@goodandready/dsh-model-sync 0.3.14 → 0.4.0

package/README.md

@@ -117,6 +117,14 @@ dsh plugin --profile web add @goodandready/dsh-model-sync
 
 ---
 
+## 🚀 Enhancements in v0.4.0
+
+- **One-Click In-App Updater**: Check npm registry for updates and trigger one-click upgrades directly within the DSH Settings Card, complete with version diff badges and server restart alerts.
+- **Strict Loopback Security**: All mutating HTTP endpoints (`/apply`, `/policy`, `/clear-cache`, `/updater/update`) now require verified loopback origin and remote socket IP to prevent CSRF / unauthorized network access.
+- **100% Theme Token Compliance**: Eliminated all hardcoded colors and `rgba()` values in client UI in favor of official DSH theme tokens (`--dsw-alias-*`), ensuring perfect dark/light mode rendering.
+- **Modular Architecture**: Decomposed core synchronization logic into specialized modules (`synchronizer-helpers.js`, `synchronizer-transfer.js`, `synchronizer-prober.js`), significantly enhancing code readability and maintainability.
+- **Clean Packaging**: Excluded development and internal planning artifacts from git and npm distribution, maintaining an ultra-lightweight release bundle (< 70 KiB).
+
 ## 🚀 Enhancements in v0.3.14
 
 - **Language Standard**: Canonical plugin in `en` and `zh`. Runtime Russian translations decoupled into `goodandready/dsh-russian-lang` (#191).

package/README.ru.md

@@ -94,6 +94,14 @@ dsh plugin --profile web add @goodandready/dsh-model-sync
 
 ---
 
+## 🚀 Улучшения в версии 0.4.0
+
+- **One-Click обновление плагина из настроек**: В карточку настроек плагина добавлен блок обновления с проверкой актуальной версии в npm, цветовым бейджем статуса и кнопкой обновления в один клик.
+- **Защита write-эндпоинтов по Loopback**: Все мутирующие HTTP-маршруты (`/apply`, `/policy`, `/clear-cache`, `/updater/update`) строго проверяют адрес источника (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) и заголовок Origin/Host для предотвращения несанкционированного доступа.
+- **Полная поддержка темы DSH (0 rgba / 0 hex)**: Все стили интерфейса переведены на официальные токены дизайн-системы DSH (`--dsw-alias-*`), обеспечивая нативную интеграцию со светлой и тёмной темами оформления.
+- **Модульная архитектура синхронизатора**: Монолитная логика синхронизации разделена на специализированные модули (`synchronizer-helpers.js`, `synchronizer-transfer.js`, `synchronizer-prober.js`), что упрощает поддержку и снижает размер основного файла ниже 600 строк.
+- **Чистый дистрибутив пакета**: Исключены внутренние файлы планирования и отладки; размер сжатого npm-пакета составляет менее 70 KiB, все файлы укладываются в лимит 256 KiB.
+
 ## 🚀 Улучшения в v0.3.13
 
 * ⚡ **ETag / 304 Not Modified для фонового опроса UI**:

package/README.zh.md

@@ -95,6 +95,14 @@ dsh plugin --profile web add @goodandready/dsh-model-sync
 
 ---
 
+## 🚀 v0.4.0 新特性与增强
+
+- **设置卡片一键更新**: 在 DSH 设置卡片中集成自动版本检查，展示当前与最新版本对比徽标，支持一键安全升级并在更新后提示重启。
+- **严格本地环回 (Loopback) 安全保护**: 所有修改状态的 HTTP 路由 (`/apply`, `/policy`, `/clear-cache`, `/updater/update`) 均强制校验本地环回 IP (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) 及请求来源，杜绝外部恶意调用。
+- **100% 原生主题变量适配**: 客户端 UI 全面移除硬编码颜色与 `rgba()` 样式，完全切换至 DSH 官方 CSS 设计令牌 (`--dsw-alias-*`)，无缝适配深色与浅色主题。
+- **同步引擎模块化拆分**: 核心同步逻辑已解耦拆分为专项子模块 (`synchronizer-helpers.js`, `synchronizer-transfer.js`, `synchronizer-prober.js`)，大幅提升代码可读性与维护性。
+- **轻量分发包清理**: 彻底排除内部计划与调试文件，精简 npm 发布体积至 70 KiB 以下，所有文件均完全符合 256 KiB 上限规范。
+
 ## 🚀 v0.3.14 新特性与增强
 
 - **语言标准**: 插件原生支持 `en` 与 `zh` 双语，俄语本地化已独立解耦至 `goodandready/dsh-russian-lang` 翻译包 (#191)。

