@ai-wendao/ant 0.3.13 → 0.3.15

package/README.md

@@ -6,15 +6,17 @@ ANT (AI-native Teams) connects a DeepSeek Harness Desktop profile to its team's
 
 ## 企业精选技能
 
-团队管理员可在 ANT 管理台从 GitHub 目录、ZIP、TAR、TAR.GZ／TGZ 或单份 `SKILL.md` 导入技能，核对来源、文件和依赖后发布。已连接团队的成员在 DSH 的 ANT 插件设置页点击“打开扩展中心”，进入“技能”页面浏览并安装。ANT Host 将固定版本的完整文件集放进 DSH 的用户技能目录，并重新核对本机文件；启用本地技能的 DSH 会话随后由原生技能提供者发现和使用。ANT 不用 Host 全局技能列表判断会话是否已发现技能。
+团队管理员可在 ANT 管理台从 GitHub 目录、ZIP、TAR、TAR.GZ／TGZ 或单份 `SKILL.md` 导入技能，核对来源、文件和依赖后发布。已连接团队的成员从 DSH 左侧“企业扩展”入口进入独立页面浏览并安装技能；ANT 插件设置页只处理连接、模型和更新。ANT Host 将固定版本的完整文件集放进 DSH 的用户技能目录，并重新核对本机文件；启用本地技能的 DSH 会话随后由原生技能提供者发现和使用。ANT 不用 Host 全局技能列表判断会话是否已发现技能。
 
 安装不会自动运行技能脚本或安装 Python、Node 等系统依赖。ANT 只更新或卸载自己管理且本机内容未被修改的技能目录；发现同名个人技能或本机改动时会停止覆盖。
 
 ## 企业精选插件
 
-管理员可从 npm 官方源的 DSH Bundle 精确版本创建草稿，填写源码、许可证、依赖和安装脚本的审核记录后发布。成员在“扩展中心 → 插件”查看审核信息和本机状态。当前 DSH RC2 无法让 ANT 在安装脚本运行前确认实际下载制品与审核制品一致，因此插件一键安装暂停；需要使用时请联系企业管理员安排。安全撤回版本会在扩展中心标明；本机安装受影响版本或无法读取本机版本时，ANT 设置页也显示相应风险公告。
+管理员可从 npm 官方源的 DSH Bundle 精确版本创建草稿，填写源码、许可证、依赖和安装脚本的审核记录后发布。成员在“企业扩展 → 插件”查看审核信息和本机状态。对无新增依赖、无安装阶段脚本且归档符合首批准入条件的草稿，管理员可从 npm 官方源锁定实际 `.tgz` 并查看文件清单、下载核验制品；这类草稿经审核发布后，成员可让 DSH 从 ANT 的固定制品地址一键安装。其他版本仍是目录项，需联系管理员安排。安全撤回版本会停止新的 ANT 下载，但不会自动删除本机副本；ANT 设置页继续显示相应风险公告。范围与限制见[上线边界](../../docs/decisions/2026-10-15-plugin-center-rollout.md)。
 
-企业精选是团队推荐目录，不是强制白名单；ANT 不能阻止成员从 DSH 原生插件管理页自行安装其他包。当前 DSH RC2 接口无法让 ANT 强制校验成员安装的包字节与审核时的摘要一致，也不能保证 profile 的依赖范围始终为精确版本；上线边界见 [待决策记录](../../docs/decisions/2026-10-15-plugin-center-rollout.md)。
+ANT 自身更新使用单独的已审核安装包。管理员将与 npm 发布一致的 `.tgz` 上传到 ANT 服务端并登记版本；新版 ANT 页面可点击“更新”，DSH 原位替换同名 Bundle 后提示重启。旧版 `@ai-wendao/ant` 用户可打开团队服务的 `/ant-update` 指引，在 DSH“添加插件”中粘贴该安装包地址完成一次性原位更新，无需先卸载或使用终端。此入口只分发 ANT 自身，不启用扩展中心其他插件的一键安装。
+
+企业精选是团队推荐目录，不是强制白名单；ANT 不能阻止成员从 DSH 原生插件管理页自行安装其他包。第一批一键安装只分发 ANT 已核验并保存的顶层包，不把有依赖或安装脚本的版本伪装成已受控；DSH RC2 后续包管理能否一直保留这一固定制品仍需真机验收。上线边界见[待决策记录](../../docs/decisions/2026-10-15-plugin-center-rollout.md)。
 
 ## Existing `ant` alias installations
 

package/client.js

@@ -3,12 +3,13 @@ window.__ModuleLoader__.load({
   factory: (require) => {
     var module = { exports: {} }
     var exports = module.exports
-    const { createElement, useEffect, useState } = require('react')
+    const { createElement, useEffect, useRef, useState } = require('react')
     const h = createElement
     const SERVICE_URL_STORAGE_KEY = 'ant-team-service-url'
     const DEVICE_ID_STORAGE_KEY = 'ant-team-device-id'
     const ANT_BUNDLE_PACKAGE_NAME = '@ai-wendao/ant'
     const ANT_API_PROTOCOL_VERSIONS = [1]
+    const PLUGIN_INSTALL_RECORD_PREFIX = 'ant-reviewed-plugin-install:'
     const fileCountFormat = new Intl.NumberFormat('zh-CN')
     const panelStyle = {
       display: 'grid', alignContent: 'start', gap: 14, padding: 18,
@@ -33,14 +34,15 @@ window.__ModuleLoader__.load({
       border: '0.5px solid var(--dsw-alias-border-l2)', borderRadius: 8,
       cursor: 'pointer',
     }
+    const categoryButtonStyle = { ...secondaryButtonStyle, minHeight: 34, padding: '6px 12px', whiteSpace: 'nowrap' }
     function ExtensionRequestNotice() {
       return h('aside', { role: 'note', style: {
-        ...panelStyle,
-        borderColor: 'var(--dsw-alias-state-business-primary)',
-        gap: 5,
+        display: 'flex', alignItems: 'baseline', gap: 8, padding: '9px 12px',
+        borderRadius: 8, backgroundColor: 'var(--dsw-alias-bg-layer-2)',
+        color: 'var(--dsw-alias-label-secondary)', fontSize: 13, lineHeight: 1.6,
       } },
-        h('h2', { style: { margin: 0, fontSize: 16 } }, '没有找到想用的技能或插件？'),
-        h('p', { style: mutedTextStyle }, '请联系企业管理员，说明你希望完成的任务或提供扩展地址。管理员审核后会将合适的版本加入扩展中心。技能可在这里安装；插件请由管理员安排，勿自行安装未经审核的扩展。'))
+        h('strong', { style: { flexShrink: 0, color: 'var(--dsw-alias-label-primary)' } }, '提示'),
+        h('span', null, '没有找到想用的扩展，或插件没有安装按钮？联系企业管理员，说明用途或提供地址。已开放的扩展可直接安装；未经审核的版本请勿自行安装。'))
     }
     const normalizeServiceUrl = (value) => {
       let url
@@ -97,6 +99,35 @@ window.__ModuleLoader__.load({
         : ''
     }
 
+    function approvedArtifactUrl(release) {
+      const expectedPath = `/api/ant-bundles/${release?.version}/package.tgz`
+      let url
+      try { url = new URL(release?.artifact_url) } catch { return null }
+      return normalizeServiceUrl(url.origin) === url.origin
+        && !url.username && !url.password && !url.search && !url.hash
+        && url.pathname === expectedPath && release?.artifact_path === expectedPath
+        && /^[a-f0-9]{64}$/u.test(release?.artifact_sha256 || '')
+        ? url.href : null
+    }
+
+    function approvedPluginArtifactUrl(plugin) {
+      if (plugin?.status !== 'published' || typeof plugin.id !== 'string'
+        || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/iu.test(plugin.id)) return null
+      const expectedPath = `/api/plugin-artifacts/${plugin.id}/package.tgz`
+      let url
+      try { url = new URL(plugin.artifact_url) } catch { return null }
+      return normalizeServiceUrl(url.origin) === url.origin
+        && !url.username && !url.password && !url.search && !url.hash
+        && url.pathname === expectedPath && plugin.artifact_path === expectedPath
+        && /^[a-f0-9]{64}$/u.test(plugin.artifact_sha256 || '')
+        ? url.href : null
+    }
+
+    function previouslyInstalledReviewedPlugin(plugin) {
+      try { return localStorage.getItem(`${PLUGIN_INSTALL_RECORD_PREFIX}${plugin.id}`) === plugin.artifact_sha256 }
+      catch { return false }
+    }
+
     function loadServiceUrl() {
       try { return normalizeServiceUrl(localStorage.getItem(SERVICE_URL_STORAGE_KEY) || '') || '' } catch { return '' }
     }
@@ -116,11 +147,41 @@ window.__ModuleLoader__.load({
       return deviceId
     }
 
