dsh-skill-hub 0.3.6 → 0.3.8

package/lib/index.js

@@ -6,13 +6,7 @@ import { homedir } from "node:os";
 import { dump, load } from "js-yaml";
 import { isSkillName } from "@deepseek-ai/dsh-skill";
 import { randomUUID } from "node:crypto";
-//#region src/protocol.ts
-/**
-* Shared API contract for dsh-skill-hub: the route paths and payload shapes
-* both the host half and the browser half import. The browser half must never
-* depend on host SDK packages, so registry types are re-spelled here as
-* plain JSON-safe interfaces.
-*/
+//#region src/protocol/api.ts
 /** Browser-facing base paths of the skill-hub API family. */
 const SKILL_HUB_API = {
 	catalog: "/api/skill-hub/catalog",
@@ -46,8 +40,13 @@ const SKILL_HUB_API = {
 	sourceSync: "/api/skill-hub/sources/sync",
 	sourceDelete: "/api/skill-hub/sources/delete",
 	sourceRestore: "/api/skill-hub/sources/restore",
-	sourceTrashClear: "/api/skill-hub/sources/trash/clear"
+	sourceTrashClear: "/api/skill-hub/sources/trash/clear",
+	diagnosticFix: "/api/skill-hub/diagnostic/fix",
+	marketSourceVersions: "/api/skill-hub/market/source/versions",
+	marketStats: "/api/skill-hub/market/stats"
 };
+//#endregion
+//#region src/protocol/config.ts
 /**
 * Hub config defaults — the single source every layer reads: the cordis
 * schema (index.ts), the host's saved-override merge, and the routes'
@@ -72,6 +71,7 @@ const HUB_CONFIG_DEFAULTS = {
 function resolveHubConfig(saved, base = {}) {
 	const dotModelColor = saved.dotModelColor !== void 0 ? saved.dotModelColor : base.dotModelColor;
 	const dotUserColor = saved.dotUserColor !== void 0 ? saved.dotUserColor : base.dotUserColor;
+	const githubToken = saved.githubToken !== void 0 ? saved.githubToken : base.githubToken;
 	const windowDays = clampNumber(saved.statsWindowDays ?? base.statsWindowDays, 0) ?? HUB_CONFIG_DEFAULTS.statsWindowDays;
 	const scanMinutes = clampNumber(saved.statsScanMinutes ?? base.statsScanMinutes, 1) ?? HUB_CONFIG_DEFAULTS.statsScanMinutes;
 	return {
@@ -83,7 +83,8 @@ function resolveHubConfig(saved, base = {}) {
 		statsWindowDays: windowDays,
 		statsScanMinutes: scanMinutes,
 		...dotModelColor !== void 0 ? { dotModelColor } : {},
-		...dotUserColor !== void 0 ? { dotUserColor } : {}
+		...dotUserColor !== void 0 ? { dotUserColor } : {},
+		...githubToken !== void 0 ? { githubToken } : {}
 	};
 }
 /** Clamp a numeric override into a valid value; undefined/invalid stays undefined. */
@@ -93,25 +94,16 @@ function clampNumber(value, min) {
 }
 /** HEX color validation shared by host routes and the settings card. */
 const HEX_COLOR_RE = /^#[0-9a-f]{6}$/i;
+/** GitHub token validation shared by host routes and the settings card. */
+const GITHUB_TOKEN_RE = /^[A-Za-z0-9_\-]{8,255}$/;
+//#endregion
+//#region src/protocol/sources.ts
 /** 项目级技能来源（它们有 workspace 归属，不属于「个人」组）。 */
 function isProjectSource(source) {
 	return source === "project-dsh" || source === "project-agents";
 }
 //#endregion
-//#region src/store.ts
-/**
-* Hub sidecar store: remembers which skills the hub toggled off and the
-* user's organization/tracking records. Disabling renames the skill's
-* SKILL.md (or flat .md) out of the filesystem provider's discovery shapes,
-* so the provider catalog alone cannot see disabled skills; this store keeps
-* name/path/root so the GUI can list them and re-enable. It also persists
-* user tag groups, upstream source records (repo + commit snapshot for
-* update checks), the market source list, and the trash (skills removed
-* after upstream deletion).
-*
-* State file: $DSH_HOME/dsh-skill-hub.json — a small JSON document written
-* atomically (tmp file + rename).
-*/
+//#region src/store/paths.ts
 /** 默认场景名（系统预置的兜底场景，新技能自动归入）。 */
 const DEFAULT_SCENE_NAME = "通用";
 /** Resolve the DSH home directory (the filesystem provider's user-dsh root base). */
@@ -122,6 +114,8 @@ function dshHome() {
 function statePath(home = dshHome()) {
 	return join(home, "dsh-skill-hub.json");
 }
+//#endregion
+//#region src/store/errors.ts
 /**
 * Business-rule failure the routes layer can map onto a 4xx status instead
 * of a blanket 500: user input is invalid (validation → 400), the target
@@ -136,6 +130,8 @@ var StoreError = class extends Error {
 		this.kind = kind;
 	}
 };
+//#endregion
+//#region src/store/migrate.ts
 /**
 * Normalize an arbitrary parsed sidecar document to the current schema.
 * v1 to v2: scenes are dropped (the one-click role merged into group
@@ -182,10 +178,152 @@ function migrateStore(parsed) {
 		...marketSources !== void 0 ? { marketSources } : {},
 		...trash !== void 0 ? { trash } : {},
 		...record.skillStats !== void 0 ? { skillStats: record.skillStats } : {},
+		...record.marketStats !== void 0 ? { marketStats: record.marketStats } : {},
 		...Array.isArray(record.collectionOrder) ? { collectionOrder: record.collectionOrder } : {},
 		...Array.isArray(record.sourceGroupOrder) ? { sourceGroupOrder: record.sourceGroupOrder } : {}
 	};
 }
+/** 小优化：统一的非空字符串数组清洗（去空、去重可选由调用方处理）。 */
+function cleanStringList(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter((n) => typeof n === "string" && n !== "");
+}
+/**
+* 把迁移后的原始文档校验为内存状态：坏条目丢弃、坏桶降级为空，
+* 绝不因一条脏数据丢掉整个 sidecar（与原 ensureLoaded 内联逻辑一致）。
+*/
+function hydrateMigratedState(migrated) {
+	const entries = /* @__PURE__ */ new Map();
+	if (Array.isArray(migrated.disabled)) {
+		for (const entry of migrated.disabled) if (typeof entry?.name === "string" && typeof entry?.path === "string") entries.set(entry.name, entry);
+	}
+	const config = {};
+	const saved = migrated.config;
+	if (typeof saved === "object" && saved !== null) {
+		if (typeof saved.enabled === "boolean") config.enabled = saved.enabled;
+		if (typeof saved.announceToAgent === "boolean") config.announceToAgent = saved.announceToAgent;
+		if (typeof saved.dotModelColor === "string" && saved.dotModelColor !== "") config.dotModelColor = saved.dotModelColor;
+		if (typeof saved.dotUserColor === "string" && saved.dotUserColor !== "") config.dotUserColor = saved.dotUserColor;
+		if (typeof saved.showUseCount === "boolean") config.showUseCount = saved.showUseCount;
+		if (typeof saved.showUseTime === "boolean") config.showUseTime = saved.showUseTime;
+		if (typeof saved.showGroupSummary === "boolean") config.showGroupSummary = saved.showGroupSummary;
+	}
+	const tagsById = /* @__PURE__ */ new Map();
+	if (Array.isArray(migrated.tags)) for (const entry of migrated.tags) {
+		const tag = entry;
+		if (tag !== null && typeof tag === "object" && typeof tag.id === "string" && typeof tag.name === "string" && Array.isArray(tag.skillNames)) tagsById.set(tag.id, {
+			id: tag.id,
+			name: tag.name,
+			skillNames: tag.skillNames.filter((n) => typeof n === "string"),
+			...tag.default === true ? { default: true } : {}
+		});
+	}
+	const sourcesByRepo = /* @__PURE__ */ new Map();
+	if (Array.isArray(migrated.sources)) for (const entry of migrated.sources) {
+		const source = entry;
+		if (source !== null && typeof source === "object" && typeof source.repo === "string" && source.repo !== "" && Array.isArray(source.skills)) {
+			const manifest = source.manifest;
+			const rawRoot = typeof source.root === "string" && source.root !== "" && /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(source.root) ? source.root : "skills";
+			sourcesByRepo.set(source.repo, {
+				repo: source.repo,
+				...typeof source.ref === "string" && source.ref !== "" ? { ref: source.ref } : {},
+				root: rawRoot,
+				commitSha: typeof source.commitSha === "string" ? source.commitSha : "",
+				skills: source.skills.filter((n) => typeof n === "string"),
+				...manifest !== null && typeof manifest === "object" && !Array.isArray(manifest) ? { manifest: Object.fromEntries(Object.entries(manifest).filter(([, size]) => typeof size === "number")) } : {}
+			});
+		}
+	}
+	const marketSources = [];
+	if (Array.isArray(migrated.marketSources)) for (const entry of migrated.marketSources) {
+		const item = entry;
+		if (item !== null && typeof item === "object" && typeof item.repo === "string" && item.repo !== "" && !marketSources.some((s) => s.repo === item.repo)) marketSources.push({
+			repo: item.repo,
+			...typeof item.ref === "string" && item.ref !== "" ? { ref: item.ref } : {},
+			...typeof item.commitSha === "string" && item.commitSha !== "" ? { commitSha: item.commitSha } : {}
+		});
+	}
+	const trashByName = /* @__PURE__ */ new Map();
+	if (Array.isArray(migrated.trash)) for (const entry of migrated.trash) {
+		const item = entry;
+		if (item !== null && typeof item === "object" && typeof item.name === "string" && typeof item.path === "string") {
+			const origin = item.origin;
+			const tagIds = item.tagIds;
+			trashByName.set(item.name, {
+				name: item.name,
+				path: item.path,
+				movedAt: typeof item.movedAt === "number" ? item.movedAt : 0,
+				...typeof item.sourcePath === "string" && item.sourcePath !== "" ? { sourcePath: item.sourcePath } : {},
+				...origin !== null && typeof origin === "object" && typeof origin.repo === "string" && origin.repo !== "" && typeof origin.root === "string" && origin.root !== "" && /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(origin.root) ? { origin: {
+					repo: origin.repo,
+					root: origin.root,
+					...typeof origin.ref === "string" && origin.ref !== "" ? { ref: origin.ref } : {},
+					commitSha: typeof origin.commitSha === "string" ? origin.commitSha : ""
+				} } : {},
+				...Array.isArray(tagIds) ? { tagIds: tagIds.filter((id) => typeof id === "string") } : {}
+			});
+		}
+	}
+	let skillStats = void 0;
+	const savedStats = migrated.skillStats;
+	if (savedStats !== null && typeof savedStats === "object" && typeof savedStats.frozenBefore === "number" && typeof savedStats.lastFullReconcile === "number" && typeof savedStats.windowDays === "number" && typeof savedStats.frozenSessions === "object" && savedStats.frozenSessions !== null) {
