@eya46/dsh-plugin-info 0.0.2 → 0.1.0

package/README.md

@@ -2,15 +2,23 @@
 
 面向 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 的插件信息页。包名 `@eya46/dsh-plugin-info`，挂到当前 Profile 后，设置里会出现「插件信息」分区。
 
-它只看 **Profile 用户自己加的插件**（`profiles/<name>/package.json` 的 `dependencies`），不把 `@deepseek-ai/dsh-base` 这类随发行版带的 bundle 算进去。默认仅展示 `@eya46/` 命名空间下的插件（见下方 `allowScopes`），可按需放开。
+它只看 **Profile 用户自己加的插件**（`profiles/<name>/package.json` 的 `dependencies`），不把 `@deepseek-ai/dsh-base` 这类随发行版带的 bundle 算进去。默认展示全部用户插件；如需只看特定命名空间，可配置 `allowScopes`。
 
 - 列出已安装插件、当前版本、来源（npm / 本地 / git）
 - 对 registry 安装的包对照 `dist-tags.latest`，标出可更新
+- 对 **GitHub Release 直装**的包（依赖是 `github.com/…/releases/download/<tag>/<file>.tgz` 链接），从依赖链接里解析出仓库和当前版本，对照该仓库的最新 Release 标出可更新——仓库与版本全部取自 profile 里的依赖信息和已安装的包信息，无需任何按插件配置；更新命令直接指向按新版本重写过的 tarball 链接，版本列表也会展示该仓库最近的 Release，点开可读对应 Release 说明
+- 可更新时一键复制 `dsh plugin --profile <当前 profile> add <包>@latest`（profile 从当前运行的 Profile 清单解析，web 端通常是 `web`）
 - 展开后默认看最近 **10** 条版本
 - 点某个版本读更新说明：优先 GitHub Release，没有就回落到相邻版本的 compare / commit
 
 实现方式对齐 [dsh-model-meta-autofill](https://github.com/QJAG1024/dsh-model-meta-autofill)：Host 注册本机 HTTP API，Client half 通过 `dsh.client` 挂到 `settings.section`。
 
+### 可选：dsh-better-sidebar 标签页
+
+若 Profile 同时安装了 [`dsh-better-sidebar`](https://github.com/omdsh-dev/DSH-better-sidebar) (≥0.4.0)，本插件会自动在侧边栏 `+` 菜单里多注册一个**插件信息**标签页（id `@eya46/dsh-plugin-info`，order 90，单实例），内容与设置页完全一致——侧边栏较窄，内部已做滚动/宽度适配。
+
+实现是**软依赖**：不写 `peerDependencies`，不 `import 'dsh-better-sidebar'`，只用 Cordis 的 `ctx.inject(['betterSidebar'], ...)` 开一个子 fiber——未安装时回调永不触发，其他功能不受影响；禁用 / HMR 任一插件时 disposer 随各自 fiber 清理，不会残留 `"already registered"`。
+
 ## 安装
 
 在仓库根目录构建后，把它加进当前 Profile：
@@ -29,7 +37,7 @@ dsh plugin --profile web add "file:./packages/dsh-plugin-info"
 
 | 端点 | 说明 |
 | --- | --- |
-| `GET /plugin-info/api/plugins` | 当前 Profile 用户插件 + 是否有更新 |
+| `GET /plugin-info/api/plugins` | 当前 Profile 用户插件 + 是否有更新；含 `profileCli`，可更新的 registry 包还会带 `updateCommand` |
 | `GET /plugin-info/api/versions?name=<pkg>&limit=10` | 最近版本，默认 10 条 |
 | `GET /plugin-info/api/notes?name=<pkg>&version=<ver>` | 该版本的更新说明 |
 
@@ -41,7 +49,7 @@ dsh plugin --profile web add "file:./packages/dsh-plugin-info"
 | `defaultVersionLimit` | `10` | 默认版本条数 |
 | `timeoutMs` | `15000` | 注册表 / GitHub 超时 |
 | `cacheTtlMs` | `300000` | packument 与说明缓存 |
-| `allowScopes` | `['@eya46/']` | 名称前缀白名单；为空数组时展示全部用户插件 |
+| `allowScopes` | 无（展示全部） | 名称前缀白名单；省略或为空数组时展示全部用户插件 |
 
