v0.8.0

This release turns link into a real source registry: eighteen new external sources on top of trae-cn — nineteen in total — each with its own discovery function behind one generic --source-dir override, all exposed in the panel. It also narrows trae-cn to skills/ only, fixes editor TypeScript resolution for src/client, and hardens the shell-completion test harness.

✨ Features

• Generic link source registry: a SOURCE_CONFIGS table pairs every source with its environment variable, default root and discovery function, replacing the hardcoded Trae path list. --source-dir <path> overrides the selected source root for every source (the legacy --trae-cn-dir stays as an alias); the override is threaded through POST /skills-nexus/link (sourceDir), the panel's root-directory input and the browser client, and all four shell completion templates offer it.
• trae (international): ~/.trae/skills/, overridable with TRAE_DIR.
• qoder: user-level skills/ plus marketplace plugins — reads plugins/installed_plugins_v2.json, resolves each plugin's skill directories from its plugin.json (falling back to ./skills/), and excludes the qoder-bundler publisher that ships with the client.
• qoder-cn: the same layout under ~/.qoder-cn, reusing one discovery function instead of a second copy of the layout knowledge.
• codebuddy / workbuddy: plain <root>/skills/ scanning.
• Thirteen further sources: copilot ~/.copilot, claude-code ~/.claude, pi ~/.pi/agent, codex ~/.codex, cursor ~/.cursor, shared ~/.agents, opencode ~/.config/opencode, gemini ~/.gemini, zcode ~/.zcode, openclaw ~/.openclaw, augment ~/.augment, kimi-code ~/.kimi-code, windsurf ~/.codeium/windsurf. What they share is the discovery contract — one level of <root>/skills/, no recursion, no flat SKILL.md, no plugin manifest, no version layer — not the nature of their roots: client home, config root, agent directory, state dir, a subdirectory of a data root, a cross-tool shared root, a legacy personal location and a nested vendor path all appear here. Six reuse the client's own official variable (COPILOT_HOME, CLAUDE_CONFIG_DIR, PI_CODING_AGENT_DIR, CODEX_HOME, OPENCODE_CONFIG_DIR, OPENCLAW_STATE_DIR); the other seven take a Nexus-side *_DIR. SUPPORTED_SOURCES is now 19.
• Boundary rules kept explicit: ~/.agents is registered once as shared; compatibility directories (~/.agents, ~/.claude, ~/.codex) are never merged into a vendor source, so one physical directory never becomes several entries. KIMI_CODE_HOME and GEMINI_CLI_HOME are deliberately not scan roots — they replace the client's data root or home, not the Nexus scan root.
• Panel: twenty source buttons, nineteen enabled, Antigravity the only disabled placeholder (its global skill directory differs between the app, CLI and IDE builds, so the contract stays open). Trae and every enabled source preview through source-aware link calls.

🐛 Fixes

• link trae-cn scans skills/ only: ~/.trae-cn/builtin_skills/ is no longer discovered — silently, by design. Existing entries remain removable with remove --group trae-cn/builtin_skills --yes.
• Editor TypeScript resolution: src/client/tsconfig.json gives the panel its own project file, so TS Server stops falling back to the root tsconfig.json and reporting TS2307 / TS7016 on panel.tsx and the panel render test.
• Shell-completion test harness: an abnormal child death (NTSTATUS exit, signal, or null status) is now distinguished from a genuinely broken template and retried once, so a flaky runner no longer turns a green matrix red with an empty error message.
• Windows fixture teardown: temporary trees are removed through a retrying helper, so a transient EBUSY can no longer fail an unrelated suite.

⚙️ Changed

• Test coverage: 836 tests · 833 pass · 3 skip (up from 754 in v0.7.0). The three skips are the real bash / zsh / fish completion runs.
• Docs: bilingual README / ARCHITECTURE / sources-and-packages / verify-link-sources updated — the source table now lists all nineteen, the verification guide gained an eighth checkpoint (PASS agent clients), and every new group has an uninstall line.
• Uninstall: dsh-skills-nexus remove --group <source> --yes removes only the symlinks and manifest entries; the linked source directories are never touched.
• README: capability overview and external-source tables, an npm-downloads badge, and the registry install note now points at "the latest published npm release" instead of a hardcoded version number.
• Verification: typecheck, lint, the full 836-test suite, both build steps with no lib/ drift, and all eight bash blocks of both verification guides pass locally. The thirteen new roots follow each client's official documentation; they were not exercised against installed clients on this machine.

⬆️ Install / Upgrade

• New: dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus", then restart once.
• Upgrade: dsh plugin --profile web remove dsh-skills-nexus then re-add. Already-registered skills are untouched; refresh with dsh-skills-nexus update.

