@ai-wendao/ant 0.3.12 → 0.3.14

package/client.js

@@ -9,6 +9,7 @@ window.__ModuleLoader__.load({
     const DEVICE_ID_STORAGE_KEY = 'ant-team-device-id'
     const ANT_BUNDLE_PACKAGE_NAME = '@ai-wendao/ant'
     const ANT_API_PROTOCOL_VERSIONS = [1]
+    const PLUGIN_INSTALL_RECORD_PREFIX = 'ant-reviewed-plugin-install:'
     const fileCountFormat = new Intl.NumberFormat('zh-CN')
     const panelStyle = {
       display: 'grid', alignContent: 'start', gap: 14, padding: 18,
@@ -33,6 +34,15 @@ window.__ModuleLoader__.load({
       border: '0.5px solid var(--dsw-alias-border-l2)', borderRadius: 8,
       cursor: 'pointer',
     }
+    function ExtensionRequestNotice() {
+      return h('aside', { role: 'note', style: {
+        ...panelStyle,
+        borderColor: 'var(--dsw-alias-state-business-primary)',
+        gap: 5,
+      } },
+        h('h2', { style: { margin: 0, fontSize: 16 } }, '没有找到想用的技能或插件？'),
+        h('p', { style: mutedTextStyle }, '目录里没有想用的扩展，或插件没有安装按钮？请联系企业管理员，说明你希望完成的任务或提供扩展地址。已开放安装的技能和插件可在这里直接安装；勿自行安装未经审核的扩展。'))
+    }
     const normalizeServiceUrl = (value) => {
       let url
       try { url = new URL(value.trim()) } catch { return null }
@@ -88,22 +98,81 @@ window.__ModuleLoader__.load({
         : ''
     }
 
+    function approvedArtifactUrl(release) {
+      const expectedPath = `/api/ant-bundles/${release?.version}/package.tgz`
+      let url
+      try { url = new URL(release?.artifact_url) } catch { return null }
+      return normalizeServiceUrl(url.origin) === url.origin
+        && !url.username && !url.password && !url.search && !url.hash
+        && url.pathname === expectedPath && release?.artifact_path === expectedPath
+        && /^[a-f0-9]{64}$/u.test(release?.artifact_sha256 || '')
+        ? url.href : null
+    }
+
+    function approvedPluginArtifactUrl(plugin) {
+      if (plugin?.status !== 'published' || typeof plugin.id !== 'string'
+        || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/iu.test(plugin.id)) return null
+      const expectedPath = `/api/plugin-artifacts/${plugin.id}/package.tgz`
+      let url
+      try { url = new URL(plugin.artifact_url) } catch { return null }
+      return normalizeServiceUrl(url.origin) === url.origin
+        && !url.username && !url.password && !url.search && !url.hash
+        && url.pathname === expectedPath && plugin.artifact_path === expectedPath
+        && /^[a-f0-9]{64}$/u.test(plugin.artifact_sha256 || '')
+        ? url.href : null
+    }
+
+    function previouslyInstalledReviewedPlugin(plugin) {
+      try { return localStorage.getItem(`${PLUGIN_INSTALL_RECORD_PREFIX}${plugin.id}`) === plugin.artifact_sha256 }
+      catch { return false }
+    }
+
     function loadServiceUrl() {
       try { return normalizeServiceUrl(localStorage.getItem(SERVICE_URL_STORAGE_KEY) || '') || '' } catch { return '' }
     }
 
+    function savedDeviceId() {
+      try {
+        const existing = localStorage.getItem(DEVICE_ID_STORAGE_KEY)
+        return existing && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/iu.test(existing) ? existing : null
+      } catch { return null }
+    }
+
     function loadDeviceId() {
-      const existing = localStorage.getItem(DEVICE_ID_STORAGE_KEY)
-      if (existing && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/iu.test(existing)) return existing
+      const existing = savedDeviceId()
+      if (existing) return existing
       const deviceId = crypto.randomUUID()
       localStorage.setItem(DEVICE_ID_STORAGE_KEY, deviceId)
       return deviceId
     }
 
-    function TeamServiceConfig({ remote, openSkillCenter }) {
+    function TeamServiceConfig({ remote, openInstalledPlugin }) {
       const [serviceUrl, setServiceUrl] = useState(loadServiceUrl)
       const [draft, setDraft] = useState(serviceUrl)
       const [message, setMessage] = useState('')
+      const [pluginAlerts, setPluginAlerts] = useState([])
+      useEffect(() => {
+        let disposed = false
+        const inspect = async () => {
+          try {
+            const response = await fetch('/api/ant-teams/plugins', { cache: 'no-store' })
+            if (!response.ok) return
+            const catalog = await readLocalJsonResponse(response)
+            const listed = await remote?.pluginManager?.listBundles?.()
+            if (!listed?.ok || !Array.isArray(catalog.plugins)) return
+            const affected = catalog.plugins.flatMap((plugin) => {
+              if (plugin.status !== 'security_withdrawn') return []
+              const local = listed.value.find((bundle) => bundle.installed && bundle.name === plugin.package_name)
+              if (!local || (local.version && local.version !== plugin.version)) return []
+              return [{ ...plugin, versionUnknown: !local.version }]
+            })
+            if (!disposed) setPluginAlerts(affected)
+          } catch {}
+        }
+        void inspect()
+        const timer = setInterval(() => void inspect(), 5 * 60 * 1000)
+        return () => { disposed = true; clearInterval(timer) }
+      }, [remote])
       const save = (event) => {
         event.preventDefault()
         const normalized = normalizeServiceUrl(draft)
@@ -142,15 +211,16 @@ window.__ModuleLoader__.load({
           h('div', { style: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 12 } },
             message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null,
             link ? h('a', { href: link, target: '_blank', rel: 'noopener noreferrer', style: { color: 'var(--dsw-alias-link)', fontSize: 13 } }, '打开团队管理 ↗') : null)),
-        h('section', { style: { ...panelStyle, display: 'flex', flexWrap: 'wrap', alignItems: 'center', justifyContent: 'space-between' } },
-          h('div', null,
-            h('h3', { style: { margin: 0, fontSize: 16, fontWeight: 650 } }, '企业精选技能'),
-            h('p', { style: { ...mutedTextStyle, marginTop: 4 } }, '浏览团队审核发布的技能，在独立页面查看说明并安装到这台 DSH。')),
-          h('button', { type: 'button', onClick: openSkillCenter, style: primaryButtonStyle }, '打开技能中心 →')),
+        pluginAlerts.length ? h('section', { role: 'alert', style: { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } },
+          h('h3', { style: { margin: 0, fontSize: 16 } }, '已安装插件存在安全撤回公告'),
+          ...pluginAlerts.map((plugin) => h('p', { key: plugin.id, style: mutedTextStyle },
+            `${plugin.title} ${plugin.version}${plugin.versionUnknown ? '（本机版本暂无法读取，请核对是否受影响）' : ''}：${plugin.withdrawal_reason}`)),
+          ...pluginAlerts.map((plugin) => h('button', { key: `${plugin.id}-open`, type: 'button',
+            onClick: () => openInstalledPlugin(plugin.package_name), style: secondaryButtonStyle }, `在 DSH 中查看 ${plugin.title}`))) : null,
         h(ModelSyncFooter, { remote, serviceUrl, onServiceUrlChange: setServiceUrl }))
     }
 