+		const sessions = {};
+		for (const [id, entry] of Object.entries(savedStats.frozenSessions)) {
+			if (entry === null || typeof entry !== "object" || typeof entry.createdAt !== "number" || typeof entry.counts !== "object" || entry.counts === null) continue;
+			const counts = {};
+			for (const [name, stat] of Object.entries(entry.counts)) if (stat !== null && typeof stat === "object" && typeof stat.count === "number" && typeof stat.lastUsed === "number") counts[name] = {
+				count: stat.count,
+				lastUsed: stat.lastUsed
+			};
+			sessions[id] = {
+				createdAt: entry.createdAt,
+				counts
+			};
+		}
+		const rawTotals = savedStats.lastTotals;
+		const lastTotals = Array.isArray(rawTotals) ? rawTotals.filter((entry) => entry !== null && typeof entry === "object" && typeof entry.name === "string" && typeof entry.count === "number").map((entry) => ({
+			name: entry.name,
+			count: entry.count,
+			...typeof entry.lastUsed === "number" ? { lastUsed: entry.lastUsed } : {}
+		})) : void 0;
+		skillStats = {
+			windowDays: savedStats.windowDays,
+			frozenBefore: savedStats.frozenBefore,
+			frozenSessions: sessions,
+			lastFullReconcile: savedStats.lastFullReconcile,
+			...lastTotals !== void 0 ? { lastTotals } : {}
+		};
+	}
+	let marketStats = void 0;
+	const savedMarketStats = migrated.marketStats;
+	if (savedMarketStats !== null && typeof savedMarketStats === "object" && typeof savedMarketStats.fetchedAt === "number" && typeof savedMarketStats.stats === "object" && savedMarketStats.stats !== null) {
+		const stats = {};
+		for (const [repo, entry] of Object.entries(savedMarketStats.stats)) if (entry !== null && typeof entry === "object" && typeof entry.stars === "number" && typeof entry.downloads === "number") stats[repo] = {
+			stars: entry.stars,
+			downloads: entry.downloads
+		};
+		marketStats = {
+			fetchedAt: savedMarketStats.fetchedAt,
+			stats
+		};
+	}
+	const collectionOrder = cleanStringList(migrated.collectionOrder);
+	const sourceGroupOrder = cleanStringList(migrated.sourceGroupOrder);
+	return {
+		entries,
+		config,
+		tagsById,
+		sourcesByRepo,
+		marketSources,
+		trashByName,
+		skillStats,
+		marketStats,
+		collectionOrder,
+		sourceGroupOrder
+	};
+}
+//#endregion
+//#region src/store/store.ts
 /** Sidecar state owner. */
 var SkillHubStore = class {
 	file;
@@ -196,6 +334,7 @@ var SkillHubStore = class {
 	marketSources = [];
 	trashByName = /* @__PURE__ */ new Map();
 	skillStats = void 0;
+	marketStats = void 0;
 	collectionOrder = [];
 	sourceGroupOrder = [];
 	loaded = false;
@@ -213,97 +352,17 @@ var SkillHubStore = class {
 			const migrated = migrateStore(JSON.parse(raw));
 			if (migrated === null) console.warn("[dsh-skill-hub] sidecar state uses a newer schema than this plugin supports; starting empty");
 			else {
-				if (Array.isArray(migrated.disabled)) {
-					for (const entry of migrated.disabled) if (typeof entry?.name === "string" && typeof entry?.path === "string") this.entries.set(entry.name, entry);
-				}
-				const saved = migrated.config;
-				if (typeof saved === "object" && saved !== null) {
-					if (typeof saved.enabled === "boolean") this.config.enabled = saved.enabled;
-					if (typeof saved.announceToAgent === "boolean") this.config.announceToAgent = saved.announceToAgent;
-					if (typeof saved.dotModelColor === "string" && saved.dotModelColor !== "") this.config.dotModelColor = saved.dotModelColor;
-					if (typeof saved.dotUserColor === "string" && saved.dotUserColor !== "") this.config.dotUserColor = saved.dotUserColor;
-					if (typeof saved.showUseCount === "boolean") this.config.showUseCount = saved.showUseCount;
-					if (typeof saved.showUseTime === "boolean") this.config.showUseTime = saved.showUseTime;
-					if (typeof saved.showGroupSummary === "boolean") this.config.showGroupSummary = saved.showGroupSummary;
-				}
-				if (Array.isArray(migrated.tags)) for (const entry of migrated.tags) {
-					const tag = entry;
-					if (tag !== null && typeof tag === "object" && typeof tag.id === "string" && typeof tag.name === "string" && Array.isArray(tag.skillNames)) this.tagsById.set(tag.id, {
-						id: tag.id,
-						name: tag.name,
-						skillNames: tag.skillNames.filter((n) => typeof n === "string"),
-						...tag.default === true ? { default: true } : {}
-					});
-				}
-				if (Array.isArray(migrated.sources)) for (const entry of migrated.sources) {
-					const source = entry;
-					if (source !== null && typeof source === "object" && typeof source.repo === "string" && source.repo !== "" && Array.isArray(source.skills)) {
-						const manifest = source.manifest;
-						const rawRoot = typeof source.root === "string" && source.root !== "" && /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(source.root) ? source.root : "skills";
-						this.sourcesByRepo.set(source.repo, {
-							repo: source.repo,
-							...typeof source.ref === "string" && source.ref !== "" ? { ref: source.ref } : {},
-							root: rawRoot,
-							commitSha: typeof source.commitSha === "string" ? source.commitSha : "",
-							skills: source.skills.filter((n) => typeof n === "string"),
-							...manifest !== null && typeof manifest === "object" && !Array.isArray(manifest) ? { manifest: Object.fromEntries(Object.entries(manifest).filter(([, size]) => typeof size === "number")) } : {}
-						});
-					}
-				}
-				if (Array.isArray(migrated.marketSources)) for (const entry of migrated.marketSources) {
-					const item = entry;
-					if (item !== null && typeof item === "object" && typeof item.repo === "string" && item.repo !== "" && !this.marketSources.some((s) => s.repo === item.repo)) this.marketSources.push({
-						repo: item.repo,
-						...typeof item.ref === "string" && item.ref !== "" ? { ref: item.ref } : {},
-						...typeof item.commitSha === "string" && item.commitSha !== "" ? { commitSha: item.commitSha } : {}
-					});
-				}
-				if (Array.isArray(migrated.trash)) for (const entry of migrated.trash) {
-					const item = entry;
-					if (item !== null && typeof item === "object" && typeof item.name === "string" && typeof item.path === "string") {
-						const origin = item.origin;
-						const tagIds = item.tagIds;
-						this.trashByName.set(item.name, {
-							name: item.name,
-							path: item.path,
-							movedAt: typeof item.movedAt === "number" ? item.movedAt : 0,
-							...typeof item.sourcePath === "string" && item.sourcePath !== "" ? { sourcePath: item.sourcePath } : {},
-							...origin !== null && typeof origin === "object" && typeof origin.repo === "string" && origin.repo !== "" && typeof origin.root === "string" && origin.root !== "" && /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(origin.root) ? { origin: {
-								repo: origin.repo,
-								root: origin.root,
-								...typeof origin.ref === "string" && origin.ref !== "" ? { ref: origin.ref } : {},
-								commitSha: typeof origin.commitSha === "string" ? origin.commitSha : ""
-							} } : {},
-							...Array.isArray(tagIds) ? { tagIds: tagIds.filter((id) => typeof id === "string") } : {}
-						});
-					}
-				}
-				const savedStats = migrated.skillStats;
-				if (savedStats !== null && typeof savedStats === "object" && typeof savedStats.frozenBefore === "number" && typeof savedStats.lastFullReconcile === "number" && typeof savedStats.windowDays === "number" && typeof savedStats.frozenSessions === "object" && savedStats.frozenSessions !== null) {
-					const sessions = {};
-					for (const [id, entry] of Object.entries(savedStats.frozenSessions)) {
-						if (entry === null || typeof entry !== "object" || typeof entry.createdAt !== "number" || typeof entry.counts !== "object" || entry.counts === null) continue;
-						const counts = {};
-						for (const [name, stat] of Object.entries(entry.counts)) if (stat !== null && typeof stat === "object" && typeof stat.count === "number" && typeof stat.lastUsed === "number") counts[name] = {
-							count: stat.count,
-							lastUsed: stat.lastUsed
-						};
-						sessions[id] = {
-							createdAt: entry.createdAt,
-							counts
-						};
-					}
-					this.skillStats = {
-						windowDays: savedStats.windowDays,
-						frozenBefore: savedStats.frozenBefore,
-						frozenSessions: sessions,
-						lastFullReconcile: savedStats.lastFullReconcile
-					};
-				}
-				const rawColOrder = migrated.collectionOrder;
-				if (Array.isArray(rawColOrder)) this.collectionOrder = rawColOrder.filter((n) => typeof n === "string" && n !== "");
-				const rawSrcOrder = migrated.sourceGroupOrder;
-				if (Array.isArray(rawSrcOrder)) this.sourceGroupOrder = rawSrcOrder.filter((n) => typeof n === "string" && n !== "");
+				const state = hydrateMigratedState(migrated);
+				this.entries = state.entries;
+				this.config = state.config;
+				this.tagsById = state.tagsById;
+				this.sourcesByRepo = state.sourcesByRepo;
+				this.marketSources = state.marketSources;
+				this.trashByName = state.trashByName;
+				this.skillStats = state.skillStats;
+				this.marketStats = state.marketStats;
+				this.collectionOrder = state.collectionOrder;
+				this.sourceGroupOrder = state.sourceGroupOrder;
 			}
 		} catch (error) {
 			if (error.code !== "ENOENT") console.warn("[dsh-skill-hub] sidecar state unreadable, starting empty:", error instanceof Error ? error.message : error);
@@ -697,17 +756,36 @@ var SkillHubStore = class {
 		await this.ensureLoaded();
 		return this.skillStats !== void 0 ? {
 			...this.skillStats,
-			frozenSessions: { ...this.skillStats.frozenSessions }
+			frozenSessions: { ...this.skillStats.frozenSessions },
+			...this.skillStats.lastTotals !== void 0 ? { lastTotals: [...this.skillStats.lastTotals] } : {}
