|
-
- 我们正在通过 DSH Community Market 设计插件发现、详情和确认安装体验。当前只有产品与安全文档，尚未提供可用市场页面。
+
+ DSH Community Market 已完成并内置，提供插件发现、详情、安装与管理。市场以开放方式连接各种插件数据源：任何人都可以提供、接入和使用符合公开 Schema 的来源，已有 API 也可以通过受审 adapter 加入合作数据源。
|
共建插件生态
@@ -181,6 +181,7 @@ Discord：[加入 DeepSeek Harness Desktop 社区](https://discord.gg/TJeGqKRNM)
| dsh-web-ui | DeepSeek Harness Web UI 插件与皮肤合集。 | [GitHub](https://github.com/zhu1090093659/dsh-web-ui) · [展示站](https://gallery.dsh-market.com) |
| dsh-TUI | DeepSeek Harness 全屏交互式终端界面。 | [GitHub](https://github.com/ccch1mneyyy/dsh-TUI) |
| dsh-tianshu-tui | DSH Web 端交互式终端极简风格 UI 插件，自研 ANSI 渲染核心、极致丝滑流畅；在官方基础上增加了 TDD、证据门、视觉图像模块等工作流。 | [GitHub](https://github.com/huiliyi37/dsh-tianshu-tui) |
+| dsh-context | DSH 上下文洞察面板：Context 仪表盘 + /context 命令 + Context 浏览器，一站式查看 Context 的分类组成、内容详情、演进趋势、压缩/注入事件与统计，覆盖 Context 全生命周期管理。 | [GitHub](https://github.com/bowenliang123/dsh-context) · [NPM](https://www.npmjs.com/package/dsh-context) |
| Agents-Anywhere | 从手机远程控制电脑上的 Coding Agent。 | [GitHub](https://github.com/anywhere-labs/Agents-Anywhere) |
| DSH-better-sidebar | DeepSeek Harness 侧边栏工作台，集成文件、终端、Git 和子代理。 | [GitHub](https://github.com/omdsh-dev/DSH-better-sidebar) |
| Awesome DeepSeek Harness | DeepSeek Harness 插件、工具与基础设施精选列表。 | [GitHub](https://github.com/0xsline/awesome-deepseek-harness) · [官网](https://deepseekdocs.com/) |
diff --git a/dsh-community-market/README.i18n.yaml b/dsh-community-market/README.i18n.yaml
index d1647ee4ce..8271f25bf2 100644
--- a/dsh-community-market/README.i18n.yaml
+++ b/dsh-community-market/README.i18n.yaml
@@ -1,4 +1,4 @@
# Bilingual-pair consistency record. Both languages carry equal authority.
# Update both files and record their Git blob hashes after editing either side.
-README.md: ba292b771d96d5bde10714b55eb237cc383894e2
-README.zh.md: 974df3bf10d9c749672c91e97303065cb376f1be
+README.md: 4947c8f090e794e4258411a5f595358f4430d0f8
+README.zh.md: 27c5b19a57e100bf072376164c2f7316e5dc7131
diff --git a/dsh-community-market/README.md b/dsh-community-market/README.md
index ba292b771d..4947c8f090 100644
--- a/dsh-community-market/README.md
+++ b/dsh-community-market/README.md
@@ -2,11 +2,11 @@
[中文说明](README.zh.md)
-DSH Community Market is the plugin-market shell for [DSH Desktop](../README.en.md). It helps people discover community plugins and, on Desktop, install or remove the small set of npm packages that pass the Market Host's checks.
+DSH Community Market is the open plugin market built into [DSH Desktop](../README.en.md). It helps people discover community plugins and, on Desktop, install, manage, or remove npm packages that pass the Market Host's checks.
-> **Current status: private integration-testing MVP.** The package has loadable Host and Client entries, persisted user-owned source records, a constrained HTTPS client, standard, DSH 1024Store, and browse-only dshfind adapters, an official **Plugin market** tab under **Settings > Plugins**, a sidebar launcher, Host-managed install and receipt-backed uninstall, plus fail-closed enable/disable controls for mutable direct bundles. This is not a claim that listed or installable plugin code is safe.
+> **Current status: complete and built into DSH Desktop.** The package provides loadable Host and Client entries, persisted user-owned source records, a constrained HTTPS client, standard sources and reviewed cooperating-source adapters, an official **Plugin market** tab under **Settings > Plugins**, a sidebar launcher, Host-managed install and receipt-backed uninstall, plus fail-closed enable/disable controls for mutable direct bundles. This is not a claim that listed or installable plugin code is safe.
-## What we are building
+## Available capabilities
The current interface has four views:
@@ -19,9 +19,9 @@ Clicking a plugin card opens the dialog synchronously and asks the Host whether
## Catalog sources
-The market has no default catalog. People may save several sources, but browse exactly one selected source at a time. They may switch the selection or add a source that implements the published catalog contract. Switching source starts a fresh browsing session: the visible list, search, category selection, and pagination are reset. Every source is isolated behind an adapter, and the market UI sees only the same validated, normalized data model.
+The market remains open to ongoing cooperation with a wide range of plugin data sources. People may save several sources, but browse exactly one selected source at a time. They may switch the selection or add a source that implements the published catalog contract. Switching source starts a fresh browsing session: the visible list, search, category selection, and pagination are reset. Every source is isolated behind an adapter, and the market UI sees only the same validated, normalized data model.
-A conforming source publishes a [`catalog-source` manifest](docs/schemas/catalog-source.schema.json), and its `/v1/plugins` endpoint returns the [`catalog-provider-page` schema](docs/schemas/catalog-provider-page.schema.json). A source may provide `media.icon`; Desktop validates and proxies it before display. Sources without an icon remain valid and receive a local fallback. A conforming standard source needs no custom Market code.
+Anyone can provide, integrate, and use a plugin data source. A conforming source only needs to publish a [`catalog-source` manifest](docs/schemas/catalog-source.schema.json) and return data matching the [`catalog-provider-page` schema](docs/schemas/catalog-provider-page.schema.json) from its `/v1/plugins` endpoint, with no custom Market code. An existing API can keep its own format and contact us to join as a cooperating source through a reviewed adapter shipped with Market. A source may provide `media.icon`; Desktop validates and proxies it before display. Sources without an icon remain valid and receive a local fallback.
Before presenting a selected source, the Host builds one complete, validated local index. A standard source is scanned through its declared cursor and page limits; the reviewed 1024Store adapter reads its full registry once and normalizes it in Schema-bounded chunks. The reviewed dshfind adapter walks its REST pages with one `data_version` fixed across the complete scan. Search, multi-category OR filtering, category choices, and pagination then run against that complete local index without refetching the provider for each interaction. Every visible page contains at most 50 items, and the category choices cover all categories in the index rather than only pages already shown. **Installable** is a fail-closed structural subset of the same index; authoritative npm verification begins only when the user previews one candidate.
@@ -64,9 +64,9 @@ These checks establish package identity and a narrow compatibility boundary; the
## Delivery plan
- **Phase 0 — complete:** package ownership, documentation, trust boundary, and headless checks.
-- **Phase 1 — implemented for integration testing:** source selection, user-added conforming sources, one-source-at-a-time browsing, search, plugin details, and loading/empty/error states.
-- **Phase 2 — implemented for integration testing:** exact stable npm installation into the active profile, configuration-level install recovery, and receipt-backed uninstall through the managed Desktop service.
-- **Later:** updates, broader compatibility evidence, and release review.
+- **Phase 1 — complete and built in:** source selection, user-added conforming sources, one-source-at-a-time browsing, search, plugin details, and loading/empty/error states.
+- **Phase 2 — complete and built in:** exact stable npm installation into the active profile, configuration-level install recovery, and receipt-backed uninstall through the managed Desktop service.
+- **Later:** updates and broader compatibility evidence.
Catalog collection, submission review, accounts, rankings, and hosting remain the responsibility of catalog providers rather than this package.
diff --git a/dsh-community-market/README.zh.md b/dsh-community-market/README.zh.md
index 974df3bf10..27c5b19a57 100644
--- a/dsh-community-market/README.zh.md
+++ b/dsh-community-market/README.zh.md
@@ -2,11 +2,11 @@
[English](README.md)
-DSH Community Market 是 [DSH Desktop](../README.md) 的插件市场壳，用于发现社区插件；在 Desktop 中，还可以安装或移除少量通过 Market Host 检查的 npm package。
+DSH Community Market 是 [DSH Desktop](../README.md) 内置的开放插件市场，用于发现社区插件；在 Desktop 中，还可以安装、管理或移除通过 Market Host 检查的 npm package。
-> **当前状态：private 集成测试 MVP。** Package 已有可加载的 Host/Client 入口、用户拥有的来源持久化、受限 HTTPS client、标准、DSH 1024Store 与仅浏览的 dshfind adapter，并在**设置 > 插件**中提供官方的**插件市场**标签页和侧边栏入口；同时已有 Host 受管安装、基于 receipt 的卸载，以及对可变 direct bundle 的 fail-closed 启用/禁用功能。这不表示被收录或显示为可安装的插件代码是安全的。
+> **当前状态：已完成并内置于 DSH Desktop。** Package 提供可加载的 Host/Client 入口、用户拥有的来源持久化、受限 HTTPS client、标准来源与受审合作来源 adapter，并在**设置 > 插件**中提供官方的**插件市场**标签页和侧边栏入口；同时支持 Host 受管安装、基于 receipt 的卸载，以及对可变 direct bundle 的 fail-closed 启用/禁用。这不表示被收录或显示为可安装的插件代码是安全的。
-## 我们要做什么
+## 已有能力
当前界面分为四个视图：
@@ -19,9 +19,9 @@ DSH Community Market 是 [DSH Desktop](../README.md) 的插件市场壳，用于
## 目录来源
-市场不设默认目录。用户可以保存多个来源，但同一时间只浏览一个已选择来源，也可以切换选择或添加符合公开目录合同的来源。切换来源会开始新的浏览会话，并重置当前列表、搜索、分类选择和分页。每个来源都在适配器之后独立运行，市场界面只能看到同一套经过校验和标准化的数据。
+市场以开放方式与各种插件数据源合作。用户可以保存多个来源，但同一时间只浏览一个已选择来源，也可以切换选择或添加符合公开目录合同的来源。切换来源会开始新的浏览会话，并重置当前列表、搜索、分类选择和分页。每个来源都在适配器之后独立运行，市场界面只能看到同一套经过校验和标准化的数据。
-符合规范的数据源需要发布一份 [`catalog-source` manifest](docs/schemas/catalog-source.schema.json)，其 `/v1/plugins` 接口返回符合 [`catalog-provider-page` Schema](docs/schemas/catalog-provider-page.schema.json) 的数据。来源可以提供 `media.icon`，Desktop 会先校验并代理图片再显示；没有图标的来源仍然合法，界面会使用本地 fallback。符合标准的数据源不需要为 Market 编写自定义代码。
+任何人都可以提供、接入和使用插件数据源。符合规范的数据源只需发布一份 [`catalog-source` manifest](docs/schemas/catalog-source.schema.json)，并由其 `/v1/plugins` 接口返回符合 [`catalog-provider-page` Schema](docs/schemas/catalog-provider-page.schema.json) 的数据，无需为 Market 编写自定义代码。已有 API 无需更换自己的格式，也可以联系我们，通过随 Market 发布的受审 adapter 作为合作数据源接入。来源可以提供 `media.icon`，Desktop 会先校验并代理图片再显示；没有图标的来源仍然合法，界面会使用本地 fallback。
展示已选来源前，Host 会先建立一份完整、经过校验的本地索引。标准来源按照声明的 cursor 与 page limit 扫描；经过审核的 1024Store adapter 只读取一次完整 registry，再按 Schema 上限分块标准化；经过审核的 dshfind adapter 则遍历 REST 分页，并在整次扫描中固定同一个 `data_version`。之后的搜索、多分类 OR 筛选、分类选项和分页都在这份完整本地索引上进行，不会因为每次交互重新请求 provider。每个可见页面最多展示 50 条，分类选项覆盖索引中的全部分类，而不只是已经显示的页面。**可安装**是同一索引上 fail-closed 的结构子集；只有用户预览某个候选时，才开始权威 npm 复核。
@@ -64,9 +64,9 @@ dshfind 当前会返回由提供方维护的安装结论和命令文本，但没
## 交付计划
- **Phase 0 — 已完成：** 确认 package 归属，写清产品与信任边界，建立 headless 检查。
-- **Phase 1 — 已实现并进入集成测试：** 来源选择、用户添加符合规范的来源、一次一个来源的浏览、搜索、插件详情，以及加载、空白和错误状态。
-- **Phase 2 — 已实现并进入集成测试：** 通过 Desktop 受管服务，把精确稳定 npm package 安装到当前 profile，提供配置级安装恢复，并支持基于 receipt 的卸载。
-- **后续：** 更新、更广泛的兼容证据，以及发布评审。
+- **Phase 1 — 已完成并内置：** 来源选择、用户添加符合规范的来源、一次一个来源的浏览、搜索、插件详情，以及加载、空白和错误状态。
+- **Phase 2 — 已完成并内置：** 通过 Desktop 受管服务，把精确稳定 npm package 安装到当前 profile，提供配置级安装恢复，并支持基于 receipt 的卸载。
+- **后续：** 更新与更广泛的兼容证据。
目录采集、投稿审核、账号、排行榜和托管仍由目录 provider 负责，不属于这个 package。
diff --git a/dsh-community-market/SECURITY.i18n.yaml b/dsh-community-market/SECURITY.i18n.yaml