---

本次发布把 link 变成真正的来源注册表：在 trae-cn 之外新增十八个外部来源，合计十九个，每个来源都有自己的发现函数，共用同一个 --source-dir 根覆盖，并在面板里全部可见。同时把 trae-cn 收窄到只扫 skills/，修复 src/client 的编辑器 TypeScript 解析，并加固补全测试工装。

✨ 新增

• 通用来源注册表：SOURCE_CONFIGS 为每个来源登记环境变量、默认根与发现函数，取代原先写死的 Trae 路径列表。--source-dir <path> 对任何来源覆盖所选根（旧参数 --trae-cn-dir 保留为别名）；覆盖规则贯通 POST /skills-nexus/link（sourceDir）、面板的根目录输入与浏览器客户端，四种 shell 补全模板均提供该参数。
• trae（国际版）：~/.trae/skills/，可用 TRAE_DIR 覆盖。
• qoder：用户级 skills/ 之外还读市场插件——解析 plugins/installed_plugins_v2.json，按插件自己的 plugin.json（缺省 ./skills/）定位技能目录，并排除随客户端下发的 qoder-bundler 发布方。
• qoder-cn：~/.qoder-cn 下布局完全相同，复用同一个发现函数，不再复制一份布局知识。
• codebuddy / workbuddy：按 <root>/skills/ 一层扫描。
• 另外十三个来源：copilot ~/.copilot、claude-code ~/.claude、pi ~/.pi/agent、codex ~/.codex、cursor ~/.cursor、shared ~/.agents、opencode ~/.config/opencode、gemini ~/.gemini、zcode ~/.zcode、openclaw ~/.openclaw、augment ~/.augment、kimi-code ~/.kimi-code、windsurf ~/.codeium/windsurf。它们共享的是发现契约——只扫 <root>/skills/ 一层、不递归、不认扁平 SKILL.md、不读插件清单、没有版本层——而根的性质并不统一：客户端 home、配置根、agent 目录、state 目录、数据根下的子目录、跨工具共享根、旧版个人位置、嵌套 vendor 路径都在其中。其中六个复用客户端自己的官方变量（COPILOT_HOME、CLAUDE_CONFIG_DIR、PI_CODING_AGENT_DIR、CODEX_HOME、OPENCODE_CONFIG_DIR、OPENCLAW_STATE_DIR），其余七个使用 Nexus 侧的 *_DIR。SUPPORTED_SOURCES 至此为十九项。
• 边界规则明确写出：~/.agents 只登记一次，来源名为 shared；兼容目录（~/.agents、~/.claude、~/.codex）一律不并入任何 vendor 来源，避免同一物理目录被注册成多条。KIMI_CODE_HOME 与 GEMINI_CLI_HOME 刻意不作为扫描根——它们替换的是客户端的数据根 / home，不是 Nexus 的扫描根。
• 面板：来源行共二十个按钮，十九个可用，Antigravity 是唯一禁用占位（它的 global 技能目录在 app / CLI / IDE 三种形态下各不相同，契约未定前不纳管）。Trae 起所有已启用来源都走「来源感知」的预览与执行。

🐛 修复

• link trae-cn 只扫 skills/：~/.trae-cn/builtin_skills/ 不再被发现，静默忽略属有意行为。存量条目仍可用 remove --group trae-cn/builtin_skills --yes 清理。
• 编辑器 TypeScript 解析：新增 src/client/tsconfig.json，让面板拥有自己的项目文件，TS Server 不再回落到根 tsconfig.json 而把 panel.tsx 与面板渲染测试报成 TS2307 / TS7016。
• 补全测试工装：把「子进程异常死亡」（NTSTATUS 退出码、被信号杀死、status 为空）与「模板真错」区分开，并立即重试一次，runner 抖动不再以一条空错误消息把全绿矩阵刷红。
• Windows 夹具清理：临时目录改走带重试的删除助手，瞬时 EBUSY 不再连累无关套件。

⚙️ 变更

• 测试覆盖：836 条 · 833 通过 · 3 跳过（v0.7.0 为 754 条）。三个跳过项是 bash / zsh / fish 补全的真 shell 实跑。
• 文档：双语 README / ARCHITECTURE / sources-and-packages / verify-link-sources 同步——来源表列全十九行，验证指南新增第八个检查点（PASS agent clients），每个新组都给出卸载命令。
• 卸载：dsh-skills-nexus remove --group <source> --yes 只删除链接与 manifest 条目，被链接的源目录全程不动。
• README：新增能力总览与外部来源表、npm 下载量徽章，registry 安装说明改为指向「最新发布版本」而不再硬编码版本号。
• 验证：typecheck、lint、836 项全量测试、两步构建（lib/ 无漂移）、两份验证指南的全部八个 bash 块在本机通过。十三个新根依据各客户端官方文档；本机未安装这些客户端，未对它们做真机链接验收。

⬆️ 安装 / 升级

• 新装：dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus"，随后重启一次。
• 升级：dsh plugin --profile web remove dsh-skills-nexus 后重新 add。已注册技能不受影响，用 dsh-skills-nexus update 刷新。

v0.7.0

This release introduces the trae-cn link channel for external skill directories, group-level batch operations across CLI/HTTP/panel, and panel UI enhancements for link management and import control.

