dsh-skill-hub 0.3.25 → 0.3.27

package/CONTRIBUTING.md

@@ -39,7 +39,7 @@ src/client/locales/     dictionaries by view (common/skills/market/sources/detai
 ```bash
 npm install
 npm run typecheck   # tsc --noEmit
-npm test            # vitest (294 tests across 16 suites)
+npm test            # vitest (295 tests across 16 suites)
 npm run build       # tsc declarations + tsdown bundles (lib/index.js + lib/client.js)
 ```
 

package/README.md

@@ -24,7 +24,7 @@ dsh plugin --profile web add dsh-skill-hub
 # restart dsh web → Settings → 技能 → Market → scan → import
 ```
 
-Requires `Node ^22.19 || >=24` + dsh web `>=0.1.7-alpha.1 <0.3`.
+Requires `Node ^22.19 || >=24` + dsh web `>=0.1.7-alpha.1 <0.3`. dsh `0.2.2` and later require `Node >=24.9`.
 
 Two surfaces — the hub panel lives at **Settings → 技能**, and this plugin's own configuration card sits on the plugin's page in the **Plugins manager** (sidebar → 插件 → dsh-skill-hub). The card is registered by the plugin itself into the `plugins.bundle.config` slot — dsh has no auto-generated config page — and covers the master switch, announce-to-agent, dot colors, usage display and the stats window/interval.
 
@@ -108,7 +108,7 @@ Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemP
 
 ```bash
 npm run typecheck  # tsc --noEmit
-npm test           # 294 tests, 16 suites
+npm test           # 295 tests, 16 suites
 npm run build      # tsc + tsdown → lib/index.js + lib/client.js
 ```
 

package/README.zh.md

@@ -24,7 +24,7 @@ dsh plugin --profile web add dsh-skill-hub
 # 重启 dsh web → 设置 → 技能 → 市场 → 扫描 → 导入
 ```
 
-要求 `Node ^22.19 || >=24` + dsh web `>=0.1.7-alpha.1 <0.3`。
+要求 `Node ^22.19 || >=24` + dsh web `>=0.1.7-alpha.1 <0.3`。dsh `0.2.2` 起要求 `Node >=24.9`。
 
 两个界面 —— 管理面板在 **设置 → 技能**；本插件自身的配置卡片在 **插件管理页** 的插件自有页面上（侧边栏「插件」→ dsh-skill-hub）。该卡片由本插件自己注册进 `plugins.bundle.config` 槽位（dsh 没有自动生成的配置页），覆盖总开关、向 Agent 公告、圆点颜色、用量显示与统计窗口/间隔。
 
@@ -108,7 +108,7 @@ GitHub 仓库 ──扫描/导入──▶ ~/.dsh/skills
 
 ```bash
 npm run typecheck  # tsc --noEmit
-npm test           # 294 tests, 16 suites
+npm test           # 295 tests, 16 suites
 npm run build      # tsc + tsdown → lib/index.js + lib/client.js
 ```
 

package/lib/index.js

@@ -937,6 +937,17 @@ var SkillHubStore = class {
 	* Upsert one skill into a source record. When the repo has no record yet a
 	* new one is created (root + commit snapshot from the caller).
 	*/
+	/**
+	* Record one imported skill in its repo-level source row.
+	*
+	* A repo owns exactly one source row, hence one pinned ref, so a later import
+	* must re-pin it: keeping the first import's `ref` / `commitSha` makes
+	* `sources/check` compare against a stale sha and `sources/sync` re-download
+	* the old ref over content that was imported from a tag — the "pinning a tag
+	* means nothing" failure of issue #15, reached through the bookkeeping
+	* instead of the download. An absent `ref` means the import ran on the
+	* default branch, which clears the pin rather than silently keeping it.
+	*/
 	async addSourceSkill(repo, root, commitSha, ref, skillName) {
 		await this.ensureLoaded();
 		const existing = this.sourcesByRepo.get(repo);
@@ -949,10 +960,14 @@ var SkillHubStore = class {
 		});
 		else {
 			const skills = existing.skills.includes(skillName) ? existing.skills : [...existing.skills, skillName].sort((a, b) => a.localeCompare(b));
-			this.sourcesByRepo.set(repo, {
+			const next = {
 				...existing,
 				skills
-			});
+			};
+			if (ref !== void 0 && ref !== "") next.ref = ref;
+			else delete next.ref;
+			if (commitSha !== "") next.commitSha = commitSha;
+			this.sourcesByRepo.set(repo, next);
 		}
 		await this.persist();
 	}

