dshmarket 1.33.0 → 1.35.0

package/README.md

@@ -31,8 +31,9 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 
 ## What you get
 
-- **Browse & search** the full community catalog (1550+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
+- **Browse & search** the full community catalog (2300+ plugins, growing daily) — category filters, star counts, top/new sorting, bilingual descriptions that follow your UI language
 - **Screenshots** — AppStore-style screenshots, auto-carousel when there's more than one, click to preview full-size: author-curated shots show right on the card (zero extra requests); plugins without curated shots fall back to automatic README extraction once you open the install dialog. Images load from GitHub hosting only
+- **Comments** — every card opens the plugin's discussion thread in place. It is the same thread its pages on [dshmarket.com](https://dshmarket.com) and the [catalog](https://awesome-dsh-plugin.com) show, so a plugin has one conversation rather than three. Backed by GitHub Discussions through giscus: it loads when you open it, needs a GitHub account only to post, and the note above it says plainly that opening it contacts giscus.app and GitHub
 - **Themes** — a dedicated tab for community themes and skins: install → active immediately, switch with one click (themes are mutually exclusive, your choice survives restarts), uninstall to revert
 - **One-click install** — confirm the source, watch live progress; most plugins go live after a page refresh, no restart
 - **Backup & restore** — export your profile's plugin list and configuration as readable JSON, import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist; restores **merge** (plugins installed after the backup are kept), validate before writing, and roll back on failure

package/README.zh.md

@@ -29,8 +29,9 @@ dsh plugin --profile web add dshmarket
 
 ## 你会得到
 
-- **逛与搜**——完整社区目录（1550+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
+- **逛与搜**——完整社区目录（2300+ 插件，每天在涨），分类筛选、star 数、最热/最新排序，中英描述跟随界面语言
 - **截图展示**——App Store 式截图，多图自动轮播，点开还能看大图；作者在 registry 里策展的截图列表卡片就直接显示（零额外请求），没有策展的插件则在打开安装弹窗时自动从 README 抽取；图片仅从 GitHub 图床加载
+- **评论**——每张卡片都能就地打开该插件的讨论。它和插件在 [dshmarket.com](https://dshmarket.com) 与[目录站](https://awesome-dsh-plugin.com)上的页面共用同一条讨论，一个插件只有一处对话，而不是三处。底层是 GitHub Discussions（经由 giscus）：打开即加载，只有发表评论才需要 GitHub 账号；说明里也直说打开会连接 giscus.app 与 GitHub
 - **主题**——独立主题页：装完立即生效，点一下切换（主题互斥、选择跨重启保留），卸载即恢复
 - **一键安装**——确认来源，实时进度；多数插件刷新页面即可用，无需重启
 - **备份与恢复**——把 profile 的插件清单与配置导出为可读 JSON，换机导入，存到 WebDAV 并每日自动备份，或通过私有 GitHub Gist 跨机器同步；恢复采用**合并**方式（备份之后新装的插件会保留），写入前校验、失败自动回滚

package/UPDATE-API-V1.md

@@ -74,6 +74,23 @@ pnpm provides it. Terminal operations include:
 - a stable failure code, bounded user-facing message and retryability;
 - whether a compatibility rollback is currently available.
 
+For npm updates, Market verifies the package version that pnpm actually placed
+on disk before reporting success. This prevents pnpm's release-age policy or a
+lagging registry mirror from silently turning `@latest` into an older or
+unexpected build. A mismatch is restored from the pre-update recovery point
+and reported as one of these stable failures:
+
+- `DOWNGRADE_DETECTED`: the resolved version is older than the version present
+  before the operation; not retryable without a new target.
+- `RESOLVED_VERSION_MISMATCH`: the resolved version is BELOW the registry
+  target checked immediately before installation; retryable after registry or
+  mirror convergence. A version above that target is accepted — `latest` can
+  move forward while the install is still running.
+
+Provider clients should still compare `beforeVersion`, the target they showed
+to the user, and `installedVersion` before offering restart. That independent
+check protects clients connected to another compatible provider implementation.
+
 Up to 50 operation records live in the current Host process. A boot id is
 embedded in every operation id, so a client never mistakes a stale browser
 record for a task belonging to the replacement process.