dsh-skill-mcp-market 0.3.2 → 0.4.0

package/README.md

@@ -161,7 +161,7 @@ DSH 本来就有技能运行时和 MCP 运行时，缺的只是市场这一层
 | `skill_market_install` | 装技能：`github`（可带 `@ref`）/ `skills.sh`（页面 URL 或裸 `owner/repo`）/ `clawhub` / `skillsmp` / `trusttools` / `browse.sh` / `lobehub-agent` / `skillhub` / `url` / `local` / `zip` |
 | `skill_market_list` | 列已装技能（含 `SKILL.md` 路径） |
 | `skill_market_uninstall` | 卸载（移到 `market/trash/`） |
-| `mcp_market_search` | 搜 MCP：官方注册表（实时）+ 已安装列表；目录不可达时返回降级列表与 `catalogHint` |
+| `mcp_market_search` | 搜 MCP：`source: "registry"`（官方注册表，默认）或 `"lobehub"`（LobeHub 市场）；目录不可达时返回降级列表与 `catalogHint` |
 | `mcp_market_install` | 装 MCP：`slug`（官方注册表名称，如 `io.github.Async23/chrome-devtools-mcp`）/ 手工定义 / `importJson`（Claude·Cursor 的 `mcpServers`），装完立即探活 |
 | `mcp_market_list` | 列已装 MCP（transport、enabled、mounted、已发布工具名） |
 | `mcp_market_set_enabled` | 启停（断开即撤销工具，启用即重连） |
@@ -173,6 +173,7 @@ DSH 本来就有技能运行时和 MCP 运行时，缺的只是市场这一层
 | 源 | 说明 |
 |---|---|
 | **MCP 官方注册表** | `registry.modelcontextprotocol.io`，免费、实时的 MCP 目录，自带真实启动方式（npm / streamable-http） |
+| **LobeHub MCP 市场** | `market.lobehub.com`，第二个 MCP 市场（面板里单独一档）。搜索走官方 `@lobehub/market-cli`，首次自动注册客户端；卡片带作者/分类/安装次数；安装取其公开 manifest 的真实启动方式 |
 | `skills.sh` | 技能索引，支持页面 URL 与裸 `owner/repo`；搜索接口要求 ≥2 字符，空搜索回退到首页推荐 |
 | `skillsmp` | 带反爬（Cloudflare），走 python→curl→fetch 三级取数 |
 | `browse.sh` | 启动预热 + 内存缓存，冷启动超时不缓存空结果 |
@@ -211,7 +212,9 @@ dsh-skill-mcp-market/
 - 技能发现是**一层深**：只认 `<root>/<name>/SKILL.md` 和 `<root>/<name>.md`。
 - MCP 定义是标准写法，能否真跑由安装时的探活结果决定，不预先保证；注册表里标记为必填的环境变量会在安装时提示。
 - 市场不伪造下载量/热度：上游没给就显示 0。
-- LobeHub 页面会间歇返回 `402 payment_required`，所以它只作为次要源；MCP 目录不可达时按「上次缓存 → 内置条目」降级，并在面板上提示可直接按名称安装。
+- 两个 MCP 市场**各自独立**，面板一次只看一个（和技能页签一样，不做合并）：官方注册表偏结构化启动方式，LobeHub 偏卡片信息与分类。
+- LobeHub 需要注册一次市场客户端（`npx -y @lobehub/market-cli register --base-url https://market.lobehub.com --name "DSH Market" --source dsh`），插件首次使用会自动完成；其搜索分页上限 40 条。
+- MCP 目录不可达时按「上次缓存 → 内置条目」降级，并在面板上提示可直接按名称安装。
 
