@ai-wendao/ant 0.3.13 → 0.3.14

package/README.md

@@ -6,15 +6,17 @@ ANT (AI-native Teams) connects a DeepSeek Harness Desktop profile to its team's
 
 ## 企业精选技能
 
-团队管理员可在 ANT 管理台从 GitHub 目录、ZIP、TAR、TAR.GZ／TGZ 或单份 `SKILL.md` 导入技能，核对来源、文件和依赖后发布。已连接团队的成员在 DSH 的 ANT 插件设置页点击“打开扩展中心”，进入“技能”页面浏览并安装。ANT Host 将固定版本的完整文件集放进 DSH 的用户技能目录，并重新核对本机文件；启用本地技能的 DSH 会话随后由原生技能提供者发现和使用。ANT 不用 Host 全局技能列表判断会话是否已发现技能。
+团队管理员可在 ANT 管理台从 GitHub 目录、ZIP、TAR、TAR.GZ／TGZ 或单份 `SKILL.md` 导入技能，核对来源、文件和依赖后发布。已连接团队的成员从 DSH 左侧“企业扩展”入口进入独立页面浏览并安装技能；ANT 插件设置页只处理连接、模型和更新。ANT Host 将固定版本的完整文件集放进 DSH 的用户技能目录，并重新核对本机文件；启用本地技能的 DSH 会话随后由原生技能提供者发现和使用。ANT 不用 Host 全局技能列表判断会话是否已发现技能。
 
 安装不会自动运行技能脚本或安装 Python、Node 等系统依赖。ANT 只更新或卸载自己管理且本机内容未被修改的技能目录；发现同名个人技能或本机改动时会停止覆盖。
 
 ## 企业精选插件
 
-管理员可从 npm 官方源的 DSH Bundle 精确版本创建草稿，填写源码、许可证、依赖和安装脚本的审核记录后发布。成员在“扩展中心 → 插件”查看审核信息和本机状态。当前 DSH RC2 无法让 ANT 在安装脚本运行前确认实际下载制品与审核制品一致，因此插件一键安装暂停；需要使用时请联系企业管理员安排。安全撤回版本会在扩展中心标明；本机安装受影响版本或无法读取本机版本时，ANT 设置页也显示相应风险公告。
+管理员可从 npm 官方源的 DSH Bundle 精确版本创建草稿，填写源码、许可证、依赖和安装脚本的审核记录后发布。成员在“企业扩展 → 插件”查看审核信息和本机状态。对无新增依赖、无安装阶段脚本且归档符合首批准入条件的草稿，管理员可从 npm 官方源锁定实际 `.tgz` 并查看文件清单、下载核验制品；这类草稿经审核发布后，成员可让 DSH 从 ANT 的固定制品地址一键安装。其他版本仍是目录项，需联系管理员安排。安全撤回版本会停止新的 ANT 下载，但不会自动删除本机副本；ANT 设置页继续显示相应风险公告。范围与限制见[上线边界](../../docs/decisions/2026-10-15-plugin-center-rollout.md)。
 
-企业精选是团队推荐目录，不是强制白名单；ANT 不能阻止成员从 DSH 原生插件管理页自行安装其他包。当前 DSH RC2 接口无法让 ANT 强制校验成员安装的包字节与审核时的摘要一致，也不能保证 profile 的依赖范围始终为精确版本；上线边界见 [待决策记录](../../docs/decisions/2026-10-15-plugin-center-rollout.md)。
+ANT 自身更新使用单独的已审核安装包。管理员将与 npm 发布一致的 `.tgz` 上传到 ANT 服务端并登记版本；新版 ANT 页面可点击“更新”，DSH 原位替换同名 Bundle 后提示重启。旧版 `@ai-wendao/ant` 用户可打开团队服务的 `/ant-update` 指引，在 DSH“添加插件”中粘贴该安装包地址完成一次性原位更新，无需先卸载或使用终端。此入口只分发 ANT 自身，不启用扩展中心其他插件的一键安装。
+
+企业精选是团队推荐目录，不是强制白名单；ANT 不能阻止成员从 DSH 原生插件管理页自行安装其他包。第一批一键安装只分发 ANT 已核验并保存的顶层包，不把有依赖或安装脚本的版本伪装成已受控；DSH RC2 后续包管理能否一直保留这一固定制品仍需真机验收。上线边界见[待决策记录](../../docs/decisions/2026-10-15-plugin-center-rollout.md)。
 
