@goodandready/dsh-cron 0.2.15 → 0.2.16

package/README.md

@@ -392,6 +392,13 @@ Developer-facing, no behaviour change. `parseScheduleExpression` was split into
 
 
 
+### 28. In-App One-Click Auto-Updater & Error Resilience (v0.2.16, #147, #155, #156)
+- **Plugin Self-Updater (#147)**: Added in-app one-click self-updating module (`lib/updater.js`) with `/api/dsh-cron/update` endpoint and dedicated Settings UI card. Automatically queries npm registry, compares semver versions including pre-releases, and upgrades `@goodandready/dsh-cron` in-place through the DSH CLI without manual SSH sessions. POST updates are protected via origin validation (`rejectCrossOrigin`).
+- **Silent Failure Elimination (#156)**: Replaced silent empty catches with diagnostic logging: uncompleted import transaction rollbacks are surfaced to system logs with warning severity, dynamic core module fallback reasons are logged, and session opening failures inform the user with actionable notifications.
+- **Dead Code & Export Hygiene (#155)**: Cleaned unused legacy helpers (`CHANNEL_LABELS`, `makeInspectAsk`), stripped unnecessary exports from 16 internal modules, and wired `supportsSilentRule` directly into execution pipeline.
+
+---
+
 ## 📦 Installation
 
 Install into your DeepSeek Harness web profile:
@@ -503,6 +510,7 @@ All endpoints are served by the DSH web server under `/dsh-cron/`. Read endpoint
 | `POST` | `/dsh-cron/kanban/test` | Create a Kanban connectivity-test card |
 | `*` | `/dsh-cron/action/:id/:action` | Legacy alias for the task action routes (`run`, `toggle`, `delete`, `history`) |
 | `GET` | `/dsh-cron/metrics` | Prometheus text exposition of task and run counters — never prompts or output (#53) |
+| `GET` / `POST` | `/api/dsh-cron/update` | One-click plugin self-updater: query registry version and in-place upgrade (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | External token-guarded surface: list / create-or-update (#54) |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | External token-guarded surface: read / delete (#54) |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | External token-guarded surface: force a run (#54) |

package/README.ru.md

@@ -268,6 +268,13 @@ cron_create_task({
 
 
 
+### 28. Модуль самообновления в 1 клик и устойчивость к ошибкам (v0.2.16, #147, #155, #156)
+- **Самообновление плагина (#147)**: Добавлен встроенный модуль обновления (`lib/updater.js`) с маршрутом `/api/dsh-cron/update` и карточкой в настройках Web UI. Автоматически опрашивает npm registry, корректно сравнивает semver-версии (включая пререлизы) и обновляет `@goodandready/dsh-cron` на лету через CLI DSH без необходимости входа по SSH. Запросы POST защищены проверкой источника (`rejectCrossOrigin`).
+- **Устранение скрытых сбоев (#156)**: Ликвидированы пустые `catch`: незавершённые откаты транзакций импорта логируются с уровнем `warn`, причины fallback для динамических модулей ядра фиксируются в отладочном журнале, а при сбое открытия сессии пользователь получает понятное уведомление.
+- **Гигиена кода и экспортов (#155)**: Удалены устаревшие неиспользуемые сущности (`CHANNEL_LABELS`, `makeInspectAsk`), снят лишний модификатор `export` с 16 внутренних функций и констант, а метод `supportsSilentRule` напрямую подключен в боевой пайплайн проверки тихих правил.
+
+---
+
 ## 📦 Установка
 
 ```bash
@@ -500,6 +507,7 @@ bash deploy.sh verify [exact-version]
 | `POST` | `/dsh-cron/kanban/test` | Тестовая карточка в Kanban |
 | `*` | `/dsh-cron/action/:id/:action` | Legacy-алиас действий над задачей (`run`, `toggle`, `delete`, `history`) |
 | `GET` | `/dsh-cron/metrics` | Текст в формате Prometheus: счётчики задач и запусков — без промптов и вывода (#53) |
+| `GET` / `POST` | `/api/dsh-cron/update` | Самообновление плагина в 1 клик: запрос версии в реестре и обновление на лету (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | Внешняя поверхность под токеном: список / создание-обновление (#54) |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | Внешняя поверхность под токеном: чтение / удаление (#54) |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | Внешняя поверхность под токеном: принудительный запуск (#54) |

package/README.zh.md

@@ -391,6 +391,13 @@ bash deploy.sh verify [exact-version]
 
 
 
+### 28. 应用内一键自更新与错误容错增强 (v0.2.16, #147, #155, #156)
+- **插件自更新模块 (#147)**：新增应用内一键自更新机制 (`lib/updater.js`)、`/api/dsh-cron/update` 接口与设置面板专属卡片。自动轮询 npmjs 仓库最新版本，精准比对 Semver 版本号（含预发布版本），通过 DSH CLI 就地升级 `@goodandready/dsh-cron`，无需 SSH 终端操作。POST 请求受跨域与来源保护 (`rejectCrossOrigin`)。
+- **消除静默异常与错误追踪 (#156)**：全面消除空 `catch` 异常压制：任务导入事务回滚失败记录 `warn` 级别日志、动态核心模块降级原因记录诊断日志、会话自动唤出失败向用户呈现友好提示。
+- **死代码清理与模块导出精简 (#155)**：清理未引用的旧版实体 (`CHANNEL_LABELS`, `makeInspectAsk`)，收回 16 个内部工具函数的暴露权限，并将 `supportsSilentRule` 接入静默规则核心执行流水线。
+
+---
+
 ## 📦 安装
 