package/lib/client.js

@@ -8,7 +8,7 @@ window.__ModuleLoader__.load({
     const CSS = '.dms-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;list-style:none;margin:0;padding:0;overflow:hidden;box-sizing:border-box}' +
       '.dms-card-open{background:var(--dsw-alias-bg-layer-3);border-color:var(--dsw-alias-border-l2)}' +
       '.dms-card-header{appearance:none;width:100%;font:inherit;color:inherit;text-align:left;cursor:pointer;background:0 0;border:0;border-radius:12px;display:flex;align-items:center;gap:12px;padding:14px 16px}' +
-      '.dms-card-header:hover{background:var(--dsw-alias-interactive-bg-hover,rgba(255,255,255,.05))}' +
+      '.dms-card-header:hover{background:var(--dsw-alias-interactive-bg-hover,var(--dsw-alias-bg-layer-2))}' +
       '.dms-card-header:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary);outline-offset:-2px}' +
       '.dms-card-head-text{display:flex;flex-direction:column;gap:2px;flex:1;min-width:0}' +
       '.dms-card-name{color:var(--dsw-alias-label-primary);font-size:15px;font-weight:600;line-height:1.4}' +
@@ -17,16 +17,16 @@ window.__ModuleLoader__.load({
       '.dms-card-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding-bottom:8px;display:flex;flex-direction:column;gap:10px;box-sizing:border-box}' +
       '.dms-wrap{display:flex;flex-direction:column;gap:14px;max-width:760px;box-sizing:border-box;color:var(--dsw-alias-label-primary,inherit)}' +
       '.dms-wrap>p{margin:0;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.55}' +
-      '.dms-toolbar,.dms-section{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary,rgba(255,255,255,.14)));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
+      '.dms-toolbar,.dms-section{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
       '.dms-toolbar>select{flex:1 1 190px;min-width:190px}' +
       '.dms-toolbar>.dms-actions{flex-basis:100%}' +
       '.dms-toolbar>label{display:inline-flex;align-items:flex-start;gap:7px;font-size:12px;line-height:1.35;color:var(--dsw-alias-label-secondary)}' +
       '.dms-toolbar>select,.dms-editor input,.dms-editor textarea,.dms-input{box-sizing:border-box;min-width:0;background:var(--dsw-specific-input-major,var(--dsw-alias-bg-layer-2,transparent));border:1px solid var(--dsw-alias-border-l1,var(--dsw-alias-border-l2));border-radius:6px;color:var(--dsw-alias-label-primary);font:inherit;padding:7px 9px}' +
       '.dms-toolbar>label input{accent-color:var(--dsw-alias-brand-primary,var(--dsw-alias-button-info-fill))}' +
       '.dms-actions{display:flex;align-items:center;flex-wrap:wrap;gap:7px}' +
-      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary,rgba(255,255,255,.14)));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
+      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
       '.dms-btn{margin:0!important;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:1.35;padding:6px 10px;cursor:pointer;white-space:normal}' +
-      '.dms-btn:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary);background:var(--dsw-alias-bg-layer-2,rgba(255,255,255,.05))}' +
+      '.dms-btn:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary);background:var(--dsw-alias-bg-layer-2)}' +
       '.dms-btn:disabled{opacity:.45;cursor:default}' +
       '.dms-section>strong{display:block;font-size:13px;font-weight:650}' +
       '.dms-provider-wrap{margin:0 0 7px}' +
@@ -44,18 +44,18 @@ window.__ModuleLoader__.load({
       '.dms-row{display:flex;flex-wrap:wrap;gap:8px;align-items:center}' +
       '.dms-grid-2{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:12px}' +
       '.dms-badge{font-size:11px;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:4px;font-weight:500}' +
-      '.dms-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:rgba(16,185,129,0.08)}' +
-      '.dms-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:rgba(245,158,11,0.08)}' +
-      '.dms-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:rgba(239,68,68,0.08)}' +
+      '.dms-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:var(--dsw-alias-state-success-secondary,var(--dsw-alias-bg-layer-2))}' +
+      '.dms-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:var(--dsw-alias-state-warning-secondary,var(--dsw-alias-bg-layer-2))}' +
+      '.dms-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:var(--dsw-alias-state-error-secondary,var(--dsw-alias-bg-layer-2))}' +
       '.dms-input{height:34px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:6px;padding:0 10px;font-size:13px;box-sizing:border-box}' +
       '.dms-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}' +
       '.dms-btn-primary{background:var(--dsw-alias-label-primary)!important;color:var(--dsw-alias-bg-layer-3)!important;border-color:transparent!important;font-weight:600}' +
       '.dms-btn-primary:hover:not(:disabled){opacity:0.88}' +
-      '.dms-btn-danger{color:var(--dsw-alias-state-error-primary)!important;border-color:rgba(239,68,68,0.3)!important}' +
-      '.dms-btn-danger:hover:not(:disabled){background:rgba(239,68,68,0.12)!important;border-color:rgba(239,68,68,0.5)!important}' +
+      '.dms-btn-danger{color:var(--dsw-alias-state-error-primary)!important;border-color:var(--dsw-alias-state-error-primary)!important}' +
+      '.dms-btn-danger:hover:not(:disabled){background:var(--dsw-alias-state-error-secondary,var(--dsw-alias-bg-layer-2))!important;border-color:var(--dsw-alias-state-error-primary)!important}' +
       '.dms-alert{padding:10px 14px;border-radius:8px;font-size:13px}' +
-      '.dms-alert-ok{background:rgba(16,185,129,0.1);color:var(--dsw-alias-state-success-primary)}' +
-      '.dms-alert-bad{background:rgba(239,68,68,0.1);color:var(--dsw-alias-state-error-primary)}' +
+      '.dms-alert-ok{background:var(--dsw-alias-state-success-secondary,var(--dsw-alias-bg-layer-2));color:var(--dsw-alias-state-success-primary)}' +
+      '.dms-alert-bad{background:var(--dsw-alias-state-error-secondary,var(--dsw-alias-bg-layer-2));color:var(--dsw-alias-state-error-primary)}' +
       '.dms-probe-result{padding:2px 6px;border-radius:4px;font-family:monospace;font-size:11px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:4px}' +
       '@media (max-width:540px){.dms-provider{grid-template-columns:1fr!important}.dms-provider .dms-btn{justify-self:start}.dms-toolbar>div:first-child{align-items:stretch;flex-direction:column}.dms-toolbar>div:first-child select{width:100%}.dms-toolbar,.dms-section,.dms-section-card,.dms-editor{padding:11px 12px}}'
 
@@ -227,6 +227,17 @@ window.__ModuleLoader__.load({
       addAlias: 'Save alias',
       removeAlias: 'Delete alias',
       noAliases: 'No model aliases defined.',
+      updaterTitle: 'Plugin Updates',
+      checkForUpdates: 'Check for updates',
+      checkingUpdates: 'Checking…',
+      updateAvailable: 'Update available: ',
+      upToDate: 'Up to date',
+      updateNow: 'Update now',
+      updating: 'Updating…',
+      updateSuccess: 'Updated to ',
+      restartRequired: ' (restart required)',
+      updateFailed: 'Update failed: ',
+      checkUpdateFailed: 'Failed to check for updates',
       targetProvider: 'Provider',
     }
 
@@ -347,6 +358,17 @@ window.__ModuleLoader__.load({
       addAlias: '保存别名',
       removeAlias: '删除别名',
       noAliases: '未定义任何模型别名。',
+      updaterTitle: '插件更新',
+      checkForUpdates: '检查更新',
+      checkingUpdates: '正在检查…',
+      updateAvailable: '发现新版本: ',
+      upToDate: '已是最新版本',
+      updateNow: '立即更新',
+      updating: '正在更新…',
+      updateSuccess: '已成功更新至 ',
+      restartRequired: ' (需重启 DSH)',
+      updateFailed: '更新失败: ',
+      checkUpdateFailed: '检查更新失败',
       targetProvider: '服务商',
     }
 