 ## Existing `ant` alias installations
 

package/client.js

@@ -9,6 +9,7 @@ window.__ModuleLoader__.load({
     const DEVICE_ID_STORAGE_KEY = 'ant-team-device-id'
     const ANT_BUNDLE_PACKAGE_NAME = '@ai-wendao/ant'
     const ANT_API_PROTOCOL_VERSIONS = [1]
+    const PLUGIN_INSTALL_RECORD_PREFIX = 'ant-reviewed-plugin-install:'
     const fileCountFormat = new Intl.NumberFormat('zh-CN')
     const panelStyle = {
       display: 'grid', alignContent: 'start', gap: 14, padding: 18,
@@ -40,7 +41,7 @@ window.__ModuleLoader__.load({
         gap: 5,
       } },
         h('h2', { style: { margin: 0, fontSize: 16 } }, '没有找到想用的技能或插件？'),
-        h('p', { style: mutedTextStyle }, '请联系企业管理员，说明你希望完成的任务或提供扩展地址。管理员审核后会将合适的版本加入扩展中心。技能可在这里安装；插件请由管理员安排，勿自行安装未经审核的扩展。'))
+        h('p', { style: mutedTextStyle }, '目录里没有想用的扩展，或插件没有安装按钮？请联系企业管理员，说明你希望完成的任务或提供扩展地址。已开放安装的技能和插件可在这里直接安装；勿自行安装未经审核的扩展。'))
     }
     const normalizeServiceUrl = (value) => {
       let url
@@ -97,6 +98,35 @@ window.__ModuleLoader__.load({
         : ''
     }
 
+    function approvedArtifactUrl(release) {
+      const expectedPath = `/api/ant-bundles/${release?.version}/package.tgz`
+      let url
+      try { url = new URL(release?.artifact_url) } catch { return null }
+      return normalizeServiceUrl(url.origin) === url.origin
+        && !url.username && !url.password && !url.search && !url.hash
+        && url.pathname === expectedPath && release?.artifact_path === expectedPath
+        && /^[a-f0-9]{64}$/u.test(release?.artifact_sha256 || '')
+        ? url.href : null
+    }
+
+    function approvedPluginArtifactUrl(plugin) {
+      if (plugin?.status !== 'published' || typeof plugin.id !== 'string'
+        || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/iu.test(plugin.id)) return null
+      const expectedPath = `/api/plugin-artifacts/${plugin.id}/package.tgz`
+      let url
+      try { url = new URL(plugin.artifact_url) } catch { return null }
+      return normalizeServiceUrl(url.origin) === url.origin
+        && !url.username && !url.password && !url.search && !url.hash
+        && url.pathname === expectedPath && plugin.artifact_path === expectedPath
+        && /^[a-f0-9]{64}$/u.test(plugin.artifact_sha256 || '')
+        ? url.href : null
+    }
+
+    function previouslyInstalledReviewedPlugin(plugin) {
+      try { return localStorage.getItem(`${PLUGIN_INSTALL_RECORD_PREFIX}${plugin.id}`) === plugin.artifact_sha256 }
+      catch { return false }
+    }
+
     function loadServiceUrl() {
       try { return normalizeServiceUrl(localStorage.getItem(SERVICE_URL_STORAGE_KEY) || '') || '' } catch { return '' }
     }
@@ -116,7 +146,7 @@ window.__ModuleLoader__.load({
       return deviceId
     }
 
-    function TeamServiceConfig({ remote, openSkillCenter, openPluginCenter }) {
+    function TeamServiceConfig({ remote, openInstalledPlugin }) {
       const [serviceUrl, setServiceUrl] = useState(loadServiceUrl)
       const [draft, setDraft] = useState(serviceUrl)
       const [message, setMessage] = useState('')
@@ -181,16 +211,12 @@ window.__ModuleLoader__.load({
           h('div', { style: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 12 } },
             message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null,
             link ? h('a', { href: link, target: '_blank', rel: 'noopener noreferrer', style: { color: 'var(--dsw-alias-link)', fontSize: 13 } }, '打开团队管理 ↗') : null)),
-        h('section', { style: { ...panelStyle, display: 'flex', flexWrap: 'wrap', alignItems: 'center', justifyContent: 'space-between' } },
-          h('div', null,
-            h('h3', { style: { margin: 0, fontSize: 16, fontWeight: 650 } }, '企业精选扩展'),
-            h('p', { style: { ...mutedTextStyle, marginTop: 4 } }, '浏览团队审核发布的技能与插件；技能可在这里安装，插件安全安装暂未开放。没有找到需要的扩展时，请联系企业管理员上架。')),
-          h('button', { type: 'button', onClick: openSkillCenter, style: primaryButtonStyle }, '打开扩展中心 →')),
         pluginAlerts.length ? h('section', { role: 'alert', style: { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } },
           h('h3', { style: { margin: 0, fontSize: 16 } }, '已安装插件存在安全撤回公告'),
           ...pluginAlerts.map((plugin) => h('p', { key: plugin.id, style: mutedTextStyle },
             `${plugin.title} ${plugin.version}${plugin.versionUnknown ? '（本机版本暂无法读取，请核对是否受影响）' : ''}：${plugin.withdrawal_reason}`)),
-          h('button', { type: 'button', onClick: openPluginCenter, style: secondaryButtonStyle }, '查看插件并打开 DSH 管理 →')) : null,
+          ...pluginAlerts.map((plugin) => h('button', { key: `${plugin.id}-open`, type: 'button',
+            onClick: () => openInstalledPlugin(plugin.package_name), style: secondaryButtonStyle }, `在 DSH 中查看 ${plugin.title}`))) : null,
         h(ModelSyncFooter, { remote, serviceUrl, onServiceUrlChange: setServiceUrl }))
     }
 
