@eya46/dsh-plugin-info 0.0.3 → 0.1.1

package/README.md

@@ -6,6 +6,8 @@
 
 - 列出已安装插件、当前版本、来源（npm / 本地 / git）
 - 对 registry 安装的包对照 `dist-tags.latest`，标出可更新
+- 对 **GitHub Release 直装**的包（依赖是 `github.com/…/releases/download/<tag>/<file>.tgz` 链接），从依赖链接里解析出仓库和当前版本，对照该仓库的最新 Release 标出可更新——仓库与版本全部取自 profile 里的依赖信息和已安装的包信息，无需任何按插件配置；更新命令直接指向按新版本重写过的 tarball 链接，版本列表也会展示该仓库最近的 Release，点开可读对应 Release 说明
+- 可更新时一键复制 `dsh plugin --profile <当前 profile> add <包>@latest`（profile 从当前运行的 Profile 清单解析，web 端通常是 `web`）
 - 展开后默认看最近 **10** 条版本
 - 点某个版本读更新说明：优先 GitHub Release，没有就回落到相邻版本的 compare / commit
 
@@ -29,13 +31,15 @@ dsh plugin --profile web add "file:./packages/dsh-plugin-info"
 
 `dsh.bundle` 会把 `@eya46/dsh-plugin-info` 写进该 Profile 的 bundle 列表。重启 `dsh web` 后，打开设置 → **插件信息**。
 
+兼容的 DSH 版本：`^0.1.5-rc.2`（0.1.x）与 `^0.2.0-rc.2`（0.2.x，含当前 Desktop / Web 发行版）。**0.1.0 只声明了 `^0.1.5-rc.2`**，装在 0.2.0-rc.2 上会被插件管理器的兼容性预检拒绝（提示「要求 @deepseek-ai/dsh-host-webserver ^0.1.5-rc.2」），请升级到 0.1.1 或更新版本。
+
 ## HTTP
 
 本机回环可用：
 
 | 端点 | 说明 |
 | --- | --- |
-| `GET /plugin-info/api/plugins` | 当前 Profile 用户插件 + 是否有更新 |
+| `GET /plugin-info/api/plugins` | 当前 Profile 用户插件 + 是否有更新；含 `profileCli`，可更新的 registry 包还会带 `updateCommand` |
 | `GET /plugin-info/api/versions?name=<pkg>&limit=10` | 最近版本，默认 10 条 |
 | `GET /plugin-info/api/notes?name=<pkg>&version=<ver>` | 该版本的更新说明 |
 