 覆盖写在 Profile 的 `cordis.patch.yml`：
 

package/lib/client.js

@@ -7,6 +7,11 @@
  *
  * @module @eya46/dsh-plugin-info/client
  */
+/** Labels for the MarkdownText copy button / footnotes heading (settings UI is zh). */
+const MARKDOWN_LABELS = {
+    code: { copyLabel: '复制代码', copiedLabel: '已复制' },
+    footnotes: '脚注',
+};
 ;
 (() => {
     const loader = window.__ModuleLoader__;
@@ -25,12 +30,17 @@
                 '.dpi-rowButton { height: 28px; padding: 0 10px; font-size: 12px; line-height: 18px; }',
                 '.dpi-secondaryButton:hover:not(:disabled), .dpi-rowButton:hover:not(:disabled) { background: var(--dsw-alias-interactive-bg-hover-solid); }',
                 '.dpi-secondaryButton:disabled, .dpi-rowButton:disabled { opacity: 0.4; cursor: default; }',
-                '.dpi-secondaryButton:focus-visible, .dpi-rowButton:focus-visible, .dpi-head:focus-visible, .dpi-version:focus-visible { outline: none; box-shadow: 0 0 0 2px var(--dsw-alias-border-l3); }',
+                '.dpi-secondaryButton:focus-visible, .dpi-rowButton:focus-visible, .dpi-head:focus-visible, .dpi-version:focus-visible, .dpi-updateCopy:focus-visible { outline: none; box-shadow: 0 0 0 2px var(--dsw-alias-border-l3); }',
                 '.dpi-status { font-size: 12px; line-height: 18px; color: var(--dsw-alias-label-secondary); }',
                 '.dpi-banner { margin: 0; font-size: 12px; line-height: 18px; color: var(--dsw-alias-state-error-primary); }',
                 '.dpi-empty { color: var(--dsw-alias-label-tertiary); font-size: 14px; line-height: 22px; }',
                 '.dpi-cards { margin: 0; padding: 0; list-style: none; display: flex; flex-direction: column; gap: 10px; }',
                 '.dpi-card { border: 1px solid var(--dsw-alias-border-l2); border-radius: 12px; overflow: hidden; }',
+                '.dpi-cardTop { display: flex; align-items: stretch; gap: 0; }',
+                '.dpi-cardTop .dpi-head { flex: 1; min-width: 0; }',
+                '.dpi-updateCopy { box-sizing: border-box; flex-shrink: 0; align-self: center; height: 28px; margin: 0 12px 0 0; padding: 0 10px; border: 1px solid var(--dsw-alias-border-l3); border-radius: 14px; background: transparent; color: var(--dsw-alias-state-warn-label); font: inherit; font-size: 12px; line-height: 18px; cursor: pointer; }',
+                '.dpi-updateCopy:hover { background: var(--dsw-alias-interactive-bg-hover-solid); }',
+                '.dpi-command { margin: 0; font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 12px; line-height: 18px; color: var(--dsw-alias-label-secondary); word-break: break-all; }',
                 '.dpi-head { box-sizing: border-box; width: 100%; display: flex; align-items: center; flex-wrap: wrap; gap: 8px; padding: 12px 14px; border: none; background: transparent; color: inherit; font: inherit; text-align: left; cursor: pointer; }',
                 '.dpi-head:hover { background: var(--dsw-alias-interactive-bg-hover-solid); }',
                 '.dpi-name { font-size: 14px; line-height: 22px; font-weight: 500; }',
@@ -46,14 +56,52 @@
                 '.dpi-version:hover { background: var(--dsw-alias-interactive-bg-hover-solid); }',
                 '.dpi-version[data-open="1"] { background: var(--dsw-alias-interactive-bg-hover-solid); }',
                 '.dpi-notes { display: flex; flex-direction: column; gap: 6px; padding: 8px 2px 2px; }',
-                '.dpi-notesBody { margin: 0; white-space: pre-wrap; font-size: 13px; line-height: 20px; color: var(--dsw-alias-label-secondary); }',
                 '.dpi-commits { margin: 0; padding-left: 18px; font-size: 13px; line-height: 20px; }',
                 '.dpi-link { color: inherit; text-underline-offset: 3px; }',
                 '.dpi-copyTag { box-sizing: border-box; border: 1px solid var(--dsw-alias-border-l3); color: var(--dsw-alias-label-secondary); background: transparent; border-radius: 4px; padding: 1px 6px; font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 11px; line-height: 16px; cursor: pointer; }',
                 '.dpi-copyTag:hover { color: var(--dsw-alias-label-primary); border-color: var(--dsw-alias-border-l2); }',
+                // Sidebar tab wrapper: the panel sits in a narrow right-side column
+                // (default 420px), where PluginInfoPanel's 720px max-width and
+                // non-scrolling body would overflow. Force full width + own scroll.
+                '.dpi-sidebar { box-sizing: border-box; width: 100%; height: 100%; overflow-y: auto; overflow-x: hidden; padding: 12px 14px 16px; background: var(--dsw-alias-bg-base); }',
+                '.dpi-sidebar .dpi-section { max-width: none; gap: 10px; }',
+                '.dpi-sidebar .dpi-card .dpi-head { padding: 10px 12px; }',
+                '.dpi-sidebar .dpi-card .dpi-body { padding: 0 12px 12px; }',
+                '.dpi-sidebar .dpi-actions { gap: 6px; }',
+                '.dpi-sidebar .dpi-rowButton { height: 26px; padding: 0 8px; }',
+                '.dpi-sidebar .dpi-updateCopy { height: 26px; margin-right: 10px; padding: 0 8px; }',
             ].join('\n');
             const React = require('react');
+            // Reuse DSH's shared untrusted-Markdown renderer instead of rolling our
+            // own — it ships in the web shell's static module table and handles GFM,
+            // math, code fences, and sanitization (raw HTML / unsafe URLs stripped).
+            const uiPrimitives = require('@deepseek-ai/dsh-client-ui-primitives');
+            const MarkdownText = uiPrimitives.MarkdownText;
             const h = React.createElement.bind(React);
+            const ReactComponent = React.Component;
+            /**
+             * MarkdownText is an undocumented shell primitive whose render can throw
+             * (labels shape drift, markdown edge cases). Contain any failure to this
+             * one note body instead of crashing the whole settings section.
+             */
+            class SafeMarkdown extends ReactComponent {
+                constructor(props) {
+                    super(props);
+                    this.state = { failed: false };
+                }
+                static getDerivedStateFromError() {
+                    return { failed: true };
+                }
+                componentDidCatch(error) {
+                    console.warn('[dsh-plugin-info] MarkdownText failed; falling back to plain text', error);
+                }
+                render() {
+                    if (this.state.failed === true) {
+                        return h('pre', { className: 'dpi-id', style: { whiteSpace: 'pre-wrap', margin: 0 } }, this.props.text);
+                    }
