dshmarket 1.32.0 → 1.34.0

package/README.md

@@ -31,12 +31,14 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 
 ## What you get
 
-- **Browse & search** the full community catalog (1550+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
+- **Browse & search** the full community catalog (2300+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
 - **Screenshots** — AppStore-style screenshots, auto-carousel when there's more than one, click to preview full-size: author-curated shots show right on the card (zero extra requests); plugins without curated shots fall back to automatic README extraction once you open the install dialog. Images load from GitHub hosting only
+- **Comments** — every card opens the plugin's discussion thread in place. It is the same thread its pages on [dshmarket.com](https://dshmarket.com) and the [catalog](https://awesome-dsh-plugin.com) show, so a plugin has one conversation rather than three. Backed by GitHub Discussions through giscus: it loads when you open it, needs a GitHub account only to post, and the note above it says plainly that opening it contacts giscus.app and GitHub
 - **Themes** — a dedicated tab for community themes and skins: install → active immediately, switch with one click (themes are mutually exclusive, your choice survives restarts), uninstall to revert
 - **One-click install** — confirm the source, watch live progress; most plugins go live after a page refresh, no restart
 - **Backup & restore** — export your profile's plugin list and configuration as readable JSON, import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist; restores **merge** (plugins installed after the backup are kept), validate before writing, and roll back on failure
 - **Updates** — per-plugin update checks (npm version or pinned commit vs HEAD), one-click update, or update everything at once; the market updates itself the same way
+- **Public update API** — plugin-owned settings pages can use the versioned, capability-gated [update API v1](UPDATE-API-V1.md) (beta) instead of copying package-manager logic or depending on private Market UI responses
 - **Uninstall** — two-step confirm; plugins installed this session are removed live
 - **Hot disable / enable** — toggles write `- id: …` + `disabled: true|false` into the profile's `cordis.patch.yml` (the official patch layer, mechanism ported from [dsh-plugin-hub](https://github.com/Noob-stupid/dsh-plugin-hub)): DSH's HMR re-composes within ~1s, no restart, and the loader re-applies the choice on every boot; hand-edited patch rows show as badges, host-infrastructure plugins are protected from toggling, and a malformed patch file is never made worse
 - **Restart when needed** — changes that cannot hot-load show a one-click restart beside the pending-change banner; the action is restricted to same-origin loopback requests

package/README.zh.md

@@ -29,12 +29,14 @@ dsh plugin --profile web add dshmarket
 
 ## 你会得到
 
-- **逛与搜**——完整社区目录（1550+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
+- **逛与搜**——完整社区目录（2300+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
 - **截图展示**——App Store 式截图，多图自动轮播，点开还能看大图；作者在 registry 里策展的截图列表卡片就直接显示（零额外请求），没有策展的插件则在打开安装弹窗时自动从 README 抽取；图片仅从 GitHub 图床加载
+- **评论**——每张卡片都能就地打开该插件的讨论。它和插件在 [dshmarket.com](https://dshmarket.com) 与[目录站](https://awesome-dsh-plugin.com)上的页面共用同一条讨论，一个插件只有一处对话，而不是三处。底层是 GitHub Discussions（经由 giscus）：打开即加载，只有发表评论才需要 GitHub 账号；说明里也直说打开会连接 giscus.app 与 GitHub
 - **主题**——独立主题页：装完立即生效，点一下切换（主题互斥、选择跨重启保留），卸载即恢复
 - **一键安装**——确认来源，实时进度；多数插件刷新页面即可用，无需重启
 - **备份与恢复**——把 profile 的插件清单与配置导出为可读 JSON，换机导入，存到 WebDAV 并每日自动备份，或通过私有 GitHub Gist 跨机器同步；恢复采用**合并**方式（备份之后新装的插件会保留），写入前校验、失败自动回滚
 - **更新**——逐插件检测（npm 版本或锁定 commit 对比 HEAD），一键更新或全部更新；市场自己也走同一通道升级
+- **公共更新接口**——插件自己的设置页可调用带版本号、能力探测和回滚状态的[更新 API v1](UPDATE-API-V1.md)（beta），无需复制包管理逻辑，也不依赖市场 UI 的私有响应字段
 - **卸载**——两步确认防误触；本次会话装的插件即点即卸
 - **热禁用 / 启用**——开关会往 profile 的 `cordis.patch.yml`（官方补丁层，机制移植自 [dsh-plugin-hub](https://github.com/Noob-stupid/dsh-plugin-hub)）写入 `- id: …` + `disabled: true|false`：DSH 的 HMR 约 1 秒内重新组合，无需重启，loader 每次启动都会重新应用这个选择；手工改过的补丁行会显示成徽标，宿主基础设施插件禁止开关，补丁文件格式不对时绝不会被写得更糟
 - **按需重启**——无法热加载的变更会在待重启提示旁显示一键重启；操作仅接受本机同源请求

