dsh-skillpie 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,28 @@
-# Temporary Holding Version
+# dsh-skillpie
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+DeepSeek Harness(DSH)插件:左侧栏「技能市场」入口。浏览并安装 [SkillPie](https://skillpie.cn) 技能库中的 Agent 技能,一键装入用户级技能目录(`~/.agents/skills/<normalizedName>`),新开会话即可使用。
+
+## 功能
+
+- 左侧栏面板图标「技能市场」→ 主区**内嵌 SkillPie 整站页面**(`https://skillpie.cn/skills`),与 ZCode 的 skill-market 主视图同构:侧栏保持可见,像内嵌浏览器一样直接访问网站。
+- 顶部细工具条:刷新页面、在浏览器中打开(兜底)。
+- Host 半提供 `POST /dsh-skillpie/api`(search / detail / install / installed),供后续对话工具或程序化安装复用;技能安装到 `~/.agents/skills/<normalizedName>`。
+
+## 安全
+
+- 安装包(zip)逐条目校验路径安全,拒绝绝对路径与 `..` 穿越,包体积与解压总量、条目数均有上限。
+- 目标目录名只允许单个安全路径段,由服务端 `normalizedName` 给出。
+- Host API(`/dsh-skillpie/api`)仅限同源页面访问,且位于 Web GUI 会话鉴权之后;安装动作只能由已登录用户在面板里发起。
+
+## 配置
+
+在 profile 的 `cordis.patch.yml` 覆盖该行 `config`:
+
+| 键 | 默认 | 说明 |
+| --- | --- | --- |
+| `skillRoot` | `~/.agents/skills` | 技能安装根目录 |
+| `baseUrl` | `https://skillpie.cn` | SkillPie 服务地址(自部署可覆盖) |
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,9 @@
+# dsh-skillpie bundle patch.
+#
+# One dual-face row: the host half serves POST /dsh-skillpie/api (search,
+# detail, install into ~/.agents/skills), the client half registers the
+# sidebar panel icon and the "Skill marketplace" main view.
+- insert:
+    - id: dsh-skillpie
+      name: "dsh-skillpie"
+      config: {}

package/icon.svg

@@ -0,0 +1,51 @@
+<svg width="512" height="512" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <!-- 背景渐变 -->
+    <linearGradient id="bgGrad" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#6A6DFF"/>
+      <stop offset="100%" stop-color="#B85EFF"/>
+    </linearGradient>
+    
+    <!-- π 符号渐变 -->
+    <linearGradient id="piGrad" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#ffffff"/>
+      <stop offset="100%" stop-color="#f0f0ff"/>
+    </linearGradient>
+    
+    <!-- 黄色星星渐变 -->
+    <linearGradient id="starGrad" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#fbbf24"/>
+      <stop offset="100%" stop-color="#f59e0b"/>
+    </linearGradient>
+    
+    <!-- 阴影效果 -->
+    <filter id="shadow" x="-20%" y="-20%" width="140%" height="140%">
+      <feDropShadow dx="0" dy="4" stdDeviation="8" flood-color="#000000" flood-opacity="0.2"/>
+    </filter>
+  </defs>
+  
+  <!-- 圆角矩形背景 -->
+  <rect x="10" y="10" width="180" height="180" rx="40" fill="url(#bgGrad)" filter="url(#shadow)"/>
+  
+  <!-- π 符号 - 圆润粗体样式(放大0.8倍) -->
+  <g transform="translate(97, 90) scale(1.8)" filter="url(#shadow)">
+    <!-- 顶部横线(带阴影) -->
+    <rect x="-32" y="-22" width="64" height="12" rx="6" fill="url(#piGrad)"/>
+      
+    <!-- 左腿 -->
+    <rect x="-22" y="-16" width="12" height="52" rx="6" fill="url(#piGrad)"/>
+      
+    <!-- 右腿 -->
+    <rect x="10" y="-16" width="12" height="38" rx="6" fill="url(#piGrad)"/>
+  </g>
+    
+  <!-- 顶部横线(无阴影覆盖层) -->
+  <g transform="translate(97, 90) scale(1.8)">
+    <rect x="-32" y="-22" width="64" height="12" rx="6" fill="url(#piGrad)"/>
+  </g>
+  
+  <!-- 黄色四角星（放大0.8倍） -->
+  <g transform="translate(161, 65) scale(1.224)" filter="url(#shadow)">
+    <path d="M 0 -16 Q 1 -1 10 0 Q 1 1 0 16 Q -1 1 -10 0 Q -1 -1 0 -16" fill="url(#starGrad)"/>
+  </g>
+</svg>

package/lib/client.js

@@ -0,0 +1,185 @@
+/**
+ * dsh-skillpie — Web client half (module-loader bundle).