+                    return h(MarkdownText, { text: this.props.text, labels: MARKDOWN_LABELS });
+                }
+            }
             const ensureStyles = () => {
                 if (document.querySelector('style[data-plugin="@eya46/dsh-plugin-info"]') !== null)
                     return;
@@ -135,17 +183,18 @@
                 const [notes, setNotes] = React.useState({});
                 const [notesBusy, setNotesBusy] = React.useState('');
                 const [copied, setCopied] = React.useState({});
-                const copyName = React.useCallback((name) => {
+                const [profileCli, setProfileCli] = React.useState('web');
+                const copyText = React.useCallback((key, text) => {
                     const write = () => {
                         if (typeof navigator !== 'undefined' && navigator.clipboard !== undefined) {
-                            return navigator.clipboard.writeText(name);
+                            return navigator.clipboard.writeText(text);
                         }
                         return Promise.reject(new Error('clipboard unavailable'));
                     };
                     write()
                         .then(() => {
-                        setCopied((prev) => ({ ...prev, [name]: true }));
-                        window.setTimeout(() => setCopied((prev) => ({ ...prev, [name]: false })), 1200);
+                        setCopied((prev) => ({ ...prev, [key]: true }));
+                        window.setTimeout(() => setCopied((prev) => ({ ...prev, [key]: false })), 1200);
                     })
                         .catch(() => { });
                 }, []);
@@ -157,6 +206,8 @@
                         if (!Array.isArray(data.plugins))
                             throw new Error(data.message ?? 'unexpected response');
                         setRows(data.plugins);
+                        if (typeof data.profileCli === 'string' && data.profileCli.length > 0)
+                            setProfileCli(data.profileCli);
                         setError('');
                     })
                         .catch((caught) => setError(String(caught)))
@@ -212,7 +263,7 @@
                 const updateCount = rows.filter((row) => row.hasUpdate).length;
                 const children = [
                     h('h2', { key: 'title', className: 'dpi-title' }, '插件信息'),
-                    h('p', { key: 'intro', className: 'dpi-intro' }, '当前 Profile 里 @eya46 命名空间下的插件。展开后默认看最近 10 个版本，点版本可看更新说明。'),
+                    h('p', { key: 'intro', className: 'dpi-intro' }, '当前 Profile（' + profileCli + '）里用户添加的插件（不含随发行版内置的 bundle）。有更新时可一键复制 dsh plugin 命令；展开后默认看最近 10 个版本，点版本可看更新说明。'),
                     h('div', { key: 'toolbar', className: 'dpi-toolbar' }, h('button', { className: 'dpi-secondaryButton', disabled: busy, onClick: () => { load(); } }, busy ? '刷新中…' : '刷新'), h('span', { className: 'dpi-status' }, '共 ' + rows.length + ' 个插件' + (updateCount > 0 ? ' · ' + updateCount + ' 个可更新' : ''))),
                 ];
                 if (error !== '')
@@ -232,14 +283,20 @@
                     if (plugin.hasUpdate && plugin.latestVersion !== undefined) {
                         head.push(h('span', { key: 'up', className: 'dpi-tag', 'data-tone': 'warn' }, '可更新 ' + plugin.latestVersion));
                     }
-                    else if (plugin.source === 'registry' && plugin.latestVersion !== undefined) {
+                    else if (!plugin.hasUpdate && plugin.latestVersion !== undefined) {
                         head.push(h('span', { key: 'ok', className: 'dpi-tag', 'data-tone': 'ok' }, '已是最新'));
                     }
+                    const updateCommand = plugin.updateCommand
+                        ?? ('dsh plugin --profile ' + profileCli + ' add ' + plugin.name + '@latest');
+                    const updateCopied = copied['update:' + plugin.name] === true;
                     const body = [];
                     if (expanded) {
                         if (plugin.description !== undefined)
                             body.push(h('p', { key: 'desc', className: 'dpi-meta' }, plugin.description));
                         body.push(h('p', { key: 'spec', className: 'dpi-meta' }, '依赖：', h('span', { className: 'dpi-id' }, plugin.spec), plugin.latestVersion === undefined ? null : ' · 最新 ' + plugin.latestVersion));
+                        if (plugin.hasUpdate) {
+                            body.push(h('p', { key: 'upd', className: 'dpi-command' }, updateCommand));
+                        }
                         if (plugin.error !== undefined)
                             body.push(h('p', { key: 'perr', className: 'dpi-banner' }, plugin.error));
                         const links = [
@@ -247,7 +304,7 @@
                                 key: 'copy',
                                 className: 'dpi-copyTag',
                                 title: '复制包名',
-                                onClick: () => { copyName(plugin.name); },
+                                onClick: () => { copyText(plugin.name, plugin.name); },
                             }, copied[plugin.name] === true ? '已复制' : plugin.name),
                             h('button', {
                                 key: 'vers',
@@ -255,6 +312,14 @@
                                 onClick: () => { loadVersions(plugin.name); },
                             }, versions[plugin.name] === undefined ? '加载版本' : '重新加载版本'),
                         ];
+                        if (plugin.hasUpdate) {
+                            links.push(h('button', {
+                                key: 'upd',
+                                className: 'dpi-rowButton',
+                                title: updateCommand,
+                                onClick: () => { copyText('update:' + plugin.name, updateCommand); },
+                            }, updateCopied ? '已复制更新命令' : '复制更新命令'));
+                        }
                         if (plugin.homepage !== undefined) {
                             links.push(h('a', { key: 'home', className: 'dpi-rowButton dpi-link', href: plugin.homepage, target: '_blank', rel: 'noreferrer' }, '主页'));
                         }
@@ -271,7 +336,7 @@
                             body.push(h('p', { key: 'vload', className: 'dpi-meta' }, '正在加载最近 10 个版本…'));
                         }
                         else if (pluginVersions.length === 0) {
-                            body.push(h('p', { key: 'vempty', className: 'dpi-meta' }, plugin.source === 'registry' ? '注册表没有版本记录。' : '本地 / git 安装没有更多历史版本。'));
+                            body.push(h('p', { key: 'vempty', className: 'dpi-meta' }, plugin.source === 'registry' ? '注册表没有版本记录。' : '没有可展示的历史版本。'));
