omni-dsh-plugins 1.0.0 → 1.0.1

package/README.md

@@ -21,9 +21,10 @@ never ships here.
 
 - Node.js 20 or newer.
 - The official `dsh` executable on `PATH` for add, update and remove operations.
-- A public catalog snapshot for discovery. Version `1.0.0` defaults to catalog revision
-  `f01d1d2d22b80222c121db6dfc0fd4035c24b390` (160 entries); `--revision` overrides it and stays
-  the trust anchor, because a fetched snapshot whose declared revision differs is rejected.
+- Network access for discovery. With no `--catalog`, the CLI reads the snapshot published at
+  <https://dsh-plugins.omniroute.online/catalog.snapshot.json> and accepts the revision that
+  snapshot declares, so a plugin merged today is findable today. Passing `--revision` turns the
+  fetch into an exact-commit demand and rejects any snapshot declaring a different one.
 
 ## Discover and validate
 
@@ -72,7 +73,7 @@ npx omni-dsh-plugins remove example-plugin \
   --allow-code-execution
 ```
 
-Native Windows policy for v1.0.0: code-executing `add`, `update`, and `remove` are disabled
+Native Windows policy for v1.0.1: code-executing `add`, `update`, and `remove` are disabled
 before any profile, state, cache, or subprocess access because complete descendant containment
 cannot be proven. Use WSL for mutations. `--dry-run` and the read-only catalog, `search`, `info`,
 `list`, and `doctor` commands remain available. A native Windows recovery marker is never

package/dist/bin.js

@@ -23869,7 +23869,7 @@ async function readLocalSnapshot(path) {
   }
 }
 function validatePublicSnapshotUrl(rawUrl, revision) {
-  assertRevision(revision);
+  if (revision !== void 0) assertRevision(revision);
   if (rawUrl.includes("\\") || rawUrl.includes("%")) {
     throw safety("catalog snapshot URL is outside the public allowlist");
   }
@@ -23879,7 +23879,7 @@ function validatePublicSnapshotUrl(rawUrl, revision) {
   } catch {
     throw safety("catalog snapshot URL is invalid");
   }
-  const expected = `${PUBLIC_CATALOG_RAW_ORIGIN}/${revision}/catalog.snapshot.json`;
+  const expected = revision === void 0 ? PUBLIC_SNAPSHOT_SITE_URL : `${PUBLIC_CATALOG_RAW_ORIGIN}/${revision}/catalog.snapshot.json`;
   if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.port !== "" || url.search !== "" || url.hash !== "" || url.href !== expected && url.href !== PUBLIC_SNAPSHOT_SITE_URL) {
     throw safety("catalog snapshot URL is outside the public allowlist");
   }
@@ -24395,24 +24395,15 @@ async function materializeCatalog(selection2, dependencies = {}) {
 }
 
 // src/catalogSource.ts
-var DEFAULT_CATALOG_REVISION = "f01d1d2d22b80222c121db6dfc0fd4035c24b390";
-var DEFAULT_EMPTY_SNAPSHOT = {
-  source: {
-    kind: "snapshot",
-    declaredRevision: DEFAULT_CATALOG_REVISION,
-    pinStatus: "declared-local"
-  },
-  entries: [],
-  diagnostics: []
-};
 async function loadDefaultCatalog(selection2, dependencies = {}) {
-  if (selection2?.root === void 0) {
-    if (selection2?.revision !== void 0 && selection2.revision !== DEFAULT_CATALOG_REVISION) {
-      throw new CliSafetyError("default catalog revision is invalid");
-    }
-    return DEFAULT_EMPTY_SNAPSHOT;
-  }
-  const materialized = await materializeSelection(selection2, dependencies);
+  const materialized = selection2?.root === void 0 ? await materializeCatalog(
+    {
+      kind: "snapshot-url",
+      url: PUBLIC_SNAPSHOT_SITE_URL,
+      ...selection2?.revision === void 0 ? {} : { revision: selection2.revision }
+    },
+    dependencies
+  ) : await materializeSelection(selection2, dependencies);
   try {
     const loaded = materialized.kind === "snapshot" ? await loadCatalog({
       kind: "snapshot",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omni-dsh-plugins",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Unofficial catalog and safe installer for DeepSeek Harness plugins",
   "type": "module",
   "license": "MIT",