+ *
+ * Registers:
+ *   - sidebar.panellist icon "skillpie-market" (opens the main view),
+ *   - the "Skill marketplace" main view: the SkillPie site itself, embedded
+ *     like an in-app browser page (ZCode's skill-market main view), with a
+ *     thin toolbar for reload / open-in-browser.
+ *
+ * The host half's JSON API (/dsh-skillpie/api) stays available for
+ * programmatic search/install, e.g. future agent tools.
+ *
+ * Follows the host UI conventions: theme tokens only, locale service for all
+ * visible text, no host primitives imported, no DOM writes outside the React
+ * tree. The factory returns the module object (template contract) so the web
+ * boot graph can activate it.
+ */
+window.__ModuleLoader__.load({
+  id: 'dsh-skillpie',
+  factory(require) {
+    var React = require('react')
+    var h = React.createElement
+    var NS = 'dsh-skillpie'
+    var MARKET_URL = 'https://skillpie.cn/skills'
+
+    var zh = {
+      title: '技能市场',
+      reload: '刷新',
+      openInBrowser: '在浏览器中打开',
+      loading: '正在加载技能市场…',
+      loadHint: '如果长时间空白，可能是网络或站点限制；也可以「在浏览器中打开」。',
+    }
+    var en = {
+      title: 'Skill marketplace',
+      reload: 'Reload',
+      openInBrowser: 'Open in browser',
+      loading: 'Loading the SkillPie marketplace…',
+      loadHint: 'If this stays blank, check the network or open it in a browser instead.',
+    }
+
+    // ── icons (currentColor, theme-aware) ────────────────────────────────
+    // ZCodeOnline 同款技能市场图标（lucide Sparkles，24 网格 stroke 风格）。
+    function PieIcon(props) {
+      var size = props && props.size ? props.size : 16
+      return h('svg', {
+        viewBox: '0 0 24 24', width: size, height: size, 'aria-hidden': true,
+        fill: 'none', stroke: 'currentColor', 'stroke-width': 1.7,
+        'stroke-linecap': 'round', 'stroke-linejoin': 'round',
+        style: { display: 'block', flex: 'none' },
+      },
+        h('path', { d: 'M11.017 2.814a1 1 0 0 1 1.966 0l1.051 5.558a2 2 0 0 0 1.594 1.594l5.558 1.051a1 1 0 0 1 0 1.966l-5.558 1.051a2 2 0 0 0-1.594 1.594l-1.051 5.558a1 1 0 0 1-1.966 0l-1.051-5.558a2 2 0 0 0-1.594-1.594l-5.558-1.051a1 1 0 0 1 0-1.966l5.558-1.051a2 2 0 0 0 1.594-1.594z' }),
+        h('path', { d: 'M20 2v4' }),
+        h('path', { d: 'M22 4h-4' }),
+        h('circle', { cx: 4, cy: 20, r: 2 }),
+      )
+    }
+
+    function ReloadIcon() {
+      return h('svg', {
+        viewBox: '0 0 24 24', width: 14, height: 14, 'aria-hidden': true,
+        style: { display: 'block', flex: 'none' },
+      }, h('path', {
+        d: 'M12 4a8 8 0 0 1 7.75 6h-2.1A6 6 0 0 0 6.6 12H4.25A8 8 0 0 1 12 4zm-7.75 8h2.1a6 6 0 0 0 11.05 2H19.75A8 8 0 0 1 4.25 12zM12 20a8 8 0 0 1-7.75-6h2.1A6 6 0 0 0 17.4 12h2.35A8 8 0 0 1 12 20z',
+        fill: 'currentColor',
+      }))
+    }
+
+    // Bound per-apply so the locale service resolves the current language.
