dsh-skill-hub 0.3.7 → 0.3.9

package/lib/index.js

@@ -6,13 +6,7 @@ import { homedir } from "node:os";
 import { dump, load } from "js-yaml";
 import { isSkillName } from "@deepseek-ai/dsh-skill";
 import { randomUUID } from "node:crypto";
-//#region src/protocol.ts
-/**
-* Shared API contract for dsh-skill-hub: the route paths and payload shapes
-* both the host half and the browser half import. The browser half must never
-* depend on host SDK packages, so registry types are re-spelled here as
-* plain JSON-safe interfaces.
-*/
+//#region src/protocol/api.ts
 /** Browser-facing base paths of the skill-hub API family. */
 const SKILL_HUB_API = {
 	catalog: "/api/skill-hub/catalog",
@@ -48,8 +42,11 @@ const SKILL_HUB_API = {
 	sourceRestore: "/api/skill-hub/sources/restore",
 	sourceTrashClear: "/api/skill-hub/sources/trash/clear",
 	diagnosticFix: "/api/skill-hub/diagnostic/fix",
-	marketSourceVersions: "/api/skill-hub/market/source/versions"
+	marketSourceVersions: "/api/skill-hub/market/source/versions",
+	marketStats: "/api/skill-hub/market/stats"
 };
+//#endregion
+//#region src/protocol/config.ts
 /**
 * Hub config defaults — the single source every layer reads: the cordis
 * schema (index.ts), the host's saved-override merge, and the routes'
@@ -74,6 +71,7 @@ const HUB_CONFIG_DEFAULTS = {
 function resolveHubConfig(saved, base = {}) {
 	const dotModelColor = saved.dotModelColor !== void 0 ? saved.dotModelColor : base.dotModelColor;
 	const dotUserColor = saved.dotUserColor !== void 0 ? saved.dotUserColor : base.dotUserColor;
+	const githubToken = saved.githubToken !== void 0 ? saved.githubToken : base.githubToken;
 	const windowDays = clampNumber(saved.statsWindowDays ?? base.statsWindowDays, 0) ?? HUB_CONFIG_DEFAULTS.statsWindowDays;
 	const scanMinutes = clampNumber(saved.statsScanMinutes ?? base.statsScanMinutes, 1) ?? HUB_CONFIG_DEFAULTS.statsScanMinutes;
 	return {
@@ -85,7 +83,8 @@ function resolveHubConfig(saved, base = {}) {
 		statsWindowDays: windowDays,
 		statsScanMinutes: scanMinutes,
 		...dotModelColor !== void 0 ? { dotModelColor } : {},
-		...dotUserColor !== void 0 ? { dotUserColor } : {}
+		...dotUserColor !== void 0 ? { dotUserColor } : {},
+		...githubToken !== void 0 ? { githubToken } : {}
 	};
 }
 /** Clamp a numeric override into a valid value; undefined/invalid stays undefined. */
@@ -95,25 +94,16 @@ function clampNumber(value, min) {
 }
 /** HEX color validation shared by host routes and the settings card. */
 const HEX_COLOR_RE = /^#[0-9a-f]{6}$/i;
+/** GitHub token validation shared by host routes and the settings card. */
+const GITHUB_TOKEN_RE = /^[A-Za-z0-9_\-]{8,255}$/;
+//#endregion
+//#region src/protocol/sources.ts
 /** 项目级技能来源（它们有 workspace 归属，不属于「个人」组）。 */
 function isProjectSource(source) {
 	return source === "project-dsh" || source === "project-agents";
 }
 //#endregion
-//#region src/store.ts
-/**
-* Hub sidecar store: remembers which skills the hub toggled off and the
-* user's organization/tracking records. Disabling renames the skill's
-* SKILL.md (or flat .md) out of the filesystem provider's discovery shapes,
-* so the provider catalog alone cannot see disabled skills; this store keeps
-* name/path/root so the GUI can list them and re-enable. It also persists
-* user tag groups, upstream source records (repo + commit snapshot for
-* update checks), the market source list, and the trash (skills removed
-* after upstream deletion).
-*
-* State file: $DSH_HOME/dsh-skill-hub.json — a small JSON document written
-* atomically (tmp file + rename).
-*/
+//#region src/store/paths.ts
 /** 默认场景名（系统预置的兜底场景，新技能自动归入）。 */
 const DEFAULT_SCENE_NAME = "通用";
 /** Resolve the DSH home directory (the filesystem provider's user-dsh root base). */
@@ -124,6 +114,8 @@ function dshHome() {
 function statePath(home = dshHome()) {
 	return join(home, "dsh-skill-hub.json");
 }
+//#endregion
+//#region src/store/errors.ts
 /**
 * Business-rule failure the routes layer can map onto a 4xx status instead
 * of a blanket 500: user input is invalid (validation → 400), the target
@@ -138,6 +130,8 @@ var StoreError = class extends Error {
 		this.kind = kind;
 	}
 };
+//#endregion
+//#region src/store/migrate.ts
 /**
 * Normalize an arbitrary parsed sidecar document to the current schema.
 * v1 to v2: scenes are dropped (the one-click role merged into group
@@ -184,10 +178,152 @@ function migrateStore(parsed) {
 		...marketSources !== void 0 ? { marketSources } : {},
 		...trash !== void 0 ? { trash } : {},
 		...record.skillStats !== void 0 ? { skillStats: record.skillStats } : {},
+		...record.marketStats !== void 0 ? { marketStats: record.marketStats } : {},
 		...Array.isArray(record.collectionOrder) ? { collectionOrder: record.collectionOrder } : {},
 		...Array.isArray(record.sourceGroupOrder) ? { sourceGroupOrder: record.sourceGroupOrder } : {}
 	};
 }
+/** 小优化：统一的非空字符串数组清洗（去空、去重可选由调用方处理）。 */
+function cleanStringList(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter((n) => typeof n === "string" && n !== "");
+}
+/**
+* 把迁移后的原始文档校验为内存状态：坏条目丢弃、坏桶降级为空，
+* 绝不因一条脏数据丢掉整个 sidecar（与原 ensureLoaded 内联逻辑一致）。
+*/
+function hydrateMigratedState(migrated) {
+	const entries = /* @__PURE__ */ new Map();
+	if (Array.isArray(migrated.disabled)) {
+		for (const entry of migrated.disabled) if (typeof entry?.name === "string" && typeof entry?.path === "string") entries.set(entry.name, entry);
+	}
+	const config = {};
+	const saved = migrated.config;
+	if (typeof saved === "object" && saved !== null) {
+		if (typeof saved.enabled === "boolean") config.enabled = saved.enabled;
+		if (typeof saved.announceToAgent === "boolean") config.announceToAgent = saved.announceToAgent;
+		if (typeof saved.dotModelColor === "string" && saved.dotModelColor !== "") config.dotModelColor = saved.dotModelColor;
+		if (typeof saved.dotUserColor === "string" && saved.dotUserColor !== "") config.dotUserColor = saved.dotUserColor;
+		if (typeof saved.showUseCount === "boolean") config.showUseCount = saved.showUseCount;
+		if (typeof saved.showUseTime === "boolean") config.showUseTime = saved.showUseTime;
+		if (typeof saved.showGroupSummary === "boolean") config.showGroupSummary = saved.showGroupSummary;
+	}
+	const tagsById = /* @__PURE__ */ new Map();
+	if (Array.isArray(migrated.tags)) for (const entry of migrated.tags) {
+		const tag = entry;
+		if (tag !== null && typeof tag === "object" && typeof tag.id === "string" && typeof tag.name === "string" && Array.isArray(tag.skillNames)) tagsById.set(tag.id, {
+			id: tag.id,
+			name: tag.name,
+			skillNames: tag.skillNames.filter((n) => typeof n === "string"),
+			...tag.default === true ? { default: true } : {}
+		});
+	}
+	const sourcesByRepo = /* @__PURE__ */ new Map();
+	if (Array.isArray(migrated.sources)) for (const entry of migrated.sources) {
+		const source = entry;
+		if (source !== null && typeof source === "object" && typeof source.repo === "string" && source.repo !== "" && Array.isArray(source.skills)) {
+			const manifest = source.manifest;
+			const rawRoot = typeof source.root === "string" && source.root !== "" && /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(source.root) ? source.root : "skills";
+			sourcesByRepo.set(source.repo, {
+				repo: source.repo,