package/lib/client.js

@@ -7,6 +7,11 @@
  *
  * @module @eya46/dsh-plugin-info/client
  */
+/** Labels for the MarkdownText copy button / footnotes heading (settings UI is zh). */
+const MARKDOWN_LABELS = {
+    code: { copyLabel: '复制代码', copiedLabel: '已复制' },
+    footnotes: '脚注',
+};
 ;
 (() => {
     const loader = window.__ModuleLoader__;
@@ -25,12 +30,17 @@
                 '.dpi-rowButton { height: 28px; padding: 0 10px; font-size: 12px; line-height: 18px; }',
                 '.dpi-secondaryButton:hover:not(:disabled), .dpi-rowButton:hover:not(:disabled) { background: var(--dsw-alias-interactive-bg-hover-solid); }',
                 '.dpi-secondaryButton:disabled, .dpi-rowButton:disabled { opacity: 0.4; cursor: default; }',
-                '.dpi-secondaryButton:focus-visible, .dpi-rowButton:focus-visible, .dpi-head:focus-visible, .dpi-version:focus-visible { outline: none; box-shadow: 0 0 0 2px var(--dsw-alias-border-l3); }',
+                '.dpi-secondaryButton:focus-visible, .dpi-rowButton:focus-visible, .dpi-head:focus-visible, .dpi-version:focus-visible, .dpi-updateCopy:focus-visible { outline: none; box-shadow: 0 0 0 2px var(--dsw-alias-border-l3); }',
                 '.dpi-status { font-size: 12px; line-height: 18px; color: var(--dsw-alias-label-secondary); }',
                 '.dpi-banner { margin: 0; font-size: 12px; line-height: 18px; color: var(--dsw-alias-state-error-primary); }',
                 '.dpi-empty { color: var(--dsw-alias-label-tertiary); font-size: 14px; line-height: 22px; }',
                 '.dpi-cards { margin: 0; padding: 0; list-style: none; display: flex; flex-direction: column; gap: 10px; }',
                 '.dpi-card { border: 1px solid var(--dsw-alias-border-l2); border-radius: 12px; overflow: hidden; }',
+                '.dpi-cardTop { display: flex; align-items: stretch; gap: 0; }',
+                '.dpi-cardTop .dpi-head { flex: 1; min-width: 0; }',
+                '.dpi-updateCopy { box-sizing: border-box; flex-shrink: 0; align-self: center; height: 28px; margin: 0 12px 0 0; padding: 0 10px; border: 1px solid var(--dsw-alias-border-l3); border-radius: 14px; background: transparent; color: var(--dsw-alias-state-warn-label); font: inherit; font-size: 12px; line-height: 18px; cursor: pointer; }',
+                '.dpi-updateCopy:hover { background: var(--dsw-alias-interactive-bg-hover-solid); }',
+                '.dpi-command { margin: 0; font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 12px; line-height: 18px; color: var(--dsw-alias-label-secondary); word-break: break-all; }',
                 '.dpi-head { box-sizing: border-box; width: 100%; display: flex; align-items: center; flex-wrap: wrap; gap: 8px; padding: 12px 14px; border: none; background: transparent; color: inherit; font: inherit; text-align: left; cursor: pointer; }',
                 '.dpi-head:hover { background: var(--dsw-alias-interactive-bg-hover-solid); }',
                 '.dpi-name { font-size: 14px; line-height: 22px; font-weight: 500; }',
@@ -59,6 +69,7 @@
                 '.dpi-sidebar .dpi-card .dpi-body { padding: 0 12px 12px; }',
                 '.dpi-sidebar .dpi-actions { gap: 6px; }',
                 '.dpi-sidebar .dpi-rowButton { height: 26px; padding: 0 8px; }',
+                '.dpi-sidebar .dpi-updateCopy { height: 26px; margin-right: 10px; padding: 0 8px; }',
             ].join('\n');
             const React = require('react');
             // Reuse DSH's shared untrusted-Markdown renderer instead of rolling our
@@ -67,6 +78,30 @@
             const uiPrimitives = require('@deepseek-ai/dsh-client-ui-primitives');
             const MarkdownText = uiPrimitives.MarkdownText;
             const h = React.createElement.bind(React);
+            const ReactComponent = React.Component;
+            /**
+             * MarkdownText is an undocumented shell primitive whose render can throw
+             * (labels shape drift, markdown edge cases). Contain any failure to this
+             * one note body instead of crashing the whole settings section.
+             */
+            class SafeMarkdown extends ReactComponent {
+                constructor(props) {
+                    super(props);
+                    this.state = { failed: false };
+                }
+                static getDerivedStateFromError() {
+                    return { failed: true };
+                }
+                componentDidCatch(error) {
+                    console.warn('[dsh-plugin-info] MarkdownText failed; falling back to plain text', error);
+                }
+                render() {
+                    if (this.state.failed === true) {
+                        return h('pre', { className: 'dpi-id', style: { whiteSpace: 'pre-wrap', margin: 0 } }, this.props.text);
+                    }
+                    return h(MarkdownText, { text: this.props.text, labels: MARKDOWN_LABELS });
+                }
+            }
             const ensureStyles = () => {
                 if (document.querySelector('style[data-plugin="@eya46/dsh-plugin-info"]') !== null)
                     return;
@@ -148,17 +183,18 @@
                 const [notes, setNotes] = React.useState({});
                 const [notesBusy, setNotesBusy] = React.useState('');
                 const [copied, setCopied] = React.useState({});
-                const copyName = React.useCallback((name) => {
+                const [profileCli, setProfileCli] = React.useState('web');
+                const copyText = React.useCallback((key, text) => {
                     const write = () => {
                         if (typeof navigator !== 'undefined' && navigator.clipboard !== undefined) {
-                            return navigator.clipboard.writeText(name);
+                            return navigator.clipboard.writeText(text);
                         }
                         return Promise.reject(new Error('clipboard unavailable'));
                     };
                     write()
                         .then(() => {
-                        setCopied((prev) => ({ ...prev, [name]: true }));
-                        window.setTimeout(() => setCopied((prev) => ({ ...prev, [name]: false })), 1200);
+                        setCopied((prev) => ({ ...prev, [key]: true }));
+                        window.setTimeout(() => setCopied((prev) => ({ ...prev, [key]: false })), 1200);
                     })
                         .catch(() => { });
                 }, []);
@@ -170,6 +206,8 @@
                         if (!Array.isArray(data.plugins))
                             throw new Error(data.message ?? 'unexpected response');
                         setRows(data.plugins);
+                        if (typeof data.profileCli === 'string' && data.profileCli.length > 0)
+                            setProfileCli(data.profileCli);
                         setError('');
                     })
                         .catch((caught) => setError(String(caught)))
@@ -225,7 +263,7 @@