@@ -295,6 +321,9 @@ window.__ModuleLoader__.load({
       const [plugins, setPlugins] = useState([])
       const [bundles, setBundles] = useState([])
       const [loading, setLoading] = useState(false)
+      const [workingId, setWorkingId] = useState('')
+      const [uncertainId, setUncertainId] = useState('')
+      const [completedId, setCompletedId] = useState('')
       const [message, setMessage] = useState('')
       const [query, setQuery] = useState('')
       const [filter, setFilter] = useState('all')
@@ -320,11 +349,96 @@ window.__ModuleLoader__.load({
         } finally { setLoading(false) }
       }
       useEffect(() => { void refresh() }, [])
+      const install = async (plugin) => {
+        const artifactUrl = approvedPluginArtifactUrl(plugin)
+        if (!artifactUrl || workingId || uncertainId === plugin.id || completedId === plugin.id) return
+        const manager = remote?.pluginManager
+        if (typeof manager?.installBundle !== 'function') {
+          setMessage('当前 DSH 未提供插件安装接口，请联系管理员。')
+          return
+        }
+        const local = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
+        const action = local ? local.version === plugin.version ? '重新安装' : '更新' : '安装'
+        if (!window.confirm(`在这台 DSH ${action}团队审核的 ${plugin.title} ${plugin.version}？插件将在本机运行，完成后需要完全重启 DSH。`)) return
+        setWorkingId(plugin.id)
+        setMessage(`正在安装 ${plugin.title}，请不要退出 DSH…`)
+        try {
+          const response = await fetch('/api/ant-teams/plugins', { cache: 'no-store' })
+          const catalog = await readLocalJsonResponse(response)
+          const latest = Array.isArray(catalog?.plugins)
+            ? catalog.plugins.find((item) => item.id === plugin.id) : null
+          if (!response.ok || latest?.package_name !== plugin.package_name
+            || latest?.version !== plugin.version || latest?.artifact_sha256 !== plugin.artifact_sha256
+            || approvedPluginArtifactUrl(latest) !== artifactUrl) {
+            throw new Error('插件审核信息已变化，请刷新目录后重试。')
+          }
+          const requestId = crypto.randomUUID()
+          let result
+          try { result = await manager.installBundle(artifactUrl, { enabled: true, requestId }) }
+          catch { result = null }
+          if (!result?.ok) {
+            let recovered = null
+            if (typeof manager.waitForInstall === 'function') {
+              try {
+                const pending = await manager.waitForInstall(requestId)
+                if (pending.ok && pending.value) recovered = { ok: true, value: pending.value }
+              } catch {}
+            }
+            if (!recovered) {
+              setUncertainId(plugin.id)
+              setMessage(`暂时无法确认 ${plugin.title} 的安装结果。请先在 DSH 插件列表核对，勿重复点击安装。`)
+              return
+            }
+            result = recovered
+          }
+          const outcome = result.value
+          if (!outcome || typeof outcome !== 'object') {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未返回 ${plugin.title} 的安装结果。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          if (outcome.application === 'failed' || outcome.application === 'cancelled') {
+            if (outcome.error?.code === 'ambiguous-install' && local?.version === plugin.version) {
+              setMessage(`DSH 无法确定 ${plugin.title} 本次安装的唯一结果，未确认完成。请先在 DSH 插件列表核对；若已经正常使用同版则无需重复安装，仍需核对来源时请联系管理员。`)
+              return
+            }
+            const diagnostic = typeof outcome.error?.diagnostic === 'string'
+              ? outcome.error.diagnostic.slice(0, 180) : ''
+            setMessage(`${plugin.title} 安装未完成。请在 DSH 插件管理查看状态或联系管理员。${diagnostic ? `原因：${diagnostic}` : ''}`)
+            return
+          }
+          if (outcome.bundle !== plugin.package_name
+            || !['restart-required', 'applied'].includes(outcome.application)) {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未确认 ${plugin.title} 已安装。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          let observed = null
+          try {
+            const installed = await manager.listBundles()
+            if (installed.ok && Array.isArray(installed.value)) {
+              observed = installed.value.find((bundle) => bundle.name === plugin.package_name && bundle.installed) || null
+            }
+          } catch {}
+          if ((outcome.version && outcome.version !== plugin.version) || observed?.version !== plugin.version) {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未确认 ${plugin.title} 的审核版本已安装。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          await refresh()
+          try { localStorage.setItem(`${PLUGIN_INSTALL_RECORD_PREFIX}${plugin.id}`, plugin.artifact_sha256) } catch {}
+          setCompletedId(plugin.id)
+          setMessage(`${plugin.title} 已安装。请完全退出并重新启动 DSH 后使用。`)
+        } catch (error) {
+          setMessage(error instanceof Error ? error.message : '插件安装未完成，请稍后重试。')
+        } finally { setWorkingId('') }
+      }
       const visible = plugins.filter((plugin) => {
         const installed = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
+        const artifactUrl = approvedPluginArtifactUrl(plugin)
         const matches = !query.trim() || `${plugin.title} ${plugin.description} ${plugin.package_name}`.toLowerCase().includes(query.trim().toLowerCase())
         return matches && (filter === 'all' || filter === 'installed' && installed?.version === plugin.version
-          || filter === 'available' && plugin.status === 'published' && !installed
+          || filter === 'available' && artifactUrl && (!installed || (installed.version && installed.version !== plugin.version))
           || filter === 'retired' && plugin.status !== 'published')
       })