+    var pageT = function (key) { return key }
+
+    /** Full-bleed embedded marketplace page, sidebar stays visible. */
+    function EmbeddedMarket() {
+      var t = pageT
+      var frameRef = React.useRef(null)
+      var loadedState = React.useState(false)
+      var loaded = loadedState[0]
+      var setLoaded = loadedState[1]
+      var tickState = React.useState(0)
+      var tick = tickState[0]
+      var setTick = tickState[1]
+
+      var reload = React.useCallback(function () {
+        setLoaded(false)
+        setTick(function (value) { return value + 1 })
+      }, [])
+
+      return h('div', {
+        style: {
+          height: '100%', minHeight: 0, boxSizing: 'border-box',
+          background: 'var(--dsw-alias-bg-base)', color: 'var(--dsw-alias-label-primary)',
+          display: 'flex', flexDirection: 'column',
+        },
+      },
+        h('div', {
+          style: {
+            display: 'flex', alignItems: 'center', gap: 8, padding: '8px 16px',
+            borderBottom: '1px solid var(--dsw-alias-border-l1)',
+          },
+        },
+          h(PieIcon, { size: 16 }),
+          h('span', { style: { fontSize: 13, fontWeight: 600 } }, t('title')),
+          h('span', { style: { flex: 1 } }),
+          h('button', {
+            type: 'button', onClick: reload,
+            title: t('reload'), 'aria-label': t('reload'),
+            style: {
+              display: 'inline-flex', alignItems: 'center', gap: 6, height: 26, padding: '0 10px',
+              borderRadius: 7, border: '1px solid var(--dsw-alias-border-l1)', cursor: 'pointer',
+              background: 'var(--dsw-alias-bg-layer-1)', color: 'var(--dsw-alias-label-primary)', fontSize: 12,
+            },
+          }, h(ReloadIcon), t('reload')),
+          h('a', {
+            href: MARKET_URL, target: '_blank', rel: 'noopener noreferrer',
+            style: {
+              display: 'inline-flex', alignItems: 'center', height: 26, padding: '0 10px',
+              borderRadius: 7, border: '1px solid var(--dsw-alias-border-l1)',
+              background: 'var(--dsw-alias-bg-layer-1)', color: 'var(--dsw-alias-label-primary)',
+              fontSize: 12, textDecoration: 'none',
+            },
+          }, t('openInBrowser')),
+        ),
+        h('div', {
+          style: { position: 'relative', flex: 1, minHeight: 0, background: '#ffffff' },
+        },
+          !loaded ? h('div', {
+            style: {
+              position: 'absolute', inset: 0, display: 'flex', alignItems: 'center', justifyContent: 'center',
+              flexDirection: 'column', gap: 6, padding: 24, textAlign: 'center',
+              color: 'var(--dsw-alias-label-secondary)', fontSize: 13,
+              background: 'var(--dsw-alias-bg-base)',
+            },
+          },
+            h('div', null, t('loading')),
+            h('div', { style: { fontSize: 12 } }, t('loadHint')),
+          ) : null,
+          h('iframe', {
+            key: 'market-frame-' + tick,
+            ref: frameRef,
+            src: MARKET_URL,
+            title: t('title'),
+            // 授权内嵌页使用剪贴板(分享/安装复制);桌面 GUI 走 http 时
+            // 站点自身还有 execCommand 降级,这里对安全上下文生效。
+            allow: 'clipboard-write; clipboard-read',
+            onLoad: function () { setLoaded(true) },
+            style: { width: '100%', height: '100%', border: 'none', display: 'block' },
+          }),
+        ),
+      )
+    }
+
+    return {
+      name: 'dsh-skillpie',
+      inject: ['slots', 'layout', 'locale'],
+      apply: function (ctx) {
+        ctx.effect(function () {
+          return ctx.locale.register(NS, { zh: zh, en: en })
+        }, 'dsh-skillpie: dictionaries')
+
+        pageT = (ctx.locale && typeof ctx.locale.bind === 'function')
+          ? ctx.locale.bind(NS)
+          : function (key) { return (zh[key] != null ? zh[key] : (en[key] != null ? en[key] : key)) }
+
+        // Sidebar panel icon → main view, mirroring ZCode's sidebar entry.
+        ctx.slots.inject('sidebar.panellist', function () {
+          return ctx.slots.register({
+            name: 'sidebar.panellist',
+            id: 'dsh-skillpie',
+            order: 25,
+            locale: NS,
+            label: function () { return pageT('title') },
+          }, PieIcon)
+        })
+
+        // Full-page embedded marketplace view (sidebar stays visible).
+        ctx.slots.inject('main', function () {
+          return ctx.slots.register({
+            name: 'main',
+            key: 'dsh-skillpie',
+            locale: NS,
+          }, EmbeddedMarket)
+        })
+      },
+    }
+  },
+})

package/lib/index.js

@@ -0,0 +1,153 @@
+/**
+ * dsh-skillpie — Cordis entry (host half).