                         }
                         else {
                             const versionNodes = pluginVersions.map((row) => {
@@ -296,8 +361,9 @@
                                     else if (note.source === 'github-release') {
                                         if (note.title !== undefined)
                                             noteChildren.push(h('p', { key: 'nt', className: 'dpi-meta' }, note.title));
-                                        if (note.body !== undefined)
-                                            noteChildren.push(h('pre', { key: 'nb', className: 'dpi-notesBody' }, note.body));
+                                        if (note.body !== undefined && note.body !== '') {
+                                            noteChildren.push(h(SafeMarkdown, { key: 'nb', text: note.body }));
+                                        }
                                         if (note.url !== undefined) {
                                             noteChildren.push(h('a', { key: 'nu', className: 'dpi-link', href: note.url, target: '_blank', rel: 'noreferrer' }, '在 GitHub 查看 Release'));
                                         }
@@ -309,7 +375,10 @@
                                         }
                                     }
                                     else {
-                                        noteChildren.push(h('p', { key: 'nnone', className: 'dpi-meta' }, note.body ?? '这个版本没有找到 GitHub Release 或提交说明。'));
+                                        const fallback = note.body ?? '这个版本没有找到 GitHub Release 或提交说明。';
+                                        // Error payloads and the "none" source are plain text; keep
+                                        // them literal rather than feeding them through Markdown.
+                                        noteChildren.push(h('p', { key: 'nnone', className: 'dpi-meta' }, fallback));
                                     }
                                 }
                                 return h('div', { key: row.version }, h('button', {
@@ -321,15 +390,66 @@
                             body.push(h('div', { key: 'versions', className: 'dpi-versions' }, ...versionNodes));
                         }
                     }
-                    cards.push(h('li', { key: plugin.name, className: 'dpi-card' }, h('button', {
+                    cards.push(h('li', { key: plugin.name, className: 'dpi-card' }, h('div', { className: 'dpi-cardTop' }, h('button', {
                         className: 'dpi-head',
                         'aria-expanded': expanded,
                         onClick: () => { togglePlugin(plugin.name); },
-                    }, ...head), expanded ? h('div', { className: 'dpi-body' }, ...body) : null));
+                    }, ...head), plugin.hasUpdate
+                        ? h('button', {
+                            className: 'dpi-updateCopy',
+                            title: updateCommand,
+                            onClick: (event) => {
+                                event.stopPropagation?.();
+                                copyText('update:' + plugin.name, updateCommand);
+                            },
+                        }, updateCopied ? '已复制' : '复制更新命令')
+                        : null), expanded ? h('div', { className: 'dpi-body' }, ...body) : null));
                 }
                 children.push(h('ul', { key: 'cards', className: 'dpi-cards' }, ...cards));
                 return h('div', { className: 'dpi-section' }, ...children);
             };
+            /**
+             * Sidebar-tab wrapper: same content as the settings panel, but hosted in
+             * the narrow right-side better-sidebar pane where it must manage its own
+             * vertical scroll and drop the 720px max-width.
+             */
+            const PluginInfoSidebarPanel = () => {
+                return h('div', { className: 'dpi-sidebar' }, h(PluginInfoPanel, null));
+            };
+            /** Small Cordis-plugin outline glyph (same geometry as the settings
+             *  nav uses, suitable for the sidebar's 16px tab icon slot). */
+            const PluginIcon = (size) => {
+                return h('svg', {
+                    width: size,
+                    height: size,
+                    viewBox: '0 0 14 14',
+                    fill: 'none',
+                    'aria-hidden': true,
+                }, h('path', {
+                    fill: 'currentColor',
+                    d: 'M3.03426 5.66661L1.70084 7.00003L3.0315 8.33069L2.14762 9.21457L-0.0669245 7.00003L2.15038 4.78273L3.03426 5.66661ZM7 14.067L4.77924 11.8462L5.66313 10.9623L7 12.2992L8.33342 10.9658L9.2173 11.8496L7 14.067ZM11.8489 9.21803L10.965 8.33414L12.2992 7.00003L10.9623 5.66316L11.8462 4.77927L14.0669 7.00003L11.8489 9.21803ZM8.33066 3.03153L7 1.70087L5.66589 3.03498L4.782 2.1511L7 -0.0668945L9.21454 2.14765L8.33066 3.03153Z',
+                }), h('rect', { x: 5.98535, y: 5.98535, width: 2.02942, height: 2.02942, fill: 'currentColor' }));
+            };
+            /**
+             * Register the sidebar tab ONLY when dsh-better-sidebar is present. The
+             * child fiber waits for the `betterSidebar` service; if that plugin is
+             * not installed the callback never runs and the rest of this plugin is
+             * unaffected. The disposer returned by registerTab is attached to the
+             * child fiber, so disabling/HMR of either side cleans up cleanly.
+             */
+            const registerSidebarTab = (ctx) => {
+                ctx.inject(['betterSidebar'], ((sctx) => {
+                    const service = sctx.betterSidebar;
+                    sctx.effect(() => service.registerTab({
+                        id: '@eya46/dsh-plugin-info',
+                        title: '插件信息',
+                        icon: (size) => PluginIcon(size),
+                        order: 90,
+                        single: true,
+                        component: PluginInfoSidebarPanel,
+                    }), '@eya46/dsh-plugin-info: better-sidebar tab');
+                }));
+            };
             return {
                 name: 'dsh-plugin-info',
                 inject: ['slots'],
@@ -338,6 +458,9 @@
                     ctx.slots.inject('settings.section', () => {
                         ctx.slots.register({ name: 'settings.section', id: 'plugin-info', order: 16, label: '插件信息' }, PluginInfoPanel);
                     });
+                    // Optional injection into dsh-better-sidebar: no-op when that
+                    // plugin is absent from the profile.
+                    registerSidebarTab(ctx);
                 },
             };
         },