       return h('section', { 'aria-label': '企业精选插件', style: {
@@ -340,13 +454,13 @@ window.__ModuleLoader__.load({
             h('p', { style: { ...mutedTextStyle, marginTop: 6 } }, '这里展示团队审核过的插件版本及本机状态。')),
           h('button', { type: 'button', disabled: loading, onClick: () => void refresh(), style: secondaryButtonStyle }, loading ? '读取中…' : '刷新目录')),
         h('aside', { role: 'note', style: { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } },
-          h('strong', null, '插件一键安装暂未开放'),
-          h('p', { style: mutedTextStyle }, '当前 DSH 无法让 ANT 在运行代码前核对实际下载的插件及其依赖。需要使用某个插件时，请联系企业管理员安排审核与安全安装；请勿自行从其他来源安装。')),
+          h('strong', null, '只安装团队锁定的固定版本'),
+          h('p', { style: mutedTextStyle }, '显示“安装”按钮的版本已锁定实际安装包并由管理员发布；其他目录项仅供查看，如需使用请联系企业管理员。')),
         h(ExtensionRequestNotice),
         h('div', { style: panelStyle },
           h('input', { type: 'search', value: query, onChange: (event) => setQuery(event.target.value), placeholder: '搜索插件名称或用途', 'aria-label': '搜索企业精选插件', style: inputStyle }),
           h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
-            ...[['all', '全部'], ['available', '已审核'], ['installed', '已安装'], ['retired', '已废弃']].map(([value, label]) =>
+            ...[['all', '全部'], ['available', '可安装或升级'], ['installed', '已安装'], ['retired', '已废弃']].map(([value, label]) =>
               h('button', { key: value, type: 'button', onClick: () => setFilter(value), 'aria-pressed': filter === value,
                 style: { ...secondaryButtonStyle, minHeight: 34, backgroundColor: filter === value ? 'var(--dsw-alias-bg-layer-2)' : secondaryButtonStyle.backgroundColor } }, label)))),
         message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null,
@@ -355,10 +469,17 @@ window.__ModuleLoader__.load({
             const local = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
             const sameVersion = local?.version === plugin.version
             const security = plugin.status === 'security_withdrawn'
+            const artifactUrl = approvedPluginArtifactUrl(plugin)
+            const sourceKnown = typeof local?.source === 'string'
+            const verifiedLocal = sameVersion && artifactUrl && sourceKnown && local.source === artifactUrl
+            const recordedInstall = sameVersion && !sourceKnown && previouslyInstalledReviewedPlugin(plugin)
             const status = security ? '已废弃（安全风险）'
-              : plugin.status === 'deprecated' ? '已废弃' : sameVersion
-                ? local.error ? '加载异常' : local.enabled ? '已安装（配置已启用）' : '已安装未启用'
-                : local ? `本机版本 ${local.version || '暂无法读取'}` : '已审核，等待安全安装'
+              : plugin.status === 'deprecated' ? '已废弃' : local?.error ? '加载异常' : sameVersion
+                ? verifiedLocal ? local.enabled ? '本机已装（团队来源，已启用）' : '本机已装（团队来源，未启用）'
+                  : sourceKnown ? '本机同版，来源不同' : recordedInstall
+                    ? '本机同版，曾由企业扩展安装；当前 DSH 无法复核来源' : '本机同版，当前 DSH 无法核对来源'
+                : artifactUrl ? local ? local.version ? `可更新 · 本机 ${local.version}` : '本机版本暂无法读取' : '可安装'
+                  : local ? `本机版本 ${local.version || '暂无法读取'}` : '已审核，暂需管理员安装'
             return h('article', { key: plugin.id, style: security
               ? { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } : panelStyle },
               h('div', { style: { display: 'flex', flexWrap: 'wrap', justifyContent: 'space-between', gap: 8 } },
@@ -374,13 +495,24 @@ window.__ModuleLoader__.load({
                 ? { ...mutedTextStyle, color: 'var(--dsw-alias-label-danger, #d44)' } : mutedTextStyle },
                 plugin.withdrawal_reason || '团队已停止推荐此版本。') : null,
               local?.error ? h('p', { role: 'status', style: mutedTextStyle }, local.error.message || String(local.error)) : null,
+              sameVersion && !sourceKnown && artifactUrl ? h('p', { style: mutedTextStyle }, recordedInstall
+                ? '此前曾由企业扩展安装；当前 DSH 无法再次核对来源。正常使用无需重复安装；若后来换过来源，可以重新安装。'
+                : '已装同版且使用正常时无需重复安装；若想改用团队审核包，可自愿安装。') : null,
               h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
-                plugin.status === 'published' && !local
+                artifactUrl && (!local || (local.version && !verifiedLocal))
+                  ? h('button', { type: 'button', disabled: Boolean(workingId) || uncertainId === plugin.id || completedId === plugin.id,
+                    onClick: () => void install(plugin), style: primaryButtonStyle },
+                  workingId === plugin.id ? '安装中…' : uncertainId === plugin.id ? '先核对安装结果'
+                    : completedId === plugin.id ? '重启 DSH 后生效'
+                    : local ? sameVersion ? '按团队审核包重新安装' : '更新到审核版本' : '安装到这台 DSH') : null,
+                plugin.status === 'published' && !local && !artifactUrl
                   ? h('p', { style: mutedTextStyle }, '如需安装，请联系企业管理员安排。') : null,
-                local ? h('button', { type: 'button', onClick: () => openBundle(plugin.package_name), style: secondaryButtonStyle }, '打开 DSH 插件管理') : null,
-                local && !sameVersion && plugin.status === 'published'
+                local || uncertainId === plugin.id ? h('button', { type: 'button', onClick: () => openBundle(plugin.package_name), style: secondaryButtonStyle }, '打开 DSH 插件管理') : null,
+                local && !sameVersion && plugin.status === 'published' && !artifactUrl
                   ? h('p', { style: mutedTextStyle }, '本机版本与团队审核版本不同；请联系企业管理员核对。') : null))
-          })) : !loading && plugins.length ? h('p', { style: mutedTextStyle }, '没有符合筛选条件的插件。') : null))
+          })) : !loading && plugins.length ? h('p', { style: mutedTextStyle }, filter === 'available'
+            ? '当前没有可一键安装的插件。可在“全部”查看审核目录，或联系企业管理员。'
+            : '没有符合筛选条件的插件。') : null))
     }
 