@@ -372,6 +394,84 @@ window.__ModuleLoader__.load({
       )
     }
 
+
+    function UpdaterSection({ t, api }) {
+      const [updaterStatus, setUpdaterStatus] = React.useState(null)
+      const [updaterChecking, setUpdaterChecking] = React.useState(false)
+      const [updaterUpdating, setUpdaterUpdating] = React.useState(false)
+      const [updaterNotice, setUpdaterNotice] = React.useState('')
+      const [updaterError, setUpdaterError] = React.useState('')
+
+      const checkUpdates = () => {
+        setUpdaterChecking(true)
+        setUpdaterError('')
+        setUpdaterNotice('')
+        fetch(`${api}/update`)
+          .then((res) => {
+            if (!res.ok) throw new Error(`HTTP ${res.status}`)
+            return res.json()
+          })
+          .then((data) => {
+            setUpdaterStatus(data)
+            setUpdaterChecking(false)
+          })
+          .catch(() => {
+            setUpdaterChecking(false)
+            setUpdaterError(t.checkUpdateFailed)
+          })
+      }
+
+      const runUpdate = () => {
+        if (updaterUpdating) return
+        setUpdaterUpdating(true)
+        setUpdaterError('')
+        setUpdaterNotice('')
+        fetch(`${api}/update`, {
+          method: 'POST',
+          headers: { 'x-dsh-plugin-update': '1', 'content-type': 'application/json' },
+        })
+          .then((res) => res.json())
+          .then((resData) => {
+            if (resData.error) throw new Error(resData.error.message || resData.error)
+            const cur = resData.updatedVersion || (updaterStatus && updaterStatus.latestVersion) || ''
+            const nextData = Object.assign({}, updaterStatus, { currentVersion: cur, updateAvailable: false })
+            setUpdaterUpdating(false)
+            setUpdaterStatus(nextData)
+            setUpdaterNotice(t.updateSuccess + cur + (resData.restartRequired ? t.restartRequired : ''))
+          })
+          .catch((err) => {
+            setUpdaterUpdating(false)
+            setUpdaterError(t.updateFailed + (err.message || String(err)))
+          })
+      }
+
+      return React.createElement('div', { style: { marginTop: 8 } },
+        React.createElement('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between' } },
+          React.createElement('div', { style: { fontSize: 13, color: 'var(--dsw-alias-label-primary)' } },
+            updaterStatus ? `v${updaterStatus.currentVersion}` : '',
+            updaterStatus && updaterStatus.updateAvailable ? ` → v${updaterStatus.latestVersion}` : ''
+          ),
+          React.createElement('div', null,
+            updaterStatus && updaterStatus.updateAvailable
+              ? React.createElement('button', {
+                  type: 'button',
+                  className: 'dms-btn dms-btn-primary',
+                  disabled: updaterUpdating,
+                  onClick: runUpdate,
+                }, updaterUpdating ? t.updating : t.updateNow)
+              : React.createElement('button', {
+                  type: 'button',
+                  className: 'dms-btn',
+                  disabled: updaterChecking,
+                  onClick: checkUpdates,
+                }, updaterChecking ? t.checkingUpdates : (updaterStatus ? t.upToDate : t.checkForUpdates))
+          )
+        ),
+        updaterNotice ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-success)', marginTop: 8, fontSize: 12 } }, updaterNotice) : null,
+        updaterError ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-error-primary)', marginTop: 8, fontSize: 12 } }, updaterError) : null
+      )
+    }
+
     function ModelSyncSection({ ctx, includeIntro = true }) {
       const locale = useLocale(ctx)
       const t = locale === 'zh' ? zh : en
@@ -1119,6 +1219,10 @@ window.__ModuleLoader__.load({
         React.createElement('div', { className: 'dms-section-card dms-section' },
           React.createElement('div', { className: 'dms-section-title' }, React.createElement('strong', null, t.history)),
           renderHistory()
+        ),
+        React.createElement('div', { className: 'dms-section-card dms-section' },
+          React.createElement('div', { className: 'dms-section-title' }, React.createElement('strong', null, t.updaterTitle)),
+          React.createElement(UpdaterSection, { t, api: API })
         )
       )
     }
@@ -1157,12 +1261,16 @@ window.__ModuleLoader__.load({
 
     function apply(ctx) {
       ctx.effect(() => {
-        try { ctx.locale?.register?.(NS, { en, zh }) } catch {}
+        try { ctx.locale?.register?.(NS, { en, zh }) } catch (err) {
+          try { console.debug('[dsh-model-sync] locale register best-effort:', err) } catch { /* console unavailable */ }
+        }
         return () => {}
       }, 'dsh-model-sync: dictionaries')
       try {
         ctx.slots.inject('settings.plugin.item', () => ctx.slots.register({ name: 'settings.plugin.item', key: NS, locale: NS, inject: () => ({ ctx }) }, (props) => React.createElement(ErrorBoundary, null, React.createElement(ModelSyncCard, { ...props, ctx }))))
-      } catch {}
+      } catch (err) {
+        try { console.debug('[dsh-model-sync] slots inject best-effort:', err) } catch { /* console unavailable */ }
+      }
     }
 
     module.exports = { apply, inject: ['slots', 'locale', 'settingsScope'], filterModelsByCapabilities }

package/lib/http.js

@@ -8,24 +8,50 @@ function json(res, status, body) {
   res.end(JSON.stringify(body))
 }
 
-function trusted(req) {
+export function isLoopbackAddress(ip) {
+  if (!ip || typeof ip !== 'string') return false
+  const clean = ip.toLowerCase().replace(/^\[|\]$/g, '')
+  if (clean === '127.0.0.1' || clean === '::1' || clean === '::ffff:127.0.0.1' || clean === 'localhost') return true
+  if (clean.startsWith('127.') || clean.startsWith('::ffff:127.')) return true
+  return false
+}
+
+export function trusted(req, { requireLoopback = false } = {}) {
+  const remoteAddress = req?.socket?.remoteAddress
+  if (requireLoopback || req?.method === 'POST') {
+    if (!isLoopbackAddress(remoteAddress)) return false
+  }
   const fetchSite = req.headers?.['sec-fetch-site']
   if (fetchSite === 'cross-site') return false
   const host = req.headers?.host
   const origin = req.headers?.origin
   if (origin) {
     if (!host) return false
-    try { return new URL(origin).host === host } catch { return false }
+    try {
+      const url = new URL(origin)
+      if (url.host !== host) return false
+      if (requireLoopback || req?.method === 'POST') {
+        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+      }
+    } catch { return false }
   }
   const referer = req.headers?.referer
   if (referer) {
     if (!host) return false
-    try { return new URL(referer).host === host } catch { return false }
+    try {
+      const url = new URL(referer)
+      if (url.host !== host) return false
+      if (requireLoopback || req?.method === 'POST') {
+        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+      }
+    } catch { return false }
   }
   // If sec-fetch-site is same-origin or same-site, allow
   if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
   // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
   if (req.headers?.['sec-fetch-mode'] && !host) return false
+  // For POST write requests without any browser origin/referer headers, require explicit loopback remoteAddress
+  if (req?.method === 'POST' && !origin && !referer && !isLoopbackAddress(remoteAddress)) return false
   return true
 }
 
@@ -188,7 +214,7 @@ export function normalizeSelectionRequest(body) {
 
 export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () => null } = {}) {
   const makeHandler = (route) => async (req, res) => {
-    if (!trusted(req)) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin request rejected' } })
+    if (!trusted(req, { requireLoopback: req.method === 'POST' })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
     if (route === 'status') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       const payload = { ...synchronizer.status(), scheduler: getSchedulerStatus(), providers: synchronizer.listProviders() }

package/lib/index.js

@@ -3,6 +3,7 @@ import { createProviderService } from './provider-service.js'
 import { createModelSynchronizer } from './synchronizer.js'
 import { createSyncScheduler } from './scheduler.js'
 import { registerHttpApi } from './http.js'
+import { registerPluginUpdater } from './updater.js'
 
 export const name = '@goodandready/dsh-model-sync'
 export const inject = ['llm', 'settings', 'webServer', 'credentials']
@@ -143,7 +144,9 @@ export function apply(ctx, config) {
   }
 
   let settings
-  try { settings = ctx.get('settings') } catch {}
+  try { settings = ctx.get('settings') } catch (e) {
+    if (typeof ctx.logger?.debug === 'function') ctx.logger.debug('[dsh-model-sync] settings service not immediately available:', e)
+  }
   if (!bindSettings(settings, ctx)) {
     ctx.inject(['settings'], (sctx) => {
       bindSettings((typeof sctx.get === 'function' ? sctx.get('settings') : null) ?? sctx.settings, sctx)
@@ -163,6 +166,11 @@ export function apply(ctx, config) {
       for (const dispose of registrations) if (typeof dispose === 'function') dispose()
     }
   }, 'dsh-model-sync: http api')
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    packageName: name,
+    endpoint: '/api/dsh-model-sync/update',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  }), 'dsh-model-sync: plugin updater')
   ctx.effect(() => {
     if (!liveConfig.enabled) return () => {}
     ctx.provide('modelSync', service)

