dsh-skill-mcp-market 0.3.1 → 0.3.2

package/README.md

@@ -7,6 +7,18 @@ DSH 的**技能市场**与 **MCP 连接器市场**：浏览实时技能源、装
 - 默认技能目录：`~/.dsh/market/skills`；默认 MCP 目录：`~/.dsh/market/mcp`
 - 左侧面板：**「SKILL技能&MCP连接器」**
 
+## 截图
+
+真机截图（DSH 桌面版，左侧菜单「SKILL技能&MCP连接器」）。
+
+### 技能市场
+
+顶部按来源切换（`skills.sh` / `clawhub` / `skillsmp` / `trusttools` / `browse.sh` / `lobehub-agent` / `skillhub`），卡片上直接「预览 / 安装」：
+
+![技能市场：来源筛选与卡片](docs/screenshots/panel-skills.png)
+
+> 「MCP 连接器」「已安装」「路径」三个页签的截图待补。
+
 ## 安装
 
 已发布到 npm：**`dsh-skill-mcp-market`**（MIT，公共包，无需登录）。
@@ -161,10 +173,11 @@ DSH 本来就有技能运行时和 MCP 运行时，缺的只是市场这一层
 | 源 | 说明 |
 |---|---|
 | **MCP 官方注册表** | `registry.modelcontextprotocol.io`，免费、实时的 MCP 目录，自带真实启动方式（npm / streamable-http） |
-| `skills.sh` | 技能索引，支持页面 URL 与裸 `owner/repo` |
+| `skills.sh` | 技能索引，支持页面 URL 与裸 `owner/repo`；搜索接口要求 ≥2 字符，空搜索回退到首页推荐 |
 | `skillsmp` | 带反爬（Cloudflare），走 python→curl→fetch 三级取数 |
 | `browse.sh` | 启动预热 + 内存缓存，冷启动超时不缓存空结果 |
-| `clawhub` / `trusttools` / `lobehub-agent` / `skillhub` | 其余实时技能源 |
+| `trusttools` | `ai.trusttools.cn/api/skills/search`（POST）；该站会丢弃本进程的 TLS 握手，走 python → curl → fetch 三级通道 |
+| `clawhub` / `lobehub-agent` / `skillhub` | 其余实时技能源 |
 | `github` | 直接给仓库或 `@ref`；jsDelivr 列树失败时回退 GitHub contents API 与 codeload tarball |
 
 ## 目录结构

package/client.js

@@ -172,14 +172,19 @@ window.__ModuleLoader__.load({
             pageSize: (options && options.size) || 24,
           });
           setSkills(d.items || []);
+          const hints = (d.hints || []).filter(Boolean);
           if (!(d.items || []).length) {
-            // An empty market is either "no match" or "upstream refused us"; say which.
+            // An empty market is either "no match", "needs a keyword" or "upstream refused us".
             const reasons = (d.sourceErrors || []).length
               ? d.sourceErrors
-              : (d.degraded || []).length
-                ? [`部分来源不可用：${d.degraded.map((x) => x.source).join(', ')}`]
-                : ['没有找到匹配的技能。'];
+              : hints.length
+                ? hints
+                : (d.degraded || []).length
+                  ? [`部分来源不可用：${d.degraded.map((x) => x.source).join(', ')}`]
+                  : ['没有找到匹配的技能。'];
             setNotice(reasons.join('；'));
+          } else if (hints.length) {
+            setNotice(hints.join('；'));
           } else if ((d.degraded || []).length) {
             setNotice(`部分来源不可用：${d.degraded.map((x) => x.source).join(', ')}`);
           } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-mcp-market",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "type": "module",
   "description": "DSH 技能市场与 MCP 连接器市场：浏览实时技能源，一键安装 SKILL.md 技能与 MCP 连接器，装完即刻可用、无需重启。SKILL & MCP marketplace for DeepSeek Harness — browse live sources, install skills and MCP connectors, effective immediately.",
   "license": "MIT",

package/src/extra-sources.js

@@ -5,7 +5,7 @@
 //   skillsmp  — skillsmp.com/api/skills (paged search; Cloudflare-fronted, needs the curl
 //               transport because this process's own TLS fingerprint is refused)
 // modelscope (api/v1/dolphin/skills → 404) is intentionally absent: the endpoint is gone.
-import { getJsonEscalating } from "./http.js";
+import { getJsonEscalating, postJsonEscalating } from "./http.js";
 
 const UA = { "User-Agent": "dsh-skill-mcp-market/0.4", accept: "application/json" };
 
@@ -60,11 +60,13 @@ export async function searchClawHub({ query = "", pageSize = 24 }) {
 