+ *
+ * Serves POST /dsh-skillpie/api for the browser panel:
+ *   { action: 'search',   query, limit }  → { ok, results }
+ *   { action: 'installed' }               → { ok, skills }
+ *   { action: 'install',  name }          → { ok, result }
+ *   { action: 'detail',   name }          → { ok, detail }
+ *   { action: 'ping' }                    → { ok, time }
+ *
+ * The route is same-origin only and lives behind the web GUI's own session
+ * auth, so installing from the panel is always an authenticated user action.
+ * The market work lives in market.js; this file only wires transport, config
+ * and disposal.
+ */
+import { join } from 'node:path'
+import { createMarket, DEFAULT_BASE_URL, DEFAULT_SKILL_ROOT, SkillMarketError } from './market.js'
+
+export const ROUTE = '/dsh-skillpie/api'
+const MAX_BODY = 64 * 1024
+
+/** One issue in the Standard Schema config vocabulary. */
+const issue = (message, ...path) => ({ message, path: path.length ? path : undefined })
+
+/**
+ * Plugin config. Defaults: skillRoot ~/.agents/skills, baseUrl
+ * https://skillpie.cn. Both accept a row override in cordis.patch.yml.
+ */
+export const Config = {
+  '~standard': {
+    version: 1,
+    vendor: 'dsh-skillpie',
+    validate(input) {
+      if (input === undefined || input === null) return { value: {} }
+      if (typeof input !== 'object' || Array.isArray(input)) return { issues: [issue('expected an object')] }
+      const issues = []
+      const value = {}
+      for (const key of ['skillRoot', 'baseUrl']) {
+        const raw = input[key]
+        if (raw === undefined) continue
+        if (typeof raw !== 'string' || !raw.trim()) {
+          issues.push(issue(`expected a non-empty string`, key))
+          continue
+        }
+        value[key] = raw.trim()
+      }
+      if (value.baseUrl !== undefined) {
+        try { new URL(value.baseUrl) } catch {
+          issues.push(issue('expected an absolute http(s) URL', 'baseUrl'))
+          delete value.baseUrl
+        }
+      }
+      return issues.length ? { issues } : { value }
+    },
+  },
+}
+
+/** Read a small JSON request body. */
+function readBody(req) {
+  return new Promise((resolvePromise, rejectPromise) => {
+    let data = ''
+    req.on('data', (chunk) => {
+      data += chunk
+      if (data.length > MAX_BODY) {
+        req.destroy()
+        rejectPromise(new Error('request body too large'))
+      }
+    })
+    req.on('end', () => {
+      if (!data.trim()) return resolvePromise({})
+      try {
+        resolvePromise(JSON.parse(data))
+      } catch {
+        rejectPromise(new Error('invalid JSON body'))
+      }
+    })
+    req.on('error', rejectPromise)
+  })
+}
+
+async function dispatch(market, body) {
+  const action = typeof body?.action === 'string' ? body.action : ''
+  switch (action) {
+    case 'search':
+      return { ok: true, results: await market.search(body.query, body.limit) }
+    case 'installed':
+      return { ok: true, skills: await market.installed() }
+    case 'install':
+      return { ok: true, result: await market.install(body.name) }
+    case 'detail':
+      return { ok: true, detail: await market.detail(body.name) }
+    case 'ping':
+      return { ok: true, time: Date.now() }
+    default:
+      throw new Error(`unknown action: ${action || '(empty)'}`)
+  }
+}
+
+/** Cordis plugin entry (service-object export form). */
+export default {
+  name: 'dsh-skillpie',
+  Config,
+  inject: [],
+  apply(ctx, config = null) {
+    const cfg = config ?? {}
+    const market = createMarket({
+      skillRoot: cfg.skillRoot ?? DEFAULT_SKILL_ROOT,
+      baseUrl: cfg.baseUrl ?? DEFAULT_BASE_URL,
+    })
+
+    ctx.effect(() => () => {}, 'dsh-skillpie: lifetime')
+
+    // HTTP carrier for the browser panel. Optional: headless assemblies keep
+    // the module loadable without the web layer.
+    ctx.inject(['webServer'], (child) => {
+      child.effect(() => child.webServer.register({
+        kind: 'exact',
+        path: ROUTE,
+        handler: async (req, res) => {
+          const send = (status, payload) => {
+            res.writeHead(status, {
+              'Content-Type': 'application/json; charset=utf-8',
+              'Cache-Control': 'no-store',
+            })
+            res.end(JSON.stringify(payload))
+          }
+          // Same-origin only: a cross-origin fetch with a "simple" content
+          // type would skip preflight and could otherwise trigger writes.