                 const updateCount = rows.filter((row) => row.hasUpdate).length;
                 const children = [
                     h('h2', { key: 'title', className: 'dpi-title' }, '插件信息'),
-                    h('p', { key: 'intro', className: 'dpi-intro' }, '当前 Profile 里用户添加的插件（不含随发行版内置的 bundle）。展开后默认看最近 10 个版本，点版本可看更新说明。'),
+                    h('p', { key: 'intro', className: 'dpi-intro' }, '当前 Profile（' + profileCli + '）里用户添加的插件（不含随发行版内置的 bundle）。有更新时可一键复制 dsh plugin 命令；展开后默认看最近 10 个版本，点版本可看更新说明。'),
                     h('div', { key: 'toolbar', className: 'dpi-toolbar' }, h('button', { className: 'dpi-secondaryButton', disabled: busy, onClick: () => { load(); } }, busy ? '刷新中…' : '刷新'), h('span', { className: 'dpi-status' }, '共 ' + rows.length + ' 个插件' + (updateCount > 0 ? ' · ' + updateCount + ' 个可更新' : ''))),
                 ];
                 if (error !== '')
@@ -245,14 +283,20 @@
                     if (plugin.hasUpdate && plugin.latestVersion !== undefined) {
                         head.push(h('span', { key: 'up', className: 'dpi-tag', 'data-tone': 'warn' }, '可更新 ' + plugin.latestVersion));
                     }
-                    else if (plugin.source === 'registry' && plugin.latestVersion !== undefined) {
+                    else if (!plugin.hasUpdate && plugin.latestVersion !== undefined) {
                         head.push(h('span', { key: 'ok', className: 'dpi-tag', 'data-tone': 'ok' }, '已是最新'));
                     }
+                    const updateCommand = plugin.updateCommand
+                        ?? ('dsh plugin --profile ' + profileCli + ' add ' + plugin.name + '@latest');
+                    const updateCopied = copied['update:' + plugin.name] === true;
                     const body = [];
                     if (expanded) {
                         if (plugin.description !== undefined)
                             body.push(h('p', { key: 'desc', className: 'dpi-meta' }, plugin.description));
                         body.push(h('p', { key: 'spec', className: 'dpi-meta' }, '依赖：', h('span', { className: 'dpi-id' }, plugin.spec), plugin.latestVersion === undefined ? null : ' · 最新 ' + plugin.latestVersion));
+                        if (plugin.hasUpdate) {
+                            body.push(h('p', { key: 'upd', className: 'dpi-command' }, updateCommand));
+                        }
                         if (plugin.error !== undefined)
                             body.push(h('p', { key: 'perr', className: 'dpi-banner' }, plugin.error));
                         const links = [
@@ -260,7 +304,7 @@
                                 key: 'copy',
                                 className: 'dpi-copyTag',
                                 title: '复制包名',
-                                onClick: () => { copyName(plugin.name); },
+                                onClick: () => { copyText(plugin.name, plugin.name); },
                             }, copied[plugin.name] === true ? '已复制' : plugin.name),
                             h('button', {
                                 key: 'vers',
@@ -268,6 +312,14 @@
                                 onClick: () => { loadVersions(plugin.name); },
                             }, versions[plugin.name] === undefined ? '加载版本' : '重新加载版本'),
                         ];
+                        if (plugin.hasUpdate) {
+                            links.push(h('button', {
+                                key: 'upd',
+                                className: 'dpi-rowButton',
+                                title: updateCommand,
+                                onClick: () => { copyText('update:' + plugin.name, updateCommand); },
+                            }, updateCopied ? '已复制更新命令' : '复制更新命令'));
+                        }
                         if (plugin.homepage !== undefined) {
                             links.push(h('a', { key: 'home', className: 'dpi-rowButton dpi-link', href: plugin.homepage, target: '_blank', rel: 'noreferrer' }, '主页'));
                         }
@@ -284,7 +336,7 @@
                             body.push(h('p', { key: 'vload', className: 'dpi-meta' }, '正在加载最近 10 个版本…'));
                         }
                         else if (pluginVersions.length === 0) {
-                            body.push(h('p', { key: 'vempty', className: 'dpi-meta' }, plugin.source === 'registry' ? '注册表没有版本记录。' : '本地 / git 安装没有更多历史版本。'));
+                            body.push(h('p', { key: 'vempty', className: 'dpi-meta' }, plugin.source === 'registry' ? '注册表没有版本记录。' : '没有可展示的历史版本。'));
                         }
                         else {
                             const versionNodes = pluginVersions.map((row) => {
@@ -310,7 +362,7 @@
                                         if (note.title !== undefined)
                                             noteChildren.push(h('p', { key: 'nt', className: 'dpi-meta' }, note.title));
                                         if (note.body !== undefined && note.body !== '') {
-                                            noteChildren.push(h(MarkdownText, { key: 'nb', text: note.body }));
+                                            noteChildren.push(h(SafeMarkdown, { key: 'nb', text: note.body }));
                                         }
                                         if (note.url !== undefined) {
                                             noteChildren.push(h('a', { key: 'nu', className: 'dpi-link', href: note.url, target: '_blank', rel: 'noreferrer' }, '在 GitHub 查看 Release'));
@@ -338,11 +390,20 @@
                             body.push(h('div', { key: 'versions', className: 'dpi-versions' }, ...versionNodes));
                         }
                     }
-                    cards.push(h('li', { key: plugin.name, className: 'dpi-card' }, h('button', {
+                    cards.push(h('li', { key: plugin.name, className: 'dpi-card' }, h('div', { className: 'dpi-cardTop' }, h('button', {
                         className: 'dpi-head',
                         'aria-expanded': expanded,
                         onClick: () => { togglePlugin(plugin.name); },
-                    }, ...head), expanded ? h('div', { className: 'dpi-body' }, ...body) : null));
+                    }, ...head), plugin.hasUpdate
+                        ? h('button', {
+                            className: 'dpi-updateCopy',
+                            title: updateCommand,
+                            onClick: (event) => {
+                                event.stopPropagation?.();
+                                copyText('update:' + plugin.name, updateCommand);
+                            },
+                        }, updateCopied ? '已复制' : '复制更新命令')
+                        : null), expanded ? h('div', { className: 'dpi-body' }, ...body) : null));
                 }
                 children.push(h('ul', { key: 'cards', className: 'dpi-cards' }, ...cards));
                 return h('div', { className: 'dpi-section' }, ...children);