index 07e48d1270..66b3a23bf6 100644
--- a/dsh-community-market/SECURITY.i18n.yaml
+++ b/dsh-community-market/SECURITY.i18n.yaml
@@ -1,4 +1,4 @@
# Bilingual-pair consistency record. Both languages carry equal authority.
# Update both files and record their Git blob hashes after editing either side.
-SECURITY.md: 235965c6f8d5a120495bb16c3ec3c7e42499262e
-SECURITY.zh.md: 05faa13b82b809353b432140611c0e7813543f6e
+SECURITY.md: f27ce8ce307df3fbd091950ec89bf1046fe55264
+SECURITY.zh.md: e8f922b9e07aef621019c855f840f78f6f28ab83
diff --git a/dsh-community-market/SECURITY.md b/dsh-community-market/SECURITY.md
index 235965c6f8..f27ce8ce30 100644
--- a/dsh-community-market/SECURITY.md
+++ b/dsh-community-market/SECURITY.md
@@ -4,7 +4,7 @@
## Current status
-`dsh-community-market` remains private and is being exercised through Desktop integration tests. Its Host/Client runtime validates and normalizes catalog data, persists user-owned source choices, and performs constrained HTTPS requests only after a source is explicitly enabled. On DSH Desktop it also implements a limited exact-version npm install path and receipt-backed uninstall through the managed package capability; the renderer has no package-manager access.
+`dsh-community-market` is complete and built into DSH Desktop. It openly connects to a wide range of plugin data sources: anyone can provide, integrate, and use a source that follows the public schemas, while an existing API can become a cooperating source through a reviewed adapter shipped with Market. Its Host/Client runtime validates and normalizes catalog data, persists user-owned source choices, and performs constrained HTTPS requests only after a source is explicitly enabled. Market also implements a limited exact-version npm install path and receipt-backed uninstall through the managed package capability; the renderer has no package-manager access.
## Trust model
diff --git a/dsh-community-market/SECURITY.zh.md b/dsh-community-market/SECURITY.zh.md
index 05faa13b82..e8f922b9e0 100644
--- a/dsh-community-market/SECURITY.zh.md
+++ b/dsh-community-market/SECURITY.zh.md
@@ -4,7 +4,7 @@
## 当前状态
-`dsh-community-market` 仍在 monorepo 内保持 private，正在进行 Desktop 集成测试。Host/Client runtime 会校验并规范化目录数据、持久化用户拥有的来源选择，并且只在来源被明确启用后执行受限 HTTPS 请求。在 DSH Desktop 中，它还通过受管 package 能力实现了有限的精确版本 npm 安装和基于 receipt 的卸载；renderer 不能访问 package manager。
+`dsh-community-market` 已完成并内置于 DSH Desktop。它以开放方式连接各种插件数据源：任何人都可以提供、接入和使用符合公开 Schema 的来源，已有 API 也可以通过随 Market 发布的受审 adapter 成为合作数据源。Host/Client runtime 会校验并规范化目录数据、持久化用户拥有的来源选择，并且只在来源被明确启用后执行受限 HTTPS 请求。Market 通过受管 package 能力实现有限的精确版本 npm 安装和基于 receipt 的卸载；renderer 不能访问 package manager。
## 信任模型
diff --git a/dsh-community-market/docs/catalog-adapter-guide.i18n.yaml b/dsh-community-market/docs/catalog-adapter-guide.i18n.yaml
index 087afd8ef7..a560c2e1c8 100644
--- a/dsh-community-market/docs/catalog-adapter-guide.i18n.yaml
+++ b/dsh-community-market/docs/catalog-adapter-guide.i18n.yaml
@@ -1,4 +1,4 @@
# Bilingual-pair consistency record. Both languages carry equal authority.
# Update both files and record their Git blob hashes after editing either side.
-catalog-adapter-guide.md: b59a0e88464213d5248614a5d107b53d02b8ed0d
-catalog-adapter-guide.zh.md: c5d8ce2f3ad0167911f374c30cb35cff6cf4697e
+catalog-adapter-guide.md: 176aa079084213bd3cda7b441cbd001a561bb71f
+catalog-adapter-guide.zh.md: 1a524f4baa09259e97c69a45eb4b3c3d89e5a89e
diff --git a/dsh-community-market/docs/catalog-adapter-guide.md b/dsh-community-market/docs/catalog-adapter-guide.md
index b59a0e8846..176aa07908 100644
--- a/dsh-community-market/docs/catalog-adapter-guide.md
+++ b/dsh-community-market/docs/catalog-adapter-guide.md
@@ -2,7 +2,9 @@
[中文](catalog-adapter-guide.zh.md)
-Status: Draft implementation guide. The schemas remain versioned by the [catalog provider contract](catalog-provider-contract.md).
+Status: Implemented public v1 integration guide. The authoritative Schemas and compatibility rules are versioned by the [catalog provider contract](catalog-provider-contract.md).
+
+DSH Community Market is open to every catalog provider and user-owned source. Anyone can use path A immediately by publishing Schema-conforming public HTTPS JSON and sharing the manifest URL; no Market code change or partnership approval is required. Providers that need path B are welcome to propose a reviewed adapter collaboration for their existing public API.
## Choose one integration path
@@ -26,7 +28,7 @@ Use this path when an existing API cannot return the standard page shape. Give t
- stable field meanings and pagination rules;
- attribution, rate limits, and the provider's icon ownership semantics.
-The adapter is local TypeScript reviewed, tested, and released with Market. It uses the constrained Host HTTP client and returns a validated `CatalogSnapshot`. A manifest or remote response can never supply JavaScript, mapping expressions, install commands, credentials, or adapter code.
+The adapter is local TypeScript reviewed, tested, and released with Market. It uses the constrained Host HTTP client and returns a validated `CatalogSnapshot`. Open cooperation does not bypass review: a manifest or remote response can never supply JavaScript, mapping expressions, install commands, credentials, or adapter code.
## Copyable adapter skeleton
diff --git a/dsh-community-market/docs/catalog-adapter-guide.zh.md b/dsh-community-market/docs/catalog-adapter-guide.zh.md
index c5d8ce2f3a..1a524f4baa 100644
--- a/dsh-community-market/docs/catalog-adapter-guide.zh.md
+++ b/dsh-community-market/docs/catalog-adapter-guide.zh.md
@@ -2,7 +2,9 @@
[English](catalog-adapter-guide.md)
-状态：Draft 实现指南。Schema 版本仍以[目录提供方契约](catalog-provider-contract.zh.md)为准。
+状态：已实现的公开 v1 接入指南。权威 Schema 与兼容规则仍以[目录提供方契约](catalog-provider-contract.zh.md)为准。
+
+DSH Community Market 对所有目录 provider 和用户自有来源开放。任何人都可以直接选择路径 A：发布符合 Schema 的公开 HTTPS JSON，并分享 manifest URL；无需修改 Market 代码，也无需先获得合作批准。需要路径 B 的 provider 也可以使用现有公开 API 提出经过审核的 adapter 合作接入。
## 选择一条接入路径
@@ -26,7 +28,7 @@ Provider 能在同一个 origin 发布两个匿名 HTTPS JSON 资源时，选择
- 稳定字段语义和分页规则；
- 来源声明、rate limit 和 provider 的图标所有权语义。
-Adapter 是本地 TypeScript，经过审核与测试后随 Market 发布。它只使用受限 Host HTTP client，并返回经过校验的 `CatalogSnapshot`。Manifest 或远程 response 绝不能提供 JavaScript、mapping 表达式、install command、credential 或 adapter 代码。
+Adapter 是本地 TypeScript，经过审核与测试后随 Market 发布。它只使用受限 Host HTTP client，并返回经过校验的 `CatalogSnapshot`。开放合作不会绕过审核：manifest 或远程 response 绝不能提供 JavaScript、mapping 表达式、install command、credential 或 adapter 代码。
## 可复制 adapter skeleton
diff --git a/dsh-community-market/docs/catalog-provider-contract.i18n.yaml b/dsh-community-market/docs/catalog-provider-contract.i18n.yaml
index e368abcd4a..190fba8531 100644
--- a/dsh-community-market/docs/catalog-provider-contract.i18n.yaml
+++ b/dsh-community-market/docs/catalog-provider-contract.i18n.yaml
@@ -1,4 +1,4 @@
# Bilingual-pair consistency record. Both languages carry equal authority.
# Update both files and record their Git blob hashes after editing either side.
-catalog-provider-contract.md: ef4d33cc0d7cbb02d0307444348a7275f678f50d
-catalog-provider-contract.zh.md: 4dade345a9ac6ed6df4680e9bc9b235551f416b1
+catalog-provider-contract.md: e8fa9cb9ace1f16f1de607cce778c69b01c8c391
+catalog-provider-contract.zh.md: 48eb0fff781022df657f461e9deb0dccceeb1e16
diff --git a/dsh-community-market/docs/catalog-provider-contract.md b/dsh-community-market/docs/catalog-provider-contract.md
index ef4d33cc0d..e8fa9cb9ac 100644
--- a/dsh-community-market/docs/catalog-provider-contract.md
+++ b/dsh-community-market/docs/catalog-provider-contract.md
@@ -2,13 +2,15 @@
[中文](catalog-provider-contract.zh.md)
-Status: **Draft / implementation handoff**. Generated types, validation, source persistence, constrained network access, standard, DSH 1024Store, and browse-only dshfind adapters, and loadable Host/Client entries are implemented for integration testing. This remains a private draft without a compatibility guarantee.
+Status: **Implemented public v1 contract.** The versioned Schemas, generated types, strict validation, source persistence, constrained network and media boundaries, standard HTTP adapter, reviewed DSH 1024Store and browse-only dshfind adapters, complete local indexing, and loadable Host/Client entries are implemented and tested in DSH Desktop. This document and its fixtures are the public interoperability contract for `manifestVersion` and `schemaVersion` `1.x`.
## Decision summary
- DSH Community Market has **no default, preferred, or fallback catalog source**.
- Users may save several source registrations, but explicitly select exactly one source for the current browsing session.
- A user may add any source that implements this contract. Adding a source does not install a plugin and does not grant that source execution access.
+- The catalog ecosystem is open: any person, community, or service may publish a conforming source and any user may register its manifest URL. No Market code change or partnership approval is required for the standard path.
+- Providers with an existing public API that cannot emit the standard page shape may propose a reviewed adapter integration. Cooperation adds local, tested Market code; it never allows a provider to send executable adapter code.
- DSH 1024Store is one of the catalog providers currently cooperating with this project. A reviewed built-in adapter is included; it does not select or fall back to 1024Store automatically.
- dshfind is another optional cooperating provider. Its reviewed adapter is browse-only and is neither selected by default nor used as a preferred, recommended, or fallback source.
- A source being bundled as a choice or supported by an adapter does not mean that Anywhere Labs has recommended, audited, or endorsed the source or the plugins it lists.
@@ -26,7 +28,7 @@ This contract defines:
- the normalized snapshot consumed by the market;
- saved-source registration, single-source selection, provenance, pagination, and failure behavior;
- the minimum network and data-safety boundary;
-- the handoff checklist and test matrix for the first implementation.
+- the implemented v1 capability checklist and verified acceptance matrix.
It does not define catalog governance, plugin review, account systems, payments, arbitrary authenticated sources, or package installation commands. Installation remains a separate user-confirmed operation owned by the market Host and the active-profile services.