+				...typeof source.ref === "string" && source.ref !== "" ? { ref: source.ref } : {},
+				root: rawRoot,
+				commitSha: typeof source.commitSha === "string" ? source.commitSha : "",
+				skills: source.skills.filter((n) => typeof n === "string"),
+				...manifest !== null && typeof manifest === "object" && !Array.isArray(manifest) ? { manifest: Object.fromEntries(Object.entries(manifest).filter(([, size]) => typeof size === "number")) } : {}
+			});
+		}
+	}
+	const marketSources = [];
+	if (Array.isArray(migrated.marketSources)) for (const entry of migrated.marketSources) {
+		const item = entry;
+		if (item !== null && typeof item === "object" && typeof item.repo === "string" && item.repo !== "" && !marketSources.some((s) => s.repo === item.repo)) marketSources.push({
+			repo: item.repo,
+			...typeof item.ref === "string" && item.ref !== "" ? { ref: item.ref } : {},
+			...typeof item.commitSha === "string" && item.commitSha !== "" ? { commitSha: item.commitSha } : {}
+		});
+	}
+	const trashByName = /* @__PURE__ */ new Map();
+	if (Array.isArray(migrated.trash)) for (const entry of migrated.trash) {
+		const item = entry;
+		if (item !== null && typeof item === "object" && typeof item.name === "string" && typeof item.path === "string") {
+			const origin = item.origin;
+			const tagIds = item.tagIds;
+			trashByName.set(item.name, {
+				name: item.name,
+				path: item.path,
+				movedAt: typeof item.movedAt === "number" ? item.movedAt : 0,
+				...typeof item.sourcePath === "string" && item.sourcePath !== "" ? { sourcePath: item.sourcePath } : {},
+				...origin !== null && typeof origin === "object" && typeof origin.repo === "string" && origin.repo !== "" && typeof origin.root === "string" && origin.root !== "" && /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(origin.root) ? { origin: {
+					repo: origin.repo,
+					root: origin.root,
+					...typeof origin.ref === "string" && origin.ref !== "" ? { ref: origin.ref } : {},
+					commitSha: typeof origin.commitSha === "string" ? origin.commitSha : ""
+				} } : {},
+				...Array.isArray(tagIds) ? { tagIds: tagIds.filter((id) => typeof id === "string") } : {}
+			});
+		}
+	}
+	let skillStats = void 0;
+	const savedStats = migrated.skillStats;
+	if (savedStats !== null && typeof savedStats === "object" && typeof savedStats.frozenBefore === "number" && typeof savedStats.lastFullReconcile === "number" && typeof savedStats.windowDays === "number" && typeof savedStats.frozenSessions === "object" && savedStats.frozenSessions !== null) {
+		const sessions = {};
+		for (const [id, entry] of Object.entries(savedStats.frozenSessions)) {
+			if (entry === null || typeof entry !== "object" || typeof entry.createdAt !== "number" || typeof entry.counts !== "object" || entry.counts === null) continue;
+			const counts = {};
+			for (const [name, stat] of Object.entries(entry.counts)) if (stat !== null && typeof stat === "object" && typeof stat.count === "number" && typeof stat.lastUsed === "number") counts[name] = {
+				count: stat.count,
+				lastUsed: stat.lastUsed
+			};
+			sessions[id] = {
+				createdAt: entry.createdAt,
+				counts
+			};
+		}
+		const rawTotals = savedStats.lastTotals;
+		const lastTotals = Array.isArray(rawTotals) ? rawTotals.filter((entry) => entry !== null && typeof entry === "object" && typeof entry.name === "string" && typeof entry.count === "number").map((entry) => ({
+			name: entry.name,
+			count: entry.count,
+			...typeof entry.lastUsed === "number" ? { lastUsed: entry.lastUsed } : {}
+		})) : void 0;
+		skillStats = {
+			windowDays: savedStats.windowDays,
+			frozenBefore: savedStats.frozenBefore,
+			frozenSessions: sessions,
+			lastFullReconcile: savedStats.lastFullReconcile,
+			...lastTotals !== void 0 ? { lastTotals } : {}
+		};
+	}
+	let marketStats = void 0;
+	const savedMarketStats = migrated.marketStats;
+	if (savedMarketStats !== null && typeof savedMarketStats === "object" && typeof savedMarketStats.fetchedAt === "number" && typeof savedMarketStats.stats === "object" && savedMarketStats.stats !== null) {
+		const stats = {};
+		for (const [repo, entry] of Object.entries(savedMarketStats.stats)) if (entry !== null && typeof entry === "object" && typeof entry.stars === "number" && typeof entry.downloads === "number") stats[repo] = {
+			stars: entry.stars,
+			downloads: entry.downloads
+		};
+		marketStats = {
+			fetchedAt: savedMarketStats.fetchedAt,
+			stats
+		};
+	}
+	const collectionOrder = cleanStringList(migrated.collectionOrder);
+	const sourceGroupOrder = cleanStringList(migrated.sourceGroupOrder);
+	return {
+		entries,
+		config,
+		tagsById,
+		sourcesByRepo,
+		marketSources,
+		trashByName,
+		skillStats,
+		marketStats,
+		collectionOrder,
+		sourceGroupOrder
+	};
+}
+//#endregion
+//#region src/store/store.ts
 /** Sidecar state owner. */
 var SkillHubStore = class {
 	file;
@@ -198,6 +334,7 @@ var SkillHubStore = class {
 	marketSources = [];
 	trashByName = /* @__PURE__ */ new Map();
 	skillStats = void 0;
+	marketStats = void 0;
 	collectionOrder = [];
 	sourceGroupOrder = [];
 	loaded = false;
@@ -215,97 +352,17 @@ var SkillHubStore = class {
 			const migrated = migrateStore(JSON.parse(raw));
 			if (migrated === null) console.warn("[dsh-skill-hub] sidecar state uses a newer schema than this plugin supports; starting empty");
 			else {
-				if (Array.isArray(migrated.disabled)) {
-					for (const entry of migrated.disabled) if (typeof entry?.name === "string" && typeof entry?.path === "string") this.entries.set(entry.name, entry);
-				}
-				const saved = migrated.config;
-				if (typeof saved === "object" && saved !== null) {
-					if (typeof saved.enabled === "boolean") this.config.enabled = saved.enabled;
-					if (typeof saved.announceToAgent === "boolean") this.config.announceToAgent = saved.announceToAgent;
-					if (typeof saved.dotModelColor === "string" && saved.dotModelColor !== "") this.config.dotModelColor = saved.dotModelColor;
-					if (typeof saved.dotUserColor === "string" && saved.dotUserColor !== "") this.config.dotUserColor = saved.dotUserColor;
-					if (typeof saved.showUseCount === "boolean") this.config.showUseCount = saved.showUseCount;
-					if (typeof saved.showUseTime === "boolean") this.config.showUseTime = saved.showUseTime;
-					if (typeof saved.showGroupSummary === "boolean") this.config.showGroupSummary = saved.showGroupSummary;
-				}
-				if (Array.isArray(migrated.tags)) for (const entry of migrated.tags) {
-					const tag = entry;
-					if (tag !== null && typeof tag === "object" && typeof tag.id === "string" && typeof tag.name === "string" && Array.isArray(tag.skillNames)) this.tagsById.set(tag.id, {
-						id: tag.id,
-						name: tag.name,
-						skillNames: tag.skillNames.filter((n) => typeof n === "string"),
-						...tag.default === true ? { default: true } : {}
-					});
-				}
-				if (Array.isArray(migrated.sources)) for (const entry of migrated.sources) {
-					const source = entry;
-					if (source !== null && typeof source === "object" && typeof source.repo === "string" && source.repo !== "" && Array.isArray(source.skills)) {
-						const manifest = source.manifest;
