRequest)
   }
 
   /** Remove a market source repo; resolves with the fresh list. */

package/src/client/panel/hooks/useMarketFlow.ts

@@ -75,8 +75,10 @@ export function useMarketFlow(
       setNewSourceName('')
       setRepoResult(null)
       setRepoSelected(new Set())
-      // 用服务端归一化后的 slug 扫描（URL/owner@repo 输入都能对上记录）。
-      const slug = result.repos[result.repos.length - 1].repo
+      // 用服务端回传的归一化 slug 扫描（URL/owner@repo 输入都能对上记录）。
+      // 不能猜 `repos` 的位置：重复添加一个已存在的源只改它的 ref、不重排，
+      // 取末位会扫到另一个源。
+      const slug = result.repo
       setScanningRepo(slug)
       setRepoDiscoverState({ status: 'scanning' })
       try {

package/src/client/settings-card.tsx

@@ -10,6 +10,7 @@ import { useState, type ReactElement } from 'react'
 import { IconChevronDownOutline14 } from './icons.tsx'
 import type { HubKey } from './locales.ts'
 import type { CardShell } from './settings-form.ts'
+import { HEX_COLOR_RE } from '../protocol.ts'
 import css from './settings-card.module.css'
 
 /** Card-level chrome props. */
@@ -178,7 +179,7 @@ export interface ColorFieldProps extends FieldBaseProps {
 }
 
 export function ColorField(props: ColorFieldProps): ReactElement {
-  const value = /^#[0-9a-f]{6}$/i.test(props.text) ? props.text : props.defaultColor
+  const value = HEX_COLOR_RE.test(props.text) ? props.text : props.defaultColor
   return (
     <div className={css.field}>
       <FieldShell {...props} />

package/src/client/settings-form.ts

@@ -10,6 +10,9 @@
  */
 
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+// One definition of what a valid color/token looks like, shared with the host
+// routes that re-validate the same drafts.
+import { GITHUB_TOKEN_RE, HEX_COLOR_RE } from '../protocol.ts'
 
 /** One staged field: its draft text plus the clear/reset marker. */
 interface StagedEdit {
@@ -41,9 +44,9 @@ export function booleanField(field: string): FieldSpec {
 export function colorField(field: string): FieldSpec {
   return {
     field,
-    format: (value) => (typeof value === 'string' && /^#[0-9a-f]{6}$/i.test(value) ? value : ''),
+    format: (value) => (typeof value === 'string' && HEX_COLOR_RE.test(value) ? value : ''),
     parse: (text) => {
-      if (/^#[0-9a-f]{6}$/i.test(text)) return { kind: 'set', value: text }
+      if (HEX_COLOR_RE.test(text)) return { kind: 'set', value: text }
       return undefined
     },
   }
@@ -61,7 +64,7 @@ export function secretField(field: string): FieldSpec {
     parse: (text) => {
       const trimmed = text.trim()
       if (trimmed === '') return undefined
-      if (!/^[A-Za-z0-9_-]{8,255}$/.test(trimmed)) return undefined
+      if (!GITHUB_TOKEN_RE.test(trimmed)) return undefined
       return { kind: 'set', value: trimmed }
     },
   }

package/src/index.ts

@@ -24,7 +24,7 @@ import { SkillHubProvider } from './provider.ts'
 import { makeRoutes } from './routes.ts'
 import { createSkillStatsReader, asPersistenceSeam, type SessionPersistenceLike, type SessionQueryLike, type SkillStatsReader } from './stats.ts'
 import { SkillHubStore } from './store.ts'
-import { reconcileDisabledSkills } from './reconcile.ts'
+import { reconcileDisabledSkills, pruneStaleDisabledSkills } from './reconcile.ts'
 import { cleanupLeftoverImportDirs, setGithubToken } from './repo.ts'
 import { dshHome } from './store.ts'
 import { join } from 'node:path'
@@ -163,7 +163,7 @@ export function apply(ctx: Context, config?: Config): void {
     }
     return out as Partial<HubConfig>
   }
-  const current = (): HubConfig => resolveHubConfig({}, readConfig())
+  const current = (): HubConfig => resolveHubConfig(readConfig())
 
   /** The Settings service, when this deployment mounts it. Absent ⇒ no user layer to read or write. */
   const settingsOf = (): SettingsForms | undefined => ctx.get('settings') as SettingsForms | undefined
@@ -307,6 +307,16 @@ export function apply(ctx: Context, config?: Config): void {
     } catch (error) {
       ctx.logger.warn('[dsh-skill-hub] startup disabled-skill reconcile failed', error)
     }
+    // 反向对账：记录还在、文件已不在 → 修路径或删记录。不做这一步，那条记录会
+    // 把名字永久锁死（启用/新建/删除三条路都失败）。
+    try {
+      const pruned = await pruneStaleDisabledSkills(store, home)
+      if (pruned.repaired.length > 0 || pruned.removed.length > 0) {
+        ctx.logger.info(`[dsh-skill-hub] startup pruned disabled records: repaired ${pruned.repaired.length} (${pruned.repaired.map((entry) => entry.name).join(', ') || '-'}), removed ${pruned.removed.length} (${pruned.removed.join(', ') || '-'})`)
+      }
+    } catch (error) {
+      ctx.logger.warn('[dsh-skill-hub] startup disabled-record prune failed', error)
+    }
   })()
 
   void (async () => {