package/lib/index.js

@@ -64,6 +64,11 @@ function compareParsed(left, right) {
 	}
 	return 0;
 }
+/** Version embedded in a release tag: `v2.0.3`, `2.0.3`, or `panel-1.20.3-rc.1`. */
+function versionFromTag(tag) {
+	if (parseVersion(tag) !== void 0) return normalizeVersion(tag);
+	return /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/.exec(tag)?.[1];
+}
 /** True when `latest` is a newer published version than `installed`. */
 function hasNewerVersion(installed, latest) {
 	if (installed === void 0 || latest === void 0) return false;
@@ -75,6 +80,28 @@ function hasNewerVersion(installed, latest) {
 }
 //#endregion
 //#region src/profile.ts
+/** Prefix DSH writes onto a profile package.json `name`. */
+const PROFILE_PACKAGE_PREFIX = "dsh-profile-";
+/**
+* CLI `--profile` argument for this profile directory.
+*
+* DSH names the manifest `dsh-profile-<dir>` and the CLI flag is the
+* directory basename (`web`, `tui`, …). Prefer the manifest prefix so temp
+* test dirs still resolve; fall back to the folder name, then `web`.
+*/
+function profileCliName(manifestName, profileDir) {
+	if (typeof manifestName === "string" && manifestName.startsWith(PROFILE_PACKAGE_PREFIX)) {
+		const id = manifestName.slice(12).trim();
+		if (id.length > 0) return id;
+	}
+	const dirName = profileDir.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? "";
+	if (dirName.length > 0 && dirName !== "." && dirName !== ".." && !/^[A-Za-z]:$/.test(dirName)) return dirName;
+	return "web";
+}
+/** `dsh plugin add …@latest` command for one registry package in this profile. */
+function pluginUpdateCommand(profileCli, packageName) {
+	return `dsh plugin --profile ${profileCli} add ${packageName}@latest`;
+}
 /** Classify a profile dependency spec. */
 function classifySpec(spec) {
 	const trimmed = spec.trim();
@@ -154,6 +181,47 @@ function parseGithubRepo(input) {
 		};
 	}
 }
+const GITHUB_RELEASE_SPEC = /^https?:\/\/github\.com\/([^/\s]+)\/([^/\s]+)\/releases\/download\/([^/\s]+)\/([^/\s]+)$/i;
+/**
+* Parse a `github.com/<owner>/<repo>/releases/download/<tag>/<asset>`
+* dependency spec into its repository, tag, and asset. Everything is derived
+* from the spec itself — no per-plugin configuration.
+*/
+function parseGithubReleaseSpec(spec) {
+	const match = GITHUB_RELEASE_SPEC.exec(spec.trim());
+	if (match === null) return void 0;
+	const [rawOwner, rawRepo, rawTag, rawAsset] = match.slice(1);
+	if (rawOwner === void 0 || rawRepo === void 0 || rawTag === void 0 || rawAsset === void 0) return void 0;
+	try {
+		return {
+			owner: decodeURIComponent(rawOwner),
+			repo: decodeURIComponent(rawRepo),
+			tag: decodeURIComponent(rawTag),
+			asset: decodeURIComponent(rawAsset)
+		};
+	} catch {
+		return {
+			owner: rawOwner,
+			repo: rawRepo,
+			tag: rawTag,
+			asset: rawAsset
+		};
+	}
+}
+/**
+* Rewrite a release spec onto a newer tag. The asset file name keeps its
+* shape: an embedded version token equal to `oldVersion` is replaced by
+* `newVersion` (`dsh-skill-mcp-panel-2.0.3.tgz` → `…-2.0.4.tgz`) without
+* touching longer version numbers (`12.0.3`) that merely contain it.
+*/
+function releaseDownloadUrl(spec, newTag, newVersion, oldVersion) {
+	return `https://github.com/${spec.owner}/${spec.repo}/releases/download/${encodeURIComponent(newTag)}/${encodeURIComponent(replaceVersionToken(spec.asset, oldVersion, newVersion))}`;
+}
+function replaceVersionToken(asset, from, to) {
+	if (from.length === 0 || from === to) return asset;
+	const escaped = from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return asset.replace(new RegExp(`(?<![\\d.])${escaped}(?!\\d)`), to);
+}
 //#endregion
 //#region src/registry.ts
 /** Join a registry origin with a package name, encoding the scoped slash. */
@@ -208,6 +276,8 @@ var PluginInfoService = class {
 	now;
 	packuments = /* @__PURE__ */ new Map();
 	notes = /* @__PURE__ */ new Map();
+	githubLatest = /* @__PURE__ */ new Map();
+	githubReleases = /* @__PURE__ */ new Map();
 	constructor(config, fetchJson, now = () => Date.now()) {
 		this.config = config;
 		this.fetchJson = fetchJson;
@@ -216,10 +286,12 @@ var PluginInfoService = class {
 	/** List user-added plugins for one profile directory. */
 	async listPlugins(profileDir) {
 		const manifest = readProfileManifest(profileDir);
+		const profileCli = profileCliName(manifest.name, profileDir);
 		const listed = listUserPlugins(manifest).filter((item) => isAllowedScope(item.name, this.config.allowScopes));
-		const plugins = await Promise.all(listed.map(async (item) => this.describePlugin(profileDir, item.name, item.spec)));
+		const plugins = await Promise.all(listed.map(async (item) => this.describePlugin(profileDir, profileCli, item.name, item.spec)));
 		return {
 			profile: manifest.name ?? profileDir,
+			profileCli,
 			plugins
 		};
 	}
@@ -229,6 +301,10 @@ var PluginInfoService = class {
 		const installed = readInstalledPackage(profileDir, name);
 		if (plugin.source !== "registry") {
 			const installedVersion = installed?.version;
+			const releaseSpec = parseGithubReleaseSpec(plugin.spec);
+			if (releaseSpec !== void 0) try {
+				return await this.githubReleaseVersions(name, installedVersion, releaseSpec, limit);
+			} catch {}
 			return {
 				name,
 				...installedVersion === void 0 ? {} : { installedVersion },
@@ -251,18 +327,18 @@ var PluginInfoService = class {
 	}
 	/** Update notes for one published version. */
 	async versionNotes(profileDir, name, version) {
-		findUserPlugin(profileDir, name, this.config.allowScopes);
+		const plugin = findUserPlugin(profileDir, name, this.config.allowScopes);
 		const cacheKey = `${name}@${version}`;
 		const cached = this.notes.get(cacheKey);
 		if (cached !== void 0 && cached.expiresAt > this.now()) return cached.value;
-		const notes = await this.loadNotes(profileDir, name, version);
+		const notes = await this.loadNotes(profileDir, name, version, plugin.spec);
 		this.notes.set(cacheKey, {
 			value: notes,
 			expiresAt: this.now() + this.config.cacheTtlMs
 		});
 		return notes;
 	}
-	async describePlugin(profileDir, name, spec) {
+	async describePlugin(profileDir, profileCli, name, spec) {
 		const source = classifySpec(spec);
 		const installed = readInstalledPackage(profileDir, name);
 		const installedRepository = repositoryUrlOf(installed?.repository);
@@ -276,17 +352,19 @@ var PluginInfoService = class {
 			...installed?.homepage === void 0 ? {} : { homepage: installed.homepage },
 			...installedRepository === void 0 ? {} : { repository: installedRepository }
 		};
-		if (source !== "registry") return summary;
+		if (source !== "registry") return this.describeReleaseSpecPlugin(profileCli, spec, summary);
 		try {
 			const packument = await this.loadPackument(name);
 			const latestVersion = latestVersionOf(packument);
 			const homepage = summary.homepage ?? packument.homepage;
 			const repository = summary.repository ?? repositoryUrlOf(packument.repository);
+			const hasUpdate = hasNewerVersion(summary.installedVersion, latestVersion);
 			return {
 				...summary,
 				...packument.description === void 0 || summary.description !== void 0 ? {} : { description: packument.description },
 				...latestVersion === void 0 ? {} : { latestVersion },
-				hasUpdate: hasNewerVersion(summary.installedVersion, latestVersion),
+				hasUpdate,
+				...hasUpdate ? { updateCommand: pluginUpdateCommand(profileCli, name) } : {},
 				...homepage === void 0 ? {} : { homepage },
 				...repository === void 0 ? {} : { repository }
 			};
@@ -309,7 +387,106 @@ var PluginInfoService = class {
 		});
 		return packument;
 	}
-	async loadNotes(profileDir, name, version) {
+	/**
+	* The repo's latest published release (GitHub skips prereleases/drafts),
+	* or undefined when the repo has no releases. Negative answers are cached
+	* too so a repo without releases does not burn the API rate limit.
+	*/
+	async loadGithubLatest(owner, repo) {
+		const key = `${owner}/${repo}`;
+		const cached = this.githubLatest.get(key);
+		if (cached !== void 0 && cached.expiresAt > this.now()) return cached.value;
+		let payload;
+		try {
+			payload = await this.fetchJson(`https://api.github.com/repos/${owner}/${repo}/releases/latest`, this.config.timeoutMs, githubHeaders());