✨ Features

• trae-cn link channel: Discover and register skills from ~/.trae-cn/skills/ and ~/.trae-cn/builtin_skills/ without cloning — creates symlinks to existing directories, registers manifest entries, and organizes them by group path. New CLI command link trae-cn with --dry-run, --json, --trae-cn-dir, --group, and --force options.
• Group operations: Batch enable/disable/remove by group path prefix. CLI toggle --group <path> and remove --group <path> with segment-exact matching (no more string prefix false matches). HTTP routes POST /toggle and POST /remove support group mode. Panel renders L1 group headers with Switch (✓/○/◐ for on/off/mixed) and remove button.
• Link area collapsible + multi-source buttons: Panel link section now uses DisclosureRow for collapse/expand, with source buttons (trae-cn enabled, others placeholder with "support planned" tooltip). State persisted independently.
• Panel import locked checkbox: "Restore exact recorded versions (locked)" checkbox in import area, equivalent to CLI import --locked. Checkbox stays sticky after successful import for batch migration scenarios.

🐛 Fixes

• tsconfig.client-types.json cross-directory imports: Added src/filter.ts and src/import-decision.ts to include — fixes IDE TypeScript errors (TS2307) for cross-directory imports in panel.tsx.
• Group matching segment precision: HTTP toggle route and panel reconcile now use segment-exact comparison instead of string prefix matching — --group trae-cn/skill no longer falsely matches trae-cn/skills/*.
• Panel group state sync: groupStates now updates immediately after group toggle reconciliation, keeping group-level Switch in sync with child entries (no more stale state until manual refresh).
• Purge failure visibility: executePurge now records failed deletions in PurgeResult.failed instead of silently catching errors. CLI human mode and JSON report both expose the failure list.

⚙️ Changed

• Test coverage: 754 tests · 751 pass · 3 skip (up from 578 in v0.6.0).
• Completions: All four shell completion templates (bash/zsh/fish/powershell) updated with link subcommand and --group flag for toggle/remove.
• README: Added DSH Compatible badge and updated description to emphasize full lifecycle management.

⬆️ Install / Upgrade

• New: dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus", then restart once.
• Upgrade: dsh plugin --profile web remove dsh-skills-nexus then re-add. Already-registered skills are untouched; refresh with dsh-skills-nexus update.

---

本次发布引入 trae-cn 外部技能目录链接通道、跨 CLI/HTTP/面板的组级批量操作，以及面板 link 管理和导入控制的 UI 增强。

✨ 新增

• trae-cn link 通道：发现并注册 ~/.trae-cn/skills/ 和 ~/.trae-cn/builtin_skills/ 中的技能，无需克隆——对已存在目录创建符号链接、注册 manifest 条目、按组路径组织。新增 CLI 命令 link trae-cn，支持 --dry-run、--json、--trae-cn-dir、--group、--force 选项。
• 组操作：按组路径前缀批量 enable/disable/remove。CLI toggle --group <path> 和 remove --group <path> 采用段级精确匹配（不再有字符串前缀误匹配）。HTTP 路由 POST /toggle 和 POST /remove 支持 group 模式。面板渲染 L1 组头及 Switch（✓/○/◐ 表示 on/off/mixed）和 remove 按钮。
• link 区可折叠 + 多来源按钮：面板 link 区块改用 DisclosureRow 实现折叠/展开，来源按钮行（trae-cn 可用，其余占位并显示 "support planned" tooltip）。状态独立持久化。
• 面板 import locked checkbox：导入区域新增"恢复精确记录版本（locked）"复选框，等效于 CLI import --locked。成功导入后复选框保持选中，方便整机迁移场景连续导入。

🐛 修复

• tsconfig.client-types.json 跨目录导入：include 新增 src/filter.ts 和 src/import-decision.ts——修复 panel.tsx 中跨目录导入的 IDE TypeScript 错误（TS2307）。
• 组匹配段级精确化：HTTP toggle 路由和面板 reconcile 改用段级精确比较而非字符串前缀匹配——--group trae-cn/skill 不再误匹配 trae-cn/skills/*。
• 面板组状态同步：组切换后 groupStates 立即更新，组级 Switch 与子条目状态保持同步（不再需要手动刷新才能看到新状态）。
• purge 失败可见性：executePurge 将失败删除记录到 PurgeResult.failed 而非静默吞掉错误。CLI 人类模式和 JSON 报告均暴露失败列表。

