dshmarket 1.31.2 → 1.33.0

package/README.md

@@ -37,6 +37,7 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 - **One-click install** — confirm the source, watch live progress; most plugins go live after a page refresh, no restart
 - **Backup & restore** — export your profile's plugin list and configuration as readable JSON, import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist; restores **merge** (plugins installed after the backup are kept), validate before writing, and roll back on failure
 - **Updates** — per-plugin update checks (npm version or pinned commit vs HEAD), one-click update, or update everything at once; the market updates itself the same way
+- **Public update API** — plugin-owned settings pages can use the versioned, capability-gated [update API v1](UPDATE-API-V1.md) (beta) instead of copying package-manager logic or depending on private Market UI responses
 - **Uninstall** — two-step confirm; plugins installed this session are removed live
 - **Hot disable / enable** — toggles write `- id: …` + `disabled: true|false` into the profile's `cordis.patch.yml` (the official patch layer, mechanism ported from [dsh-plugin-hub](https://github.com/Noob-stupid/dsh-plugin-hub)): DSH's HMR re-composes within ~1s, no restart, and the loader re-applies the choice on every boot; hand-edited patch rows show as badges, host-infrastructure plugins are protected from toggling, and a malformed patch file is never made worse
 - **Restart when needed** — changes that cannot hot-load show a one-click restart beside the pending-change banner; the action is restricted to same-origin loopback requests

package/README.zh.md

@@ -35,6 +35,7 @@ dsh plugin --profile web add dshmarket
 - **一键安装**——确认来源，实时进度；多数插件刷新页面即可用，无需重启
 - **备份与恢复**——把 profile 的插件清单与配置导出为可读 JSON，换机导入，存到 WebDAV 并每日自动备份，或通过私有 GitHub Gist 跨机器同步；恢复采用**合并**方式（备份之后新装的插件会保留），写入前校验、失败自动回滚
 - **更新**——逐插件检测（npm 版本或锁定 commit 对比 HEAD），一键更新或全部更新；市场自己也走同一通道升级
+- **公共更新接口**——插件自己的设置页可调用带版本号、能力探测和回滚状态的[更新 API v1](UPDATE-API-V1.md)（beta），无需复制包管理逻辑，也不依赖市场 UI 的私有响应字段
 - **卸载**——两步确认防误触；本次会话装的插件即点即卸
 - **热禁用 / 启用**——开关会往 profile 的 `cordis.patch.yml`（官方补丁层，机制移植自 [dsh-plugin-hub](https://github.com/Noob-stupid/dsh-plugin-hub)）写入 `- id: …` + `disabled: true|false`：DSH 的 HMR 约 1 秒内重新组合，无需重启，loader 每次启动都会重新应用这个选择；手工改过的补丁行会显示成徽标，宿主基础设施插件禁止开关，补丁文件格式不对时绝不会被写得更糟
 - **按需重启**——无法热加载的变更会在待重启提示旁显示一键重启；操作仅接受本机同源请求