 		} : void 0;
 	}
-	/** Persist a usage-statistics checkpoint (written at most ~once a day, on full reconciliations). */
+	/** Persist a usage-statistics checkpoint (after every completed scan; cadence follows the scan TTL). */
 	async saveSkillStatsState(state) {
 		await this.ensureLoaded();
 		this.skillStats = {
 			windowDays: state.windowDays,
 			frozenBefore: state.frozenBefore,
 			frozenSessions: { ...state.frozenSessions },
-			lastFullReconcile: state.lastFullReconcile
+			lastFullReconcile: state.lastFullReconcile,
+			...state.lastTotals !== void 0 ? { lastTotals: [...state.lastTotals] } : {}
+		};
+		await this.persist();
+	}
+	/** The persisted market-stats snapshot (undefined until first saved). */
+	async getMarketStatsState() {
+		await this.ensureLoaded();
+		return this.marketStats !== void 0 ? {
+			fetchedAt: this.marketStats.fetchedAt,
+			stats: { ...this.marketStats.stats }
+		} : void 0;
+	}
+	/** Persist a market-stats snapshot (written when a refresh fetched anything new). */
+	async saveMarketStatsState(state) {
+		await this.ensureLoaded();
+		this.marketStats = {
+			fetchedAt: state.fetchedAt,
+			stats: { ...state.stats }
 		};
 		await this.persist();
 	}
@@ -722,6 +800,7 @@ var SkillHubStore = class {
 				...this.marketSources.length > 0 ? { marketSources: [...this.marketSources] } : {},
 				...this.trashByName.size > 0 ? { trash: [...this.trashByName.values()] } : {},
 				...this.skillStats !== void 0 ? { skillStats: this.skillStats } : {},
+				...this.marketStats !== void 0 ? { marketStats: this.marketStats } : {},
 				...this.collectionOrder.length > 0 ? { collectionOrder: [...this.collectionOrder] } : {},
 				...this.sourceGroupOrder.length > 0 ? { sourceGroupOrder: [...this.sourceGroupOrder] } : {}
 			};
@@ -867,10 +946,18 @@ function parseFrontmatter(text) {
 	const match = /^---\s*\r?\n([\s\S]*?)\r?\n---\s*(?:\r?\n([\s\S]*))?$/.exec(text);
 	if (match === null) return { error: "missing YAML frontmatter (--- block)" };
 	let data;
+	let rawFrontmatter = match[1];
 	try {
-		data = load(match[1]);
+		data = load(rawFrontmatter);
 	} catch (error) {
-		return { error: "invalid YAML frontmatter: " + (error instanceof Error ? error.message : String(error)) };
+		const repaired = repairFrontmatterScalarFields(rawFrontmatter);
+		if (repaired !== null) try {
+			data = load(repaired);
+			rawFrontmatter = repaired;
+		} catch {
+			return { error: "invalid YAML frontmatter: " + (error instanceof Error ? error.message : String(error)) };
+		}
+		else return { error: "invalid YAML frontmatter: " + (error instanceof Error ? error.message : String(error)) };
 	}
 	if (typeof data !== "object" || data === null || Array.isArray(data)) return { error: "frontmatter must be a YAML mapping" };
 	const record = data;
@@ -902,6 +989,111 @@ function parseFrontmatter(text) {
 		content: (match[2] ?? "").trim()
 	} };
 }
+/**
+* Repair bare scalar fields that contain an unquoted colon (e.g. `description: Build for AWS: ECS`)
+* or an invalid flow-like scalar (`@`, `` ` ``, `[`, `{`). Mirrors codex `repair_frontmatter_scalar_fields`:
+* line-oriented, only touches lines where quoting makes the YAML valid, and preserves block scalars.
+* Returns the repaired frontmatter string when at least one line was quoted, otherwise null.
+*/
+function repairFrontmatterScalarFields(frontmatter) {
+	let changed = false;
+	let blockScalarIndent = null;
+	const repairedLines = [];
+	for (const line of frontmatter.split("\n")) {
+		const indent = line.search(/[^ ]/);
+		const effectiveIndent = indent === -1 ? line.length : indent;
+		if (blockScalarIndent !== null) {
+			if (line.trim() === "" || effectiveIndent > blockScalarIndent) {
+				repairedLines.push(line);
+				continue;
+			}
+			blockScalarIndent = null;
+		}
+		const colonIndex = line.indexOf(":");
+		if (colonIndex === -1) {
+			repairedLines.push(line);
+			continue;
+		}
+		const key = line.slice(0, colonIndex);
+		const value = line.slice(colonIndex + 1);
+		if (key.trim() === "" || value.length === 0 || !/^\s/.test(value)) {
+			repairedLines.push(line);
+			continue;
+		}
+		const trimmedStart = value.trimStart();
+		const leadingWhitespace = value.slice(0, value.length - trimmedStart.length);
+		let scalar = trimmedStart;
+		let comment = "";
+		for (let idx = 0; idx < trimmedStart.length; idx += 1) if (trimmedStart[idx] === "#") {
+			const prev = idx === 0 ? " " : trimmedStart[idx - 1];
+			const next = idx + 1 < trimmedStart.length ? trimmedStart[idx + 1] : " ";
+			if (/\s/.test(prev) && /\s/.test(next)) {
+				const commentStart = trimmedStart.slice(0, idx).trimEnd().length;
+				scalar = trimmedStart.slice(0, commentStart);
+				comment = trimmedStart.slice(commentStart);
+				break;
+			}
+		}
+		scalar = scalar.trimEnd();
+		if (scalar === "") {
+			repairedLines.push(line);
+			continue;
+		}
+		const firstChar = scalar[0];
+		if (firstChar === "|" || firstChar === ">") {
+			blockScalarIndent = effectiveIndent;
+			repairedLines.push(line);
+			continue;
+		}
+		if (firstChar === "'" || firstChar === "\"") {
+			repairedLines.push(line);
+			continue;
+		}
+		let hasColonSeparator = false;
+		for (let i = 0; i < scalar.length - 1; i += 1) if (scalar[i] === ":" && /\s/.test(scalar[i + 1])) {
+			hasColonSeparator = true;
+			break;
+		}
+		let invalidFlowLike = false;
+		if (firstChar === "[" || firstChar === "{" || firstChar === "@" || firstChar === "`") try {
+			load(scalar);
+		} catch {
+			invalidFlowLike = true;
+		}
+		if (!hasColonSeparator && !invalidFlowLike) {
+			repairedLines.push(line);
+			continue;
+		}
+		const quotedScalar = "'" + scalar.replace(/'/g, "''") + "'";
+		repairedLines.push(key + ":" + leadingWhitespace + quotedScalar + comment);
+		changed = true;
+	}
+	return changed ? repairedLines.join("\n") : null;
+}
+/** Try to repair a SKILL.md's frontmatter in place (unquoted colon etc.). Returns the new file text or null when not fixable. */
+function repairFrontmatterFileText(text) {
+	const match = /^---\s*\r?\n([\s\S]*?)\r?\n---\s*(?:\r?\n([\s\S]*))?$/.exec(text);
+	if (match === null) return null;
+	const repaired = repairFrontmatterScalarFields(match[1]);
+	if (repaired === null) return null;
+	try {
+		load(repaired);
+	} catch {
+		return null;
+	}
+	const body = match[2] ?? "";
+	return "---\n" + repaired + "\n---" + (body !== "" ? "\n" + body : "");
+}
+/** Repair one file on disk when its frontmatter is auto-fixable. Returns the new text. */
+async function fixDiagnosticFile(path, home = dshHome()) {
+	if (rootOfPath(path, home) === void 0) throw new TypeError("not a hub writable skill path: " + path);
+	const repairedText = repairFrontmatterFileText(await readFile(path, "utf8"));
+	if (repairedText === null) throw new TypeError("diagnostic is not auto-fixable: " + path);
+	const parsed = parseFrontmatter(repairedText);
+	if ("error" in parsed) throw new TypeError("repaired frontmatter still invalid: " + parsed.error);
+	await writeFile(path, repairedText, "utf8");
+	return path;
+}
 /** Official boolean grammar: true/false, 1/0, and the common string spellings. */
 function frontmatterBoolean(data, key) {
 	if (!Object.hasOwn(data, key)) return void 0;
@@ -959,6 +1151,59 @@ async function scanRoot(base) {
 function listSkillEntries(root, home = dshHome()) {
 	return scanRoot(rootPath(root, home));
 }
+/** Read UI metadata from `agents/openai.yaml` beside a directory skill (mirrors codex SkillInterface). */
+async function readSkillInterface(directory) {
+	const yamlPath = join(directory, "agents", "openai.yaml");
+	let text;
+	try {
+		text = await readFile(yamlPath, "utf8");
+	} catch {
+		return;
+	}
+	let data;
+	try {
+		data = load(text);
+	} catch {
+		return;
+	}
+	if (typeof data !== "object" || data === null || Array.isArray(data)) return void 0;
+	const record = data;
+	const iface = record.interface ?? record;
+	const ifaceObj = typeof record.interface === "object" && record.interface !== null && !Array.isArray(record.interface) ? record.interface : iface;
+	const cleanStr = (value, maxLen) => {
+		if (typeof value !== "string") return void 0;
+		const cleaned = value.split(/\s+/).join(" ").trim();
+		if (cleaned === "" || cleaned.length > maxLen) return void 0;
+		return cleaned;
+	};
+	const hexColor = (value) => {
+		if (typeof value !== "string") return void 0;
+		const trimmed = value.trim();
+		return /^#[0-9a-fA-F]{6}$/.test(trimmed) ? trimmed : void 0;
+	};
+	const iconPath = (value) => {
+		if (typeof value !== "string" || value.trim() === "") return void 0;
+		const trimmed = value.trim().replace(/\\/g, "/");
+		if (trimmed.startsWith("/") || trimmed.includes("..")) return void 0;
+		if (!trimmed.startsWith("assets/")) return void 0;
+		return trimmed;
+	};
+	const displayName = cleanStr(ifaceObj.display_name, 64);
+	const shortDescription = cleanStr(ifaceObj.short_description, 1024);
+	const brandColor = hexColor(ifaceObj.brand_color);
+	const defaultPrompt = cleanStr(ifaceObj.default_prompt, 1024);
+	const iconSmall = iconPath(ifaceObj.icon_small);
+	const iconLarge = iconPath(ifaceObj.icon_large);
+	if (!(displayName !== void 0 || shortDescription !== void 0 || brandColor !== void 0 || iconSmall !== void 0 || iconLarge !== void 0 || defaultPrompt !== void 0)) return void 0;
+	return {
+		...displayName !== void 0 ? { displayName } : {},
+		...shortDescription !== void 0 ? { shortDescription } : {},
+		...brandColor !== void 0 ? { brandColor } : {},
+		...iconSmall !== void 0 ? { iconSmall } : {},
+		...iconLarge !== void 0 ? { iconLarge } : {},
+		...defaultPrompt !== void 0 ? { defaultPrompt } : {}
+	};
+}
 /**
 * Walk up from cwd (max 32 levels) for a project marker (.dsh or .git);
 * falls back to cwd itself. The provider roots project skills here.