+          const origin = req.headers?.origin
+          if (typeof origin === 'string' && origin !== '') {
+            let sameOrigin = false
+            try { sameOrigin = new URL(origin).host === req.headers.host } catch { sameOrigin = false }
+            if (!sameOrigin) {
+              send(403, { ok: false, error: 'cross-origin request refused' })
+              return
+            }
+          }
+          if (req.method !== 'POST') {
+            send(200, { ok: true, service: 'dsh-skillpie', route: ROUTE })
+            return
+          }
+          try {
+            send(200, await dispatch(market, await readBody(req)))
+          } catch (error) {
+            send(200, { ok: false, error: error?.message ?? String(error) })
+          }
+        },
+      }), 'dsh-skillpie: http api')
+    })
+  },
+}
+
+export { createMarket, DEFAULT_BASE_URL, DEFAULT_SKILL_ROOT, SkillMarketError, dispatch }

package/lib/market.js

@@ -0,0 +1,350 @@
+/**
+ * dsh-skillpie — SkillPie (https://skillpie.cn) market client + installer (host half core).
+ *
+ * Public, auth-free HTTP API. The field contract mirrors ZCode's
+ * packages/shared/src/skill-market.ts (verified against the live service):
+ *   GET  /api/skills?query=&limit=                           → { skills: [...] }
+ *   GET  /api/skills/by-normalized-name/<name>               → { skill: { ..., version } }
+ *   GET  /api/skills/by-normalized-name/<name>/download-url  → { downloadUrl }
+ *
+ * Install target: the user-level skills root (~/.agents/skills/<normalizedName>),
+ * the directory DSH scans for session skills. Install safety mirrors ZCode's
+ * skillMarketInstall.ts: safe single-segment target name, per-entry path checks,
+ * package/extracted size caps, entry count cap, and a skill directory that must
+ * contain exactly one SKILL.md.
+ */
+import { existsSync } from 'node:fs'
+import { cp, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+import { fromBuffer } from 'yauzl'
+
+export const DEFAULT_BASE_URL = 'https://skillpie.cn'
+export const DEFAULT_SKILL_ROOT = join(homedir(), '.agents', 'skills')
+
+const API_TIMEOUT_MS = 10_000
+const DOWNLOAD_TIMEOUT_MS = 60_000
+const MAX_PACKAGE_BYTES = 20 * 1024 * 1024
+const MAX_EXTRACTED_BYTES = 20 * 1024 * 1024
+const MAX_ARCHIVE_ENTRIES = 4096
+const DEFAULT_SEARCH_LIMIT = 10
+const MAX_SEARCH_LIMIT = 20
+/** Target directory name: one safe path segment, no traversal possible. */
+const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/
+
+export class SkillMarketError extends Error {}
+
+/** Fetch JSON with a hard timeout; non-2xx carries the first bytes of the body. */
+async function fetchJson(fetchImpl, url) {
+  const response = await fetchImpl(url, { signal: AbortSignal.timeout(API_TIMEOUT_MS) })
+  if (!response.ok) {
+    const body = await response.text().catch(() => '')
+    throw new SkillMarketError(`skill market request failed (${response.status})${body ? `: ${body.slice(0, 200)}` : ''}`)
+  }
+  return await response.json()
+}
+
+function joinMarketUrl(baseUrl, path) {
+  return `${baseUrl.replace(/\/+$/u, '')}${path}`
+}
+
+function resolveAbsoluteMarketUrl(baseUrl, url) {
+  if (/^https?:\/\//iu.test(url)) return url
+  return joinMarketUrl(baseUrl, url)
+}
+
+function toFiniteNumber(value, fallback = 0) {
+  return typeof value === 'number' && Number.isFinite(value) ? value : fallback
+}
+
+/** Server fields are loosely mapped; missing fields fall back here, never throw. */
+function toSearchResult(baseUrl, skill) {
+  return {
+    id: typeof skill.id === 'string' ? skill.id : '',
+    name: typeof skill.name === 'string' ? skill.name : '',
+    normalizedName: typeof skill.normalizedName === 'string' ? skill.normalizedName : '',
+    category: typeof skill.category === 'string' && skill.category !== '' ? skill.category : null,
+    description: typeof skill.description === 'string' ? skill.description : '',
+    ownerDisplayName: typeof skill.ownerDisplayName === 'string' ? skill.ownerDisplayName : '',
+    downloadCount: toFiniteNumber(skill.downloadCount),
+    likeCount: toFiniteNumber(skill.likeCount),
+    versionNo: toFiniteNumber(skill.version?.versionNo),
+    isFree: skill.isFree !== false,
+  }
+}
+
+/** Loose SKILL.md frontmatter parse for the installed-skills list. */
+function parseFrontmatter(text) {
