@goodandready/dsh-context-lens 0.1.17 → 0.1.18

package/README.md

@@ -154,6 +154,16 @@ dsh-context-lens:
 
 ---
 
+
+## Changed in v0.1.18
+
+- **Critical Fix (#71, GH #2)**: Conformed `output.render` to DeepSeek Harness core contract by returning `ContentBlock[]` (`[{ type: 'text', text: ... }]`). Prevents irreversible DSH session poisoning caused by `TypeError: content.some is not a function` in `@deepseek-ai/dsh-llm`.
+- **Security & Reliability (#62, #63, #70)**: Hardened HTTP endpoints (`/clear-focus`, `/compress-preview`, `/status`): strictly requires `POST` on write actions, enforces loopback/same-origin trust checks, caps body size to 256KB (413 on exceed), validates `maxLines` (1-5000), and handles malformed session queries with clear 400 responses.
+- **One-Click In-App Updater (#61)**: Added canonical plugin updater module (`lib/updater.js`) with `/api/dsh-context-lens/update` endpoint and an in-app update UI banner with one-click update button in the settings card.
+- **Settings & Lifecycle (#64, #66)**: Injected `settingsScope` directly into client plugin dependencies and removed foreign `lanSettings` fallback. Wrapped settings and locale registrations in `ctx.effect` with disposable cleanups.
+- **UI & Theme Alignment (#67, #68)**: Implemented smooth vector SVG 14x14 chevron with 180° rotation animation and replaced hardcoded colors with `--dsw-alias-*` theme tokens for seamless light/dark mode presentation.
+- **Repository Hygiene (#65)**: Purged internal agent artifacts (`AGENTS.md`, `index.md`, `docs/plans/`) from tracked git tree and added denylist to `.gitignore`.
+
 ## 📄 License
 
 MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)

package/README.ru.md

@@ -151,6 +151,16 @@ dsh-context-lens:
 
 ---
 
+
+## Изменения в v0.1.18
+
+- **Критическое исправление (#71, GH #2)**: Приведение контракта `output.render` к стандарту ядра DeepSeek Harness: теперь возвращается массив `ContentBlock[]` (`[{ type: 'text', text: ... }]`). Полностью устранено необратимое повреждение сессий DSH с ошибкой `TypeError: content.some is not a function` в модуле `@deepseek-ai/dsh-llm`.
+- **Безопасность и отказоустойчивость HTTP (#62, #63, #70)**: Защита маршрутов (`/clear-focus`, `/compress-preview`, `/status`): проверка метода (`POST` для изменений), верификация loopback и same-origin, ограничение размера тела запроса до 256 КБ (код 413 при превышении), клампинг `maxLines` (1–5000), возврат 400 Bad Request при невалидном идентификаторе сессии.
+- **One-Click автообновление плагина (#61)**: Внедрен стандартный модуль автообновления `lib/updater.js`, endpoint `/api/dsh-context-lens/update` и блок проверки/установки обновления в карточке настроек.
+- **Сервис настроек и жизненный цикл (#64, #66)**: Клиентский плагин объявляет зависимость `settingsScope`, убрана привязка к чужому сервису `lanSettings`. Регистрации настроек и локали обёрнуты в `ctx.effect` с корректными уборщиками.
+- **Визуальная часть UI и темы (#67, #68)**: Запасной шеврон заменён на векторный SVG 14x14 с плавной анимацией поворота на 180°. Исключены захардкоженные цвета `rgba()`, интерфейс переведён на токены `--dsw-alias-*`.
+- **Санитайзинг репозитория (#65)**: Из отслеживаемого дерева исключены внутренние файлы (`AGENTS.md`, `index.md`, `docs/plans/`), обновлён `.gitignore`.
+
 ## 📄 Лицензия
 
 MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)

package/README.zh.md

@@ -81,3 +81,13 @@ dsh plugin --profile web add @goodandready/dsh-context-lens
 ## 📄 开源协议
 
 MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
+
+
+## v0.1.18 更新日志
+
+- **严重问题修复 (#71, GH #2)**：严格遵循 DeepSeek Harness 核心工具返回规范，将 `output.render` 调整为返回 `ContentBlock[]` 数组 (`[{ type: 'text', text: ... }]`)。彻底解决第三方工具调用后会话写入非数组导致 `@deepseek-ai/dsh-llm` 报错 `TypeError: content.some is not a function` 并永久损坏会话的严重缺陷。
+- **安全性与稳定性加固 (#62, #63, #70)**：全面加固 HTTP 接口 (`/clear-focus`, `/compress-preview`, `/status`)：写操作严格要求 `POST` 请求，校验环回与同源请求来源，限制请求体上限为 256KB（超限返回 413），限制 `maxLines` 范围为 1–5000，无效 session 参数返回规范 400 错误。
+- **一键在线更新支持 (#61)**：引入标准更新管理模块 (`lib/updater.js`) 及 `/api/dsh-context-lens/update` 接口，在设置卡片中增加版本检查与一键更新按钮。
+- **设置域与生命周期规范 (#64, #66)**：客户端显式声明 `settingsScope` 依赖并移除对外部 `lanSettings` 的隐式依赖，将设置注册与多语言注册统一纳入 `ctx.effect` 生命周期清理管理。
+- **UI 与主题深度适配 (#67, #68)**：将折叠箭头升级为 14x14 矢量 SVG 并支持平滑 180° 旋转动画，全面替换硬编码色值，使用 `--dsw-alias-*` 主题变量完美适配明暗主题。
+- **仓库代码纯净性 (#65)**：从 Git 跟踪树中彻底剥离内部计划文件 (`AGENTS.md`, `index.md`, `docs/plans/`)，并更新 `.gitignore` 防护清单。

package/lib/client.js

@@ -6,6 +6,13 @@ window.__ModuleLoader__.load({
     const NS = '@goodandready/dsh-context-lens';
 
         const en = {
+      'update.available': 'Update available: v{latestVersion} (current: v{currentVersion})',
+      'update.btn': 'Update Now',
+      'update.updating': 'Updating…',
+      'update.done': 'Successfully updated to v{version}! Please restart DSH.',
+      'update.failed': 'Update failed: {error}',
+      'update.checking': 'Checking for updates…',
+      'update.up_to_date': 'Up to date',
       title: 'Context Lens & Token Guard',
       sub: 'AST compression, log filtering, token budget',
       mode: 'Compression mode',
@@ -37,6 +44,13 @@ window.__ModuleLoader__.load({
     };
 