-						const rawRoot = typeof source.root === "string" && source.root !== "" && /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(source.root) ? source.root : "skills";
-						this.sourcesByRepo.set(source.repo, {
-							repo: source.repo,
-							...typeof source.ref === "string" && source.ref !== "" ? { ref: source.ref } : {},
-							root: rawRoot,
-							commitSha: typeof source.commitSha === "string" ? source.commitSha : "",
-							skills: source.skills.filter((n) => typeof n === "string"),
-							...manifest !== null && typeof manifest === "object" && !Array.isArray(manifest) ? { manifest: Object.fromEntries(Object.entries(manifest).filter(([, size]) => typeof size === "number")) } : {}
-						});
-					}
-				}
-				if (Array.isArray(migrated.marketSources)) for (const entry of migrated.marketSources) {
-					const item = entry;
-					if (item !== null && typeof item === "object" && typeof item.repo === "string" && item.repo !== "" && !this.marketSources.some((s) => s.repo === item.repo)) this.marketSources.push({
-						repo: item.repo,
-						...typeof item.ref === "string" && item.ref !== "" ? { ref: item.ref } : {},
-						...typeof item.commitSha === "string" && item.commitSha !== "" ? { commitSha: item.commitSha } : {}
-					});
-				}
-				if (Array.isArray(migrated.trash)) for (const entry of migrated.trash) {
-					const item = entry;
-					if (item !== null && typeof item === "object" && typeof item.name === "string" && typeof item.path === "string") {
-						const origin = item.origin;
-						const tagIds = item.tagIds;
-						this.trashByName.set(item.name, {
-							name: item.name,
-							path: item.path,
-							movedAt: typeof item.movedAt === "number" ? item.movedAt : 0,
-							...typeof item.sourcePath === "string" && item.sourcePath !== "" ? { sourcePath: item.sourcePath } : {},
-							...origin !== null && typeof origin === "object" && typeof origin.repo === "string" && origin.repo !== "" && typeof origin.root === "string" && origin.root !== "" && /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(origin.root) ? { origin: {
-								repo: origin.repo,
-								root: origin.root,
-								...typeof origin.ref === "string" && origin.ref !== "" ? { ref: origin.ref } : {},
-								commitSha: typeof origin.commitSha === "string" ? origin.commitSha : ""
-							} } : {},
-							...Array.isArray(tagIds) ? { tagIds: tagIds.filter((id) => typeof id === "string") } : {}
-						});
-					}
-				}
-				const savedStats = migrated.skillStats;
-				if (savedStats !== null && typeof savedStats === "object" && typeof savedStats.frozenBefore === "number" && typeof savedStats.lastFullReconcile === "number" && typeof savedStats.windowDays === "number" && typeof savedStats.frozenSessions === "object" && savedStats.frozenSessions !== null) {
-					const sessions = {};
-					for (const [id, entry] of Object.entries(savedStats.frozenSessions)) {
-						if (entry === null || typeof entry !== "object" || typeof entry.createdAt !== "number" || typeof entry.counts !== "object" || entry.counts === null) continue;
-						const counts = {};
-						for (const [name, stat] of Object.entries(entry.counts)) if (stat !== null && typeof stat === "object" && typeof stat.count === "number" && typeof stat.lastUsed === "number") counts[name] = {
-							count: stat.count,
-							lastUsed: stat.lastUsed
-						};
-						sessions[id] = {
-							createdAt: entry.createdAt,
-							counts
-						};
-					}
-					this.skillStats = {
-						windowDays: savedStats.windowDays,
-						frozenBefore: savedStats.frozenBefore,
-						frozenSessions: sessions,
-						lastFullReconcile: savedStats.lastFullReconcile
-					};
-				}
-				const rawColOrder = migrated.collectionOrder;
-				if (Array.isArray(rawColOrder)) this.collectionOrder = rawColOrder.filter((n) => typeof n === "string" && n !== "");
-				const rawSrcOrder = migrated.sourceGroupOrder;
-				if (Array.isArray(rawSrcOrder)) this.sourceGroupOrder = rawSrcOrder.filter((n) => typeof n === "string" && n !== "");
+				const state = hydrateMigratedState(migrated);
+				this.entries = state.entries;
+				this.config = state.config;
+				this.tagsById = state.tagsById;
+				this.sourcesByRepo = state.sourcesByRepo;
+				this.marketSources = state.marketSources;
+				this.trashByName = state.trashByName;
+				this.skillStats = state.skillStats;
+				this.marketStats = state.marketStats;
+				this.collectionOrder = state.collectionOrder;
+				this.sourceGroupOrder = state.sourceGroupOrder;
 			}
 		} catch (error) {
 			if (error.code !== "ENOENT") console.warn("[dsh-skill-hub] sidecar state unreadable, starting empty:", error instanceof Error ? error.message : error);
@@ -699,17 +756,36 @@ var SkillHubStore = class {
 		await this.ensureLoaded();
 		return this.skillStats !== void 0 ? {
 			...this.skillStats,
-			frozenSessions: { ...this.skillStats.frozenSessions }
+			frozenSessions: { ...this.skillStats.frozenSessions },
+			...this.skillStats.lastTotals !== void 0 ? { lastTotals: [...this.skillStats.lastTotals] } : {}
 		} : void 0;
 	}
-	/** Persist a usage-statistics checkpoint (written at most ~once a day, on full reconciliations). */
+	/** Persist a usage-statistics checkpoint (after every completed scan; cadence follows the scan TTL). */
 	async saveSkillStatsState(state) {
 		await this.ensureLoaded();
 		this.skillStats = {
 			windowDays: state.windowDays,
 			frozenBefore: state.frozenBefore,
 			frozenSessions: { ...state.frozenSessions },
-			lastFullReconcile: state.lastFullReconcile
+			lastFullReconcile: state.lastFullReconcile,
+			...state.lastTotals !== void 0 ? { lastTotals: [...state.lastTotals] } : {}
+		};
+		await this.persist();
+	}
+	/** The persisted market-stats snapshot (undefined until first saved). */
+	async getMarketStatsState() {
+		await this.ensureLoaded();
+		return this.marketStats !== void 0 ? {
+			fetchedAt: this.marketStats.fetchedAt,
+			stats: { ...this.marketStats.stats }
+		} : void 0;
+	}
+	/** Persist a market-stats snapshot (written when a refresh fetched anything new). */
+	async saveMarketStatsState(state) {
+		await this.ensureLoaded();
+		this.marketStats = {
+			fetchedAt: state.fetchedAt,
+			stats: { ...state.stats }
 		};
 		await this.persist();
 	}
@@ -724,6 +800,7 @@ var SkillHubStore = class {
 				...this.marketSources.length > 0 ? { marketSources: [...this.marketSources] } : {},
 				...this.trashByName.size > 0 ? { trash: [...this.trashByName.values()] } : {},
 				...this.skillStats !== void 0 ? { skillStats: this.skillStats } : {},
+				...this.marketStats !== void 0 ? { marketStats: this.marketStats } : {},
 				...this.collectionOrder.length > 0 ? { collectionOrder: [...this.collectionOrder] } : {},
 				...this.sourceGroupOrder.length > 0 ? { sourceGroupOrder: [...this.sourceGroupOrder] } : {}
 			};
@@ -1349,17 +1426,12 @@ var SkillHubProvider = class {
 	}
 };
 //#endregion
-//#region src/repo.ts
+//#region src/repo/github-client.ts
 /**
-* GitHub repository skill discovery/import helpers.
-*
-* Kept dependency-free and mostly pure so the root/origin rules are easy to
-* test. Roots are auto-derived: any top-level directory that contains a
-* `**\/SKILL.md` (e.g. `skills/**`, `design-templates/**`, `templates/**`,
-* `workflows/**`) is treated as a skill root. No hard-coded allowlist.