package/lib/types/store/store.d.ts

@@ -83,6 +83,17 @@ export declare class SkillHubStore {
      * Upsert one skill into a source record. When the repo has no record yet a
      * new one is created (root + commit snapshot from the caller).
      */
+    /**
+     * Record one imported skill in its repo-level source row.
+     *
+     * A repo owns exactly one source row, hence one pinned ref, so a later import
+     * must re-pin it: keeping the first import's `ref` / `commitSha` makes
+     * `sources/check` compare against a stale sha and `sources/sync` re-download
+     * the old ref over content that was imported from a tag — the "pinning a tag
+     * means nothing" failure of issue #15, reached through the bookkeeping
+     * instead of the download. An absent `ref` means the import ran on the
+     * default branch, which clears the pin rather than silently keeping it.
+     */
     addSourceSkill(repo: string, root: string, commitSha: string, ref: string | undefined, skillName: string): Promise<void>;
     /** Replace a source's skill list (used after sync/confirm-delete). */
     setSourceSkills(repo: string, skills: readonly string[]): Promise<SourceRecord | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.25",
+  "version": "0.3.27",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {
@@ -68,7 +68,9 @@
         "0.2.0-rc.1",
         "0.2.0-rc.2",
         "0.2.1-alpha.2",
-        "0.2.1-alpha.5"
+        "0.2.1-alpha.5",
+        "0.2.1-rc.2",
+        "0.2.2-alpha.2"
       ]
     },
     "capability": {
@@ -88,7 +90,7 @@
     "js-yaml": "^4.1.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2 || ^4.0.5-alpha.1 || ^4.0.5-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.1 || ^4.0.2 || ^4.0.5-alpha.1 || ^4.0.5-alpha.2 || ^4.0.6-alpha.1",
     "@deepseek-ai/dsh-client-connection": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-locale": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-client-runtime": ">=0.1.7-alpha.1 <0.3.0-0",
@@ -102,7 +104,7 @@
     "@deepseek-ai/dsh-settings": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-skill": ">=0.1.7-alpha.1 <0.3.0-0",
     "@deepseek-ai/dsh-system-prompt": ">=0.1.7-alpha.1 <0.3.0-0",
-    "@deepseek-ai/schemastery": "^3.18.3 || ^3.18.5-alpha.1 || ^3.18.5-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.3 || ^3.18.5-alpha.1 || ^3.18.5-alpha.2 || ^3.18.6-alpha.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
@@ -115,22 +117,22 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.5-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-locale": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-store": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-host-webserver": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-session": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-session-query": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-settings": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-skill": "^0.2.1-alpha.5",
-    "@deepseek-ai/dsh-system-prompt": "^0.2.1-alpha.5",
-    "@deepseek-ai/schemastery": "^3.18.5-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.6-alpha.1",
+    "@deepseek-ai/dsh-client-connection": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-store": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session-query": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-settings": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-skill": "^0.2.2-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.2.2-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.6-alpha.1",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",

package/src/store/store.ts

@@ -282,6 +282,17 @@ export class SkillHubStore {
    * Upsert one skill into a source record. When the repo has no record yet a
    * new one is created (root + commit snapshot from the caller).
    */
+  /**
+   * Record one imported skill in its repo-level source row.
+   *
+   * A repo owns exactly one source row, hence one pinned ref, so a later import
+   * must re-pin it: keeping the first import's `ref` / `commitSha` makes
+   * `sources/check` compare against a stale sha and `sources/sync` re-download
+   * the old ref over content that was imported from a tag — the "pinning a tag
+   * means nothing" failure of issue #15, reached through the bookkeeping
+   * instead of the download. An absent `ref` means the import ran on the
+   * default branch, which clears the pin rather than silently keeping it.
+   */
   async addSourceSkill(repo: string, root: string, commitSha: string, ref: string | undefined, skillName: string): Promise<void> {
     await this.ensureLoaded()
     const existing = this.sourcesByRepo.get(repo)
@@ -295,7 +306,11 @@ export class SkillHubStore {
       })
     } else {
       const skills = existing.skills.includes(skillName) ? existing.skills : [...existing.skills, skillName].sort((a, b) => a.localeCompare(b))
-      this.sourcesByRepo.set(repo, { ...existing, skills })
+      const next: SourceRecord = { ...existing, skills }
+      if (ref !== undefined && ref !== '') next.ref = ref
+      else delete next.ref
+      if (commitSha !== '') next.commitSha = commitSha
+      this.sourcesByRepo.set(repo, next)
     }
     await this.persist()
   }

package/src/store.test.ts

@@ -125,6 +125,31 @@ describe('SkillHubStore', () => {
     expect(again[0].manifest).toEqual({ 'skills/docx/SKILL.md': 120 })
   })
 
+  // issue #15 follow-up: one repo owns one source row, hence one pinned ref, so
+  // a later import must re-pin it. Keeping the first import's ref/sha made
+  // `check` compare a stale sha and `sync` re-download the old ref over
+  // tag-pinned content — the same "pinning a tag means nothing" failure.
+  it('re-pins the source to the ref and sha of the latest import', async () => {
+    await store.addSourceSkill('a/b', 'skills', 'sha-main', 'main', 'one')
+    expect(await store.getSource('a/b')).toMatchObject({ ref: 'main', commitSha: 'sha-main' })
+
+    await store.addSourceSkill('a/b', 'skills', 'sha-tag', 'v1.2.0', 'two')
+    expect(await store.getSource('a/b')).toMatchObject({ ref: 'v1.2.0', commitSha: 'sha-tag', skills: ['one', 'two'] })
+
+    // An import from the default branch clears the pin instead of keeping it.
+    await store.addSourceSkill('a/b', 'skills', 'sha-default', undefined, 'three')
+    const unpinned = await store.getSource('a/b')
+    expect(unpinned?.ref).toBeUndefined()
+    expect(unpinned?.commitSha).toBe('sha-default')
+    expect(unpinned?.skills).toEqual(['one', 'three', 'two'])
+
+    // The cleared pin survives the sidecar round trip.
+    const reloaded = new SkillHubStore(file)
+    const persisted = await reloaded.getSource('a/b')
+    expect(persisted?.ref).toBeUndefined()
+    expect(persisted?.commitSha).toBe('sha-default')
+  })
+
   it('drops only the given skill directory from the baseline', async () => {
     await store.addSourceSkill('a/b', 'skills', 'sha-1', undefined, 'docx')
     await store.addSourceSkill('a/b', 'skills', 'sha-1', undefined, 'pdf')