-    function SkillCenterPage({ onBack }) {
+    function SkillCenterPage({ onBack, onPlugins }) {
       const [skills, setSkills] = useState([])
       const [loading, setLoading] = useState(false)
       const [workingId, setWorkingId] = useState('')
@@ -191,7 +261,8 @@ window.__ModuleLoader__.load({
           const result = await readLocalJsonResponse(response)
           if (!response.ok) throw new Error(result.message || `${action}失败（${response.status}）。`)
           await refresh()
-          setMessage(`${skill.title} 已${action}。DSH 将从本机技能目录发现它。`)
+          setMessage(remove ? `${skill.title} 已从 ANT 管理的本机目录卸载。`
+            : `${skill.title} 的文件已${action}到 DSH 用户技能目录。DSH 会在后续会话或模型步骤中读取；若不可用，请检查当前预设是否启用了本地技能。`)
         } catch (error) { setMessage(error instanceof Error ? error.message : `${action}失败。`) }
         finally { setWorkingId('') }
       }
@@ -200,17 +271,20 @@ window.__ModuleLoader__.load({
         const matchesQuery = !query.trim() || `${skill.title} ${skill.description} ${skill.dsh_name}`.toLowerCase().includes(query.trim().toLowerCase())
         return matchesFilter && matchesQuery
       })
-      const statusLabel = { installed: '已安装', 'update-available': '可更新', 'not-installed': '未安装', 'not-discovered': 'DSH 未发现', conflict: '本机冲突' }
+      const statusLabel = { installed: '已放入本机目录', 'update-available': '可更新', 'not-installed': '未安装', conflict: '本机冲突' }
       return h('section', { 'aria-label': '企业精选技能', style: {
         height: '100%', overflowY: 'auto', boxSizing: 'border-box',
         padding: 'calc(var(--dsh-frame-top-clearance, 0px) + 20px) clamp(16px, 3vw, 36px) 48px',
       } }, h('div', { style: { maxWidth: 1440, margin: '0 auto', display: 'grid', gap: 22 } },
-        h('button', { type: 'button', onClick: onBack, style: { ...secondaryButtonStyle, justifySelf: 'start' } }, '← 返回 ANT 插件设置'),
+        h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
+          h('button', { type: 'button', onClick: onBack, style: secondaryButtonStyle }, '← 返回 ANT 插件设置'),
+          h('button', { type: 'button', onClick: onPlugins, style: secondaryButtonStyle }, '查看企业精选插件 →')),
         h('div', { style: { display: 'flex', flexWrap: 'wrap', alignItems: 'end', justifyContent: 'space-between', gap: 16 } },
           h('div', null,
             h('h1', { style: { margin: 0, fontSize: 28 } }, '企业精选技能'),
             h('p', { style: { ...mutedTextStyle, marginTop: 6 } }, '团队管理员审核后发布；安装到这台 DSH 后，由 DSH 原生技能系统发现和使用。')),
           h('button', { type: 'button', disabled: loading || Boolean(workingId), onClick: () => void refresh(), style: secondaryButtonStyle }, loading ? '读取中…' : '刷新目录')),
+        h(ExtensionRequestNotice),
         h('div', { style: { ...panelStyle, gap: 12 } },
           h('input', { type: 'search', value: query, onChange: (event) => setQuery(event.target.value), placeholder: '搜索技能名称或说明', 'aria-label': '搜索企业精选技能', style: inputStyle }),
           h('div', { style: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8 } },
@@ -234,19 +308,213 @@ window.__ModuleLoader__.load({
               h('p', { style: mutedTextStyle }, `本机依赖：${skill.requirements}`),
               skill.local_status === 'conflict'
                 ? h('p', { role: 'status', style: mutedTextStyle }, '本机同名技能有未受 ANT 管理的内容、文件已被修改或备份损坏；请联系管理员处理。')
-                : skill.local_status === 'not-discovered'
-                  ? h('div', { style: { display: 'grid', gap: 10 } },
-                    h('p', { role: 'status', style: mutedTextStyle }, '文件已在本机，但 DSH 技能服务没有发现它；请检查 DSH 技能目录配置。'),
-                    h('button', { type: 'button', disabled: Boolean(workingId), onClick: () => void changeInstall(skill, true), style: { ...secondaryButtonStyle, justifySelf: 'start' } }, '卸载本机副本'))
-                  : h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8, marginTop: 'auto' } },
+                : h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8, marginTop: 'auto' } },
                     h('button', { type: 'button', disabled: Boolean(workingId) || skill.local_status === 'installed',
                       onClick: () => void changeInstall(skill), style: primaryButtonStyle },
-                    skill.local_status === 'installed' ? '已安装' : skill.local_status === 'update-available' ? '更新技能' : '安装到这台 DSH'),
+                    skill.local_status === 'installed' ? '文件已安装' : skill.local_status === 'update-available' ? '更新技能' : '安装到这台 DSH'),
                     skill.local_status !== 'not-installed' ? h('button', { type: 'button', disabled: Boolean(workingId),
                       onClick: () => void changeInstall(skill, true), style: secondaryButtonStyle }, '卸载') : null))
           })) : !loading && skills.length ? h('p', { style: mutedTextStyle }, '没有符合筛选条件的技能。') : null))
     }
 