⚙️ 变更

• 测试覆盖：754 条 · 751 通过 · 3 跳过（v0.6.0 为 578 条）。
• 补全脚本：四种 shell 补全模板（bash/zsh/fish/powershell）同步更新 link 子命令和 toggle/remove 的 --group flag。
• README：新增 DSH Compatible 徽章，更新描述强调全生命周期管理。

⬆️ 安装 / 升级

• 新装：dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus"，随后重启一次。
• 升级：dsh plugin --profile web remove dsh-skills-nexus 后重新 add。已注册技能不受影响，用 dsh-skills-nexus update 刷新。

v0.6.0

Since 0.5.0, this rolls up a major panel UI overhaul, a complete machine-readable CLI interface, fundamental Windows junction fixes, and CI hardening across macOS/Windows/Linux.

✨ Features

• Panel UI overhaul (B0–B2): Module table aligned with host's 9-item real table; CSS Modules channel with hashed class names; full primitive migration (StateDot, Button, Tag, Switch, Input, DisclosureRow, TerminalBlock, RiskConfirmation); health check UI, search box, update count badge, coexistence notice.
• CLI machine interface (--json): Write-side machine output for list / add / update / remove / enable / disable — 51 new tests, version 1 report contract.
• OpsIO diagnostic channel: io.error 收编 all 11 command files; printHelp goes through io.emit.
• Batch operations: enable / disable now accept multiple names, symmetric with remove.
• ownership contract: managed vs external distinction for panel attribution.

🐛 Fixes

• Windows junction visibility: NTFS junctions were invisible to lstat / readlink / unlink — link attribution, disable, doctor, and list all failed. Fixed by switching to realpath + rmdir.
• Cross-platform path canonicalization: macOS /var → /private/var symlink and Windows 8.3 short-name expansion caused isLinkEntry to misidentify real directories as nexus-owned links. Fixed with safeRealPath bilateral canonical comparison (4 CI fixes).
• CSS Modules build reproducibility: lightningcss exports were unsorted, causing lib/client.js to differ byte-for-byte across builds. Fixed with keyed sorting.

⚙️ Changed

• Panel route: Host primitives + CSS Modules + --dsw-* token theme (no custom drawing).
• Link primitives: resolveLinkTarget (realpath) as the sole entry point; removeLinkEntry (rmdir first, then unlink) handles junctions correctly.
• Test coverage: 578 tests · 575 pass · 3 skip (up from 518 in 0.5.0).

⬆️ Install / Upgrade

• New: dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus", then restart once.
• Upgrade: dsh plugin --profile web remove dsh-skills-nexus then re-add. Already-registered skills are untouched; refresh with dsh-skills-nexus update.

---

自 0.5.0 以来，累积了面板 UI 大改版、完整的机器可读 CLI 接口、Windows junction 根本性修复，以及跨 macOS/Windows/Linux 的 CI 加固。

✨ 新增

• 面板 UI 大改版（B0–B2）：模块表对齐宿主九项真表；CSS Modules 通道（哈希类名）；全面原语化（StateDot / Button / Tag / Switch / Input / DisclosureRow / TerminalBlock / RiskConfirmation）；健康检查 UI、搜索框、更新计数徽标、底部共存提示。
• CLI 机器接口（--json）：list / add / update / remove / enable / disable 写侧机器输出补齐——51 条新测试，version 1 报告契约。
• OpsIO 诊断通道：io.error 收编全部 11 个命令文件；printHelp 改走 io.emit。
• 批量操作：enable / disable 接受多个名字，与 remove 对称。
• ownership 契约：managed vs external 区分，供面板归属判断。

🐛 修复

• Windows junction 可见性：NTFS junction 对 lstat / readlink / unlink 不可见——链接归属、disable、doctor、list 全部失效。改走 realpath + rmdir 修复。
• 跨平台路径规范化：macOS /var → /private/var 符号链接与 Windows 8.3 短名展开导致 isLinkEntry 把真实目录误判为 nexus 管理的链接。safeRealPath 双边规范化修复（CI 四次修复）。
• CSS Modules 构建可重现性：lightningcss 导出未排序导致 lib/client.js 每次构建字节不同。按键排序修复。

⚙️ 变更

• 面板路线：宿主原语 + CSS Modules + --dsw-* 令牌主题（不自行绘制）。
• 链接原语：resolveLinkTarget（realpath）作为唯一读入口；removeLinkEntry（先 rmdir 再 unlink）正确处理 junction。
• 测试覆盖：578 条 · 575 通过 · 3 跳过（0.5.0 为 518 条）。

⬆️ 安装 / 升级

• 新装：dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus"，随后重启一次。
• 升级：dsh plugin --profile web remove dsh-skills-nexus 后重新 add。已注册技能不受影响，用 dsh-skills-nexus update 刷新。

v0.5.0

The web panel ships end-to-end. Since v0.4.0 this adds the full Settings →
Skills Nexus panel (Phases 0-5), the export / import / adopt channels on both
CLI and panel, retires zip as an install method, and hardens git input validation.