+  const meta = { title: null, description: null, category: null }
+  if (!text.startsWith('---')) return meta
+  const end = text.indexOf('\n---', 3)
+  if (end < 0) return meta
+  for (const line of text.slice(4, end).split('\n')) {
+    const match = /^(name|title|description|category):\s*(.+?)\s*$/u.exec(line)
+    if (match) {
+      const key = match[1] === 'name' ? 'title' : match[1]
+      if (meta[key] == null) meta[key] = match[2].replace(/^["']|["']$/gu, '')
+    }
+  }
+  return meta
+}
+
+export function createMarket(options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch
+  const skillRoot = options.skillRoot ?? DEFAULT_SKILL_ROOT
+  const baseUrl = options.baseUrl ?? DEFAULT_BASE_URL
+
+  const assertSafeNormalizedName = (normalizedName) => {
+    const name = typeof normalizedName === 'string' ? normalizedName.trim() : ''
+    if (!SAFE_NAME.test(name)) {
+      throw new SkillMarketError(`unsafe skill market name: ${normalizedName}`)
+    }
+    return name
+  }
+
+  const market = {
+    /** Search the public catalog. Empty query returns an empty list. */
+    async search(query, limit) {
+      const trimmed = typeof query === 'string' ? query.trim() : ''
+      if (!trimmed) return []
+      const capped = Math.min(Math.max(Number(limit) || DEFAULT_SEARCH_LIMIT, 1), MAX_SEARCH_LIMIT)
+      const params = new URLSearchParams({ query: trimmed, limit: String(capped) })
+      const data = await fetchJson(fetchImpl, joinMarketUrl(baseUrl, `/api/skills?${params.toString()}`))
+      return (Array.isArray(data?.skills) ? data.skills : []).map((skill) => toSearchResult(baseUrl, skill))
+    },
+
+    /** Skill detail; also the source of the paid check and package URL. */
+    async detail(normalizedName) {
+      const name = assertSafeNormalizedName(normalizedName)
+      const data = await fetchJson(
+        fetchImpl,
+        joinMarketUrl(baseUrl, `/api/skills/by-normalized-name/${encodeURIComponent(name)}`),
+      )
+      const skill = data?.skill
+      if (!skill) throw new SkillMarketError(`skill not found in market: ${name}`)
+      const version = skill.version && typeof skill.version === 'object' ? skill.version : null
+      const packageDownloadUrl =
+        typeof version?.packageDownloadUrl === 'string' && version.packageDownloadUrl !== ''
+          ? resolveAbsoluteMarketUrl(baseUrl, version.packageDownloadUrl)
+          : null
+      return {
+        id: typeof skill.id === 'string' ? skill.id : '',
+        name: typeof skill.name === 'string' && skill.name !== '' ? skill.name : name,
+        normalizedName: name,
+        category: typeof skill.category === 'string' && skill.category !== '' ? skill.category : null,
+        description: typeof skill.description === 'string' ? skill.description : '',
+        ownerDisplayName: typeof skill.ownerDisplayName === 'string' ? skill.ownerDisplayName : '',
+        downloadCount: toFiniteNumber(skill.downloadCount),
+        likeCount: toFiniteNumber(skill.likeCount),
+        isFree: skill.isFree !== false,
+        usageInstructions: typeof skill.usageInstructions === 'string' ? skill.usageInstructions : null,
+        version: version
+          ? {
+              versionNo: toFiniteNumber(version.versionNo),
+              packageDownloadUrl,
+              packageSize: toFiniteNumber(version.packageSize, 0) || null,
+            }
+          : null,
+      }
+    },
+
+    /** Install one free skill into <skillRoot>/<normalizedName>. */
+    async install(normalizedName) {
+      const name = assertSafeNormalizedName(normalizedName)
+      const targetPath = resolve(skillRoot, name)
+      if (!targetPath.startsWith(resolve(skillRoot) + '/') && targetPath !== resolve(skillRoot)) {
+        throw new SkillMarketError('unsafe skill install target')
+      }
+      if (existsSync(targetPath)) {
+        return { status: 'already-installed', normalizedName: name, path: targetPath }
+      }
+      const detail = await market.detail(name)
+      if (!detail.isFree) {
+        throw new SkillMarketError('付费技能必须前往 skillpie.cn 技能市场获取 / paid skills must be acquired in the SkillPie marketplace')
+      }
+      let downloadUrl = detail.version?.packageDownloadUrl ?? null
+      if (!downloadUrl) {
+        // Detail without a package URL: fall back to the public download-url endpoint.