package/lib/synchronizer-helpers.js

@@ -0,0 +1,113 @@
+import { statusOfError } from './reliability.js'
+
+export const PIAI_NS = 'llm-pi-ai'
+export const DEFAULT_RELIABILITY = Object.freeze({
+  timeoutMs: 15000,
+  retryAttempts: 3,
+  retryBaseDelayMs: 250,
+  retryMaxDelayMs: 4000,
+  concurrency: 4,
+  circuitBreakerFailures: 3,
+  circuitBreakerCooldownMs: 300000,
+})
+
+export function boundedInteger(value, fallback, minimum, maximum) {
+  const number = Number(value)
+  if (!Number.isFinite(number)) return fallback
+  return Math.min(maximum, Math.max(minimum, Math.floor(number)))
+}
+
+export function reliabilityOptions(config, options) {
+  const source = { ...config, ...options }
+  const baseDelay = boundedInteger(source.retryBaseDelayMs, DEFAULT_RELIABILITY.retryBaseDelayMs, 0, 60000)
+  const cooldownMs = source.circuitBreakerCooldownMs !== undefined
+    ? boundedInteger(source.circuitBreakerCooldownMs, DEFAULT_RELIABILITY.circuitBreakerCooldownMs, 0, 3600000)
+    : boundedInteger(Number(source.circuitBreakerCooldownMinutes) * 60000, DEFAULT_RELIABILITY.circuitBreakerCooldownMs, 0, 3600000)
+  return {
+    timeoutMs: boundedInteger(source.requestTimeoutMs, DEFAULT_RELIABILITY.timeoutMs, 100, 120000),
+    retryAttempts: boundedInteger(source.retryAttempts, DEFAULT_RELIABILITY.retryAttempts, 1, 6),
+    retryBaseDelayMs: baseDelay,
+    retryMaxDelayMs: Math.max(baseDelay, boundedInteger(source.retryMaxDelayMs, DEFAULT_RELIABILITY.retryMaxDelayMs, 0, 120000)),
+    concurrency: boundedInteger(source.concurrency, DEFAULT_RELIABILITY.concurrency, 1, 32),
+    circuitBreakerFailures: boundedInteger(source.circuitBreakerFailures, DEFAULT_RELIABILITY.circuitBreakerFailures, 0, 20),
+    circuitBreakerCooldownMs: cooldownMs,
+  }
+}
+
+export function settingsOf(ctx) {
+  try { return (typeof ctx.get === 'function' ? (ctx.get('settings') ?? ctx.settings) : ctx.settings) } catch { return ctx.settings }
+}
+
+export function llmOf(ctx) {
+  try {
+    const llm = typeof ctx.get === 'function' ? ctx.get('llm') : null
+    return (llm && typeof llm === 'object' && (llm.listConfigurableProviders || llm.listProviders)) ? llm : ctx.llm
+  } catch {
+    return ctx.llm
+  }
+}
+
+export function descriptorOf(settings, ns) {
+  try { return settings?.describe?.({ redactSecrets: true })?.find((row) => row.ns === ns) }
+  catch { return undefined }
+}
+
+export function profileOf(settings, provider) {
+  try { return settings?.get(PIAI_NS)?.providers?.[provider] ?? {} }
+  catch { return {} }
+}
+
+export function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error)
+}
+
+export function diagnosticMessage(error) {
+  return errorMessage(error).replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
+}
+
+export function adapterErrorType(error) {
+  if (error?.adapterCode === 'auth') return 'auth'
+  if (error?.adapterCode === 'rate-limit') return 'rate-limit'
+  if (error?.adapterCode === 'schema') return 'schema'
+  if (error?.adapterCode === 'endpoint') return 'endpoint'
+  if (error?.code === 'CREDENTIALS_UNAVAILABLE' || error?.code === 'AUTH') return 'credential'
+  const status = statusOfError(error)
+  if (status === 401 || status === 403) return 'auth'
+  if (status === 429) return 'rate-limit'
+  if (status) return 'http'
+  return 'endpoint'
+}
+
+export async function replaceWithRetry(settings, ns, patchFn, attempts = 3) {
+  let lastError
+  for (let i = 0; i < attempts; i++) {
+    const section = settings?.get?.(ns)
+    const descriptor = descriptorOf(settings, ns)
+    if (!section || !descriptor || typeof settings.replace !== 'function') {
+      throw Object.assign(new Error(`${ns} settings are not writable`), { code: 'SETTINGS_UNAVAILABLE' })
+    }
+    const next = patchFn(structuredClone(section))
+    try {
+      await settings.replace(ns, next, descriptor.revision)
+      return next
+    } catch (err) {
+      lastError = err
+      const isConflict = err?.code === 'SETTINGS_CONFLICT' || err?.status === 409 || /conflict|revision/i.test(err?.message || '')
+      if (isConflict && i < attempts - 1) {
+        continue
+      }
+      throw err
+    }
+  }
+  throw lastError
+}
+
+export function rotationRefs(settings, provider) {
+  try {
+    const rows = settings?.get?.('dsh-key-rotation')?.providers
+    if (!Array.isArray(rows)) return []
+    return rows.filter((row) => row?.provider === provider).flatMap((row) => Array.isArray(row.keys) ? row.keys : [])
+  } catch {
+    return []
+  }
+}

package/lib/synchronizer-prober.js

@@ -0,0 +1,50 @@
+export function createModelProber({ health }) {
+  async function tryModel({ provider, model } = {}) {
+    if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
+    if (typeof model !== 'string' || !model) throw new Error('model is required')
+    const start = Date.now()
+    const result = await health({ provider })
+    const entry = result?.results?.find((r) => r.provider === provider)
+    return {
+      provider,
+      model,
+      ok: entry?.status === 'ok',
+      latencyMs: Date.now() - start,
+      status: entry?.status ?? 'unknown',
+      ...(entry?.status !== 'ok' ? { error: entry?.message || entry?.status || 'probe failed' } : {}),
+    }
+  }
+
+  async function batchTryModels({ provider, models } = {}) {
+    if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
+    if (!Array.isArray(models)) throw new Error('models must be an array')
+    const list = [...new Set(models.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()))].slice(0, 50)
+    const results = []
+    const concurrency = 3
+    for (let i = 0; i < list.length; i += concurrency) {
+      const chunk = list.slice(i, i + concurrency)
+      const chunkResults = await Promise.all(
+        chunk.map((model) => tryModel({ provider, model }).catch((err) => ({
+          provider,
+          model,
+          ok: false,
+          latencyMs: 0,
+          status: 'error',
+          error: err instanceof Error ? err.message : String(err)
+        })))
+      )
+      results.push(...chunkResults)
+    }
+    const reachable = results.filter((r) => r.ok).length
+    return {
+      provider,
+      results,
+      summary: { total: results.length, reachable, unreachable: results.length - reachable }
+    }
+  }
+
+  return {
+    tryModel,
+    batchTryModels,
+  }
+}