     function ModelSyncFooter({ remote, serviceUrl, onServiceUrlChange }) {
@@ -396,6 +528,7 @@ window.__ModuleLoader__.load({
       const [bundleRelease, setBundleRelease] = useState(null)
       const [bundleUpdate, setBundleUpdate] = useState({ state: 'idle', currentVersion: '', message: '' })
       const [serviceCompatibility, setServiceCompatibility] = useState({ state: 'idle', message: '' })
+      const [pinnedServiceUrl, setPinnedServiceUrl] = useState(null)
 
       const connectionErrorMessage = (result, status) => {
         const message = result?.message || `请求失败（${status}）`
@@ -563,16 +696,105 @@ window.__ModuleLoader__.load({
             throw new Error(`当前 DSH 未找到已安装的 ${release.package_name} Bundle。`)
           }
           const available = newerVersion(release.version, installed.version)
+          if (release.artifact_status === 'revoked') {
+            setBundleUpdate({ state: 'revoked', currentVersion: installed.version,
+              message: installed.version === release.version
+                ? `当前 ANT ${installed.version} 的安装包已因安全问题停用。请联系企业管理员获取处理方式；ANT 不会自动删除本机副本。`
+                : `发布版本 ${release.version} 的安装包已因安全问题停用，请等待管理员发布修复版本。` })
+            return
+          }
+          const artifactUrl = approvedArtifactUrl(release)
           setBundleUpdate({
-            state: available ? 'available' : 'current',
+            state: available ? artifactUrl ? 'available' : 'artifact-missing' : 'current',
             currentVersion: installed.version,
-            message: available ? `发现新版本 ${release.version}。` : `当前已是最新发布版本（${installed.version}）。`,
+            message: available
+              ? artifactUrl
+                ? `发现新版本 ${release.version}，可直接更新。`
+                : `发现新版本 ${release.version}，但管理员尚未提供已审核安装包。请联系管理员。`
+              : `当前已是最新发布版本（${installed.version}）。`,
           })
         } catch (error) {
           setBundleUpdate({ state: 'failed', currentVersion: '', message: error instanceof Error ? error.message : '检查 ANT 更新失败。' })
         }
       }
 