@@ -83,21 +85,21 @@ flowchart LR
### Layer 1: source manifest
-A standard source publishes a static manifest validated by [`catalog-source.schema.json`](schemas/catalog-source.schema.json). Its draft v1 shape identifies:
+A standard source publishes a static manifest validated by [`catalog-source.schema.json`](schemas/catalog-source.schema.json). Its public v1 shape identifies:
-- `manifestVersion`, fixed to `1.0.0` for this draft;
+- `manifestVersion`, fixed to `1.0.0` for v1;
- a provider-claimed `providerId`, human-readable `name`, and optional description/homepage;
- provider attribution with a name, URL, and optional notice;
- a public `https-json` GET endpoint;
- the supported query parameters, default and maximum page size, and supported sort values.
-The manifest describes provider capability; it does not control local policy. Draft v1 is public and anonymous: it has no bearer token, cookies, request headers, secret fields, executable mapping, or dynamic JavaScript.
+The manifest describes provider capability; it does not control local policy. Public v1 sources are anonymous: the contract has no bearer token, cookies, request headers, secret fields, executable mapping, or dynamic JavaScript.
The source manifest URL and catalog endpoint are distinct. Adding the manifest URL is an explicit user action. The Host generates a fresh `sourceRecordId`, validates and stores a registration-time copy of the manifest with that local user-added record, exposes its disclosure fields in source management, and does not select it until the user chooses it.
For direct standard integration, the user registers only the manifest URL. The smallest recommended manifest uses one public GET endpoint, advertises only `q`, `category`, `cursor`, and `limit`, sets both example page limits to 50, and leaves `sorts` empty. Fifty is a convenient starter value, not a standard-source ceiling: a manifest may declare limits through the Schema safety maximum of 100. Capability, sort, locale, icons, and richer display fields remain optional extensions. See the [minimal source manifest](examples/catalog-source.example.json) and [minimal provider page](examples/catalog-provider-page.minimal.example.json).
-Registration also pins the provider claim and network origin. On every fetch, the manifest `providerId` must still equal the value saved in the local source record. The user-approved manifest URL, the manifest request's final URL, `transport.endpoint`, and the provider-page request's final URL must all remain on the same credential-free HTTPS origin. Draft v1 network URLs and manifests use only standard HTTPS port 443; custom ports are not part of the standard-source contract. Same-origin redirects are allowed; crossing to another origin is rejected even when both origins use HTTPS. A deployment that requires a separate API origin or port must use a reviewed provider adapter until a future contract version defines that relationship explicitly.
+Registration also pins the provider claim and network origin. On every fetch, the manifest `providerId` must still equal the value saved in the local source record. The user-approved manifest URL, the manifest request's final URL, `transport.endpoint`, and the provider-page request's final URL must all remain on the same credential-free HTTPS origin. Public v1 network URLs and manifests use only standard HTTPS port 443; custom ports are not part of the standard-source contract. Same-origin redirects are allowed; crossing to another origin is rejected even when both origins use HTTPS. A deployment that requires a separate API origin or port uses the reviewed provider-adapter path unless a later contract revision defines that relationship explicitly.
### Layer 2: adapter
@@ -110,7 +112,7 @@ interface CatalogAdapter {
}
```
-`CatalogFetchContext` should expose an `AbortSignal`, a constrained HTTP client, the validated source identity, configured limits, and a narrow Host media registrar that accepts reviewed candidates and returns opaque asset references. It must not expose Electron globals, arbitrary filesystem access, a shell, ambient credentials, or package-manager execution.
+`CatalogFetchContext` exposes an `AbortSignal`, a constrained HTTP client, the validated source identity, configured limits, and a narrow Host media registrar that accepts reviewed candidates and returns opaque asset references. It does not expose Electron globals, arbitrary filesystem access, a shell, ambient credentials, or package-manager execution.
There are only two supported integration paths:
@@ -127,7 +129,7 @@ Provider input never supplies Host provenance. After a response succeeds, the ad
Every successful result is validated against [`catalog-snapshot.schema.json`](schemas/catalog-snapshot.schema.json) before it can be cached, displayed, or considered for installation.
-A draft v1 normalized snapshot contains:
+A public v1 normalized snapshot contains:
- `schemaVersion: "1.0.0"`;
- Host-generated source record identity, provider claim, local adapter identity, registration kind, observed fetch time, and final URL;
@@ -171,7 +173,7 @@ Accept: application/json
The Host first builds and validates a [`CatalogQuery`](schemas/catalog-query.schema.json), then serializes only parameters listed in the source manifest's `query.supported` array. Missing values are omitted rather than serialized as empty strings or `null`.
-| Parameter | Cardinality | Draft v1 meaning |
+| Parameter | Cardinality | Public v1 meaning |
| --- | --- | --- |
| `q` | zero or one | Trimmed search text, 1–200 characters. Matching and ranking are provider-defined. |
| `category` | zero or more | Stable category IDs. Repeated values mean “match any requested category”. Duplicates are invalid. |
@@ -212,7 +214,7 @@ The canonical item identity is the pair `{ sourceRecordId, itemId }`. Two regist
## DSH 1024Store cooperation
-[DSH 1024Store](https://github.com/imsai-sh/awesome-deepseek-harness-plugins) is one of the providers currently cooperating with DSH Community Market. Its existing registry API does not need to change to this draft contract. The integration is a reviewed built-in provider adapter that:
+[DSH 1024Store](https://github.com/imsai-sh/awesome-deepseek-harness-plugins) is one of the providers currently cooperating with DSH Community Market. Its existing registry API does not need to adopt the standard wire shape. The integration uses the public reviewed-adapter path and ships as a built-in provider adapter that:
- requests the provider's documented public API under the same Host network limits;
- maps its categories and plugin metadata into the normalized snapshot;
@@ -243,10 +245,10 @@ Catalog browsing and plugin installation are separate operations:
- Fetching a manifest or snapshot is read-only and never invokes pnpm, DSH, a shell, or a lifecycle script.
- Remote data cannot supply an install command, custom package-manager arguments, environment variables, or a working directory.
-- A browse record is not yet an install target. The Host independently resolves npm identity to an exact SemVer version or repository identity to an immutable commit, using a semantic version parser rather than a regular expression.
-- When a record declares both an npm package and a repository, they are independent provider claims: neither silently takes precedence and their presence does not prove that they contain the same code. The user must explicitly choose the identity being installed. If the Host cannot independently verify the relationship or detects a conflict, installation stays disabled.
-- Installation stays disabled when an immutable version or commit cannot be resolved and revalidated.
-- The final confirmation shows the exact source record, pinned package version or repository commit, active profile, and local-code warning.
+- A browse record is not yet an install target. The current managed path accepts only a structurally eligible exact stable npm target with reviewed provider verification and a canonical repository backlink.
+- Preview independently verifies npm identity, repository, integrity, runtime, lifecycle scripts, DSH bundle evidence, and the active profile against authoritative local and registry state. A conflicting or unverifiable claim keeps installation disabled.
+- Execution repeats mutable checks and rejects changed package or profile evidence.
+- The final confirmation shows the exact source record, pinned npm package and version, active profile, and local-code warning.
- Installation begins only after that explicit user gesture and uses the existing managed active-profile service.
Supporting a source means its metadata can be browsed. It does not grant that source the ability to install, update, enable, or execute a plugin.
@@ -258,12 +260,12 @@ Supporting a source means its metadata can be browsed. It does not grant that so
- Production manifest and catalog URLs must use HTTPS. Reject credentials in the URL, fragments, nonstandard schemes, and endpoints with an embedded query.
- Validate every redirect hop, cap the redirect count, reject HTTPS downgrade, and apply all address checks again at every hop.
- Block loopback, private, link-local, multicast, unspecified, carrier-grade NAT, and cloud metadata destinations after DNS resolution. Protect the connection against DNS rebinding. A local-development override must be explicit, visible, and unavailable in production builds.
-- Do not attach ambient cookies, authorization headers, client certificates, or provider-supplied custom headers. Draft v1 sources are public and anonymous.
+- Do not attach ambient cookies, authorization headers, client certificates, or provider-supplied custom headers. Public v1 standard sources are anonymous.
- Apply connect, first-byte, and total deadlines plus `AbortSignal` cancellation.
- Limit compressed and decoded response sizes, item count, pagination depth, string lengths, arrays, and URL lengths. Limits must be constants covered by tests; schema maxima remain authoritative for data fields.
- Require a JSON media type for catalog responses, decode once, and validate before caching. The catalog loader never follows discovered URLs; only the explicit Host media resolver may process a validated provider-page `media.icon.url` under its separate image limits.
-The current draft v1 runtime budgets are part of the provider contract, not implementation hints:
+The public v1 runtime budgets are part of the provider contract, not implementation hints:
| Boundary | Body and redirect budget | Deadlines | Additional rules |
| --- | --- | --- | --- |
@@ -292,7 +294,7 @@ The Host performs catalog I/O only for the selected source. The icon asset servi
## Versioning and schema authority
-The draft schemas use JSON Schema Draft 2020-12:
+The public v1 schemas use JSON Schema Draft 2020-12:
- [`catalog-source.schema.json`](schemas/catalog-source.schema.json) is authoritative for source manifests.
- [`catalog-query.schema.json`](schemas/catalog-query.schema.json) is authoritative for the normalized query object and parameter bounds.
@@ -301,11 +303,11 @@ The draft schemas use JSON Schema Draft 2020-12:
Implementations must compile these schemas with Draft 2020-12 format assertion enabled and complete URI, date-time, and UUID format validation. `format` is a validation requirement here, not documentation-only annotation. Semantic checks still apply where relationships span fields, including `defaultLimit <= maxLimit` and non-empty `sorts` when `sort` is advertised.
-### Copyable draft fixtures
+### Copyable v1 fixtures
-The implementation team can start contract tests with the matching [minimal source manifest](examples/catalog-source.example.json), [minimal query](examples/catalog-query.example.json), [minimal provider page](examples/catalog-provider-page.minimal.example.json), richer [provider page with optional media](examples/catalog-provider-page.example.json), and [normalized snapshot](examples/catalog-snapshot.example.json) fixtures. They are examples only: the source fixture is not a bundled or selected provider, and none of these files is runtime configuration.
+Provider and adapter authors can run compatibility tests from the matching [minimal source manifest](examples/catalog-source.example.json), [minimal query](examples/catalog-query.example.json), [minimal provider page](examples/catalog-provider-page.minimal.example.json), richer [provider page with optional media](examples/catalog-provider-page.example.json), and [normalized snapshot](examples/catalog-snapshot.example.json) fixtures. They are examples only: the source fixture is not a bundled or selected provider, and none of these files is runtime configuration.
-`manifestVersion` and response `schemaVersion` version this contract, not the DSH, Desktop, Market package, provider, or plugin version. Until this draft is reviewed and marked stable, all four schemas are provisional and must not be advertised as an implemented compatibility promise.
+`manifestVersion` and response `schemaVersion` version this contract, not the DSH, Desktop, Market package, provider, or plugin version. The published `1.x` Schemas are the implemented compatibility surface. Additive compatible evolution requires review, fixtures, generated types, and contract tests; incompatible changes require a new major version.
An implementation must reject an unsupported major version. Any contract change follows review together with schema fixtures and compatibility tests; loosening validation ad hoc inside one provider adapter is not allowed.
@@ -320,50 +322,52 @@ An implementation must reject an unsupported major version. Any contract change
7. Reuse the completed index until its bounded expiry; an explicit refresh invalidates it and bypasses the catalog HTTP cache before rescanning.
8. Cancel owned requests and reset the session when the selected source changes, the selection is cleared, the plugin generation is disposed, or DSH shuts down.
-## Implementation handoff checklist
+## Implemented v1 checklist
+
+The current package implements and tests every capability below.
### Contract and types
-- [ ] Review and freeze the four draft schemas together; generate or maintain matching TypeScript types.
-- [ ] Add positive and negative JSON fixtures for every schema.
-- [ ] Implement semantic checks that JSON Schema alone cannot express, including endpoint path, provider-page item-ID uniqueness, `provenance.itemId` equality, source-record/provenance equality, source-record uniqueness, query-limit relationships, package/repository conflict handling, repository canonicalization, and cursor ownership.
-- [ ] Keep provider adapter types internal until at least one standard source and one provider-specific adapter pass the same contract suite.
+- [x] Publish the four v1 Schemas together and generate matching TypeScript types.