     const zh = {
+      'update.available': '发现新版本 v{latestVersion}（当前版本 v{currentVersion}）',
+      'update.btn': '立即更新',
+      'update.updating': '正在更新…',
+      'update.done': '更新成功至 v{version}！请重启 DSH 服务生效。',
+      'update.failed': '更新失败：{error}',
+      'update.checking': '正在检查更新…',
+      'update.up_to_date': '已是最新版本',
       title: 'Context Lens 上下文镜头与 Token 守卫',
       sub: 'AST 代码精简、日志过滤与 Token 预算监控',
       mode: '压缩模式',
@@ -108,12 +122,12 @@ window.__ModuleLoader__.load({
 .cl-badge-ok {
   border-color: var(--dsw-alias-state-success-primary, #10b981);
   color: var(--dsw-alias-state-success-primary, #10b981);
-  background: rgba(16, 185, 129, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 8%, transparent);
 }
 .cl-badge-warn {
   border-color: var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
-  background: rgba(239, 68, 68, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 8%, transparent);
 }
 .cl-stat-grid {
   display: grid;
@@ -211,7 +225,7 @@ window.__ModuleLoader__.load({
 .cl-banner-warn {
   padding: 10px 14px;
   border-radius: 8px;
-  background: rgba(239, 68, 68, 0.1);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 10%, transparent);
   border: 1px solid var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
   font-size: 12px;
@@ -244,7 +258,7 @@ window.__ModuleLoader__.load({
 .cl-error-box {
   padding: 12px;
   border-radius: 8px;
-  background: rgba(239, 68, 68, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 8%, transparent);
   border: 1px solid var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
   font-size: 12px;
@@ -253,6 +267,18 @@ window.__ModuleLoader__.load({
       document.head.appendChild(style);
     }
 
+    function makeT(dict, fallback) {
+      return function t(key, vars) {
+        let val = (dict && dict[key]) || (fallback && fallback[key]) || key;
+        if (vars && typeof val === 'string') {
+          for (const k of Object.keys(vars)) {
+            val = val.replace(new RegExp('\\{' + k + '\\}', 'g'), String(vars[k]));
+          }
+        }
+        return val;
+      };
+    }
+
     function createErrorBoundary() {
       if (!React || typeof React.Component !== 'function') {
         return function NoopBoundary(props) { return (props && props.children) || null; };
@@ -293,7 +319,7 @@ window.__ModuleLoader__.load({
           const snap = ctx.locale.getSnapshot();
           if (snap && snap.active && snap.active.startsWith('zh')) return zh;
         }
-      } catch {}
+      } catch (err) { void err; }
       return en;
     }
 
@@ -534,7 +560,7 @@ window.__ModuleLoader__.load({
         style: {
           position: 'absolute', top: 'calc(100% + 6px)', right: 0, width: 280,
           background: 'var(--dsw-alias-bg-layer-3)', border: '1px solid var(--dsw-alias-border-l2)',
-          borderRadius: 10, boxShadow: '0 8px 24px rgba(0, 0, 0, 0.28)', padding: '12px 14px',
+          borderRadius: 10, boxShadow: 'var(--dsw-alias-modal-shadow, var(--dsw-alias-shadow-large, 0 4px 16px var(--dsw-alias-border-l1)))', padding: '12px 14px',
           zIndex: 1000, fontSize: 12, color: 'var(--dsw-alias-label-primary)', cursor: 'default', textAlign: 'left'
         },
         onClick: (e) => e.stopPropagation()
@@ -587,7 +613,7 @@ window.__ModuleLoader__.load({
       const scopeRef = React.useRef(null);
       if (!scopeRef.current && _ctx) {
         try {
-          const s = (_ctx.get && _ctx.get('lanSettings')) || _ctx.settingsScope;
+          const s = _ctx.settingsScope || (_ctx.get && _ctx.get('settingsScope'));
           if (s && typeof s.bind === 'function') {
             scopeRef.current = s.bind({ namespace: NS });
           }
@@ -627,7 +653,7 @@ window.__ModuleLoader__.load({
             unsub = scope.subscribe(() => {
               if (!cancelled) loadSnap();
             });
-          } catch (_) {}
+          } catch (_err) { void _err; }
         }
 
         return () => {
@@ -636,6 +662,69 @@ window.__ModuleLoader__.load({
         };
       }, [scope]);
 
+      const [updateState, setUpdateState] = React.useState({
+        checking: false,
+        updating: false,
+        currentVersion: '0.1.18',
+        latestVersion: '',
+        updateAvailable: false,
+        canAutoUpdate: true,
+        notice: '',
+        error: ''
+      });
+
+      const checkUpdate = React.useCallback(async () => {
+        setUpdateState((s) => ({ ...s, checking: true, error: '' }));
+        try {
+          const res = await fetch('/api/dsh-context-lens/update');
+          if (!res.ok) throw new Error('HTTP ' + res.status);
+          const data = await res.json().catch(() => ({}));
+          setUpdateState((s) => ({
+            ...s,
+            checking: false,
+            currentVersion: data.currentVersion || s.currentVersion,
+            latestVersion: data.latestVersion || '',
+            updateAvailable: !!data.updateAvailable,
+            canAutoUpdate: data.canAutoUpdate !== false,
+          }));
+        } catch (_) {
+          setUpdateState((s) => ({ ...s, checking: false }));
+        }
+      }, []);
+
+      React.useEffect(() => {
+        if (expanded) checkUpdate();
+      }, [expanded, checkUpdate]);
+
+      async function handleTriggerUpdate() {
+        if (updateState.updating) return;
+        setUpdateState((s) => ({ ...s, updating: true, error: '', notice: '' }));
+        try {
+          const res = await fetch('/api/dsh-context-lens/update', {
+            method: 'POST',
+            headers: { 'x-dsh-plugin-update': '1', 'x-dsh-context-lens-update': '1' }
+          });
+          const data = await res.json().catch(() => ({}));
+          if (!res.ok || data.ok === false || data.error) {
+            throw new Error(data.error || ('HTTP ' + res.status));
+          }
+          const newVer = data.updatedVersion || updateState.latestVersion || updateState.currentVersion;
+          setUpdateState((s) => ({
+            ...s,
+            updating: false,
+            updateAvailable: false,
+            currentVersion: newVer,
+            notice: tt('update.done', { version: newVer }),
+          }));
+        } catch (e) {
+          setUpdateState((s) => ({
+            ...s,
+            updating: false,
+            error: tt('update.failed', { error: e && e.message || String(e) }),
+          }));
+        }
+      }
+
       React.useEffect(() => {
         if (!expanded) return;
         fetch('/dsh-context-lens/status').then((r) => r.ok ? r.json() : null).then((j) => {
@@ -646,7 +735,8 @@ window.__ModuleLoader__.load({
         }).catch(() => {});
       }, [expanded, draft.autoCollapse]);
 