+* GitHub API 统一请求层：token 管理、鉴权头、ETag 缓存、错误映射、
+* 带缓存的 JSON GET。从 repo.ts 抽出，原 6 处重复的 try/catch +
+* headers + json 解析收敛到 fetchJson / fetchJsonCached 两个入口。
 */
-/** Top-level directory pattern for a skill root: visible, non-dot, safe chars. First char must be alphanum. */
-const ROOT_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 /** Fetch failure carrying a useful HTTP status for the route layer. */
 var RepoFetchError = class extends Error {
 	status;
@@ -1372,13 +1444,25 @@ var RepoFetchError = class extends Error {
 /**
 * GitHub token for authenticated API calls. Read from GITHUB_TOKEN /
 * GH_TOKEN at module load; setGithubToken() overrides it at runtime (the
-* plugin config route calls it when a saved token exists).
+* host calls it from the settings sync whenever the card value changes;
+* an absent value falls back to the env var).
 */
 let githubToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? "";
+/** Override the GitHub token at runtime ('' falls back to the env var). */
+function setGithubToken(token) {
+	githubToken = token !== void 0 && token !== "" ? token : process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? "";
+}
 /** Authorization header for api.github.com / raw.githubusercontent.com calls. */
 function githubAuthHeaders() {
 	return githubToken === "" ? {} : { authorization: "Bearer " + githubToken };
 }
+/** JSON API 默认请求头（含鉴权）。 */
+function apiHeaders() {
+	return {
+		accept: "application/vnd.github+json",
+		...githubAuthHeaders()
+	};
+}
 /** ETag cache for GitHub API JSON (mirrors codex lib.rs marker+fingerprint). In-memory only, saves 304 for daily checks. */
 const etagCache = /* @__PURE__ */ new Map();
 const ETAG_MAX = 200;
@@ -1407,41 +1491,31 @@ function fetchError(context, response, fallbackStatus = 502) {
 	}
 	return new RepoFetchError(context + " (HTTP " + response.status + ")", response.status === 404 ? 404 : fallbackStatus);
 }
-/** `owner/repo` slug for a parsed reference. */
-function repoSlug(ref) {
-	return `${ref.owner}/${ref.repo}`;
+/** 是否限流/中断类错误（调用方可直接透出，不再包装）。 */
+function isAbortError(error) {
+	return error instanceof Error && (error.name === "AbortError" || error.message.includes("aborted") || error.message.includes("Abort"));
 }
 /**
-* Normalize a GitHub URL or `owner/repo`/`owner/repo@ref` input.
-* Only github.com URLs are accepted in v1.
+* 不带缓存的统一 GET+JSON：网络异常、非 2xx、坏 JSON 全部映射为
+* RepoFetchError，调用方无需重复写 try/catch。
 */
-function normalizeRepoInput(input) {
-	let value = input.trim();
-	if (value === "") return null;
-	let ref;
-	const urlMatch = /^https?:\/\/github\.com\/([^/]+)\/([^/#?@]+)(?:\/tree\/([^/?#]+))?/.exec(value);
-	if (urlMatch !== null) {
-		value = `${urlMatch[1]}/${urlMatch[2]}`;
-		ref = urlMatch[3];
-	} else {
-		if (/^https?:\/\//.test(value)) return null;
-		const at = value.indexOf("@");
-		if (at !== -1) {
-			ref = value.slice(at + 1).trim();
-			value = value.slice(0, at).trim();
-		}
+async function fetchJson(url, fetchImpl, context, headers = apiHeaders()) {
+	let response;
+	try {
+		response = await fetchImpl(url, { headers });
+	} catch (error) {
+		if (isAbortError(error)) throw error;
+		throw new RepoFetchError(context + ": " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (!response.ok) throw fetchError(context, response);
+	try {
+		return {
+			json: await response.json(),
+			response
+		};
+	} catch {
+		throw new RepoFetchError("invalid github response for " + url);
 	}
-	value = value.replace(/\.git$/, "").replace(/\/+$/, "");
-	const parts = value.split("/").filter(Boolean);
-	if (parts.length < 2) return null;
-	const owner = parts[0];
-	const repo = parts[1];
-	if (owner === "" || repo === "" || owner.includes("..") || repo.includes("..")) return null;
-	return {
-		owner,
-		repo,
-		...ref !== void 0 && ref !== "" ? { ref } : {}
-	};
 }
 /**
 * Load repo metadata and the recursive git tree at the given ref. The meta
@@ -1451,10 +1525,7 @@ function normalizeRepoInput(input) {
 */
 async function fetchJsonCached(url, fetchImpl, context) {
 	const cached = etagCacheGet(url);
-	const headers = {
-		accept: "application/vnd.github+json",
-		...githubAuthHeaders()
-	};
+	const headers = { ...apiHeaders() };
 	if (cached !== void 0) headers["if-none-match"] = cached.etag;
 	let response;
 	try {
@@ -1480,6 +1551,54 @@ async function fetchJsonCached(url, fetchImpl, context) {
 		response
 	};
 }
+//#endregion
+//#region src/repo.ts
+/**
+* GitHub repository skill discovery/import helpers.
+*
+* Kept dependency-free and mostly pure so the root/origin rules are easy to
+* test. Roots are auto-derived: any top-level directory that contains a
+* `**\/SKILL.md` (e.g. `skills/**`, `design-templates/**`, `templates/**`,
+* `workflows/**`) is treated as a skill root. No hard-coded allowlist.
+*/
+/** Top-level directory pattern for a skill root: visible, non-dot, safe chars. First char must be alphanum. */
+const ROOT_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+/** `owner/repo` slug for a parsed reference. */
+function repoSlug(ref) {
+	return `${ref.owner}/${ref.repo}`;
+}
+/**
+* Normalize a GitHub URL or `owner/repo`/`owner/repo@ref` input.
+* Only github.com URLs are accepted in v1.
+*/
+function normalizeRepoInput(input) {
+	let value = input.trim();
+	if (value === "") return null;
+	let ref;
+	const urlMatch = /^https?:\/\/github\.com\/([^/]+)\/([^/#?@]+)(?:\/tree\/([^/?#]+))?/.exec(value);
+	if (urlMatch !== null) {
+		value = `${urlMatch[1]}/${urlMatch[2]}`;
+		ref = urlMatch[3];
+	} else {
+		if (/^https?:\/\//.test(value)) return null;
+		const at = value.indexOf("@");
+		if (at !== -1) {
+			ref = value.slice(at + 1).trim();
+			value = value.slice(0, at).trim();
+		}
+	}
+	value = value.replace(/\.git$/, "").replace(/\/+$/, "");
+	const parts = value.split("/").filter(Boolean);
+	if (parts.length < 2) return null;
+	const owner = parts[0];
+	const repo = parts[1];
+	if (owner === "" || repo === "" || owner.includes("..") || repo.includes("..")) return null;
+	return {
+		owner,
+		repo,
+		...ref !== void 0 && ref !== "" ? { ref } : {}
+	};
+}
 async function loadRepoTree(repo, ref, fetchImpl = fetch) {
 	const { json: metaJson } = await fetchJsonCached(`https://api.github.com/repos/${repo}`, fetchImpl, "github repo not found or unavailable");
 	let meta = metaJson;
@@ -1545,7 +1664,7 @@ function discoverRepoEntries(tree, repo, existingNames = /* @__PURE__ */ new Set
 	}).sort((a, b) => a.name.localeCompare(b.name));
 }
 /** Run an async worker over items with a bounded concurrency. */
-async function mapConcurrent(items, limit, worker) {
+async function mapConcurrent$1(items, limit, worker) {
 	const results = new Array(items.length);
 	let cursor = 0;
 	const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
@@ -1558,10 +1677,6 @@ async function mapConcurrent(items, limit, worker) {
 	await Promise.all(runners);
 	return results;
 }
-/** Whether an error is an abort (AbortError / signal). */
-function isAbortError(error) {
-	return error instanceof Error && (error.name === "AbortError" || error.message.includes("aborted") || error.message.includes("Abort"));
-}
 /**
 * Download one GitHub file as a buffer. Tries raw.githubusercontent.com
 * first (no API quota); on any failure falls back to the api.github.com
@@ -1619,7 +1734,7 @@ async function downloadRepoSkill(repo, ref, entry, files, targetRoot, fetchImpl
 	const tempDir = await mkdtemp(join(targetRoot, "." + entry.name + ".import-"));
 	let renamed = false;
 	try {
-		await mapConcurrent(files, 6, async (file) => {
+		await mapConcurrent$1(files, 6, async (file) => {
 			if (signal?.aborted) throw new DOMException("aborted", "AbortError");
 			const relative = file.path.slice(entry.dir.length + 1);
 			if (relative === "" || relative.includes("..")) throw new RepoFetchError("unsafe repo path: " + file.path);
@@ -1700,65 +1815,48 @@ async function cleanupLeftoverImportDirs(targetRoot) {
 * repo has no releases (GitHub's /releases/latest skips prereleases/drafts).
