v0.5.0

[xiaxi626]

The web panel ships end-to-end. Since v0.4.0 this adds the full Settings →
Skills Nexus panel (Phases 0-5), the export / import / adopt channels on both
CLI and panel, retires zip as an install method, and hardens git input validation.

✨ Features

• Web panel — manage skill repositories from the DSH Settings UI: add by git
  url, toggle on/off, update, pin/switch versions. Discovery stays with the
  official filesystem provider; the panel only manages the clones and their symlinks.
  Requires the optional @deepseek-ai/dsh-host-webserver peer.
• export / import / adopt — a portable package carries each entry's source
  label; import rebuilds entries from a package (preferring the label's remote),
  adopt attaches a git source to a source-less entry with full rollback. All three
  are exposed on the panel too (package channel: import preview + adopt inline).
• Add form field coverage — the panel's add form now offers the CLI's optional
  name / ref / subdir channels; the registered name follows the CLI's
  name ?? subdir-leaf ?? repo-base chain, while the clone directory never follows
  a name override.

🐛 Fixes

• Stale links pruned on update — both CLI and panel rebuild symlinks after
  discarding links that point into the entry's own clone (a renamed multi-skill
  collection no longer leaves orphan links behind).
• remove unified — CLI and plugin share one name-based removal core.
• Panel export errors are readable — an empty manifest now shows the server's
  message instead of a bare 400 export-failed.
• Plugin install channel — the host-webserver peer range was widened so
  dsh plugin add resolves prerelease versions (was a pnpm dead-end).

⚙️ Changed

• Zip retired as an install method — "can this be updated" is decided by
  hasGitSource, not source === 'zip'.
• disable deletes by link-target attribution — no longer depends on the clone
  being intact (fixes a silent false-success when the clone is missing).
• Shared install core — the panel's add path and the CLI both run through
  src/install.ts; CLI output is byte-for-byte unchanged.

🔒 Security

• Repo spec / ref / --subdir inputs reject git option injection (leading -),
  transport::address helper syntax (e.g. ext::) and control characters; URL
  schemes are whitelisted (https/http/ssh/git/file).

⬆️ Install / Upgrade

• New: dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus", then
  restart the profile once.
• Upgrade nexus itself: dsh plugin --profile web remove dsh-skills-nexus then
  re-add (pulls latest master). Already-registered skills are untouched; refresh
  them with dsh-skills-nexus update.

---

dsh-skills-nexus v0.5.0（中文）

Web 面板端到端落地。自 v0.4.0 起，本次交付完整的 Settings → Skills Nexus 面板
（Phase 0-5）、CLI 与面板两侧的 export / import / adopt 通道，退役 zip 安装方式，
并加固 git 输入校验。

✨ 新增

• Web 面板：在 DSH 设置界面管理技能仓库——按 git url 添加、开关、更新、
  锁定 / 切换版本。技能发现仍由官方 filesystem provider 负责，面板只管克隆目录
  及其符号链接。需可选的 @deepseek-ai/dsh-host-webserver peer。
• export / import / adopt：可移植包携带每条目的来源标签；import 从包
  重建条目（优先按标签恢复远端），adopt 给"无 git 源"条目补身份并整体回滚。
  三者同样在面板暴露（package 通道：import 预览 + 条目行内 adopt）。
• add 表单字段补齐：面板 add 表单提供 CLI 已有的 name / ref / subdir
  可选参数；注册名沿用 CLI 的 name ?? subdir 末段 ?? 仓库名 链，克隆目录不跟随
  名字覆盖。

🐛 修复

• update 清理旧链接：CLI 与面板重建符号链接前，先删除指向本条目克隆的旧链接
  （重命名的多技能集合不再残留孤儿链接）。
• remove 统一：CLI 与插件共用一套按名字的删除核心。
• 面板 export 错误可读：空 manifest 现在展示服务端人话消息，而非裸码
  400 export-failed。
• 插件安装渠道：放宽 host-webserver peer 范围，使 dsh plugin add 能解析
  预发布版本（此前是 pnpm 的死路）。

⚙️ 变更

• 退役 zip 安装方式："能否更新"由 hasGitSource 判定，而非 source === 'zip'。
• disable 按链接目标归属删除：不再依赖克隆完好（修复克隆缺失时的静默假成功）。
• 共享安装核心：面板 add 路径与 CLI 都走 src/install.ts；CLI 输出逐字不变。

🔒 安全

• repo spec / ref / --subdir 输入拒绝 git 选项注入（前导 -）、
  transport::address 辅助器语法（如 ext::）与控制字符；URL scheme 白名单
  （https/http/ssh/git/file）。

⬆️ 安装 / 升级

• 新装：dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus"，随后
  重启一次 profile。
• 升级 nexus 本体：dsh plugin --profile web remove dsh-skills-nexus 后重新
  add（拉取最新 master）；已注册技能不受影响，用 dsh-skills-nexus update 单独刷新。

---

This discussion was created from the release v0.5.0.