+    function PluginCenterPage({ remote, onBack, onSkills, openBundle }) {
+      const [plugins, setPlugins] = useState([])
+      const [bundles, setBundles] = useState([])
+      const [loading, setLoading] = useState(false)
+      const [workingId, setWorkingId] = useState('')
+      const [uncertainId, setUncertainId] = useState('')
+      const [completedId, setCompletedId] = useState('')
+      const [message, setMessage] = useState('')
+      const [query, setQuery] = useState('')
+      const [filter, setFilter] = useState('all')
+      const refresh = async () => {
+        setLoading(true)
+        try {
+          const manager = remote?.pluginManager
+          if (typeof manager?.listBundles !== 'function') throw new Error('当前 DSH 未提供插件管理接口。')
+          const [response, listed] = await Promise.all([
+            fetch('/api/ant-teams/plugins', { cache: 'no-store' }), manager.listBundles(),
+          ])
+          const result = await readLocalJsonResponse(response)
+          if (!response.ok) throw new Error(result.message || `读取插件目录失败（${response.status}）。`)
+          if (!Array.isArray(result.plugins)) throw new Error('企业插件目录格式无效。')
+          if (!listed.ok) throw new Error(listed.error?.message || '无法读取 DSH 本机插件。')
+          setPlugins(result.plugins)
+          setBundles(listed.value)
+          setMessage(result.plugins.length ? '' : '团队暂未发布精选插件。')
+        } catch (error) {
+          setPlugins([])
+          setBundles([])
+          setMessage(error instanceof Error ? error.message : '无法读取企业精选插件。')
+        } finally { setLoading(false) }
+      }
+      useEffect(() => { void refresh() }, [])
+      const install = async (plugin) => {
+        const artifactUrl = approvedPluginArtifactUrl(plugin)
+        if (!artifactUrl || workingId || uncertainId === plugin.id || completedId === plugin.id) return
+        const manager = remote?.pluginManager
+        if (typeof manager?.installBundle !== 'function') {
+          setMessage('当前 DSH 未提供插件安装接口，请联系管理员。')
+          return
+        }
+        const local = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
+        const action = local ? local.version === plugin.version ? '重新安装' : '更新' : '安装'
+        if (!window.confirm(`在这台 DSH ${action}团队审核的 ${plugin.title} ${plugin.version}？插件将在本机运行，完成后需要完全重启 DSH。`)) return
+        setWorkingId(plugin.id)
+        setMessage(`正在安装 ${plugin.title}，请不要退出 DSH…`)
+        try {
+          const response = await fetch('/api/ant-teams/plugins', { cache: 'no-store' })
+          const catalog = await readLocalJsonResponse(response)
+          const latest = Array.isArray(catalog?.plugins)
+            ? catalog.plugins.find((item) => item.id === plugin.id) : null
+          if (!response.ok || latest?.package_name !== plugin.package_name
+            || latest?.version !== plugin.version || latest?.artifact_sha256 !== plugin.artifact_sha256
+            || approvedPluginArtifactUrl(latest) !== artifactUrl) {
+            throw new Error('插件审核信息已变化，请刷新目录后重试。')
+          }
+          const requestId = crypto.randomUUID()
+          let result
+          try { result = await manager.installBundle(artifactUrl, { enabled: true, requestId }) }
+          catch { result = null }
+          if (!result?.ok) {
+            let recovered = null
+            if (typeof manager.waitForInstall === 'function') {
+              try {
+                const pending = await manager.waitForInstall(requestId)
+                if (pending.ok && pending.value) recovered = { ok: true, value: pending.value }
+              } catch {}
+            }
+            if (!recovered) {
+              setUncertainId(plugin.id)
+              setMessage(`暂时无法确认 ${plugin.title} 的安装结果。请先在 DSH 插件列表核对，勿重复点击安装。`)
+              return
+            }
+            result = recovered
+          }
+          const outcome = result.value
+          if (!outcome || typeof outcome !== 'object') {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未返回 ${plugin.title} 的安装结果。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          if (outcome.application === 'failed' || outcome.application === 'cancelled') {
+            if (outcome.error?.code === 'ambiguous-install' && local?.version === plugin.version) {
+              setMessage(`DSH 无法确定 ${plugin.title} 本次安装的唯一结果，未确认完成。请先在 DSH 插件列表核对；若已经正常使用同版则无需重复安装，仍需核对来源时请联系管理员。`)
+              return
+            }
+            const diagnostic = typeof outcome.error?.diagnostic === 'string'
+              ? outcome.error.diagnostic.slice(0, 180) : ''
+            setMessage(`${plugin.title} 安装未完成。请在 DSH 插件管理查看状态或联系管理员。${diagnostic ? `原因：${diagnostic}` : ''}`)
+            return
+          }
+          if (outcome.bundle !== plugin.package_name
+            || !['restart-required', 'applied'].includes(outcome.application)) {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未确认 ${plugin.title} 已安装。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          let observed = null
+          try {
+            const installed = await manager.listBundles()
+            if (installed.ok && Array.isArray(installed.value)) {
+              observed = installed.value.find((bundle) => bundle.name === plugin.package_name && bundle.installed) || null
+            }
+          } catch {}
+          if ((outcome.version && outcome.version !== plugin.version) || observed?.version !== plugin.version) {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未确认 ${plugin.title} 的审核版本已安装。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          await refresh()
+          try { localStorage.setItem(`${PLUGIN_INSTALL_RECORD_PREFIX}${plugin.id}`, plugin.artifact_sha256) } catch {}
+          setCompletedId(plugin.id)
+          setMessage(`${plugin.title} 已安装。请完全退出并重新启动 DSH 后使用。`)
+        } catch (error) {
+          setMessage(error instanceof Error ? error.message : '插件安装未完成，请稍后重试。')
+        } finally { setWorkingId('') }
+      }
+      const visible = plugins.filter((plugin) => {
+        const installed = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
+        const artifactUrl = approvedPluginArtifactUrl(plugin)
+        const matches = !query.trim() || `${plugin.title} ${plugin.description} ${plugin.package_name}`.toLowerCase().includes(query.trim().toLowerCase())
+        return matches && (filter === 'all' || filter === 'installed' && installed?.version === plugin.version
+          || filter === 'available' && artifactUrl && (!installed || (installed.version && installed.version !== plugin.version))
+          || filter === 'retired' && plugin.status !== 'published')
+      })
+      return h('section', { 'aria-label': '企业精选插件', style: {
+        height: '100%', overflowY: 'auto', boxSizing: 'border-box',
+        padding: 'calc(var(--dsh-frame-top-clearance, 0px) + 20px) clamp(16px, 3vw, 36px) 48px',
+      } }, h('div', { style: { maxWidth: 1440, margin: '0 auto', display: 'grid', gap: 22 } },
+        h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
+          h('button', { type: 'button', onClick: onBack, style: secondaryButtonStyle }, '← 返回 ANT 插件设置'),
+          h('button', { type: 'button', onClick: onSkills, style: secondaryButtonStyle }, '查看企业精选技能 →')),