@@ -995,13 +1240,21 @@ async function scanDiagnostics(root, home = dshHome()) {
 		}
 		const parsed = parseFrontmatter(text);
 		if ("error" in parsed) {
+			const fixable = repairFrontmatterFileText(text) !== null;
 			diagnostics.push({
 				path: entry.path,
 				root,
-				reason: parsed.error
+				reason: parsed.error,
+				...fixable ? { fixable: true } : {}
 			});
 			continue;
 		}
+		if (repairFrontmatterFileText(text) !== null) diagnostics.push({
+			path: entry.path,
+			root,
+			reason: "frontmatter contains unquoted colon/bracket (auto-repaired in memory; click Fix to persist)",
+			fixable: true
+		});
 		const { value } = parsed;
 		const pathName = entry.kind === "directory" ? basename(entry.directory) : basename(entry.path, ".md");
 		if (value.name !== pathName) diagnostics.push({
@@ -1173,17 +1426,12 @@ var SkillHubProvider = class {
 	}
 };
 //#endregion
-//#region src/repo.ts
+//#region src/repo/github-client.ts
 /**
-* GitHub repository skill discovery/import helpers.
-*
-* Kept dependency-free and mostly pure so the root/origin rules are easy to
-* test. Roots are auto-derived: any top-level directory that contains a
-* `**\/SKILL.md` (e.g. `skills/**`, `design-templates/**`, `templates/**`,
-* `workflows/**`) is treated as a skill root. No hard-coded allowlist.
+* GitHub API 统一请求层：token 管理、鉴权头、ETag 缓存、错误映射、
+* 带缓存的 JSON GET。从 repo.ts 抽出，原 6 处重复的 try/catch +
+* headers + json 解析收敛到 fetchJson / fetchJsonCached 两个入口。
 */
-/** Top-level directory pattern for a skill root: visible, non-dot, safe chars. First char must be alphanum. */
-const ROOT_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 /** Fetch failure carrying a useful HTTP status for the route layer. */
 var RepoFetchError = class extends Error {
 	status;
@@ -1196,13 +1444,41 @@ var RepoFetchError = class extends Error {
 /**
 * GitHub token for authenticated API calls. Read from GITHUB_TOKEN /
 * GH_TOKEN at module load; setGithubToken() overrides it at runtime (the
-* plugin config route calls it when a saved token exists).
+* host calls it from the settings sync whenever the card value changes;
+* an absent value falls back to the env var).
 */
 let githubToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? "";
+/** Override the GitHub token at runtime ('' falls back to the env var). */
+function setGithubToken(token) {
+	githubToken = token !== void 0 && token !== "" ? token : process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? "";
+}
 /** Authorization header for api.github.com / raw.githubusercontent.com calls. */
 function githubAuthHeaders() {
 	return githubToken === "" ? {} : { authorization: "Bearer " + githubToken };
 }
+/** JSON API 默认请求头（含鉴权）。 */
+function apiHeaders() {
+	return {
+		accept: "application/vnd.github+json",
+		...githubAuthHeaders()
+	};
+}
+/** ETag cache for GitHub API JSON (mirrors codex lib.rs marker+fingerprint). In-memory only, saves 304 for daily checks. */
+const etagCache = /* @__PURE__ */ new Map();
+const ETAG_MAX = 200;
+function etagCacheGet(url) {
+	return etagCache.get(url);
+}
+function etagCacheSet(url, etag, json) {
+	if (etagCache.size >= ETAG_MAX) {
+		const first = etagCache.keys().next().value;
+		if (first !== void 0) etagCache.delete(first);
+	}
+	etagCache.set(url, {
+		etag,
+		json
+	});
+}
 /**
 * Build a RepoFetchError; when the response shows an exhausted rate limit,
 * report the reset time instead of a bare HTTP status.
@@ -1215,6 +1491,78 @@ function fetchError(context, response, fallbackStatus = 502) {
 	}
 	return new RepoFetchError(context + " (HTTP " + response.status + ")", response.status === 404 ? 404 : fallbackStatus);
 }
+/** 是否限流/中断类错误（调用方可直接透出，不再包装）。 */
+function isAbortError(error) {
+	return error instanceof Error && (error.name === "AbortError" || error.message.includes("aborted") || error.message.includes("Abort"));
+}
+/**
+* 不带缓存的统一 GET+JSON：网络异常、非 2xx、坏 JSON 全部映射为
+* RepoFetchError，调用方无需重复写 try/catch。
+*/
+async function fetchJson(url, fetchImpl, context, headers = apiHeaders()) {
+	let response;
+	try {
+		response = await fetchImpl(url, { headers });
+	} catch (error) {
+		if (isAbortError(error)) throw error;
+		throw new RepoFetchError(context + ": " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (!response.ok) throw fetchError(context, response);
+	try {
+		return {
+			json: await response.json(),
+			response
+		};
+	} catch {
+		throw new RepoFetchError("invalid github response for " + url);
+	}
+}
+/**
+* Load repo metadata and the recursive git tree at the given ref. The meta
+* request always resolves the default branch (used when ref is absent); the
+* tree is fetched at `ref ?? default_branch` so an explicit branch/tag scans
+* the exact same content a later download would fetch.
+*/
+async function fetchJsonCached(url, fetchImpl, context) {
+	const cached = etagCacheGet(url);
+	const headers = { ...apiHeaders() };
+	if (cached !== void 0) headers["if-none-match"] = cached.etag;
+	let response;
+	try {
+		response = await fetchImpl(url, { headers });
+	} catch (error) {
+		throw new RepoFetchError(context + ": " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (response.status === 304 && cached !== void 0) return {
+		json: cached.json,
+		response
+	};
+	if (!response.ok) throw fetchError(context, response);
+	let json;
+	try {
+		json = await response.json();
+	} catch {
+		throw new RepoFetchError("invalid github response for " + url);
+	}
+	const etag = response.headers.get("etag");
+	if (etag !== null && etag !== "") etagCacheSet(url, etag, json);
+	return {
+		json,
+		response
+	};
+}
+//#endregion
+//#region src/repo.ts
+/**
+* GitHub repository skill discovery/import helpers.
+*
+* Kept dependency-free and mostly pure so the root/origin rules are easy to
+* test. Roots are auto-derived: any top-level directory that contains a
+* `**\/SKILL.md` (e.g. `skills/**`, `design-templates/**`, `templates/**`,
+* `workflows/**`) is treated as a skill root. No hard-coded allowlist.
+*/
+/** Top-level directory pattern for a skill root: visible, non-dot, safe chars. First char must be alphanum. */
+const ROOT_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 /** `owner/repo` slug for a parsed reference. */
 function repoSlug(ref) {
 	return `${ref.owner}/${ref.repo}`;
@@ -1251,53 +1599,19 @@ function normalizeRepoInput(input) {
 		...ref !== void 0 && ref !== "" ? { ref } : {}
 	};
 }
-/**
-* Load repo metadata and the recursive git tree at the given ref. The meta
-* request always resolves the default branch (used when ref is absent); the
-* tree is fetched at `ref ?? default_branch` so an explicit branch/tag scans
-* the exact same content a later download would fetch.