 // ---------------------------------------------------------------- trusttools
 export async function searchTrustTools({ query = "", pageSize = 24 }) {
-  const data = await postJson("https://ai.trusttools.cn/api/skills/search", {
-    q: query,
-    page: 1,
-    pageSize,
-  });
+  // ai.trusttools.cn drops this process's TLS handshake (same class of failure as
+  // skillsmp), so the POST goes through python → curl → fetch instead of plain fetch.
+  const data = await postJsonEscalating(
+    "https://ai.trusttools.cn/api/skills/search",
+    { q: query, page: 1, pageSize },
+    { timeoutMs: 25000 },
+  );
   const rows = Array.isArray(data.data) ? data.data : [];
   const items = rows.map((raw) => {
     const repo = String(raw.repo_url || "").replace(/^https?:\/\/github\.com\//i, "").replace(/\.git$/i, "");

package/src/http.js

@@ -107,6 +107,14 @@ const PY_FETCH = [
   "    sys.stdout.write(response.read().decode('utf-8', 'replace'))",
 ].join("\n");
 
+const PY_POST = [
+  "import sys, json, urllib.request",
+  "url, body, headers, timeout = sys.argv[1], sys.argv[2], json.loads(sys.argv[3]), float(sys.argv[4])",
+  "request = urllib.request.Request(url, data=body.encode('utf-8'), headers=headers, method='POST')",
+  "with urllib.request.urlopen(request, timeout=timeout) as response:",
+  "    sys.stdout.write(response.read().decode('utf-8', 'replace'))",
+].join("\n");
+
 async function isPython(binary) {
   // A relocatable CPython can be present but unusable (its stdlib may be pinned to the
   // build machine, e.g. "AssertionError: SRE module mismatch"), so the probe imports what
@@ -230,3 +238,84 @@ export async function getJsonEscalating(url, { headers = {}, timeoutMs = 20000 }
   }
   throw new Error(errors[0] || "所有传输方式都失败");
 }
+
+/** POST a JSON body through curl (some hosts only answer a non-Node TLS client). */
+export async function curlPostText(url, body, { headers = {}, timeoutMs = 15000 } = {}) {
+  const merged = { ...BROWSER_HEADERS, "content-type": "application/json", ...headers };
+  const payload = JSON.stringify(body ?? {});
+  const args = [
+    "-s", "-S", "--compressed",
+    "--max-time", String(Math.max(1, Math.ceil(timeoutMs / 1000))),
+    "-X", "POST",
+    "--data-binary", "@-",
+  ];
+  for (const [name, value] of Object.entries(merged)) args.push("-H", `${name}: ${value}`);
+  args.push(url);
+  return new Promise((resolve, reject) => {
+    const child = execFile("curl.exe", args, { maxBuffer: 16 * 1024 * 1024, timeout: timeoutMs + 5000, windowsHide: true },
+      (error, stdout) => (error ? reject(error) : resolve(String(stdout || ""))));
+    if (child.stdin) {
+      child.stdin.end(payload);
+    }
+  });
+}
+
+/** POST a JSON body through the Python transport. */
+export async function pythonPostText(url, body, { headers = {}, timeoutMs = 20000 } = {}) {
+  const python = await findPython();
+  if (!python) throw new Error("没有可用的 Python 解释器，无法通过该传输取数");
+  return new Promise((resolve, reject) => {
+    execFile(
+      python,
+      ["-c", PY_POST, url, JSON.stringify(body ?? {}), JSON.stringify({ ...BROWSER_HEADERS, "content-type": "application/json", ...headers }), String(timeoutMs / 1000)],
+      {
+        timeout: timeoutMs + 5000,
+        windowsHide: true,
+        maxBuffer: 16 * 1024 * 1024,
+        env: { ...process.env, PYTHONIOENCODING: "utf-8", PYTHONUTF8: "1" },
+      },
+      (error, stdout, stderr) => {
+        if (error) reject(new Error(`python POST 失败：${String(stderr || error.message).slice(0, 200)}`));
+        else resolve(String(stdout));
+      },
+    );
+  });
+}
+
+/**
+ * POST escalation for hosts whose edge drops this process's TLS handshake: python → curl →
+ * Node fetch, first JSON response wins.
+ */
+export async function postJsonEscalating(url, body, { headers = {}, timeoutMs = 20000 } = {}) {
+  const parse = (text) => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new Error(`上游返回的不是 JSON：${String(text).slice(0, 80).replace(/\s+/g, " ")}`);
+    }
+  };
+  const attempts = [
+    async () => parse(await pythonPostText(url, body, { headers, timeoutMs })),
+    async () => parse(await curlPostText(url, body, { headers, timeoutMs })),
+    async () => {
+      const response = await fetch(url, {
+        method: "POST",
+        headers: { ...BROWSER_HEADERS, "content-type": "application/json", ...headers },
+        body: JSON.stringify(body ?? {}),
+        signal: AbortSignal.timeout(timeoutMs),
+      });
+      if (!response.ok) throw new Error(`HTTP ${response.status} for ${url}`);
+      return response.json();
+    },
+  ];
+  const errors = [];
+  for (const attempt of attempts) {
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      return await attempt();
+    } catch (error) {
+      errors.push(String((error && error.message) || error).slice(0, 120));
+    }
+  }
+  throw new Error(errors[0] || "所有传输方式都失败");
+}

