docs: require open-source marketplace plugins

README.md

@@ -169,7 +169,7 @@ Welcome to the EdgeEver community. Join us to discuss the EdgeEver experience, r
 
 ## Plugins and Themes
 
-EdgeEver supports device-local plugins and code-free themes on Web and desktop, installable from the Plugin Marketplace, GitHub, or a Manifest URL. Developers can use `@edgeever/plugin-api`; see the [plugin development guide](docs/plugin-development.md).
+EdgeEver supports device-local plugins and code-free themes on Web and desktop, installable from the Plugin Marketplace, GitHub, or a Manifest URL. The official marketplace only lists free and open-source plugins; this requirement does not apply to direct installation from GitHub or a Manifest URL. Developers can use `@edgeever/plugin-api`; see the [plugin development guide](docs/plugin-development.md) and [marketplace submission policy](docs/plugin-marketplace-policy.md).
 
 ## Tech Stack
 

README.zh-CN.md

@@ -167,7 +167,7 @@ EdgeEver 官方容器镜像托管于 GitHub Container Registry（GHCR）。部
 
 ## 插件与主题
 
-EdgeEver 的 Web 与桌面端支持安装在当前设备的插件和无代码主题，可从插件市场、GitHub 或 Manifest 地址安装。开发者可使用 `@edgeever/plugin-api`，详情参阅[插件开发文档](docs/plugin-development.zh-CN.md)。
+EdgeEver 的 Web 与桌面端支持安装在当前设备的插件和无代码主题，可从插件市场、GitHub 或 Manifest 地址安装。官方插件市场仅收录自由及开源插件，该要求不限制用户直接通过 GitHub 或 Manifest 地址安装其他插件。开发者可使用 `@edgeever/plugin-api`，详情参阅[插件开发文档](docs/plugin-development.zh-CN.md)和[官方插件市场上架政策](docs/plugin-marketplace-policy.zh-CN.md)。
 
 ## 技术栈
 

docs/plugin-development.md

@@ -56,6 +56,8 @@ Only public GitHub repositories are supported for now; private-repository tokens
 
 ## Verified plugin marketplace
 
+The official marketplace only lists free and open-source plugins. Complete human-readable source, an accepted open-source license, build information, and a traceable public source revision are required for every listed version. This requirement applies only to official marketplace admission; users remain free to install other plugins from GitHub or a Manifest URL. See the [Plugin Marketplace Submission Policy](plugin-marketplace-policy.md) for the complete requirements.
+
 The marketplace is a verified Registry and does not take ownership of plugin files. For each version, the Registry pins the plugin ID, GitHub repository, version, and SHA-256 hashes for `manifest.json`, `main.js`, and optional `styles.css`. Installation still downloads from the developer's GitHub Release or registered public URL and verifies those hashes again.
 
 Registry format:

docs/plugin-development.zh-CN.md

@@ -56,6 +56,8 @@ https://github.com/owner/edgeever-plugin
 
 ## 已验证插件市场
 
+官方插件市场仅收录自由及开源插件。每个上架版本都必须提供完整且人类可读的源码、认可的开源许可证、构建信息，以及可追溯的公开源码版本。该要求仅适用于官方市场准入；用户仍可自由通过 GitHub 或 Manifest 地址安装其他插件。完整要求参阅[官方插件市场上架政策](plugin-marketplace-policy.zh-CN.md)。
+
 插件市场是一个经过校验的 Registry，不接管插件所有权。Registry 为每个版本固定插件 ID、GitHub 仓库、版本号及 `manifest.json`/`main.js`/`styles.css` 的 SHA-256；安装时仍从开发者的 GitHub Release 或登记的公开地址下载，并再次核对校验和。
 