package/lib/index.js

@@ -64,6 +64,11 @@ function compareParsed(left, right) {
 	}
 	return 0;
 }
+/** Version embedded in a release tag: `v2.0.3`, `2.0.3`, or `panel-1.20.3-rc.1`. */
+function versionFromTag(tag) {
+	if (parseVersion(tag) !== void 0) return normalizeVersion(tag);
+	return /(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/.exec(tag)?.[1];
+}
 /** True when `latest` is a newer published version than `installed`. */
 function hasNewerVersion(installed, latest) {
 	if (installed === void 0 || latest === void 0) return false;
@@ -75,6 +80,28 @@ function hasNewerVersion(installed, latest) {
 }
 //#endregion
 //#region src/profile.ts
+/** Prefix DSH writes onto a profile package.json `name`. */
+const PROFILE_PACKAGE_PREFIX = "dsh-profile-";
+/**
+* CLI `--profile` argument for this profile directory.
+*
+* DSH names the manifest `dsh-profile-<dir>` and the CLI flag is the
+* directory basename (`web`, `tui`, …). Prefer the manifest prefix so temp
+* test dirs still resolve; fall back to the folder name, then `web`.
+*/
+function profileCliName(manifestName, profileDir) {
+	if (typeof manifestName === "string" && manifestName.startsWith(PROFILE_PACKAGE_PREFIX)) {
+		const id = manifestName.slice(12).trim();
+		if (id.length > 0) return id;
+	}
+	const dirName = profileDir.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? "";
+	if (dirName.length > 0 && dirName !== "." && dirName !== ".." && !/^[A-Za-z]:$/.test(dirName)) return dirName;
+	return "web";
+}
+/** `dsh plugin add …@latest` command for one registry package in this profile. */
+function pluginUpdateCommand(profileCli, packageName) {
+	return `dsh plugin --profile ${profileCli} add ${packageName}@latest`;
+}
 /** Classify a profile dependency spec. */
 function classifySpec(spec) {
 	const trimmed = spec.trim();
@@ -154,6 +181,47 @@ function parseGithubRepo(input) {
 		};
 	}
 }
+const GITHUB_RELEASE_SPEC = /^https?:\/\/github\.com\/([^/\s]+)\/([^/\s]+)\/releases\/download\/([^/\s]+)\/([^/\s]+)$/i;
+/**
+* Parse a `github.com/<owner>/<repo>/releases/download/<tag>/<asset>`
+* dependency spec into its repository, tag, and asset. Everything is derived
+* from the spec itself — no per-plugin configuration.
+*/
+function parseGithubReleaseSpec(spec) {
+	const match = GITHUB_RELEASE_SPEC.exec(spec.trim());
+	if (match === null) return void 0;
+	const [rawOwner, rawRepo, rawTag, rawAsset] = match.slice(1);
+	if (rawOwner === void 0 || rawRepo === void 0 || rawTag === void 0 || rawAsset === void 0) return void 0;
+	try {
+		return {
+			owner: decodeURIComponent(rawOwner),
+			repo: decodeURIComponent(rawRepo),
+			tag: decodeURIComponent(rawTag),
+			asset: decodeURIComponent(rawAsset)
+		};
+	} catch {
+		return {
+			owner: rawOwner,
+			repo: rawRepo,
+			tag: rawTag,
+			asset: rawAsset
+		};
+	}
+}
+/**
+* Rewrite a release spec onto a newer tag. The asset file name keeps its
+* shape: an embedded version token equal to `oldVersion` is replaced by
+* `newVersion` (`dsh-skill-mcp-panel-2.0.3.tgz` → `…-2.0.4.tgz`) without
+* touching longer version numbers (`12.0.3`) that merely contain it.
+*/
+function releaseDownloadUrl(spec, newTag, newVersion, oldVersion) {
+	return `https://github.com/${spec.owner}/${spec.repo}/releases/download/${encodeURIComponent(newTag)}/${encodeURIComponent(replaceVersionToken(spec.asset, oldVersion, newVersion))}`;
+}
+function replaceVersionToken(asset, from, to) {
+	if (from.length === 0 || from === to) return asset;
+	const escaped = from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return asset.replace(new RegExp(`(?<![\\d.])${escaped}(?!\\d)`), to);
+}
 //#endregion
 //#region src/registry.ts
 /** Join a registry origin with a package name, encoding the scoped slash. */
@@ -208,6 +276,8 @@ var PluginInfoService = class {
 	now;
 	packuments = /* @__PURE__ */ new Map();
 	notes = /* @__PURE__ */ new Map();
+	githubLatest = /* @__PURE__ */ new Map();
+	githubReleases = /* @__PURE__ */ new Map();
 	constructor(config, fetchJson, now = () => Date.now()) {
 		this.config = config;
 		this.fetchJson = fetchJson;
@@ -216,10 +286,12 @@ var PluginInfoService = class {
 	/** List user-added plugins for one profile directory. */
 	async listPlugins(profileDir) {
 		const manifest = readProfileManifest(profileDir);
+		const profileCli = profileCliName(manifest.name, profileDir);
 		const listed = listUserPlugins(manifest).filter((item) => isAllowedScope(item.name, this.config.allowScopes));
-		const plugins = await Promise.all(listed.map(async (item) => this.describePlugin(profileDir, item.name, item.spec)));
+		const plugins = await Promise.all(listed.map(async (item) => this.describePlugin(profileDir, profileCli, item.name, item.spec)));
 		return {
 			profile: manifest.name ?? profileDir,
+			profileCli,
 			plugins
 		};
 	}
@@ -229,6 +301,10 @@ var PluginInfoService = class {
 		const installed = readInstalledPackage(profileDir, name);
 		if (plugin.source !== "registry") {
 			const installedVersion = installed?.version;
+			const releaseSpec = parseGithubReleaseSpec(plugin.spec);
+			if (releaseSpec !== void 0) try {
+				return await this.githubReleaseVersions(name, installedVersion, releaseSpec, limit);
+			} catch {}
 			return {
 				name,
 				...installedVersion === void 0 ? {} : { installedVersion },
@@ -251,18 +327,18 @@ var PluginInfoService = class {
