feat: prefix manifest_id with user token hash to prevent ID collisions

server/api.py

@@ -565,6 +565,22 @@ async def api_market_upload(file: UploadFile = File(...), name: str = "", catego
             if not manifest.get('name'):
                 return {"error": "manifest.json 缺少 name"}
 
+            import hashlib, io as _io
+            user_prefix = hashlib.md5(token.encode()).hexdigest()[:6] if token else "anon"
+            manifest_id = f"{user_prefix}__{manifest['id']}"
+            manifest['id'] = manifest_id
+
+            # Rewrite zip with updated manifest.json
+            new_zip = _io.BytesIO()
+            with zipfile.ZipFile(new_zip, 'w', zipfile.ZIP_DEFLATED) as zf_out:
+                with zipfile.ZipFile(_io.BytesIO(zip_data), 'r') as zf_in:
+                    for name in zf_in.namelist():
+                        if name == 'manifest.json':
+                            zf_out.writestr(name, _json.dumps(manifest, indent=2, ensure_ascii=False))
+                        else:
+                            zf_out.writestr(name, zf_in.read(name))
+            zip_data = new_zip.getvalue()
+
             actual_name = name or manifest.get('name', file.filename.replace('.tsd', ''))
             actual_category = category or manifest.get('category', 'community')
             actual_author = author or manifest.get('author', 'Unknown')
@@ -588,7 +604,7 @@ async def api_market_upload(file: UploadFile = File(...), name: str = "", catego
                     "name": actual_name, "category": actual_category, "author": actual_author,
                     "version": actual_version, "supported_games": supported,
                     "icon": icon, "description": desc, "dashb_pending": "true",
-                    "manifest_id": manifest.get("id", ""),
+                    "manifest_id": manifest_id,
                 },
                 files={"file": (file.filename, zip_data, file.content_type)},
             )