+		} catch (error) {
+			if (error instanceof Error && error.message.startsWith("HTTP 404")) {
+				this.githubLatest.set(key, {
+					value: void 0,
+					expiresAt: this.now() + this.config.cacheTtlMs
+				});
+				return;
+			}
+			throw error;
+		}
+		const release = asGithubRelease(payload);
+		this.githubLatest.set(key, {
+			value: release,
+			expiresAt: this.now() + this.config.cacheTtlMs
+		});
+		return release;
+	}
+	/** Newest-first GitHub releases for one repo, cached per repo. */
+	async loadGithubReleases(owner, repo, limit) {
+		const key = `${owner}/${repo}`;
+		const cached = this.githubReleases.get(key);
+		if (cached !== void 0 && cached.expiresAt > this.now()) return cached.value;
+		const perPage = Math.min(100, Math.max(1, Math.trunc(limit)));
+		const payload = await this.fetchJson(`https://api.github.com/repos/${owner}/${repo}/releases?per_page=${perPage}`, this.config.timeoutMs, githubHeaders());
+		if (!Array.isArray(payload)) throw new Error(`GitHub returned a non-array releases payload for ${owner}/${repo}`);
+		const releases = payload.map((item) => asGithubRelease(item)).filter((item) => item !== void 0);
+		this.githubReleases.set(key, {
+			value: releases,
+			expiresAt: this.now() + this.config.cacheTtlMs
+		});
+		return releases;
+	}
+	/**
+	* Update detection for GitHub-release tarball installs: the dependency spec
+	* itself names the repository and the currently installed tag, so the
+	* latest release is looked up from that repo — nothing is hardcoded.
+	*/
+	async describeReleaseSpecPlugin(profileCli, spec, summary) {
+		const releaseSpec = parseGithubReleaseSpec(spec);
+		if (releaseSpec === void 0) return summary;
+		const repository = `https://github.com/${releaseSpec.owner}/${releaseSpec.repo}`;
+		try {
+			const latest = await this.loadGithubLatest(releaseSpec.owner, releaseSpec.repo);
+			const latestVersion = latest === void 0 ? void 0 : versionFromTag(latest.tag);
+			const hasUpdate = hasNewerVersion(summary.installedVersion ?? versionFromTag(releaseSpec.tag), latestVersion);
+			const oldVersion = versionFromTag(releaseSpec.tag) ?? summary.installedVersion;
+			const updateUrl = latest !== void 0 && latestVersion !== void 0 && oldVersion !== void 0 && hasUpdate ? releaseDownloadUrl(releaseSpec, latest.tag, latestVersion, oldVersion) : void 0;
+			return {
+				...summary,
+				...summary.repository === void 0 ? { repository } : {},
+				...latestVersion === void 0 ? {} : { latestVersion },
+				hasUpdate,
+				...hasUpdate && updateUrl !== void 0 ? { updateCommand: `dsh plugin --profile ${profileCli} add "${updateUrl}"` } : {}
+			};
+		} catch (error) {
+			return {
+				...summary,
+				repository,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	/** GitHub release history reshaped into version rows for one URL install. */
+	async githubReleaseVersions(name, installedVersion, releaseSpec, limit) {
+		const releases = await this.loadGithubReleases(releaseSpec.owner, releaseSpec.repo, limit);
+		const normalizedInstalled = installedVersion === void 0 ? void 0 : normalizeVersion(installedVersion);
+		const published = releases.filter((release) => !release.draft && versionFromTag(release.tag) !== void 0).slice(0, Math.max(0, limit));
+		const rows = published.map((release) => {
+			const version = versionFromTag(release.tag);
+			return {
+				version,
+				...release.publishedAt === void 0 ? {} : { publishedAt: release.publishedAt },
+				latest: false,
+				installed: normalizedInstalled !== void 0 && version === normalizedInstalled
+			};
+		});
+		const latestIndex = published.findIndex((release) => !release.prerelease);
+		const latestRow = (latestIndex === -1 ? rows[0] : rows[latestIndex]) ?? void 0;
+		if (latestRow !== void 0) latestRow.latest = true;
+		const latestVersion = latestRow?.version;
+		return {
+			name,
+			...installedVersion === void 0 ? {} : { installedVersion },
+			...latestVersion === void 0 ? {} : { latestVersion },
+			versions: rows
+		};
+	}
+	async loadNotes(profileDir, name, version, spec) {
 		const installed = readInstalledPackage(profileDir, name);
 		let packument;
 		try {
@@ -317,8 +494,13 @@ var PluginInfoService = class {
 		} catch {
 			packument = void 0;
 		}
+		const releaseSpec = parseGithubReleaseSpec(spec);
 		const repository = repositoryUrlOf(installed?.repository) ?? repositoryUrlOf(packument?.repository);
-		const github = repository === void 0 ? void 0 : parseGithubRepo(repository);
+		let github = repository === void 0 ? void 0 : parseGithubRepo(repository);
+		if (github === void 0 && releaseSpec !== void 0) github = {
+			owner: releaseSpec.owner,
+			repo: releaseSpec.repo
+		};
 		const publishedAt = packument?.time?.[version];
 		const base = {
 			name,
@@ -327,7 +509,8 @@ var PluginInfoService = class {
 			...publishedAt === void 0 ? {} : { publishedAt }
 		};
 		if (github === void 0) return base;
-		const release = await this.fetchGithubRelease(github.owner, github.repo, version);
+		const specTag = releaseSpec !== void 0 && versionFromTag(releaseSpec.tag) === normalizeVersion(version) ? releaseSpec.tag : void 0;
+		const release = await this.fetchGithubRelease(github.owner, github.repo, version, specTag === void 0 ? [] : [specTag]);
 		if (release !== void 0) return {
 			...base,
 			source: "github-release",
@@ -347,8 +530,12 @@ var PluginInfoService = class {
 			commits: compare.commits
 		};
 	}
-	async fetchGithubRelease(owner, repo, version) {
-		const tags = unique([version, `v${version}`]);
+	async fetchGithubRelease(owner, repo, version, preferredTags = []) {
+		const tags = unique([
+			...preferredTags,
+			version,
+			`v${version}`
+		]);
 		for (const tag of tags) try {
 			const payload = await this.fetchJson(`https://api.github.com/repos/${owner}/${repo}/releases/tags/${encodeURIComponent(tag)}`, this.config.timeoutMs, githubHeaders());
 			if (payload === null || typeof payload !== "object" || Array.isArray(payload)) continue;
@@ -410,6 +597,22 @@ function findUserPlugin(profileDir, name, allowScopes) {
 function unique(values) {
 	return [...new Set(values.filter((value) => value.length > 0))];
 }
+/** Extract the release fields the service needs from a GitHub API payload. */
+function asGithubRelease(payload) {
+	if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+	const record = payload;
+	const tag = typeof record.tag_name === "string" && record.tag_name.length > 0 ? record.tag_name : void 0;
+	if (tag === void 0) return void 0;
+	const publishedAt = typeof record.published_at === "string" ? record.published_at : void 0;
+	const url = typeof record.html_url === "string" ? record.html_url : void 0;
+	return {
+		tag,
+		...publishedAt === void 0 ? {} : { publishedAt },
+		...url === void 0 ? {} : { url },
+		prerelease: record.prerelease === true,
+		draft: record.draft === true
+	};
+}
 /** True when `name` matches one of the configured scope prefixes (empty list = allow all). */
 function isAllowedScope(name, allowScopes) {
 	if (allowScopes === void 0 || allowScopes.length === 0) return true;
@@ -460,7 +663,7 @@ const Config = z.object({
 	defaultVersionLimit: z.number().step(1).min(1).max(50).default(10),
 	timeoutMs: z.number().step(1).min(1e3).default(15e3),
 	cacheTtlMs: z.number().step(1).min(0).default(3e5),
-	allowScopes: z.array(z.string()).default(["@eya46/"])
+	allowScopes: z.array(z.string())
 });
 /**
 * Register the plugin-info HTTP API when a web server is present.
@@ -540,4 +743,4 @@ function sendError(res, error) {
 	});
 }
 //#endregion
-export { Config, DEFAULT_VERSION_LIMIT, PluginInfoService, apply, classifySpec, fetchJson, hasNewerVersion, latestVersionOf, listUserPlugins, name, packumentUrl, parseGithubRepo, parseVersion, profileDirFromBaseUrl, recentVersions, repositoryUrlOf, resolveVersionLimit };
+export { Config, DEFAULT_VERSION_LIMIT, PluginInfoService, apply, classifySpec, fetchJson, hasNewerVersion, latestVersionOf, listUserPlugins, name, packumentUrl, parseGithubReleaseSpec, parseGithubRepo, parseVersion, pluginUpdateCommand, profileCliName, profileDirFromBaseUrl, recentVersions, releaseDownloadUrl, repositoryUrlOf, resolveVersionLimit, versionFromTag };