+        h('div', { style: { display: 'flex', flexWrap: 'wrap', justifyContent: 'space-between', gap: 16 } },
+          h('div', null,
+            h('h1', { style: { margin: 0, fontSize: 28 } }, '企业精选插件'),
+            h('p', { style: { ...mutedTextStyle, marginTop: 6 } }, '这里展示团队审核过的插件版本及本机状态。')),
+          h('button', { type: 'button', disabled: loading, onClick: () => void refresh(), style: secondaryButtonStyle }, loading ? '读取中…' : '刷新目录')),
+        h('aside', { role: 'note', style: { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } },
+          h('strong', null, '只安装团队锁定的固定版本'),
+          h('p', { style: mutedTextStyle }, '显示“安装”按钮的版本已锁定实际安装包并由管理员发布；其他目录项仅供查看，如需使用请联系企业管理员。')),
+        h(ExtensionRequestNotice),
+        h('div', { style: panelStyle },
+          h('input', { type: 'search', value: query, onChange: (event) => setQuery(event.target.value), placeholder: '搜索插件名称或用途', 'aria-label': '搜索企业精选插件', style: inputStyle }),
+          h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
+            ...[['all', '全部'], ['available', '可安装或升级'], ['installed', '已安装'], ['retired', '已废弃']].map(([value, label]) =>
+              h('button', { key: value, type: 'button', onClick: () => setFilter(value), 'aria-pressed': filter === value,
+                style: { ...secondaryButtonStyle, minHeight: 34, backgroundColor: filter === value ? 'var(--dsw-alias-bg-layer-2)' : secondaryButtonStyle.backgroundColor } }, label)))),
+        message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null,
+        visible.length ? h('div', { style: { display: 'grid', gridTemplateColumns: 'repeat(auto-fit, minmax(min(100%, 420px), 1fr))', gap: 16 } },
+          ...visible.map((plugin) => {
+            const local = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
+            const sameVersion = local?.version === plugin.version
+            const security = plugin.status === 'security_withdrawn'
+            const artifactUrl = approvedPluginArtifactUrl(plugin)
+            const sourceKnown = typeof local?.source === 'string'
+            const verifiedLocal = sameVersion && artifactUrl && sourceKnown && local.source === artifactUrl
+            const recordedInstall = sameVersion && !sourceKnown && previouslyInstalledReviewedPlugin(plugin)
+            const status = security ? '已废弃（安全风险）'
+              : plugin.status === 'deprecated' ? '已废弃' : local?.error ? '加载异常' : sameVersion
+                ? verifiedLocal ? local.enabled ? '本机已装（团队来源，已启用）' : '本机已装（团队来源，未启用）'
+                  : sourceKnown ? '本机同版，来源不同' : recordedInstall
+                    ? '本机同版，曾由企业扩展安装；当前 DSH 无法复核来源' : '本机同版，当前 DSH 无法核对来源'
+                : artifactUrl ? local ? local.version ? `可更新 · 本机 ${local.version}` : '本机版本暂无法读取' : '可安装'
+                  : local ? `本机版本 ${local.version || '暂无法读取'}` : '已审核，暂需管理员安装'
+            return h('article', { key: plugin.id, style: security
+              ? { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } : panelStyle },
+              h('div', { style: { display: 'flex', flexWrap: 'wrap', justifyContent: 'space-between', gap: 8 } },
+                h('h2', { style: { margin: 0, fontSize: 19 } }, plugin.title),
+                h('span', { style: security
+                  ? { ...mutedTextStyle, color: 'var(--dsw-alias-label-danger, #d44)', fontWeight: 650 } : mutedTextStyle }, status)),
+              h('p', { style: mutedTextStyle }, plugin.description),
+              h('p', { style: mutedTextStyle }, `${plugin.package_name}@${plugin.version} · 许可证：${plugin.license || '未声明'}`),
+              h('p', { style: mutedTextStyle }, `来源：${plugin.source_url || '未提供'} · DSH 版本要求：${plugin.peer_range || '包未声明'}`),
+              h('p', { style: mutedTextStyle }, `额外配置：${plugin.requirements || '无'}`),
+              plugin.scripts ? h('p', { style: mutedTextStyle }, `包自身的安装脚本：${plugin.scripts}`) : null,
+              plugin.status !== 'published' ? h('p', { role: 'status', style: security
+                ? { ...mutedTextStyle, color: 'var(--dsw-alias-label-danger, #d44)' } : mutedTextStyle },
+                plugin.withdrawal_reason || '团队已停止推荐此版本。') : null,
+              local?.error ? h('p', { role: 'status', style: mutedTextStyle }, local.error.message || String(local.error)) : null,
+              sameVersion && !sourceKnown && artifactUrl ? h('p', { style: mutedTextStyle }, recordedInstall
+                ? '此前曾由企业扩展安装；当前 DSH 无法再次核对来源。正常使用无需重复安装；若后来换过来源，可以重新安装。'
+                : '已装同版且使用正常时无需重复安装；若想改用团队审核包，可自愿安装。') : null,
+              h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
+                artifactUrl && (!local || (local.version && !verifiedLocal))
+                  ? h('button', { type: 'button', disabled: Boolean(workingId) || uncertainId === plugin.id || completedId === plugin.id,
+                    onClick: () => void install(plugin), style: primaryButtonStyle },
+                  workingId === plugin.id ? '安装中…' : uncertainId === plugin.id ? '先核对安装结果'
+                    : completedId === plugin.id ? '重启 DSH 后生效'
+                    : local ? sameVersion ? '按团队审核包重新安装' : '更新到审核版本' : '安装到这台 DSH') : null,
+                plugin.status === 'published' && !local && !artifactUrl
+                  ? h('p', { style: mutedTextStyle }, '如需安装，请联系企业管理员安排。') : null,
+                local || uncertainId === plugin.id ? h('button', { type: 'button', onClick: () => openBundle(plugin.package_name), style: secondaryButtonStyle }, '打开 DSH 插件管理') : null,
+                local && !sameVersion && plugin.status === 'published' && !artifactUrl
+                  ? h('p', { style: mutedTextStyle }, '本机版本与团队审核版本不同；请联系企业管理员核对。') : null))
+          })) : !loading && plugins.length ? h('p', { style: mutedTextStyle }, filter === 'available'
+            ? '当前没有可一键安装的插件。可在“全部”查看审核目录，或联系企业管理员。'
+            : '没有符合筛选条件的插件。') : null))
+    }
+
     function ModelSyncFooter({ remote, serviceUrl, onServiceUrlChange }) {
       const [email, setEmail] = useState('')
       const [code, setCode] = useState('')
@@ -256,10 +524,21 @@ window.__ModuleLoader__.load({
       const [credentialConfigured, setCredentialConfigured] = useState(null)
       const [reauthenticate, setReauthenticate] = useState(false)
       const [needsReconnect, setNeedsReconnect] = useState(false)
+      const [allowLocalCleanup, setAllowLocalCleanup] = useState(false)
       const [bundleRelease, setBundleRelease] = useState(null)
       const [bundleUpdate, setBundleUpdate] = useState({ state: 'idle', currentVersion: '', message: '' })
-      const [approvedBuilds, setApprovedBuilds] = useState([])
       const [serviceCompatibility, setServiceCompatibility] = useState({ state: 'idle', message: '' })
+      const [pinnedServiceUrl, setPinnedServiceUrl] = useState(null)
+
+      const connectionErrorMessage = (result, status) => {
+        const message = result?.message || `请求失败（${status}）`
+        if (!['LEGACY_DEVICE_REVOKE_REQUIRED', 'ANT_CONNECTION_CLEANUP_REQUIRED'].includes(result?.code)) return message
+        setAllowLocalCleanup(true)
+        const deviceId = savedDeviceId()
+        return deviceId
+          ? `${message} 设备编号：${deviceId}。请把编号提供给原团队管理员。`
+          : `${message} 本机无法确认旧设备编号；请让原团队管理员按成员查看设备清单，勿用新编号猜测。`
+      }
 