-*/
 async function loadRepoTree(repo, ref, fetchImpl = fetch) {
-	let metaResponse;
-	try {
-		metaResponse = await fetchImpl(`https://api.github.com/repos/${repo}`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!metaResponse.ok) throw fetchError("github repo not found or unavailable", metaResponse);
-	let meta;
-	try {
-		meta = await metaResponse.json();
-	} catch {
-		throw new RepoFetchError("invalid github repo response");
-	}
+	const { json: metaJson } = await fetchJsonCached(`https://api.github.com/repos/${repo}`, fetchImpl, "github repo not found or unavailable");
+	let meta = metaJson;
 	const record = typeof meta === "object" && meta !== null ? meta : {};
 	const defaultBranch = typeof record.default_branch === "string" && record.default_branch !== "" ? record.default_branch : "main";
 	const treeRef = ref !== void 0 && ref !== "" ? ref : defaultBranch;
-	let treeResponse;
-	try {
-		treeResponse = await fetchImpl(`https://api.github.com/repos/${repo}/git/trees/${encodeURIComponent(treeRef)}?recursive=1`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github tree request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!treeResponse.ok) throw fetchError("github tree not found", treeResponse);
-	let payload;
-	try {
-		payload = await treeResponse.json();
-	} catch {
-		throw new RepoFetchError("invalid github tree response");
-	}
+	const { json: payload } = await fetchJsonCached(`https://api.github.com/repos/${repo}/git/trees/${encodeURIComponent(treeRef)}?recursive=1`, fetchImpl, "github tree not found");
 	const treeRecord = typeof payload === "object" && payload !== null ? payload : {};
-	if (treeRecord.truncated === true) throw new RepoFetchError("repo tree is too large to scan");
+	const truncated = treeRecord.truncated === true;
 	return {
 		ref: treeRef,
-		tree: Array.isArray(treeRecord.tree) ? treeRecord.tree : []
+		tree: Array.isArray(treeRecord.tree) ? treeRecord.tree : [],
+		truncated
 	};
 }
 /** Collect every file inside a skill directory, including SKILL.md itself. */
@@ -1350,7 +1664,7 @@ function discoverRepoEntries(tree, repo, existingNames = /* @__PURE__ */ new Set
 	}).sort((a, b) => a.name.localeCompare(b.name));
 }
 /** Run an async worker over items with a bounded concurrency. */
-async function mapConcurrent(items, limit, worker) {
+async function mapConcurrent$1(items, limit, worker) {
 	const results = new Array(items.length);
 	let cursor = 0;
 	const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
@@ -1363,10 +1677,6 @@ async function mapConcurrent(items, limit, worker) {
 	await Promise.all(runners);
 	return results;
 }
-/** Whether an error is an abort (AbortError / signal). */
-function isAbortError(error) {
-	return error instanceof Error && (error.name === "AbortError" || error.message.includes("aborted") || error.message.includes("Abort"));
-}
 /**
 * Download one GitHub file as a buffer. Tries raw.githubusercontent.com
 * first (no API quota); on any failure falls back to the api.github.com
@@ -1424,7 +1734,7 @@ async function downloadRepoSkill(repo, ref, entry, files, targetRoot, fetchImpl
 	const tempDir = await mkdtemp(join(targetRoot, "." + entry.name + ".import-"));
 	let renamed = false;
 	try {
-		await mapConcurrent(files, 6, async (file) => {
+		await mapConcurrent$1(files, 6, async (file) => {
 			if (signal?.aborted) throw new DOMException("aborted", "AbortError");
 			const relative = file.path.slice(entry.dir.length + 1);
 			if (relative === "" || relative.includes("..")) throw new RepoFetchError("unsafe repo path: " + file.path);
@@ -1505,44 +1815,48 @@ async function cleanupLeftoverImportDirs(targetRoot) {
 * repo has no releases (GitHub's /releases/latest skips prereleases/drafts).
 */
 async function getLatestReleaseTag(repo, fetchImpl = fetch) {
-	let response;
-	try {
-		response = await fetchImpl(`https://api.github.com/repos/${repo}/releases/latest`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github release request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (response.status === 404) return void 0;
-	if (!response.ok) throw fetchError("github release lookup failed", response);
 	let payload;
 	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github release response");
+		({json: payload} = await fetchJson(`https://api.github.com/repos/${repo}/releases/latest`, fetchImpl, "github release lookup failed"));
+	} catch (error) {
+		if (error instanceof RepoFetchError && error.status === 404) return void 0;
+		throw error;
 	}
 	const tag = typeof payload === "object" && payload !== null ? payload.tag_name : void 0;
 	return typeof tag === "string" && tag !== "" ? tag : void 0;
 }
+/** Stars + release-asset downloads of a repo (two GitHub API requests). */
+async function getRepoStats(repo, fetchImpl = fetch) {
+	const headers = apiHeaders();
+	const { json: meta } = await fetchJson(`https://api.github.com/repos/${repo}`, fetchImpl, "github repo not found or unavailable", headers);
+	const stars = typeof meta === "object" && meta !== null && typeof meta.stargazers_count === "number" ? meta.stargazers_count : 0;
+	let downloads = 0;
+	try {
+		const relResponse = await fetchImpl(`https://api.github.com/repos/${repo}/releases?per_page=20`, { headers });
+		if (relResponse.ok) {
+			const releases = await relResponse.json();
+			if (Array.isArray(releases)) for (const item of releases) {
+				if (typeof item !== "object" || item === null) continue;
+				const assets = item.assets;
+				if (!Array.isArray(assets)) continue;
+				for (const asset of assets) if (typeof asset === "object" && asset !== null && typeof asset.download_count === "number") downloads += asset.download_count;
+			}
+		}
+	} catch {}
+	return {
+		stars,
+		downloads
+	};
+}
+/** Release tags of a repo, newest first (skips drafts, keeps prereleases). */
+async function listRepoReleases(repo, fetchImpl = fetch) {
+	const { json: payload } = await fetchJson(`https://api.github.com/repos/${repo}/releases?per_page=20`, fetchImpl, "github releases lookup failed");
+	if (!Array.isArray(payload)) return [];
+	return payload.filter((item) => typeof item === "object" && item !== null && item.draft !== true).map((item) => item.tag_name).filter((tag) => typeof tag === "string" && tag !== "");
+}
 /** Branch names of a repo, default branch first (one GitHub API request). */
 async function listRepoBranches(repo, fetchImpl = fetch) {
-	let response;
-	try {
-		response = await fetchImpl(`https://api.github.com/repos/${repo}/branches?per_page=100`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github branches request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!response.ok) throw fetchError("github branches lookup failed", response);
-	let payload;
-	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github branches response");
-	}
+	const { json: payload } = await fetchJson(`https://api.github.com/repos/${repo}/branches?per_page=100`, fetchImpl, "github branches lookup failed");
 	if (!Array.isArray(payload)) return [];
 	return payload.map((item) => typeof item === "object" && item !== null ? item.name : void 0).filter((name) => typeof name === "string" && name !== "");
 }
@@ -1552,23 +1866,7 @@ async function listRepoBranches(repo, fetchImpl = fetch) {
 * upstream tree on change (one extra request).
 */
 async function getLatestCommit(repo, ref, fetchImpl = fetch) {
-	const url = ref !== void 0 && ref !== "" ? `https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref)}` : `https://api.github.com/repos/${repo}/commits?per_page=1`;
-	let response;
-	try {
-		response = await fetchImpl(url, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!response.ok) throw fetchError("github commit lookup failed", response);
-	let payload;
-	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github commit response");
-	}
+	const { json: payload } = await fetchJson(ref !== void 0 && ref !== "" ? `https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref)}` : `https://api.github.com/repos/${repo}/commits?per_page=1`, fetchImpl, "github commit lookup failed");
 	const record = Array.isArray(payload) ? payload[0] ?? {} : typeof payload === "object" && payload !== null ? payload : {};
 	const commitSha = typeof record.sha === "string" && record.sha !== "" ? record.sha : null;
 	const tree = typeof record.commit === "object" && record.commit !== null ? record.commit.tree : void 0;
@@ -1581,22 +1879,7 @@ async function getLatestCommit(repo, ref, fetchImpl = fetch) {
 }
 /** Load the recursive git tree at an explicit tree SHA (one API request). */
 async function loadRepoTreeAt(repo, treeSha, fetchImpl = fetch) {
-	let response;
-	try {
-		response = await fetchImpl(`https://api.github.com/repos/${repo}/git/trees/${encodeURIComponent(treeSha)}?recursive=1`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github tree request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!response.ok) throw fetchError("github tree lookup failed", response);
-	let payload;
-	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github tree response");
-	}
+	const { json: payload } = await fetchJson(`https://api.github.com/repos/${repo}/git/trees/${encodeURIComponent(treeSha)}?recursive=1`, fetchImpl, "github tree lookup failed");
 	const record = typeof payload === "object" && payload !== null ? payload : {};
 	if (record.truncated === true) throw new RepoFetchError("repo tree is too large to scan");
 	return Array.isArray(record.tree) ? record.tree : [];
@@ -1801,25 +2084,6 @@ async function checkLatestRelease(repo = UPDATE_REPO, fetchImpl = fetch) {
 		url: typeof record.html_url === "string" ? record.html_url : null
 	};
 }
-//#endregion
-//#region src/routes.ts
-/**
-* The /api/skill-hub route family: full catalog (enabled skills from the
-* official registry + hub-disabled skills + discovery diagnostics), skill
-* detail, enable/disable toggle, new-skill scaffold, user groups (tags +
-* origin collections), and upstream source tracking (check/sync/follow
-* upstream deletion into a restorable trash). Every route carries a
-* loopback-only trust fence — these endpoints rename files under the user's
-* skill roots, so LAN-exposed dsh web deployments must not serve them.
-*
-* Every handler is declared through the local `route()` wrapper, which owns
-* the shared request fences (loopback trust, HTTP method, master switch,
-* JSON body) exactly once, so a new route cannot forget them.