package/lib/types/client.d.ts

@@ -21,14 +21,51 @@ interface MinimalReact {
     useEffect(effect: () => void | (() => void), deps?: unknown[]): void;
     useCallback<T>(fn: T, deps: unknown[]): T;
 }
+/**
+ * Subset of DSH's `MarkdownText` shared primitive (GFM + KaTeX, unsafe
+ * HTML/protocols stripped). `labels` is REQUIRED in practice: the fenced
+ * code-block renderer reads `labels.code.copyLabel` / `labels.code.copiedLabel`
+ * with no defaults, and the footnotes section reads `labels.footnotes` —
+ * passing only `text` crashes the whole settings section the moment a
+ * release note contains a fenced code block.
+ */
+interface MarkdownLabels {
+    code: {
+        copyLabel: string;
+        copiedLabel: string;
+    };
+    footnotes: string;
+}
+type MarkdownTextComponent = (props: {
+    text: string;
+    labels?: MarkdownLabels;
+}) => unknown;
+/** Labels for the MarkdownText copy button / footnotes heading (settings UI is zh). */
+declare const MARKDOWN_LABELS: MarkdownLabels;
 interface SlotsService {
     inject(key: string, register: () => void): void;
     register(options: Record<string, unknown>, component: unknown): void;
 }
+/**
+ * Minimal structural mirror of dsh-better-sidebar's client service — the
+ * only method we call is `registerTab`. The plugin is an OPTIONAL soft
+ * dependency: this plugin does not value-import it, does not list it in
+ * peerDependencies, and reaches the service through `ctx.inject(...)` so
+ * the whole registration block is inert when better-sidebar is absent.
+ */
+interface BetterSidebarServiceLike {
+    registerTab(descriptor: Record<string, unknown>): () => void;
+}
 interface ClientContext {
     slots: SlotsService;
     /** Cordis fiber-lifetime effect: runs now, disposes on fiber unload. */
     effect(callback: () => (() => void) | void, label?: string): () => void;
+    /**
+     * Cordis child-fiber spawn: waits until all named services are available
+     * before running the callback. Used to register with better-sidebar only
+     * when that plugin is loaded (optional soft dependency).
+     */
+    inject(deps: string[], apply: (ctx: ClientContext) => void): unknown;
 }
 interface PluginRow {
     name: string;
@@ -38,6 +75,7 @@ interface PluginRow {
     installedVersion?: string;
     latestVersion?: string;
     hasUpdate: boolean;
+    updateCommand?: string;
     homepage?: string;
     repository?: string;
     error?: string;

package/lib/types/index.d.ts

@@ -6,11 +6,11 @@
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 import type { PluginConfig } from './types.ts';
-export { classifySpec, listUserPlugins, parseGithubRepo, repositoryUrlOf } from './profile.ts';
-export { hasNewerVersion, parseVersion } from './semver.ts';
+export { classifySpec, listUserPlugins, parseGithubReleaseSpec, parseGithubRepo, pluginUpdateCommand, profileCliName, releaseDownloadUrl, repositoryUrlOf } from './profile.ts';
+export { hasNewerVersion, parseVersion, versionFromTag } from './semver.ts';
 export { latestVersionOf, packumentUrl, recentVersions, resolveVersionLimit } from './registry.ts';
 export { fetchJson, PluginInfoService, profileDirFromBaseUrl } from './service.ts';
-export type { InstalledPackage, Packument, PluginConfig, PluginSource, PluginSummary, PluginVersionRow, ProfileManifest, VersionNotes, } from './types.ts';
+export type { GithubReleaseSpec, InstalledPackage, Packument, PluginConfig, PluginSource, PluginSummary, PluginVersionRow, ProfileManifest, VersionNotes, } from './types.ts';
 /** Cordis plugin name used by Loader diagnostics. */
 export declare const name = "dsh-plugin-info";
 /** Default version window shown by the settings page. */