+      const installBundleUpdate = async () => {
+        if (bundleUpdate.state !== 'available') return
+        const artifactUrl = approvedArtifactUrl(bundleRelease)
+        if (!artifactUrl) return
+        const manager = remote?.pluginManager
+        if (typeof manager?.installBundle !== 'function') {
+          setBundleUpdate((current) => ({ ...current, state: 'failed', message: '当前 DSH 未提供 Bundle 更新接口。' }))
+          return
+        }
+        setBusy(true)
+        setBundleUpdate((current) => ({ ...current, state: 'installing', message: '正在由 DSH 安装已审核的 ANT 更新…' }))
+        try {
+          const releaseResponse = await fetch('/api/ant-teams/bundle-release', {
+            cache: 'no-store', headers: {
+              'x-ant-bundle-capabilities': 'direct-package-install',
+              'x-ant-bundle-update-mode': 'check-only',
+            },
+          })
+          const latest = await readLocalJsonResponse(releaseResponse)
+          if (!releaseResponse.ok || latest.version !== bundleRelease.version
+            || latest.artifact_sha256 !== bundleRelease.artifact_sha256
+            || approvedArtifactUrl(latest) !== artifactUrl) {
+            throw new Error('ANT 更新信息已变化，请重新检查更新。')
+          }
+          const requestId = crypto.randomUUID()
+          let result
+          try {
+            result = await manager.installBundle(artifactUrl, { enabled: true, requestId })
+          } catch {
+            result = null
+          }
+          if (!result?.ok) {
+            let recovered = null
+            if (typeof manager.waitForInstall === 'function') {
+              try {
+                const pending = await manager.waitForInstall(requestId)
+                if (pending.ok && pending.value) recovered = { ok: true, value: pending.value }
+              } catch {}
+            }
+            if (!recovered) {
+              setBundleUpdate((current) => ({ ...current, state: 'unknown',
+                message: 'DSH 连接中断，更新结果暂时无法确认。请先在 DSH 插件列表查看 ANT 版本，勿重复点击更新。' }))
+              return
+            }
+            result = recovered
+          }
+          const outcome = result.value
+          if (outcome.application === 'failed' || outcome.application === 'cancelled') {
+            const reason = outcome.error?.diagnostic || outcome.packageResult?.output || '安装未完成。'
+            setBundleUpdate((current) => ({ ...current, state: 'failed', message: `更新失败：${reason}` }))
+            return
+          }
+          if (outcome.bundle !== ANT_BUNDLE_PACKAGE_NAME
+            || !['restart-required', 'applied'].includes(outcome.application)) {
+            throw new Error('DSH 未确认 ANT 安装成功，请联系管理员检查插件状态。')
+          }
+          let observed = null
+          try {
+            const installed = await manager.listBundles()
+            if (installed.ok && Array.isArray(installed.value)) {
+              observed = installed.value.find((bundle) => bundle.name === ANT_BUNDLE_PACKAGE_NAME && bundle.installed) || null
+            }
+          } catch {}
+          if ((outcome.version && outcome.version !== bundleRelease.version) || observed?.version !== bundleRelease.version) {
+            setBundleUpdate((current) => ({ ...current, state: 'unknown',
+              message: 'DSH 未确认新版本已安装。请先在 DSH 插件列表核对 ANT 版本，勿重复点击更新。' }))
+            return
+          }
+          setBundleUpdate({ state: 'done', currentVersion: bundleRelease.version,
+            message: `ANT ${bundleRelease.version} 已安装。请完全退出并重新启动 DSH 后生效。` })
+        } catch (error) {
+          setBundleUpdate((current) => ({ ...current, state: 'failed', message: error instanceof Error ? error.message : '更新未完成。' }))
+        } finally {
+          setBusy(false)
+        }
+      }
+
       const clearLocalConnection = async () => {
         if (typeof remote?.settings?.mutate !== 'function') throw new Error('DSH 未提供模型设置接口。')
         const settingsResult = await remote.settings.mutate('llm-pi-ai', [
@@ -643,6 +865,23 @@ window.__ModuleLoader__.load({
         return () => { current = false }
       }, [remote])
 
+      useEffect(() => {
+        let current = true
+        if (credentialConfigured !== true) {
+          setPinnedServiceUrl(null)
+          return () => { current = false }
+        }
+        const readPinnedOrigin = async () => {
+          try {
+            const response = await fetch('/api/ant-teams/connection-origin', { cache: 'no-store' })
+            const result = await readLocalJsonResponse(response)
+            if (current) setPinnedServiceUrl(response.ok ? normalizeServiceUrl(result.service_url) : null)
+          } catch { if (current) setPinnedServiceUrl(null) }
+        }
+        void readPinnedOrigin()
+        return () => { current = false }
+      }, [remote, credentialConfigured])
+
       useEffect(() => {
         void inspectServiceCompatibility(serviceUrl, credentialConfigured === true)
       }, [remote, serviceUrl, credentialConfigured])
@@ -746,6 +985,9 @@ window.__ModuleLoader__.load({
       }
 