 	}
 	/** Update notes for one published version. */
 	async versionNotes(profileDir, name, version) {
-		findUserPlugin(profileDir, name, this.config.allowScopes);
+		const plugin = findUserPlugin(profileDir, name, this.config.allowScopes);
 		const cacheKey = `${name}@${version}`;
 		const cached = this.notes.get(cacheKey);
 		if (cached !== void 0 && cached.expiresAt > this.now()) return cached.value;
-		const notes = await this.loadNotes(profileDir, name, version);
+		const notes = await this.loadNotes(profileDir, name, version, plugin.spec);
 		this.notes.set(cacheKey, {
 			value: notes,
 			expiresAt: this.now() + this.config.cacheTtlMs
 		});
 		return notes;
 	}
-	async describePlugin(profileDir, name, spec) {
+	async describePlugin(profileDir, profileCli, name, spec) {
 		const source = classifySpec(spec);
 		const installed = readInstalledPackage(profileDir, name);
 		const installedRepository = repositoryUrlOf(installed?.repository);
@@ -276,17 +352,19 @@ var PluginInfoService = class {
 			...installed?.homepage === void 0 ? {} : { homepage: installed.homepage },
 			...installedRepository === void 0 ? {} : { repository: installedRepository }
 		};
-		if (source !== "registry") return summary;
+		if (source !== "registry") return this.describeReleaseSpecPlugin(profileCli, spec, summary);
 		try {
 			const packument = await this.loadPackument(name);
 			const latestVersion = latestVersionOf(packument);
 			const homepage = summary.homepage ?? packument.homepage;
 			const repository = summary.repository ?? repositoryUrlOf(packument.repository);
+			const hasUpdate = hasNewerVersion(summary.installedVersion, latestVersion);
 			return {
 				...summary,
 				...packument.description === void 0 || summary.description !== void 0 ? {} : { description: packument.description },
 				...latestVersion === void 0 ? {} : { latestVersion },
-				hasUpdate: hasNewerVersion(summary.installedVersion, latestVersion),
+				hasUpdate,
+				...hasUpdate ? { updateCommand: pluginUpdateCommand(profileCli, name) } : {},
 				...homepage === void 0 ? {} : { homepage },
 				...repository === void 0 ? {} : { repository }
 			};
@@ -309,7 +387,106 @@ var PluginInfoService = class {
 		});
 		return packument;
 	}
-	async loadNotes(profileDir, name, version) {
+	/**
+	* The repo's latest published release (GitHub skips prereleases/drafts),
+	* or undefined when the repo has no releases. Negative answers are cached
+	* too so a repo without releases does not burn the API rate limit.
+	*/
+	async loadGithubLatest(owner, repo) {
+		const key = `${owner}/${repo}`;
+		const cached = this.githubLatest.get(key);
+		if (cached !== void 0 && cached.expiresAt > this.now()) return cached.value;
+		let payload;
+		try {
+			payload = await this.fetchJson(`https://api.github.com/repos/${owner}/${repo}/releases/latest`, this.config.timeoutMs, githubHeaders());
+		} catch (error) {
+			if (error instanceof Error && error.message.startsWith("HTTP 404")) {
+				this.githubLatest.set(key, {
+					value: void 0,
+					expiresAt: this.now() + this.config.cacheTtlMs
+				});
+				return;
+			}
+			throw error;
+		}
+		const release = asGithubRelease(payload);
+		this.githubLatest.set(key, {
+			value: release,
+			expiresAt: this.now() + this.config.cacheTtlMs
+		});
+		return release;
+	}
+	/** Newest-first GitHub releases for one repo, cached per repo. */
+	async loadGithubReleases(owner, repo, limit) {
+		const key = `${owner}/${repo}`;
+		const cached = this.githubReleases.get(key);
+		if (cached !== void 0 && cached.expiresAt > this.now()) return cached.value;
+		const perPage = Math.min(100, Math.max(1, Math.trunc(limit)));
+		const payload = await this.fetchJson(`https://api.github.com/repos/${owner}/${repo}/releases?per_page=${perPage}`, this.config.timeoutMs, githubHeaders());
+		if (!Array.isArray(payload)) throw new Error(`GitHub returned a non-array releases payload for ${owner}/${repo}`);
+		const releases = payload.map((item) => asGithubRelease(item)).filter((item) => item !== void 0);
+		this.githubReleases.set(key, {
+			value: releases,
+			expiresAt: this.now() + this.config.cacheTtlMs
+		});
+		return releases;
+	}
+	/**
+	* Update detection for GitHub-release tarball installs: the dependency spec
+	* itself names the repository and the currently installed tag, so the
+	* latest release is looked up from that repo — nothing is hardcoded.
+	*/
+	async describeReleaseSpecPlugin(profileCli, spec, summary) {
+		const releaseSpec = parseGithubReleaseSpec(spec);
+		if (releaseSpec === void 0) return summary;
+		const repository = `https://github.com/${releaseSpec.owner}/${releaseSpec.repo}`;
+		try {
+			const latest = await this.loadGithubLatest(releaseSpec.owner, releaseSpec.repo);
+			const latestVersion = latest === void 0 ? void 0 : versionFromTag(latest.tag);
+			const hasUpdate = hasNewerVersion(summary.installedVersion ?? versionFromTag(releaseSpec.tag), latestVersion);
+			const oldVersion = versionFromTag(releaseSpec.tag) ?? summary.installedVersion;
+			const updateUrl = latest !== void 0 && latestVersion !== void 0 && oldVersion !== void 0 && hasUpdate ? releaseDownloadUrl(releaseSpec, latest.tag, latestVersion, oldVersion) : void 0;
+			return {
+				...summary,
+				...summary.repository === void 0 ? { repository } : {},