+- [x] Maintain positive and negative JSON fixtures for every Schema.
+- [x] Enforce cross-field semantics that JSON Schema alone cannot express, including endpoint, identity, provenance, query-limit, repository, and cursor rules.
+- [x] Keep adapter types local while the standard, DSH 1024Store, and dshfind paths share the same normalized contract.
### Source registry and UI
-- [ ] Persist user-owned source records with a Host-generated UUID, adapter identity, manifest URL or built-in provider ID, and registration kind; persist one local selected-source marker without exposing it to providers.
-- [ ] Implement add, inspect, select, switch, retry, and remove actions.
-- [ ] Ship with no source selected and an explicit zero-source state.
-- [ ] Show attribution and endpoint host before selecting a source and on every result/detail/install surface.
-- [ ] Make the selected-source error explicit; do not replace a failed source or select another source automatically.
+- [x] Persist user-owned source records and one provider-inaccessible local selection marker.
+- [x] Provide add, inspect, select, switch, retry, reorder, and remove actions.
+- [x] Start with no source selected and show an explicit source-choice state.
+- [x] Show attribution, endpoint host, adapter type, and last result in source management and preserve source provenance in catalog and install surfaces.
+- [x] Keep failures attached to the selected source without automatic replacement or fallback.
### Fetch and selected-source session
-- [ ] Implement one constrained HTTP client shared by the standard and built-in provider adapters.
-- [ ] Implement the standard GET `/v1/plugins` adapter and exact query serialization.
-- [ ] Implement the reviewed DSH 1024Store adapter as one optional source choice.
-- [ ] Add selected-source abort/timeout/full-index caching and force refresh; enforce each standard source's effective requested or default network-page limit through the Schema maximum of 100, and serve visible results from local pages of at most 50.
-- [ ] Validate raw provider data before normalization where applicable, then validate every normalized snapshot again.
-- [ ] Preserve provenance through the complete scan, local search, grouping, pagination, cache, details, and installation confirmation.
+- [x] Share one constrained HTTP client across standard and reviewed provider adapters.
+- [x] Implement standard GET `/v1/plugins`, exact query serialization, full cursor scans, and complete local indexing.
+- [x] Ship reviewed optional DSH 1024Store and browse-only dshfind adapters.
+- [x] Enforce abort, deadlines, bounded caches, force refresh, Schema-bounded network pages, and local UI pages of at most 50.
+- [x] Validate untrusted wire data before normalization and validate every normalized snapshot again.
+- [x] Preserve provenance through scanning, local filtering, pagination, cache, details, and installation confirmation.
### Installation handoff
-- [ ] Derive candidates from normalized identity only; never consume remote commands.
-- [ ] Resolve and pin an exact npm SemVer version or immutable repository commit before enabling Install; never treat provider `latestVersion` text as the pin.
-- [ ] Derive the candidate only from the source record currently visible and selected by the user.
-- [ ] Revalidate the chosen record and active profile immediately before invoking the managed install service.
-- [ ] Keep browsing fully usable when installation capability is absent.
+- [x] Derive candidates only from normalized identity and reviewed provider verification; never consume remote commands.
+- [x] Admit only exact stable npm candidates, then independently revalidate registry identity, repository, integrity, runtime, lifecycle scripts, and DSH bundle evidence during preview and execution.
+- [x] Bind each candidate to the source record currently selected and visible to the user.
+- [x] Revalidate the chosen record, mutable package evidence, and active profile immediately before managed installation.
+- [x] Keep browsing fully usable when installation capability is absent or an item remains browse-only.
### Release gate
-- [ ] Keep `dsh-community-market` private and non-loadable until reviewed runtime entries and Loader smoke tests exist.
-- [ ] Document all configured network/data limits and show safe user-facing failures.
-- [ ] Complete security review for user-added URLs, redirects, DNS rebinding, renderer text handling, and install candidate derivation.
-- [ ] Mark this contract stable only after interoperability fixtures pass against at least two independently shaped providers.
+- [x] Provide reviewed Host/Client runtime entries, package-export checks, and Loader smoke tests.
+- [x] Document configured network/data limits and return bounded user-facing failures.
+- [x] Cover user-added URLs, redirects, DNS pinning, renderer text handling, media isolation, and install-candidate derivation with fail-closed boundaries.
+- [x] Exercise the normalized contract through the standard source and two independently shaped reviewed provider APIs.
-## Planned test matrix
+## Verified test matrix
-These are required acceptance tests for the later implementation, not claims about current test coverage.
+The current automated contract, adapter, Host, Client, media, and installation suites exercise the following acceptance behavior. Rows may group several assertions from those suites.
| Area | Case | Expected result |
| --- | --- | --- |
@@ -403,10 +407,10 @@ These are required acceptance tests for the later implementation, not claims abo
| Security | Source attempts to use cookies, auth, custom headers, or remote adapter code | Capability unavailable and input rejected |
| Lifecycle | Selection changes, is cleared, or Host is disposed during fetch | Fetch aborts, resources release, session state resets when applicable, and no late result mutates state |
| Install | Snapshot contains a command-like string or URL query crafted as a command | It cannot reach the managed install operation |
-| Install | npm version or repository revision is absent, mutable, invalid, or changes during revalidation | Install remains disabled; no package operation starts |
-| Install | One record claims both npm package and repository, but their relationship is unverified or conflicting | Neither identity wins implicitly; install remains disabled |
+| Install | Exact stable npm version or reviewed provider verification is absent, invalid, or changes during revalidation | Install remains disabled; no package operation starts |
+| Install | Catalog repository and authoritative npm package repository are unverified or conflicting | Install remains disabled; no catalog claim wins over authoritative verification |
| Install | User chooses an item from the selected source | Confirmation shows exact source, identity, and active profile before execution |
-## Open implementation details
+## Versioned extension points
-The implementation team may propose concrete cache TTLs, byte/item budgets, locale fallback behavior, and UI layout during review. Those choices must be documented and tested. They may not weaken the exactly-one-selected-source rule, explicit selection, no-default, no-fallback, strict validation, provenance, or non-executable-data rules without revising this contract.
+Compatible v1 revisions may refine documented cache TTLs, byte/item budgets, locale fallback behavior, and UI layout together with tests. They may not weaken the exactly-one-selected-source rule, explicit selection, no-default, no-fallback, strict validation, provenance, or non-executable-data rules; changing those boundaries requires a reviewed contract revision.
diff --git a/dsh-community-market/docs/catalog-provider-contract.zh.md b/dsh-community-market/docs/catalog-provider-contract.zh.md
index 4dade345a9..48eb0fff78 100644
--- a/dsh-community-market/docs/catalog-provider-contract.zh.md
+++ b/dsh-community-market/docs/catalog-provider-contract.zh.md
@@ -2,13 +2,15 @@
[English](catalog-provider-contract.md)
-状态：**Draft / 实现交接稿**。生成类型、校验、来源持久化、受限网络访问、标准、DSH 1024Store 与仅浏览的 dshfind adapter，以及可加载 Host/Client 入口已实现并进入集成测试。它仍是 private draft，不提供兼容性承诺。
+状态：**已实现的公开 v1 契约。** 带版本的 Schema、生成类型、严格校验、来源持久化、受限网络与媒体边界、标准 HTTP adapter、经过审核的 DSH 1024Store 与仅浏览的 dshfind adapter、完整本地索引，以及可加载的 Host/Client 入口均已在 DSH Desktop 中实现并通过测试。本文档和 fixture 是 `manifestVersion` 与 `schemaVersion` `1.x` 的公开互操作契约。
## 决策摘要
- DSH Community Market **没有默认、优先或兜底目录来源**。
- 用户可以保存多个来源注册，但当前浏览会话必须明确且最多只选择一个来源。
- 用户可以添加任何符合本契约的来源。添加来源不会安装插件，也不会给该来源任何执行能力。
+- 目录生态是开放的：任何个人、社区或服务都可以发布符合规范的来源，任何用户都可以登记其 manifest URL。标准接入不需要修改 Market 代码，也不需要先获得合作批准。
+- 已有公开 API 无法直接输出标准 page 结构的 provider，可以提出经过审核的 adapter 合作接入。合作只会增加本地、经过测试的 Market 代码，绝不允许 provider 下发可执行 adapter 代码。
- DSH 1024Store 是当前与本项目合作的目录提供方之一。市场已包含经过审核的内置 adapter；这个 adapter 不会自动选择 1024Store，也不会在当前来源失败时用它兜底。
- dshfind 是另一个可选合作提供方。它经过审查的 adapter 当前仅用于浏览，不会被默认选择、优先排序、推荐或用作兜底。
- 某个来源出现在内置选项中或受到 adapter 支持，不代表 Anywhere Labs 推荐、审核或背书该来源及其收录的插件。
@@ -26,7 +28,7 @@
- 市场消费的标准化快照；
- 已保存来源注册、单一来源选择、provenance、分页和失败行为；
- 最小网络与数据安全边界；
-- 第一版实现的交接清单和测试矩阵。
+- 已实现的 v1 能力清单和已验证验收矩阵。
它不定义目录治理、插件审核、账号系统、付费、任意鉴权来源或 package 安装命令。安装仍然是独立的用户确认操作，由 Market Host 和当前 profile 服务负责。
@@ -83,21 +85,21 @@ flowchart LR
### 第一层：来源 manifest
-标准来源发布一份静态 manifest，并由 [`catalog-source.schema.json`](schemas/catalog-source.schema.json) 校验。Draft v1 的结构用于声明：
+标准来源发布一份静态 manifest，并由 [`catalog-source.schema.json`](schemas/catalog-source.schema.json) 校验。公开 v1 的结构用于声明：
-- `manifestVersion`，本草案固定为 `1.0.0`；
+- `manifestVersion`，v1 固定为 `1.0.0`；