✨ Features

• Web panel — manage skill repositories from the DSH Settings UI: add by git
  url, toggle on/off, update, pin/switch versions. Discovery stays with the
  official filesystem provider; the panel only manages the clones and their symlinks.
  Requires the optional @deepseek-ai/dsh-host-webserver peer.
• export / import / adopt — a portable package carries each entry's source
  label; import rebuilds entries from a package (preferring the label's remote),
  adopt attaches a git source to a source-less entry with full rollback. All three
  are exposed on the panel too (package channel: import preview + adopt inline).
• Add form field coverage — the panel's add form now offers the CLI's optional
  name / ref / subdir channels; the registered name follows the CLI's
  name ?? subdir-leaf ?? repo-base chain, while the clone directory never follows
  a name override.

🐛 Fixes

• Stale links pruned on update — both CLI and panel rebuild symlinks after
  discarding links that point into the entry's own clone (a renamed multi-skill
  collection no longer leaves orphan links behind).
• remove unified — CLI and plugin share one name-based removal core.
• Panel export errors are readable — an empty manifest now shows the server's
  message instead of a bare 400 export-failed.
• Plugin install channel — the host-webserver peer range was widened so
  dsh plugin add resolves prerelease versions (was a pnpm dead-end).

⚙️ Changed

• Zip retired as an install method — "can this be updated" is decided by
  hasGitSource, not source === 'zip'.
• disable deletes by link-target attribution — no longer depends on the clone
  being intact (fixes a silent false-success when the clone is missing).
• Shared install core — the panel's add path and the CLI both run through
  src/install.ts; CLI output is byte-for-byte unchanged.

🔒 Security

• Repo spec / ref / --subdir inputs reject git option injection (leading -),
  transport::address helper syntax (e.g. ext::) and control characters; URL
  schemes are whitelisted (https/http/ssh/git/file).

⬆️ Install / Upgrade

• New: dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus", then
  restart the profile once.
• Upgrade nexus itself: dsh plugin --profile web remove dsh-skills-nexus then
  re-add (pulls latest master). Already-registered skills are untouched; refresh
  them with dsh-skills-nexus update.

---

dsh-skills-nexus v0.5.0（中文）

Web 面板端到端落地。自 v0.4.0 起，本次交付完整的 Settings → Skills Nexus 面板
（Phase 0-5）、CLI 与面板两侧的 export / import / adopt 通道，退役 zip 安装方式，
并加固 git 输入校验。

✨ 新增

• Web 面板：在 DSH 设置界面管理技能仓库——按 git url 添加、开关、更新、
  锁定 / 切换版本。技能发现仍由官方 filesystem provider 负责，面板只管克隆目录
  及其符号链接。需可选的 @deepseek-ai/dsh-host-webserver peer。
• export / import / adopt：可移植包携带每条目的来源标签；import 从包
  重建条目（优先按标签恢复远端），adopt 给"无 git 源"条目补身份并整体回滚。
  三者同样在面板暴露（package 通道：import 预览 + 条目行内 adopt）。
• add 表单字段补齐：面板 add 表单提供 CLI 已有的 name / ref / subdir
  可选参数；注册名沿用 CLI 的 name ?? subdir 末段 ?? 仓库名 链，克隆目录不跟随
  名字覆盖。

🐛 修复

• update 清理旧链接：CLI 与面板重建符号链接前，先删除指向本条目克隆的旧链接
  （重命名的多技能集合不再残留孤儿链接）。
• remove 统一：CLI 与插件共用一套按名字的删除核心。
• 面板 export 错误可读：空 manifest 现在展示服务端人话消息，而非裸码
  400 export-failed。
• 插件安装渠道：放宽 host-webserver peer 范围，使 dsh plugin add 能解析
  预发布版本（此前是 pnpm 的死路）。

⚙️ 变更

• 退役 zip 安装方式："能否更新"由 hasGitSource 判定，而非 source === 'zip'。
• disable 按链接目标归属删除：不再依赖克隆完好（修复克隆缺失时的静默假成功）。
• 共享安装核心：面板 add 路径与 CLI 都走 src/install.ts；CLI 输出逐字不变。