+				...latestVersion === void 0 ? {} : { latestVersion },
+				hasUpdate,
+				...hasUpdate && updateUrl !== void 0 ? { updateCommand: `dsh plugin --profile ${profileCli} add "${updateUrl}"` } : {}
+			};
+		} catch (error) {
+			return {
+				...summary,
+				repository,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	/** GitHub release history reshaped into version rows for one URL install. */
+	async githubReleaseVersions(name, installedVersion, releaseSpec, limit) {
+		const releases = await this.loadGithubReleases(releaseSpec.owner, releaseSpec.repo, limit);
+		const normalizedInstalled = installedVersion === void 0 ? void 0 : normalizeVersion(installedVersion);
+		const published = releases.filter((release) => !release.draft && versionFromTag(release.tag) !== void 0).slice(0, Math.max(0, limit));
+		const rows = published.map((release) => {
+			const version = versionFromTag(release.tag);
+			return {
+				version,
+				...release.publishedAt === void 0 ? {} : { publishedAt: release.publishedAt },
+				latest: false,
+				installed: normalizedInstalled !== void 0 && version === normalizedInstalled
+			};
+		});
+		const latestIndex = published.findIndex((release) => !release.prerelease);
+		const latestRow = (latestIndex === -1 ? rows[0] : rows[latestIndex]) ?? void 0;
+		if (latestRow !== void 0) latestRow.latest = true;
+		const latestVersion = latestRow?.version;
+		return {
+			name,
+			...installedVersion === void 0 ? {} : { installedVersion },
+			...latestVersion === void 0 ? {} : { latestVersion },
+			versions: rows
+		};
+	}
+	async loadNotes(profileDir, name, version, spec) {
 		const installed = readInstalledPackage(profileDir, name);
 		let packument;
 		try {
@@ -317,8 +494,13 @@ var PluginInfoService = class {
 		} catch {
 			packument = void 0;
 		}
+		const releaseSpec = parseGithubReleaseSpec(spec);
 		const repository = repositoryUrlOf(installed?.repository) ?? repositoryUrlOf(packument?.repository);
-		const github = repository === void 0 ? void 0 : parseGithubRepo(repository);
+		let github = repository === void 0 ? void 0 : parseGithubRepo(repository);
+		if (github === void 0 && releaseSpec !== void 0) github = {
+			owner: releaseSpec.owner,
+			repo: releaseSpec.repo
+		};
 		const publishedAt = packument?.time?.[version];
 		const base = {
 			name,
@@ -327,7 +509,8 @@ var PluginInfoService = class {
 			...publishedAt === void 0 ? {} : { publishedAt }
 		};
 		if (github === void 0) return base;
-		const release = await this.fetchGithubRelease(github.owner, github.repo, version);
+		const specTag = releaseSpec !== void 0 && versionFromTag(releaseSpec.tag) === normalizeVersion(version) ? releaseSpec.tag : void 0;
+		const release = await this.fetchGithubRelease(github.owner, github.repo, version, specTag === void 0 ? [] : [specTag]);
 		if (release !== void 0) return {
 			...base,
 			source: "github-release",
@@ -347,8 +530,12 @@ var PluginInfoService = class {
 			commits: compare.commits
 		};
 	}
-	async fetchGithubRelease(owner, repo, version) {
-		const tags = unique([version, `v${version}`]);
+	async fetchGithubRelease(owner, repo, version, preferredTags = []) {
+		const tags = unique([
+			...preferredTags,
+			version,
+			`v${version}`
+		]);
 		for (const tag of tags) try {
 			const payload = await this.fetchJson(`https://api.github.com/repos/${owner}/${repo}/releases/tags/${encodeURIComponent(tag)}`, this.config.timeoutMs, githubHeaders());
 			if (payload === null || typeof payload !== "object" || Array.isArray(payload)) continue;
@@ -410,6 +597,22 @@ function findUserPlugin(profileDir, name, allowScopes) {
 function unique(values) {
 	return [...new Set(values.filter((value) => value.length > 0))];
 }
+/** Extract the release fields the service needs from a GitHub API payload. */
+function asGithubRelease(payload) {
+	if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+	const record = payload;
+	const tag = typeof record.tag_name === "string" && record.tag_name.length > 0 ? record.tag_name : void 0;
+	if (tag === void 0) return void 0;
+	const publishedAt = typeof record.published_at === "string" ? record.published_at : void 0;
+	const url = typeof record.html_url === "string" ? record.html_url : void 0;
+	return {
+		tag,
+		...publishedAt === void 0 ? {} : { publishedAt },
+		...url === void 0 ? {} : { url },
+		prerelease: record.prerelease === true,
+		draft: record.draft === true
+	};
+}
 /** True when `name` matches one of the configured scope prefixes (empty list = allow all). */
 function isAllowedScope(name, allowScopes) {
 	if (allowScopes === void 0 || allowScopes.length === 0) return true;
@@ -540,4 +743,4 @@ function sendError(res, error) {
 	});
 }
 //#endregion
-export { Config, DEFAULT_VERSION_LIMIT, PluginInfoService, apply, classifySpec, fetchJson, hasNewerVersion, latestVersionOf, listUserPlugins, name, packumentUrl, parseGithubRepo, parseVersion, profileDirFromBaseUrl, recentVersions, repositoryUrlOf, resolveVersionLimit };
+export { Config, DEFAULT_VERSION_LIMIT, PluginInfoService, apply, classifySpec, fetchJson, hasNewerVersion, latestVersionOf, listUserPlugins, name, packumentUrl, parseGithubReleaseSpec, parseGithubRepo, parseVersion, pluginUpdateCommand, profileCliName, profileDirFromBaseUrl, recentVersions, releaseDownloadUrl, repositoryUrlOf, resolveVersionLimit, versionFromTag };