 ## 开发
 

package/client.js

@@ -142,6 +142,7 @@ window.__ModuleLoader__.load({
       const [detail, setDetail] = useState(null);
       const [draft, setDraft] = useState({});
       const [source, setSource] = useState('clawhub');
+      const [mcpSource, setMcpSource] = useState('registry');
       const [size, setSize] = useState(24);
       const [sort, setSort] = useState('default');
       const [importPath, setImportPath] = useState('');
@@ -201,7 +202,10 @@ window.__ModuleLoader__.load({
         setBusy('mcp.search');
         setError('');
         try {
-          const d = await call('mcp.search', { query: text });
+          const d = await call('mcp.search', {
+            query: text,
+            source: (options && options.source) || mcpSource,
+          });
           setMcps(d.items || []);
           // The host reports catalogue degradation separately from "no match", so both the
           // reason and the still-usable path (install by registry name) reach the user.
@@ -468,7 +472,10 @@ window.__ModuleLoader__.load({
           h('div', { style: S.desc }, item.description || ''),
           h('div', { style: S.meta },
             h('span', null, item.transport || 'stdio'),
-            item.source ? h('span', null, `· ${item.source}`) : null,
+            h('span', null, `· ${item.sourceLabel || (item.source === 'lobehub' ? 'LobeHub' : 'MCP 官方注册表')}`),
+            item.owner ? h('span', null, `· ${item.owner}`) : null,
+            item.category ? h('span', null, `· ${item.category}`) : null,
+            item.installs ? h('span', null, `· ${Number(item.installs).toLocaleString()} 次安装`) : null,
             (item.envRequired || []).length ? h('span', null, `· 需要 ${item.envRequired.join(', ')}`) : null),
           // "name" is the registry identifier users may need to copy into a manual install.
           h('div', { style: S.meta }, h('span', null, item.slug)),
@@ -563,7 +570,15 @@ window.__ModuleLoader__.load({
                             searchSkills(query, { source: key, size });
                           },
                         }, key === 'all' ? '全部来源' : key))
-                    : h('span', { style: S.status }, '来源：MCP 官方注册表（实时）'),
+                    : ['registry', 'lobehub'].map((key) =>
+                        h('button', {
+                          key,
+                          style: S.chip(mcpSource === key),
+                          onClick: () => {
+                            setMcpSource(key);
+                            searchMcps(query, { source: key });
+                          },
+                        }, key === 'registry' ? 'MCP 官方注册表' : 'LobeHub')),
                   h('div', { style: { flex: 1 } }),
                   h('select', {
                     style: { ...S.input, flex: '0 0 120px', height: 30 },

package/index.js

@@ -21,7 +21,8 @@ import { installSkill, listInstalledSkills, uninstallSkill, updateSkill } from "
 import { createMcpManager, missingEnv, normalizeServerName } from "./src/mcp.js";
 import { fallbackCards, registryDefinitionByName, searchMcpRegistry } from "./src/mcp-registry.js";
 import { createMarketSkillProvider, readSkillBody } from "./src/provider.js";
-import { lobehubMcpConfig, makeCache, searchLobeHubMcp, searchSkills, warmMarketCache } from "./src/sources.js";
+import { makeCache, searchSkills, warmMarketCache } from "./src/sources.js";
+import { lobehubManifestDefinition, lobehubRegistered, searchLobeHubMarket } from "./src/lobehub-market.js";
 import { setUserEnvironmentVariable } from "./src/env.js";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -88,7 +89,42 @@ function shortError(error) {
  * only one of them is worth acting on. Installation never depends on this function — a
  * `slug` resolves on its own — so a degraded list never blocks a real install.
  */
-async function loadMcpCatalog(cache, query = "") {
+/**
+ * The LobeHub marketplace, as its own source: it is a separate catalogue with its own
+ * identifiers, categories and install manifests, so the panel switches between the two
+ * markets instead of blending them.
+ */
+async function loadLobeHubCatalog(cache, query = "") {
+  const key = `lobehub:list:${String(query || "").trim().toLowerCase() || "all"}:60`;
+  try {
+    const result = await searchLobeHubMarket({ query, pageSize: 40, sort: query ? "" : "installCount", cache });
+    if (result.items.length > 0) {
+      await cache.put(key, result.items);
+      return { items: result.items, hint: "", live: true, categories: result.categories, source: "lobehub" };
+    }
+    return {
+      items: [],
+      hint: String(query || "").trim()
+        ? `LobeHub 里没有匹配「${String(query).trim()}」的连接器，换个关键词（单个词更好）试试。`
+        : "LobeHub 目录暂时没有返回条目，稍后再试。",
+      live: true,
+      categories: result.categories,
+      source: "lobehub",
+    };
+  } catch (error) {
+    const stale = await cache.get(key, 7 * 24 * 3600 * 1000);
+    if (Array.isArray(stale) && stale.length > 0) {
+      return { items: stale, hint: `LobeHub 暂时不可达（${shortError(error)}），下面是上次取到的列表。`, live: false, categories: [], source: "lobehub" };
+    }
+    const registerHint = lobehubRegistered()
+      ? ""
+      : "（还没有注册市场客户端，可运行 npx -y @lobehub/market-cli register --base-url https://market.lobehub.com --name \"DSH Market\" --source dsh）";
+    return { items: [], hint: `LobeHub 暂时不可达：${shortError(error)}${registerHint}`, live: false, categories: [], source: "lobehub" };
+  }
+}
+
+async function loadMcpCatalog(cache, query = "", source = "registry") {
+  if (source === "lobehub") return loadLobeHubCatalog(cache, query);
   const key = `registry:v2:${String(query || "").trim().toLowerCase() || "all"}:60`;
   const problems = [];
   let answered = false;
@@ -101,20 +137,6 @@ async function loadMcpCatalog(cache, query = "") {
     problems.push(`官方注册表：${shortError(error)}`);
   }
 