 ```bash
@@ -500,6 +507,7 @@ dsh-cron:
 | `POST` | `/dsh-cron/kanban/test` | 创建 Kanban 连通性测试卡片 |
 | `*` | `/dsh-cron/action/:id/:action` | 任务操作路由的兼容别名（`run`、`toggle`、`delete`、`history`） |
 | `GET` | `/dsh-cron/metrics` | Prometheus 文本格式的任务与运行计数 —— 不含提示词与输出（#53） |
+| `GET` / `POST` | `/api/dsh-cron/update` | 插件一键自更新：查询仓库最新版本并就地平滑升级 (#147) |
 | `GET` / `POST` | `/dsh-cron/api/tasks` | 令牌保护的外部接口：列表 / 创建或更新（#54） |
 | `GET` / `DELETE` | `/dsh-cron/api/tasks/:id` | 令牌保护的外部接口：读取 / 删除（#54） |
 | `POST` | `/dsh-cron/api/tasks/:id/run` | 令牌保护的外部接口：强制执行（#54） |

package/lib/api.js

@@ -343,7 +343,9 @@ function applyImportPlan({ store, scheduler, plan }) {
       try {
         if (entry.previous) store.set(entry.previous);
         else store.delete(entry.id);
-      } catch (_) {}
+      } catch (rollbackErr) {
+        console.warn(`[dsh-cron] import rollback failed for task "${entry.id}":`, rollbackErr?.message || rollbackErr);
+      }
     }
     return { imported: [], error: `Import failed and was rolled back: ${writeErr.message}` };
   }

package/lib/channels.js

@@ -13,22 +13,12 @@ import { resolveTemplateText, truncateText } from './templates.js';
 
 export const CHANNEL_IDS = ['telegram', 'kanban', 'discord', 'slack', 'ntfy', 'bark', 'pushplus', 'tts', 'gitea'];
 
-export const CHANNEL_LABELS = {
-  telegram: 'Telegram',
-  kanban: 'dsh-kanban card',
-  discord: 'Discord webhook',
-  slack: 'Slack webhook',
-  ntfy: 'ntfy push',
-  bark: 'Bark push',
-  pushplus: 'PushPlus',
-  tts: 'Voice via dsh-tts',
-  gitea: 'Gitea issue',
-};
+// CHANNEL_LABELS removed (#155) — localized via lib/client.js
 
 const isFailed = (status) => status === 'error' || status === 'timeout';
 