🔒 安全

• repo spec / ref / --subdir 输入拒绝 git 选项注入（前导 -）、
  transport::address 辅助器语法（如 ext::）与控制字符；URL scheme 白名单
  （https/http/ssh/git/file）。

⬆️ 安装 / 升级

• 新装：dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus"，随后
  重启一次 profile。
• 升级 nexus 本体：dsh plugin --profile web remove dsh-skills-nexus 后重新
  add（拉取最新 master）；已注册技能不受影响，用 dsh-skills-nexus update 单独刷新。

v0.4.0

2026-09-27 | 24 commits, 18 changelog entries since v0.3.0

Highlights

• Batch operations and wildcards: add / remove accept multiple targets in one call; remove supports * / ? wildcards. When a wildcard matches multiple skills, the full deletion list is printed first and confirmation is required — non-interactive shells must pass --yes. Never a silent batch delete.
• doctor read-only full check-up: one command inspects the manifest, skill roots, symlink integrity, orphan repos / links and Git state; --updates adds a network check for pins that have fallen behind; --json provides a stable machine contract; exit codes 0 / 1 / 2 (no errors / errors / usage error).
• Shell completion quartet: completions --shell bash|zsh|fish|powershell prints completion scripts that can be evaluated directly; list --names provides the dynamic completion data source.
• --subdir standalone sparse checkout: installing a single subdirectory from a collection repo now uses a partial clone (--filter=blob:none) + cone-mode sparse-checkout, materializing only the target subdirectory; when Git does not support it, the install falls back to a full shallow clone with a visible warning; the install output checkout: sparse|full makes the actual scope explicit.
• Security hardening: a pre-release L3 deep security review found one high-severity issue (CWE-88 argument injection), fixed before release — repo specs, refs and --subdir skill roots are uniformly validated before reaching Git: option-injection shapes (leading -), transport::address helper syntax (e.g. ext::) and control characters are rejected; URL scheme allowlist (https/http/ssh/git/file); remote-declared default branch names are guarded the same way; skill-root checks do not follow symlinks.
• Progress visibility: add / update show a TTY-gated spinner and elapsed seconds during network waits; multi-target batches print [i/N] counters. All output goes to stderr and is fully silent on non-TTY (CI / pipes).

Added

• Read-only check-up command doctor [--json] [--updates] [--quiet]: six local checks plus optional network updates; --updates reports tag/commit pins as locked instead of misreporting them as behind; it never auto-fixes, and filesystem objects whose ownership cannot be confirmed are reported as warnings only, with no deletion hints.
• Shell completions: completions --shell <bash|zsh|fish|powershell>, together with list --names.
• list gains a SOURCE column: shows each entry's origin repository owner/repo (https / scp / ssh forms normalized automatically).
• add / remove multi-target batch operations; remove wildcards with a multi-match deletion guard.
• TTY-gated spinner and [i/N] batch counter (stderr only, clamped to terminal width to avoid wrap artifacts).

Changed

• --subdir installs now use standalone sparse checkout (with capability probe and fallback): existing full-clone installs are not migrated automatically (update does not retro-fit them) — reinstall to benefit; one-way exit from sparse: git -C <clone dir> sparse-checkout disable.
• An explicit --name equal to the default entry name now prints a one-time omission hint.
• README install / uninstall / local-test sections rewritten: CLI commands come from the global npm install (dsh plugin add only registers the plugin layer and does not provide shell commands); uninstall cleans the three independent artifacts item by item; the manual-fallback deletion never recurses into links.
• README install section adapted to npm 12's Git dependency policy: EALLOWGIT troubleshooting subsection and the one-shot --allow-git=all note (effective for that single invocation).
• New bilingual "Building on nexus" guide (docs/build-on-nexus.md / .zh-CN.md) plus a "For tool authors" section in the README.

Fixed

• Corrected the local-test overlay path guidance in both READMEs: unified to the relative-anchored form './lib/index.js' (fixes Cannot find module 'C:\C:\...' on dsh web --patch overlay.yml cold boot when configured per the old guidance).
• Corrected the root-file list in docs/verify-collection-support: the example repository root actually holds 3 files (added community-leaderboard.md).
• CLI --help "Accepted repo forms" now covers SSH (git@ / ssh://) and git+https:// forms, and clarifies that /tree subpaths are ignored (installing a subdirectory requires an explicit --subdir).
• Install documentation corrected: CLI commands come from the global npm install, not from dsh plugin add.

Upgrade notes

• Sparse --subdir checkout is an enhancement, not a break, for existing installs: old clones keep working; they just do not become sparse automatically.
• The input-validation hardening does not affect legitimate usage: file://, local paths, git@ / ssh:// and git+https:// all keep working as before.
• remove wildcard deletions are irreversible: interactive confirmation on multiple matches; non-interactive shells must pass --yes.