package/UPDATE-API-V1.md

@@ -0,0 +1,115 @@
+# Public plugin update API v1
+
+> **Status: beta.** The shape described here may still change between
+> releases. `GET /dsh-market/api/v1/capabilities` reports
+> `"stability": "beta"` while that is true, and `"stable"` once it stops
+> moving — read that field rather than assuming from the `v1` in the path.
+>
+> Nothing here is going away; what is not yet promised is that field names
+> and response shapes will survive untouched. If you ship against it now,
+> say so in an issue: a shape somebody depends on is a much stronger reason
+> not to move it, and it is how this reaches `stable`.
+
+
+`dshmarket` exposes a small, versioned, same-origin JSON API for plugin-owned
+update surfaces. It lets a plugin show its own update button without spawning a
+package manager, copying the Market installation algorithm, or binding to the
+Market UI's private response fields.
+
+All responses carry:
+
+```json
+{ "schema": "dsh-market/update-api/v1" }
+```
+
+Clients must discover the API before enabling mutation controls:
+
+```http
+GET /dsh-market/api/v1/capabilities
+```
+
+The response names the Market version, profile, runtime (`web` or `desktop`),
+supported features, restart owner and endpoint paths. A client must hide its
+restart button when `restart.supported` is false. Desktop and supervised hosts
+normally delegate restart to their owning shell or operator.
+
+## Check one installed package
+
+```http
+GET /dsh-market/api/v1/updates?name=dsh-mcp-connector&force=1
+```
+
+The response includes the installed version, target version, source kind and
+whether the target is a forward update. Omitting `force=1` allows the Market's
+short update-check cache.
+
+## Start and observe an update
+
+Mutation requests require the same-origin protection used by the Market UI.
+
+```http
+POST /dsh-market/api/v1/updates
+Content-Type: application/json
+
+{ "packageName": "dsh-mcp-connector" }
+```
+
+An accepted request returns HTTP `202` immediately with an `operationId`.
+Passing `"force": true` opts this one operation out of the registry release-age
+wait; clients should offer it only after the normal operation reports
+`RELEASE_TOO_FRESH` or `VERSION_UNCHANGED`.
+
+Poll the operation by id:
+
+```http
+GET /dsh-market/api/v1/operations?operationId=<id>
+```
+
+States are `queued`, `running`, `succeeded`, `failed`, `cancelled` and
+`rolled-back`. Running operations include structured package progress when
+pnpm provides it. Terminal operations include:
+
+- the before and actually installed versions;
+- `refreshRequired` and `restartRequired` outcomes;
+- a stable failure code, bounded user-facing message and retryability;
+- whether a compatibility rollback is currently available.
+
+Up to 50 operation records live in the current Host process. A boot id is
+embedded in every operation id, so a client never mistakes a stale browser
+record for a task belonging to the replacement process.
+
+## Roll back
+
+```http
+POST /dsh-market/api/v1/rollback
+Content-Type: application/json
+
+{ "operationId": "<id>" }
+```
+
+Rollback is intentionally capability- and operation-scoped. It is available
+only when the Market's compatibility verification retained a recovery point;
+a later mutation may supersede it. The normalized result is written back to
+the same operation record.
+
+## Restart
+
+```http
+POST /dsh-market/api/v1/restart
+Content-Type: application/json
+
+{}
+```
+
+This preserves the Market's stricter restart guard: direct loopback,
+same-origin, no forwarding headers, no package mutation in progress, and a Host
+whose lifecycle is not owned by Desktop or a supervisor. Clients must feature
+detect it; they must not invent an alternative process-control path.
+
+## Compatibility policy
+
+- New optional response fields may be added within v1.
+- Existing v1 fields and meanings are not repurposed.
+- A breaking change uses a new path and schema version.
+- When discovery is unavailable, plugin UIs should fall back to opening the
+  Market rather than calling legacy `/dsh-market/*` mutation routes directly.

package/client/client.js

@@ -4428,12 +4428,16 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		* clock instead of letting it fire again moments later: without that, a
 		* deliberate "go back one" reads as broken when it auto-advances right past
 		* where the user just navigated to.
+		*
+		* `intervalMs <= 0` disables the timer entirely (no auto-advance at all);
+		* manual jumps still work. The lightbox uses this: a full-bleed image needs
+		* to stay put until the viewer moves on, so it must never page itself.
 		*/
 		function useAutoCarousel(count, initial, intervalMs = 3500) {
 			const [index, setIndexState] = (0, react.useState)(initial);
 			const [resetTick, setResetTick] = (0, react.useState)(0);
 			(0, react.useEffect)(() => {
-				if (count <= 1) return;
+				if (count <= 1 || intervalMs <= 0) return;
 				const timer = setInterval(() => {
 					setIndexState((i) => (i + 1) % count);
 				}, intervalMs);
@@ -4779,7 +4783,7 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 		* vs "full size" asset to fetch.
 		*/
 		function ScreenshotLightbox({ shots, startIndex, onClose, t }) {
-			const [index, setIndex] = useAutoCarousel(shots.length, startIndex, 4e3);
+			const [index, setIndex] = useAutoCarousel(shots.length, startIndex, 0);
 			(0, react.useEffect)(() => {
 				const onKey = (e) => {
 					if (e.key === "Escape") {
@@ -5610,6 +5614,24 @@ window.__ModuleLoader__.load({ id: "dshmarket", factory: (require) => {
 					else el.scrollTop = 0;
 				}
 			};
+			(0, react.useLayoutEffect)(() => {
+				const el = bodyRef.current;
+				if (el !== null) el.scrollTop = 0;
+				setShowTop(false);
+			}, [
+				tab,
+				q,
+				cat,
+				sortField,
+				sortDir,
+				timeRange,
+				qThemes,
+				themeSortField,
+				themeSortDir,
+				themeTimeRange,
+				qInstalled,
+				installedView
+			]);
 			const plugins = (0, react.useMemo)(() => data === null ? [] : visiblePlugins(data.plugins, {
 				category: cat,
 				query: q,