-*/
-/** Cap on JSON request bodies (toggle/create payloads are tiny). */
-const MAX_JSON_BODY_BYTES = 64 * 1024;
-/** Minimum interval between network update checks per source (GitHub rate limits). */
-const MIN_CHECK_INTERVAL_MS = 5 * 6e4;
 /** Loopback literal check plus browser same-origin markers. */
 function isLoopbackRequest(request) {
 	const address = request.socket.remoteAddress;
@@ -1880,7 +2144,7 @@ async function readJsonBody(req) {
 	for await (const chunk of req) {
 		const buffer = chunk;
 		size += buffer.length;
-		if (size > MAX_JSON_BODY_BYTES) return void 0;
+		if (size > 65536) return void 0;
 		chunks.push(buffer);
 	}
 	try {
@@ -2045,15 +2309,23 @@ async function buildCatalog(deps, cwd) {
 			title: ""
 		}];
 	}
-	const byName = /* @__PURE__ */ new Map();
+	const byKey = /* @__PURE__ */ new Map();
+	const identitiesByKey = /* @__PURE__ */ new Map();
 	let complete = true;
 	for (const ws of workspaces) {
 		const lookup = ws.path !== "" ? { cwd: ws.path } : void 0;
 		const snapshot = await deps.skills.snapshot(lookup);
 		if (!snapshot.complete) complete = false;
 		for (const skill of snapshot.skills) {
-			if (byName.has(skill.name)) continue;
-			byName.set(skill.name, {
+			const logicalKey = isProjectSource(skill.source) && ws.path !== "" ? `${skill.name}\0${ws.path}\0${skill.source}` : skill.name;
+			let identities = identitiesByKey.get(logicalKey);
+			if (identities === void 0) {
+				identities = /* @__PURE__ */ new Set();
+				identitiesByKey.set(logicalKey, identities);
+			}
+			identities.add(skill.source + "\0" + skill.provider);
+			if (byKey.has(logicalKey)) continue;
+			byKey.set(logicalKey, {
 				skill,
 				...isProjectSource(skill.source) && ws.path !== "" ? {
 					workspace: ws.path,
@@ -2062,6 +2334,17 @@ async function buildCatalog(deps, cwd) {
 			});
 		}
 	}
+	const disabled = await deps.store.listDisabled();
+	const byName = byKey;
+	for (const d of disabled) {
+		let identities = identitiesByKey.get(d.name);
+		if (identities === void 0) {
+			identities = /* @__PURE__ */ new Set();
+			identitiesByKey.set(d.name, identities);
+		}
+		identities.add("hub-disabled\0" + d.root);
+	}
+	const duplicateNames = [...identitiesByKey.entries()].filter(([, identities]) => identities.size > 1).map(([key]) => key.split("\0")[0]).filter((name, idx, arr) => arr.indexOf(name) === idx).sort((a, b) => a.localeCompare(b));
 	const timesByName = /* @__PURE__ */ new Map();
 	await Promise.all([...byName.values()].map(async ({ skill }) => {
 		if (!isWritableSource(skill.source)) return;
@@ -2079,6 +2362,22 @@ async function buildCatalog(deps, cwd) {
 			return;
 		} catch {}
 	}));
+	const interfaceByName = /* @__PURE__ */ new Map();
+	await Promise.all([...byName.values()].map(async ({ skill, workspace }) => {
+		const candidates = [];
+		if (isWritableSource(skill.source)) candidates.push(join(rootPath(skill.source, home), skill.name));
+		else if (isProjectSource(skill.source) && workspace !== void 0) candidates.push(join(workspace, skill.source === "project-dsh" ? ".dsh/skills" : ".agents/skills", skill.name));
+		else if (isProjectSource(skill.source)) {
+			for (const ws of workspaces) if (ws.path !== "") candidates.push(join(ws.path, skill.source === "project-dsh" ? ".dsh/skills" : ".agents/skills", skill.name));
+		}
+		for (const dir of candidates) try {
+			const iface = await readSkillInterface(dir);
+			if (iface !== void 0) {
+				interfaceByName.set(skill.name, iface);
+				return;
+			}
+		} catch {}
+	}));
 	const skills = [...byName.values()].map(({ skill, workspace, workspaceTitle }) => {
 		const row = {
 			name: skill.name,
@@ -2101,9 +2400,17 @@ async function buildCatalog(deps, cwd) {
 			row.addedAt = times.addedAt;
 			row.updatedAt = times.updatedAt;
 		}
+		const iface = interfaceByName.get(skill.name);
+		if (iface !== void 0) {
+			if (iface.displayName !== void 0) row.displayName = iface.displayName;
+			if (iface.shortDescription !== void 0) row.shortDescription = iface.shortDescription;
+			if (iface.brandColor !== void 0) row.brandColor = iface.brandColor;
+			if (iface.iconSmall !== void 0) row.iconSmall = iface.iconSmall;
+			if (iface.iconLarge !== void 0) row.iconLarge = iface.iconLarge;
+			if (iface.defaultPrompt !== void 0) row.defaultPrompt = iface.defaultPrompt;
+		}
 		return row;
 	});
-	const disabled = await deps.store.listDisabled();
 	const diagnostics = [...await scanDiagnostics("user-dsh", home), ...await scanDiagnostics("user-agents", home)];
 	return {
 		ok: true,
@@ -2111,7 +2418,8 @@ async function buildCatalog(deps, cwd) {
 		complete,
 		skills,
 		disabled,
-		diagnostics
+		diagnostics,
+		...duplicateNames.length > 0 ? { duplicateNames } : {}
 	};
 }
 /** Map a loaded definition onto the wire shape. */
@@ -2129,50 +2437,14 @@ function toDetail(skill) {
 		content: skill.content
 	};
 }
-/** Last successful check time per repo (in-memory throttle for GitHub rate limits). */
-const lastSourceCheck = /* @__PURE__ */ new Map();
-/** Last successful market update check per repo (same throttle). */
-const lastMarketCheck = /* @__PURE__ */ new Map();
-const importJobs = /* @__PURE__ */ new Map();
-const IMPORT_JOB_TTL_MS = 5 * 6e4;
-const IMPORT_JOB_MAX = 100;
-function gcImportJobs() {
-	if (importJobs.size > 500) importJobs.clear();
-	const now = Date.now();
-	for (const [id, job] of importJobs) if (job.status !== "running" && now - job.createdAt > IMPORT_JOB_TTL_MS) importJobs.delete(id);
-	if (importJobs.size > IMPORT_JOB_MAX) {
-		const sorted = [...importJobs.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
-		for (let i = 0; i < sorted.length - IMPORT_JOB_MAX; i++) importJobs.delete(sorted[i][0]);
-	}
-}
-/** Replace one skill directory with a fresh download; restores the old dir on failure. */
-async function replaceSkillDir(targetDir, download) {
-	const backup = join(dirname(targetDir), "." + basename(targetDir) + ".sync-bak-" + Date.now());
-	await rename(targetDir, backup);
-	try {
-		await download();
-	} catch (error) {
-		await rename(backup, targetDir).catch(() => {});
-		throw error;
-	}
-	await rm(backup, {
-		recursive: true,
-		force: true
-	});
-}
 /**
-* Build every /api/skill-hub route.
-* @param deps - skill registry view + sidecar store.
-* @returns the exact-path routes.
+* Wrap one handler in the shared request fences. Order matches the
+* original per-handler prologue: loopback trust → HTTP method → master
+* switch → JSON body. The outer catch maps errors onto the JSON error
+* body (preserving RepoFetchError status codes).
 */
-function makeRoutes(deps) {
-	/**
-	* Wrap one handler in the shared request fences. Order matches the
-	* original per-handler prologue: loopback trust → HTTP method → master
-	* switch → JSON body. The outer catch maps errors onto the JSON error
-	* body (preserving RepoFetchError status codes).
-	*/
-	const route = (spec) => ({
+function createRoute(deps, spec) {
+	return {
 		kind: "exact",
 		path: spec.path,
 		handler: async (req, res) => {
@@ -2206,16 +2478,25 @@ function makeRoutes(deps) {
 				writeRouteError(res, error);
 			}
 		}
-	});
+	};
+}
+//#endregion
+//#region src/routes/catalog.ts
+/**
+* 目录域路由：catalog / skill 详情 / skill 删除 / toggle / toggle-batch /
+* create / stats。从 routes.ts 原样搬出，handler 逻辑不变。
+*/
+/** 目录域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function catalogRoutes(deps) {
 	return [
-		route({
+		{
 			path: SKILL_HUB_API.catalog,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
 				writeJson(res, 200, await buildCatalog(deps, queryParam(url, "cwd")));
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.skill,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
@@ -2235,22 +2516,64 @@ function makeRoutes(deps) {
 					if (skill === void 0) skill = await deps.skills.get(name);
 				}
 				if (skill === void 0) {
+					const record = await deps.store.getDisabled(name);
+					if (record !== void 0) try {
+						const parsed = parseFrontmatter(await readFile(record.path, "utf8"));
+						if (!("error" in parsed)) {
+							const disabledDetail = {
+								name: record.name,
+								description: parsed.value.description,
+								...parsed.value.whenToUse !== void 0 ? { whenToUse: parsed.value.whenToUse } : {},
+								invocation: { ...parsed.value.invocation },
+								provider: "skill-hub (disabled)",
+								path: record.path,
+								content: parsed.value.content
+							};
+							try {
+								const times = await stat(record.path);
+								disabledDetail.addedAt = times.birthtimeMs;
+								disabledDetail.updatedAt = times.mtimeMs;
+							} catch {}
+							writeJson(res, 200, {
+								ok: true,
+								skill: disabledDetail
+							});
+							return;
+						}
+					} catch {}
 					writeError(res, 404, "skill not found: " + name);
 					return;
 				}
 				const detail = toDetail(skill);
-				if (skill.path !== void 0) try {
-					const times = await stat(skill.path);
-					detail.addedAt = times.birthtimeMs;
-					detail.updatedAt = times.mtimeMs;
-				} catch {}
+				if (skill.path !== void 0) {
+					try {
+						const times = await stat(skill.path);
+						detail.addedAt = times.birthtimeMs;
+						detail.updatedAt = times.mtimeMs;
+					} catch {}
+					try {
+						const rb = skill.resourceBase;
+						const dir = rb?.kind === "directory" && typeof rb.path === "string" ? rb.path : skill.path.endsWith("SKILL.md") ? dirname(skill.path) : void 0;
+						if (dir !== void 0) {
+							const iface = await readSkillInterface(dir);
+							if (iface !== void 0) {
+								if (iface.displayName !== void 0) detail.displayName = iface.displayName;
+								if (iface.shortDescription !== void 0) detail.shortDescription = iface.shortDescription;
+								if (iface.brandColor !== void 0) detail.brandColor = iface.brandColor;
+								if (iface.iconSmall !== void 0) detail.iconSmall = iface.iconSmall;
+								if (iface.iconLarge !== void 0) detail.iconLarge = iface.iconLarge;
+								if (iface.defaultPrompt !== void 0) detail.defaultPrompt = iface.defaultPrompt;
+							}
+						}
+					} catch {}
+				}
 				writeJson(res, 200, {
 					ok: true,
 					skill: detail
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.skillDelete,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2306,8 +2629,8 @@ function makeRoutes(deps) {
 					path