 */
 async function getLatestReleaseTag(repo, fetchImpl = fetch) {
-	let response;
-	try {
-		response = await fetchImpl(`https://api.github.com/repos/${repo}/releases/latest`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github release request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (response.status === 404) return void 0;
-	if (!response.ok) throw fetchError("github release lookup failed", response);
 	let payload;
 	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github release response");
+		({json: payload} = await fetchJson(`https://api.github.com/repos/${repo}/releases/latest`, fetchImpl, "github release lookup failed"));
+	} catch (error) {
+		if (error instanceof RepoFetchError && error.status === 404) return void 0;
+		throw error;
 	}
 	const tag = typeof payload === "object" && payload !== null ? payload.tag_name : void 0;
 	return typeof tag === "string" && tag !== "" ? tag : void 0;
 }
+/** Stars + release-asset downloads of a repo (two GitHub API requests). */
+async function getRepoStats(repo, fetchImpl = fetch) {
+	const headers = apiHeaders();
+	const { json: meta } = await fetchJson(`https://api.github.com/repos/${repo}`, fetchImpl, "github repo not found or unavailable", headers);
+	const stars = typeof meta === "object" && meta !== null && typeof meta.stargazers_count === "number" ? meta.stargazers_count : 0;
+	let downloads = 0;
+	try {
+		const relResponse = await fetchImpl(`https://api.github.com/repos/${repo}/releases?per_page=20`, { headers });
+		if (relResponse.ok) {
+			const releases = await relResponse.json();
+			if (Array.isArray(releases)) for (const item of releases) {
+				if (typeof item !== "object" || item === null) continue;
+				const assets = item.assets;
+				if (!Array.isArray(assets)) continue;
+				for (const asset of assets) if (typeof asset === "object" && asset !== null && typeof asset.download_count === "number") downloads += asset.download_count;
+			}
+		}
+	} catch {}
+	return {
+		stars,
+		downloads
+	};
+}
 /** Release tags of a repo, newest first (skips drafts, keeps prereleases). */
 async function listRepoReleases(repo, fetchImpl = fetch) {
-	let response;
-	try {
-		response = await fetchImpl(`https://api.github.com/repos/${repo}/releases?per_page=20`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github releases request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!response.ok) throw fetchError("github releases lookup failed", response);
-	let payload;
-	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github releases response");
-	}
+	const { json: payload } = await fetchJson(`https://api.github.com/repos/${repo}/releases?per_page=20`, fetchImpl, "github releases lookup failed");
 	if (!Array.isArray(payload)) return [];
 	return payload.filter((item) => typeof item === "object" && item !== null && item.draft !== true).map((item) => item.tag_name).filter((tag) => typeof tag === "string" && tag !== "");
 }
 /** Branch names of a repo, default branch first (one GitHub API request). */
 async function listRepoBranches(repo, fetchImpl = fetch) {
-	let response;
-	try {
-		response = await fetchImpl(`https://api.github.com/repos/${repo}/branches?per_page=100`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github branches request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!response.ok) throw fetchError("github branches lookup failed", response);
-	let payload;
-	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github branches response");
-	}
+	const { json: payload } = await fetchJson(`https://api.github.com/repos/${repo}/branches?per_page=100`, fetchImpl, "github branches lookup failed");
 	if (!Array.isArray(payload)) return [];
 	return payload.map((item) => typeof item === "object" && item !== null ? item.name : void 0).filter((name) => typeof name === "string" && name !== "");
 }
@@ -1768,23 +1866,7 @@ async function listRepoBranches(repo, fetchImpl = fetch) {
 * upstream tree on change (one extra request).
 */
 async function getLatestCommit(repo, ref, fetchImpl = fetch) {
-	const url = ref !== void 0 && ref !== "" ? `https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref)}` : `https://api.github.com/repos/${repo}/commits?per_page=1`;
-	let response;
-	try {
-		response = await fetchImpl(url, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!response.ok) throw fetchError("github commit lookup failed", response);
-	let payload;
-	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github commit response");
-	}
+	const { json: payload } = await fetchJson(ref !== void 0 && ref !== "" ? `https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref)}` : `https://api.github.com/repos/${repo}/commits?per_page=1`, fetchImpl, "github commit lookup failed");
 	const record = Array.isArray(payload) ? payload[0] ?? {} : typeof payload === "object" && payload !== null ? payload : {};
 	const commitSha = typeof record.sha === "string" && record.sha !== "" ? record.sha : null;
 	const tree = typeof record.commit === "object" && record.commit !== null ? record.commit.tree : void 0;
@@ -1797,22 +1879,7 @@ async function getLatestCommit(repo, ref, fetchImpl = fetch) {
 }
 /** Load the recursive git tree at an explicit tree SHA (one API request). */
 async function loadRepoTreeAt(repo, treeSha, fetchImpl = fetch) {
-	let response;
-	try {
-		response = await fetchImpl(`https://api.github.com/repos/${repo}/git/trees/${encodeURIComponent(treeSha)}?recursive=1`, { headers: {
-			accept: "application/vnd.github+json",
-			...githubAuthHeaders()
-		} });
-	} catch (error) {
-		throw new RepoFetchError("github tree request failed: " + (error instanceof Error ? error.message : String(error)));
-	}
-	if (!response.ok) throw fetchError("github tree lookup failed", response);
-	let payload;
-	try {
-		payload = await response.json();
-	} catch {
-		throw new RepoFetchError("invalid github tree response");
-	}
+	const { json: payload } = await fetchJson(`https://api.github.com/repos/${repo}/git/trees/${encodeURIComponent(treeSha)}?recursive=1`, fetchImpl, "github tree lookup failed");
 	const record = typeof payload === "object" && payload !== null ? payload : {};
 	if (record.truncated === true) throw new RepoFetchError("repo tree is too large to scan");
 	return Array.isArray(record.tree) ? record.tree : [];
@@ -2017,25 +2084,6 @@ async function checkLatestRelease(repo = UPDATE_REPO, fetchImpl = fetch) {
 		url: typeof record.html_url === "string" ? record.html_url : null
 	};
 }
-//#endregion
-//#region src/routes.ts
-/**
-* The /api/skill-hub route family: full catalog (enabled skills from the
-* official registry + hub-disabled skills + discovery diagnostics), skill
-* detail, enable/disable toggle, new-skill scaffold, user groups (tags +
-* origin collections), and upstream source tracking (check/sync/follow
-* upstream deletion into a restorable trash). Every route carries a
-* loopback-only trust fence — these endpoints rename files under the user's
-* skill roots, so LAN-exposed dsh web deployments must not serve them.
-*
-* Every handler is declared through the local `route()` wrapper, which owns
-* the shared request fences (loopback trust, HTTP method, master switch,
-* JSON body) exactly once, so a new route cannot forget them.