- provider 声称的 `providerId`、可读 `name`，以及可选 description/homepage；
- 包含名称、URL 和可选 notice 的 provider 来源声明；
- 一个公开的 `https-json` GET endpoint；
- 支持的 query 参数、默认和最大分页大小，以及支持的排序值。
-Manifest 描述 provider 能力，不控制本地策略。Draft v1 只支持公开匿名来源：不包含 bearer token、cookie、request header、secret 字段、可执行 mapping 或动态 JavaScript。
+Manifest 描述 provider 能力，不控制本地策略。公开 v1 标准来源只支持匿名访问：契约不包含 bearer token、cookie、request header、secret 字段、可执行 mapping 或动态 JavaScript。
来源 manifest URL 与目录 endpoint 是两个不同地址。添加 manifest URL 必须来自用户明确操作。Host 生成全新 `sourceRecordId`，校验 manifest 后将注册时副本与该本地用户来源记录一起保存，在来源管理中展示其披露字段，并且只有用户选择后才把它设为当前来源。
标准直接接入时，用户只需要登记 manifest URL。建议的最小 manifest 只使用一个公开 GET endpoint，只声明 `q`、`category`、`cursor` 和 `limit`，把示例中的两个 page limit 都设为 50，并将 `sorts` 留空。50 是方便起步的值，不是标准来源上限；manifest 可以在 Schema 安全上限 100 以内声明 limit。Capability、sort、locale、图标和更丰富的展示字段仍是可选扩展。参见[最小来源 manifest](examples/catalog-source.example.json)与[最小 provider page](examples/catalog-provider-page.minimal.example.json)。
-注册同时固定 provider 声明与网络 origin。每次请求都必须重新确认 manifest 的 `providerId` 与本地来源记录保存的值完全一致。用户确认的 manifest URL、manifest 请求的最终 URL、`transport.endpoint` 和 provider-page 请求的最终 URL 必须始终属于同一个无凭据 HTTPS origin。Draft v1 的网络 URL 和 manifest 只允许标准 HTTPS 443 端口，不把自定义端口纳入标准来源契约。允许同源 redirect；即使两个地址都使用 HTTPS，也必须拒绝跨 origin。确实需要独立 API origin 或端口的部署，在未来契约版本明确描述这种关系之前，必须使用经过审核的 provider adapter。
+注册同时固定 provider 声明与网络 origin。每次请求都必须重新确认 manifest 的 `providerId` 与本地来源记录保存的值完全一致。用户确认的 manifest URL、manifest 请求的最终 URL、`transport.endpoint` 和 provider-page 请求的最终 URL 必须始终属于同一个无凭据 HTTPS origin。公开 v1 的网络 URL 和 manifest 只允许标准 HTTPS 443 端口，不把自定义端口纳入标准来源契约。允许同源 redirect；即使两个地址都使用 HTTPS，也必须拒绝跨 origin。确实需要独立 API origin 或端口的部署，应使用经过审核的 provider adapter 接入路径，除非后续契约修订明确描述这种关系。
### 第二层：adapter
@@ -110,7 +112,7 @@ interface CatalogAdapter {
}
```
-`CatalogFetchContext` 应只提供 `AbortSignal`、受限 HTTP client、已校验来源身份、配置限制，以及一个只接受已审核候选并返回不透明 asset reference 的窄 Host media registrar。它不能暴露 Electron 全局对象、任意文件系统访问、shell、ambient credentials 或包管理器执行能力。
+`CatalogFetchContext` 只提供 `AbortSignal`、受限 HTTP client、已校验来源身份、配置限制，以及一个只接受已审核候选并返回不透明 asset reference 的窄 Host media registrar。它不暴露 Electron 全局对象、任意文件系统访问、shell、ambient credentials 或包管理器执行能力。
接入只有两条受支持路径：
@@ -127,7 +129,7 @@ Provider 输入绝不提供 Host provenance。Response 成功后，adapter 注
每个成功结果都必须先通过 [`catalog-snapshot.schema.json`](schemas/catalog-snapshot.schema.json) 校验，之后才能缓存、展示或用于生成安装候选。
-Draft v1 标准化快照包含：
+公开 v1 标准化快照包含：
- `schemaVersion: "1.0.0"`；
- Host 生成的来源记录身份、provider claim、本地 adapter 身份、registration kind、观测的抓取时间和最终 URL；
@@ -171,7 +173,7 @@ Accept: application/json
Host 先构造并校验 [`CatalogQuery`](schemas/catalog-query.schema.json)，然后只序列化来源 manifest 的 `query.supported` 数组中声明的参数。缺失值直接省略，不能序列化为空字符串或 `null`。
-| 参数 | 数量 | Draft v1 语义 |
+| 参数 | 数量 | 公开 v1 语义 |
| --- | --- | --- |
| `q` | 0 或 1 个 | 去除首尾空白的搜索文本，1–200 个字符；匹配和排序方式由 provider 决定。 |
| `category` | 0 或多个 | 稳定 category ID。重复参数表示“匹配任意一个请求分类”；不允许重复值。 |
@@ -212,7 +214,7 @@ Provider cursor 只属于一个已选来源和一个有效 wire query。Host 绝
## 与 DSH 1024Store 的合作
-[DSH 1024Store](https://github.com/imsai-sh/awesome-deepseek-harness-plugins) 是当前与 DSH Community Market 合作的提供方之一。它现有的 registry API 不需要为了本草案而修改。接入方式是一份经过审核的内置 provider adapter，它会：
+[DSH 1024Store](https://github.com/imsai-sh/awesome-deepseek-harness-plugins) 是当前与 DSH Community Market 合作的提供方之一。它现有的 registry API 不需要改成标准 wire 结构，而是通过公开的受审 adapter 路径接入，并随 Market 提供一份内置 provider adapter。它会：
- 在相同 Host 网络限制下请求该 provider 公开文档中的 API；
- 把其分类和插件元数据映射成标准化快照；
@@ -243,10 +245,10 @@ Adapter 可以标准化有界纯文本身份、描述、标签/分类、更新
- 获取 manifest 或 snapshot 是只读操作，绝不会调用 pnpm、DSH、shell 或 lifecycle script。
- 远程数据不能提供 install command、自定义包管理器参数、环境变量或工作目录。
-- 浏览记录还不是安装目标。Host 必须独立把 npm identity 解析为精确 SemVer 版本，或把 repository identity 解析为不可变 commit，并使用语义化版本解析器而不是正则表达式。
-- 一个记录同时声明 npm package 和 repository 时，它们只是 provider 提供的两项独立声明：任何一项都不能静默优先，同时存在也不能证明两者包含相同代码。用户必须明确选择要安装的 identity；Host 无法独立验证两者关系或发现冲突时，安装保持禁用。
-- 无法解析并重新校验不可变版本或 commit 时，安装保持禁用。
-- 最终确认必须展示精确来源记录、已锁定 package 版本或 repository commit、当前 profile 和本地代码风险提示。
+- 浏览记录还不是安装目标。当前受管路径只接受具有经过审核的 provider 验证、规范 repository backlink 和精确稳定版本的 npm 结构候选。
+- Preview 会根据权威本地与 registry 状态独立复核 npm identity、repository、integrity、runtime、lifecycle script、DSH bundle 证据和当前 profile。声明冲突或无法验证时，安装保持禁用。
+- 执行时会重新检查可变证据，并拒绝 package 或 profile 已改变的操作。
+- 最终确认展示精确来源记录、锁定的 npm package 与版本、当前 profile 和本地代码风险提示。
- 只有用户明确操作后才开始安装，并使用现有的受管当前 profile 服务。
支持一个来源只表示可以浏览它的元数据，不会授予该来源安装、更新、启用或执行插件的能力。
@@ -258,12 +260,12 @@ Adapter 可以标准化有界纯文本身份、描述、标签/分类、更新
- 生产环境中的 manifest 和目录 URL 必须使用 HTTPS。拒绝 URL credentials、fragment、非标准 scheme，以及 endpoint 自带 query 的情况。
- 校验每次 redirect，限制 redirect 次数，拒绝 HTTPS downgrade，并在每一跳重新执行全部地址检查。
- DNS 解析后阻止 loopback、private、link-local、multicast、unspecified、运营商级 NAT 和 cloud metadata 地址，并保护连接不受 DNS rebinding 影响。仅可提供明确、可见且生产 build 不存在的本地开发 override。
-- 不附带 ambient cookie、authorization header、client certificate 或 provider 提供的自定义 header。Draft v1 来源只支持公开匿名访问。
+- 不附带 ambient cookie、authorization header、client certificate 或 provider 提供的自定义 header。公开 v1 标准来源只支持匿名访问。
- 设置 connect、first-byte 和 total deadline，并支持 `AbortSignal` 取消。
- 限制压缩后与解压后 response 大小、条目数量、分页深度、字符串、数组和 URL 长度。限制值必须是有测试的常量；数据字段以 schema maximum 为准。
- 目录 response 必须使用 JSON media type，只解码一次，校验后才能缓存。目录 loader 绝不跟随数据中发现的 URL；只有明确的 Host 媒体解析器可以在独立图片限制下处理已校验 provider-page `media.icon.url`。
-当前 Draft v1 的运行时预算属于 provider contract，而不只是实现提示：
+公开 v1 的运行时预算属于 provider contract，而不只是实现提示：
| 边界 | Body 与 redirect 预算 | Deadline | 其他规则 |
| --- | --- | --- | --- |
@@ -292,7 +294,7 @@ Host 只为当前已选来源执行目录 I/O。图标 asset service 同时最
## 版本与 schema 权威性
-草案 schema 使用 JSON Schema Draft 2020-12：
+公开 v1 Schema 使用 JSON Schema Draft 2020-12：
- [`catalog-source.schema.json`](schemas/catalog-source.schema.json) 是来源 manifest 的权威定义。
- [`catalog-query.schema.json`](schemas/catalog-query.schema.json) 是标准化 query object 和参数边界的权威定义。
@@ -301,11 +303,11 @@ Host 只为当前已选来源执行目录 I/O。图标 asset service 同时最
实现必须在启用 Draft 2020-12 format assertion 的情况下编译这些 schema，并完整校验 URI、date-time 和 UUID format。这里的 `format` 是校验要求，不是只用于说明的 annotation。字段间关系仍需语义校验，例如 `defaultLimit <= maxLimit`，以及宣告支持 `sort` 时 `sorts` 不得为空。
-### 可复制的草案 fixture
+### 可复制的 v1 fixture
-实现团队可以直接从对应的[最小来源 manifest](examples/catalog-source.example.json)、[最小 query](examples/catalog-query.example.json)、[最小 provider page](examples/catalog-provider-page.minimal.example.json)、带可选媒体的完整 [provider page](examples/catalog-provider-page.example.json) 和[标准化 snapshot](examples/catalog-snapshot.example.json) fixture 开始编写契约测试。它们只是示例：来源 fixture 不是内置或已选择的 provider，这些文件也都不是 runtime configuration。
+Provider 与 adapter 作者可以直接使用对应的[最小来源 manifest](examples/catalog-source.example.json)、[最小 query](examples/catalog-query.example.json)、[最小 provider page](examples/catalog-provider-page.minimal.example.json)、带可选媒体的完整 [provider page](examples/catalog-provider-page.example.json) 和[标准化 snapshot](examples/catalog-snapshot.example.json) fixture 编写兼容性测试。它们只是示例：来源 fixture 不是内置或已选择的 provider，这些文件也都不是 runtime configuration。
-`manifestVersion` 和 response `schemaVersion` 对本契约进行版本管理，不代表 DSH、Desktop、Market package、provider 或插件版本。在草案完成审核并标记 stable 之前，四个 schema 都是临时定义，不能宣传成已经实现的兼容承诺。
+`manifestVersion` 和 response `schemaVersion` 对本契约进行版本管理，不代表 DSH、Desktop、Market package、provider 或插件版本。已发布的 `1.x` Schema 是当前已实现的兼容性边界。兼容性的新增必须同时经过评审、fixture、生成类型和契约测试；不兼容变更必须使用新的 major version。
实现必须拒绝不支持的 major version。所有契约修改都需要连同 schema fixture 和兼容性测试一起评审；不允许在某个 provider adapter 中临时放宽校验。
@@ -320,50 +322,52 @@ Host 只为当前已选来源执行目录 I/O。图标 asset service 同时最
7. 在有界有效期内复用完成的索引；明确刷新会使其失效，并绕过目录 HTTP cache 后重新扫描。
8. 已选来源变化、清空选择、plugin generation 被 dispose 或 DSH 关闭时，取消自己拥有的请求并重置会话。
-## 实现交接清单
+## 已实现的 v1 清单
+
+当前 package 已实现并测试以下全部能力。
### 契约与类型
-- [ ] 一起评审并冻结四个 draft schema；生成或维护对应 TypeScript 类型。
-- [ ] 为每个 schema 添加正向和反向 JSON fixture。
-- [ ] 实现 JSON Schema 无法表达的语义校验，包括 endpoint path、provider page 条目 ID 唯一性、`provenance.itemId` 一致性、source record/provenance 一致性、source record 唯一性、query limit 关系、package/repository 冲突处理、repository 规范化和 cursor 归属。
-- [ ] 在至少一个标准来源和一个 provider 私有 adapter 通过同一套契约测试前，provider adapter 类型保持内部使用。
+- [x] 同时发布四份 v1 Schema，并生成对应 TypeScript 类型。
+- [x] 为每份 Schema 维护正向与反向 JSON fixture。
+- [x] 执行 JSON Schema 无法单独表达的 endpoint、identity、provenance、query limit、repository 和 cursor 跨字段语义校验。
+- [x] Adapter 类型保持本地使用，标准来源、DSH 1024Store 与 dshfind 通过同一标准化契约。
### 来源 registry 与 UI
-- [ ] 持久化用户拥有的来源记录，包括 Host 生成 UUID、adapter identity、manifest URL 或内置 provider ID 与 registration kind；另行持久化一个 provider 无法控制的本地已选来源标记。
-- [ ] 实现添加、检查、选择、切换、重试和删除操作。
-- [ ] 首次交付时不预选任何来源，并实现明确的零来源状态。
-- [ ] 选择前展示来源声明与 endpoint host，并在每个结果、详情和安装界面继续展示。
-- [ ] 明确展示当前已选来源的错误；不能自动替换失败来源，也不能自动选择其他来源。
+- [x] 持久化用户拥有的来源记录，以及 provider 无法控制的一条本地选择标记。
+- [x] 提供添加、检查、选择、切换、重试、排序和删除操作。
+- [x] 首次启动不预选来源，并显示明确的来源选择状态。
+- [x] 在来源管理中展示来源声明、endpoint host、adapter 类型和最近结果，并在目录与安装界面保留 provenance。
+- [x] 让失败归属于当前已选来源，不自动替换或兜底。
### 请求与单一已选来源会话
-- [ ] 实现一个由标准 adapter 和内置 provider adapter 共用的受限 HTTP client。
-- [ ] 实现标准 GET `/v1/plugins` adapter 和精确 query 序列化。
-- [ ] 把经审核的 DSH 1024Store adapter 实现为一个可选来源。
-- [ ] 增加已选来源的 abort/timeout/完整索引 cache 和强制刷新；标准来源网络 page 按有效请求值或默认值执行限制，Schema 上限 100，可见结果使用每页最多 50 条的本地分页。
-- [ ] 适用时先校验 provider 原始数据，再做 normalization；之后对每个标准化 snapshot 再次校验。
-- [ ] 在完整扫描、本地搜索、分组、分页、缓存、详情和安装确认中始终保留 provenance。
+- [x] 标准 adapter 与受审 provider adapter 共用一个受限 HTTP client。
+- [x] 实现标准 GET `/v1/plugins`、精确 query 序列化、完整 cursor 扫描和本地完整索引。
+- [x] 提供经过审核的可选 DSH 1024Store 与仅浏览 dshfind adapter。
+- [x] 实施取消、deadline、有界 cache、强制刷新、Schema 有界网络分页和每页最多 50 条的本地 UI 分页。
+- [x] 在标准化前校验不可信 wire 数据，并再次校验每份标准化 snapshot。
+- [x] 在扫描、本地筛选、分页、cache、详情和安装确认中始终保留 provenance。
### 安装交接
-- [ ] 只从标准化 identity 推导候选，永不消费远程 command。
-- [ ] 启用安装前解析并锁定精确 npm SemVer 版本或不可变 repository commit；绝不把 provider `latestVersion` 文本当作 pin。