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.toggle,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2356,8 +2679,8 @@ function makeRoutes(deps) {
 					catalog: await buildCatalog(deps, lookup?.cwd)
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.toggleBatch,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2408,8 +2731,8 @@ function makeRoutes(deps) {
 					failures
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.create,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2447,8 +2770,8 @@ function makeRoutes(deps) {
 					root
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.stats,
 			methods: ["GET"],
 			handler: async ({ res }) => {
@@ -2466,8 +2789,19 @@ function makeRoutes(deps) {
 					stats: await deps.stats()
 				});
 			}
-		}),
-		route({
+		}
+	];
+}
+//#endregion
+//#region src/routes/config.ts
+/**
+* 配置域路由：config（总开关开着也可用，设置卡自救入口）/ update 自身更新
+* 检查 / diagnosticFix。从 routes.ts 原样搬出，handler 逻辑不变。
+*/
+/** 配置域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function configRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.config,
 			methods: ["GET", "POST"],
 			jsonBody: true,
@@ -2524,6 +2858,15 @@ function makeRoutes(deps) {
 					}
 					patch[key] = value;
 				}
+				if (raw.githubToken !== void 0) {
+					const value = raw.githubToken;
+					if (value === null) patch.githubToken = void 0;
+					else if (typeof value !== "string" || value.trim() === "") patch.githubToken = void 0;
+					else if (!GITHUB_TOKEN_RE.test(value.trim())) {
+						writeError(res, 400, "githubToken looks invalid (expected a personal access token)");
+						return;
+					} else patch.githubToken = value.trim();
+				}
 				let config;
 				if (deps.updateConfig === void 0) {
 					const merged = { ...configOf(deps) };
@@ -2538,8 +2881,96 @@ function makeRoutes(deps) {
 					saved: savedOf(deps)
 				});
 			}
-		}),
-		route({
+		},
+		{
+			path: SKILL_HUB_API.update,
+			methods: ["GET"],
+			handler: async ({ res }) => {
+				writeJson(res, 200, await checkLatestRelease());
+			}
+		},
+		{
+			path: SKILL_HUB_API.diagnosticFix,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const rawPath = typeof request.path === "string" ? request.path.trim() : "";
+				if (rawPath === "") {
+					writeError(res, 400, "path is required");
+					return;
+				}
+				try {
+					await fixDiagnosticFile(rawPath, homeOf(deps));
+					deps.invalidate?.();
+					writeJson(res, 200, {
+						ok: true,
+						path: rawPath
+					});
+				} catch (error) {
+					writeRouteError(res, error);
+				}
+			}
+		}
+	];
+}
+/** Last successful check time per repo (in-memory throttle for GitHub rate limits). */
+const lastSourceCheck = /* @__PURE__ */ new Map();
+/** Last successful market update check per repo (same throttle). */
+const lastMarketCheck = /* @__PURE__ */ new Map();
+/** Market stats (stars/downloads) throttle: hourly, plus a fallback cache. */
+const lastMarketStats = /* @__PURE__ */ new Map();
+const marketStatsCache = /* @__PURE__ */ new Map();
+/** One-time seed of the in-memory stats cache from the sidecar (survives restarts). */
+let marketStatsSeeded = false;
+async function seedMarketStats(deps) {
+	if (marketStatsSeeded) return;
+	marketStatsSeeded = true;
+	try {
+		const saved = await deps.store.getMarketStatsState();
+		if (saved === void 0) return;
+		for (const [repo, stats] of Object.entries(saved.stats)) if (!marketStatsCache.has(repo)) {
+			marketStatsCache.set(repo, stats);
+			lastMarketStats.set(repo, saved.fetchedAt);
+		}
+	} catch {}
+}
+const importJobs = /* @__PURE__ */ new Map();
+function gcImportJobs() {
+	if (importJobs.size > 500) importJobs.clear();
+	const now = Date.now();
+	for (const [id, job] of importJobs) if (job.status !== "running" && now - job.createdAt > 3e5) importJobs.delete(id);
+	if (importJobs.size > 100) {
+		const sorted = [...importJobs.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+		for (let i = 0; i < sorted.length - 100; i++) importJobs.delete(sorted[i][0]);
+	}
+}
+/** Replace one skill directory with a fresh download; restores the old dir on failure. */
+async function replaceSkillDir(targetDir, download) {
+	const backup = join(dirname(targetDir), "." + basename(targetDir) + ".sync-bak-" + Date.now());
+	await rename(targetDir, backup);
+	try {
+		await download();
+	} catch (error) {
+		await rename(backup, targetDir).catch(() => {});
+		throw error;
+	}
+	await rm(backup, {
+		recursive: true,
+		force: true
+	});
+}
+//#endregion
+//#region src/routes/market.ts
+/**
+* 市场域路由：market 列表 / source 增删 / ref 锁定 / versions 选择器 /
+* check 更新检查 / stats 星标统计 / sync 对齐版本。从 routes.ts 原样搬出，
+* handler 逻辑不变。
+*/
+/** 市场域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function marketRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.market,
 			methods: ["GET"],
 			handler: async ({ res }) => {
@@ -2548,8 +2979,8 @@ function makeRoutes(deps) {
 					repos: await deps.store.listMarketSources()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.marketSource,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2566,8 +2997,8 @@ function makeRoutes(deps) {
 					repos: await deps.store.addMarketSource(repoSlug(parsed), ref)
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.marketSourceDelete,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2583,8 +3014,8 @@ function makeRoutes(deps) {
 					repos: await deps.store.removeMarketSource(repoSlug(parsed))
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.marketSourceRef,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2609,8 +3040,33 @@ function makeRoutes(deps) {
 					repos: await deps.store.listMarketSources()
 				});
 			}
-		}),
-		route({
+		},
+		{
+			path: SKILL_HUB_API.marketSourceVersions,
+			methods: ["GET"],
+			handler: async ({ res, url }) => {
+				const parsed = normalizeRepoInput(queryParam(url, "repo") ?? "");
+				if (parsed === null) {
+					writeError(res, 400, "repo must be owner/repo or a github.com URL");
+					return;
+				}
+				const repo = repoSlug(parsed);
+				const source = await deps.store.getMarketSource(repo);
+				if (source === void 0) {
+					writeError(res, 404, "market source not found: " + repo);
+					return;
+				}
+				const [releases, branches] = await Promise.all([listRepoReleases(repo), listRepoBranches(repo)]);
+				writeJson(res, 200, {
+					ok: true,
+					repo,
+					...source.ref !== void 0 && source.ref !== "" ? { current: source.ref } : {},
+					releases,
+					branches
+				});
+			}
+		},
+		{
 			path: SKILL_HUB_API.marketCheck,
 			methods: ["GET"],
 			handler: async ({ res }) => {
@@ -2623,7 +3079,7 @@ function makeRoutes(deps) {
 						...source.ref !== void 0 ? { ref: source.ref } : {}
 					};
 					const now = Date.now();
-					if (now - (lastMarketCheck.get(source.repo) ?? 0) < MIN_CHECK_INTERVAL_MS) {
+					if (now - (lastMarketCheck.get(source.repo) ?? 0) < 3e5) {
 						results.push({
 							...base,
 							updateAvailable: false,
@@ -2667,8 +3123,65 @@ function makeRoutes(deps) {
 					results
 				});
 			}
-		}),
-		route({
+		},
+		{
+			path: SKILL_HUB_API.marketStats,
+			methods: ["GET"],
+			handler: async ({ res, url }) => {
+				const refresh = queryParam(url, "refresh") === "1";
+				await seedMarketStats(deps);
+				const sources = await deps.store.listMarketSources();
+				if (lastMarketStats.size > 500) lastMarketStats.clear();
+				const results = [];
+				const now = Date.now();
+				let fetchedAny = false;
+				for (const source of sources) {
+					const cached = marketStatsCache.get(source.repo);
+					const age = now - (lastMarketStats.get(source.repo) ?? 0);
+					if (cached !== void 0 && (!refresh || age < 36e5)) {
+						results.push({
+							repo: source.repo,
+							stars: cached.stars,
+							downloads: cached.downloads,
+							...age >= 36e5 ? { stale: true } : refresh ? { throttled: true } : {}
+						});
+						continue;
+					}
+					try {
+						const stats = await getRepoStats(source.repo);
+						marketStatsCache.set(source.repo, stats);
+						lastMarketStats.set(source.repo, now);
+						fetchedAny = true;
+						results.push({
+							repo: source.repo,
+							...stats
+						});
+					} catch (error) {
+						if (cached !== void 0) results.push({
+							repo: source.repo,
+							stars: cached.stars,
+							downloads: cached.downloads,
+							stale: true
+						});
+						else results.push({
+							repo: source.repo,
+							stars: 0,
+							downloads: 0,
+							error: error instanceof Error ? error.message : String(error)
+						});
+					}
+				}
+				if (fetchedAny) deps.store.saveMarketStatsState({
+					fetchedAt: now,
+					stats: Object.fromEntries(marketStatsCache)
+				}).catch(() => {});
+				writeJson(res, 200, {
+					ok: true,
+					results
+				});
+			}
+		},
+		{
 			path: SKILL_HUB_API.marketSync,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2707,8 +3220,19 @@ function makeRoutes(deps) {
 					skills: tracked !== void 0 ? [...tracked.skills] : []
 				});
 			}
-		}),
-		route({
+		}
+	];
+}
+//#endregion
+//#region src/routes/repo-import.ts
+/**
+* 仓库导入域路由：repo 发现 / repoImport 异步导入任务 / progress 轮询 /
+* cancel 取消。从 routes.ts 原样搬出，handler 逻辑不变。
+*/
+/** 仓库导入域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function repoImportRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.repo,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
@@ -2725,8 +3249,11 @@ function makeRoutes(deps) {
 				}
 				if (ref === void 0 || ref === "") {
 					const releaseTag = await getLatestReleaseTag(repo);
-					if (releaseTag !== void 0) ref = releaseTag;
-					else {
+					if (releaseTag !== void 0) {
+						ref = releaseTag;
+						const existing = await deps.store.getMarketSource(repo);
+						if (existing !== void 0 && (existing.ref === void 0 || existing.ref === "")) await deps.store.setMarketSourceRef(repo, releaseTag);
+					} else {
 						const branches = await listRepoBranches(repo);
 						if (branches.length === 0) {
 							writeError(res, 404, "repo has no branches to scan");
@@ -2742,16 +3269,17 @@ function makeRoutes(deps) {
 						return;
 					}
 				}
-				const { ref: resolvedRef, tree } = await loadRepoTree(repo, ref);
+				const { ref: resolvedRef, tree, truncated } = await loadRepoTree(repo, ref);
 				writeJson(res, 200, {
 					ok: true,
 					repo,
 					ref: resolvedRef,