package/lib/types/profile.d.ts

@@ -1,4 +1,14 @@
-import type { InstalledPackage, PluginSource, ProfileManifest } from './types.ts';
+import type { GithubReleaseSpec, InstalledPackage, PluginSource, ProfileManifest } from './types.ts';
+/**
+ * CLI `--profile` argument for this profile directory.
+ *
+ * DSH names the manifest `dsh-profile-<dir>` and the CLI flag is the
+ * directory basename (`web`, `tui`, …). Prefer the manifest prefix so temp
+ * test dirs still resolve; fall back to the folder name, then `web`.
+ */
+export declare function profileCliName(manifestName: string | undefined, profileDir: string): string;
+/** `dsh plugin add …@latest` command for one registry package in this profile. */
+export declare function pluginUpdateCommand(profileCli: string, packageName: string): string;
 /** Classify a profile dependency spec. */
 export declare function classifySpec(spec: string): PluginSource;
 /** User-added plugins are the profile's own `dependencies`, not in-box bundles. */
@@ -18,4 +28,17 @@ export declare function parseGithubRepo(input: string): {
     owner: string;
     repo: string;
 } | undefined;
+/**
+ * Parse a `github.com/<owner>/<repo>/releases/download/<tag>/<asset>`
+ * dependency spec into its repository, tag, and asset. Everything is derived
+ * from the spec itself — no per-plugin configuration.
+ */
+export declare function parseGithubReleaseSpec(spec: string): GithubReleaseSpec | undefined;
+/**
+ * Rewrite a release spec onto a newer tag. The asset file name keeps its
+ * shape: an embedded version token equal to `oldVersion` is replaced by
+ * `newVersion` (`dsh-skill-mcp-panel-2.0.3.tgz` → `…-2.0.4.tgz`) without
+ * touching longer version numbers (`12.0.3`) that merely contain it.
+ */
+export declare function releaseDownloadUrl(spec: GithubReleaseSpec, newTag: string, newVersion: string, oldVersion: string): string;
 //# sourceMappingURL=profile.d.ts.map

package/lib/types/semver.d.ts

@@ -13,6 +13,8 @@ export declare function parseVersion(input: string): ParsedVersion | undefined;
 export declare function compareParsed(left: ParsedVersion, right: ParsedVersion): number;
 /** Compare two version strings. Unparseable values compare as equal (0). */
 export declare function compareVersions(left: string, right: string): number;
+/** Version embedded in a release tag: `v2.0.3`, `2.0.3`, or `panel-1.20.3-rc.1`. */
+export declare function versionFromTag(tag: string): string | undefined;
 /** True when `latest` is a newer published version than `installed`. */
 export declare function hasNewerVersion(installed: string | undefined, latest: string | undefined): boolean;
 //# sourceMappingURL=semver.d.ts.map

package/lib/types/service.d.ts

@@ -8,10 +8,13 @@ export declare class PluginInfoService {
     private readonly now;
     private readonly packuments;
     private readonly notes;
+    private readonly githubLatest;
+    private readonly githubReleases;
     constructor(config: PluginConfig, fetchJson: JsonFetcher, now?: () => number);
     /** List user-added plugins for one profile directory. */
     listPlugins(profileDir: string): Promise<{
         profile: string;
+        profileCli: string;
         plugins: PluginSummary[];
     }>;
     /** Recent published versions for one user-added plugin. */
@@ -25,6 +28,22 @@ export declare class PluginInfoService {
     versionNotes(profileDir: string, name: string, version: string): Promise<VersionNotes>;
     private describePlugin;
     private loadPackument;
+    /**
+     * The repo's latest published release (GitHub skips prereleases/drafts),
+     * or undefined when the repo has no releases. Negative answers are cached
+     * too so a repo without releases does not burn the API rate limit.
+     */
+    private loadGithubLatest;
+    /** Newest-first GitHub releases for one repo, cached per repo. */
+    private loadGithubReleases;
+    /**
+     * Update detection for GitHub-release tarball installs: the dependency spec
+     * itself names the repository and the currently installed tag, so the
+     * latest release is looked up from that repo — nothing is hardcoded.
+     */
+    private describeReleaseSpecPlugin;
+    /** GitHub release history reshaped into version rows for one URL install. */
+    private githubReleaseVersions;
     private loadNotes;
     private fetchGithubRelease;
     private fetchGithubCompare;

package/lib/types/types.d.ts

@@ -1,5 +1,14 @@
 /** Where a profile dependency spec came from. */
 export type PluginSource = 'registry' | 'file' | 'link' | 'git' | 'other';
+/** A profile dependency spec that installs a GitHub release tarball directly. */
+export interface GithubReleaseSpec {
+    owner: string;
+    repo: string;
+    /** Release tag embedded in the download URL, e.g. `v2.0.3`. */
+    tag: string;
+    /** Tarball file name, e.g. `dsh-skill-mcp-panel-2.0.3.tgz`. */
+    asset: string;
+}
 /** One user-added profile plugin as the UI lists it. */
 export interface PluginSummary {
     /** npm package name. */
@@ -16,6 +25,11 @@ export interface PluginSummary {
     latestVersion?: string;
     /** True when the registry latest is newer than the installed version. */
     hasUpdate: boolean;
+    /**
+     * `dsh plugin --profile <name> add <pkg>@latest` when this row has a
+     * registry update. Omitted for local / git installs and up-to-date packages.
+     */
+    updateCommand?: string;
     /** Package homepage. */
     homepage?: string;
     /** Normalized repository browse URL. */
@@ -102,10 +116,11 @@ export interface PluginConfig {
     /** How long packument and notes stay cached. */
     cacheTtlMs: number;
     /**
-     * Optional allow-list: when non-empty, only plugins whose npm name starts
-     * with one of these prefixes (case-insensitive, e.g. `@eya46/`) appear in
-     * the settings page and the version/notes APIs. Set to `[]` to show all.
+     * Optional allow-list: when omitted or empty, all profile-added plugins
+     * appear in the settings page and the version/notes APIs. When non-empty,
+     * only plugins whose npm name starts with one of these prefixes appear
+     * (case-insensitive, e.g. `@eya46/`).
      */
-    allowScopes: string[];
+    allowScopes?: string[];
 }
 //# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@eya46/dsh-plugin-info",
   "description": "List profile-added DSH plugins, mark available updates, and show recent version notes",
-  "version": "0.0.2",
+  "version": "0.1.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -49,8 +49,8 @@
     }
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.7"
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-host-webserver": {
@@ -58,12 +58,12 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.7",
-    "@types/node": "^22.20.0",
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.2",
+    "@types/node": "^22.20.3",
     "tsdown": "^0.22.2",
     "typescript": "^5.9.3",
     "vitest": "^4.1.8"