package/src/sources.js

@@ -54,11 +54,58 @@ export function makeCache(dir) {
 }
 
 // ------------------------------------------------------------------ skills.sh
+/**
+ * skills.sh has no listing API, but its home page links the skills it is featuring right
+ * now. Scrape those links so an empty search box still shows a real catalogue instead of
+ * a blank market.
+ */
+export async function browseSkillsSh({ pageSize = 24, cache } = {}) {
+  let rows = cache ? await cache.get("skills_sh_home", 30 * 60 * 1000) : null;
+  if (!Array.isArray(rows) || rows.length === 0) {
+    const html = await fetchText("https://www.skills.sh/", 25000);
+    const seen = new Set();
+    rows = [];
+    for (const match of html.matchAll(/\/([A-Za-z0-9_.-]+)\/skills\/([A-Za-z0-9_.-]+)/g)) {
+      const key = `${match[1]}/${match[2]}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      rows.push({ owner: `${match[1]}/skills`, slug: match[2] });
+    }
+    if (rows.length > 0 && cache) await cache.put("skills_sh_home", rows);
+  }
+  const items = rows.slice(0, pageSize).map(({ owner, slug }) => ({
+    id: `skills.sh:${owner}/${slug}`,
+    slug,
+    name: slug,
+    description: "",
+    source: "skills.sh",
+    sourceLabel: "skills.sh",
+    owner,
+    homepage: `https://www.skills.sh/${owner}/${slug}`,
+    upstreamUrl: owner,
+    skillDir: "",
+    installs: 0,
+    installable: true,
+  }));
+  return { source: "skills.sh", items, total: rows.length };
+}
+
 /** skills.sh exposes a real JSON search API (Algolia-backed). */
 export async function searchSkillsSh({ query = "", pageSize = 24, cache }) {
-  // The upstream API rejects queries shorter than 2 characters; browsing with an empty
-  // box is a legitimate state, so return an empty page with a hint instead of failing.
+  // The upstream search API rejects queries shorter than 2 characters. Browsing with an
+  // empty box is a legitimate state, so fall back to the home-page highlights and say so.
   if (query.trim().length < 2) {
+    try {
+      const browse = await browseSkillsSh({ pageSize, cache });
+      if (browse.items.length > 0) {
+        return {
+          ...browse,
+          hint: "未输入关键词：以下是 skills.sh 首页当前推荐的技能，输入至少 2 个字符可精确搜索",
+        };
+      }
+    } catch {
+      // fall through to the plain hint below
+    }
     return { source: "skills.sh", items: [], total: 0, hint: "skills.sh 需要至少 2 个字符的关键词" };
   }
   const url = `https://www.skills.sh/api/search?q=${encodeURIComponent(query)}&limit=${pageSize}`;
@@ -244,10 +291,12 @@ export async function searchSkills({ query, source = "all", pageSize = 24, cache
   const wanted = source === "all" ? ALL_SOURCES : [source];
   const items = [];
   const degraded = [];
+  const hints = [];
   for (const name of wanted) {
     try {
       if (name === "skills.sh") {
         const result = await searchSkillsSh({ query, pageSize, cache });
+        if (result.hint) hints.push(`skills.sh：${result.hint}`);
         items.push(...result.items);
       } else if (name === "clawhub") {
         const result = await searchClawHub({ query, pageSize });
@@ -287,8 +336,10 @@ export async function searchSkills({ query, source = "all", pageSize = 24, cache
       ? []
       : degraded.length
         ? degraded.map((entry) => `${entry.source} 不可达：${entry.error}`.slice(0, 200))
-        : ["所选市场暂时没有取到数据，可能是上游不可达或响应超时，请稍后重试"];
-  return { items, degraded, sourceErrors, total: items.length };
+        : hints.length
+          ? hints
+          : ["所选市场暂时没有取到数据，可能是上游不可达或响应超时，请稍后重试"];
+  return { items, degraded, hints, sourceErrors, total: items.length };
 }
 
 /**