@huaqiu/dsh-tool-plugin-update 0.5.22 → 0.6.2

package/lib/client.js

@@ -64,15 +64,40 @@ window.__ModuleLoader__.load({
 				applyBadge
 			};
 		}
-		/** Re-insert the entry after the New Session row (before the browser region). */
+		/**
+		* Re-insert the entry after the New Session row, in the family's intended
+		* order.
+		*
+		* The `familySelectors` array order is the single source of truth for visual
+		* order, so the rendered order is stable regardless of which plugin mounts
+		* first or of observer callback order — a re-render can never swap two rows.
+		* (Earlier builds used the `position: 'before' | 'after'` convention, which
+		* clustered rows by mount order and let a late-mounting `before` row steal the
+		* lead. The array order supersedes it; `position` remains only as a fallback
+		* for a row whose selector is absent from the family list.)
+		*/
 		function placeEntry(root, entry, options) {
 			const button = newSessionButton(root);
 			if (button === void 0) return false;
 			if (entry.parentElement !== root) {
 				const row = button.closest("[class*=\"logoRow\"]");
 				const base = row !== null && row.parentElement === root ? row : button;
-				const family = Array.from(root.children).filter((el) => el instanceof HTMLElement && el.matches(options.familySelectors.join(", ")));
-				const anchor = options.position === "before" ? family.length > 0 ? family[0] : base.nextElementSibling : family.length > 0 ? family[family.length - 1].nextElementSibling : base.nextElementSibling;
+				const order = options.familySelectors;
+				const present = Array.from(root.children).filter((el) => el instanceof HTMLElement && el.matches(order.join(", "))).map((el) => ({
+					el,
+					idx: order.findIndex((sel) => el.matches(sel))
+				}));
+				const selfIndex = order.indexOf(options.rowSelector);
+				let anchor;
+				if (selfIndex === -1) anchor = options.position === "before" ? present.length > 0 ? present[0].el : base.nextElementSibling : present.length > 0 ? present[present.length - 1].el.nextElementSibling : base.nextElementSibling;
+				else {
+					const later = present.find((member) => member.idx > selfIndex);
+					if (later !== void 0) anchor = later.el;
+					else {
+						const earlier = [...present].reverse().find((member) => member.idx < selfIndex);
+						anchor = earlier !== void 0 ? earlier.el.nextElementSibling : base.nextElementSibling;
+					}
+				}
 				root.insertBefore(entry, anchor ?? null);
 			}
 			return true;
@@ -158,10 +183,11 @@ window.__ModuleLoader__.load({
 		* family row means adding its selector here (and to no plugin-local list).
 		*/
 		const HUAQIU_SIDEBAR_ENTRY_FAMILY = [
+			"[data-hq-plugin-update-entry]",
 			"[data-hqcg-footprint-entry]",
 			"[data-hqcg-symbol-entry]",
 			"[data-hqcg-schematic-entry]",
-			"[data-hq-plugin-update-entry]"
+			"[data-hq-dummy-entry]"
 		];
 		/**
 		* Read the host UI language from `<html lang>`.
@@ -229,6 +255,22 @@ window.__ModuleLoader__.load({
 		* @module
 		*/
 		const UPDATE_BASE = "/api/v1/huaqiu/plugin-update";
+		/**
+		* The latest runtime version to display, or null when there is none.
+		*
+		* hq-edge sends the full release entry; an older or future server could send
+		* a bare string. Both are accepted here so the facts row can never again fall
+		* back to `String(object)` — i.e. "[object Object]" — in the DOM.