-    function TeamServiceConfig({ remote, openSkillCenter, openPluginCenter }) {
+    function TeamServiceConfig({ remote, openInstalledPlugin }) {
       const [serviceUrl, setServiceUrl] = useState(loadServiceUrl)
       const [draft, setDraft] = useState(serviceUrl)
+      const [binding, setBinding] = useState({ state: 'checking', url: null })
+      const bindingRevision = useRef(0)
       const [message, setMessage] = useState('')
       const [pluginAlerts, setPluginAlerts] = useState([])
+      useEffect(() => {
+        let disposed = false
+        const revision = bindingRevision.current
+        const current = () => !disposed && bindingRevision.current === revision
+        const inspectBinding = async () => {
+          try {
+            const response = await fetch('/api/ant-teams/connection-origin', { cache: 'no-store' })
+            const result = await readLocalJsonResponse(response)
+            if (!response.ok) throw new Error()
+            const pinned = result.service_url == null ? null : normalizeServiceUrl(result.service_url)
+            if (result.service_url != null && !pinned) throw new Error()
+            if (pinned) {
+              if (current()) {
+                setBinding({ state: 'ready', url: pinned })
+                setServiceUrl(pinned)
+                setDraft(pinned)
+                try { localStorage.setItem(SERVICE_URL_STORAGE_KEY, pinned) } catch {}
+              }
+              return
+            }
+            const described = await remote?.credentials?.describe?.(['ANT_MODEL_API_KEY'])
+            if (!described?.ok) throw new Error()
+            if (current()) setBinding({ state: described.value?.ANT_MODEL_API_KEY?.configured ? 'unverified' : 'ready', url: null })
+          } catch { if (current()) setBinding({ state: 'error', url: null }) }
+        }
+        void inspectBinding()
+        return () => { disposed = true }
+      }, [remote])
       useEffect(() => {
         let disposed = false
         const inspect = async () => {
@@ -145,6 +206,10 @@ window.__ModuleLoader__.load({
       }, [remote])
       const save = (event) => {
         event.preventDefault()
+        if (binding.state !== 'ready' || binding.url) {
+          setMessage(binding.url ? '当前已连接团队；切换前请先在下方断开当前设备。' : '尚未核对这台 DSH 的团队绑定，不能修改地址。')
+          return
+        }
         const normalized = normalizeServiceUrl(draft)
         if (!normalized) {
           setMessage('请输入 HTTPS 团队服务地址；本机测试可使用 localhost。')
@@ -159,39 +224,50 @@ window.__ModuleLoader__.load({
           setMessage('浏览器无法保存此地址，请检查本地存储权限。')
         }
       }
-      const link = consoleUrl(serviceUrl)
+      const link = binding.state === 'ready' ? consoleUrl(binding.url || serviceUrl) : null
+      const onConnectionChange = (url) => {
+        bindingRevision.current += 1
+        setBinding({ state: 'ready', url: url || null })
+        if (url) {
+          setServiceUrl(url)
+          setDraft(url)
+          try { localStorage.setItem(SERVICE_URL_STORAGE_KEY, url) } catch {}
+        }
+      }
       return h('section', { style: { display: 'grid', gap: 16, width: '100%', maxWidth: 1120 } },
         h('p', { style: mutedTextStyle }, '连接团队服务后，即可同步获准模型并使用团队协作。'),
         h('section', { style: panelStyle },
           h('div', null,
             h('h3', { style: { margin: 0, fontSize: 16, fontWeight: 650 } }, '团队服务'),
             h('p', { style: { ...mutedTextStyle, marginTop: 4 } }, '由团队管理员提供服务地址；管理员可在控制台管理成员、模型和协作设置。')),
-          h('form', { onSubmit: save, style: { display: 'grid', gridTemplateColumns: 'minmax(0, 1fr) auto', alignItems: 'end', gap: 10 } },
-          h('label', { htmlFor: 'ant-team-service-url', style: { gridColumn: '1 / -1', fontSize: 13, fontWeight: 550 } }, '服务地址'),
+          h('form', { onSubmit: save, style: { display: 'grid', gridTemplateColumns: binding.url ? '1fr' : 'minmax(0, 1fr) auto', alignItems: 'end', gap: 10 } },
+          h('label', { htmlFor: 'ant-team-service-url', style: { gridColumn: '1 / -1', fontSize: 13, fontWeight: 550 } }, binding.url ? '当前连接的团队服务地址' : '服务地址'),
           h('input', {
             id: 'ant-team-service-url',
             type: 'url',
             required: true,
-            value: draft,
+            value: binding.url || draft,
+            readOnly: binding.state !== 'ready' || Boolean(binding.url),
             placeholder: 'https://ant.example.com',
-            onChange: (event) => setDraft(event.target.value),
+            onChange: (event) => { if (binding.state === 'ready' && !binding.url) setDraft(event.target.value) },
             style: inputStyle,
           }),
-          h('button', { type: 'submit', style: primaryButtonStyle }, '保存地址')),
+          binding.url ? null : h('button', { type: 'submit', disabled: binding.state !== 'ready', style: primaryButtonStyle }, '保存地址')),
+          binding.url ? h('p', { style: mutedTextStyle }, '若要切换团队，请先在下方断开当前设备，再填写新地址并验证邮箱。') : null,
+          binding.state === 'checking' ? h('p', { role: 'status', style: mutedTextStyle }, '正在核对这台 DSH 绑定的团队…') : null,
+          binding.state === 'unverified' ? h('p', { role: 'status', style: mutedTextStyle }, '本机仍有 ANT 凭证，但无法核对所属团队。请联系原团队管理员核查并撤销旧设备；确认后可在下方断开或仅清理本机。') : null,
+          binding.state === 'error' ? h('p', { role: 'status', style: mutedTextStyle }, '暂时无法核对这台 DSH 的团队绑定，请重新打开 ANT 或联系管理员。') : null,
           h('div', { style: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 12 } },
             message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null,
             link ? h('a', { href: link, target: '_blank', rel: 'noopener noreferrer', style: { color: 'var(--dsw-alias-link)', fontSize: 13 } }, '打开团队管理 ↗') : null)),
-        h('section', { style: { ...panelStyle, display: 'flex', flexWrap: 'wrap', alignItems: 'center', justifyContent: 'space-between' } },
-          h('div', null,
-            h('h3', { style: { margin: 0, fontSize: 16, fontWeight: 650 } }, '企业精选扩展'),
-            h('p', { style: { ...mutedTextStyle, marginTop: 4 } }, '浏览团队审核发布的技能与插件；技能可在这里安装，插件安全安装暂未开放。没有找到需要的扩展时，请联系企业管理员上架。')),
-          h('button', { type: 'button', onClick: openSkillCenter, style: primaryButtonStyle }, '打开扩展中心 →')),
         pluginAlerts.length ? h('section', { role: 'alert', style: { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } },
           h('h3', { style: { margin: 0, fontSize: 16 } }, '已安装插件存在安全撤回公告'),
           ...pluginAlerts.map((plugin) => h('p', { key: plugin.id, style: mutedTextStyle },
             `${plugin.title} ${plugin.version}${plugin.versionUnknown ? '（本机版本暂无法读取，请核对是否受影响）' : ''}：${plugin.withdrawal_reason}`)),
-          h('button', { type: 'button', onClick: openPluginCenter, style: secondaryButtonStyle }, '查看插件并打开 DSH 管理 →')) : null,
-        h(ModelSyncFooter, { remote, serviceUrl, onServiceUrlChange: setServiceUrl }))
+          ...pluginAlerts.map((plugin) => h('button', { key: `${plugin.id}-open`, type: 'button',
+            onClick: () => openInstalledPlugin(plugin.package_name), style: secondaryButtonStyle }, `在 DSH 中查看 ${plugin.title}`))) : null,
+        h(ModelSyncFooter, { remote, serviceUrl, bindingReady: binding.state === 'ready',
+          onServiceUrlChange: setServiceUrl, onConnectionChange }))
     }
 