-      const tt = t || ((k) => (en[k] || k));
+      const L = React.useMemo(() => getActiveLocale(_ctx), [_ctx]);
+      const tt = React.useMemo(() => (t ? t : makeT(L, en)), [t, L]);
 
       let ChevronIcon = null;
       try {
@@ -655,9 +745,29 @@ window.__ModuleLoader__.load({
       } catch (e) { ChevronIcon = null; }
 
       const Chevron = ChevronIcon ? function ChevronNode(p) {
-        return React.createElement(ChevronIcon, { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)', transition: 'transform .16s', transform: p.open ? 'rotate(180deg)' : 'none' } });
+        return React.createElement(ChevronIcon, { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)', transition: 'transform .16s ease', transform: p.open ? 'rotate(180deg)' : 'none' } });
       } : function Fallback(p) {
-        return React.createElement('span', { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)' } }, '▼');
+        return React.createElement('svg', {
+          className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''),
+          viewBox: '0 0 14 14',
+          width: 14,
+          height: 14,
+          style: {
+            marginLeft: 'auto',
+            color: 'var(--dsw-alias-label-tertiary)',
+            transform: p.open ? 'rotate(180deg)' : 'none',
+            transition: 'transform .16s ease',
+            display: 'inline-block',
+            flexShrink: 0
+          }
+        }, React.createElement('path', {
+          d: 'M3.5 5.25L7 8.75L10.5 5.25',
+          fill: 'none',
+          stroke: 'currentColor',
+          strokeWidth: '1.5',
+          strokeLinecap: 'round',
+          strokeLinejoin: 'round'
+        }));
       };
 
       async function onSave() {
@@ -711,6 +821,39 @@ window.__ModuleLoader__.load({
           React.createElement(Chevron, { open: expanded })
         ),
         expanded ? React.createElement('div', { className: 'cl-body', style: { borderTop: '1px solid var(--dsw-alias-border-l2)', paddingTop: 12 } },
+          React.createElement('div', {
+            style: {
+              display: 'flex', alignItems: 'center', justifyContent: 'space-between',
+              padding: '6px 10px', marginBottom: 10, borderRadius: 8,
+              background: 'var(--dsw-alias-bg-layer-2)', border: '1px solid var(--dsw-alias-border-l2)', fontSize: 12
+            }
+          },
+            React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: 8 } },
+              React.createElement('span', { style: { fontWeight: 500, color: 'var(--dsw-alias-label-primary)' } },
+                'v' + (updateState.currentVersion || '0.1.18')
+              ),
+              updateState.checking
+                ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-tertiary)', fontSize: 11 } }, tt('update.checking'))
+                : updateState.updateAvailable
+                  ? React.createElement('span', { className: 'cl-badge cl-badge-warn' },
+                      tt('update.available', { latestVersion: updateState.latestVersion, currentVersion: updateState.currentVersion })
+                    )
+                  : React.createElement('span', { className: 'cl-badge cl-badge-ok' },
+                      '✓ ' + tt('update.up_to_date')
+                    )
+            ),
+            updateState.updateAvailable
+              ? React.createElement('button', {
+                  type: 'button',
+                  className: 'cl-btn cl-btn-primary',
+                  disabled: updateState.updating,
+                  onClick: handleTriggerUpdate,
+                  style: { padding: '3px 8px', fontSize: 11 }
+                }, updateState.updating ? tt('update.updating') : tt('update.btn'))
+              : null
+          ),
+          updateState.notice ? React.createElement('div', { className: 'cl-banner-ok', style: { marginBottom: 10, padding: '8px 12px', borderRadius: 8, background: 'color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 8%, transparent)', border: '1px solid var(--dsw-alias-state-success-primary, #10b981)', color: 'var(--dsw-alias-state-success-primary, #10b981)', fontSize: 12 } }, '✓ ' + updateState.notice) : null,
+          updateState.error ? React.createElement('div', { className: 'cl-banner-warn', style: { marginBottom: 10 } }, updateState.error) : null,
           budgetWarn ? React.createElement('div', { className: 'cl-banner-warn', style: { marginBottom: 12 } }, '⚠ ' + tt('lowBudget')) : null,
           status === 'loading' ? React.createElement('div', { style: { padding: 12, color: 'var(--dsw-alias-label-secondary)' } }, 'Loading…') :
           status === 'unavailable' ? React.createElement('div', { style: { padding: 12, color: 'var(--dsw-alias-label-secondary)' } }, 'Settings unavailable — plugin not registered on host yet') :
@@ -815,9 +958,28 @@ window.__ModuleLoader__.load({
       );
     }
 
-    module.exports.inject = ['slots', 'locale'];
+    module.exports.inject = ['slots', 'locale', 'settingsScope'];
     module.exports.apply = function apply(ctx) {
-      try { ctx.locale.register(NS, { en, zh }); } catch (e) { console.warn('[dsh-context-lens] locale register failed', e && e.message || e); }
+      let hasEffect = false;
+      try {
+        hasEffect = typeof ctx.effect === 'function';
+      } catch (_) {
+        hasEffect = false;
+      }
+      if (hasEffect) {
+        ctx.effect(() => {
+          try {
+            const dispose = ctx.locale?.register ? ctx.locale.register(NS, { en, zh }) : undefined;
+            return () => {
+              if (typeof dispose === 'function') dispose();
+            };
+          } catch (e) {
+            console.warn('[dsh-context-lens] locale register failed', e && e.message || e);
+          }
+        }, 'dsh-context-lens: locale');
+      } else {
+        try { ctx.locale.register(NS, { en, zh }); } catch (e) { console.warn('[dsh-context-lens] locale register failed', e && e.message || e); }
+      }
       if (!ctx.slots) return;
       let registered = false;
       const doRegister = () => {
@@ -893,14 +1055,14 @@ window.__ModuleLoader__.load({
                     try { registerPaneTab(); } catch (e2) {}
                   }
                 } else {
-                  try { registerPaneTab(); } catch (e) {}
+                  try { registerPaneTab(); } catch (err) { void err; }
                 }
               }
             } catch (e) {
               console.warn("[dsh-context-lens] native sidebar registration failed", e && e.message || e);
             }
           });
-        } catch (e) {}
+        } catch (err) { void err; }
       }
 
       if (typeof ctx.inject === 'function') {
@@ -925,7 +1087,7 @@ window.__ModuleLoader__.load({
               console.warn('[dsh-context-lens] betterSidebar registerTab failed', e && e.message || e);
             }
           });
-        } catch (e) {}
+        } catch (err) { void err; }
       }
 
       if (ctx.slots) {
@@ -949,7 +1111,7 @@ window.__ModuleLoader__.load({
             try { headerChipRegister(); } catch (e2) {}
           }
         } else {
-          try { headerChipRegister(); } catch (e) {}
+          try { headerChipRegister(); } catch (err) { void err; }
         }
       }
     };