       const inspectServiceCompatibility = async (rawServiceUrl, useSavedConnection = false) => {
         const normalized = normalizeServiceUrl(rawServiceUrl)
@@ -374,10 +653,12 @@ window.__ModuleLoader__.load({
 
       const checkBundleUpdate = async () => {
         setBundleUpdate({ state: 'checking', currentVersion: '', message: '正在检查 ANT 更新…' })
-        setApprovedBuilds([])
         try {
           const response = await fetch('/api/ant-teams/bundle-release', {
-            cache: 'no-store', headers: { 'x-ant-bundle-capabilities': 'direct-package-install' },
+            cache: 'no-store', headers: {
+              'x-ant-bundle-capabilities': 'direct-package-install',
+              'x-ant-bundle-update-mode': 'check-only',
+            },
           })
           const release = await readLocalJsonResponse(response)
           if (!response.ok) throw new Error(release.message || `检查失败（${response.status}）`)
@@ -415,109 +696,154 @@ window.__ModuleLoader__.load({
             throw new Error(`当前 DSH 未找到已安装的 ${release.package_name} Bundle。`)
           }
           const available = newerVersion(release.version, installed.version)
+          if (release.artifact_status === 'revoked') {
+            setBundleUpdate({ state: 'revoked', currentVersion: installed.version,
+              message: installed.version === release.version
+                ? `当前 ANT ${installed.version} 的安装包已因安全问题停用。请联系企业管理员获取处理方式；ANT 不会自动删除本机副本。`
+                : `发布版本 ${release.version} 的安装包已因安全问题停用，请等待管理员发布修复版本。` })
+            return
+          }
+          const artifactUrl = approvedArtifactUrl(release)
           setBundleUpdate({
-            state: available ? 'available' : 'current',
+            state: available ? artifactUrl ? 'available' : 'artifact-missing' : 'current',
             currentVersion: installed.version,
-            message: available ? `发现新版本 ${release.version}。` : `当前已是最新发布版本（${installed.version}）。`,
+            message: available
+              ? artifactUrl
+                ? `发现新版本 ${release.version}，可直接更新。`
+                : `发现新版本 ${release.version}，但管理员尚未提供已审核安装包。请联系管理员。`
+              : `当前已是最新发布版本（${installed.version}）。`,
           })
         } catch (error) {
           setBundleUpdate({ state: 'failed', currentVersion: '', message: error instanceof Error ? error.message : '检查 ANT 更新失败。' })
         }
       }
 
-      const installBundleUpdate = async (allowScripts = false) => {
-        const installSpec = directInstallSpec(bundleRelease)
-        if (!installSpec
-          || (!allowScripts && bundleUpdate.state !== 'available')
-          || (allowScripts && approvedBuilds.length === 0)) return
+      const installBundleUpdate = async () => {
+        if (bundleUpdate.state !== 'available') return
+        const artifactUrl = approvedArtifactUrl(bundleRelease)
+        if (!artifactUrl) return
         const manager = remote?.pluginManager
         if (typeof manager?.installBundle !== 'function') {
-          setBundleUpdate((current) => ({ ...current, state: 'failed', message: '当前 DSH 版本未提供官方 Bundle 安装接口。' }))
+          setBundleUpdate((current) => ({ ...current, state: 'failed', message: '当前 DSH 未提供 Bundle 更新接口。' }))
           return
         }
-        const scripts = allowScripts ? approvedBuilds : []
-        if (scripts.length && !window.confirm(`DSH 安装需要运行以下依赖的安装脚本：\n\n${scripts.join('\n')}\n\n仅在信任这些依赖时继续。`)) return
         setBusy(true)
-        setApprovedBuilds([])
-        setBundleUpdate((current) => ({ ...current, state: 'installing', message: '正在委托 DSH 官方管理器安装更新…' }))
+        setBundleUpdate((current) => ({ ...current, state: 'installing', message: '正在由 DSH 安装已审核的 ANT 更新…' }))
         try {
-          const result = await manager.installBundle(installSpec, {
-            enabled: true,
-            ...(scripts.length ? { approvedBuilds: scripts } : {}),
+          const releaseResponse = await fetch('/api/ant-teams/bundle-release', {
+            cache: 'no-store', headers: {
+              'x-ant-bundle-capabilities': 'direct-package-install',
+              'x-ant-bundle-update-mode': 'check-only',
+            },
           })
-          if (!result.ok) throw new Error(result.error?.message || 'DSH 安装请求未返回结果。')
-          const outcome = result.value
-          if (outcome.application === 'failed') {
-            const pending = Array.isArray(outcome.pendingBuilds) ? outcome.pendingBuilds : []
-            setApprovedBuilds(pending)
-            const reason = outcome.error?.diagnostic || outcome.packageResult?.output || 'DSH 未能安装该版本。'
-            setBundleUpdate({
-              state: 'failed', currentVersion: bundleUpdate.currentVersion,
-              message: pending.length
-                ? `DSH 暂停了安装，因为以下依赖需要明确授权运行安装脚本：${pending.join('、')}`
-                : reason,
-            })
-            return
+          const latest = await readLocalJsonResponse(releaseResponse)
+          if (!releaseResponse.ok || latest.version !== bundleRelease.version
+            || latest.artifact_sha256 !== bundleRelease.artifact_sha256
+            || approvedArtifactUrl(latest) !== artifactUrl) {
+            throw new Error('ANT 更新信息已变化，请重新检查更新。')
           }
-          if (outcome.application === 'cancelled') {
-            setBundleUpdate({ state: 'failed', currentVersion: bundleUpdate.currentVersion, message: 'DSH 已取消更新，当前运行版本未切换。' })
-            return
+          const requestId = crypto.randomUUID()
+          let result
+          try {
+            result = await manager.installBundle(artifactUrl, { enabled: true, requestId })
+          } catch {
+            result = null
+          }
+          if (!result?.ok) {
+            let recovered = null
+            if (typeof manager.waitForInstall === 'function') {
+              try {
+                const pending = await manager.waitForInstall(requestId)
+                if (pending.ok && pending.value) recovered = { ok: true, value: pending.value }
+              } catch {}
+            }
+            if (!recovered) {
+              setBundleUpdate((current) => ({ ...current, state: 'unknown',
+                message: 'DSH 连接中断，更新结果暂时无法确认。请先在 DSH 插件列表查看 ANT 版本，勿重复点击更新。' }))
+              return
+            }
+            result = recovered
           }
-          if (outcome.application === 'overridden') {
-            setBundleUpdate({ state: 'failed', currentVersion: bundleUpdate.currentVersion, message: 'DSH 已记录更新，但其他插件配置覆盖了 ANT。请检查 DSH 插件配置后再重启。' })
+          const outcome = result.value
+          if (outcome.application === 'failed' || outcome.application === 'cancelled') {
+            const reason = outcome.error?.diagnostic || outcome.packageResult?.output || '安装未完成。'
+            setBundleUpdate((current) => ({ ...current, state: 'failed', message: `更新失败：${reason}` }))
             return
           }
-          if (outcome.bundle !== bundleRelease.package_name) {
-            setBundleUpdate({ state: 'failed', currentVersion: bundleUpdate.currentVersion, message: 'DSH 返回的安装包名称与 ANT 发布信息不一致。请联系管理员核对发布包。' })
+          if (outcome.bundle !== ANT_BUNDLE_PACKAGE_NAME
+            || !['restart-required', 'applied'].includes(outcome.application)) {
+            throw new Error('DSH 未确认 ANT 安装成功，请联系管理员检查插件状态。')
+          }
+          let observed = null
+          try {
+            const installed = await manager.listBundles()
+            if (installed.ok && Array.isArray(installed.value)) {
+              observed = installed.value.find((bundle) => bundle.name === ANT_BUNDLE_PACKAGE_NAME && bundle.installed) || null
+            }
+          } catch {}
+          if ((outcome.version && outcome.version !== bundleRelease.version) || observed?.version !== bundleRelease.version) {
+            setBundleUpdate((current) => ({ ...current, state: 'unknown',
+              message: 'DSH 未确认新版本已安装。请先在 DSH 插件列表核对 ANT 版本，勿重复点击更新。' }))
             return
           }
-          setBundleUpdate({
-            state: 'done', currentVersion: bundleRelease.version,
-            message: outcome.application === 'restart-required'
-              ? `DSH 已安装 ${installSpec}。请完全退出并重新启动 DSH 后生效。`
-              : `DSH 已安装 ${installSpec}。`,
-          })
+          setBundleUpdate({ state: 'done', currentVersion: bundleRelease.version,
+            message: `ANT ${bundleRelease.version} 已安装。请完全退出并重新启动 DSH 后生效。` })
         } catch (error) {
-          setBundleUpdate({ state: 'failed', currentVersion: bundleUpdate.currentVersion, message: error instanceof Error ? error.message : 'DSH 未能安装 ANT 更新。' })
+          setBundleUpdate((current) => ({ ...current, state: 'failed', message: error instanceof Error ? error.message : '更新未完成。' }))
         } finally {
           setBusy(false)
         }
       }
 