     function SkillCenterPage({ onBack, onPlugins }) {
@@ -250,9 +326,11 @@ window.__ModuleLoader__.load({
         height: '100%', overflowY: 'auto', boxSizing: 'border-box',
         padding: 'calc(var(--dsh-frame-top-clearance, 0px) + 20px) clamp(16px, 3vw, 36px) 48px',
       } }, h('div', { style: { maxWidth: 1440, margin: '0 auto', display: 'grid', gap: 22 } },
-        h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
-          h('button', { type: 'button', onClick: onBack, style: secondaryButtonStyle }, '← 返回 ANT 插件设置'),
-          h('button', { type: 'button', onClick: onPlugins, style: secondaryButtonStyle }, '查看企业精选插件 →')),
+        h('div', { style: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8 } },
+          h('nav', { 'aria-label': '企业扩展分类', style: { display: 'flex', gap: 6 } },
+            h('span', { 'aria-current': 'page', style: { ...categoryButtonStyle, display: 'inline-flex', alignItems: 'center', cursor: 'default', backgroundColor: 'var(--dsw-alias-bg-layer-2)' } }, '技能'),
+            h('button', { type: 'button', onClick: onPlugins, style: categoryButtonStyle }, '插件')),
+          h('button', { type: 'button', onClick: onBack, style: { ...categoryButtonStyle, marginLeft: 'auto' } }, 'ANT 设置')),
         h('div', { style: { display: 'flex', flexWrap: 'wrap', alignItems: 'end', justifyContent: 'space-between', gap: 16 } },
           h('div', null,
             h('h1', { style: { margin: 0, fontSize: 28 } }, '企业精选技能'),
@@ -283,9 +361,9 @@ window.__ModuleLoader__.load({
               skill.local_status === 'conflict'
                 ? h('p', { role: 'status', style: mutedTextStyle }, '本机同名技能有未受 ANT 管理的内容、文件已被修改或备份损坏；请联系管理员处理。')
                 : h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8, marginTop: 'auto' } },
-                    h('button', { type: 'button', disabled: Boolean(workingId) || skill.local_status === 'installed',
+                    skill.local_status === 'installed' ? null : h('button', { type: 'button', disabled: Boolean(workingId),
                       onClick: () => void changeInstall(skill), style: primaryButtonStyle },
-                    skill.local_status === 'installed' ? '文件已安装' : skill.local_status === 'update-available' ? '更新技能' : '安装到这台 DSH'),
+                    skill.local_status === 'update-available' ? '更新技能' : '安装到这台 DSH'),
                     skill.local_status !== 'not-installed' ? h('button', { type: 'button', disabled: Boolean(workingId),
                       onClick: () => void changeInstall(skill, true), style: secondaryButtonStyle }, '卸载') : null))
           })) : !loading && skills.length ? h('p', { style: mutedTextStyle }, '没有符合筛选条件的技能。') : null))
@@ -294,7 +372,11 @@ window.__ModuleLoader__.load({
     function PluginCenterPage({ remote, onBack, onSkills, openBundle }) {
       const [plugins, setPlugins] = useState([])
       const [bundles, setBundles] = useState([])
-      const [loading, setLoading] = useState(false)
+      const [loading, setLoading] = useState(true)
+      const [loadError, setLoadError] = useState(false)
+      const [workingId, setWorkingId] = useState('')
+      const [uncertainId, setUncertainId] = useState('')
+      const [completedId, setCompletedId] = useState('')
       const [message, setMessage] = useState('')
       const [query, setQuery] = useState('')
       const [filter, setFilter] = useState('all')
@@ -312,53 +394,150 @@ window.__ModuleLoader__.load({
           if (!listed.ok) throw new Error(listed.error?.message || '无法读取 DSH 本机插件。')
           setPlugins(result.plugins)
           setBundles(listed.value)
+          setLoadError(false)
           setMessage(result.plugins.length ? '' : '团队暂未发布精选插件。')
         } catch (error) {
           setPlugins([])
           setBundles([])
+          setLoadError(true)
           setMessage(error instanceof Error ? error.message : '无法读取企业精选插件。')
         } finally { setLoading(false) }
       }
       useEffect(() => { void refresh() }, [])
+      const install = async (plugin) => {
+        const artifactUrl = approvedPluginArtifactUrl(plugin)
+        if (!artifactUrl || workingId || uncertainId === plugin.id || completedId === plugin.id) return
+        const manager = remote?.pluginManager
+        if (typeof manager?.installBundle !== 'function') {
+          setMessage('当前 DSH 未提供插件安装接口，请联系管理员。')
+          return
+        }
+        const local = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
+        const action = local ? local.version === plugin.version ? '重新安装' : '更新' : '安装'
+        if (!window.confirm(`在这台 DSH ${action}团队审核的 ${plugin.title} ${plugin.version}？插件将在本机运行，完成后需要完全重启 DSH。`)) return
+        setWorkingId(plugin.id)
+        setMessage(`正在安装 ${plugin.title}，请不要退出 DSH…`)
+        try {
+          const response = await fetch('/api/ant-teams/plugins', { cache: 'no-store' })
+          const catalog = await readLocalJsonResponse(response)
+          const latest = Array.isArray(catalog?.plugins)
+            ? catalog.plugins.find((item) => item.id === plugin.id) : null
+          if (!response.ok || latest?.package_name !== plugin.package_name
+            || latest?.version !== plugin.version || latest?.artifact_sha256 !== plugin.artifact_sha256
+            || approvedPluginArtifactUrl(latest) !== artifactUrl) {
+            throw new Error('插件审核信息已变化，请刷新目录后重试。')
+          }
+          const requestId = crypto.randomUUID()
+          let result
+          try { result = await manager.installBundle(artifactUrl, { enabled: true, requestId }) }
+          catch { result = null }
+          if (!result?.ok) {
+            let recovered = null
+            if (typeof manager.waitForInstall === 'function') {
+              try {
+                const pending = await manager.waitForInstall(requestId)
+                if (pending.ok && pending.value) recovered = { ok: true, value: pending.value }
+              } catch {}
+            }
+            if (!recovered) {
+              setUncertainId(plugin.id)
+              setMessage(`暂时无法确认 ${plugin.title} 的安装结果。请先在 DSH 插件列表核对，勿重复点击安装。`)
+              return
+            }
+            result = recovered
+          }
+          const outcome = result.value
+          if (!outcome || typeof outcome !== 'object') {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未返回 ${plugin.title} 的安装结果。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          if (outcome.application === 'failed' || outcome.application === 'cancelled') {
+            if (outcome.error?.code === 'ambiguous-install' && local?.version === plugin.version) {
+              setMessage(`DSH 无法确定 ${plugin.title} 本次安装的唯一结果，未确认完成。请先在 DSH 插件列表核对；若已经正常使用同版则无需重复安装，仍需核对来源时请联系管理员。`)
+              return
+            }
+            const diagnostic = typeof outcome.error?.diagnostic === 'string'
+              ? outcome.error.diagnostic.slice(0, 180) : ''
+            setMessage(`${plugin.title} 安装未完成。请在 DSH 插件管理查看状态或联系管理员。${diagnostic ? `原因：${diagnostic}` : ''}`)
+            return
+          }
+          if (outcome.bundle !== plugin.package_name
+            || !['restart-required', 'applied'].includes(outcome.application)) {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未确认 ${plugin.title} 已安装。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          let observed = null
+          try {
+            const installed = await manager.listBundles()
+            if (installed.ok && Array.isArray(installed.value)) {
+              observed = installed.value.find((bundle) => bundle.name === plugin.package_name && bundle.installed) || null
+            }
+          } catch {}
+          if ((outcome.version && outcome.version !== plugin.version) || observed?.version !== plugin.version) {
+            setUncertainId(plugin.id)
+            setMessage(`DSH 未确认 ${plugin.title} 的审核版本已安装。请先在插件列表核对，勿重复点击安装。`)
+            return
+          }
+          await refresh()
+          try { localStorage.setItem(`${PLUGIN_INSTALL_RECORD_PREFIX}${plugin.id}`, plugin.artifact_sha256) } catch {}
+          setCompletedId(plugin.id)
+          setMessage(`${plugin.title} 已安装。请完全退出并重新启动 DSH 后使用。`)
+        } catch (error) {
+          setMessage(error instanceof Error ? error.message : '插件安装未完成，请稍后重试。')
+        } finally { setWorkingId('') }
+      }
       const visible = plugins.filter((plugin) => {
         const installed = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
+        const artifactUrl = approvedPluginArtifactUrl(plugin)