package/lib/http.js

@@ -0,0 +1,114 @@
+export function writeJson(res, code, body) {
+  try {
+    res.writeHead(code, {
+      'Content-Type': 'application/json; charset=utf-8',
+      'Cache-Control': 'no-store',
+    });
+    res.end(JSON.stringify(body));
+  } catch {
+    /* socket already closed */
+  }
+}
+
+export function readBody(req, maxBytes = 256 * 1024) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on('data', (c) => {
+      size += c.length;
+      if (size > maxBytes) {
+        req.destroy();
+        reject(new Error('body too large'));
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on('end', () => resolve(Buffer.concat(chunks)));
+    req.on('error', reject);
+  });
+}
+
+export function header(request, name) {
+  const value = request?.headers?.[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+export function isLoopbackAddress(value) {
+  const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '');
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address.startsWith('127.')
+    || address.startsWith('::ffff:127.');
+}
+
+/** Reject cross-site writes while allowing local, LAN, and reverse-proxy UIs. */
+export function isTrustedRequest(request) {
+  const secFetchSite = header(request, 'sec-fetch-site');
+  if (secFetchSite === 'cross-site') {
+    return false;
+  }
+
+  const host = header(request, 'x-forwarded-host') || header(request, 'host');
+  const origin = header(request, 'origin');
+  if (origin) {
+    try {
+      const url = new URL(origin);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  const referer = header(request, 'referer');
+  if (referer) {
+    try {
+      const url = new URL(referer);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  // Requests without origin/referer (e.g. curl, loopback tests, or internal calls)
+  if (isLoopbackAddress(request?.socket?.remoteAddress)) {
+    return true;
+  }
+
+  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
+    return true;
+  }
+
+  return false;
+}
+
+export const UPDATE_HEADER = 'x-dsh-plugin-update';
+export const ALT_UPDATE_HEADER = 'x-dsh-context-lens-update';
+
+export function isTrustedUpdateRequest(request) {
+  const updHdr = header(request, UPDATE_HEADER) || header(request, ALT_UPDATE_HEADER);
+  if (updHdr !== '1') return false;
+  if (!isLoopbackAddress(request?.socket?.remoteAddress)) return false;
+  const site = header(request, 'sec-fetch-site');
+  if (site !== undefined && site !== 'same-origin') return false;
+  const origin = header(request, 'origin');
+  const host = header(request, 'host');
+  if (origin === undefined || host === undefined) return false;
+  try {
+    const url = new URL(origin);
+    return (url.protocol === 'http:' || url.protocol === 'https:')
+      && isLoopbackAddress(url.hostname) && url.host === host;
+  } catch {
+    return false;
+  }
+}

package/lib/index.js

@@ -1,8 +1,15 @@
 import z from '@deepseek-ai/schemastery';
-import { compressLog, estimateTokens as estLog } from './compression/log-compressor.js';
-import { skeletonize } from './ast/skeletonizer.js';
 import * as tracker from './tokens/tracker.js';
-import { shouldAutoCompress } from './auto-compress.js';
+import { compressLog } from './compression/log-compressor.js';
+import { writeJson, readBody, isTrustedRequest } from './http.js';
+import { registerPluginUpdater } from './updater.js';
+import {
+  renderOutput,
+  registerTools,
+  getFocus,
+  clearFocus,
+  getLastActiveSession
+} from './tools.js';
 
 export const name = '@goodandready/dsh-context-lens';
 export const inject = ['tools', 'settings', 'webServer'];
@@ -19,195 +26,52 @@ export const Config = z.object({
 
 const NS = '@goodandready/dsh-context-lens';
 
-// #37/#18: focus keyed by session id (not process-global singleton)
-const focusBySession = new Map();
-let lastActiveSession = '__default__';
-
-function sessionKey(params, meta) {
-  const k = (
-    (params && (params.sessionId || params.session_id)) ||
-    (meta && (meta.sessionId || meta.session_id || (meta.session && meta.session.id))) ||
-    '__default__'
-  );
-  if (k !== '__default__') lastActiveSession = k;
-  return k;
-}
-
-function getFocus(key) {
-  if (!focusBySession.has(key)) focusBySession.set(key, { paths: [], updatedAt: null });
-  return focusBySession.get(key);
-}
-
-function clearFocus(key) {
-  if (key) {
-    focusBySession.set(key, { paths: [], updatedAt: new Date().toISOString() });
-  } else {
-    focusBySession.clear();
-  }
-}
-
-const OUTPUT_SCHEMA = { type: 'object', properties: { success: { type: 'boolean' } }, additionalProperties: true };
-const renderOutput = (_args, result) => JSON.stringify(result, null, 2);
+export { renderOutput };
 
 export function apply(ctx, config) {
   let getConfig = () => config;
 
   ctx.inject(['settings'], (sctx) => {
-    const scope = sctx.settings.register(NS, Config, { base: config });
-    getConfig = () => scope.get() ?? config;
+    if (typeof sctx.effect === 'function') {
+      sctx.effect(() => {
+        const scope = sctx.settings.register(NS, Config, { base: config });
+        getConfig = () => scope.get() ?? config;
+        return () => {
+          if (typeof scope?.dispose === 'function') scope.dispose();
+          getConfig = () => config;
+        };
+      }, 'dsh-context-lens: settings');
+    } else {
+      const scope = sctx.settings.register(NS, Config, { base: config });
+      getConfig = () => scope.get() ?? config;
+    }
   });
 
   function maybeTrack(original, compressed) {
-    try {
-      const cfg = getConfig();
-      if (cfg && cfg.tokenSavingsTracking === false) return null;
-      if (cfg && typeof cfg.budgetLimit === 'number') tracker.setBudgetLimit(cfg.budgetLimit);
-      if (cfg && typeof cfg.budgetAlertPercent === 'number') tracker.setBudgetAlertPercent(cfg.budgetAlertPercent);
-      return tracker.record(original, compressed);
-    } catch {
-      // #39: never record on config/read errors
-      return null;
-    }
+    const cfg = getConfig();
+    if (cfg.tokenSavingsTracking === false) return;
+    tracker.record(original, compressed);
   }
 