-  try {
-    const result = await searchLobeHubMcp({ query, pageSize: 60, cache });
-    answered = true;
-    if (result.items.length > 0) {
-      return {
-        items: result.items,
-        hint: problems.length > 0 ? `官方注册表暂时不可用（${problems[0]}），下面来自 LobeHub 目录。` : "",
-        live: true,
-      };
-    }
-  } catch (error) {
-    problems.push(`LobeHub：${shortError(error)}`);
-  }
-
   // Both catalogues answered and neither had a match: that is an empty search result, not
   // an outage, and it must not be dressed up as a degraded catalogue.
   if (answered && problems.length === 0) {
@@ -151,21 +173,13 @@ function applyEnvValues(envValues) {
 
 /** Resolve one LobeHub slug into a runnable MCP definition by reading its page. */
 async function resolveLobeHubDefinition(slug, serverName) {
-  const config = await lobehubMcpConfig(slug);
-  const name = normalizeServerName(serverName || config.name || slug);
+  // A LobeHub identifier resolves through its public marketplace manifest, which declares the
+  // real command/args (or remote URL) plus the environment variables the server expects.
+  const definition = await lobehubManifestDefinition(slug);
   return {
-    serverName: name,
-    title: slug,
-    description: "",
-    transport: config.url ? "streamable-http" : "stdio",
-    command: config.command || "",
-    args: config.args || [],
-    env: config.env || {},
-    url: config.url || "",
-    headers: config.headers || {},
-    source: "lobehub",
+    ...definition,
+    serverName: normalizeServerName(serverName || definition.title || slug),
     slug,
-    homepage: `https://lobehub.com/mcp/${slug}`,
   };
 }
 