 Registry 格式：

docs/plugin-marketplace-policy.md

@@ -0,0 +1,25 @@
+# EdgeEver Plugin Marketplace Submission Policy
+
+[简体中文](plugin-marketplace-policy.zh-CN.md)
+
+The official EdgeEver Plugin Marketplace only lists free and open-source plugins. This policy applies to admission to and continued distribution through the official marketplace. It does not restrict users from installing other plugins directly from GitHub or a Manifest URL.
+
+## Open-source requirements
+
+For every marketplace version, a plugin developer must:
+
+- Host the complete source code executed in the EdgeEver client in a publicly accessible repository that does not require an account or special permission to view.
+- Include an OSI-approved open-source license that permits use, inspection, modification, and redistribution. The developer is responsible for ensuring that the selected license is compatible with all included code and dependencies.
+- Publish the human-readable, non-obfuscated source, build configuration, and instructions reasonably necessary to produce the distributed package. Publishing only a compiled, minified, or bundled `main.js` is not sufficient.
+- Associate the marketplace version with a public, immutable Git tag or commit, and ensure that its Manifest and release assets can be traced to that source revision.
+- Identify bundled third-party code and comply with its license and source-availability requirements.
+
+Minified or bundled release assets are allowed when their corresponding source remains public and reviewable. Code that executes only on a separately hosted service is not required to be open source, but the plugin listing must clearly disclose the service dependency, data sent to it, privacy policy, and any payment requirement.
+
+Code-free themes must publish their complete Manifest and use a license that permits public use, inspection, modification, and redistribution. Any included third-party material must use compatible terms.
+
+## Continued eligibility
+
+The repository, license, source revision, and build information must remain publicly available while a version is distributed through the official marketplace. EdgeEver may reject, suspend, or remove a listing when it no longer satisfies this policy, when its release assets cannot be traced to the declared source, or when its behavior creates a security, privacy, legal, or reliability risk.
+
+Marketplace verification means that a listing has passed the applicable admission and integrity checks at the time of review. It is not a guarantee that a plugin is secure, error-free, or suitable for every user.

docs/plugin-marketplace-policy.zh-CN.md

@@ -0,0 +1,25 @@
+# EdgeEver 官方插件市场上架政策
+
+[English](plugin-marketplace-policy.md)
+
+EdgeEver 官方插件市场仅收录自由及开源插件。本政策适用于插件进入官方市场并继续通过官方市场分发，不限制用户直接通过 GitHub 或 Manifest 地址安装其他插件。
+
+## 开源要求
+
+对于提交到市场的每个版本，插件开发者必须：
+
+- 将 EdgeEver 客户端中执行的完整源码托管在公众无需账号或特别权限即可查看的公开仓库中。
+- 提供 OSI 认可的开源许可证，允许使用、审查、修改和再分发。开发者负责确保所选许可证与插件包含的全部代码及依赖兼容。
+- 公开人类可读且未经混淆的源码、构建配置，以及能够合理生成分发包的构建说明。只公开编译、压缩或打包后的 `main.js` 不符合要求。
+- 让市场版本对应一个公开且不可变的 Git Tag 或 Commit，并确保 Manifest 和 Release 资产可以追溯到该源码版本。
+- 标明打包到插件中的第三方代码，并遵守相应的许可证及源码提供要求。
+
+在对应源码保持公开且可审查的前提下，可以分发压缩或打包后的资产。仅在独立托管服务中执行的代码无需开源，但插件详情必须明确披露对该服务的依赖、发送的数据、隐私政策及任何付费要求。
+
+无代码主题必须公开完整 Manifest，并使用允许公众使用、审查、修改和再分发的许可证；其中包含的第三方材料也必须采用兼容条款。
+
+## 持续上架资格
+
+只要某个版本仍通过官方市场分发，其仓库、许可证、对应源码版本和构建信息就必须持续公开。如果插件不再满足本政策、发布资产无法追溯到声明的源码，或者其行为带来安全、隐私、法律或可靠性风险，EdgeEver 可以拒绝上架、暂停分发或下架该插件。
+
+市场“已验证”仅表示插件在审核时通过了适用的准入与完整性检查，不代表 EdgeEver 保证插件绝对安全、没有错误或适合所有用户。