feat(market): restructure as the Mayfly/DSH plugin marketplace

.github/ISSUE_TEMPLATE/submit-plugin.yml

@@ -0,0 +1,46 @@
+name: 插件收录申请 / Plugin submission
+description: Apply to list your plugin in the marketplace
+labels: [submission]
+body:
+  - type: input
+    id: package
+    attributes:
+      label: npm package or GitHub repository
+      description: The installable source, e.g. `your-package` or `https://github.com/you/your-plugin`
+    validations:
+      required: true
+  - type: input
+    id: slug
+    attributes:
+      label: Requested marketplace id
+      description: Lowercase slug, e.g. `awesome-pane` (must be unique; see registry/ for taken ids)
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: What does it do?
+      description: One or two sentences, English and Chinese if possible.
+    validations:
+      required: true
+  - type: checkboxes
+    id: surfaces
+    attributes:
+      label: Surfaces
+      options:
+        - label: Server (dsh tools/services, works in any frontend)
+        - label: Web (dsh Web client module)
+        - label: TUI (Mayfly panes/status/overlays/editor extensions)
+  - type: input
+    id: pr
+    attributes:
+      label: Manifest PR link
+      description: PR adding registry/community/<slug>.json (see registry/community/README.md)
+  - type: checkboxes
+    id: ownership
+    attributes:
+      label: Authorization
+      options:
+        - label: I own this package, or its author approved this listing (link the approval below)
+    validations:
+      required: true

.github/workflows/index-publish.yml

@@ -0,0 +1,73 @@
+name: index-publish
+
+# Rebuild dist/ whenever the registry changes, weekly to track upstream npm
+# drift, or manually. dist/ updates land through an auto-merged PR — never a
+# direct push to main.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'registry/**'
+      - 'plugins/**'
+      - 'scripts/**'
+  schedule:
+    - cron: '23 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: index-publish
+  cancel-in-progress: true
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@11.21.0 --activate
+      - name: Validate manifests
+        run: node scripts/validate-manifests.mjs
+      - name: Re-verify install sources (fails on unpublished/removed packages)
+        run: node scripts/verify-packages.mjs
+      - name: Build index
+        run: node scripts/build-index.mjs
+      - name: Open auto-merge PR when dist changed
+        id: dist_pr
+        uses: peter-evans/create-pull-request@v6
+        with:
+          title: 'chore(market): rebuild dist index'
+          commit-message: 'chore(market): rebuild dist index'
+          branch: auto/market-index
+          delete-branch: true
+          body: |
+            Automated rebuild of `dist/index.json` + `dist/catalog.json`.
+
+            - Triggered by: ${{ github.event_name }}
+            - Source commit: ${{ github.sha }}
+
+            Auto-generated by the index-publish workflow. Do not edit by hand.
+          labels: automation
+      - name: Auto-merge when checks pass
+        if: steps.dist_pr.outputs.pull-request-number != ''
+        run: gh pr merge --auto --squash "$PR"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ steps.dist_pr.outputs.pull-request-number }}
+      - name: Notify the Mayfly website
+        if: steps.dist_pr.outputs.pull-request-number != '' && env.MARKET_NOTIFY_TOKEN != ''
+        run: |
+          curl -fsS -X POST \
+            -H "Authorization: Bearer $MARKET_NOTIFY_TOKEN" \
+            -H "Accept: application/vnd.github+json" \
+            https://api.github.com/repos/Ephemeral-AI-Lab/mayfly/dispatches \
+            -d '{"event_type":"market-updated"}'
+        env:
+          MARKET_NOTIFY_TOKEN: ${{ secrets.MARKET_NOTIFY_TOKEN }}