 /** The message text for a channel: custom template, else built-in defaults. */
-export function messageTextFor(channelId, task, runInfo, settings = {}) {
+function messageTextFor(channelId, task, runInfo, settings = {}) {
   const templates = (settings && settings.channelTemplates) || {};
   const template = templates[channelId] || settings.template || '';
   return resolveTemplateText({ template, task, runInfo });
@@ -247,7 +237,7 @@ async function postJson(http, url, headers, body, channelId, signal, timeoutMs)
  * One handler per channel. Each returns a small detail object and throws a
  * descriptive Error on failure; the router turns that into a failure entry.
  */
-export const CHANNEL_HANDLERS = {
+const CHANNEL_HANDLERS = {
   async telegram({ task, runInfo, settings, secrets, http, signal, timeoutMs }) {
     const botToken = secrets.botToken || '';
     const chatId = String(settings.chatId || '').trim();

package/lib/chat-start.js

@@ -24,7 +24,9 @@ export async function chatStartHandler(ctx, req, res, parseJsonBody, sendJson, r
       if (llmModule && typeof llmModule.createUserMessage === 'function') {
         createUserMessage = llmModule.createUserMessage;
       }
-    } catch {}
+    } catch (err) {
+      (ctx.logger || console).debug?.('[dsh-cron] @deepseek-ai/dsh-llm createUserMessage unavailable, using identity fallback:', err?.message || err);
+    }
 
     let mintSessionId = () => `cron-setup-${randomUUID()}`;
     try {
@@ -33,7 +35,9 @@ export async function chatStartHandler(ctx, req, res, parseJsonBody, sendJson, r
         const sid = mintSessionId();
         mintSessionId = () => sessionModule.SessionId(sid);
       }
-    } catch {}
+    } catch (err) {
+      (ctx.logger || console).debug?.('[dsh-cron] @deepseek-ai/dsh-session SessionId unavailable, using string fallback:', err?.message || err);
+    }
 
     const defaultSel = ctx.get('agentDefaultModel')?.currentSelection?.();
     const provider = body.provider || defaultSel?.provider;

package/lib/client.js

@@ -1088,6 +1088,7 @@ window.__ModuleLoader__.load({
           }
         }
       }
+      console.warn('[dsh-cron] could not open session in workspace:', sessionId);
       return false;
     }
 
@@ -3316,6 +3317,65 @@ window.__ModuleLoader__.load({
       const [testInfo, setTestInfo] = React.useState(null);
       // Collapsed by default, head is the toggle (canonical card contract, #100)
       const [cardOpen, setCardOpen] = React.useState(false);
+      const [updateState, setUpdateState] = React.useState({
+        checking: false,
+        updating: false,
+        currentVersion: '0.2.16',
+        latestVersion: undefined,
+        updateAvailable: false,
+        notice: null,
+        error: null
+      });
+
+      const checkUpdates = async () => {
+        setUpdateState(prev => ({ ...prev, checking: true, error: null, notice: null }));
+        try {
+          const res = await fetch('/api/dsh-cron/update');
+          const data = await res.json();
+          if (data && data.currentVersion) {
+            setUpdateState(prev => ({
+              ...prev,
+              checking: false,
+              currentVersion: data.currentVersion,
+              latestVersion: data.latestVersion,
+              updateAvailable: Boolean(data.updateAvailable),
+              error: data.latestCheckFailed ? 'Registry check failed' : null
+            }));
+          } else {
+            setUpdateState(prev => ({ ...prev, checking: false, error: data.error || 'Check failed' }));
+          }
+        } catch (err) {
+          setUpdateState(prev => ({ ...prev, checking: false, error: err.message }));
+        }
+      };
+
+      const runUpdate = async () => {
+        setUpdateState(prev => ({ ...prev, updating: true, error: null, notice: null }));
+        try {
+          const res = await fetch('/api/dsh-cron/update', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'x-dsh-plugin-update': '1' }
+          });
+          const data = await res.json();
+          if (data && data.updated) {
+            setUpdateState(prev => ({
+              ...prev,
+              updating: false,
+              updateAvailable: false,
+              currentVersion: data.updatedVersion || data.latestVersion,
+              notice: T_KEY(t, 'updater.success', { version: data.updatedVersion || data.latestVersion })
+            }));
+          } else {
+            setUpdateState(prev => ({
+              ...prev,
+              updating: false,
+              error: data.error || data.message || 'Update failed'
+            }));
+          }
+        } catch (err) {
+          setUpdateState(prev => ({ ...prev, updating: false, error: err.message }));
+        }
+      };
 