package/lib/synchronizer-transfer.js

@@ -0,0 +1,118 @@
+export function createConfigTransfer({ getConfig = () => ({}), saveConfig = async () => {}, listProviders = () => [], validatePolicy } = {}) {
+  function exportConfig() {
+    const config = getConfig() ?? {}
+    const pmap = {}
+    for (const p of listProviders()) {
+      if (p.configured) {
+        pmap[p.provider] = {
+          policy: config.modelPolicies?.[p.provider] ?? {},
+          selectedModels: config.modelSelections?.[p.provider] ?? []
+        }
+      }
+    }
+    return {
+      version: '1.0',
+      exportedAt: new Date().toISOString(),
+      plugin: '@goodandready/dsh-model-sync',
+      providers: pmap,
+      aliases: config.aliases ?? {},
+      scheduler: {
+        scheduleEnabled: config.scheduleEnabled ?? false,
+        intervalMinutes: config.intervalMinutes ?? 60,
+        autoApply: config.autoApply ?? false
+      }
+    }
+  }
+
+  async function importConfig(data) {
+    if (!data || typeof data !== 'object' || Array.isArray(data)) {
+      throw Object.assign(new Error('invalid config payload'), { code: 'INVALID_CONFIG' })
+    }
+    if (typeof saveConfig !== 'function') throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
+    const config = getConfig() ?? {}
+    const importedProviders = []
+    const importedAliases = []
+    const patch = {}
+
+    if (data.providers && typeof data.providers === 'object') {
+      const currentPolicies = structuredClone(config.modelPolicies ?? {})
+      const currentSelections = structuredClone(config.modelSelections ?? {})
+      for (const [pname, pdata] of Object.entries(data.providers)) {
+        if (pdata && typeof pdata === 'object') {
+          if (pdata.policy) {
+            currentPolicies[pname] = typeof validatePolicy === 'function' ? validatePolicy(pdata.policy) : pdata.policy
+            importedProviders.push(pname)
+          }
+          if (Array.isArray(pdata.selectedModels)) {
+            currentSelections[pname] = pdata.selectedModels.filter((m) => typeof m === 'string')
+            importedProviders.push(pname)
+          }
+        }
+      }
+      patch.modelPolicies = currentPolicies
+      patch.modelSelections = currentSelections
+    }
+
+    if (data.aliases && typeof data.aliases === 'object') {
+      const currentAliases = structuredClone(config.aliases ?? {})
+      for (const [k, v] of Object.entries(data.aliases)) {
+        if (typeof k === 'string' && /^[a-zA-Z0-9_\-.]{1,64}$/.test(k.trim()) && v && typeof v === 'object' && typeof v.provider === 'string' && typeof v.model === 'string') {
+          currentAliases[k.trim()] = { provider: v.provider, model: v.model, updatedAt: Date.now() }
+          importedAliases.push(k.trim())
+        }
+      }
+      patch.aliases = currentAliases
+    }
+
+    if (data.scheduler && typeof data.scheduler === 'object') {
+      if (typeof data.scheduler.scheduleEnabled === 'boolean') patch.scheduleEnabled = data.scheduler.scheduleEnabled
+      if (typeof data.scheduler.intervalMinutes === 'number') patch.intervalMinutes = data.scheduler.intervalMinutes
+      if (typeof data.scheduler.autoApply === 'boolean') patch.autoApply = data.scheduler.autoApply
+    }
+
+    await saveConfig(patch)
+    return {
+      success: true,
+      importedProviders: [...new Set(importedProviders)],
+      importedAliases: [...new Set(importedAliases)]
+    }
+  }
+
+  function getAliases() {
+    const config = getConfig() ?? {}
+    return config.aliases ?? {}
+  }
+
+  async function setAlias({ alias, provider, model } = {}) {
+    if (typeof alias !== 'string' || !/^[a-zA-Z0-9_\-.]{1,64}$/.test(alias.trim())) {
+      throw Object.assign(new Error('alias must be 1-64 alphanumeric characters or _-.'), { code: 'INVALID_ALIAS' })
+    }
+    const trimmedAlias = alias.trim()
+    if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
+    if (typeof model !== 'string' || !model) throw new Error('model is required')
+    if (typeof saveConfig !== 'function') throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
+    const config = getConfig() ?? {}
+    const currentAliases = structuredClone(config.aliases ?? {})
+    currentAliases[trimmedAlias] = { provider, model, updatedAt: Date.now() }
+    await saveConfig({ aliases: currentAliases })
+    return { alias: trimmedAlias, provider, model, aliases: currentAliases }
+  }
+
+  async function deleteAlias({ alias } = {}) {
+    if (typeof alias !== 'string' || !alias) throw new Error('alias is required')
+    if (typeof saveConfig !== 'function') throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
+    const config = getConfig() ?? {}
+    const currentAliases = structuredClone(config.aliases ?? {})
+    delete currentAliases[alias.trim()]
+    await saveConfig({ aliases: currentAliases })
+    return { alias: alias.trim(), deleted: true, aliases: currentAliases }
+  }
+
+  return {
+    exportConfig,
+    importConfig,
+    getAliases,
+    setAlias,
+    deleteAlias,
+  }
+}

package/lib/synchronizer.js

@@ -9,117 +9,23 @@ import { appendHistory, createHistoryEntry, historyEntry, listHistory } from './
 import { lifecycleOptions, lifecycleStatus, selectableModels, updateLifecycle } from './lifecycle.js'
 import { appendNotification, listNotifications, createSyncReport, updateNotification } from './reporting.js'
 