         const matches = !query.trim() || `${plugin.title} ${plugin.description} ${plugin.package_name}`.toLowerCase().includes(query.trim().toLowerCase())
-        return matches && (filter === 'all' || filter === 'installed' && installed?.version === plugin.version
-          || filter === 'available' && plugin.status === 'published' && !installed
+        return matches && (filter === 'all' || filter === 'installed' && Boolean(installed)
+          || filter === 'available' && artifactUrl && (!installed || (installed.version && installed.version !== plugin.version))
           || filter === 'retired' && plugin.status !== 'published')
       })
       return h('section', { 'aria-label': '企业精选插件', style: {
         height: '100%', overflowY: 'auto', boxSizing: 'border-box',
         padding: 'calc(var(--dsh-frame-top-clearance, 0px) + 20px) clamp(16px, 3vw, 36px) 48px',
       } }, h('div', { style: { maxWidth: 1440, margin: '0 auto', display: 'grid', gap: 22 } },
-        h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
-          h('button', { type: 'button', onClick: onBack, style: secondaryButtonStyle }, '← 返回 ANT 插件设置'),
-          h('button', { type: 'button', onClick: onSkills, style: secondaryButtonStyle }, '查看企业精选技能 →')),
+        h('div', { style: { display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: 8 } },
+          h('nav', { 'aria-label': '企业扩展分类', style: { display: 'flex', gap: 6 } },
+            h('button', { type: 'button', onClick: onSkills, style: categoryButtonStyle }, '技能'),
+            h('span', { 'aria-current': 'page', style: { ...categoryButtonStyle, display: 'inline-flex', alignItems: 'center', cursor: 'default', backgroundColor: 'var(--dsw-alias-bg-layer-2)' } }, '插件')),
+          h('button', { type: 'button', onClick: onBack, style: { ...categoryButtonStyle, marginLeft: 'auto' } }, 'ANT 设置')),
         h('div', { style: { display: 'flex', flexWrap: 'wrap', justifyContent: 'space-between', gap: 16 } },
           h('div', null,
             h('h1', { style: { margin: 0, fontSize: 28 } }, '企业精选插件'),
             h('p', { style: { ...mutedTextStyle, marginTop: 6 } }, '这里展示团队审核过的插件版本及本机状态。')),
           h('button', { type: 'button', disabled: loading, onClick: () => void refresh(), style: secondaryButtonStyle }, loading ? '读取中…' : '刷新目录')),
-        h('aside', { role: 'note', style: { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } },
-          h('strong', null, '插件一键安装暂未开放'),
-          h('p', { style: mutedTextStyle }, '当前 DSH 无法让 ANT 在运行代码前核对实际下载的插件及其依赖。需要使用某个插件时，请联系企业管理员安排审核与安全安装；请勿自行从其他来源安装。')),
-        h(ExtensionRequestNotice),
-        h('div', { style: panelStyle },
+        !loading && !plugins.length && !loadError ? h('section', { role: 'status', style: panelStyle },
+          h('h2', { style: { margin: 0, fontSize: 18 } }, '团队暂未发布精选插件'),
+          h('p', { style: mutedTextStyle }, '需要某个插件？请联系企业管理员，说明用途或提供插件地址。审核发布后会显示在这里。')) : null,
+        !loading && loadError ? h('p', { role: 'alert', style: mutedTextStyle }, message) : null,
+        plugins.length ? h(ExtensionRequestNotice) : null,
+        plugins.length ? h('div', { style: panelStyle },
           h('input', { type: 'search', value: query, onChange: (event) => setQuery(event.target.value), placeholder: '搜索插件名称或用途', 'aria-label': '搜索企业精选插件', style: inputStyle }),
           h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
-            ...[['all', '全部'], ['available', '已审核'], ['installed', '已安装'], ['retired', '已废弃']].map(([value, label]) =>
+            ...[['all', '全部'], ['available', '可安装或升级'], ['installed', '已安装'], ['retired', '已废弃']].map(([value, label]) =>
               h('button', { key: value, type: 'button', onClick: () => setFilter(value), 'aria-pressed': filter === value,
-                style: { ...secondaryButtonStyle, minHeight: 34, backgroundColor: filter === value ? 'var(--dsw-alias-bg-layer-2)' : secondaryButtonStyle.backgroundColor } }, label)))),
-        message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null,
+                style: { ...secondaryButtonStyle, minHeight: 34, backgroundColor: filter === value ? 'var(--dsw-alias-bg-layer-2)' : secondaryButtonStyle.backgroundColor } }, label)))) : null,
+        plugins.length && message ? h('p', { role: 'status', style: mutedTextStyle }, message) : null,
         visible.length ? h('div', { style: { display: 'grid', gridTemplateColumns: 'repeat(auto-fit, minmax(min(100%, 420px), 1fr))', gap: 16 } },
           ...visible.map((plugin) => {
             const local = bundles.find((bundle) => bundle.name === plugin.package_name && bundle.installed)
             const sameVersion = local?.version === plugin.version
             const security = plugin.status === 'security_withdrawn'
+            const artifactUrl = approvedPluginArtifactUrl(plugin)
+            const sourceKnown = typeof local?.source === 'string'
+            const verifiedLocal = sameVersion && artifactUrl && sourceKnown && local.source === artifactUrl
+            const recordedInstall = sameVersion && !sourceKnown && previouslyInstalledReviewedPlugin(plugin)
             const status = security ? '已废弃（安全风险）'
-              : plugin.status === 'deprecated' ? '已废弃' : sameVersion
-                ? local.error ? '加载异常' : local.enabled ? '已安装（配置已启用）' : '已安装未启用'
-                : local ? `本机版本 ${local.version || '暂无法读取'}` : '已审核，等待安全安装'
+              : plugin.status === 'deprecated' ? '已废弃' : local?.error ? '加载异常' : sameVersion
+                ? verifiedLocal ? local.enabled ? '本机已装（团队来源，已启用）' : '本机已装（团队来源，未启用）'
+                  : sourceKnown ? '本机同版，来源不同' : recordedInstall
+                    ? '本机同版，曾由企业扩展安装；当前 DSH 无法复核来源' : '本机同版，当前 DSH 无法核对来源'
+                : artifactUrl ? local ? local.version ? `可更新 · 本机 ${local.version}` : '本机版本暂无法读取' : '可安装'
+                  : local ? `本机版本 ${local.version || '暂无法读取'}` : '已审核，暂需管理员安装'
             return h('article', { key: plugin.id, style: security
               ? { ...panelStyle, borderColor: 'var(--dsw-alias-label-danger, #d44)' } : panelStyle },
               h('div', { style: { display: 'flex', flexWrap: 'wrap', justifyContent: 'space-between', gap: 8 } },
@@ -374,16 +553,27 @@ window.__ModuleLoader__.load({
                 ? { ...mutedTextStyle, color: 'var(--dsw-alias-label-danger, #d44)' } : mutedTextStyle },
                 plugin.withdrawal_reason || '团队已停止推荐此版本。') : null,
               local?.error ? h('p', { role: 'status', style: mutedTextStyle }, local.error.message || String(local.error)) : null,
+              sameVersion && !sourceKnown && artifactUrl ? h('p', { style: mutedTextStyle }, recordedInstall
+                ? '此前曾由企业扩展安装；当前 DSH 无法再次核对来源。正常使用无需重复安装；若后来换过来源，可以重新安装。'
+                : '已装同版且使用正常时无需重复安装；若想改用团队审核包，可自愿安装。') : null,
               h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
-                plugin.status === 'published' && !local
+                artifactUrl && (!local || (local.version && !verifiedLocal))
+                  ? h('button', { type: 'button', disabled: Boolean(workingId) || uncertainId === plugin.id || completedId === plugin.id,
+                    onClick: () => void install(plugin), style: primaryButtonStyle },
+                  workingId === plugin.id ? '安装中…' : uncertainId === plugin.id ? '先核对安装结果'
+                    : completedId === plugin.id ? '重启 DSH 后生效'
+                    : local ? sameVersion ? '按团队审核包重新安装' : '更新到审核版本' : '安装到这台 DSH') : null,
+                plugin.status === 'published' && !local && !artifactUrl
                   ? h('p', { style: mutedTextStyle }, '如需安装，请联系企业管理员安排。') : null,
-                local ? h('button', { type: 'button', onClick: () => openBundle(plugin.package_name), style: secondaryButtonStyle }, '打开 DSH 插件管理') : null,
-                local && !sameVersion && plugin.status === 'published'
+                local || uncertainId === plugin.id ? h('button', { type: 'button', onClick: () => openBundle(plugin.package_name), style: secondaryButtonStyle }, '打开 DSH 插件管理') : null,
+                local && !sameVersion && plugin.status === 'published' && !artifactUrl
                   ? h('p', { style: mutedTextStyle }, '本机版本与团队审核版本不同；请联系企业管理员核对。') : null))
-          })) : !loading && plugins.length ? h('p', { style: mutedTextStyle }, '没有符合筛选条件的插件。') : null))
+          })) : !loading && plugins.length ? h('p', { style: mutedTextStyle }, filter === 'available'
+            ? '当前没有可一键安装的插件。可在“全部”查看审核目录，或联系企业管理员。'
+            : '没有符合筛选条件的插件。') : null))
     }
 