+      const clearLocalConnection = async () => {
+        if (typeof remote?.settings?.mutate !== 'function') throw new Error('DSH 未提供模型设置接口。')
+        const settingsResult = await remote.settings.mutate('llm-pi-ai', [
+          { op: 'unset', path: ['providers', 'ant-team-openai'] },
+          { op: 'unset', path: ['providers', 'ant-team-anthropic'] },
+        ], undefined)
+        if (!settingsResult.ok) throw new Error(settingsResult.error?.message || 'ANT 模型设置未能清除。')
+        if (typeof remote?.credentials?.unset !== 'function') throw new Error('DSH 未提供凭证删除接口。')
+        const credentialResult = await remote.credentials.unset('ANT_MODEL_API_KEY')
+        if (!credentialResult.ok) throw new Error(credentialResult.error?.message || 'ANT 成员凭证未能清除。')
+        setCredentialConfigured(false)
+        setNeedsReconnect(false)
+        setReauthenticate(false)
+        setAllowLocalCleanup(false)
+      }
+
       const disconnect = async () => {
         setBusy(true)
         setMessage('正在断开此设备的 ANT 连接…')
         try {
-          if (typeof remote?.settings?.mutate !== 'function') throw new Error('DSH 未提供模型设置接口。')
-          const result = await remote.settings.mutate('llm-pi-ai', [
-            { op: 'unset', path: ['providers', 'ant-team-openai'] },
-            { op: 'unset', path: ['providers', 'ant-team-anthropic'] },
-          ], undefined)
-          if (!result.ok) throw new Error(result.error?.message || 'ANT 模型设置未能清除。')
+          const response = await fetch('/api/ant-teams/disconnect', { method: 'POST' })
+          const result = await readLocalJsonResponse(response)
+          if (!response.ok || result.revoked !== true) {
+            throw new Error(connectionErrorMessage(result, response.status))
+          }
         } catch (error) {
+          setAllowLocalCleanup(true)
           setBusy(false)
-          setMessage(`无法清除本机 ANT 模型设置，因此连接仍保留。${error instanceof Error ? error.message : '请稍后重试。'}`)
+          setMessage(`未清除本机凭证和模型设置：${error instanceof Error ? error.message : '请稍后重试。'}`)
           return
         }
-        let serverRevoked = false
         try {
-          const response = await fetch('/api/ant-teams/disconnect', { method: 'POST' })
-          const result = await readLocalJsonResponse(response)
-          serverRevoked = response.ok && result.revoked === true
-        } catch {}
-        let credentialRemoved = false
+          await clearLocalConnection()
+          setMessage('此设备的 ANT 凭证已撤销，ANT 模型设置已清除。团队服务地址已保留。')
+        } catch (error) {
+          setAllowLocalCleanup(true)
+          setMessage(`服务端已撤销设备令牌，但本机清理失败：${error instanceof Error ? error.message : '请稍后重试'}。可选择仅清理本机。`)
+        } finally { setBusy(false) }
+      }
+
+      const clearOnlyLocal = async () => {
+        if (!window.confirm('仅清理这台 DSH 的 ANT 凭证和模型设置，不保证服务端设备令牌已撤销。请先让原团队管理员确认远端撤销；否则令牌可能仍可被使用。确定继续吗？')) return
+        setBusy(true)
         try {
-          if (typeof remote?.credentials?.unset !== 'function') throw new Error('DSH 未提供凭证删除接口。')
-          const result = await remote.credentials.unset('ANT_MODEL_API_KEY')
-          if (!result.ok) throw new Error(result.error?.message || 'ANT 成员凭证未能清除。')
-          credentialRemoved = true
-          setCredentialConfigured(false)
+          await clearLocalConnection()
+          setMessage('已仅清理本机 ANT 凭证和模型设置。此操作未确认服务端撤销，请向原团队管理员核对。')
         } catch (error) {
-          setMessage(`本机 ANT 模型设置已清除，但成员凭证未能移除：${error instanceof Error ? error.message : '请稍后重试。'}`)
-        }
-        setBusy(false)
-        if (credentialRemoved && serverRevoked) setMessage('此设备的 ANT 凭证已撤销，ANT 模型设置已清除。团队服务地址已保留。')
-        else if (credentialRemoved) setMessage('本机 ANT 凭证与模型设置已清除；服务端未确认撤销，活动会话会在 90 秒内到期。团队服务地址已保留。')
+          setMessage(`本机清理未完成：${error instanceof Error ? error.message : '请稍后重试。'}`)
+        } finally { setBusy(false) }
       }
 
       useEffect(() => {
@@ -539,6 +865,23 @@ window.__ModuleLoader__.load({
         return () => { current = false }
       }, [remote])
 