package/UPDATE-API-V1.md

@@ -0,0 +1,115 @@
+# Public plugin update API v1
+
+> **Status: beta.** The shape described here may still change between
+> releases. `GET /dsh-market/api/v1/capabilities` reports
+> `"stability": "beta"` while that is true, and `"stable"` once it stops
+> moving — read that field rather than assuming from the `v1` in the path.
+>
+> Nothing here is going away; what is not yet promised is that field names
+> and response shapes will survive untouched. If you ship against it now,
+> say so in an issue: a shape somebody depends on is a much stronger reason
+> not to move it, and it is how this reaches `stable`.
+
+
+`dshmarket` exposes a small, versioned, same-origin JSON API for plugin-owned
+update surfaces. It lets a plugin show its own update button without spawning a
+package manager, copying the Market installation algorithm, or binding to the
+Market UI's private response fields.
+
+All responses carry:
+
+```json
+{ "schema": "dsh-market/update-api/v1" }
+```
+
+Clients must discover the API before enabling mutation controls:
+
+```http
+GET /dsh-market/api/v1/capabilities
+```
+
+The response names the Market version, profile, runtime (`web` or `desktop`),
+supported features, restart owner and endpoint paths. A client must hide its
+restart button when `restart.supported` is false. Desktop and supervised hosts
+normally delegate restart to their owning shell or operator.
+
+## Check one installed package
+
+```http
+GET /dsh-market/api/v1/updates?name=dsh-mcp-connector&force=1
+```
+
+The response includes the installed version, target version, source kind and
+whether the target is a forward update. Omitting `force=1` allows the Market's
+short update-check cache.
+
+## Start and observe an update
+
+Mutation requests require the same-origin protection used by the Market UI.
+
+```http
+POST /dsh-market/api/v1/updates
+Content-Type: application/json
+
+{ "packageName": "dsh-mcp-connector" }
+```
+
+An accepted request returns HTTP `202` immediately with an `operationId`.
+Passing `"force": true` opts this one operation out of the registry release-age
+wait; clients should offer it only after the normal operation reports
+`RELEASE_TOO_FRESH` or `VERSION_UNCHANGED`.
+
+Poll the operation by id:
+
+```http
+GET /dsh-market/api/v1/operations?operationId=<id>
+```
+
+States are `queued`, `running`, `succeeded`, `failed`, `cancelled` and
+`rolled-back`. Running operations include structured package progress when
+pnpm provides it. Terminal operations include:
+
+- the before and actually installed versions;
+- `refreshRequired` and `restartRequired` outcomes;
+- a stable failure code, bounded user-facing message and retryability;
+- whether a compatibility rollback is currently available.
+
+Up to 50 operation records live in the current Host process. A boot id is
+embedded in every operation id, so a client never mistakes a stale browser
+record for a task belonging to the replacement process.
+
+## Roll back
+
+```http
+POST /dsh-market/api/v1/rollback
+Content-Type: application/json
+
+{ "operationId": "<id>" }
+```
+
+Rollback is intentionally capability- and operation-scoped. It is available
+only when the Market's compatibility verification retained a recovery point;
+a later mutation may supersede it. The normalized result is written back to
+the same operation record.
+
+## Restart
+
+```http
+POST /dsh-market/api/v1/restart
+Content-Type: application/json
+
+{}
+```
+
+This preserves the Market's stricter restart guard: direct loopback,
+same-origin, no forwarding headers, no package mutation in progress, and a Host
+whose lifecycle is not owned by Desktop or a supervisor. Clients must feature
+detect it; they must not invent an alternative process-control path.
+
+## Compatibility policy
+
+- New optional response fields may be added within v1.
+- Existing v1 fields and meanings are not repurposed.
+- A breaking change uses a new path and schema version.
+- When discovery is unavailable, plugin UIs should fall back to opening the
+  Market rather than calling legacy `/dsh-market/*` mutation routes directly.