-    function ModelSyncFooter({ remote, serviceUrl, onServiceUrlChange }) {
+    function ModelSyncFooter({ remote, serviceUrl, bindingReady, onServiceUrlChange, onConnectionChange }) {
       const [email, setEmail] = useState('')
       const [code, setCode] = useState('')
       const [message, setMessage] = useState('')
@@ -396,6 +586,7 @@ window.__ModuleLoader__.load({
       const [bundleRelease, setBundleRelease] = useState(null)
       const [bundleUpdate, setBundleUpdate] = useState({ state: 'idle', currentVersion: '', message: '' })
       const [serviceCompatibility, setServiceCompatibility] = useState({ state: 'idle', message: '' })
+      const [pinnedServiceUrl, setPinnedServiceUrl] = useState(null)
 
       const connectionErrorMessage = (result, status) => {
         const message = result?.message || `请求失败（${status}）`
@@ -407,13 +598,13 @@ window.__ModuleLoader__.load({
           : `${message} 本机无法确认旧设备编号；请让原团队管理员按成员查看设备清单，勿用新编号猜测。`
       }
 
-      const inspectServiceCompatibility = async (rawServiceUrl, useSavedConnection = false) => {
+      const inspectServiceCompatibility = async (rawServiceUrl, useSavedConnection = false, isCurrent = () => true) => {
         const normalized = normalizeServiceUrl(rawServiceUrl)
         if (!normalized && !useSavedConnection) {
-          setServiceCompatibility({ state: 'idle', message: '' })
+          if (isCurrent()) setServiceCompatibility({ state: 'idle', message: '' })
           return null
         }
-        setServiceCompatibility({ state: 'checking', message: '正在识别 ANT 客户端与服务端版本…' })
+        if (isCurrent()) setServiceCompatibility({ state: 'checking', message: '正在识别 ANT 客户端与服务端版本…' })
         try {
           const manager = remote?.pluginManager
           if (typeof manager?.listBundles !== 'function') throw new Error('当前 DSH 未提供 Bundle 版本读取接口。')
@@ -444,14 +635,14 @@ window.__ModuleLoader__.load({
               : `已识别 ANT Bundle v${result.bundle_version} 和服务端 v${result.server_version}；服务端未提供协议能力，兼容性未知，仍允许继续。`
           const state = compatibility === true ? 'compatible' : compatibility === false ? 'incompatible' : 'unknown'
           const status = { state, message, ...result }
-          setServiceCompatibility(status)
+          if (isCurrent()) setServiceCompatibility(status)
           return status
         } catch (error) {
           const status = {
             state: 'unknown',
             message: `无法确认 ANT 版本兼容性，仍允许继续：${error instanceof Error ? error.message : '连接检查失败。'}`,
           }
-          setServiceCompatibility(status)
+          if (isCurrent()) setServiceCompatibility(status)
           return status
         }
       }
@@ -496,6 +687,10 @@ window.__ModuleLoader__.load({
       }
 
       const refreshModels = async () => {
+        if (!bindingReady) {
+          setMessage('请先等待团队绑定检查完成，再刷新团队模型。')
+          return
+        }
         setBusy(true)
         setMessage('正在从 ANT 刷新获准模型…')
         try {
@@ -563,16 +758,105 @@ window.__ModuleLoader__.load({
             throw new Error(`当前 DSH 未找到已安装的 ${release.package_name} Bundle。`)
           }
           const available = newerVersion(release.version, installed.version)
+          if (release.artifact_status === 'revoked') {
+            setBundleUpdate({ state: 'revoked', currentVersion: installed.version,
+              message: installed.version === release.version
+                ? `当前 ANT ${installed.version} 的安装包已因安全问题停用。请联系企业管理员获取处理方式；ANT 不会自动删除本机副本。`
+                : `发布版本 ${release.version} 的安装包已因安全问题停用，请等待管理员发布修复版本。` })
+            return
+          }
+          const artifactUrl = approvedArtifactUrl(release)
           setBundleUpdate({
-            state: available ? 'available' : 'current',
+            state: available ? artifactUrl ? 'available' : 'artifact-missing' : 'current',
             currentVersion: installed.version,
-            message: available ? `发现新版本 ${release.version}。` : `当前已是最新发布版本（${installed.version}）。`,
+            message: available
+              ? artifactUrl
+                ? `发现新版本 ${release.version}，可直接更新。`
+                : `发现新版本 ${release.version}，但管理员尚未提供已审核安装包。请联系管理员。`
+              : `当前已是最新发布版本（${installed.version}）。`,
           })
         } catch (error) {
           setBundleUpdate({ state: 'failed', currentVersion: '', message: error instanceof Error ? error.message : '检查 ANT 更新失败。' })
         }
       }
 