package/lib/types/client.d.ts

@@ -22,13 +22,26 @@ interface MinimalReact {
     useCallback<T>(fn: T, deps: unknown[]): T;
 }
 /**
- * Subset of DSH's `MarkdownText` shared primitive. The real component is
- * GFM + KaTeX with unsafe HTML/protocols stripped; we only need the `text`
- * prop for rendering release-note bodies.
+ * Subset of DSH's `MarkdownText` shared primitive (GFM + KaTeX, unsafe
+ * HTML/protocols stripped). `labels` is REQUIRED in practice: the fenced
+ * code-block renderer reads `labels.code.copyLabel` / `labels.code.copiedLabel`
+ * with no defaults, and the footnotes section reads `labels.footnotes` —
+ * passing only `text` crashes the whole settings section the moment a
+ * release note contains a fenced code block.
  */
+interface MarkdownLabels {
+    code: {
+        copyLabel: string;
+        copiedLabel: string;
+    };
+    footnotes: string;
+}
 type MarkdownTextComponent = (props: {
     text: string;
+    labels?: MarkdownLabels;
 }) => unknown;
+/** Labels for the MarkdownText copy button / footnotes heading (settings UI is zh). */
+declare const MARKDOWN_LABELS: MarkdownLabels;
 interface SlotsService {
     inject(key: string, register: () => void): void;
     register(options: Record<string, unknown>, component: unknown): void;
@@ -62,6 +75,7 @@ interface PluginRow {
     installedVersion?: string;
     latestVersion?: string;
     hasUpdate: boolean;
+    updateCommand?: string;
     homepage?: string;
     repository?: string;
     error?: string;

package/lib/types/index.d.ts

@@ -6,11 +6,11 @@
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 import type { PluginConfig } from './types.ts';
-export { classifySpec, listUserPlugins, parseGithubRepo, repositoryUrlOf } from './profile.ts';
-export { hasNewerVersion, parseVersion } from './semver.ts';
+export { classifySpec, listUserPlugins, parseGithubReleaseSpec, parseGithubRepo, pluginUpdateCommand, profileCliName, releaseDownloadUrl, repositoryUrlOf } from './profile.ts';
+export { hasNewerVersion, parseVersion, versionFromTag } from './semver.ts';
 export { latestVersionOf, packumentUrl, recentVersions, resolveVersionLimit } from './registry.ts';
 export { fetchJson, PluginInfoService, profileDirFromBaseUrl } from './service.ts';
-export type { InstalledPackage, Packument, PluginConfig, PluginSource, PluginSummary, PluginVersionRow, ProfileManifest, VersionNotes, } from './types.ts';
+export type { GithubReleaseSpec, InstalledPackage, Packument, PluginConfig, PluginSource, PluginSummary, PluginVersionRow, ProfileManifest, VersionNotes, } from './types.ts';
 /** Cordis plugin name used by Loader diagnostics. */
 export declare const name = "dsh-plugin-info";
 /** Default version window shown by the settings page. */