@@ -188,9 +202,9 @@ async function resolveMcpDefinition(slug, serverName) {
   } catch (error) {
     const detail = registryError ? `注册表查询失败：${shortError(registryError)}` : "注册表里没有这个名称";
     throw new Error(
-      `无法解析 MCP 连接器 "${slug}"（${detail}）。LobeHub 目录已改为付费接口（HTTP 402）。` +
-        `请改用 MCP 官方注册表名称，例如 mcp_market_install({slug:"io.github.Async23/chrome-devtools-mcp"})，` +
-        `或直接给 command/args（stdio）或 url（streamable-http）手动安装。原始错误：${shortError(error)}`,
+      `无法解析 MCP 连接器 "${slug}"（${detail}；LobeHub manifest 也失败：${shortError(error)}）。` +
+        `可改用 MCP 官方注册表名称（例如 io.github.Async23/chrome-devtools-mcp）或 LobeHub 标识符（例如 microsoft-playwright-mcp），` +
+        `也可以直接给 command/args（stdio）或 url（streamable-http）手动安装。`,
     );
   }
 }
@@ -500,12 +514,19 @@ export async function apply(ctx, config = {}) {
         query: { type: "string" },
         category: { type: "string" },
         includeInstalled: { type: "boolean", description: "Include installed connectors. Defaults to true." },
+        source: {
+          type: "string",
+          enum: ["registry", "lobehub"],
+          description:
+            "Which MCP market to search: `registry` (official Model Context Protocol registry, default) or `lobehub` (LobeHub marketplace, richer cards with author/install counts).",
+        },
       },
       additionalProperties: false,
     },
     handler: async (args) => {
       const query = String(args.query || "").trim();
-      const catalog = await loadMcpCatalog(marketCache, query);
+      const wanted = String(args.source || "registry") === "lobehub" ? "lobehub" : "registry";
+      const catalog = await loadMcpCatalog(marketCache, query, wanted);
       const rows = catalog.live
         ? catalog.items
         : catalog.items.filter((item) =>
@@ -825,7 +846,8 @@ export async function apply(ctx, config = {}) {
         return mcp.update(body.serverName, body.patch || {});
       case "mcp.search": {
         const query = String(body.query || "").trim();
-        const catalog = await loadMcpCatalog(marketCache, query);
+        const wanted = String(body.source || "registry") === "lobehub" ? "lobehub" : "registry";
+        const catalog = await loadMcpCatalog(marketCache, query, wanted);
         // A live registry search is already filtered server-side; fallback and cached lists
         // are not, so only those get a local filter.
         const rows = catalog.live
@@ -849,6 +871,8 @@ export async function apply(ctx, config = {}) {
             source: item.source || "registry",
           })),
           hint: catalog.hint,
+          categories: catalog.categories || [],
+          source: wanted,
         };
       }
       case "mcp.install": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-mcp-market",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "type": "module",
   "description": "DSH 技能市场与 MCP 连接器市场：浏览实时技能源，一键安装 SKILL.md 技能与 MCP 连接器，装完即刻可用、无需重启。SKILL & MCP marketplace for DeepSeek Harness — browse live sources, install skills and MCP connectors, effective immediately.",
   "license": "MIT",