-const PIAI_NS = 'llm-pi-ai'
-const DEFAULT_RELIABILITY = Object.freeze({
-  timeoutMs: 15000,
-  retryAttempts: 3,
-  retryBaseDelayMs: 250,
-  retryMaxDelayMs: 4000,
-  concurrency: 4,
-  circuitBreakerFailures: 3,
-  circuitBreakerCooldownMs: 300000,
-})
-
-function boundedInteger(value, fallback, minimum, maximum) {
-  const number = Number(value)
-  if (!Number.isFinite(number)) return fallback
-  return Math.min(maximum, Math.max(minimum, Math.floor(number)))
-}
-
-function reliabilityOptions(config, options) {
-  const source = { ...config, ...options }
-  const baseDelay = boundedInteger(source.retryBaseDelayMs, DEFAULT_RELIABILITY.retryBaseDelayMs, 0, 60000)
-  const cooldownMs = source.circuitBreakerCooldownMs !== undefined
-    ? boundedInteger(source.circuitBreakerCooldownMs, DEFAULT_RELIABILITY.circuitBreakerCooldownMs, 0, 3600000)
-    : boundedInteger(Number(source.circuitBreakerCooldownMinutes) * 60000, DEFAULT_RELIABILITY.circuitBreakerCooldownMs, 0, 3600000)
-  return {
-    timeoutMs: boundedInteger(source.requestTimeoutMs, DEFAULT_RELIABILITY.timeoutMs, 100, 120000),
-    retryAttempts: boundedInteger(source.retryAttempts, DEFAULT_RELIABILITY.retryAttempts, 1, 6),
-    retryBaseDelayMs: baseDelay,
-    retryMaxDelayMs: Math.max(baseDelay, boundedInteger(source.retryMaxDelayMs, DEFAULT_RELIABILITY.retryMaxDelayMs, 0, 120000)),
-    concurrency: boundedInteger(source.concurrency, DEFAULT_RELIABILITY.concurrency, 1, 32),
-    circuitBreakerFailures: boundedInteger(source.circuitBreakerFailures, DEFAULT_RELIABILITY.circuitBreakerFailures, 0, 20),
-    circuitBreakerCooldownMs: cooldownMs,
-  }
-}
-
-function settingsOf(ctx) {
-  try { return (typeof ctx.get === 'function' ? (ctx.get('settings') ?? ctx.settings) : ctx.settings) } catch { return ctx.settings }
-}
-
-function llmOf(ctx) {
-  try {
-    const llm = typeof ctx.get === 'function' ? ctx.get('llm') : null
-    return (llm && typeof llm === 'object' && (llm.listConfigurableProviders || llm.listProviders)) ? llm : ctx.llm
-  } catch {
-    return ctx.llm
-  }
-}
-
-function descriptorOf(settings, ns) {
-  try { return settings?.describe?.({ redactSecrets: true })?.find((row) => row.ns === ns) }
-  catch { return undefined }
-}
-
-function profileOf(settings, provider) {
-  try { return settings?.get(PIAI_NS)?.providers?.[provider] ?? {} }
-  catch { return {} }
-}
-
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error)
-}
-
-function diagnosticMessage(error) {
-  return errorMessage(error).replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
-}
-
-function adapterErrorType(error) {
-  if (error?.adapterCode === 'auth') return 'auth'
-  if (error?.adapterCode === 'rate-limit') return 'rate-limit'
-  if (error?.adapterCode === 'schema') return 'schema'
-  if (error?.adapterCode === 'endpoint') return 'endpoint'
-  if (error?.code === 'CREDENTIALS_UNAVAILABLE' || error?.code === 'AUTH') return 'credential'
-  const status = statusOfError(error)
-  if (status === 401 || status === 403) return 'auth'
-  if (status === 429) return 'rate-limit'
-  if (status) return 'http'
-  return 'endpoint'
-}
-
-async function replaceWithRetry(settings, ns, patchFn, attempts = 3) {
-  let lastError
-  for (let i = 0; i < attempts; i++) {
-    const section = settings?.get?.(ns)
-    const descriptor = descriptorOf(settings, ns)
-    if (!section || !descriptor || typeof settings.replace !== 'function') {
-      throw Object.assign(new Error(`${ns} settings are not writable`), { code: 'SETTINGS_UNAVAILABLE' })
-    }
-    const next = patchFn(structuredClone(section))
-    try {
-      await settings.replace(ns, next, descriptor.revision)
-      return next
-    } catch (err) {
-      lastError = err
-      const isConflict = err?.code === 'SETTINGS_CONFLICT' || err?.status === 409 || /conflict|revision/i.test(err?.message || '')
-      if (isConflict && i < attempts - 1) {
-        continue
-      }
-      throw err
-    }
-  }
-  throw lastError
-}
-
-function rotationRefs(settings, provider) {
-  try {
-    const rows = settings?.get?.('dsh-key-rotation')?.providers
-    if (!Array.isArray(rows)) return []
-    return rows.filter((row) => row?.provider === provider).flatMap((row) => Array.isArray(row.keys) ? row.keys : [])
-  } catch {
-    return []
-  }
-}
+import {
+  PIAI_NS,
+  DEFAULT_RELIABILITY,
+  boundedInteger,
+  reliabilityOptions,
+  settingsOf,
+  llmOf,
+  descriptorOf,
+  profileOf,
+  errorMessage,
+  diagnosticMessage,
+  adapterErrorType,
+  replaceWithRetry,
+  rotationRefs,
+} from './synchronizer-helpers.js'
+import { createConfigTransfer } from './synchronizer-transfer.js'
+import { createModelProber } from './synchronizer-prober.js'
 
 export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfig = async () => {}, fetchImpl = fetch, adapterImplementations = {} } = {}) {
   const resolveCredential = createCredentialResolver(ctx)
@@ -531,50 +437,9 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     return transientNotifications.find((row) => row.id === id)
   }
 
-  async function tryModel({ provider, model } = {}) {
-    if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
-    if (typeof model !== 'string' || !model) throw new Error('model is required')
-    const start = Date.now()
-    // Use health as lightweight probe; latency is the signal
-    const result = await health({ provider })
-    const entry = result?.results?.find((r) => r.provider === provider)
-    return {
-      provider,
-      model,
-      ok: entry?.status === 'ok',
-      latencyMs: Date.now() - start,
-      status: entry?.status ?? 'unknown',
-      ...(entry?.status !== 'ok' ? { error: entry?.message || entry?.status || 'probe failed' } : {}),
-    }
-  }
-  async function batchTryModels({ provider, models } = {}) {
-    if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
-    if (!Array.isArray(models)) throw new Error('models must be an array')
-    const list = [...new Set(models.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()))].slice(0, 50)
-    const results = []
-    const concurrency = 3
-    for (let i = 0; i < list.length; i += concurrency) {
-      const chunk = list.slice(i, i + concurrency)
-      const chunkResults = await Promise.all(
-        chunk.map((model) => tryModel({ provider, model }).catch((err) => ({
-          provider,
-          model,
-          ok: false,
-          latencyMs: 0,
-          status: 'error',
-          error: err instanceof Error ? err.message : String(err)
-        })))
-      )
-      results.push(...chunkResults)
-    }
-    const reachable = results.filter((r) => r.ok).length
-    return {
-      provider,
-      results,
-      summary: { total: results.length, reachable, unreachable: results.length - reachable }
-    }
-  }
-
+  const prober = createModelProber({ health })
+  const tryModel = prober.tryModel
+  const batchTryModels = prober.batchTryModels
 