+  // Register AI agent tools
   if (ctx.tools) {
-    ctx.tools.register({
-      name: 'context_lens_focus',
-      description: 'Set focus files/folders for a session; other context will be auto-collapsed via skeletonizer',
-      parameters: {
-        type: 'object',
-        properties: {
-          paths: { type: 'array', items: { type: 'string' }, description: 'Focused file/folder paths' },
-          maxDepth: { type: 'number', description: 'Max skeleton depth (overrides settings)' },
-          sessionId: { type: 'string', description: 'Session id (defaults to host session when available)' }
-        },
-        required: ['paths']
-      },
-      output: { schema: OUTPUT_SCHEMA, render: renderOutput },
-      execute: async (params, meta) => {
-        const key = sessionKey(params, meta);
-        const paths = Array.isArray(params.paths) ? params.paths : [];
-        const focus = { paths, updatedAt: new Date().toISOString() };
-        focusBySession.set(key, focus);
-        return { success: true, sessionId: key, focus, hint: 'Use skeletonize helper via compress or read files with focus set' };
-      }
-    });
-
-    ctx.tools.register({
-      name: 'context_lens_compress_log',
-      description: 'Compress a large log/test output block, keeping failures and stacktraces (Jest/Pytest/Go/npm)',
-      parameters: {
-        type: 'object',
-        properties: {
-          text: { type: 'string', description: 'Raw log text to compress' },
-          log: { type: 'string', description: 'Alias for text' },
-          mode: { type: 'string', enum: ['raw', 'balanced', 'aggressive'], description: 'Compression aggressiveness' },
-          maxLines: { type: 'number', description: 'Max output lines' },
-          auto: { type: 'boolean', description: 'Auto-compress if large (uses threshold); keeps configured compressionMode' }
-        }
-      },
-      output: { schema: OUTPUT_SCHEMA, render: renderOutput },
-      execute: async (params) => {
-        const cfg = getConfig();
-        const inputText = params.text || params.log || '';
-        const mode = params.mode || cfg.compressionMode || 'balanced';
-        const maxLines = params.maxLines || 400;
-        const threshold = cfg.autoCompressThreshold ?? 4000;
-        const useAuto = params.auto !== false && shouldAutoCompress(inputText, threshold);
-        // #33: never force balanced — keep configured/explicit mode
-        const effectiveMode = mode;
-        const res = compressLog(inputText, { mode: effectiveMode, maxLines });
-        maybeTrack(inputText, res.compressed);
-        return { success: true, mode: effectiveMode, autoCompressed: useAuto, ...res };
-      }
-    });
-
-    ctx.tools.register({
-      name: 'context_lens_compress_code',
-      description: 'Generate AST skeleton for a large source file (JS/TS/Python/Go/Rust/Java/C/C++/SQL) to save context',
-      parameters: {
-        type: 'object',
-        properties: {
-          code: { type: 'string', description: 'Source code to skeletonize' },
-          language: { type: 'string', enum: ['js', 'ts', 'py', 'python', 'go', 'rust', 'java', 'c', 'cpp', 'sql'], description: 'Language hint' },
-          maxDepth: { type: 'number', description: 'Max depth' },
-          filePath: { type: 'string', description: 'File path to check focus (if in focus, returns full code)' },
-          sessionId: { type: 'string', description: 'Session id for focus lookup' }
-        },
-        required: ['code']
-      },
-      output: { schema: OUTPUT_SCHEMA, render: renderOutput },
-      execute: async (params, meta) => {
-        const cfg = getConfig();
-        const maxDepth = params.maxDepth ?? cfg.astSkeletonMaxDepth ?? 3;
-        const key = sessionKey(params, meta);
-        const focusState = getFocus(key);
-        const isFocused = params.filePath && focusState.paths.length > 0
-          ? focusState.paths.some(p => params.filePath.includes(p) || p.includes(params.filePath))
-          : false;
-        if (isFocused) {
-          maybeTrack(params.code, params.code);
-          return { success: true, skeleton: params.code, originalTokens: estLog(params.code), skeletonTokens: estLog(params.code), maxDepth, focused: true, sessionId: key, hint: 'File is in focus, returned full code' };
-        }
-        const skeleton = skeletonize(params.code, { maxDepth, language: params.language });
-        maybeTrack(params.code, skeleton);
-        return { success: true, skeleton, originalTokens: estLog(params.code), skeletonTokens: estLog(skeleton), maxDepth, focused: false, sessionId: key };
-      }
-    });
-
-    ctx.tools.register({
-      name: 'context_lens_reset',
-      description: 'Reset context-lens savings stats and history (e.g. at the start of a new task)',
-      parameters: {
-        type: 'object',
-        properties: {
-          sessionId: { type: 'string', description: 'Optional session id to also reset session focus' }
-        }
-      },
-      output: { schema: OUTPUT_SCHEMA, render: renderOutput },
-      execute: async (params, meta) => {
-        tracker.reset();
-        const key = sessionKey(params || {}, meta);
-        if (params && params.sessionId) {
-          focusBySession.delete(key);
-        }
-        return { success: true, message: 'Context lens stats and history reset', sessionId: key };
-      }
-    });
-
-    ctx.tools.register({
-      name: 'context_lens_stats',
-      description: 'Show session token savings stats for context-lens',
-      parameters: {
-        type: 'object',
-        properties: {
-          sessionId: { type: 'string', description: 'Session id for focus snapshot' }
-        }
-      },
-      output: { schema: OUTPUT_SCHEMA, render: renderOutput },
-      execute: async (params, meta) => {
-        const cfg = getConfig();
-        if (typeof cfg.budgetLimit === 'number') tracker.setBudgetLimit(cfg.budgetLimit);
-        if (typeof cfg.budgetAlertPercent === 'number') tracker.setBudgetAlertPercent(cfg.budgetAlertPercent);
-        const stats = tracker.getStats(cfg.budgetLimit, cfg.budgetAlertPercent);
-        const history = tracker.getHistory();
-        const key = sessionKey(params || {}, meta);
-        return {
-          success: true,
-          ...stats,
-          history,
-          trackingEnabled: cfg.tokenSavingsTracking !== false,
-          autoCollapse: cfg.autoCollapse !== false,
-          focus: getFocus(key),
-          sessionId: key,
-          autoCompressThreshold: cfg.autoCompressThreshold,
-          budgetAlertPercent: cfg.budgetAlertPercent ?? 90
-        };
-      }
-    });
+    registerTools(ctx, { getConfig, maybeTrack });
   }
 