-*/
-/** Cap on JSON request bodies (toggle/create payloads are tiny). */
-const MAX_JSON_BODY_BYTES = 64 * 1024;
-/** Minimum interval between network update checks per source (GitHub rate limits). */
-const MIN_CHECK_INTERVAL_MS = 5 * 6e4;
 /** Loopback literal check plus browser same-origin markers. */
 function isLoopbackRequest(request) {
 	const address = request.socket.remoteAddress;
@@ -2096,7 +2144,7 @@ async function readJsonBody(req) {
 	for await (const chunk of req) {
 		const buffer = chunk;
 		size += buffer.length;
-		if (size > MAX_JSON_BODY_BYTES) return void 0;
+		if (size > 65536) return void 0;
 		chunks.push(buffer);
 	}
 	try {
@@ -2389,50 +2437,14 @@ function toDetail(skill) {
 		content: skill.content
 	};
 }
-/** Last successful check time per repo (in-memory throttle for GitHub rate limits). */
-const lastSourceCheck = /* @__PURE__ */ new Map();
-/** Last successful market update check per repo (same throttle). */
-const lastMarketCheck = /* @__PURE__ */ new Map();
-const importJobs = /* @__PURE__ */ new Map();
-const IMPORT_JOB_TTL_MS = 5 * 6e4;
-const IMPORT_JOB_MAX = 100;
-function gcImportJobs() {
-	if (importJobs.size > 500) importJobs.clear();
-	const now = Date.now();
-	for (const [id, job] of importJobs) if (job.status !== "running" && now - job.createdAt > IMPORT_JOB_TTL_MS) importJobs.delete(id);
-	if (importJobs.size > IMPORT_JOB_MAX) {
-		const sorted = [...importJobs.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
-		for (let i = 0; i < sorted.length - IMPORT_JOB_MAX; i++) importJobs.delete(sorted[i][0]);
-	}
-}
-/** Replace one skill directory with a fresh download; restores the old dir on failure. */
-async function replaceSkillDir(targetDir, download) {
-	const backup = join(dirname(targetDir), "." + basename(targetDir) + ".sync-bak-" + Date.now());
-	await rename(targetDir, backup);
-	try {
-		await download();
-	} catch (error) {
-		await rename(backup, targetDir).catch(() => {});
-		throw error;
-	}
-	await rm(backup, {
-		recursive: true,
-		force: true
-	});
-}
 /**
-* Build every /api/skill-hub route.
-* @param deps - skill registry view + sidecar store.
-* @returns the exact-path routes.
+* Wrap one handler in the shared request fences. Order matches the
+* original per-handler prologue: loopback trust → HTTP method → master
+* switch → JSON body. The outer catch maps errors onto the JSON error
+* body (preserving RepoFetchError status codes).
 */
-function makeRoutes(deps) {
-	/**
-	* Wrap one handler in the shared request fences. Order matches the
-	* original per-handler prologue: loopback trust → HTTP method → master
-	* switch → JSON body. The outer catch maps errors onto the JSON error
-	* body (preserving RepoFetchError status codes).
-	*/
-	const route = (spec) => ({
+function createRoute(deps, spec) {
+	return {
 		kind: "exact",
 		path: spec.path,
 		handler: async (req, res) => {
@@ -2466,16 +2478,25 @@ function makeRoutes(deps) {
 				writeRouteError(res, error);
 			}
 		}
-	});
+	};
+}
+//#endregion
+//#region src/routes/catalog.ts
+/**
+* 目录域路由：catalog / skill 详情 / skill 删除 / toggle / toggle-batch /
+* create / stats。从 routes.ts 原样搬出，handler 逻辑不变。
+*/
+/** 目录域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function catalogRoutes(deps) {
 	return [
-		route({
+		{
 			path: SKILL_HUB_API.catalog,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
 				writeJson(res, 200, await buildCatalog(deps, queryParam(url, "cwd")));
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.skill,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
@@ -2551,8 +2572,8 @@ function makeRoutes(deps) {
 					skill: detail
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.skillDelete,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2608,8 +2629,8 @@ function makeRoutes(deps) {
 					path
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.toggle,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2658,8 +2679,8 @@ function makeRoutes(deps) {
 					catalog: await buildCatalog(deps, lookup?.cwd)
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.toggleBatch,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2710,8 +2731,8 @@ function makeRoutes(deps) {
 					failures
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.create,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2749,8 +2770,8 @@ function makeRoutes(deps) {
 					root
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.stats,
 			methods: ["GET"],
 			handler: async ({ res }) => {
@@ -2768,8 +2789,19 @@ function makeRoutes(deps) {
 					stats: await deps.stats()
 				});
 			}
-		}),
-		route({
+		}
+	];
+}
+//#endregion
+//#region src/routes/config.ts
+/**
+* 配置域路由：config（总开关开着也可用，设置卡自救入口）/ update 自身更新
+* 检查 / diagnosticFix。从 routes.ts 原样搬出，handler 逻辑不变。
+*/
+/** 配置域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function configRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.config,
 			methods: ["GET", "POST"],
 			jsonBody: true,
@@ -2826,6 +2858,15 @@ function makeRoutes(deps) {
 					}
 					patch[key] = value;
 				}
+				if (raw.githubToken !== void 0) {
+					const value = raw.githubToken;
+					if (value === null) patch.githubToken = void 0;
+					else if (typeof value !== "string" || value.trim() === "") patch.githubToken = void 0;
+					else if (!GITHUB_TOKEN_RE.test(value.trim())) {
+						writeError(res, 400, "githubToken looks invalid (expected a personal access token)");
+						return;
+					} else patch.githubToken = value.trim();
+				}
 				let config;
 				if (deps.updateConfig === void 0) {
 					const merged = { ...configOf(deps) };
@@ -2840,8 +2881,96 @@ function makeRoutes(deps) {
 					saved: savedOf(deps)
 				});
 			}
-		}),
-		route({
+		},
+		{
+			path: SKILL_HUB_API.update,
+			methods: ["GET"],
+			handler: async ({ res }) => {
+				writeJson(res, 200, await checkLatestRelease());
+			}
+		},
+		{
+			path: SKILL_HUB_API.diagnosticFix,
+			methods: ["POST"],
+			jsonBody: true,
+			handler: async ({ res, body }) => {
+				const request = body;
+				const rawPath = typeof request.path === "string" ? request.path.trim() : "";
+				if (rawPath === "") {
+					writeError(res, 400, "path is required");
+					return;
+				}
+				try {
+					await fixDiagnosticFile(rawPath, homeOf(deps));
+					deps.invalidate?.();
+					writeJson(res, 200, {
+						ok: true,
+						path: rawPath
+					});
+				} catch (error) {
+					writeRouteError(res, error);
+				}
+			}
+		}
+	];
+}
+/** Last successful check time per repo (in-memory throttle for GitHub rate limits). */
+const lastSourceCheck = /* @__PURE__ */ new Map();
+/** Last successful market update check per repo (same throttle). */
+const lastMarketCheck = /* @__PURE__ */ new Map();
+/** Market stats (stars/downloads) throttle: hourly, plus a fallback cache. */
+const lastMarketStats = /* @__PURE__ */ new Map();
+const marketStatsCache = /* @__PURE__ */ new Map();
+/** One-time seed of the in-memory stats cache from the sidecar (survives restarts). */
+let marketStatsSeeded = false;
+async function seedMarketStats(deps) {
+	if (marketStatsSeeded) return;
+	marketStatsSeeded = true;
+	try {
+		const saved = await deps.store.getMarketStatsState();
+		if (saved === void 0) return;
+		for (const [repo, stats] of Object.entries(saved.stats)) if (!marketStatsCache.has(repo)) {
+			marketStatsCache.set(repo, stats);
+			lastMarketStats.set(repo, saved.fetchedAt);
+		}
+	} catch {}
+}
+const importJobs = /* @__PURE__ */ new Map();
+function gcImportJobs() {
+	if (importJobs.size > 500) importJobs.clear();
+	const now = Date.now();
+	for (const [id, job] of importJobs) if (job.status !== "running" && now - job.createdAt > 3e5) importJobs.delete(id);
+	if (importJobs.size > 100) {
+		const sorted = [...importJobs.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+		for (let i = 0; i < sorted.length - 100; i++) importJobs.delete(sorted[i][0]);
+	}
+}
+/** Replace one skill directory with a fresh download; restores the old dir on failure. */
+async function replaceSkillDir(targetDir, download) {
+	const backup = join(dirname(targetDir), "." + basename(targetDir) + ".sync-bak-" + Date.now());
+	await rename(targetDir, backup);
+	try {
+		await download();
+	} catch (error) {
+		await rename(backup, targetDir).catch(() => {});
+		throw error;
+	}
+	await rm(backup, {
+		recursive: true,
+		force: true
+	});
+}
+//#endregion
+//#region src/routes/market.ts
+/**
+* 市场域路由：market 列表 / source 增删 / ref 锁定 / versions 选择器 /
+* check 更新检查 / stats 星标统计 / sync 对齐版本。从 routes.ts 原样搬出，
+* handler 逻辑不变。
+*/
+/** 市场域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function marketRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.market,
 			methods: ["GET"],
 			handler: async ({ res }) => {
@@ -2850,8 +2979,8 @@ function makeRoutes(deps) {