package/src/lobehub-market.js

@@ -0,0 +1,211 @@
+// The second MCP market: LobeHub's plugin marketplace.
+//
+// LobeHub used to be reachable only by scraping its pages, which is why this plugin kept it
+// as a last-resort fallback. It now ships a documented marketplace API, used through its own
+// CLI (`@lobehub/market-cli`), which handles the OAuth client registration for us:
+//
+//   npx -y @lobehub/market-cli register --base-url https://market.lobehub.com --name "DSH Market" --source dsh
+//   npx -y @lobehub/market-cli mcp search --q "playwright" --sort installCount --output json
+//   npx -y @lobehub/market-cli mcp view  <identifier> --output json
+//
+// Search results carry name/author/description/category/installCount/ratingAverage, i.e. the
+// same fields the reference desktop app renders. The per-plugin manifest (command, args, url,
+// env schema) is served anonymously at /api/v1/plugins/<identifier>/manifest, so installs do
+// not need the CLI at all.
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { getJson } from "./http.js";
+
+/** Marketplace origin; overridable for self-hosted or test instances. */
+export const LOBEHUB_MARKET_BASE = process.env.LOBEHUB_MARKET_BASE_URL || "https://market.lobehub.com";
+
+/** Where the CLI keeps the registered client credentials. */
+export function lobehubCredentialsPath() {
+  return join(homedir(), ".lobehub-market", "credentials.json");
+}
+
+export function lobehubRegistered() {
+  try {
+    return existsSync(lobehubCredentialsPath());
+  } catch {
+    return false;
+  }
+}
+
+/** Quote one argv item for a `cmd /c` command line. */
+function quoteForCmd(value) {
+  const text = String(value);
+  if (!/[\s"&|<>^]/.test(text)) return text;
+  return `"${text.replace(/"/g, '\\"')}"`;
+}
+
+function runCli(args, timeoutMs = 90000) {
+  // Windows cannot execFile a `.cmd` shim without a shell (EINVAL), so the CLI runs through
+  // cmd.exe there with an explicitly quoted command line.
+  const isWindows = process.platform === "win32";
+  const file = isWindows ? process.env.ComSpec || "cmd.exe" : "npx";
+  const argv = isWindows
+    ? ["/d", "/s", "/c", ["npx", "-y", "@lobehub/market-cli", ...args].map(quoteForCmd).join(" ")]
+    : ["-y", "@lobehub/market-cli", ...args];
+  return new Promise((resolve, reject) => {
+    execFile(
+      file,
+      argv,
+      {
+        timeout: timeoutMs,
+        maxBuffer: 16 * 1024 * 1024,
+        windowsHide: true,
+        env: { ...process.env, MARKET_BASE_URL: LOBEHUB_MARKET_BASE, NO_COLOR: "1", npm_config_yes: "true" },
+      },
+      (error, stdout, stderr) => {
+        if (error) {
+          const detail = String(stderr || error.message || "")
+            .split(/\r?\n/)
+            .filter((line) => !/^npm notice/.test(line.trim()))
+            .join(" ")
+            .replace(/\s+/g, " ")
+            .slice(0, 300);
+          const wrapped = new Error(`LobeHub 市场命令失败：${detail}`);
+          wrapped.code = error.code;
+          reject(wrapped);
+        } else {
+          resolve(String(stdout || ""));
+        }
+      },
+    );
+  });
+}
+
+/** Register this plugin as a marketplace client once; the CLI stores the credentials itself. */
+export async function registerLobeHubClient(name = "DSH Market") {
+  await runCli(["register", "--base-url", LOBEHUB_MARKET_BASE, "--name", name, "--source", "dsh"], 150000);
+  return lobehubCredentialsPath();
+}
+
+function parseJsonOutput(text) {
+  const start = String(text).indexOf("{");
+  if (start < 0) throw new Error(`LobeHub 市场返回了非 JSON 内容：${String(text).slice(0, 120)}`);
+  return JSON.parse(String(text).slice(start));
+}
+
+function mapItem(raw) {
+  const connectionType = String(raw.connectionType || "").toLowerCase();
+  const transport = connectionType === "local" || connectionType === "stdio"
+    ? "stdio"
+    : raw.haveCloudEndpoint || connectionType === "remote" || connectionType === "http"
+      ? "streamable-http"
+      : "stdio";
+  return {
+    id: `lobehub:${raw.identifier}`,
+    slug: raw.identifier,
+    name: raw.name || raw.identifier,
+    description: raw.description || "",
+    category: raw.category || "",
+    transport,
+    envRequired: Array.isArray(raw.envRequired) ? raw.envRequired : [],
+    installable: Boolean(raw.identifier),
+    homepage: raw.homepage || raw.github?.url || `https://market.lobehub.com/s/plugins/${raw.identifier}`,
+    owner: raw.author || "",
+    installs: Number(raw.installCount) || 0,
+    rating: Number(raw.ratingAverage) || 0,