   if (ctx.webServer) {
+    // #61: One-click plugin updater endpoint (/api/dsh-context-lens/update)
+    const mountUpdater = () => registerPluginUpdater(ctx, {
+      packageName: '@goodandready/dsh-context-lens',
+      manifestUrl: new URL('../package.json', import.meta.url),
+      endpoint: '/api/dsh-context-lens/update'
+    });
+    if (typeof ctx.effect === 'function') {
+      ctx.effect(mountUpdater, 'dsh-context-lens: updater');
+    } else {
+      mountUpdater();
+    }
+
+    // Status route (#70: explicit URL parsing and validation)
     ctx.effect(() => ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-context-lens/status',
@@ -215,60 +79,114 @@ export function apply(ctx, config) {
         const cfg = getConfig();
         if (typeof cfg.budgetLimit === 'number') tracker.setBudgetLimit(cfg.budgetLimit);
         if (typeof cfg.budgetAlertPercent === 'number') tracker.setBudgetAlertPercent(cfg.budgetAlertPercent);
-        let sId = '__default__';
+        let sId = getLastActiveSession() || '__default__';
         try {
           const u = new URL(req.url, 'http://127.0.0.1');
-          sId = u.searchParams.get('sessionId') || u.searchParams.get('session_id') || lastActiveSession || '__default__';
-        } catch {}
-        res.setHeader('content-type', 'application/json');
-        res.end(JSON.stringify({
+          const qId = u.searchParams.get('sessionId') || u.searchParams.get('session_id');
+          if (qId !== null) {
+            if (!qId || typeof qId !== 'string' || qId.trim() === '') {
+              writeJson(res, 400, { ok: false, error: 'Invalid sessionId parameter' });
+              return;
+            }
+            sId = qId.trim();
+          }
+        } catch (err) {
+          ctx.logger?.warn?.('dsh-context-lens: failed to parse request url in status', err);
+          writeJson(res, 400, { ok: false, error: 'Malformed request URL' });
+          return;
+        }
+
+        writeJson(res, 200, {
           ok: true,
           plugin: 'dsh-context-lens',
           stats: tracker.getStats(cfg.budgetLimit, cfg.budgetAlertPercent),
           history: tracker.getHistory(),
           focus: getFocus(sId),
           sessionId: sId
-        }));
+        });
       }
     }), 'dsh-context-lens status route');
 
-    // Quick clear-focus API route
+    // Quick clear-focus API route (#62: POST only, trusted origin check; #70: clean URL error handling)
     ctx.effect(() => ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-context-lens/clear-focus',
       handler: async (req, res) => {
-        let sId = lastActiveSession || '__default__';
+        if (req.method !== 'POST') {
+          res.writeHead(405, { Allow: 'POST', 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: 'Method Not Allowed: POST required' }));
+          return;
+        }
+        if (!isTrustedRequest(req)) {
+          writeJson(res, 403, { ok: false, error: 'Forbidden: untrusted request origin' });
+          return;
+        }
+
+        let sId = getLastActiveSession() || '__default__';
         try {
           const u = new URL(req.url, 'http://127.0.0.1');
           const qId = u.searchParams.get('sessionId') || u.searchParams.get('session_id');
-          if (qId) sId = qId;
-        } catch {}
+          if (qId !== null) {
+            if (!qId || typeof qId !== 'string' || qId.trim() === '') {
+              writeJson(res, 400, { ok: false, error: 'Invalid sessionId parameter' });
+              return;
+            }
+            sId = qId.trim();
+          }
+        } catch (err) {
+          ctx.logger?.warn?.('dsh-context-lens: failed to parse request url in clear-focus', err);
+          writeJson(res, 400, { ok: false, error: 'Malformed request URL' });
+          return;
+        }
+
         clearFocus(sId);
-        res.setHeader('content-type', 'application/json');
-        res.end(JSON.stringify({ ok: true, sessionId: sId, focus: getFocus(sId) }));
+        writeJson(res, 200, { ok: true, sessionId: sId, focus: getFocus(sId) });
       }
     }), 'dsh-context-lens clear-focus route');
 
-    // #45: server-backed preview (same compressor as tools)
+    // Server-backed preview (#63: POST only, trusted origin, bounded body size, clamped maxLines)
     ctx.effect(() => ctx.webServer.register({
       kind: 'exact',
       path: '/dsh-context-lens/compress-preview',
       handler: async (req, res) => {
+        if (req.method !== 'POST') {
+          res.writeHead(405, { Allow: 'POST', 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: 'Method Not Allowed: POST required' }));
+          return;
+        }
+        if (!isTrustedRequest(req)) {
+          writeJson(res, 403, { ok: false, error: 'Forbidden: untrusted request origin' });
+          return;
+        }
+
+        let body;
         try {
-          const chunks = [];
-          for await (const c of req) chunks.push(c);
-          const body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
-          const cfg = getConfig();
-          const mode = body.mode || cfg.compressionMode || 'balanced';
-          const text = body.text || '';
-          const out = compressLog(text, { mode, maxLines: body.maxLines || 400 });
-          res.setHeader('content-type', 'application/json');
-          res.end(JSON.stringify({ ok: true, mode, ...out }));
+          const raw = await readBody(req, 256 * 1024);
+          body = JSON.parse(raw.toString('utf8') || '{}');
         } catch (e) {
-          res.statusCode = 400;
-          res.setHeader('content-type', 'application/json');
-          res.end(JSON.stringify({ ok: false, error: e && e.message || String(e) }));
+          if (e?.message === 'body too large') {
+            writeJson(res, 413, { ok: false, error: 'Payload Too Large: maximum 256KB allowed' });
+            return;
+          }
+          writeJson(res, 400, { ok: false, error: 'Malformed JSON body' });
+          return;
+        }
+
+        let maxLines = 400;
+        if (body.maxLines !== undefined) {
+          const parsed = Number(body.maxLines);
+          if (Number.isNaN(parsed) || parsed < 1 || parsed > 5000) {
+            writeJson(res, 400, { ok: false, error: 'maxLines must be a number between 1 and 5000' });
+            return;
+          }
+          maxLines = Math.floor(parsed);
         }
+
+        const cfg = getConfig();
+        const mode = body.mode || cfg.compressionMode || 'balanced';
+        const text = typeof body.text === 'string' ? body.text : '';
+        const out = compressLog(text, { mode, maxLines });
+        writeJson(res, 200, { ok: true, mode, ...out });
       }
     }), 'dsh-context-lens compress-preview route');
   }