-- [ ] 只从用户当前看见并选择的来源记录推导安装候选。
-- [ ] 调用受管安装服务前，立即重新校验所选记录和当前 profile。
-- [ ] 缺少安装能力时，目录浏览仍然完整可用。
+- [x] 只从标准化 identity 与经过审核的 provider 验证推导候选，永不消费远程 command。
+- [x] 只接纳精确稳定的 npm 候选，并在 preview 与执行时独立复核 registry identity、repository、integrity、runtime、lifecycle script 和 DSH bundle 证据。
+- [x] 把每个候选绑定到用户当前看见并选择的来源记录。
+- [x] 调用受管安装服务前重新校验所选记录、可变 package 证据和当前 profile。
+- [x] 缺少安装能力或条目只能浏览时，目录浏览仍然完整可用。
### 发布门槛
-- [ ] 在运行时入口经过审核并具有 Loader smoke test 前，`dsh-community-market` 保持 private 且不可加载。
-- [ ] 记录所有网络/数据限制，并提供安全的用户可见失败信息。
-- [ ] 完成针对用户添加 URL、redirect、DNS rebinding、renderer 文本和安装候选推导的安全审核。
-- [ ] 至少两个 wire format 独立的 provider 通过 interoperability fixture 后，才把本契约标记为 stable。
+- [x] 提供经过审核的 Host/Client runtime 入口、package export 检查和 Loader smoke test。
+- [x] 记录网络/数据限制，并返回有界的用户可见失败信息。
+- [x] 以 fail-closed 边界覆盖用户添加 URL、redirect、DNS pinning、renderer 文本、媒体隔离和安装候选推导。
+- [x] 通过标准来源和两个 wire 结构独立的受审 provider API 验证标准化契约。
-## 规划测试矩阵
+## 已验证测试矩阵
-下列内容是后续实现必须通过的验收测试，不表示当前已有这些测试。
+当前自动化契约、adapter、Host、Client、媒体和安装测试覆盖以下验收行为；部分行汇总同一测试套件中的多项断言。
| 范围 | 用例 | 预期结果 |
| --- | --- | --- |
@@ -403,10 +407,10 @@ Host 只为当前已选来源执行目录 I/O。图标 asset service 同时最
| 安全 | 来源尝试使用 cookie、auth、自定义 header 或远程 adapter 代码 | 该能力不存在，输入被拒绝 |
| 生命周期 | 请求中切换/清空选择或 dispose Host | Fetch abort，释放资源，适用时重置会话，迟到结果不能修改状态 |
| 安装 | Snapshot 包含 command-like string，或 URL query 被构造成命令 | 无法进入受管安装操作 |
-| 安装 | npm 版本或 repository revision 缺失、可变、非法，或在重新校验期间改变 | 安装保持禁用；不启动 package 操作 |
-| 安装 | 一个记录同时声明 npm package 与 repository，但二者关系未验证或互相冲突 | 任何 identity 都不能隐式胜出；安装保持禁用 |
+| 安装 | 精确稳定 npm 版本或经过审核的 provider 验证缺失、非法，或在重新校验期间改变 | 安装保持禁用；不启动 package 操作 |
+| 安装 | 目录 repository 与权威 npm package repository 的关系未验证或互相冲突 | 安装保持禁用；任何目录 claim 都不能压过权威复核 |
| 安装 | 用户选择当前来源中的一个条目 | 执行前确认展示精确来源、identity 和当前 profile |
-## 开放的实现细节
+## 版本化扩展点
-实现团队可以在评审中提出具体 cache TTL、字节/条目预算、locale fallback 行为和 UI 布局。这些选择必须记录并测试；如果不先修订本契约，不得弱化“同时最多一个已选来源”、用户明确选择、无默认、无兜底、strict validation、provenance 或远程数据不可执行等规则。
+兼容的 v1 修订可以连同测试一起细化已经记录的 cache TTL、字节/条目预算、locale fallback 行为和 UI 布局，但不得弱化“同时最多一个已选来源”、用户明确选择、无默认、无兜底、strict validation、provenance 或远程数据不可执行等规则；改变这些边界必须经过契约修订评审。
diff --git a/dsh-community-market/docs/install-and-uninstall.i18n.yaml b/dsh-community-market/docs/install-and-uninstall.i18n.yaml
index 60449fed2f..a2d8de7b76 100644
--- a/dsh-community-market/docs/install-and-uninstall.i18n.yaml
+++ b/dsh-community-market/docs/install-and-uninstall.i18n.yaml
@@ -1,4 +1,4 @@
# Bilingual-pair consistency record. Both languages carry equal authority.
# Update both files and record their Git blob hashes after editing either side.
-install-and-uninstall.md: 4c96cecad3fb344f818a69721d0a35c86abf3fb5
-install-and-uninstall.zh.md: 1d923c31d20e719cd385ef8aa1105edb0c0d98ca
+install-and-uninstall.md: 47082e1aa980ae260bf09c88be144c37556097df
+install-and-uninstall.zh.md: fe57f40abc8ecd0e87b65ca5b8fb760b68428c6b
diff --git a/dsh-community-market/docs/install-and-uninstall.md b/dsh-community-market/docs/install-and-uninstall.md
index 4c96cecad3..47082e1aa9 100644
--- a/dsh-community-market/docs/install-and-uninstall.md
+++ b/dsh-community-market/docs/install-and-uninstall.md
@@ -2,7 +2,7 @@
[中文](install-and-uninstall.zh.md)
-Status: implemented for private Desktop integration testing; not a plugin security review
+Status: delivered and built into DSH Desktop; this does not constitute a plugin security review
This guide explains what users see and the boundary developers must preserve. The current Market installs only a narrow class of exact npm packages into the active DSH Desktop profile. It does not install from GitHub or run a command supplied by a catalog. For plugins installed elsewhere, it can only persist a Desktop-owned enabled/disabled loading choice; it never claims uninstall ownership.
@@ -35,7 +35,7 @@ The **Installable** label means only “this listing is a local structural candi
## What the Host accepts
-The current MVP supports only an npm package when all of these checks succeed. The first structural check is local; the remaining authoritative package checks run during preview for the selected item and are repeated where mutable during execution:
+The built-in managed installation boundary supports only an npm package when all of these checks succeed. The first structural check is local; the remaining authoritative package checks run during preview for the selected item and are repeated where mutable during execution:
- the catalog supplies a normalized npm package name, an exact stable SemVer version, and a canonical repository identity;
- npm returns the same package name and exact version;
@@ -64,7 +64,7 @@ The next Desktop generation claims the record before profile preparation. Succes
When a Market receipt was already saved for an install that startup recovery rolls back, the Market removes that exact receipt before acknowledging and clearing the recovery record. If receipt persistence fails, the record remains pending and the cleanup is retried. The local diagnostics archive is not uploaded automatically and may contain logs, system information, and crash evidence; treat it as sensitive rather than assuming every artifact can be completely redacted.
-The current MVP rejects:
+The built-in managed installer rejects:
- GitHub URLs, Git repositories, release archives, commits, and other repository-based install targets;
- version ranges, tags such as `latest`, and prerelease versions;
@@ -84,7 +84,7 @@ A GitHub repository link may still appear as inert provenance and may be used to
4. Desktop runs the managed remove operation. The Host verifies that the package has left the profile before removing the receipt.
5. Restart DSH Desktop so the running process no longer uses the removed plugin.
-Uninstall does not need the provider to remain online and does not refetch the original listing. If a plugin has no Market receipt, belongs to another profile, or was changed after installation, this MVP refuses to remove it. That conservative behavior avoids claiming ownership of packages managed elsewhere.
+Uninstall does not need the provider to remain online and does not refetch the original listing. If a plugin has no Market receipt, belongs to another profile, or was changed after installation, the built-in Market refuses to remove it. That conservative behavior avoids claiming ownership of packages managed elsewhere.
## Disable or enable a plugin
diff --git a/dsh-community-market/docs/install-and-uninstall.zh.md b/dsh-community-market/docs/install-and-uninstall.zh.md
index 1d923c31d2..fe57f40abc 100644
--- a/dsh-community-market/docs/install-and-uninstall.zh.md
+++ b/dsh-community-market/docs/install-and-uninstall.zh.md
@@ -2,7 +2,7 @@
[English](install-and-uninstall.md)
-状态：已实现并用于 private Desktop 集成测试；不代表插件已经通过安全审核
+状态：已完成并内置于 DSH Desktop；不代表插件已经通过安全审核
本文同时说明用户会看到什么，以及开发者必须保持哪些边界。当前 Market 只会把一小类精确 npm package 安装到 DSH Desktop 的当前 profile；它不会从 GitHub 安装，也不会运行目录提供的命令。对于通过其他工具安装的插件，它只能保存 Desktop 自己拥有的启用/禁用加载选择，绝不会取得卸载所有权。
@@ -35,7 +35,7 @@
## Host 接受什么
-当前 MVP 只在以下检查全部通过时支持 npm package。第一项结构检查在本地完成；其余权威 package 检查在用户选择条目后的 preview 阶段执行，并在执行阶段按可变性再次检查：
+内置受管安装边界只在以下检查全部通过时支持 npm package。第一项结构检查在本地完成；其余权威 package 检查在用户选择条目后的 preview 阶段执行，并在执行阶段按可变性再次检查：
- 目录给出标准化 npm package 名、精确稳定的 SemVer 版本和规范仓库身份；
- npm 返回相同的 package 名和精确版本；
@@ -64,7 +64,7 @@ Add 成功后，Desktop 会封存白名单文件的结果 hash，并保留一条
如果 Market receipt 已经保存，但该安装随后被启动恢复回滚，Market 会先移除这条精确 receipt，再确认并清除恢复记录。Receipt 持久化失败时，记录会继续保持 pending，之后重试清理。本地诊断归档不会自动上传，其中可能包含日志、系统信息和 crash 证据；应把它当作敏感数据处理，不能假设每一类 artifact 都能彻底脱敏。
-当前 MVP 会拒绝：
+内置受管安装器会拒绝：
- GitHub URL、Git repository、release archive、commit，以及其他基于仓库的安装目标；
- 版本范围、`latest` 等 tag 和 prerelease 版本；
@@ -84,7 +84,7 @@ GitHub 仓库链接仍可作为不可执行的来源信息显示，也可以用
4. Desktop 执行受管 remove 操作。Host 确认 package 已离开 profile 后，才移除 receipt。
5. 重启 DSH Desktop，让当前运行的进程不再使用已移除插件。
-卸载不需要 provider 保持在线，也不会重新请求原目录条目。没有 Market receipt、属于其他 profile，或安装后已被修改的插件，当前 MVP 都会拒绝移除。这种保守行为可以避免 Market 错误接管由其他工具维护的 package。
+卸载不需要 provider 保持在线，也不会重新请求原目录条目。没有 Market receipt、属于其他 profile，或安装后已被修改的插件，内置 Market 都会拒绝移除。这种保守行为可以避免 Market 错误接管由其他工具维护的 package。
## 禁用或启用插件
diff --git a/dsh-community-market/docs/market-shell.i18n.yaml b/dsh-community-market/docs/market-shell.i18n.yaml
index e742b136df..f7b3f51de0 100644
--- a/dsh-community-market/docs/market-shell.i18n.yaml
+++ b/dsh-community-market/docs/market-shell.i18n.yaml
@@ -1,4 +1,4 @@
# Bilingual-pair consistency record. Both languages carry equal authority.
# Update both files and record their Git blob hashes after editing either side.
-market-shell.md: 8d5fd324e9af0bfb88403cf4e1ce401bd96da89a
-market-shell.zh.md: 0873d01b6e74ab098c23dc2bdf9a550454cd7c82
+market-shell.md: c4920dc75b0495e21e22942344f45ba0bc51723c
+market-shell.zh.md: faea0432bbe60515510c51f8e1c79a0f306ae8bb
diff --git a/dsh-community-market/docs/market-shell.md b/dsh-community-market/docs/market-shell.md
index 8d5fd324e9..c4920dc75b 100644
--- a/dsh-community-market/docs/market-shell.md
+++ b/dsh-community-market/docs/market-shell.md
@@ -2,9 +2,9 @@
[中文](market-shell.zh.md)
-Status: Host/Client market plus limited npm install, receipt-backed uninstall, and direct-bundle enable/disable implemented for private integration testing
+Status: delivered and built into DSH Desktop, including the Host/Client market, limited npm installation, receipt-backed uninstall, and direct-bundle enable/disable
-This document defines the first implementation boundary for `dsh-community-market`. It is deliberately narrower than a complete marketplace. The package owns an in-product shell and adapters; it does not own the community catalog, package registry, or DSH profile format.