 					repos: await deps.store.listMarketSources()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.marketSource,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2868,8 +2997,8 @@ function makeRoutes(deps) {
 					repos: await deps.store.addMarketSource(repoSlug(parsed), ref)
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.marketSourceDelete,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2885,8 +3014,8 @@ function makeRoutes(deps) {
 					repos: await deps.store.removeMarketSource(repoSlug(parsed))
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.marketSourceRef,
 			methods: ["POST"],
 			jsonBody: true,
@@ -2911,8 +3040,8 @@ function makeRoutes(deps) {
 					repos: await deps.store.listMarketSources()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.marketSourceVersions,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
@@ -2936,8 +3065,8 @@ function makeRoutes(deps) {
 					branches
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.marketCheck,
 			methods: ["GET"],
 			handler: async ({ res }) => {
@@ -2950,7 +3079,7 @@ function makeRoutes(deps) {
 						...source.ref !== void 0 ? { ref: source.ref } : {}
 					};
 					const now = Date.now();
-					if (now - (lastMarketCheck.get(source.repo) ?? 0) < MIN_CHECK_INTERVAL_MS) {
+					if (now - (lastMarketCheck.get(source.repo) ?? 0) < 3e5) {
 						results.push({
 							...base,
 							updateAvailable: false,
@@ -2994,8 +3123,65 @@ function makeRoutes(deps) {
 					results
 				});
 			}
-		}),
-		route({
+		},
+		{
+			path: SKILL_HUB_API.marketStats,
+			methods: ["GET"],
+			handler: async ({ res, url }) => {
+				const refresh = queryParam(url, "refresh") === "1";
+				await seedMarketStats(deps);
+				const sources = await deps.store.listMarketSources();
+				if (lastMarketStats.size > 500) lastMarketStats.clear();
+				const results = [];
+				const now = Date.now();
+				let fetchedAny = false;
+				for (const source of sources) {
+					const cached = marketStatsCache.get(source.repo);
+					const age = now - (lastMarketStats.get(source.repo) ?? 0);
+					if (cached !== void 0 && (!refresh || age < 36e5)) {
+						results.push({
+							repo: source.repo,
+							stars: cached.stars,
+							downloads: cached.downloads,
+							...age >= 36e5 ? { stale: true } : refresh ? { throttled: true } : {}
+						});
+						continue;
+					}
+					try {
+						const stats = await getRepoStats(source.repo);
+						marketStatsCache.set(source.repo, stats);
+						lastMarketStats.set(source.repo, now);
+						fetchedAny = true;
+						results.push({
+							repo: source.repo,
+							...stats
+						});
+					} catch (error) {
+						if (cached !== void 0) results.push({
+							repo: source.repo,
+							stars: cached.stars,
+							downloads: cached.downloads,
+							stale: true
+						});
+						else results.push({
+							repo: source.repo,
+							stars: 0,
+							downloads: 0,
+							error: error instanceof Error ? error.message : String(error)
+						});
+					}
+				}
+				if (fetchedAny) deps.store.saveMarketStatsState({
+					fetchedAt: now,
+					stats: Object.fromEntries(marketStatsCache)
+				}).catch(() => {});
+				writeJson(res, 200, {
+					ok: true,
+					results
+				});
+			}
+		},
+		{
 			path: SKILL_HUB_API.marketSync,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3034,8 +3220,19 @@ function makeRoutes(deps) {
 					skills: tracked !== void 0 ? [...tracked.skills] : []
 				});
 			}
-		}),
-		route({
+		}
+	];
+}
+//#endregion
+//#region src/routes/repo-import.ts
+/**
+* 仓库导入域路由：repo 发现 / repoImport 异步导入任务 / progress 轮询 /
+* cancel 取消。从 routes.ts 原样搬出，handler 逻辑不变。
+*/
+/** 仓库导入域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function repoImportRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.repo,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
@@ -3081,8 +3278,8 @@ function makeRoutes(deps) {
 					...truncated ? { truncated: true } : {}
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.repoImport,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3220,8 +3417,8 @@ function makeRoutes(deps) {
 					totalBytes
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.repoImportProgress,
 			methods: ["GET"],
 			handler: async ({ res, url }) => {
@@ -3254,8 +3451,8 @@ function makeRoutes(deps) {
 					...job.error !== void 0 ? { error: job.error } : {}
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.repoImportCancel,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3281,22 +3478,26 @@ function makeRoutes(deps) {
 					status: job.status
 				});
 			}
-		}),
-		route({
-			path: SKILL_HUB_API.update,
-			methods: ["GET"],
-			handler: async ({ res }) => {
-				writeJson(res, 200, await checkLatestRelease());
-			}
-		}),
-		route({
+		}
+	];
+}
+//#endregion
+//#region src/routes/groups.ts
+/**
+* 分组域路由：groups / tag 新建重命名 / tag 删除 / tag 成员 / tag 重排 /
+* collection 重排 / source-group 重排。从 routes.ts 原样搬出，handler 逻辑不变。
+*/
+/** 分组域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function groupRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.groups,
 			methods: ["GET"],
 			handler: async ({ res }) => {
 				writeJson(res, 200, await buildGroups(deps));
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.tag,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3316,8 +3517,8 @@ function makeRoutes(deps) {
 					tags: await deps.store.listTags()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.tagDelete,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3337,8 +3538,8 @@ function makeRoutes(deps) {
 					tags: await deps.store.listTags()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.tagMembers,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3360,8 +3561,8 @@ function makeRoutes(deps) {
 					tags: await deps.store.listTags()
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.tagReorder,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3381,8 +3582,8 @@ function makeRoutes(deps) {
 					throw error;
 				}
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.collectionReorder,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3396,8 +3597,8 @@ function makeRoutes(deps) {
 					order
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceGroupReorder,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3409,8 +3610,20 @@ function makeRoutes(deps) {
 					order: await deps.store.reorderSourceGroups(orderedKeys)
 				});
 			}
-		}),
-		route({
+		}
+	];
+}
+//#endregion
+//#region src/routes/sources.ts
+/**
+* 来源跟踪域路由：sources 列表 / check 上游更新 / sync 同步 / delete 跟进
+* 删除 / restore 恢复 / trash/clear 清空回收站。从 routes.ts 原样搬出，
+* handler 逻辑不变。
+*/
+/** 来源跟踪域全部路由 spec（由 routes.ts 经 createRoute 包上统一围栏）。 */
+function sourceRoutes(deps) {
+	return [
+		{
 			path: SKILL_HUB_API.sources,
 			methods: ["GET"],
 			handler: async ({ res }) => {
@@ -3443,8 +3656,8 @@ function makeRoutes(deps) {
 					trash
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceCheck,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3469,7 +3682,7 @@ function makeRoutes(deps) {
 						...item.ref !== void 0 ? { ref: item.ref } : {}
 					};
 					const now = Date.now();
-					if (now - (lastSourceCheck.get(item.repo) ?? 0) < MIN_CHECK_INTERVAL_MS) {
+					if (now - (lastSourceCheck.get(item.repo) ?? 0) < 3e5) {
 						results.push({
 							...base,
 							changed: false,
@@ -3526,8 +3739,8 @@ function makeRoutes(deps) {
 					results
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceSync,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3598,8 +3811,8 @@ function makeRoutes(deps) {
 					failed
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceDelete,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3683,8 +3896,8 @@ function makeRoutes(deps) {
 					failed
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceRestore,
 			methods: ["POST"],
 			jsonBody: true,
@@ -3716,8 +3929,8 @@ function makeRoutes(deps) {
 					path
 				});
 			}
-		}),
-		route({
+		},
+		{
 			path: SKILL_HUB_API.sourceTrashClear,
 			methods: ["POST"],
 			handler: async ({ res }) => {
@@ -3743,33 +3956,27 @@ function makeRoutes(deps) {
 					failed
 				});
 			}
-		}),
-		route({
-			path: SKILL_HUB_API.diagnosticFix,
-			methods: ["POST"],
-			jsonBody: true,
-			handler: async ({ res, body }) => {
-				const request = body;
-				const rawPath = typeof request.path === "string" ? request.path.trim() : "";
-				if (rawPath === "") {
-					writeError(res, 400, "path is required");
-					return;
-				}
-				try {
-					await fixDiagnosticFile(rawPath, homeOf(deps));
-					deps.invalidate?.();
-					writeJson(res, 200, {
-						ok: true,
-						path: rawPath
-					});
-				} catch (error) {
-					writeRouteError(res, error);
-				}
-			}
-		})
+		}
 	];
 }
 //#endregion
+//#region src/routes.ts
+/**
+* Build every /api/skill-hub route.