package/lib/types/profile.d.ts

@@ -1,4 +1,14 @@
-import type { InstalledPackage, PluginSource, ProfileManifest } from './types.ts';
+import type { GithubReleaseSpec, InstalledPackage, PluginSource, ProfileManifest } from './types.ts';
+/**
+ * CLI `--profile` argument for this profile directory.
+ *
+ * DSH names the manifest `dsh-profile-<dir>` and the CLI flag is the
+ * directory basename (`web`, `tui`, …). Prefer the manifest prefix so temp
+ * test dirs still resolve; fall back to the folder name, then `web`.
+ */
+export declare function profileCliName(manifestName: string | undefined, profileDir: string): string;
+/** `dsh plugin add …@latest` command for one registry package in this profile. */
+export declare function pluginUpdateCommand(profileCli: string, packageName: string): string;
 /** Classify a profile dependency spec. */
 export declare function classifySpec(spec: string): PluginSource;
 /** User-added plugins are the profile's own `dependencies`, not in-box bundles. */
@@ -18,4 +28,17 @@ export declare function parseGithubRepo(input: string): {
     owner: string;
     repo: string;
 } | undefined;
+/**
+ * Parse a `github.com/<owner>/<repo>/releases/download/<tag>/<asset>`
+ * dependency spec into its repository, tag, and asset. Everything is derived
+ * from the spec itself — no per-plugin configuration.
+ */
+export declare function parseGithubReleaseSpec(spec: string): GithubReleaseSpec | undefined;
+/**
+ * Rewrite a release spec onto a newer tag. The asset file name keeps its
+ * shape: an embedded version token equal to `oldVersion` is replaced by
+ * `newVersion` (`dsh-skill-mcp-panel-2.0.3.tgz` → `…-2.0.4.tgz`) without
+ * touching longer version numbers (`12.0.3`) that merely contain it.
+ */
+export declare function releaseDownloadUrl(spec: GithubReleaseSpec, newTag: string, newVersion: string, oldVersion: string): string;
 //# sourceMappingURL=profile.d.ts.map

package/lib/types/semver.d.ts

@@ -13,6 +13,8 @@ export declare function parseVersion(input: string): ParsedVersion | undefined;
 export declare function compareParsed(left: ParsedVersion, right: ParsedVersion): number;
 /** Compare two version strings. Unparseable values compare as equal (0). */
 export declare function compareVersions(left: string, right: string): number;
+/** Version embedded in a release tag: `v2.0.3`, `2.0.3`, or `panel-1.20.3-rc.1`. */
+export declare function versionFromTag(tag: string): string | undefined;
 /** True when `latest` is a newer published version than `installed`. */
 export declare function hasNewerVersion(installed: string | undefined, latest: string | undefined): boolean;
 //# sourceMappingURL=semver.d.ts.map

package/lib/types/service.d.ts

@@ -8,10 +8,13 @@ export declare class PluginInfoService {
     private readonly now;
     private readonly packuments;
     private readonly notes;
+    private readonly githubLatest;
+    private readonly githubReleases;
     constructor(config: PluginConfig, fetchJson: JsonFetcher, now?: () => number);
     /** List user-added plugins for one profile directory. */
     listPlugins(profileDir: string): Promise<{
         profile: string;
+        profileCli: string;
         plugins: PluginSummary[];
     }>;
     /** Recent published versions for one user-added plugin. */
@@ -25,6 +28,22 @@ export declare class PluginInfoService {
     versionNotes(profileDir: string, name: string, version: string): Promise<VersionNotes>;
     private describePlugin;
     private loadPackument;
+    /**
+     * The repo's latest published release (GitHub skips prereleases/drafts),
+     * or undefined when the repo has no releases. Negative answers are cached
+     * too so a repo without releases does not burn the API rate limit.
+     */
+    private loadGithubLatest;
+    /** Newest-first GitHub releases for one repo, cached per repo. */
+    private loadGithubReleases;
+    /**
+     * Update detection for GitHub-release tarball installs: the dependency spec
+     * itself names the repository and the currently installed tag, so the
+     * latest release is looked up from that repo — nothing is hardcoded.
+     */
+    private describeReleaseSpecPlugin;
+    /** GitHub release history reshaped into version rows for one URL install. */
+    private githubReleaseVersions;
     private loadNotes;
     private fetchGithubRelease;
     private fetchGithubCompare;

package/lib/types/types.d.ts

@@ -1,5 +1,14 @@
 /** Where a profile dependency spec came from. */
 export type PluginSource = 'registry' | 'file' | 'link' | 'git' | 'other';
+/** A profile dependency spec that installs a GitHub release tarball directly. */
+export interface GithubReleaseSpec {
+    owner: string;
+    repo: string;
+    /** Release tag embedded in the download URL, e.g. `v2.0.3`. */
+    tag: string;
+    /** Tarball file name, e.g. `dsh-skill-mcp-panel-2.0.3.tgz`. */
+    asset: string;
+}
 /** One user-added profile plugin as the UI lists it. */
 export interface PluginSummary {
     /** npm package name. */
@@ -16,6 +25,11 @@ export interface PluginSummary {
     latestVersion?: string;
     /** True when the registry latest is newer than the installed version. */
     hasUpdate: boolean;
+    /**
+     * `dsh plugin --profile <name> add <pkg>@latest` when this row has a
+     * registry update. Omitted for local / git installs and up-to-date packages.
+     */
+    updateCommand?: string;
     /** Package homepage. */
     homepage?: string;
     /** Normalized repository browse URL. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@eya46/dsh-plugin-info",
   "description": "List profile-added DSH plugins, mark available updates, and show recent version notes",
-  "version": "0.0.3",
+  "version": "0.1.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -49,8 +49,8 @@
     }
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.7"
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.2 || ^0.2.0-rc.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-host-webserver": {
@@ -58,12 +58,12 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.4"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.7",
-    "@types/node": "^22.20.0",
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2",
+    "@types/node": "^22.20.3",
     "tsdown": "^0.22.2",
     "typescript": "^5.9.3",
     "vitest": "^4.1.8"