+This document defines the delivered implementation boundary for `dsh-community-market`. It is deliberately narrower than a complete marketplace. The package owns an in-product shell and adapters; it does not own the community catalog, package registry, or DSH profile format.
## Product goals
@@ -28,7 +28,7 @@ This document defines the first implementation boundary for `dsh-community-marke
- Editing inactive profiles or migrating plugins between profiles.
- Backing up or actively rolling back `node_modules`, protecting raw `pnpm`/`npm` commands, or recovering commands run in an external system terminal.
-## Proposed boundary
+## Implemented boundary
```mermaid
flowchart LR
@@ -56,6 +56,8 @@ The Host supports two source paths:
1. A user-added source implements the published HTTPS JSON contract and is handled by the standard adapter.
2. A partner with a different API is integrated through a reviewed adapter shipped with the Market code.
+DSH Community Market openly cooperates with a wide range of plugin data sources. Anyone may publish a plugin catalog that implements the public standard contract, and any user may add and use such a source. A provider that uses a different API may propose a reviewed built-in adapter, while conforming standard sources can connect directly through the public contract.
+
A remote manifest can describe data, but cannot supply adapter code, credentials, commands, enablement, or priority. Every adapter converts its private response into the same normalized page before the renderer receives it. Source-specific fields must never become UI assumptions.
The standard adapter serializes only fields declared in the source manifest's `query.supported` list. In particular, it omits `category` for a source that does not advertise category support; unsupported fields are not emulated or broadcast to that source.
@@ -64,7 +66,7 @@ The standard adapter serializes only fields declared in the source manifest's `q
[dshfind](https://dshfind.com) is another optional cooperating source with a reviewed built-in adapter. It is not selected by default, preferred, recommended, or used as a fallback. Its listings, scores, grades, `official`/featured labels, risk labels, and installation probes remain provider claims rather than Anywhere Labs trust decisions.
-The normative draft for the implementation team is the [catalog provider contract](catalog-provider-contract.md), with machine-readable schemas for the source manifest, query, untrusted provider page, and Host-normalized response. Remote fields are display data, not executable instructions. Text is rendered as text, never as raw HTML.
+The published normative contract is the [catalog provider contract](catalog-provider-contract.md), with machine-readable schemas for the source manifest, query, untrusted provider page, and Host-normalized response. Remote fields are display data, not executable instructions. Text is rendered as text, never as raw HTML.
## Complete local index and cache
@@ -108,7 +110,7 @@ Clicking a card is an explicit request to inspect that item. The dialog opens sy
- the short-lived confirmation expiry; and
- a warning that plugins run locally with the user's permissions and that this verification is not a code audit.
-Catalog `install` fields, documentation snippets, provider commands, and arbitrary strings are discarded as execution authority and are never executed or displayed as a Host manual hint. When a normalized item carries an exact stable npm identity, the Host may separately reconstruct a bounded display-only command. That text may differ from repository documentation, is explicitly marked as not fully verified, and is never sent to a package manager or Desktop action. The dshfind adapter specifically discards `install.cmd` and never parses or forwards it. The current managed MVP rejects GitHub and other repository install targets, ranges, tags, prereleases, deprecated versions, a target manifest containing `preinstall`, `install`, `postinstall`, or `prepare`, packages incompatible with the bundled DSH `0.1.0-rc.7`/Cordis/Node.js runtime, repository mismatches, and packages without official npm SHA-512/tarball and valid DSH bundle evidence.
+Catalog `install` fields, documentation snippets, provider commands, and arbitrary strings are discarded as execution authority and are never executed or displayed as a Host manual hint. When a normalized item carries an exact stable npm identity, the Host may separately reconstruct a bounded display-only command. That text may differ from repository documentation, is explicitly marked as not fully verified, and is never sent to a package manager or Desktop action. The dshfind adapter specifically discards `install.cmd` and never parses or forwards it. The built-in managed installer rejects GitHub and other repository install targets, ranges, tags, prereleases, deprecated versions, a target manifest containing `preinstall`, `install`, `postinstall`, or `prepare`, packages incompatible with the bundled DSH `0.1.0-rc.7`/Cordis/Node.js runtime, repository mismatches, and packages without official npm SHA-512/tarball and valid DSH bundle evidence.
Preview performs the full npm registry, canonical-repository, deprecation, lifecycle-script, runtime, integrity, tarball, DSH bundle, and active-profile checks for that one package. The resulting one-shot opaque preview binds the verified facts. Immediately before the confirmed mutation, execution re-fetches or rechecks mutable registry, candidate, and profile evidence and refuses the operation if the candidate, active profile, tarball, integrity, or bundle path changed. For managed operations the renderer submits only opaque identities, never a package-manager spec or command.
@@ -135,7 +137,7 @@ The diagnostics archive remains local and may contain logs, system information,
The **Installed** view is built from the active profile's direct-bundle inventory and valid local receipts. It does not depend on the selected source, so a Market-installed plugin remains removable after its source is disabled, deleted, or offline.
-Uninstall preview accepts only a `receiptId`. The Host confirms that the receipt still exists and the active profile still contains the exact package version and DSH bundle recorded by that receipt. Execution accepts only the resulting one-shot opaque preview, invokes the managed `remove` operation, verifies removal, and then deletes the receipt. A package installed elsewhere, a receipt in another profile, or a package changed after installation is not removed by this MVP. After success the same **Restart now** / **Restart later** choice is shown.
+Uninstall preview accepts only a `receiptId`. The Host confirms that the receipt still exists and the active profile still contains the exact package version and DSH bundle recorded by that receipt. Execution accepts only the resulting one-shot opaque preview, invokes the managed `remove` operation, verifies removal, and then deletes the receipt. The built-in Market does not remove a package installed elsewhere, a receipt in another profile, or a package changed after installation. After success the same **Restart now** / **Restart later** choice is shown.
Mutable direct bundles also expose generation-scoped opaque capabilities for enable/disable. A disabled Market-managed bundle keeps its receipt-backed Uninstall action and may be enabled separately. The Host and Desktop revalidate exact bundle status, mutability, profile generation, and receipt ownership at preview and execution; the renderer never submits a package name or filesystem target.
@@ -170,15 +172,15 @@ Install receipts are stored locally and include their owning profile; only recei
Raw response bodies, filesystem paths, tokens, environment variables, and command strings are never included in user-facing errors or telemetry.
-## Delivery phases
+## Delivery status and next steps
-### Phase 0: documentation scaffold
+### Phase 0: package and trust foundation — delivered
-- Own the npm name and monorepo package boundary.
-- Record catalog attribution, trust rules, and integration decisions.
-- Keep the package private and non-loadable.
+- The npm name and monorepo package boundary are established.
+- Catalog attribution, trust rules, and integration decisions are recorded.
+- The Host/Client package is delivered as a built-in DSH Desktop implementation.
-### Phase 1: catalog market shell — implemented for integration testing
+### Phase 1: catalog market shell — delivered and built in
- Host and Client plugin entries.
- User-owned source selection, standard sources, reviewed partner adapters, and strict normalization.
@@ -186,7 +188,7 @@ Raw response bodies, filesystem paths, tokens, environment variables, and comman
- Search, categories, details, and resilient state handling.
- Headless unit tests and Loader smoke.
-### Phase 2: confirmed active-profile operations — implemented for integration testing
+### Phase 2: confirmed active-profile operations — delivered and built in
- Desktop capability detection and unavailable state.
- Exact stable npm target verification and two-step user intent.
@@ -195,13 +197,13 @@ Raw response bodies, filesystem paths, tokens, environment variables, and comman
- Receipt-backed uninstall independent of the catalog source, plus opaque enable/disable for mutable direct bundles.
- Restart guidance after a successful profile change.
-### Later work
+### Post-delivery enhancements
- Updates and release hardening.
- Stronger verification signals based on independently specified evidence.
## Attribution and independence
-The design is informed by community catalog projects including [imsai-sh/awesome-deepseek-harness-plugins](https://github.com/imsai-sh/awesome-deepseek-harness-plugins), also presented as DSH 1024Store. DSH 1024Store is a current cooperating provider, and it also publishes the separate `dsh-1024store` plugin. DSH Community Market is not a fork, repackaging, or official client of that plugin. Its application code is MIT licensed and its catalog metadata is CC0-1.0. This scaffold copies neither its code nor its artwork and bundles no catalog snapshot.
+The design is informed by community catalog projects including [imsai-sh/awesome-deepseek-harness-plugins](https://github.com/imsai-sh/awesome-deepseek-harness-plugins), also presented as DSH 1024Store. DSH 1024Store is a current cooperating provider, and it also publishes the separate `dsh-1024store` plugin. DSH Community Market is not a fork, repackaging, or official client of that plugin. Its application code is MIT licensed and its catalog metadata is CC0-1.0. The Market copies neither its code nor its artwork and bundles no catalog snapshot.
DSH Community Market is an independent Anywhere Labs project. Catalog inclusion does not imply endorsement by Anywhere Labs, DSH 1024Store, DeepSeek, or a plugin author.