       const showConnectForm = credentialConfigured !== true || reauthenticate || needsReconnect
+      const canCheckUpdate = credentialConfigured === true && !needsReconnect
+      const updateGuideUrl = pinnedServiceUrl
+        ? new URL('/ant-update', pinnedServiceUrl).href : null
       return h('div', { style: { display: 'grid', gridTemplateColumns: 'repeat(auto-fit, minmax(min(100%, 400px), 1fr))', alignItems: 'start', gap: 16 } },
         h('section', { style: panelStyle },
           h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', gap: 12 } },
@@ -772,15 +1014,20 @@ window.__ModuleLoader__.load({
             h('button', { type: 'button', disabled: busy, onClick: () => void refreshModels(), style: primaryButtonStyle }, busy ? '刷新中…' : '刷新团队模型'),
             h('button', { type: 'button', disabled: busy, onClick: () => { setReauthenticate(true); setMessage('') }, style: secondaryButtonStyle }, '重新验证邮箱'),
             h('button', { type: 'button', disabled: busy, onClick: () => { if (window.confirm('断开当前设备与 ANT 的连接？本机 ANT 凭证和模型设置将被清除，团队服务地址会保留。')) void disconnect() }, style: secondaryButtonStyle }, '断开当前设备')) : null,
-          credentialConfigured === true && !showConnectForm ? h('section', { style: { ...panelStyle, padding: 14, gap: 10 } },
+          h('section', { style: { ...panelStyle, padding: 14, gap: 10 } },
             h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', gap: 12 } },
               h('h4', { style: { margin: 0, fontSize: 14, fontWeight: 650 } }, 'ANT 插件更新'),
-              h('button', { type: 'button', disabled: busy || bundleUpdate.state === 'checking', onClick: () => void checkBundleUpdate(), style: secondaryButtonStyle }, bundleUpdate.state === 'checking' ? '检查中…' : '检查更新')),
-            bundleUpdate.message ? h('p', { role: 'status', style: mutedTextStyle }, bundleUpdate.message) : null,
-            bundleRelease?.version && bundleUpdate.state === 'available' ? h('div', { style: { display: 'grid', gap: 8 } },
+              h('button', { type: 'button', disabled: busy || !canCheckUpdate || bundleUpdate.state === 'checking', onClick: () => void checkBundleUpdate(), style: secondaryButtonStyle }, bundleUpdate.state === 'checking' ? '检查中…' : '检查更新')),
+            !canCheckUpdate ? h('p', { role: 'status', style: mutedTextStyle }, '连接团队后可在这里检查并安装 ANT 更新；需要先恢复插件时，可打开团队管理台的更新指引。') : null,
+            updateGuideUrl ? h('a', { href: updateGuideUrl, target: '_blank', rel: 'noopener noreferrer', style: { color: 'var(--dsw-alias-link)', fontSize: 13 } }, `打开 ${pinnedServiceUrl} 的更新指引 ↗`)
+              : !canCheckUpdate ? h('p', { style: mutedTextStyle }, '无法核对原团队地址时，请向企业管理员索取更新指引。') : null,
+            bundleUpdate.message ? h('p', { role: 'status', style: bundleUpdate.state === 'revoked'
+              ? { ...mutedTextStyle, color: 'var(--dsw-alias-state-error-primary)' } : mutedTextStyle }, bundleUpdate.message) : null,
+            canCheckUpdate && bundleRelease?.version && ['available', 'artifact-missing'].includes(bundleUpdate.state) ? h('div', { style: { display: 'grid', gap: 8 } },
               h('p', { style: mutedTextStyle }, `发布版本：${bundleRelease.version} · 精确包名：${directInstallSpec(bundleRelease)}`),
               bundleRelease.release_notes ? h('p', { style: mutedTextStyle }, bundleRelease.release_notes) : null,
-              h('p', { style: mutedTextStyle }, 'ANT 暂停一键安装更新：当前 DSH 无法在执行安装脚本前核对审核制品。请联系团队管理员确认升级方式。')) : null) : null,
+              bundleUpdate.state === 'available'
+                ? h('button', { type: 'button', disabled: busy, onClick: () => void installBundleUpdate(), style: primaryButtonStyle }, busy ? '更新中…' : '更新 ANT') : null) : null),
           showConnectForm ? h('form', { onSubmit: requestCode, style: { display: 'grid', gap: 9, maxWidth: 560 } },
             h('label', { htmlFor: 'ant-team-model-email', style: { fontSize: 13, fontWeight: 550 } }, '工作邮箱'),
             h('input', {
@@ -822,6 +1069,20 @@ window.__ModuleLoader__.load({
 
     }
 
+    function EnterpriseExtensionsPanelIcon({ size }) {
+      return h('span', { 'aria-hidden': true, style: {
+        display: 'inline-grid', placeItems: 'center', width: size, height: size,
+        fontSize: size, lineHeight: 1,
+      } }, '✦')
+    }
+
+    function EnterpriseExtensionsPage({ remote, onBack, openBundle }) {
+      const [tab, setTab] = useState('skills')
+      return tab === 'skills'
+        ? h(SkillCenterPage, { onBack, onPlugins: () => setTab('plugins') })
+        : h(PluginCenterPage, { remote, onBack, onSkills: () => setTab('skills'), openBundle })
+    }
+
     function apply(ctx) {
       const remote = {
         credentials: ctx.remote.credentials,
@@ -829,17 +1090,14 @@ window.__ModuleLoader__.load({
         pluginManager: ctx.remote.pluginManager,
       }
       ctx.slots.inject('main', () => ctx.slots.register({ name: 'main', key: 'ant-skills' },
-        () => h(SkillCenterPage, {
-          onBack: () => ctx.pluginNavigation.openBundle(ANT_BUNDLE_PACKAGE_NAME),
-          onPlugins: () => ctx.layout.selectPanel('ant-plugins'),
-        })))
-      ctx.slots.inject('main', () => ctx.slots.register({ name: 'main', key: 'ant-plugins' },
-        () => h(PluginCenterPage, {
+        () => h(EnterpriseExtensionsPage, {
           remote,
           onBack: () => ctx.pluginNavigation.openBundle(ANT_BUNDLE_PACKAGE_NAME),
-          onSkills: () => ctx.layout.selectPanel('ant-skills'),
           openBundle: (name) => ctx.pluginNavigation.openBundle(name),
         })))
+      ctx.slots.inject('sidebar.panellist', () => ctx.slots.register({
+        name: 'sidebar.panellist', id: 'ant-skills', order: 5, label: '企业扩展',
+      }, EnterpriseExtensionsPanelIcon))
       ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({
           name: 'plugins.bundle.config',
           key: ANT_BUNDLE_PACKAGE_NAME,
@@ -848,8 +1106,7 @@ window.__ModuleLoader__.load({
           ? h('p', null, 'ANT 团队服务入口。')
           : h(TeamServiceConfig, {
             remote: injectedRemote,
-            openSkillCenter: () => ctx.layout.selectPanel('ant-skills'),
-            openPluginCenter: () => ctx.layout.selectPanel('ant-plugins'),
+            openInstalledPlugin: (name) => ctx.pluginNavigation.openBundle(name),
           })))
     }
 