.github/workflows/registry-validate.yml

@@ -0,0 +1,38 @@
+name: registry-validate
+
+on:
+  pull_request:
+    paths:
+      - 'registry/**'
+      - 'scripts/**'
+      - 'plugins/**'
+      - '.github/workflows/registry-validate.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@11.21.0 --activate
+      - name: Validate manifests (fast local gate)
+        run: node scripts/validate-manifests.mjs
+      - name: Validate manifests (JSON Schema via ajv)
+        run: |
+          npx --yes ajv-cli@5 validate \
+            -s registry/schema/plugin-manifest.v1.json \
+            -d 'registry/official/*.json' -d 'registry/dsh/*.json' -d 'registry/community/*.json' \
+            --spec=draft7
+      - name: Verify install sources (npm tarballs + GitHub scratch installs)
+        run: >-
+          node scripts/verify-packages.mjs
+          --github-ref "${{ github.event.pull_request.head.sha || 'main' }}"
+          --github-repo "${{ github.event.pull_request.head.repo.full_name || 'Ephemeral-AI-Lab/dsh-plugins' }}"
+      - name: Smoke-build the index
+        run: node scripts/build-index.mjs --out /tmp/dist-smoke

AGENTS.md

@@ -71,19 +71,49 @@ details.
 
 ```text
 dsh-plugins/
-├── codex-terminal/       Persistent exec_command/write_stdin tools
-├── coding-plan/          Codex and Grok subscription providers
-├── loop/                 Recurring prompts and loop UI
-├── mock/                 Deterministic model/replay testing
-├── preset-builder/       Preset configuration UI
-├── sessions/             Session discovery and messaging
-└── docs/                 Architecture, tool references, and how-to guides
+├── plugins/              Official plugin sources (independently buildable packages)
+│   ├── codex-terminal/   Persistent exec_command/write_stdin tools
+│   ├── coding-plan/      Codex and Grok subscription providers
+│   ├── loop/             Recurring prompts and loop UI
+│   ├── mock/             Deterministic model/replay testing
+│   ├── preset-builder/   Preset configuration UI
+│   ├── sessions/         Session discovery and messaging
+│   ├── sidechat/         Web workbench side-chat panel
+│   └── work-bench-ui/    Web workbench frame
+├── registry/             Marketplace manifests (see docs/market.md)
+│   ├── schema/           plugin-manifest.v1.json
+│   ├── official/         one manifest per Ephemeral AI Lab plugin
+│   ├── dsh/              DeepSeek optional plugin listings
+│   ├── community/        third-party submissions (PR-reviewed)
+│   ├── submission-template.json
+│   └── review-checklist.md
+├── scripts/              validate-manifests / verify-packages / build-index
+├── dist/                 generated index.json + catalog.json (workflow-owned)
+└── docs/                 Architecture, tool references, how-to guides, market spec
 ```
 
 Each plugin is an independently buildable package. Its `cordis.patch.yml` is
 part of the runtime contract. Treat `package.json`, the patch, source, tests,
 and generated `lib/` output as one package workflow.
 
+## Marketplace rules
+
+- Registry manifests are discovery/install metadata only; never make them a
+  runtime dependency. The manifest spec is `docs/market.md`.
+- `dist/` is generated. Never edit it by hand; the `index-publish` workflow
+  owns it through an auto-merged PR.
+- Every registry change must pass `node scripts/validate-manifests.mjs` and
+  `node scripts/verify-packages.mjs` (the latter checks npm and scratch-installs
+  GitHub sources; run with `--offline` when network access is unavailable, or
+  `--skip-install` to skip only GitHub scratch installs).
+- Official plugins install from GitHub (`github:...#main&path:plugins/<name>`)
+  because the `dsh-*` npm names are currently unpublished. Their `lib/` build
+  output is committed on purpose — git installs fetch sources, so rebuild and
+  re-commit `lib/` when releasing a plugin. Plugins without committed `lib/`
+  (none today) must not declare a GitHub source.
+- When moving or renaming a plugin directory, update the matching manifest's
+  `install.rows[].github.subdir` in the same change.
+
 ## Local plugin workflow
 
 Use absolute paths when installing a checkout into a DSH profile:
@@ -164,4 +194,3 @@ Before finishing:
 - Keep generated files only where the plugin's existing workflow expects them.
 - Report the plugin changed, commands run, reload/restart action, and any
   unresolved host-artifact or environment dependency.
-