Quality & verification

• Four-step gate (typecheck / lint / test / build) all green; npm test 288 tests · 285 pass · 0 fail · 3 skip (the skips are environment-gated shell completion cases, executed for real in CI).
• Pre-release L3 deep security review: all reported issues were fixed before release; a re-scan found none.

Install / Upgrade

npm 12+ (Git dependencies need explicit allowance):

npm install -g --allow-git=all github:xiaxi626/dsh-skills-nexus

Older npm:

npm install -g github:xiaxi626/dsh-skills-nexus

Full changelog: CHANGELOG.md

---

重点

• 批量与通配符：add / remove 支持一次多个目标；remove 支持 * / ? 通配符。通配符命中多个 skill 时先打印完整待删清单并要求确认，非交互 shell 必须显式 --yes——绝不静默批量删除。
• doctor 只读全量体检：一条命令检查 manifest、技能根、符号链接完整性、孤立仓库 / 链接与 Git 状态；--updates 追加联网检查 pin 是否落后；--json 提供稳定机器契约；退出码 0 / 1 / 2（无 error / 有 error / 用法错误）。
• 命令自动补全四件套：completions --shell bash|zsh|fish|powershell 输出可直接 eval 的补全脚本；list --names 提供动态补全数据源。
• --subdir 独立稀疏检出：从集合仓库安装单个子目录改为 partial clone（--filter=blob:none）+ cone 模式 sparse-checkout，只物化目标子目录；Git 不支持时自动降级为整仓浅克隆并给出可见警告；安装输出 checkout: sparse|full 明示实际安装范围。
• 安全加固：发布前 L3 深度安全审查发现 1 条 high 级问题（CWE-88 参数注入）并已修复——对进入 Git 的 repo spec、ref 与 --subdir 技能根统一校验：拒绝选项注入形态（前导 -）、transport::address 辅助器语法（如 ext::）与控制字符；URL scheme 白名单（https/http/ssh/git/file）；远端声明的默认分支名同样设防；技能根判定不跟随符号链接。
• 进度可见性：add / update 网络等待期显示 TTY 门控的转圈与已用秒数；多目标批处理打印 [i/N] 计数。全部走 stderr，非 TTY（CI / 管道）下完全静默。

新增

• 只读体检命令 doctor [--json] [--updates] [--quiet]：六项本地检查 + 可选联网 updates；--updates 对 tag/commit pin 报 locked、不误报落后；绝不自动修复，无法确认归属的文件系统对象只报 warning、不给删除提示。
• 命令自动补全：completions --shell <bash|zsh|fish|powershell>，配套 list --names。
• list 新增 SOURCE 列：显示条目来源仓库 owner/repo（https / scp / ssh 等写法自动归一）。
• add / remove 多目标批量操作；remove 通配符与多命中删除护栏。
• TTY 门控 spinner 与 [i/N] 批量计数器（仅 stderr、按终端宽度钳制防换行残留）。

变更

• --subdir 安装改为独立稀疏检出（含能力探测与降级）：旧整仓克隆不自动迁移（update 不追溯），如需受益请卸载重装；退出稀疏的单向操作 git -C <克隆目录> sparse-checkout disable。
• 显式 --name 与默认条目名相同时打印一次省略提示。
• README 安装 / 卸载 / 本地测试章节重写：CLI 命令来自全局 npm 安装（dsh plugin add 只注册插件层、不提供 shell 命令）；卸载按三条独立产物逐项清理；兜底手动删除绝不对链接递归。
• README 安装章节适配 npm 12 Git 依赖策略：EALLOWGIT 排障小节与一次性 --allow-git=all 说明（仅本次调用生效）。
• 新增《在 nexus 之上构建》双语指南（docs/build-on-nexus.md / .zh-CN.md）与 README「给工具开发者」小节。

修复

• 修正两版 README 本地测试 overlay 路径指引：统一为相对锚定写法 './lib/index.js'（修复按旧指引配置时 dsh web --patch overlay.yml 冷启动报 Cannot find module 'C:\C:\...' 的问题）。
• 修正 docs/verify-collection-support 根文件清单：示例仓库根目录实为 3 个文件（补 community-leaderboard.md）。
• CLI --help 的「Accepted repo forms」补齐 SSH（git@ / ssh://）与 git+https:// 写法，并澄清 /tree 子路径被忽略（装子目录须显式 --subdir）。
• 安装说明纠正：CLI 命令来自全局 npm 安装，而非 dsh plugin add。