package/index.js

@@ -8,6 +8,7 @@ export const inject = []
 const MODEL_SYNC_PATH = '/api/ant-teams/models'
 const SERVICE_INFO_PATH = '/api/ant-teams/service-info'
 const BUNDLE_RELEASE_PATH = '/api/ant-teams/bundle-release'
+const CONNECTION_ORIGIN_PATH = '/api/ant-teams/connection-origin'
 const DISCONNECT_PATH = '/api/ant-teams/disconnect'
 const REQUEST_CODE_PATH = '/api/ant-teams/request-code'
 const CONNECT_PATH = '/api/ant-teams/connect'
@@ -292,19 +293,37 @@ async function fetchBundleRelease(request, credentials, settings) {
     const directInstallSpec = release?.package_name && release?.version
       ? `${release.package_name}@${release.version}`
       : ''
+    const artifactPath = release?.version ? `/api/ant-bundles/${release.version}/package.tgz` : ''
+    const hasArtifact = release?.artifact_path === artifactPath
+      && /^[a-f0-9]{64}$/u.test(release?.artifact_sha256 || '')
+    const noArtifact = !release?.artifact_path && !release?.artifact_sha256
     if (release?.bundle_name !== 'ant' || !validPackageName || !validVersion
       || typeof release?.install_spec !== 'string' || typeof release?.release_notes !== 'string'
       || (release.version && release.install_spec !== installSpec)
       || (!release.version && release.install_spec !== '')
-      || (release.direct_install_spec !== undefined && release.direct_install_spec !== directInstallSpec)) {
+      || (release.direct_install_spec !== undefined && release.direct_install_spec !== directInstallSpec)
+      || (!hasArtifact && !noArtifact)) {
       return jsonResponse(502, { message: 'ANT 更新信息字段无效。' })
     }
-    return jsonResponse(200, release)
+    return jsonResponse(200, hasArtifact ? {
+      ...release,
+      artifact_url: new URL(artifactPath, connection.serviceUrl).href,
+    } : release)
   } catch {
     return jsonResponse(502, { message: '无法连接 ANT 更新服务。' })
   }
 }
 
+async function fetchConnectionOrigin(request, credentials, settings) {
+  if (request.method !== 'GET') return jsonResponse(405, { message: '只支持 GET 请求' })
+  try {
+    const connection = await readMemberConnection(credentials, settings)
+    return jsonResponse(200, { service_url: connection?.serviceUrl || null })
+  } catch {
+    return jsonResponse(500, { message: '无法核对已绑定的 ANT 团队地址。' })
+  }
+}
+
 async function disconnectMember(request, credentials, settings) {
   if (request.method !== 'POST') return jsonResponse(405, { message: '只支持 POST 请求' })
   let connection
@@ -397,7 +416,17 @@ async function fetchMemberPlugins(request, credentials, settings) {
       { message: '无法读取企业精选插件目录。' })
     const plugins = JSON.parse(text)
     if (!Array.isArray(plugins)) throw new Error('插件目录格式无效。')
-    return jsonResponse(200, { plugins })
+    return jsonResponse(200, { plugins: plugins.map((plugin) => {
+      const validId = typeof plugin?.id === 'string'
+        && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/iu.test(plugin.id)
+      const validDigest = /^[0-9a-f]{64}$/u.test(plugin?.artifact_sha256 || '')
+      if (plugin?.status !== 'published' || !validId || !validDigest) {
+        return { ...plugin, artifact_sha256: null }
+      }
+      const artifactPath = `/api/plugin-artifacts/${plugin.id}/package.tgz`
+      return { ...plugin, artifact_path: artifactPath,
+        artifact_url: new URL(artifactPath, connection.serviceUrl).href }
+    }) })
   } catch {
     return jsonResponse(502, { message: '无法读取企业精选插件目录。' })
   }
@@ -505,6 +534,12 @@ export function apply(ctx) {
       requestBody: 'buffered',
       fetch: (request) => fetchBundleRelease(request, connectionCtx.credentials, connectionCtx.settings),
     }), 'ant-teams: authenticated Bundle release relay')
+    connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+      path: CONNECTION_ORIGIN_PATH,
+      methods: ['GET'],
+      requestBody: 'buffered',
+      fetch: (request) => fetchConnectionOrigin(request, connectionCtx.credentials, connectionCtx.settings),
+    }), 'ant-teams: pinned connection origin for update guide')
     connectionCtx.effect(() => connectionCtx.connection.fetch.register({
       path: SKILLS_PATH, methods: ['GET'], requestBody: 'buffered',
       fetch: (request) => fetchMemberSkills(request, connectionCtx.credentials, connectionCtx.settings),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-wendao/ant",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "description": "ANT (AI-native Teams) connects a DeepSeek Harness Desktop profile to team identity and approved models.",
   "type": "module",
   "scripts": {