+        const data = await fetchJson(
+          fetchImpl,
+          joinMarketUrl(baseUrl, `/api/skills/by-normalized-name/${encodeURIComponent(name)}/download-url`),
+        )
+        downloadUrl = typeof data?.downloadUrl === 'string' && data.downloadUrl !== ''
+          ? resolveAbsoluteMarketUrl(baseUrl, data.downloadUrl)
+          : null
+      }
+      if (!downloadUrl) throw new SkillMarketError('skill package download url is unavailable')
+      const response = await fetchImpl(downloadUrl, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) })
+      if (!response.ok) throw new SkillMarketError(`skill package download failed (${response.status})`)
+      const archive = Buffer.from(await response.arrayBuffer())
+      return await installArchive({ archive, normalizedName: name, skillRoot })
+    },
+
+    /** List locally installed skills under the skills root. */
+    async installed() {
+      if (!existsSync(skillRoot)) return []
+      const entries = await readdir(skillRoot, { withFileTypes: true })
+      const skills = []
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue
+        const skillFile = join(skillRoot, entry.name, 'SKILL.md')
+        if (!existsSync(skillFile)) continue
+        let meta = { title: null, description: null, category: null }
+        try {
+          meta = parseFrontmatter(await readFile(skillFile, 'utf8').then((text) => text.slice(0, 4096)))
+        } catch {
+          // Unreadable SKILL.md still lists the directory name.
+        }
+        skills.push({ normalizedName: entry.name, title: meta.title, description: meta.description, category: meta.category })
+      }
+      skills.sort((a, b) => a.normalizedName.localeCompare(b.normalizedName))
+      return skills
+    },
+  }
+  return market
+}
+
+/** Extract a downloaded skill zip and copy the SKILL.md directory into place. */
+export async function installArchive({ archive, normalizedName, skillRoot }) {
+  if (archive.byteLength === 0) throw new SkillMarketError('skill package is empty')
+  if (archive.byteLength > MAX_PACKAGE_BYTES) throw new SkillMarketError('skill package exceeds size limit')
+  if (!SAFE_NAME.test(normalizedName)) throw new SkillMarketError(`unsafe skill market directory name: ${normalizedName}`)
+  const targetPath = resolve(skillRoot, normalizedName)
+  if (existsSync(targetPath)) {
+    return { status: 'already-installed', normalizedName, path: targetPath }
+  }
+
+  const tempRoot = await mkdtemp(join(tmpdir(), 'dsh-skillpie-'))
+  try {
+    const extractRoot = join(tempRoot, 'package')
+    await extractZipArchive(archive, extractRoot)
+    const sourceDir = await locateSkillDirectory(extractRoot)
+    await mkdir(skillRoot, { recursive: true })
+    await cp(sourceDir, targetPath, { recursive: true, errorOnExist: true, force: false })
+    return { status: 'installed', normalizedName, path: targetPath }
+  } finally {
+    await rm(tempRoot, { recursive: true, force: true })
+  }
+}
+
+/** Per-entry path safety + total size / entry count caps, then stream out. */
+async function extractZipArchive(archive, targetDir) {
+  const zip = await openZipBuffer(archive)
+  let extractedBytes = 0
+  let entryCount = 0
+  const resolvedTarget = resolve(targetDir)
+
+  await new Promise((resolvePromise, rejectPromise) => {
+    const fail = (error) => {
+      rejectPromise(error instanceof Error ? error : new Error(String(error)))
+      try { zip.close() } catch { /* already closed */ }
+    }
+    const safeTargetFor = (fileName) => {
+      if (fileName.startsWith('/') || fileName.includes('\\')) {
+        throw new SkillMarketError(`unsafe skill package entry: ${fileName}`)
+      }
+      const segments = fileName.split('/')
+      if (segments.some((segment) => segment === '' || segment === '..' || segment === '.')) {
+        throw new SkillMarketError(`unsafe skill package entry: ${fileName}`)
+      }
+      const target = resolve(resolvedTarget, ...segments)
+      if (!target.startsWith(resolvedTarget + '/')) {
+        throw new SkillMarketError(`unsafe skill package entry: ${fileName}`)
+      }
+      return target
+    }
+
+    zip.on('error', fail)
+    zip.on('entry', (entry) => {
+      entryCount += 1
+      if (entryCount > MAX_ARCHIVE_ENTRIES) {
+        fail(new SkillMarketError('skill package has too many entries'))
+        return
+      }
+      if (extractedBytes + entry.uncompressedSize > MAX_EXTRACTED_BYTES) {
+        fail(new SkillMarketError('skill package exceeds extracted size limit'))
+        return
+      }
+      let targetPath
+      const isDirectory = entry.fileName.endsWith('/')
+      try {
+        // Directory entries carry a trailing slash; strip it before the
+        // segment check so 'dir/' does not look like an empty segment.