       // Settings snapshot status (#102): never render phantom inputs before
       // the snapshot arrives; offer a retry when it is unavailable.
@@ -3521,6 +3581,57 @@ window.__ModuleLoader__.load({
             'data-type': testInfo.success ? 'success' : 'error',
             style: { margin: 0, padding: '8px 12px' }
           }, testInfo.message),
+          React.createElement('div', {
+            className: 'dsh-cron-form-group',
+            style: {
+              background: 'var(--dsw-alias-bg-layer-2, rgba(255,255,255,0.03))',
+              border: '1px solid var(--dsw-alias-border-l2, rgba(255,255,255,0.08))',
+              borderRadius: '8px',
+              padding: '14px',
+              marginBottom: '16px'
+            }
+          },
+            React.createElement('div', {
+              style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '8px' }
+            },
+              React.createElement('div', { style: { fontWeight: '600', fontSize: '14px' } }, `🚀 ${T_KEY(t, 'updater.title')}`),
+              React.createElement('div', { style: { display: 'flex', gap: '8px' } },
+                React.createElement('button', {
+                  type: 'button',
+                  className: 'dsh-cron-btn-secondary',
+                  style: { padding: '4px 10px', fontSize: '12px' },
+                  disabled: updateState.checking || updateState.updating,
+                  onClick: checkUpdates
+                }, updateState.checking ? T_KEY(t, 'updater.checking') : T_KEY(t, 'updater.btnCheck')),
+                updateState.updateAvailable ? React.createElement('button', {
+                  type: 'button',
+                  className: 'dsh-cron-btn-primary',
+                  style: { padding: '4px 10px', fontSize: '12px' },
+                  disabled: updateState.updating,
+                  onClick: runUpdate
+                }, updateState.updating ? T_KEY(t, 'updater.updating') : T_KEY(t, 'updater.btnUpdate', { version: updateState.latestVersion })) : null
+              )
+            ),
+            React.createElement('div', {
+              style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary, #999)', marginBottom: '8px' }
+            }, T_KEY(t, 'updater.desc')),
+            React.createElement('div', {
+              style: { display: 'flex', alignItems: 'center', gap: '12px', fontSize: '13px' }
+            },
+              React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary, #aaa)' } },
+                T_KEY(t, 'updater.current', { version: updateState.currentVersion })
+              ),
+              updateState.checking ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-info' }, T_KEY(t, 'updater.checking')) :
+              updateState.updateAvailable ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-warn' }, T_KEY(t, 'updater.available', { version: updateState.latestVersion })) :
+              updateState.currentVersion && !updateState.error ? React.createElement('span', { className: 'dsh-cron-badge dsh-cron-badge-ok' }, `✓ ${T_KEY(t, 'updater.upToDate')}`) : null
+            ),
+            updateState.notice ? React.createElement('div', {
+              style: { marginTop: '8px', color: 'var(--dsw-alias-success, #10b981)', fontSize: '12px' }
+            }, updateState.notice) : null,
+            updateState.error ? React.createElement('div', {
+              style: { marginTop: '8px', color: 'var(--dsw-alias-error, #ef4444)', fontSize: '12px' }
+            }, updateState.error) : null
+          ),
           React.createElement('div', { style: { display: 'flex', gap: '8px', alignItems: 'center', flexWrap: 'wrap', marginTop: '4px' } },
             React.createElement('button', {
               type: 'submit',

package/lib/failure-inspector.js

@@ -13,7 +13,7 @@
 import { askModel, parseJsonAnswer, resolveAskTarget } from './llm-ask.js';
 