+* @param deps - skill registry view + sidecar store.
+* @returns the exact-path routes.
+*/
+function makeRoutes(deps) {
+	return [
+		...catalogRoutes(deps),
+		...configRoutes(deps),
+		...marketRoutes(deps),
+		...repoImportRoutes(deps),
+		...groupRoutes(deps),
+		...sourceRoutes(deps)
+	].map((spec) => createRoute(deps, spec));
+}
+//#endregion
 //#region src/stats.ts
 /** Fallback freeze horizon when no rolling window is configured (14 days). */
 const STATS_FREEZE_AFTER_MS = 336 * 60 * 60 * 1e3;
@@ -3808,6 +4015,22 @@ function isFrozen(record, watermark) {
 	const created = record.header.createdAt;
 	return typeof created === "number" && created > 0 && created < watermark;
 }
+/** Bounded-concurrency map: session-log reads are independent decompressions, so wall time scales ~1/limit. Merge stays sequential in index order. */
+async function mapConcurrent(items, limit, worker) {
+	const results = new Array(items.length);
+	let cursor = 0;
+	const runners = Array.from({ length: Math.min(Math.max(limit, 1), items.length) }, async () => {
+		while (cursor < items.length) {
+			const index = cursor;
+			cursor += 1;
+			results[index] = await worker(items[index], index);
+		}
+	});
+	await Promise.all(runners);
+	return results;
+}
+/** Max parallel session-log reads per scan (read-only; merge is order-independent). */
+const SCAN_READ_CONCURRENCY = 6;
 function mergeInto(totals, counted) {
 	for (const [name, stat] of counted) {
 		const total = totals[name];
@@ -3853,20 +4076,23 @@ async function scan(query, checkpoint, nowMs, windowDays) {
 	if (nowMs - checkpoint.lastFullReconcile >= 864e5 || checkpoint.windowDays !== windowDays) {
 		const cache = {};
 		const totals = {};
-		for (const record of sessions) {
-			let counted;
+		const countedList = await mapConcurrent(sessions, SCAN_READ_CONCURRENCY, async (record) => {
 			try {
-				counted = countSkillInvocations((await query.readSession(record.header.id)).events);
+				return countSkillInvocations((await query.readSession(record.header.id)).events);
 			} catch {
-				continue;
+				return;
 			}
+		});
+		sessions.forEach((record, index) => {
+			const counted = countedList[index];
+			if (counted === void 0) return;
 			const created = record.header.createdAt;
 			if (isFrozen(record, cutoff) && counted.size > 0 && typeof created === "number") cache[record.header.id] = {
 				createdAt: created,
 				counts: Object.fromEntries(counted)
 			};
 			if (inWindow(created, windowDays, nowMs)) mergeInto(totals, counted);
-		}
+		});
 		checkpoint.frozenSessions = cache;
 		checkpoint.frozenBefore = cutoff;
 		checkpoint.windowDays = windowDays;
@@ -3877,13 +4103,16 @@ async function scan(query, checkpoint, nowMs, windowDays) {
 		};
 	}
 	const recent = {};
-	for (const record of sessions) {
-		if (isFrozen(record, checkpoint.frozenBefore)) continue;
+	const recentList = await mapConcurrent(sessions.filter((record) => !isFrozen(record, checkpoint.frozenBefore)), SCAN_READ_CONCURRENCY, async (record) => {
 		try {
-			mergeInto(recent, countSkillInvocations((await query.readSession(record.header.id)).events));
+			return countSkillInvocations((await query.readSession(record.header.id)).events);
 		} catch {
-			continue;
+			return;
 		}
+	});
+	for (const counted of recentList) {
+		if (counted === void 0) continue;
+		mergeInto(recent, counted);
 	}
 	const totals = {};
 	for (const [id, entry] of Object.entries(checkpoint.frozenSessions)) {
@@ -3921,7 +4150,7 @@ function createSkillStatsReader(query, ttlMs = 3e5, options = {}) {
 		lastFullReconcile: 0
 	};
 	const now = options.now ?? (() => Date.now());
-	let cached;
+	let cached = checkpoint.lastTotals !== void 0 ? [...checkpoint.lastTotals] : void 0;
 	let cachedAt = 0;
 	let refreshing = null;
 	let lastScanDurationMs = 0;
@@ -3932,11 +4161,12 @@ function createSkillStatsReader(query, ttlMs = 3e5, options = {}) {
 		if (cached !== void 0 && startedAt - cachedAt < ttl) return cached;
 		if (refreshing === null) {
 			const windowDays = options.windowDays?.() ?? 0;
-			refreshing = scan(query, checkpoint, startedAt, windowDays).then(({ stats, mutated }) => {
+			refreshing = scan(query, checkpoint, startedAt, windowDays).then(({ stats }) => {
 				cached = stats;
 				cachedAt = now();
 				lastScanDurationMs = Math.max(0, cachedAt - startedAt);
-				if (mutated) options.onCheckpoint?.({
+				checkpoint.lastTotals = stats;
+				options.onCheckpoint?.({
 					...checkpoint,
 					frozenSessions: { ...checkpoint.frozenSessions }
 				});
@@ -3984,6 +4214,7 @@ const HubSettingsSchema = z.object({
 	showGroupSummary: z.boolean().default(HUB_CONFIG_DEFAULTS.showGroupSummary),
 	dotModelColor: z.string().pattern(HEX_COLOR_RE),
 	dotUserColor: z.string().pattern(HEX_COLOR_RE),
+	githubToken: z.string(),
 	statsWindowDays: z.number().min(0).max(3650).default(HUB_CONFIG_DEFAULTS.statsWindowDays),
 	statsScanMinutes: z.number().min(1).max(1440).default(HUB_CONFIG_DEFAULTS.statsScanMinutes)
 });
@@ -4026,6 +4257,7 @@ function apply(ctx, config) {
 			disposeProvider = void 0;
 		}
 		const value = current();
+		setGithubToken(value.githubToken);
 		if (value.announceToAgent) disposeSection = ctx.systemPrompt.section({
 			name: "plugin:dsh-skill-hub",
 			order: SECTION_ORDER,
@@ -4092,7 +4324,7 @@ function apply(ctx, config) {
 				const value = current().statsWindowDays;
 				return typeof value === "number" && value >= 0 ? Math.floor(value) : HUB_CONFIG_DEFAULTS.statsWindowDays;
 			};
-			stats = createSkillStatsReader(sctx.sessionQuery, () => scanMinutes() * 6e4, {
+			const reader = createSkillStatsReader(sctx.sessionQuery, () => scanMinutes() * 6e4, {
 				checkpoint: saved,
 				windowDays,
 				onCheckpoint: (next) => {
@@ -4101,7 +4333,9 @@ function apply(ctx, config) {
 					});
 				}
 			});
+			stats = reader;
 			sync();
+			reader();
 		})();
 	});
 }