+        targetPath = safeTargetFor(isDirectory ? entry.fileName.slice(0, -1) : entry.fileName)
+      } catch (error) {
+        fail(error)
+        return
+      }
+      void (async () => {
+        try {
+          if (isDirectory) {
+            await mkdir(targetPath, { recursive: true })
+          } else {
+            const stream = await openZipEntryStream(zip, entry)
+            const chunks = []
+            for await (const chunk of stream) chunks.push(Buffer.from(chunk))
+            const content = Buffer.concat(chunks)
+            extractedBytes += content.byteLength
+            if (extractedBytes > MAX_EXTRACTED_BYTES) {
+              throw new SkillMarketError('skill package exceeds extracted size limit')
+            }
+            await mkdir(targetPath.slice(0, targetPath.lastIndexOf('/')), { recursive: true })
+            await writeFile(targetPath, content)
+          }
+          zip.readEntry()
+        } catch (error) {
+          fail(error)
+        }
+      })()
+    })
+    zip.on('end', () => resolvePromise())
+    zip.readEntry()
+  })
+  try { zip.close() } catch { /* already closed */ }
+}
+
+function openZipBuffer(buffer) {
+  return new Promise((resolvePromise, rejectPromise) => {
+    fromBuffer(buffer, { lazyEntries: true, autoClose: false }, (error, zip) => {
+      if (error || !zip) {
+        rejectPromise(error ?? new Error('failed to open skill package'))
+        return
+      }
+      resolvePromise(zip)
+    })
+  })
+}
+
+function openZipEntryStream(zip, entry) {
+  return new Promise((resolvePromise, rejectPromise) => {
+    zip.openReadStream(entry, (error, stream) => {
+      if (error || !stream) {
+        rejectPromise(error ?? new Error('failed to read skill package entry'))
+        return
+      }
+      resolvePromise(stream)
+    })
+  })
+}
+
+/** The zip root is the skill (SKILL.md at root), or exactly one child dir has it. */
+async function locateSkillDirectory(extractRoot) {
+  const skillFile = join(extractRoot, 'SKILL.md')
+  if (existsSync(skillFile)) return extractRoot
+  const candidates = []
+  const entries = await readdir(extractRoot, { withFileTypes: true })
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue
+    const candidate = join(extractRoot, entry.name)
+    if (existsSync(join(candidate, 'SKILL.md'))) candidates.push(candidate)
+  }
+  if (candidates.length !== 1) {
+    throw new SkillMarketError(
+      candidates.length === 0
+        ? 'skill package has no SKILL.md'
+        : 'skill package has multiple skill directories',
+    )
+  }
+  return candidates[0]
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Skill marketplace",
+    "description": "Browse and install SkillPie agent skills from the sidebar."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "技能市场",
+    "description": "在侧边栏浏览并安装 SkillPie 技能库中的 Agent 技能。"
+  }
+}

package/package.json

@@ -1,6 +1,58 @@
 {
   "name": "dsh-skillpie",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "SkillPie marketplace for DeepSeek Harness: search and install agent skills from the sidebar.",
+  "type": "module",
+  "license": "MIT",
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "dsh-plugin",
+    "skillpie",
+    "skills",
+    "marketplace",
+    "agent-skills"
+  ],
+  "main": "./lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg"
+  },
+  "files": [
+    "lib",
+    "locale/*.json",
+    "cordis.patch.yml",
+    "icon.svg",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22.13",
+    "dsh": ">=0.2.1-rc.3"
+  },
+  "dependencies": {
+    "yauzl": "^3.2.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ]
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/skillpie/dsh-plugins.git",
+    "directory": "dsh-skillpie"
+  }
+}