 /** Agent-mediated tasks have a prompt worth revising. */
-export const INSPECTABLE_TASK_TYPES = ['llm', 'skill', 'workflow'];
+const INSPECTABLE_TASK_TYPES = ['llm', 'skill', 'workflow'];
 
 export function supportsInspection(task) {
   const type = String((task && task.type) || 'llm');
@@ -98,10 +98,4 @@ export async function inspectFailure({ task, runInfo, ask, preferredModel, timeo
   }
 }
 
-/** Ask helper bound to a context, used by the scheduler. */
-export function makeInspectAsk(ctx) {
-  return async ({ prompt, system, preferredModel, maxTokens, timeoutMs, task }) => {
-    const target = resolveAskTarget(ctx, task || {}, preferredModel);
-    return askModel(ctx, { ...target, prompt, system, maxTokens, timeoutMs });
-  };
-}
+// makeInspectAsk removed (#155) — scheduler uses makeAsk(ctx) from lib/llm-ask.js

package/lib/index.js

@@ -1,3 +1,5 @@
+import { registerPluginUpdater } from './updater.js';
+import { credentialRefStatus } from './secrets.js';
 import { TaskStore } from './store.js';
 import { TaskScheduler, parseScheduleExpression } from './scheduler.js';
 import { SessionRunner } from './runner.js';
@@ -165,6 +167,15 @@ export function sanitizeSettingsPayload(body) {
       delete payload[key];
     }
   }
+  for (const key of ['botTokenRef', 'barkKeyRef', 'giteaTokenRef']) {
+    if (key in payload && typeof payload[key] === 'string' && payload[key].trim()) {
+      const refCheck = credentialRefStatus(payload[key]);
+      if (!refCheck.ok) {
+        console.warn(`[dsh-cron] invalid credential reference in "${key}": ${refCheck.error}`);
+        delete payload[key];
+      }
+    }
+  }
   for (const key of TaskStore.FORBIDDEN_SETTING_KEYS) {
     if (key in payload) {
       console.warn(`[dsh-cron] refusing raw secret "${key}" from the client — use a credential reference`);
@@ -378,6 +389,13 @@ export function apply(ctx, config) {
   // #48: the recipe hub is the single source of the panel's suggestions.
   const recommendations = recipeRecommendations();
 
+  // Auto-updater route (#147)
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    endpoint: '/api/dsh-cron/update',
+    packageName: '@goodandready/dsh-cron',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  }), 'dsh-cron: /api/dsh-cron/update');
+
   // 1. REST API — collection (list/create) + item actions in one prefix
   // handler per route family; registered WITHOUT the trailing slash (#96)
   ctx.effect(() => ctx.webServer.register({

package/lib/recipes.js

@@ -34,7 +34,7 @@ export const RECIPE_CATEGORIES = [
  * packages, users and permissions, scheduling and the network edge, power state
  * and writes outside the working tree.
  */
-export const DESTRUCTIVE_PATTERNS = [
+const DESTRUCTIVE_PATTERNS = [
   /\brm\b/i,
   /\bunlink\b/i,
   /\bshred\b/i,

package/lib/runtimes.js

@@ -10,7 +10,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 export const EXTERNAL_RUNTIMES = ['script', 'node', 'python', 'http', 'ssh', 'docker'];
-export const AGENT_RUNTIMES = ['llm', 'skill', 'workflow'];
+const AGENT_RUNTIMES = ['llm', 'skill', 'workflow'];
 export const TASK_TYPES = [...AGENT_RUNTIMES, ...EXTERNAL_RUNTIMES];
 
 /** Types that execute code and therefore need the HTTP confirm header. */
@@ -56,7 +56,7 @@ export function buildNodeInvocation(task, cwd) {
 }
 
 /** Find the Python interpreter, preferring a task virtualenv, then the workspace one. */
-export function detectPython(task, cwd) {
+function detectPython(task, cwd) {
   if (task.pythonPath) return task.pythonPath;
   const candidates = [];
   if (process.env.VIRTUAL_ENV) {

package/lib/scheduler.js

@@ -6,10 +6,10 @@ import { applySilentRule } from './silent-rule.js';
 import { inspectFailure } from './failure-inspector.js';
 