+    ratingCount: Number(raw.ratingCount) || 0,
+    stars: Number(raw.github?.stars) || 0,
+    featured: Boolean(raw.isFeatured),
+    validated: Boolean(raw.isValidated),
+    source: "lobehub",
+    sourceLabel: "LobeHub",
+    manifestUrl: raw.manifestUrl || "",
+  };
+}
+
+/**
+ * Search the LobeHub marketplace. Registered credentials are reused; a first run without any
+ * registers this plugin automatically so the tab is never dead on arrival.
+ */
+export async function searchLobeHubMarket({ query = "", pageSize = 24, category = "", sort = "", page = 1, cache } = {}) {
+  // The API rejects `--page-size 60` with "Bad Request"; 40 answers reliably.
+  const size = Math.max(1, Math.min(40, Number(pageSize) || 24));
+  const pageNumber = Math.max(1, Number(page) || 1);
+  const key = `lobehub_market:${String(query).toLowerCase()}:${category}:${sort}:${pageNumber}:${size}`;
+  if (cache) {
+    const hit = await cache.get(key, 10 * 60 * 1000);
+    if (hit) return hit;
+  }
+  const hasQuery = Boolean(String(query).trim());
+  const args = ["mcp", "search", "--output", "json", "--page", String(pageNumber), "--page-size", String(size)];
+  if (hasQuery) args.push("--q", String(query).trim());
+  if (category) args.push("--category", category);
+  // `--sort` without a query is rejected ("Bad Request"), so browsering keeps the API order
+  // and the requested ordering is applied to the returned page locally.
+  if (sort && hasQuery) args.push("--sort", sort);
+
+  let text;
+  try {
+    text = await runCli(args);
+  } catch (error) {
+    // A missing or rejected registration is the one failure worth repairing automatically.
+    if (lobehubRegistered()) throw error;
+    await registerLobeHubClient();
+    text = await runCli(args, 120000);
+  }
+  const data = parseJsonOutput(text);
+  const items = (data.items || []).map(mapItem);
+  if (sort === "installCount" && !hasQuery) items.sort((a, b) => (b.installs || 0) - (a.installs || 0));
+  const result = {
+    source: "lobehub",
+    sourceLabel: "LobeHub",
+    items,
+    total: Number(data.totalCount) || items.length,
+    categories: Array.isArray(data.categories) ? data.categories : [],
+    page: Number(data.currentPage) || 1,
+    pageSize: Number(data.pageSize) || size,
+    totalPages: Number(data.totalPages) || 1,
+  };
+  if (cache) await cache.put(key, result);
+  return result;
+}
+
+/** Turn one manifest deployment option into the plugin's MCP definition shape. */
+function definitionFromManifest(manifest, identifier) {
+  const options = Array.isArray(manifest.deploymentOptions) ? manifest.deploymentOptions : [];
+  const withCommand = options.find((option) => option.connection && option.connection.command);
+  const withUrl = options.find((option) => option.connection && option.connection.url);
+  const chosen = withCommand || withUrl || options[0] || {};
+  const connection = chosen.connection || {};
+  const schema = connection.configSchema && connection.configSchema.properties ? connection.configSchema.properties : {};
+  const env = {};
+  for (const [name, spec] of Object.entries(connection.env || schema)) {
+    env[name] = typeof spec === "string" ? spec : String(spec?.default ?? spec?.example ?? "");
+  }
+  const isHttp = Boolean(connection.url);
+  return {
+    title: manifest.name || identifier,
+    description: manifest.description || "",
+    transport: isHttp ? "streamable-http" : "stdio",
+    command: isHttp ? "" : connection.command || "",
+    args: Array.isArray(connection.args) ? connection.args : [],
+    url: connection.url || "",
+    env,
+    headers: connection.headers && typeof connection.headers === "object" ? connection.headers : {},
+    homepage: manifest.homepage || "",
+    category: manifest.category || "",
+    source: "lobehub",
+    slug: identifier,
+    envHints: Object.fromEntries(
+      Object.entries(connection.env || schema).map(([name, spec]) => [name, String((spec && (spec.description || spec.title)) || "")]),
+    ),
+  };
+}
+
+/** Read one plugin manifest (public endpoint) and reduce it to a runnable definition. */
+export async function lobehubManifestDefinition(identifier) {
+  const url = `${LOBEHUB_MARKET_BASE}/api/v1/plugins/${encodeURIComponent(identifier)}/manifest`;
+  const manifest = await getJson(url, { timeoutMs: 25000 });
+  const definition = definitionFromManifest(manifest, identifier);
+  if (!definition.command && !definition.url) {
+    throw new Error(`LobeHub 条目 "${identifier}" 没有声明可用的启动方式（既无命令也无远程地址）`);
+  }
+  return definition;
+}