+		*/
+		function runtimeLatestVersion(runtime) {
+			const latest = runtime?.latest;
+			if (typeof latest === "string") return latest.length > 0 ? latest : null;
+			if (latest !== null && typeof latest === "object" && "version" in latest) {
+				const version = latest.version;
+				if (typeof version === "string" && version.length > 0) return version;
+			}
+			return null;
+		}
 		async function request(path, init) {
 			const res = await fetch(`${UPDATE_BASE}${path}`, {
 				cache: "no-store",
@@ -268,6 +310,13 @@ window.__ModuleLoader__.load({
 				body: JSON.stringify({ setVersion })
 			});
 		}
+		/** POST the user-confirmed HQ Edge runtime update for one target version. */
+		function requestRuntimeUpdate(targetVersion) {
+			return request("/runtime-request", {
+				method: "POST",
+				body: JSON.stringify({ targetVersion })
+			});
+		}
 		/** POST unignore for the set version (reverses an ignore). */
 		function unignoreOffer(setVersion) {
 			return request("/unignore", {
@@ -275,6 +324,37 @@ window.__ModuleLoader__.load({
 				body: JSON.stringify({ setVersion })
 			});
 		}
+		/**
+		* POST a new runtime-update manifest URL, or `""` to clear a user override
+		* and fall back to the configured URL.
+		*
+		* hq-edge validates the URL itself (`https` required except for loopback, no
+		* embedded credentials) and answers 422 with a message meant for a person —
+		* this client surfaces it verbatim rather than pre-validating, so the rule
+		* lives in exactly one place. A successful answer is the NEW source; the
+		* caller must then re-run discovery, because the cached report still names
+		* the old manifest's offer.
+		*/
+		function setRuntimeUpdateSource(url) {
+			return request("/runtime-source", {
+				method: "POST",
+				body: JSON.stringify({ url })
+			});
+		}
+		/**
+		* POST a new plugin release-manifest URL, or `""` to clear a user override.
+		*
+		* hq-edge persists the override per host AND re-runs discovery in the
+		* background, so the next report (and the sidebar badge) already reflect the
+		* new manifest. This client still re-checks explicitly after a save — the
+		* background pass is a safety net for other consumers, not a substitute.
+		*/
+		function setPluginUpdateSource(url) {
+			return request("/plugin-source", {
+				method: "POST",
+				body: JSON.stringify({ url })
+			});
+		}
 		const COPY = {
 			zh: {
 				entryLabel: "插件更新",
@@ -322,11 +402,39 @@ window.__ModuleLoader__.load({
 					source: "更新源",
 					unknown: "版本未知",
 					notConfigured: "未配置更新源",
-					note: "运行时更新由 EDA 安装器处理"
+					note: "运行时更新由 EDA 安装器处理",
+					update: "安装运行时更新",
+					updateConfirm: (version) => `安装 HQ Edge 运行时 ${version}？HQ Edge 会先关闭并完成替换，然后重新启动。`,
+					updating: "正在下载并校验运行时包，可能需要一分钟…",
+					updateAccepted: "运行时更新已受理，HQ Edge 正在重启…",
+					sourceHint: "运行时更新清单的下载地址，保存后立即生效",
+					sourceEdit: "修改",
+					sourceSave: "保存",
+					sourceReset: "恢复默认",
+					saved: "更新源已保存，正在重新检查更新…",
+					saveFailed: "保存更新源失败",
+					sourceInputLabel: "运行时更新清单地址",
+					sourcePlaceholder: "https://gitee.com/huaqiu-electronics/dsh-pcb-eda/raw/main/edge-headless-release-manifest.json"
 				},
+				pluginSource: {
+					title: "插件更新源",
+					hint: "插件更新清单的下载地址，保存后立即生效",
+					edit: "修改",
+					save: "保存",
+					reset: "恢复默认",
+					saved: "更新源已保存，正在重新检查更新…",
+					saveFailed: "保存更新源失败",
+					inputLabel: "插件更新清单地址",
+					placeholder: "https://gitee.com/huaqiu-electronics/dsh-pcb-eda/raw/main/plugins-release-manifest.json"
+				},
+				originOverride: "自定义",
+				originConfig: "默认配置",
+				originUnset: "未配置",
 				lastError: "上次检查失败",
 				installError: "安装失败",
-				installSuccess: "更新已安装，正在重启 DSH…"
+				installSuccess: "更新已安装，正在重启 DSH…",
+				confirmInstall: "确认安装",
+				cancel: "取消"
 			},
 			en: {
 				entryLabel: "Plugin Updates",
@@ -374,11 +482,39 @@ window.__ModuleLoader__.load({
 					source: "Update source",
 					unknown: "Version unknown",
 					notConfigured: "No update source configured",
-					note: "Runtime updates are handled by the EDA installer"
+					note: "Runtime updates are handled by the EDA installer",
+					update: "Install runtime update",
+					updateConfirm: (version) => `Install HQ Edge runtime ${version}? HQ Edge shuts down to swap the runtime, then restarts.`,