+      const installBundleUpdate = async () => {
+        if (bundleUpdate.state !== 'available') return
+        const artifactUrl = approvedArtifactUrl(bundleRelease)
+        if (!artifactUrl) return
+        const manager = remote?.pluginManager
+        if (typeof manager?.installBundle !== 'function') {
+          setBundleUpdate((current) => ({ ...current, state: 'failed', message: '当前 DSH 未提供 Bundle 更新接口。' }))
+          return
+        }
+        setBusy(true)
+        setBundleUpdate((current) => ({ ...current, state: 'installing', message: '正在由 DSH 安装已审核的 ANT 更新…' }))
+        try {
+          const releaseResponse = await fetch('/api/ant-teams/bundle-release', {
+            cache: 'no-store', headers: {
+              'x-ant-bundle-capabilities': 'direct-package-install',
+              'x-ant-bundle-update-mode': 'check-only',
+            },
+          })
+          const latest = await readLocalJsonResponse(releaseResponse)
+          if (!releaseResponse.ok || latest.version !== bundleRelease.version
+            || latest.artifact_sha256 !== bundleRelease.artifact_sha256
+            || approvedArtifactUrl(latest) !== artifactUrl) {
+            throw new Error('ANT 更新信息已变化，请重新检查更新。')
+          }
+          const requestId = crypto.randomUUID()
+          let result
+          try {
+            result = await manager.installBundle(artifactUrl, { enabled: true, requestId })
+          } catch {
+            result = null
+          }
+          if (!result?.ok) {
+            let recovered = null
+            if (typeof manager.waitForInstall === 'function') {
+              try {
+                const pending = await manager.waitForInstall(requestId)
+                if (pending.ok && pending.value) recovered = { ok: true, value: pending.value }
+              } catch {}
+            }
+            if (!recovered) {
+              setBundleUpdate((current) => ({ ...current, state: 'unknown',
+                message: 'DSH 连接中断，更新结果暂时无法确认。请先在 DSH 插件列表查看 ANT 版本，勿重复点击更新。' }))
+              return
+            }
+            result = recovered
+          }
+          const outcome = result.value
+          if (outcome.application === 'failed' || outcome.application === 'cancelled') {
+            const reason = outcome.error?.diagnostic || outcome.packageResult?.output || '安装未完成。'
+            setBundleUpdate((current) => ({ ...current, state: 'failed', message: `更新失败：${reason}` }))
+            return
+          }
+          if (outcome.bundle !== ANT_BUNDLE_PACKAGE_NAME
+            || !['restart-required', 'applied'].includes(outcome.application)) {
+            throw new Error('DSH 未确认 ANT 安装成功，请联系管理员检查插件状态。')
+          }
+          let observed = null
+          try {
+            const installed = await manager.listBundles()
+            if (installed.ok && Array.isArray(installed.value)) {
+              observed = installed.value.find((bundle) => bundle.name === ANT_BUNDLE_PACKAGE_NAME && bundle.installed) || null
+            }
+          } catch {}
+          if ((outcome.version && outcome.version !== bundleRelease.version) || observed?.version !== bundleRelease.version) {
+            setBundleUpdate((current) => ({ ...current, state: 'unknown',
+              message: 'DSH 未确认新版本已安装。请先在 DSH 插件列表核对 ANT 版本，勿重复点击更新。' }))
+            return
+          }
+          setBundleUpdate({ state: 'done', currentVersion: bundleRelease.version,
+            message: `ANT ${bundleRelease.version} 已安装。请完全退出并重新启动 DSH 后生效。` })
+        } catch (error) {
+          setBundleUpdate((current) => ({ ...current, state: 'failed', message: error instanceof Error ? error.message : '更新未完成。' }))
+        } finally {
+          setBusy(false)
+        }
+      }
+
       const clearLocalConnection = async () => {
         if (typeof remote?.settings?.mutate !== 'function') throw new Error('DSH 未提供模型设置接口。')
         const settingsResult = await remote.settings.mutate('llm-pi-ai', [
@@ -584,6 +868,7 @@ window.__ModuleLoader__.load({
         const credentialResult = await remote.credentials.unset('ANT_MODEL_API_KEY')
         if (!credentialResult.ok) throw new Error(credentialResult.error?.message || 'ANT 成员凭证未能清除。')
         setCredentialConfigured(false)
+        onConnectionChange?.(null)
         setNeedsReconnect(false)
         setReauthenticate(false)
         setAllowLocalCleanup(false)
@@ -635,20 +920,47 @@ window.__ModuleLoader__.load({
           if (!current) return
           const configured = result.ok ? Boolean(result.value?.ANT_MODEL_API_KEY?.configured) : null
           setCredentialConfigured(configured)
-          if (configured) {
+          if (configured && bindingReady) {
             void refreshModels()
             void checkBundleUpdate()
           }
         }).catch(() => { if (current) setCredentialConfigured(null) })
         return () => { current = false }
-      }, [remote])
+      }, [remote, bindingReady])
 
       useEffect(() => {
-        void inspectServiceCompatibility(serviceUrl, credentialConfigured === true)
-      }, [remote, serviceUrl, credentialConfigured])
+        let current = true
+        if (credentialConfigured !== true) {
+          setPinnedServiceUrl(null)
+          return () => { current = false }
+        }
+        const readPinnedOrigin = async () => {
+          try {
+            const response = await fetch('/api/ant-teams/connection-origin', { cache: 'no-store' })
+            const result = await readLocalJsonResponse(response)
+            if (current) setPinnedServiceUrl(response.ok ? normalizeServiceUrl(result.service_url) : null)
+          } catch { if (current) setPinnedServiceUrl(null) }
+        }
+        void readPinnedOrigin()
+        return () => { current = false }
+      }, [remote, credentialConfigured])
+
+      useEffect(() => {
+        if (!bindingReady) {
+          setServiceCompatibility({ state: 'idle', message: '' })
+          return
+        }
+        let current = true
+        void inspectServiceCompatibility(serviceUrl, credentialConfigured === true, () => current)
+        return () => { current = false }
+      }, [remote, serviceUrl, credentialConfigured, bindingReady])
 
       const requestCode = async (event) => {
         event.preventDefault()
+        if (!bindingReady) {
+          setMessage('请先等待团队绑定检查完成，再验证工作邮箱。')
+          return
+        }
         const normalized = normalizeServiceUrl(serviceUrl)
         const normalizedEmail = email.trim()
         if (!normalized) {
@@ -690,6 +1002,10 @@ window.__ModuleLoader__.load({
 
       const connect = async (event) => {
         event.preventDefault()
+        if (!bindingReady) {
+          setMessage('请先等待团队绑定检查完成，再连接团队。')
+          return
+        }
         const normalized = normalizeServiceUrl(serviceUrl)
         const normalizedEmail = email.trim()
         const normalizedCode = code.trim()
@@ -706,6 +1022,7 @@ window.__ModuleLoader__.load({
         }
         setBusy(true)
         setMessage('正在验证邮箱并同步团队模型…')
+        let credentialSaved = false
         try {
           await requireCompatibleService(normalized)
           localStorage.setItem(SERVICE_URL_STORAGE_KEY, normalized)
@@ -729,23 +1046,36 @@ window.__ModuleLoader__.load({
           }
           const credentialWrite = await remote.credentials.set('ANT_MODEL_API_KEY', result.token)
           if (!credentialWrite.ok) throw new Error(credentialWrite.error?.message || 'DSH 无法安全保存 ANT 凭证。')
+          credentialSaved = true
           await applyAuthorizedModels(result.models, normalized)
           setCode('')
           onServiceUrlChange(normalized)
           setCodeRequested(false)
           setCredentialConfigured(true)
+          onConnectionChange?.(normalized)
           setAllowLocalCleanup(false)
           setNeedsReconnect(false)
           setReauthenticate(false)
           setMessage(`已连接 ${result.email || normalizedEmail}，同步 ${result.models.length} 个获准模型。它们现已出现在 DSH 模型选择器中。`)
         } catch (error) {
-          setMessage(error instanceof Error ? error.message : '连接失败，请稍后重试。')
+          if (credentialSaved) {
+            setCredentialConfigured(true)
+            setCode('')
+            setCodeRequested(false)
+            onConnectionChange?.(normalized)
+            setMessage(`ANT 凭证已保存，但团队模型未能同步：${error instanceof Error ? error.message : '请稍后重试。'} 请点击“刷新团队模型”重试。`)
+          } else {
+            setMessage(error instanceof Error ? error.message : '连接失败，请稍后重试。')
+          }
         } finally {
           setBusy(false)
         }
       }
 