-					entries: discoverRepoEntries(tree, repo, await knownSkillNames(deps))
+					entries: discoverRepoEntries(tree, repo, await knownSkillNames(deps)),
+					...truncated ? { truncated: true } : {}
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.repoImport,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2889,8 +3417,8 @@ function makeRoutes(deps) {
 					totalBytes
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.repoImportProgress,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
@@ -2923,8 +3451,8 @@ function makeRoutes(deps) {
 					...job.error !== void 0 ? { error: job.error } : {}
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.repoImportCancel,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2950,22 +3478,26 @@ function makeRoutes(deps) {
 					status: job.status
 				});
 			}
-		}),
-		route({
-			path: SKILL_HUB_API.update,
-			methods: ["GET"],
-			handler: async ({ res }) => {
-				writeJson(res, 200, await checkLatestRelease());
-			}
-		}),
-		route({
+		}
+	];
+}
+//#endregion
+//#region src/routes/groups.ts
+/**
+* 分组域路由：groups / tag 新建重命名 / tag 删除 / tag 成员 / tag 重排 /
+* collection 重排 / source-group 重排。从 routes.ts 原样搬出，handler 逻辑不变。
+*/
+/** 分组域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function groupRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.groups,
 			methods: ["GET"],
 			handler: async ({ res }) => {
 				writeJson(res, 200, await buildGroups(deps));
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.tag,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2985,8 +3517,8 @@ function makeRoutes(deps) {
 					tags: await deps.store.listTags()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.tagDelete,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3006,8 +3538,8 @@ function makeRoutes(deps) {
 					tags: await deps.store.listTags()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.tagMembers,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3029,8 +3561,8 @@ function makeRoutes(deps) {
 					tags: await deps.store.listTags()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.tagReorder,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3050,8 +3582,8 @@ function makeRoutes(deps) {
 					throw error;
 				}
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.collectionReorder,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3065,8 +3597,8 @@ function makeRoutes(deps) {
 					order
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceGroupReorder,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3078,8 +3610,20 @@ function makeRoutes(deps) {
 					order: await deps.store.reorderSourceGroups(orderedKeys)
 				});
 			}
-		}),
-		route({
+		}
+	];
+}
+//#endregion
+//#region src/routes/sources.ts
+/**
+* 来源跟踪域路由：sources 列表 / check 上游更新 / sync 同步 / delete 跟进
+* 删除 / restore 恢复 / trash/clear 清空回收站。从 routes.ts 原样搬出，
+* handler 逻辑不变。
+*/
+/** 来源跟踪域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function sourceRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.sources,
 			methods: ["GET"],
 			handler: async ({ res }) => {
@@ -3112,8 +3656,8 @@ function makeRoutes(deps) {
 					trash
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceCheck,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3138,7 +3682,7 @@ function makeRoutes(deps) {
 						...item.ref !== void 0 ? { ref: item.ref } : {}
 					};
 					const now = Date.now();
-					if (now - (lastSourceCheck.get(item.repo) ?? 0) < MIN_CHECK_INTERVAL_MS) {
+					if (now - (lastSourceCheck.get(item.repo) ?? 0) < 3e5) {
 						results.push({
 							...base,
 							changed: false,
@@ -3195,8 +3739,8 @@ function makeRoutes(deps) {
 					results
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceSync,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3267,8 +3811,8 @@ function makeRoutes(deps) {
 					failed
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceDelete,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3352,8 +3896,8 @@ function makeRoutes(deps) {
 					failed
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceRestore,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3385,8 +3929,8 @@ function makeRoutes(deps) {
 					path
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceTrashClear,
 			methods: ["POST"],
 			handler: async ({ res }) => {
@@ -3412,10 +3956,27 @@ function makeRoutes(deps) {
 					failed
 				});
 			}
-		})
+		}
 	];
 }
 //#endregion
+//#region src/routes.ts
+/**
+* Build every /api/skill-hub route.
+* @param deps - skill registry view + sidecar store.
+* @returns the exact-path routes.
+*/
+function makeRoutes(deps) {
+	return [
+		...catalogRoutes(deps),
+		...configRoutes(deps),
+		...marketRoutes(deps),
+		...repoImportRoutes(deps),
+		...groupRoutes(deps),
+		...sourceRoutes(deps)
+	].map((spec) => createRoute(deps, spec));
+}
+//#endregion
 //#region src/stats.ts
 /** Fallback freeze horizon when no rolling window is configured (14 days). */
 const STATS_FREEZE_AFTER_MS = 336 * 60 * 60 * 1e3;
@@ -3454,6 +4015,22 @@ function isFrozen(record, watermark) {
 	const created = record.header.createdAt;
 	return typeof created === "number" && created > 0 && created < watermark;
 }
+/** Bounded-concurrency map: session-log reads are independent decompressions, so wall time scales ~1/limit. Merge stays sequential in index order. */
+async function mapConcurrent(items, limit, worker) {
+	const results = new Array(items.length);
+	let cursor = 0;
+	const runners = Array.from({ length: Math.min(Math.max(limit, 1), items.length) }, async () => {
+		while (cursor < items.length) {
+			const index = cursor;
+			cursor += 1;
+			results[index] = await worker(items[index], index);
+		}
+	});
+	await Promise.all(runners);
+	return results;
+}
+/** Max parallel session-log reads per scan (read-only; merge is order-independent). */
+const SCAN_READ_CONCURRENCY = 6;
 function mergeInto(totals, counted) {
 	for (const [name, stat] of counted) {
 		const total = totals[name];
@@ -3499,20 +4076,23 @@ async function scan(query, checkpoint, nowMs, windowDays) {
 	if (nowMs - checkpoint.lastFullReconcile >= 864e5 || checkpoint.windowDays !== windowDays) {
 		const cache = {};
 		const totals = {};
-		for (const record of sessions) {
-			let counted;
+		const countedList = await mapConcurrent(sessions, SCAN_READ_CONCURRENCY, async (record) => {
 			try {
-				counted = countSkillInvocations((await query.readSession(record.header.id)).events);
+				return countSkillInvocations((await query.readSession(record.header.id)).events);
 			} catch {
-				continue;
+				return;
 			}
+		});
+		sessions.forEach((record, index) => {
+			const counted = countedList[index];
+			if (counted === void 0) return;
 			const created = record.header.createdAt;
 			if (isFrozen(record, cutoff) && counted.size > 0 && typeof created === "number") cache[record.header.id] = {
 				createdAt: created,
 				counts: Object.fromEntries(counted)
 			};
 			if (inWindow(created, windowDays, nowMs)) mergeInto(totals, counted);
-		}
+		});
 		checkpoint.frozenSessions = cache;
 		checkpoint.frozenBefore = cutoff;
 		checkpoint.windowDays = windowDays;
@@ -3523,13 +4103,16 @@ async function scan(query, checkpoint, nowMs, windowDays) {
 		};
 	}
 	const recent = {};
-	for (const record of sessions) {
-		if (isFrozen(record, checkpoint.frozenBefore)) continue;
+	const recentList = await mapConcurrent(sessions.filter((record) => !isFrozen(record, checkpoint.frozenBefore)), SCAN_READ_CONCURRENCY, async (record) => {
 		try {
-			mergeInto(recent, countSkillInvocations((await query.readSession(record.header.id)).events));
+			return countSkillInvocations((await query.readSession(record.header.id)).events);
 		} catch {
-			continue;
+			return;
 		}
+	});
+	for (const counted of recentList) {
+		if (counted === void 0) continue;
+		mergeInto(recent, counted);
 	}
 	const totals = {};
 	for (const [id, entry] of Object.entries(checkpoint.frozenSessions)) {
@@ -3567,7 +4150,7 @@ function createSkillStatsReader(query, ttlMs = 3e5, options = {}) {
 		lastFullReconcile: 0
 	};
 	const now = options.now ?? (() => Date.now());
-	let cached;
+	let cached = checkpoint.lastTotals !== void 0 ? [...checkpoint.lastTotals] : void 0;
 	let cachedAt = 0;
 	let refreshing = null;
 	let lastScanDurationMs = 0;
@@ -3578,11 +4161,12 @@ function createSkillStatsReader(query, ttlMs = 3e5, options = {}) {
 		if (cached !== void 0 && startedAt - cachedAt < ttl) return cached;
 		if (refreshing === null) {
 			const windowDays = options.windowDays?.() ?? 0;
-			refreshing = scan(query, checkpoint, startedAt, windowDays).then(({ stats, mutated }) => {
+			refreshing = scan(query, checkpoint, startedAt, windowDays).then(({ stats }) => {
 				cached = stats;
 				cachedAt = now();
 				lastScanDurationMs = Math.max(0, cachedAt - startedAt);
-				if (mutated) options.onCheckpoint?.({
+				checkpoint.lastTotals = stats;
+				options.onCheckpoint?.({
 					...checkpoint,
 					frozenSessions: { ...checkpoint.frozenSessions }
 				});
@@ -3630,6 +4214,7 @@ const HubSettingsSchema = z.object({
 	showGroupSummary: z.boolean().default(HUB_CONFIG_DEFAULTS.showGroupSummary),
 	dotModelColor: z.string().pattern(HEX_COLOR_RE),
 	dotUserColor: z.string().pattern(HEX_COLOR_RE),
+	githubToken: z.string(),
 	statsWindowDays: z.number().min(0).max(3650).default(HUB_CONFIG_DEFAULTS.statsWindowDays),
 	statsScanMinutes: z.number().min(1).max(1440).default(HUB_CONFIG_DEFAULTS.statsScanMinutes)
 });
@@ -3672,6 +4257,7 @@ function apply(ctx, config) {
 			disposeProvider = void 0;
 		}
 		const value = current();
+		setGithubToken(value.githubToken);
 		if (value.announceToAgent) disposeSection = ctx.systemPrompt.section({
 			name: "plugin:dsh-skill-hub",
 			order: SECTION_ORDER,
@@ -3738,7 +4324,7 @@ function apply(ctx, config) {
 				const value = current().statsWindowDays;
 				return typeof value === "number" && value >= 0 ? Math.floor(value) : HUB_CONFIG_DEFAULTS.statsWindowDays;
 			};
-			stats = createSkillStatsReader(sctx.sessionQuery, () => scanMinutes() * 6e4, {
+			const reader = createSkillStatsReader(sctx.sessionQuery, () => scanMinutes() * 6e4, {
 				checkpoint: saved,
 				windowDays,
 				onCheckpoint: (next) => {
@@ -3747,7 +4333,9 @@ function apply(ctx, config) {
 					});
 				}
 			});
+			stats = reader;
 			sync();
+			reader();
 		})();
 	});
 }