diff --git a/dsh-community-market/docs/market-shell.zh.md b/dsh-community-market/docs/market-shell.zh.md
index 0873d01b6e..faea0432bb 100644
--- a/dsh-community-market/docs/market-shell.zh.md
+++ b/dsh-community-market/docs/market-shell.zh.md
@@ -2,9 +2,9 @@
[English](market-shell.md)
-状态：Host/Client 市场与有限 npm 安装、基于 receipt 的卸载及 direct-bundle 启用/禁用已实现，正在进行 private 集成测试
+状态：已完成并内置于 DSH Desktop，包括 Host/Client 市场、有限 npm 安装、基于 receipt 的卸载及 direct-bundle 启用/禁用
-本文定义 `dsh-community-market` 第一阶段的实现边界。它刻意比完整的插件市场更小：package 只负责产品内的市场壳和适配器，不负责社区目录、包 registry 或 DSH profile 格式。
+本文定义 `dsh-community-market` 已交付的实现边界。它刻意比完整的插件市场更小：package 只负责产品内的市场壳和适配器，不负责社区目录、包 registry 或 DSH profile 格式。
## 产品目标
@@ -28,7 +28,7 @@
- 修改未激活 profile，或在 profile 之间迁移插件。
- 备份或主动回滚 `node_modules`、保护直接执行的 `pnpm`/`npm` 命令，或恢复在外部系统终端运行的命令。
-## 规划边界
+## 已实现边界
```mermaid
flowchart LR
@@ -56,6 +56,8 @@ Host 支持两条来源路径：
1. 用户添加的来源实现公开 HTTPS JSON 合同，由标准适配器处理。
2. 接口不同的合作方，通过随 Market 代码发布且经过审查的适配器接入。
+DSH Community Market 以开放方式与各种插件数据源合作。任何人都可以发布实现公开标准合同的插件目录，任何用户也都可以添加和使用这样的来源。使用不同 API 的提供方可以提出经过审查的内置适配器；符合标准合同的来源则可以通过公开合同直接接入。
+
远程 manifest 可以描述数据，但不能提供适配器代码、凭据、命令、启用状态或优先级。每个适配器都必须先把私有响应转成同一套标准化页面，才能交给 renderer；来源私有字段不能变成 UI 假设。
标准 adapter 只序列化来源 manifest 的 `query.supported` 清单中声明的字段。尤其是，来源没有声明支持 `category` 时，adapter 会针对该来源省略该字段，而不是模拟该能力或把筛选广播给该来源。
@@ -64,7 +66,7 @@ Host 支持两条来源路径：
[dshfind](https://dshfind.com) 是另一个通过经审查内置 adapter 接入的可选合作来源。它不会被默认选择、优先排序、推荐或用作兜底。它的目录收录、分数、等级、`official`/精选标记、风险标记和安装探测仍是 provider claim，不是 Anywhere Labs 作出的信任判断。
-面向实现团队的规范是[目录提供方合同](catalog-provider-contract.zh.md)，其中包含来源 manifest、query、不可信 provider page 和 Host 标准化响应的机器可读 Schema。远程字段只是展示数据，不是可执行指令；文本只能按文本渲染，不能作为原始 HTML。
+已发布的规范合同是[目录提供方合同](catalog-provider-contract.zh.md)，其中包含来源 manifest、query、不可信 provider page 和 Host 标准化响应的机器可读 Schema。远程字段只是展示数据，不是可执行指令；文本只能按文本渲染，不能作为原始 HTML。
## 完整本地索引与 cache
@@ -108,7 +110,7 @@ Market 界面包含四个视图：
- 短时确认的过期时间；以及
- 插件会以用户权限作为本地代码运行、而且该复核不等于代码审计的提示。
-目录中的 `install` 字段、文档命令、provider 命令和任意字符串都会失去执行授权，绝不会被执行，也不会作为 Host 手动提示展示。当标准化条目具有精确稳定的 npm 身份时，Host 可以另行重建一条有界、只用于展示的命令。该文本可能与仓库文档中的命令不同，会明确标为未完成全部验证，而且绝不会发送给 package manager 或 Desktop action。dshfind adapter 会明确丢弃 `install.cmd`，绝不解析或转发它。当前受管 MVP 会拒绝 GitHub 与其他仓库安装目标、range、tag、prerelease、deprecated 版本、目标 manifest 中包含 `preinstall`、`install`、`postinstall` 或 `prepare` 的 package、与内置 DSH `0.1.0-rc.7`/Cordis/Node.js runtime 不兼容的 package、仓库身份不匹配的 package，以及缺少官方 npm SHA-512/tarball 或有效 DSH bundle 证据的 package。
+目录中的 `install` 字段、文档命令、provider 命令和任意字符串都会失去执行授权，绝不会被执行，也不会作为 Host 手动提示展示。当标准化条目具有精确稳定的 npm 身份时，Host 可以另行重建一条有界、只用于展示的命令。该文本可能与仓库文档中的命令不同，会明确标为未完成全部验证，而且绝不会发送给 package manager 或 Desktop action。dshfind adapter 会明确丢弃 `install.cmd`，绝不解析或转发它。内置受管安装器会拒绝 GitHub 与其他仓库安装目标、range、tag、prerelease、deprecated 版本、目标 manifest 中包含 `preinstall`、`install`、`postinstall` 或 `prepare` 的 package、与内置 DSH `0.1.0-rc.7`/Cordis/Node.js runtime 不兼容的 package、仓库身份不匹配的 package，以及缺少官方 npm SHA-512/tarball 或有效 DSH bundle 证据的 package。
Preview 会针对这一个 package 完整检查 npm registry、规范仓库、deprecated 状态、lifecycle script、runtime、integrity、tarball、DSH bundle 和当前 profile，并用一次性不透明 preview 绑定已验证事实。用户确认后、真正修改前，执行阶段会立即重新获取或检查可变的 registry、候选和 profile 证据；候选、当前 profile、tarball、integrity 或 bundle 路径发生变化时会拒绝执行。受管操作中，renderer 只提交不透明身份，绝不会提交 package-manager spec 或命令。
@@ -135,7 +137,7 @@ Add 成功后，系统会在开放重启许可前封存白名单文件的结果
**已安装**视图来自当前 profile 的 direct-bundle 清单与合法本地 receipt，不依赖已选来源。因此，即使安装来源后来被禁用、删除或离线，通过 Market 安装的插件仍然可以卸载。
-卸载预览只接受 `receiptId`。Host 会确认 receipt 仍然存在，并且当前 profile 仍包含 receipt 记录的精确 package 版本和 DSH bundle。执行阶段只接受由此生成的不透明一次性 preview，调用受管 `remove` 操作，确认 package 已移除后再删除 receipt。通过其他方式安装的 package、其他 profile 的 receipt，或安装后已经发生变化的 package，当前 MVP 都不会移除。成功后同样显示**立即重启**与**稍后重启**。
+卸载预览只接受 `receiptId`。Host 会确认 receipt 仍然存在，并且当前 profile 仍包含 receipt 记录的精确 package 版本和 DSH bundle。执行阶段只接受由此生成的不透明一次性 preview，调用受管 `remove` 操作，确认 package 已移除后再删除 receipt。内置 Market 不会移除通过其他方式安装的 package、其他 profile 的 receipt，或安装后已经发生变化的 package。成功后同样显示**立即重启**与**稍后重启**。
可变 direct bundle 还会暴露 generation-scoped 不透明启用/禁用能力。已禁用的 Market 受管 bundle 会保留基于 receipt 的“卸载”，并可独立选择“启用”。Host 与 Desktop 会在 preview 和执行时重验精确 bundle 状态、可变性、profile generation 与 receipt 所有权；renderer 绝不会提交 package 名或文件系统目标。
@@ -170,15 +172,15 @@ Add 成功后，系统会在开放重启许可前封存白名单文件的结果
面向用户的错误或遥测中，不得包含原始响应 body、文件路径、token、环境变量或命令字符串。
-## 交付阶段
+## 交付状态与后续工作
-### Phase 0：文档初始化工程
+### Phase 0：package 与信任基础——已交付
-- 确认 npm 名称和 monorepo package 边界。
-- 记录目录来源、信任规则和集成决策。
-- package 保持私有且不可加载。
+- npm 名称和 monorepo package 边界已经确立。
+- 目录来源、信任规则和集成决策已经记录。
+- Host/Client package 已作为 DSH Desktop 内置实现交付。
-### Phase 1：目录市场壳——已实现并进入集成测试
+### Phase 1：目录市场壳——已交付并内置
- Host 与 Client 插件入口。
- 用户拥有的来源选择、标准来源、经审查的合作方适配器与严格标准化。
@@ -186,7 +188,7 @@ Add 成功后，系统会在开放重启许可前封存白名单文件的结果
- 搜索、分类、详情和完整状态处理。
- headless 单元测试与 Loader smoke。
-### Phase 2：确认后的当前 profile 操作——已实现并进入集成测试
+### Phase 2：确认后的当前 profile 操作——已交付并内置
- Desktop 能力检测和不可用状态。
- 精确稳定 npm 目标复核和两步用户意图。
@@ -195,13 +197,13 @@ Add 成功后，系统会在开放重启许可前封存白名单文件的结果
- 不依赖目录来源、基于 receipt 的卸载，以及针对可变 direct bundle 的不透明启用/禁用。
- profile 修改成功后的重启说明。
-### 后续工作
+### 交付后的增强
- 更新与发布加固。
- 基于独立规范证据的更强验证信号。
## 来源与独立性
-本设计参考了多个社区目录项目，其中包括 [imsai-sh/awesome-deepseek-harness-plugins](https://github.com/imsai-sh/awesome-deepseek-harness-plugins)，该项目也以 DSH 1024Store 展示。DSH 1024Store 是当前合作的提供方，并另行发布 `dsh-1024store` 插件。DSH Community Market 不是该插件的 fork、重新打包版本或官方客户端。其应用代码使用 MIT，目录元数据使用 CC0-1.0。当前初始化工程没有复制其代码或素材，也没有打包目录快照。
+本设计参考了多个社区目录项目，其中包括 [imsai-sh/awesome-deepseek-harness-plugins](https://github.com/imsai-sh/awesome-deepseek-harness-plugins)，该项目也以 DSH 1024Store 展示。DSH 1024Store 是当前合作的提供方，并另行发布 `dsh-1024store` 插件。DSH Community Market 不是该插件的 fork、重新打包版本或官方客户端。其应用代码使用 MIT，目录元数据使用 CC0-1.0。Market 没有复制其代码或素材，也没有打包目录快照。
DSH Community Market 是 Anywhere Labs 的独立项目。目录收录不表示 Anywhere Labs、DSH 1024Store、DeepSeek 或插件作者对项目作出推荐。
diff --git a/dsh-community-market/docs/schemas/catalog-provider-page.schema.json b/dsh-community-market/docs/schemas/catalog-provider-page.schema.json
index 7a6ca9d94a..c59a5c970a 100644
--- a/dsh-community-market/docs/schemas/catalog-provider-page.schema.json
+++ b/dsh-community-market/docs/schemas/catalog-provider-page.schema.json
@@ -81,7 +81,7 @@
},
"media": {
"type": "object",
- "description": "Optional provider-declared plugin media. In draft v1, only a direct plugin icon is standardized.",
+ "description": "Optional provider-declared plugin media. In v1, only a direct plugin icon is standardized.",
"additionalProperties": false,
"required": [
"icon"
diff --git a/dsh-community-market/docs/schemas/catalog-snapshot.schema.json b/dsh-community-market/docs/schemas/catalog-snapshot.schema.json
index d773b82747..2d6d734696 100644
--- a/dsh-community-market/docs/schemas/catalog-snapshot.schema.json
+++ b/dsh-community-market/docs/schemas/catalog-snapshot.schema.json
@@ -101,7 +101,7 @@
},
"media": {
"type": "object",
- "description": "Optional Host-resolved plugin media. Draft v1 standardizes only the icon slot.",
+ "description": "Optional Host-resolved plugin media. Version 1 standardizes only the icon slot.",
"additionalProperties": false,
"required": [
"icon"
diff --git a/dsh-community-market/scripts/verify-docs.mjs b/dsh-community-market/scripts/verify-docs.mjs
index 215a5f90b8..de9a962bb3 100644
--- a/dsh-community-market/scripts/verify-docs.mjs
+++ b/dsh-community-market/scripts/verify-docs.mjs
@@ -18,7 +18,9 @@ const readJson = path => {
const manifest = JSON.parse(read('package.json'))
if (manifest.name !== 'dsh-community-market') fail('package name must remain dsh-community-market')
-if (manifest.private !== true) fail('the market must stay private until the release gate is approved')
+if (manifest.private !== true) {
+ fail('the built-in Market workspace package must stay private to prevent unsupported standalone publication')
+}
if (manifest.main !== 'lib/index.js' || manifest.types !== 'lib/index.d.ts') {
fail('runtime package must expose the reviewed Host entry and declarations')
}
diff --git a/dsh-community-market/src/contracts/generated/catalog-provider-page.ts b/dsh-community-market/src/contracts/generated/catalog-provider-page.ts
index 8509345296..5db5c297ab 100644
--- a/dsh-community-market/src/contracts/generated/catalog-provider-page.ts
+++ b/dsh-community-market/src/contracts/generated/catalog-provider-page.ts
@@ -70,7 +70,7 @@ export interface Publisher {
url?: HttpsUri
}
/**
- * Optional provider-declared plugin media. In draft v1, only a direct plugin icon is standardized.
+ * Optional provider-declared plugin media. In v1, only a direct plugin icon is standardized.
*/
export interface Media {
icon: RemoteIconCandidate
diff --git a/dsh-community-market/src/contracts/generated/catalog-snapshot.ts b/dsh-community-market/src/contracts/generated/catalog-snapshot.ts
index 2b79754224..ba9e68265e 100644
--- a/dsh-community-market/src/contracts/generated/catalog-snapshot.ts
+++ b/dsh-community-market/src/contracts/generated/catalog-snapshot.ts
@@ -89,7 +89,7 @@ export interface Publisher {
url?: HttpsUri
}
/**
- * Optional Host-resolved plugin media. Draft v1 standardizes only the icon slot.
+ * Optional Host-resolved plugin media. Version 1 standardizes only the icon slot.
*/
export interface Media {
icon: ResolvedIcon
|