+      useEffect(() => {
+        let current = true
+        if (credentialConfigured !== true) {
+          setPinnedServiceUrl(null)
+          return () => { current = false }
+        }
+        const readPinnedOrigin = async () => {
+          try {
+            const response = await fetch('/api/ant-teams/connection-origin', { cache: 'no-store' })
+            const result = await readLocalJsonResponse(response)
+            if (current) setPinnedServiceUrl(response.ok ? normalizeServiceUrl(result.service_url) : null)
+          } catch { if (current) setPinnedServiceUrl(null) }
+        }
+        void readPinnedOrigin()
+        return () => { current = false }
+      }, [remote, credentialConfigured])
+
       useEffect(() => {
         void inspectServiceCompatibility(serviceUrl, credentialConfigured === true)
       }, [remote, serviceUrl, credentialConfigured])
@@ -555,6 +898,13 @@ window.__ModuleLoader__.load({
           setMessage('请填写工作邮箱。')
           return
         }
+        if (credentialConfigured !== false && !savedDeviceId()) {
+          if (credentialConfigured === true) setAllowLocalCleanup(true)
+          setMessage(credentialConfigured === true
+            ? '旧 ANT 凭证仍在，但本机无法确认它绑定的设备编号。请让原团队管理员按成员核查并撤销旧设备，再仅清理本机。'
+            : '尚未确认本机凭证状态，也没有已保存的设备编号。请等待检查完成，或修复 DSH 凭证接口后重试。')
+          return
+        }
         setBusy(true)
         setMessage('正在发送邮箱验证码…')
         try {
@@ -566,7 +916,7 @@ window.__ModuleLoader__.load({
             body: JSON.stringify({ service_url: normalized, email: normalizedEmail }),
           })
           const result = await readLocalJsonResponse(response)
-          if (!response.ok) throw new Error(result.message || `请求失败（${response.status}）`)
+          if (!response.ok) throw new Error(connectionErrorMessage(result, response.status))
           setEmail(normalizedEmail)
           setCodeRequested(true)
           setMessage(result.message || '如果该邮箱符合团队规则，验证码将发送至邮箱。')
@@ -586,6 +936,13 @@ window.__ModuleLoader__.load({
           setMessage('请填写有效的服务地址、工作邮箱和 8 位验证码。')
           return
         }
+        if (credentialConfigured !== false && !savedDeviceId()) {
+          if (credentialConfigured === true) setAllowLocalCleanup(true)
+          setMessage(credentialConfigured === true
+            ? '旧 ANT 凭证仍在，但本机无法确认旧设备编号。请先联系原团队管理员撤销旧设备，再仅清理本机。'
+            : '尚未确认本机凭证状态，也没有已保存的设备编号。请等待检查完成，或修复 DSH 凭证接口后重试。')
+          return
+        }
         setBusy(true)
         setMessage('正在验证邮箱并同步团队模型…')
         try {
@@ -602,7 +959,7 @@ window.__ModuleLoader__.load({
             }),
           })
           const result = await readLocalJsonResponse(response)
-          if (!response.ok) throw new Error(result.message || `请求失败（${response.status}）`)
+          if (!response.ok) throw new Error(connectionErrorMessage(result, response.status))
           if (typeof result.token !== 'string' || !result.token.startsWith('antm_') || !Array.isArray(result.models)) {
             throw new Error('ANT 返回的连接信息格式无效。')
           }
@@ -616,6 +973,7 @@ window.__ModuleLoader__.load({
           onServiceUrlChange(normalized)
           setCodeRequested(false)
           setCredentialConfigured(true)
+          setAllowLocalCleanup(false)
           setNeedsReconnect(false)
           setReauthenticate(false)
           setMessage(`已连接 ${result.email || normalizedEmail}，同步 ${result.models.length} 个获准模型。它们现已出现在 DSH 模型选择器中。`)
@@ -627,6 +985,9 @@ window.__ModuleLoader__.load({
       }
 