package/lib/tools.js

@@ -0,0 +1,179 @@
+import { compressLog, estimateTokens as estLog } from './compression/log-compressor.js';
+import { skeletonize } from './ast/skeletonizer.js';
+import * as tracker from './tokens/tracker.js';
+import { shouldAutoCompress } from './auto-compress.js';
+
+export const OUTPUT_SCHEMA = { type: 'object', properties: { success: { type: 'boolean' } }, additionalProperties: true };
+
+// #71 (GH #2): output.render MUST return ContentBlock[] [{ type: 'text', text: ... }]
+export const renderOutput = (_args, result) => [
+  { type: 'text', text: typeof result === 'string' ? result : JSON.stringify(result, null, 2) }
+];
+
+const focusBySession = new Map();
+let lastActiveSession = '__default__';
+
+export function sessionKey(params, meta) {
+  const k = (
+    (params && (params.sessionId || params.session_id)) ||
+    (meta && (meta.sessionId || meta.session_id || (meta.session && meta.session.id))) ||
+    '__default__'
+  );
+  if (k !== '__default__') lastActiveSession = k;
+  return k;
+}
+
+export function getFocus(key) {
+  if (!focusBySession.has(key)) focusBySession.set(key, { paths: [], updatedAt: null });
+  return focusBySession.get(key);
+}
+
+export function clearFocus(key) {
+  if (key) {
+    focusBySession.set(key, { paths: [], updatedAt: new Date().toISOString() });
+  } else {
+    focusBySession.clear();
+  }
+}
+
+export function getLastActiveSession() {
+  return lastActiveSession;
+}
+
+export function registerTools(ctx, { getConfig, maybeTrack }) {
+  if (!ctx?.tools?.register) return;
+
+  ctx.tools.register({
+    name: 'context_lens_focus',
+    description: 'Set active file paths for current session focus (these files skip AST compression)',
+    parameters: {
+      type: 'object',
+      properties: {
+        paths: { type: 'array', items: { type: 'string' }, description: 'File paths or patterns currently in focus' },
+        sessionId: { type: 'string', description: 'Session id (uses active session if omitted)' }
+      },
+      required: ['paths']
+    },
+    output: { schema: OUTPUT_SCHEMA, render: renderOutput },
+    execute: async (params, meta) => {
+      const key = sessionKey(params, meta);
+      const paths = Array.isArray(params.paths) ? params.paths : [];
+      const state = getFocus(key);
+      state.paths = paths;
+      state.updatedAt = new Date().toISOString();
+      return { success: true, sessionId: key, focus: state };
+    }
+  });
+
+  ctx.tools.register({
+    name: 'context_lens_compress_log',
+    description: 'Compress a large log/test output block, keeping failures and stacktraces (Jest/Pytest/Go/npm)',
+    parameters: {
+      type: 'object',
+      properties: {
+        text: { type: 'string', description: 'Raw log text to compress' },
+        log: { type: 'string', description: 'Alias for text' },
+        mode: { type: 'string', enum: ['raw', 'balanced', 'aggressive'], description: 'Compression aggressiveness' },
+        maxLines: { type: 'number', description: 'Max output lines' },
+        auto: { type: 'boolean', description: 'Auto-compress if large (uses threshold); keeps configured compressionMode' }
+      }
+    },
+    output: { schema: OUTPUT_SCHEMA, render: renderOutput },
+    execute: async (params) => {
+      const cfg = getConfig();
+      const inputText = params.text || params.log || '';
+      const mode = params.mode || cfg.compressionMode || 'balanced';
+      const maxLines = params.maxLines || 400;
+      const threshold = cfg.autoCompressThreshold ?? 4000;
+      const useAuto = params.auto !== false && shouldAutoCompress(inputText, threshold);
+      const effectiveMode = mode;
+      const res = compressLog(inputText, { mode: effectiveMode, maxLines });
+      maybeTrack(inputText, res.compressed);
+      return { success: true, mode: effectiveMode, autoCompressed: useAuto, ...res };
+    }
+  });
+
+  ctx.tools.register({
+    name: 'context_lens_compress_code',
+    description: 'Generate AST skeleton for a large source file (JS/TS/Python/Go/Rust/Java/C/C++/SQL) to save context',
+    parameters: {
+      type: 'object',
+      properties: {
+        code: { type: 'string', description: 'Source code to skeletonize' },
+        language: { type: 'string', enum: ['js', 'ts', 'py', 'python', 'go', 'rust', 'java', 'c', 'cpp', 'sql'], description: 'Language hint' },
+        maxDepth: { type: 'number', description: 'Max depth' },
+        filePath: { type: 'string', description: 'File path to check focus (if in focus, returns full code)' },
+        sessionId: { type: 'string', description: 'Session id for focus lookup' }
+      },
+      required: ['code']
+    },
+    output: { schema: OUTPUT_SCHEMA, render: renderOutput },
+    execute: async (params, meta) => {
+      const cfg = getConfig();
+      const maxDepth = params.maxDepth ?? cfg.astSkeletonMaxDepth ?? 3;
+      const key = sessionKey(params, meta);
+      const focusState = getFocus(key);
+      const isFocused = params.filePath && focusState.paths.length > 0
+        ? focusState.paths.some(p => params.filePath.includes(p) || p.includes(params.filePath))
+        : false;
+      if (isFocused) {
+        maybeTrack(params.code, params.code);
+        return { success: true, skeleton: params.code, originalTokens: estLog(params.code), skeletonTokens: estLog(params.code), maxDepth, focused: true, sessionId: key, hint: 'File is in focus, returned full code' };
+      }
+      const skeleton = skeletonize(params.code, { maxDepth, language: params.language });
+      maybeTrack(params.code, skeleton);
+      return { success: true, skeleton, originalTokens: estLog(params.code), skeletonTokens: estLog(skeleton), maxDepth, focused: false, sessionId: key };
+    }
+  });
+
+  ctx.tools.register({
+    name: 'context_lens_reset',
+    description: 'Reset context-lens savings stats and history (e.g. at the start of a new task)',
+    parameters: {
+      type: 'object',
+      properties: {
+        sessionId: { type: 'string', description: 'Optional session id to also reset session focus' }
+      }
+    },
+    output: { schema: OUTPUT_SCHEMA, render: renderOutput },
+    execute: async (params, meta) => {
+      tracker.reset();
+      const key = sessionKey(params || {}, meta);
+      if (params && params.sessionId) {
+        focusBySession.delete(key);
+      }
+      return { success: true, message: 'Context lens stats and history reset', sessionId: key };
+    }
+  });
+
+  ctx.tools.register({
+    name: 'context_lens_stats',
+    description: 'Show session token savings stats for context-lens',
+    parameters: {
+      type: 'object',
+      properties: {
+        sessionId: { type: 'string', description: 'Session id for focus snapshot' }
+      }
+    },
+    output: { schema: OUTPUT_SCHEMA, render: renderOutput },
+    execute: async (params, meta) => {
+      const cfg = getConfig();
+      if (typeof cfg.budgetLimit === 'number') tracker.setBudgetLimit(cfg.budgetLimit);
+      if (typeof cfg.budgetAlertPercent === 'number') tracker.setBudgetAlertPercent(cfg.budgetAlertPercent);
+      const stats = tracker.getStats(cfg.budgetLimit, cfg.budgetAlertPercent);
+      const history = tracker.getHistory();
+      const key = sessionKey(params || {}, meta);
+      return {
+        success: true,
+        ...stats,
+        history,
+        trackingEnabled: cfg.tokenSavingsTracking !== false,
+        autoCollapse: cfg.autoCollapse !== false,
+        focus: getFocus(key),
+        sessionId: key,
+        autoCompressThreshold: cfg.autoCompressThreshold,
+        budgetAlertPercent: cfg.budgetAlertPercent ?? 90
+      };
+    }
+  });
+}