 /** Task types that talk to a model and can therefore use a fallback model. */
-export const AGENT_TASK_TYPES = ['llm', 'skill', 'workflow'];
+const AGENT_TASK_TYPES = ['llm', 'skill', 'workflow'];
 
 /** Sum two usage records, so a fallback attempt is not lost in accounting. */
-export function addUsage(a, b) {
+function addUsage(a, b) {
   return {
     inputTokens: (a?.inputTokens || 0) + (b?.inputTokens || 0),
     outputTokens: (a?.outputTokens || 0) + (b?.outputTokens || 0),

package/lib/silent-rule.js

@@ -15,7 +15,7 @@
 import { askModel, parseJsonAnswer, resolveAskTarget } from './llm-ask.js';
 
 /** Task types whose runs produce output a rule can judge. */
-export const SILENT_RULE_TASK_TYPES = ['script', 'node', 'python', 'http'];
+const SILENT_RULE_TASK_TYPES = ['script', 'node', 'python', 'http'];
 
 export function supportsSilentRule(task) {
   return SILENT_RULE_TASK_TYPES.includes(String(task && task.type ? task.type : 'script'));
@@ -64,6 +64,9 @@ export async function applySilentRule({ task, runInfo, ask, preferredModel, time
   if (!task || !task.silentRule || String(task.silentRule).trim() === '') {
     return { skipped: false, reason: '' };
   }
+  if (!supportsSilentRule(task)) {
+    return { skipped: false, reason: '', note: 'task type does not support silent rule' };
+  }
   if ((runInfo && runInfo.status) !== 'success') {
     return { skipped: false, reason: '', note: 'the rule only judges successful runs' };
   }

package/lib/telegram.js

@@ -79,7 +79,7 @@ export function getDshDefaultTelegramCredentials() {
 /**
  * Escape markdown special characters for Telegram legacy markdown.
  */
-export function escapeMarkdown(str) {
+function escapeMarkdown(str) {
   if (!str) return '';
   return String(str).replace(/[_*[\]()~`>#+\-=|{}.!]/g, '\\$&');
 }