       const showConnectForm = credentialConfigured !== true || reauthenticate || needsReconnect
+      const canCheckUpdate = credentialConfigured === true && !needsReconnect
+      const updateGuideUrl = pinnedServiceUrl
+        ? new URL('/ant-update', pinnedServiceUrl).href : null
       return h('div', { style: { display: 'grid', gridTemplateColumns: 'repeat(auto-fit, minmax(min(100%, 400px), 1fr))', alignItems: 'start', gap: 16 } },
         h('section', { style: panelStyle },
           h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', gap: 12 } },
@@ -653,18 +1014,20 @@ window.__ModuleLoader__.load({
             h('button', { type: 'button', disabled: busy, onClick: () => void refreshModels(), style: primaryButtonStyle }, busy ? '刷新中…' : '刷新团队模型'),
             h('button', { type: 'button', disabled: busy, onClick: () => { setReauthenticate(true); setMessage('') }, style: secondaryButtonStyle }, '重新验证邮箱'),
             h('button', { type: 'button', disabled: busy, onClick: () => { if (window.confirm('断开当前设备与 ANT 的连接？本机 ANT 凭证和模型设置将被清除，团队服务地址会保留。')) void disconnect() }, style: secondaryButtonStyle }, '断开当前设备')) : null,
-          credentialConfigured === true && !showConnectForm ? h('section', { style: { ...panelStyle, padding: 14, gap: 10 } },
+          h('section', { style: { ...panelStyle, padding: 14, gap: 10 } },
             h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', gap: 12 } },
               h('h4', { style: { margin: 0, fontSize: 14, fontWeight: 650 } }, 'ANT 插件更新'),
-              h('button', { type: 'button', disabled: busy || bundleUpdate.state === 'checking', onClick: () => void checkBundleUpdate(), style: secondaryButtonStyle }, bundleUpdate.state === 'checking' ? '检查中…' : '检查更新')),
-            bundleUpdate.message ? h('p', { role: 'status', style: mutedTextStyle }, bundleUpdate.message) : null,
-            bundleRelease?.version && bundleUpdate.state === 'available' ? h('div', { style: { display: 'grid', gap: 8 } },
-              h('p', { style: mutedTextStyle }, `发布版本：${bundleRelease.version} · npm：${directInstallSpec(bundleRelease)}`),
+              h('button', { type: 'button', disabled: busy || !canCheckUpdate || bundleUpdate.state === 'checking', onClick: () => void checkBundleUpdate(), style: secondaryButtonStyle }, bundleUpdate.state === 'checking' ? '检查中…' : '检查更新')),
+            !canCheckUpdate ? h('p', { role: 'status', style: mutedTextStyle }, '连接团队后可在这里检查并安装 ANT 更新；需要先恢复插件时，可打开团队管理台的更新指引。') : null,
+            updateGuideUrl ? h('a', { href: updateGuideUrl, target: '_blank', rel: 'noopener noreferrer', style: { color: 'var(--dsw-alias-link)', fontSize: 13 } }, `打开 ${pinnedServiceUrl} 的更新指引 ↗`)
+              : !canCheckUpdate ? h('p', { style: mutedTextStyle }, '无法核对原团队地址时，请向企业管理员索取更新指引。') : null,
+            bundleUpdate.message ? h('p', { role: 'status', style: bundleUpdate.state === 'revoked'
+              ? { ...mutedTextStyle, color: 'var(--dsw-alias-state-error-primary)' } : mutedTextStyle }, bundleUpdate.message) : null,
+            canCheckUpdate && bundleRelease?.version && ['available', 'artifact-missing'].includes(bundleUpdate.state) ? h('div', { style: { display: 'grid', gap: 8 } },
+              h('p', { style: mutedTextStyle }, `发布版本：${bundleRelease.version} · 精确包名：${directInstallSpec(bundleRelease)}`),
               bundleRelease.release_notes ? h('p', { style: mutedTextStyle }, bundleRelease.release_notes) : null,
-              h('button', { type: 'button', disabled: busy, onClick: () => void installBundleUpdate(), style: primaryButtonStyle }, busy ? '安装中…' : '由 DSH 安装并更新')) : null,
-            approvedBuilds.length ? h('div', { style: { display: 'grid', gap: 8 } },
-              h('p', { style: mutedTextStyle }, `DSH 暂停安装，等待授权运行以下依赖的安装脚本：${approvedBuilds.join('、')}。`),
-              h('button', { type: 'button', disabled: busy, onClick: () => void installBundleUpdate(true), style: secondaryButtonStyle }, '信任这些依赖并继续安装')) : null) : null,
+              bundleUpdate.state === 'available'
+                ? h('button', { type: 'button', disabled: busy, onClick: () => void installBundleUpdate(), style: primaryButtonStyle }, busy ? '更新中…' : '更新 ANT') : null) : null),
           showConnectForm ? h('form', { onSubmit: requestCode, style: { display: 'grid', gap: 9, maxWidth: 560 } },
             h('label', { htmlFor: 'ant-team-model-email', style: { fontSize: 13, fontWeight: 550 } }, '工作邮箱'),
             h('input', {
@@ -685,10 +1048,41 @@ window.__ModuleLoader__.load({
               onChange: (event) => setCode(event.target.value.replace(/\D/gu, '').slice(0, 8)), style: inputStyle,
             }),
             h('button', { type: 'submit', disabled: busy || code.length !== 8, style: primaryButtonStyle }, busy ? '连接中…' : '验证并连接')) : null,
+          allowLocalCleanup ? h('section', { style: { ...panelStyle, padding: 14, gap: 9 } },
+            h('p', { style: mutedTextStyle }, savedDeviceId()
+              ? `已保存的设备编号：${savedDeviceId()}。请交给原团队管理员核对。`
+              : '本机无法确认旧设备编号。请让原团队管理员按成员查看设备清单，勿用新编号猜测。'),
+            h('p', { style: mutedTextStyle }, '仅清理本机不会确认服务端令牌已撤销；请先取得管理员确认。'),
+            h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
+              h('button', { type: 'button', disabled: busy, onClick: () => void clearOnlyLocal(), style: secondaryButtonStyle }, '仅清理本机'),
+              h('button', { type: 'button', disabled: busy || !savedDeviceId(), onClick: async () => {
+                try {
+                  const deviceId = savedDeviceId()
+                  if (!deviceId) throw new Error('device id unavailable')
+                  if (typeof window.navigator?.clipboard?.writeText !== 'function') throw new Error('clipboard unavailable')
+                  await window.navigator.clipboard.writeText(deviceId)
+                  setMessage('设备编号已复制，请发给原团队管理员。')
+                }
+                catch { setMessage(savedDeviceId() ? `请复制设备编号：${savedDeviceId()}` : '本机无法确认旧设备编号，请联系原团队管理员核查。') }
+              }, style: secondaryButtonStyle }, '复制设备编号'))) : null,
           message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null))
 
     }
 
+    function EnterpriseExtensionsPanelIcon({ size }) {
+      return h('span', { 'aria-hidden': true, style: {
+        display: 'inline-grid', placeItems: 'center', width: size, height: size,
+        fontSize: size, lineHeight: 1,
+      } }, '✦')
+    }
+
+    function EnterpriseExtensionsPage({ remote, onBack, openBundle }) {
+      const [tab, setTab] = useState('skills')
+      return tab === 'skills'
+        ? h(SkillCenterPage, { onBack, onPlugins: () => setTab('plugins') })
+        : h(PluginCenterPage, { remote, onBack, onSkills: () => setTab('skills'), openBundle })
+    }
+
     function apply(ctx) {
       const remote = {
         credentials: ctx.remote.credentials,
@@ -696,14 +1090,24 @@ window.__ModuleLoader__.load({
         pluginManager: ctx.remote.pluginManager,
       }
       ctx.slots.inject('main', () => ctx.slots.register({ name: 'main', key: 'ant-skills' },
-        () => h(SkillCenterPage, { onBack: () => ctx.pluginNavigation.openBundle(ANT_BUNDLE_PACKAGE_NAME) })))
+        () => h(EnterpriseExtensionsPage, {
+          remote,
+          onBack: () => ctx.pluginNavigation.openBundle(ANT_BUNDLE_PACKAGE_NAME),
+          openBundle: (name) => ctx.pluginNavigation.openBundle(name),
+        })))
+      ctx.slots.inject('sidebar.panellist', () => ctx.slots.register({
+        name: 'sidebar.panellist', id: 'ant-skills', order: 5, label: '企业扩展',
+      }, EnterpriseExtensionsPanelIcon))
       ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({
           name: 'plugins.bundle.config',
           key: ANT_BUNDLE_PACKAGE_NAME,
           inject: () => ({ remote }),
         }, ({ view, remote: injectedRemote }) => view === 'summary'
           ? h('p', null, 'ANT 团队服务入口。')
-          : h(TeamServiceConfig, { remote: injectedRemote, openSkillCenter: () => ctx.layout.selectPanel('ant-skills') })))
+          : h(TeamServiceConfig, {
+            remote: injectedRemote,
+            openInstalledPlugin: (name) => ctx.pluginNavigation.openBundle(name),
+          })))
     }
 
     Object.assign(exports, { inject, apply })