+					updating: "Downloading and verifying the runtime bundle — this can take a minute…",
+					updateAccepted: "Runtime update accepted — HQ Edge is restarting…",
+					sourceHint: "Where the runtime update manifest is fetched from; saved changes take effect immediately",
+					sourceEdit: "Edit",
+					sourceSave: "Save",
+					sourceReset: "Reset to default",
+					saved: "Update source saved — re-checking for updates…",
+					saveFailed: "Failed to save the update source",
+					sourceInputLabel: "Runtime update manifest URL",
+					sourcePlaceholder: "https://gitee.com/huaqiu-electronics/dsh-pcb-eda/raw/main/edge-headless-release-manifest.json"
+				},
+				pluginSource: {
+					title: "Plugin update source",
+					hint: "Where the plugin update manifest is fetched from; saved changes take effect immediately",
+					edit: "Edit",
+					save: "Save",
+					reset: "Reset to default",
+					saved: "Update source saved — re-checking for updates…",
+					saveFailed: "Failed to save the update source",
+					inputLabel: "Plugin update manifest URL",
+					placeholder: "https://gitee.com/huaqiu-electronics/dsh-pcb-eda/raw/main/plugins-release-manifest.json"
 				},
+				originOverride: "Custom",
+				originConfig: "Configured",
+				originUnset: "Not configured",
 				lastError: "Last check failed",
 				installError: "Install failed",
-				installSuccess: "Update installed — restarting DSH…"
+				installSuccess: "Update installed — restarting DSH…",
+				confirmInstall: "Confirm install",
+				cancel: "Cancel"
 			}
 		};
 		//#endregion
@@ -619,8 +755,154 @@ window.__ModuleLoader__.load({
 			section.setAttribute("aria-label", copy.loading);
 			return section;
 		}
+		/**
+		* Normalize the report's `runtime.source` to the full shape.
+		*
+		* An older hq-edge predates the feature and sends no `source` at all — that
+		* must degrade to a read-only panel, not crash the render. A future server
+		* may add fields; unknown extras are dropped here rather than trusted.
+		*/
+		function normalizeSource(raw) {
+			if (raw === null || typeof raw !== "object") return null;
+			const candidate = raw;
+			if (typeof candidate.origin !== "string") return null;
+			return {
+				url: typeof candidate.url === "string" ? candidate.url : "",
+				origin: candidate.origin,
+				configuredUrl: typeof candidate.configuredUrl === "string" ? candidate.configuredUrl : "",
+				override: candidate.override === true
+			};
+		}
+		/** The tag naming where the URL in effect came from. */
+		function originLabel(origin, copy) {
+			switch (origin) {
+				case "override": return copy.originOverride;
+				case "config": return copy.originConfig;
+				default: return copy.originUnset;
+			}
+		}
+		/** The 更新源 fact row: the URL in effect plus an origin tag. */
+		function sourceFactRow(facts, source, copy) {
+			const wrap = el("div");
+			wrap.append(el("dt", "", copy.runtime.source));
+			const dd = el("dd");
+			const line = el("div", "hqpu-source-line");
+			const code = el("code", "hqpu-source-url", source.url.length > 0 ? source.url : copy.runtime.notConfigured);
+			const tag = el("span", "hqpu-tag");
+			tag.dataset.tone = source.override ? "info" : source.origin === "config" ? "success" : "neutral";
+			tag.textContent = originLabel(source.origin, copy);
+			line.append(code, tag);
+			dd.append(line);
+			wrap.append(dd);
+			facts.append(wrap);
+		}
+		/** Pick the labels for one kind out of the copy table. */
+		function sourceLabels(copy, kind) {
+			return kind === "runtime" ? {
+				hint: copy.runtime.sourceHint,
+				edit: copy.runtime.sourceEdit,
+				save: copy.runtime.sourceSave,
+				reset: copy.runtime.sourceReset,
+				inputLabel: copy.runtime.sourceInputLabel,
+				placeholder: copy.runtime.sourcePlaceholder
+			} : {
+				hint: copy.pluginSource.hint,
+				edit: copy.pluginSource.edit,
+				save: copy.pluginSource.save,
+				reset: copy.pluginSource.reset,
+				inputLabel: copy.pluginSource.inputLabel,
+				placeholder: copy.pluginSource.placeholder
+			};
+		}
+		/**
+		* One update-source editor, shared by the plugin manifest and the runtime
+		* manifest (the only differences are the labels and the data-attribute
+		* prefix, so tests and CSS can target each).