package/lib/updater.js

@@ -0,0 +1,237 @@
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { rejectCrossOrigin } from './http-utils.js';
+
+const UPDATE_TIMEOUT_MS = 10 * 60_000;
+const VERSION_CACHE_MS = 5 * 60_000;
+let latestCache = null;
+
+function validProfileName(value) {
+  return typeof value === 'string' && value !== '' && value !== '.' && value !== '..'
+    && !value.includes('/') && !value.includes('\\') && !/[\0-\x1f\x7f]/.test(value);
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === '--profile' || argv[index] === '-p') return argv[index + 1];
+    if (argv[index]?.startsWith('--profile=')) return argv[index].slice('--profile='.length);
+  }
+  return argv[2] === 'web' ? 'web' : undefined;
+}
+
+function findDshCliEntry() {
+  const value = process.argv[1];
+  if (value === undefined || value === '') return undefined;
+  const entry = value.startsWith('file:') ? fileURLToPath(value) : resolve(process.cwd(), value);
+  if (!existsSync(entry)) return undefined;
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json');
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        const bin = typeof manifest.bin === 'string'
+          ? manifest.bin
+          : typeof manifest.bin === 'object' && manifest.bin !== null
+            ? manifest.bin.dsh
+            : undefined;
+        if (manifest.name === '@deepseek-ai/dsh' && typeof bin === 'string'
+          && !isAbsolute(bin) && resolve(directory, bin) === resolve(entry)) return entry;
+      } catch {
+        // Continue searching parent directories
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return undefined;
+  }
+}
+
+export function runtime() {
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR
+    ?? resolve(homedir(), '.dsh', 'profiles', 'web'));
+  const selected = profileNameFromArgv(process.argv);
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir)) ? basename(profileDir) : 'web';
+  const cliEntry = findDshCliEntry();
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry };
+}
+
+export function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(String(value || '').trim());
+  if (match === null) return undefined;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a);
+      const bNumber = BigInt(b);
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue);
+  const candidate = parseSemver(candidateValue);
+  if (current === undefined || candidate === undefined) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
+}
+
+export async function latestVersion(packageName, registry = 'https://registry.npmjs.org') {
+  if (latestCache?.packageName === packageName && latestCache.registry === registry && Date.now() < latestCache.expiresAt) {
+    return latestCache.version;
+  }
+  try {
+    const cleanReg = registry.replace(/\/$/, '');
+    const response = await fetch(`${cleanReg}/${encodeURIComponent(packageName)}/latest`, {
+      signal: AbortSignal.timeout(8000),
+      headers: { accept: 'application/json' },
+    });
+    if (!response.ok) return undefined;
+    const value = await response.json();
+    if (typeof value.version !== 'string' || value.version === '') return undefined;
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS };
+    return value.version;
+  } catch {
+    return undefined;
+  }
+}
+
+export async function currentVersion(manifestUrl) {
+  const raw = await readFile(manifestUrl, 'utf8');
+  const value = JSON.parse(raw);
+  if (typeof value.version !== 'string' || value.version === '') throw new Error('Cannot read current plugin version.');
+  return value.version;
+}
+
+export async function getUpdateStatus(options, target = runtime()) {
+  const current = await currentVersion(options.manifestUrl);
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org');
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  };
+}
+
+export async function installExact(target, packageSpec, options = {}) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
+  return new Promise((resolvePromise, reject) => {
+    // IMPORTANT: As required by #147, do NOT add minimumReleaseAge bypass
+    const args = [
+      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+      packageSpec,
+      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+    ];
+    const child = spawn(process.execPath, args, {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NO_COLOR: '1' },
+    });
+    let detail = '';
+    child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4000); });
+    child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4000); });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error('Update timed out; use the normal DSH update flow.'));
+    }, UPDATE_TIMEOUT_MS);
+    child.once('error', error => { clearTimeout(timer); reject(error); });
+    child.once('exit', code => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`));
+    });
+  });
+}
+
+export function registerPluginUpdater(ctx, options) {
+  let installing = false;
+  return ctx.webServer.register({
+    kind: 'exact',
+    path: options.endpoint || '/api/dsh-cron/update',
+    handler: async (req, res) => {
+      try {
+        const target = runtime();
+        if (req.method === 'GET' || req.method === 'HEAD') {
+          const payload = await getUpdateStatus(options, target);
+          res.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          });
+          res.end(req.method === 'HEAD' ? undefined : JSON.stringify(payload));
+          return;
+        }
+        if (req.method !== 'POST') {
+          res.writeHead(405, { allow: 'GET, HEAD, POST' });
+          res.end();
+          return;
+        }
+        if (rejectCrossOrigin(req, res)) {
+          return;
+        }
+        if (installing) {
+          res.writeHead(409, { 'content-type': 'application/json; charset=utf-8' });
+          res.end(JSON.stringify({ ok: false, error: 'This plugin is already updating.' }));
+          return;
+        }
+        installing = true;
+        try {
+          const before = await getUpdateStatus(options, target);
+          if (before.latestVersion === undefined) {
+            res.writeHead(503, { 'content-type': 'application/json; charset=utf-8' });
+            res.end(JSON.stringify({ ok: false, error: 'The latest version is temporarily unavailable.' }));
+            return;
+          }
+          if (!before.updateAvailable) {
+            res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' });
+            res.end(JSON.stringify({ ...before, updated: false, message: 'Already up to date.' }));
+            return;
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options);
+          res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' });
+          res.end(JSON.stringify({
+            ...before,
+            updated: true,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          }));
+        } finally {
+          installing = false;
+        }
+      } catch (error) {
+        (ctx.logger || console).warn?.(`[dsh-cron] plugin updater failed: ${String(error)}`);
+        res.writeHead(503, { 'content-type': 'application/json; charset=utf-8' });
+        res.end(JSON.stringify({ ok: false, error: 'Plugin update failed; see server logs.' }));
+      }
+    },
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cron",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "description": "Scheduled cron tasks, background automation and agent execution for DeepSeek Harness.",
   "type": "module",
   "main": "lib/index.js",