package/lib/updater.js

@@ -0,0 +1,237 @@
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { writeJson, isTrustedUpdateRequest } from './http.js';
+
+const VERSION_CACHE_MS = 60_000;
+const UPDATE_TIMEOUT_MS = 120_000;
+
+let latestCache;
+
+function validProfileName(value) {
+  return typeof value === 'string' && value !== '' && value !== '.' && value !== '..'
+    && !value.includes('/') && !value.includes('\\') && !/[\0-\x1f\x7f]/.test(value);
+}
+
+function profileNameFromArgv(argv) {
+  if (!Array.isArray(argv)) return undefined;
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === '--profile') return argv[index + 1];
+    if (typeof argv[index] === 'string' && argv[index].startsWith('--profile=')) {
+      return argv[index].slice('--profile='.length);
+    }
+  }
+  return undefined;
+}
+
+function findDshCliEntry() {
+  const value = process.argv[1];
+  if (typeof value !== 'string' || value.length === 0) return undefined;
+  const entry = value.startsWith('file:') ? fileURLToPath(value) : resolve(process.cwd(), value);
+  if (!existsSync(entry)) return undefined;
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json');
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const bin = typeof manifest.bin === 'string'
+          ? manifest.bin
+          : typeof manifest.bin === 'object' && manifest.bin !== null
+            ? manifest.bin.dsh
+            : undefined;
+        if (manifest.name === '@deepseek-ai/dsh' && typeof bin === 'string'
+          && !isAbsolute(bin) && resolve(directory, bin) === resolve(entry)) return entry;
+      } catch {
+        /* continue */
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return undefined;
+  }
+}
+
+export function detectRuntime() {
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR
+    ?? resolve(homedir(), '.dsh', 'profiles', 'web'));
+  const selected = profileNameFromArgv(process.argv);
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir)) ? basename(profileDir) : 'web';
+  const cliEntry = findDshCliEntry();
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry };
+}
+
+export function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(String(value || ''));
+  if (match === null) return undefined;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  };
+}
+
+function comparePrerelease(candidateParts, currentParts) {
+  if (candidateParts.length === 0 && currentParts.length > 0) return 1;
+  if (candidateParts.length > 0 && currentParts.length === 0) return -1;
+  if (candidateParts.length === 0 && currentParts.length === 0) return 0;
+
+  const len = Math.max(candidateParts.length, currentParts.length);
+  for (let i = 0; i < len; i += 1) {
+    const a = candidateParts[i];
+    const b = currentParts[i];
+    if (a === undefined) return -1;
+    if (b === undefined) return 1;
+    if (a === b) continue;
+
+    const aNum = /^\d+$/.test(a) ? Number(a) : undefined;
+    const bNum = /^\d+$/.test(b) ? Number(b) : undefined;
+
+    if (aNum !== undefined && bNum !== undefined) {
+      return aNum > bNum ? 1 : -1;
+    }
+    if (aNum !== undefined && bNum === undefined) {
+      return -1;
+    }
+    if (aNum === undefined && bNum !== undefined) {
+      return 1;
+    }
+    return a.localeCompare(b) > 0 ? 1 : -1;
+  }
+  return 0;
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue);
+  const candidate = parseSemver(candidateValue);
+  if (current === undefined || candidate === undefined) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
+}
+
+async function fetchLatestVersion(packageName, registry) {
+  if (latestCache?.packageName === packageName && latestCache.registry === registry && Date.now() < latestCache.expiresAt) {
+    return latestCache.version;
+  }
+  try {
+    const reg = registry.replace(/\/+$/, '');
+    const response = await fetch(`${reg}/${encodeURIComponent(packageName)}/latest`, {
+      signal: AbortSignal.timeout(6000),
+    });
+    if (!response.ok) return undefined;
+    const value = await response.json();
+    if (typeof value?.version !== 'string' || !value.version) return undefined;
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS };
+    return value.version;
+  } catch {
+    return undefined;
+  }
+}
+
+async function readCurrentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'));
+  if (typeof value?.version !== 'string' || !value.version) throw new Error('Cannot read current plugin version.');
+  return value.version;
+}
+
+export async function checkUpdateStatus(options, target = detectRuntime()) {
+  const current = await readCurrentVersion(options.manifestUrl);
+  const latest = await fetchLatestVersion(options.packageName, options.registry || 'https://registry.npmjs.org');
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  };
+}
+
+async function installExact(target, packageSpec, options) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  await new Promise((resolvePromise, reject) => {
+    // Note: per issue #61 / dsh-clinebot#24 / dsh-agent-loop-guard#38, do NOT disable pnpm minimum release age quarantine
+    const child = spawn(process.execPath, [
+      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+      packageSpec,
+      `--registry=${options.registry || 'https://registry.npmjs.org/'}`,
+    ], {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NO_COLOR: '1' },
+    });
+    let detail = '';
+    child.stdout?.on('data', (chunk) => { detail = (detail + String(chunk)).slice(-4000); });
+    child.stderr?.on('data', (chunk) => { detail = (detail + String(chunk)).slice(-4000); });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error('Update timed out.'));
+    }, UPDATE_TIMEOUT_MS);
+    child.once('error', (error) => { clearTimeout(timer); reject(error); });
+    child.once('exit', (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
+    });
+  });
+}
+
+export function registerPluginUpdater(ctx, options) {
+  if (!ctx?.webServer?.register) return () => {};
+  let installing = false;
+  return ctx.webServer.register({
+    kind: 'exact',
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = detectRuntime();
+        if (request.method === 'GET' || request.method === 'HEAD') {
+          const payload = await checkUpdateStatus(options, target);
+          writeJson(response, 200, payload);
+          return;
+        }
+        if (request.method !== 'POST') {
+          response.writeHead(405, { Allow: 'GET, HEAD, POST' });
+          response.end();
+          return;
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          writeJson(response, 403, { ok: false, error: 'Rejected non-local or cross-origin update request.' });
+          return;
+        }
+        if (installing) {
+          writeJson(response, 409, { ok: false, error: 'This plugin is already updating.' });
+          return;
+        }
+        installing = true;
+        try {
+          const before = await checkUpdateStatus(options, target);
+          if (before.latestVersion === undefined) {
+            writeJson(response, 503, { ok: false, error: 'The latest version is temporarily unavailable.' });
+            return;
+          }
+          if (!before.updateAvailable) {
+            writeJson(response, 200, before);
+            return;
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options);
+          writeJson(response, 200, {
+            ...before,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          });
+        } finally {
+          installing = false;
+        }
+      } catch (error) {
+        writeJson(response, 500, { ok: false, error: String(error?.message || error) });
+      }
+    },
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-context-lens",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "DSH plugin for AST context compression, test log filtering, and token budget guard",
   "type": "module",
   "main": "lib/index.js",