   async function rollbackHistory({ historyId, provider } = {}) {
     if (typeof historyId !== 'string' || !historyId) throw Object.assign(new Error('historyId is required'), { code: 'INVALID_HISTORY' })
@@ -660,115 +525,17 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     }
     return { provider, selectedModels, models: nextModels, availableModels: available, selectableModels: safeAvailable, applied: true }
   }
-  function exportConfig() {
-    const config = getConfig() ?? {}
-    const pmap = {}
-    for (const p of providers()) {
-      if (p.configured) {
-        pmap[p.provider] = {
-          policy: config.modelPolicies?.[p.provider] ?? {},
-          selectedModels: config.modelSelections?.[p.provider] ?? []
-        }
-      }
-    }
-    return {
-      version: '1.0',
-      exportedAt: new Date().toISOString(),
-      plugin: '@goodandready/dsh-model-sync',
-      providers: pmap,
-      aliases: config.aliases ?? {},
-      scheduler: {
-        scheduleEnabled: config.scheduleEnabled ?? false,
-        intervalMinutes: config.intervalMinutes ?? 60,
-        autoApply: config.autoApply ?? false
-      }
-    }
-  }
-
-  async function importConfig(data) {
-    if (!data || typeof data !== 'object' || Array.isArray(data)) {
-      throw Object.assign(new Error('invalid config payload'), { code: 'INVALID_CONFIG' })
-    }
-    if (typeof saveConfig !== 'function') throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
-    const config = getConfig() ?? {}
-    const importedProviders = []
-    const importedAliases = []
-    const patch = {}
-
-    if (data.providers && typeof data.providers === 'object') {
-      const currentPolicies = structuredClone(config.modelPolicies ?? {})
-      const currentSelections = structuredClone(config.modelSelections ?? {})
-      for (const [pname, pdata] of Object.entries(data.providers)) {
-        if (pdata && typeof pdata === 'object') {
-          if (pdata.policy) {
-            currentPolicies[pname] = validatePolicy(pdata.policy)
-            importedProviders.push(pname)
-          }
-          if (Array.isArray(pdata.selectedModels)) {
-            currentSelections[pname] = pdata.selectedModels.filter((m) => typeof m === 'string')
-            importedProviders.push(pname)
-          }
-        }
-      }
-      patch.modelPolicies = currentPolicies
-      patch.modelSelections = currentSelections
-    }
-
-    if (data.aliases && typeof data.aliases === 'object') {
-      const currentAliases = structuredClone(config.aliases ?? {})
-      for (const [k, v] of Object.entries(data.aliases)) {
-        if (typeof k === 'string' && /^[a-zA-Z0-9_\-.]{1,64}$/.test(k.trim()) && v && typeof v === 'object' && typeof v.provider === 'string' && typeof v.model === 'string') {
-          currentAliases[k.trim()] = { provider: v.provider, model: v.model, updatedAt: Date.now() }
-          importedAliases.push(k.trim())
-        }
-      }
-      patch.aliases = currentAliases
-    }
-
-    if (data.scheduler && typeof data.scheduler === 'object') {
-      if (typeof data.scheduler.scheduleEnabled === 'boolean') patch.scheduleEnabled = data.scheduler.scheduleEnabled
-      if (typeof data.scheduler.intervalMinutes === 'number') patch.intervalMinutes = data.scheduler.intervalMinutes
-      if (typeof data.scheduler.autoApply === 'boolean') patch.autoApply = data.scheduler.autoApply
-    }
-
-    await saveConfig(patch)
-    return {
-      success: true,
-      importedProviders: [...new Set(importedProviders)],
-      importedAliases: [...new Set(importedAliases)]
-    }
-  }
-
-  function getAliases() {
-    const config = getConfig() ?? {}
-    return config.aliases ?? {}
-  }
-
-  async function setAlias({ alias, provider, model } = {}) {
-    if (typeof alias !== 'string' || !/^[a-zA-Z0-9_\-.]{1,64}$/.test(alias.trim())) {
-      throw Object.assign(new Error('alias must be 1-64 alphanumeric characters or _-.'), { code: 'INVALID_ALIAS' })
-    }
-    const trimmedAlias = alias.trim()
-    if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
-    if (typeof model !== 'string' || !model) throw new Error('model is required')
-    if (typeof saveConfig !== 'function') throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
-    const config = getConfig() ?? {}
-    const currentAliases = structuredClone(config.aliases ?? {})
-    currentAliases[trimmedAlias] = { provider, model, updatedAt: Date.now() }
-    await saveConfig({ aliases: currentAliases })
-    return { alias: trimmedAlias, provider, model, aliases: currentAliases }
-  }
-
-  async function deleteAlias({ alias } = {}) {
-    if (typeof alias !== 'string' || !alias) throw new Error('alias is required')
-    if (typeof saveConfig !== 'function') throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
-    const config = getConfig() ?? {}
-    const currentAliases = structuredClone(config.aliases ?? {})
-    delete currentAliases[alias.trim()]
-    await saveConfig({ aliases: currentAliases })
-    return { alias: alias.trim(), deleted: true, aliases: currentAliases }
-  }
-
+  const transfer = createConfigTransfer({
+    getConfig,
+    saveConfig,
+    listProviders: providers,
+    validatePolicy,
+  })
+  const exportConfig = transfer.exportConfig
+  const importConfig = transfer.importConfig
+  const getAliases = transfer.getAliases
+  const setAlias = transfer.setAlias
+  const deleteAlias = transfer.deleteAlias
 