       const showConnectForm = credentialConfigured !== true || reauthenticate || needsReconnect
+      const canCheckUpdate = bindingReady && credentialConfigured === true && !needsReconnect
+      const updateGuideUrl = pinnedServiceUrl
+        ? new URL('/ant-update', pinnedServiceUrl).href : null
       return h('div', { style: { display: 'grid', gridTemplateColumns: 'repeat(auto-fit, minmax(min(100%, 400px), 1fr))', alignItems: 'start', gap: 16 } },
         h('section', { style: panelStyle },
           h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', gap: 12 } },
@@ -754,11 +1084,13 @@ window.__ModuleLoader__.load({
               h('p', { style: { ...mutedTextStyle, marginTop: 4 } }, '使用上方团队服务地址验证工作邮箱并同步授权模型。连接状态变化时可随时刷新。')),
             h('span', { style: {
               flexShrink: 0, padding: '4px 9px', borderRadius: 999,
-              color: credentialConfigured === true ? 'var(--dsw-alias-state-success-primary)' : 'var(--dsw-alias-label-secondary)',
-              backgroundColor: credentialConfigured === true ? 'var(--dsw-alias-state-success-tertiary)' : 'var(--dsw-alias-bg-layer-2)',
+              color: credentialConfigured === true && bindingReady ? 'var(--dsw-alias-state-success-primary)' : 'var(--dsw-alias-label-secondary)',
+              backgroundColor: credentialConfigured === true && bindingReady ? 'var(--dsw-alias-state-success-tertiary)' : 'var(--dsw-alias-bg-layer-2)',
               fontSize: 12,
-            } }, credentialConfigured === true ? '已连接' : credentialConfigured === false ? '未连接' : '检查中')),
-          h('p', { role: 'status', style: mutedTextStyle }, credentialConfigured === true
+            } }, credentialConfigured === true ? bindingReady ? '已连接' : '待核对' : credentialConfigured === false ? '未连接' : '检查中')),
+          h('p', { role: 'status', style: mutedTextStyle }, credentialConfigured === true && !bindingReady
+            ? '本机有 ANT 凭证，但尚未确认它绑定的团队；请先完成上方的绑定检查。'
+            : credentialConfigured === true
             ? 'DSH 已安全保存此设备的 ANT 团队凭证。'
             : credentialConfigured === false ? '验证工作邮箱后即可连接团队模型。' : '正在检查 ANT 连接状态…'),
           serviceCompatibility.state !== 'idle' ? h('p', {
@@ -769,25 +1101,30 @@ window.__ModuleLoader__.load({
             },
           }, serviceCompatibility.message) : null,
           credentialConfigured === true && !showConnectForm ? h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 8 } },
-            h('button', { type: 'button', disabled: busy, onClick: () => void refreshModels(), style: primaryButtonStyle }, busy ? '刷新中…' : '刷新团队模型'),
-            h('button', { type: 'button', disabled: busy, onClick: () => { setReauthenticate(true); setMessage('') }, style: secondaryButtonStyle }, '重新验证邮箱'),
+            h('button', { type: 'button', disabled: busy || !bindingReady, onClick: () => void refreshModels(), style: primaryButtonStyle }, busy ? '刷新中…' : '刷新团队模型'),
+            h('button', { type: 'button', disabled: busy || !bindingReady, onClick: () => { setReauthenticate(true); setMessage('') }, style: secondaryButtonStyle }, '重新验证邮箱'),
             h('button', { type: 'button', disabled: busy, onClick: () => { if (window.confirm('断开当前设备与 ANT 的连接？本机 ANT 凭证和模型设置将被清除，团队服务地址会保留。')) void disconnect() }, style: secondaryButtonStyle }, '断开当前设备')) : null,
-          credentialConfigured === true && !showConnectForm ? h('section', { style: { ...panelStyle, padding: 14, gap: 10 } },
+          h('section', { style: { display: 'grid', gap: 8, paddingTop: 12, borderTop: '0.5px solid var(--dsw-alias-border-l2)' } },
             h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', gap: 12 } },
               h('h4', { style: { margin: 0, fontSize: 14, fontWeight: 650 } }, 'ANT 插件更新'),
-              h('button', { type: 'button', disabled: busy || bundleUpdate.state === 'checking', onClick: () => void checkBundleUpdate(), style: secondaryButtonStyle }, bundleUpdate.state === 'checking' ? '检查中…' : '检查更新')),
-            bundleUpdate.message ? h('p', { role: 'status', style: mutedTextStyle }, bundleUpdate.message) : null,
-            bundleRelease?.version && bundleUpdate.state === 'available' ? h('div', { style: { display: 'grid', gap: 8 } },
+              h('button', { type: 'button', disabled: busy || !canCheckUpdate || bundleUpdate.state === 'checking', onClick: () => void checkBundleUpdate(), style: secondaryButtonStyle }, bundleUpdate.state === 'checking' ? '检查中…' : '检查更新')),
+            !canCheckUpdate ? h('p', { role: 'status', style: mutedTextStyle }, '连接团队后可在这里检查并安装 ANT 更新；需要先恢复插件时，可打开团队管理台的更新指引。') : null,
+            updateGuideUrl ? h('a', { href: updateGuideUrl, target: '_blank', rel: 'noopener noreferrer', style: { color: 'var(--dsw-alias-link)', fontSize: 13 } }, `打开 ${pinnedServiceUrl} 的更新指引 ↗`)
+              : !canCheckUpdate ? h('p', { style: mutedTextStyle }, '无法核对原团队地址时，请向企业管理员索取更新指引。') : null,
+            bundleUpdate.message ? h('p', { role: 'status', style: bundleUpdate.state === 'revoked'
+              ? { ...mutedTextStyle, color: 'var(--dsw-alias-state-error-primary)' } : mutedTextStyle }, bundleUpdate.message) : null,
+            canCheckUpdate && bundleRelease?.version && ['available', 'artifact-missing'].includes(bundleUpdate.state) ? h('div', { style: { display: 'grid', gap: 8 } },
               h('p', { style: mutedTextStyle }, `发布版本：${bundleRelease.version} · 精确包名：${directInstallSpec(bundleRelease)}`),
               bundleRelease.release_notes ? h('p', { style: mutedTextStyle }, bundleRelease.release_notes) : null,
-              h('p', { style: mutedTextStyle }, 'ANT 暂停一键安装更新：当前 DSH 无法在执行安装脚本前核对审核制品。请联系团队管理员确认升级方式。')) : null) : null,
+              bundleUpdate.state === 'available'
+                ? h('button', { type: 'button', disabled: busy, onClick: () => void installBundleUpdate(), style: primaryButtonStyle }, busy ? '更新中…' : '更新 ANT') : null) : null),
           showConnectForm ? h('form', { onSubmit: requestCode, style: { display: 'grid', gap: 9, maxWidth: 560 } },
             h('label', { htmlFor: 'ant-team-model-email', style: { fontSize: 13, fontWeight: 550 } }, '工作邮箱'),
             h('input', {
               id: 'ant-team-model-email', type: 'email', autoComplete: 'email', required: true, value: email,
               onChange: (event) => setEmail(event.target.value), style: inputStyle,
             }),
-            h('button', { type: 'submit', disabled: busy, style: primaryButtonStyle }, busy ? '发送中…' : '发送验证码')) : null,
+            h('button', { type: 'submit', disabled: busy || !bindingReady, style: primaryButtonStyle }, busy ? '发送中…' : '发送验证码')) : null,
           credentialConfigured === true && showConnectForm ? h('button', {
             type: 'button', disabled: busy,
             onClick: () => { if (window.confirm('断开当前设备与 ANT 的连接？本机 ANT 凭证和模型设置将被清除，团队服务地址会保留。')) void disconnect() },
@@ -800,7 +1137,7 @@ window.__ModuleLoader__.load({
               required: true, maxLength: 8, value: code, placeholder: '8 位验证码',
               onChange: (event) => setCode(event.target.value.replace(/\D/gu, '').slice(0, 8)), style: inputStyle,
             }),
-            h('button', { type: 'submit', disabled: busy || code.length !== 8, style: primaryButtonStyle }, busy ? '连接中…' : '验证并连接')) : null,
+            h('button', { type: 'submit', disabled: busy || !bindingReady || code.length !== 8, style: primaryButtonStyle }, busy ? '连接中…' : '验证并连接')) : null,
           allowLocalCleanup ? h('section', { style: { ...panelStyle, padding: 14, gap: 9 } },
             h('p', { style: mutedTextStyle }, savedDeviceId()
               ? `已保存的设备编号：${savedDeviceId()}。请交给原团队管理员核对。`
@@ -822,6 +1159,20 @@ window.__ModuleLoader__.load({
 