升级注意

• --subdir 稀疏检出对既有安装是增强而非破坏：旧克隆保持可用，只是不会自动变稀疏。
• 输入校验加固不影响合法用法：file://、本地路径、git@ / ssh://、git+https:// 均照常可用。
• remove 通配符删除不可逆：多命中时交互确认，非交互 shell 必须 --yes。

质量与验证

• 四步门禁（typecheck / lint / test / build）全绿；npm test 288 条 · 285 通过 · 0 失败 · 3 跳过（跳过为环境门控的 shell 补全用例，CI 中真实执行）。
• 发布前经 L3 深度安全审查：发现的问题已在发布前全部修复，复扫未再发现问题。

安装 / 升级

npm 12+（Git 依赖需显式放行）：

npm install -g --allow-git=all github:xiaxi626/dsh-skills-nexus

较旧 npm：

npm install -g github:xiaxi626/dsh-skills-nexus

完整变更记录：CHANGELOG.md

v0.3.0

First tagged release. Since the 0.2.0 architecture refactor (symlink + official
provider), this rolls up two features, several correctness fixes, and CI/docs hardening.

✨ Features

• --flag=value syntax for add's value options (--name=, --ref=, --subdir=).
  Boolean flags now reject a value (--yes=false errors instead of silently becoming true).
• Weak-network clone retry: branch/tag clones retry once with exponential backoff —
  helps flaky GitHub HTTPS access. Commit-SHA clones are not retried (deterministic failure).

🐛 Fixes

• Plugin load contract restored — fixes dsh web cold-boot crash right after
  dsh plugin add (a 0.2.0 regression). The official install channel works again.
• Atomic manifest writes (temp + rename) — an interrupted write can no longer leave an
  empty/half manifest.json that wipes the whole registry.
• ensureDescription on Windows — no longer silently fails on CRLF files or an empty
  description: key (which produced an "installed but invisible" skill).
• Multi-skill entries — list / disable / bare update no longer misreport off or no-op.
• update unblocked — a normalization-dirtied managed clone no longer blocks pull/drift-recovery.

⚙️ Changed

• Minimum Node raised 18 → 20 (engines.node >=20; Node 18 is EOL). No CLI breaking changes.
• CI matrix expanded to ubuntu/windows/macos × Node 20/22/24, with a link integration test
  covering Windows junction vs macOS/Linux symlink.
• Docs restructured (slimmed root README; architecture & contributing moved to docs/ + CONTRIBUTING).

⬆️ Install / Upgrade

• New: dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus", then restart the profile once.
• Upgrade nexus itself: dsh plugin --profile web remove dsh-skills-nexus then re-add (pulls latest master).
  Already-registered skills are untouched; refresh them with dsh-skills-nexus update.

---

dsh-skills-nexus v0.3.0（中文）

首个正式 tag 发布。自 0.2.0 架构重构（symlink + 官方 Provider）以来，累积了两个新功能、
多项正确性修复，以及 CI / 文档加固。

✨ 新增

• --flag=value 等号写法：add 的取值参数支持 --name= / --ref= / --subdir=；
  布尔 flag 带值现在会报错（--yes=false 不再静默变 true 而绕过确认）。
• 弱网克隆自动重试：分支/标签克隆失败按指数退避重试一次，缓解 GitHub HTTPS 抖动；
  commit-SHA 克隆不重试（确定性失败）。

🐛 修复

• 恢复插件装载契约：修复 dsh plugin add 后 dsh web 冷启动必崩（0.2.0 重构回归），官方安装渠道重新可用。
• manifest 原子写（temp + rename）：写入中断不再产生空/半截 manifest.json 而丢失整个注册表。
• Windows 下 ensureDescription：不再在 CRLF 文件或空值 description: 键上静默失败（此前会得到"装好却不生效"的 skill）。
• 多 skill 条目：list / disable / 裸 update 不再误报 off 或空转。
• update 解阻：被归一化弄脏的托管克隆不再阻塞 pull / 漂移恢复。

⚙️ 变更

• 最低 Node 版本 18 → 20（engines.node >=20，Node 18 已 EOL）；CLI 用法无破坏性变更。
• CI 矩阵扩展为 ubuntu/windows/macos × Node 20/22/24，新增覆盖 Windows junction 与 macOS/Linux symlink 的 link 集成测试。
• 文档分层重构（精简根 README，架构与贡献指南外移至 docs/ 与 CONTRIBUTING）。

⬆️ 安装 / 升级

• 新装：dsh plugin --profile web add "github:xiaxi626/dsh-skills-nexus"，随后重启一次 profile。
• 升级 nexus 本体：dsh plugin --profile web remove dsh-skills-nexus 后重新 add（拉取最新 master）；
  已注册技能不受影响，用 dsh-skills-nexus update 单独刷新。