   return Object.freeze({
     listProviders: providers,

package/lib/updater.js

@@ -0,0 +1,362 @@
+import { spawn } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { basename, dirname, isAbsolute, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Host-side one-click updater for @goodandready/dsh-model-sync.
+ * Implements the unified DSH plugin updater specification with loopback verification.
+ */
+
+const UPDATE_HEADER = 'x-dsh-plugin-update'
+const UPDATE_TIMEOUT_MS = 10 * 60_000
+const VERSION_CACHE_MS = 5 * 60_000
+let latestCache = undefined
+
+function header(request, name) {
+  const value = request?.headers?.[name]
+  return Array.isArray(value) ? value[0] : value
+}
+
+export function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  return (
+    address === 'localhost' ||
+    address === 'localhost.' ||
+    address === '::1' ||
+    address?.startsWith('127.') === true ||
+    address?.startsWith('::ffff:127.') === true
+  )
+}
+
+export function isTrustedUpdateRequest(request) {
+  if (header(request, UPDATE_HEADER) !== '1') return false
+  const remote = request.socket?.remoteAddress
+  if (!isLoopback(remote)) return false
+  const site = header(request, 'sec-fetch-site')
+  if (site !== undefined && site !== 'same-origin') return false
+  const origin = header(request, 'origin')
+  const host = header(request, 'host')
+  if (origin === undefined || host === undefined) return false
+  try {
+    const url = new URL(origin)
+    return (
+      (url.protocol === 'http:' || url.protocol === 'https:') &&
+      isLoopback(url.hostname) &&
+      url.host === host
+    )
+  } catch (err) {
+    // bestEffort URL parse
+    return false
+  }
+}
+
+function validProfileName(value) {
+  return (
+    typeof value === 'string' &&
+    value !== '' &&
+    value !== '.' &&
+    value !== '..' &&
+    !value.includes('/') &&
+    !value.includes('\\') &&
+    !/[\0-\x1f\x7f]/.test(value)
+  )
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+    if (arg === '--profile' || arg === '-p') {
+      const next = argv[index + 1]
+      if (validProfileName(next)) return next
+    }
+    if (typeof arg === 'string' && arg.startsWith('--profile=')) {
+      const value = arg.slice('--profile='.length)
+      if (validProfileName(value)) return value
+    }
+  }
+  return undefined
+}
+
+function findDshCliEntry() {
+  const entry = process.argv[1]
+  if (typeof entry !== 'string' || entry === '') return undefined
+  const resolved = entry.startsWith('file:') ? fileURLToPath(entry) : resolve(process.cwd(), entry)
+  if (!existsSync(resolved)) return undefined
+  for (let directory = dirname(resolved); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json')
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+        const bin =
+          typeof manifest.bin === 'string'
+            ? manifest.bin
+            : typeof manifest.bin === 'object' && manifest.bin !== null
+              ? manifest.bin.dsh
+              : undefined
+        if (
+          manifest.name === '@deepseek-ai/dsh' &&
+          typeof bin === 'string' &&
+          !isAbsolute(bin) &&
+          resolve(directory, bin) === resolve(resolved)
+        ) {
+          return resolved
+        }
+      } catch (err) {
+        // bestEffort manifest parse
+      }
+    }
+    const parent = dirname(directory)
+    if (parent === directory) return undefined
+  }
+}
+
+export function runtime() {
+  const profileDir = resolve(
+    process.env.DSH_PROFILE_DIR ?? resolve(homedir(), '.dsh', 'profiles', 'web')
+  )
+  const selected = profileNameFromArgv(process.argv)
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir))
+      ? basename(profileDir)
+      : 'web'
+  const cliEntry = findDshCliEntry()
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry }
+}
+
+export function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(String(value ?? '').trim())
+  if (match === null) return undefined
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4] ? match[4].split('.') : [],
+  }
+}
+
+export function comparePrerelease(left, right) {
+  if (left.length === 0 && right.length === 0) return 0
+  if (left.length === 0) return 1
+  if (right.length === 0) return -1
+  const length = Math.max(left.length, right.length)
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index]
+    const b = right[index]
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1
+    if (a === b) continue
+    const aNumeric = /^\d+$/.test(a)
+    const bNumeric = /^\d+$/.test(b)
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a)
+      const bNumber = BigInt(b)
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1
+      continue
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1
+    return a > b ? 1 : -1
+  }
+  return 0
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue)
+  const candidate = parseSemver(candidateValue)
+  if (current === undefined || candidate === undefined) return false
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index]
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0
+}
+
+export function resetLatestCache() {
+  latestCache = undefined
+}
+
+export async function latestVersion(packageName, registry = 'https://registry.npmjs.org') {
+  if (
+    latestCache?.packageName === packageName &&
+    latestCache.registry === registry &&
+    Date.now() < latestCache.expiresAt
+  ) {
+    return latestCache.version
+  }
+  try {
+    const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
+      signal: typeof AbortSignal !== 'undefined' && AbortSignal.timeout ? AbortSignal.timeout(8000) : undefined,
+    })
+    if (!response.ok) return undefined
+    const value = await response.json()
+    if (typeof value?.version !== 'string' || value.version === '') return undefined
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS }
+    return value.version
+  } catch (err) {
+    // bestEffort network check
+    return undefined
+  }
+}
+
+export async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'))
+  if (typeof value?.version !== 'string' || value.version === '') {
+    throw new Error('Cannot read current plugin version.')
+  }
+  return value.version
+}
+
+export async function status(options, target) {
+  const current = await currentVersion(options.manifestUrl)
+  let latest = undefined
+  if (typeof options.getLatestVersion === 'function') {
+    latest = await options.getLatestVersion()
+  } else if (options.latestVersion !== undefined) {
+    latest = options.latestVersion
+  } else {
+    latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org')
+  }
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  }
+}
+
+export async function installExact(target, packageSpec, options = {}) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(
+      process.execPath,
+      [
+        target.cliEntry,
+        'plugin',
+        '--profile',
+        target.profileName,
+        'add',
+        '--config.minimumReleaseAge=0',
+        packageSpec,
+        `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+      ],
+      {
+        cwd: target.profileDir,
+        windowsHide: true,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env, NO_COLOR: '1' },
+      }
+    )
+    let detail = ''
+    child.stdout?.on('data', (chunk) => {
+      detail = (detail + String(chunk)).slice(-4000)
+    })
+    child.stderr?.on('data', (chunk) => {
+      detail = (detail + String(chunk)).slice(-4000)
+    })
+    const timer = setTimeout(() => {
+      child.kill()
+      reject(new Error('Update timed out; use the normal DSH update flow.'))
+    }, UPDATE_TIMEOUT_MS)
+    child.once('error', (error) => {
+      clearTimeout(timer)
+      reject(error)
+    })
+    child.once('exit', (code) => {
+      clearTimeout(timer)
+      if (code === 0) resolvePromise()
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+    })
+  })
+}
+
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  })
+  response.end(JSON.stringify(value))
+}
+
+export function registerPluginUpdater(ctx, options = {}) {
+  let installing = false
+  if (typeof ctx?.webServer?.register !== 'function') {
+    if (typeof ctx?.logger?.warn === 'function') {
+      ctx.logger.warn('[dsh-model-sync] webServer service unavailable, updater skipped')
+    }
+    return () => {}
+  }
+
+  const packageName = options.packageName ?? '@goodandready/dsh-model-sync'
+  const endpoints = Array.isArray(options.endpoints)
+    ? options.endpoints
+    : [options.endpoint ?? '/api/dsh-model-sync/update', '/dsh-model-sync/update']
+  const uniqueEndpoints = [...new Set(endpoints)]
+
+  const handler = async (request, response) => {
+    try {
+      const target = runtime()
+      if (request.method === 'GET' || request.method === 'HEAD') {
+        const payload = await status({ ...options, packageName }, target)
+        response.writeHead(200, {
+          'content-type': 'application/json; charset=utf-8',
+          'cache-control': 'no-store',
+        })
+        response.end(request.method === 'HEAD' ? undefined : JSON.stringify(payload))
+        return
+      }
+      if (request.method !== 'POST') {
+        response.writeHead(405, { allow: 'GET, HEAD, POST' })
+        response.end()
+        return
+      }
+      if (!isTrustedUpdateRequest(request)) {
+        json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
+        return
+      }
+      if (installing) {
+        json(response, 409, { error: 'This plugin is already updating.' })
+        return
+      }
+      installing = true
+      try {
+        const before = await status({ ...options, packageName }, target)
+        if (before.latestVersion === undefined) {
+          json(response, 503, { error: 'The latest version is temporarily unavailable.' })
+          return
+        }
+        if (!before.updateAvailable) {
+          json(response, 200, before)
+          return
+        }
+        const doInstall = options.installExact ?? installExact
+        await doInstall(target, `${packageName}@${before.latestVersion}`, options)
+        json(response, 200, {
+          ...before,
+          updatedVersion: before.latestVersion,
+          restartRequired: true,
+        })
+      } finally {
+        installing = false
+      }
+    } catch (error) {
+      if (typeof ctx?.logger?.warn === 'function') {
+        ctx.logger.warn(`[dsh-model-sync] plugin updater failed: ${String(error)}`)
+      }
+      json(response, 503, { error: 'Plugin update failed; see server logs.' })
+    }
+  }
+
+  const disposers = uniqueEndpoints.map((path) =>
+    ctx.webServer.register({ kind: 'exact', path, handler })
+  )
+
+  return () => {
+    for (const dispose of disposers) {
+      if (typeof dispose === 'function') {
+        try { dispose() } catch (err) { /* bestEffort cleanup */ }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.3.14",
+  "version": "0.4.0",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",
@@ -38,7 +38,11 @@
     },
     "client": {
       "platform": "web",
-      "inject": []
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
     }
   },
   "scripts": {