     }
 
+    function EnterpriseExtensionsPanelIcon({ size }) {
+      return h('span', { 'aria-hidden': true, style: {
+        display: 'inline-grid', placeItems: 'center', width: size, height: size,
+        fontSize: size, lineHeight: 1,
+      } }, '✦')
+    }
+
+    function EnterpriseExtensionsPage({ remote, onBack, openBundle }) {
+      const [tab, setTab] = useState('skills')
+      return tab === 'skills'
+        ? h(SkillCenterPage, { onBack, onPlugins: () => setTab('plugins') })
+        : h(PluginCenterPage, { remote, onBack, onSkills: () => setTab('skills'), openBundle })
+    }
+
     function apply(ctx) {
       const remote = {
         credentials: ctx.remote.credentials,
@@ -829,17 +1180,14 @@ window.__ModuleLoader__.load({
         pluginManager: ctx.remote.pluginManager,
       }
       ctx.slots.inject('main', () => ctx.slots.register({ name: 'main', key: 'ant-skills' },
-        () => h(SkillCenterPage, {
-          onBack: () => ctx.pluginNavigation.openBundle(ANT_BUNDLE_PACKAGE_NAME),
-          onPlugins: () => ctx.layout.selectPanel('ant-plugins'),
-        })))
-      ctx.slots.inject('main', () => ctx.slots.register({ name: 'main', key: 'ant-plugins' },
-        () => h(PluginCenterPage, {
+        () => h(EnterpriseExtensionsPage, {
           remote,
           onBack: () => ctx.pluginNavigation.openBundle(ANT_BUNDLE_PACKAGE_NAME),
-          onSkills: () => ctx.layout.selectPanel('ant-skills'),
           openBundle: (name) => ctx.pluginNavigation.openBundle(name),
         })))
+      ctx.slots.inject('sidebar.panellist', () => ctx.slots.register({
+        name: 'sidebar.panellist', id: 'ant-skills', order: 5, label: '企业扩展',
+      }, EnterpriseExtensionsPanelIcon))
       ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({
           name: 'plugins.bundle.config',
           key: ANT_BUNDLE_PACKAGE_NAME,
@@ -848,8 +1196,7 @@ window.__ModuleLoader__.load({
           ? h('p', null, 'ANT 团队服务入口。')
           : h(TeamServiceConfig, {
             remote: injectedRemote,
-            openSkillCenter: () => ctx.layout.selectPanel('ant-skills'),
-            openPluginCenter: () => ctx.layout.selectPanel('ant-plugins'),
+            openInstalledPlugin: (name) => ctx.pluginNavigation.openBundle(name),
           })))
     }
 

package/index.js

@@ -8,6 +8,7 @@ export const inject = []
 const MODEL_SYNC_PATH = '/api/ant-teams/models'
 const SERVICE_INFO_PATH = '/api/ant-teams/service-info'
 const BUNDLE_RELEASE_PATH = '/api/ant-teams/bundle-release'
+const CONNECTION_ORIGIN_PATH = '/api/ant-teams/connection-origin'
 const DISCONNECT_PATH = '/api/ant-teams/disconnect'
 const REQUEST_CODE_PATH = '/api/ant-teams/request-code'
 const CONNECT_PATH = '/api/ant-teams/connect'
@@ -292,19 +293,37 @@ async function fetchBundleRelease(request, credentials, settings) {
     const directInstallSpec = release?.package_name && release?.version
       ? `${release.package_name}@${release.version}`
       : ''
+    const artifactPath = release?.version ? `/api/ant-bundles/${release.version}/package.tgz` : ''
+    const hasArtifact = release?.artifact_path === artifactPath
+      && /^[a-f0-9]{64}$/u.test(release?.artifact_sha256 || '')
+    const noArtifact = !release?.artifact_path && !release?.artifact_sha256
     if (release?.bundle_name !== 'ant' || !validPackageName || !validVersion
       || typeof release?.install_spec !== 'string' || typeof release?.release_notes !== 'string'
       || (release.version && release.install_spec !== installSpec)
       || (!release.version && release.install_spec !== '')
-      || (release.direct_install_spec !== undefined && release.direct_install_spec !== directInstallSpec)) {
+      || (release.direct_install_spec !== undefined && release.direct_install_spec !== directInstallSpec)
+      || (!hasArtifact && !noArtifact)) {
       return jsonResponse(502, { message: 'ANT 更新信息字段无效。' })
     }
-    return jsonResponse(200, release)
+    return jsonResponse(200, hasArtifact ? {
+      ...release,
+      artifact_url: new URL(artifactPath, connection.serviceUrl).href,
+    } : release)
   } catch {
     return jsonResponse(502, { message: '无法连接 ANT 更新服务。' })
   }
 }
 
+async function fetchConnectionOrigin(request, credentials, settings) {
+  if (request.method !== 'GET') return jsonResponse(405, { message: '只支持 GET 请求' })
+  try {
+    const connection = await readMemberConnection(credentials, settings)
+    return jsonResponse(200, { service_url: connection?.serviceUrl || null })
+  } catch {
+    return jsonResponse(500, { message: '无法核对已绑定的 ANT 团队地址。' })
+  }
+}
+
 async function disconnectMember(request, credentials, settings) {
   if (request.method !== 'POST') return jsonResponse(405, { message: '只支持 POST 请求' })
   let connection
@@ -397,7 +416,17 @@ async function fetchMemberPlugins(request, credentials, settings) {
       { message: '无法读取企业精选插件目录。' })
     const plugins = JSON.parse(text)
     if (!Array.isArray(plugins)) throw new Error('插件目录格式无效。')
-    return jsonResponse(200, { plugins })
+    return jsonResponse(200, { plugins: plugins.map((plugin) => {
+      const validId = typeof plugin?.id === 'string'
+        && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/iu.test(plugin.id)
+      const validDigest = /^[0-9a-f]{64}$/u.test(plugin?.artifact_sha256 || '')
+      if (plugin?.status !== 'published' || !validId || !validDigest) {
+        return { ...plugin, artifact_sha256: null }
+      }
+      const artifactPath = `/api/plugin-artifacts/${plugin.id}/package.tgz`
+      return { ...plugin, artifact_path: artifactPath,
+        artifact_url: new URL(artifactPath, connection.serviceUrl).href }
+    }) })
   } catch {
     return jsonResponse(502, { message: '无法读取企业精选插件目录。' })
   }
@@ -505,6 +534,12 @@ export function apply(ctx) {
       requestBody: 'buffered',
       fetch: (request) => fetchBundleRelease(request, connectionCtx.credentials, connectionCtx.settings),
     }), 'ant-teams: authenticated Bundle release relay')
+    connectionCtx.effect(() => connectionCtx.connection.fetch.register({
+      path: CONNECTION_ORIGIN_PATH,
+      methods: ['GET'],
+      requestBody: 'buffered',
+      fetch: (request) => fetchConnectionOrigin(request, connectionCtx.credentials, connectionCtx.settings),
+    }), 'ant-teams: pinned connection origin for update guide')
     connectionCtx.effect(() => connectionCtx.connection.fetch.register({
       path: SKILLS_PATH, methods: ['GET'], requestBody: 'buffered',
       fetch: (request) => fetchMemberSkills(request, connectionCtx.credentials, connectionCtx.settings),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-wendao/ant",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "ANT (AI-native Teams) connects a DeepSeek Harness Desktop profile to team identity and approved models.",
   "type": "module",
   "scripts": {