+		*
+		* Read mode is a hint plus a 修改 button; edit mode is the URL field with
+		* 保存 / 取消 — plus 恢复默认 while a user override shadows the configured
+		* URL. The draft lives in {@link SourceEditorActions} (the panel closure), so
+		* a background store refresh re-renders the typed URL instead of discarding it.
+		*/
+		function sourceEditor(kind, source, copy, actions) {
+			const labels = sourceLabels(copy, kind);
+			const block = el("div", `hqpu-source-editor hqpu-source-editor--${kind}`);
+			if (!actions.sourceEditing) {
+				block.append(el("p", "hqpu-status hqpu-source-hint", labels.hint));
+				const edit = el("button", "hqpu-btn hqpu-btn--outline hqpu-btn--sm", labels.edit);
+				edit.type = "button";
+				edit.setAttribute(`data-${kind}-source-edit`, "");
+				edit.disabled = actions.sourceSaving;
+				edit.addEventListener("click", actions.onSourceEdit);
+				block.append(edit);
+				return block;
+			}
+			const input = el("input", "hqpu-source-input");
+			input.type = "url";
+			input.value = actions.sourceDraft;
+			input.placeholder = labels.placeholder;
+			input.setAttribute("aria-label", labels.inputLabel);
+			input.setAttribute(`data-${kind}-source-input`, "");
+			input.disabled = actions.sourceSaving;
+			input.addEventListener("input", () => {
+				actions.onSourceDraft(input.value);
+			});
+			input.addEventListener("keydown", (ev) => {
+				if (ev.key === "Enter") {
+					ev.preventDefault();
+					actions.onSourceSave();
+				} else if (ev.key === "Escape") {
+					ev.preventDefault();
+					ev.stopPropagation();
+					actions.onSourceCancel();
+				}
+			});
+			const save = el("button", "hqpu-btn hqpu-btn--primary hqpu-btn--sm", labels.save);
+			save.type = "button";
+			save.setAttribute(`data-${kind}-source-save`, "");
+			save.disabled = actions.sourceSaving;
+			save.addEventListener("click", actions.onSourceSave);
+			const cancel = el("button", "hqpu-btn hqpu-btn--outline hqpu-btn--sm", copy.cancel);
+			cancel.type = "button";
+			cancel.setAttribute(`data-${kind}-source-cancel`, "");
+			cancel.disabled = actions.sourceSaving;
+			cancel.addEventListener("click", actions.onSourceCancel);
+			const controls = el("div", "hqpu-actions hqpu-source-controls");
+			controls.append(input, save, cancel);
+			if (source.override) {
+				const reset = el("button", "hqpu-btn hqpu-btn--ghost hqpu-btn--sm", labels.reset);
+				reset.type = "button";
+				reset.setAttribute(`data-${kind}-source-reset`, "");
+				reset.disabled = actions.sourceSaving;
+				reset.addEventListener("click", actions.onSourceReset);
+				controls.append(reset);
+			}
+			block.append(controls);
+			input.focus();
+			return block;
+		}
+		/**
+		* The plugin release-manifest source, as its own group above the plugin
+		* groups: it says where the whole list comes from, so it belongs above the
+		* list rather than inside it. Absent on an older hq-edge (no `pluginSource`
+		* in the report) — then nothing is rendered at all.
+		*/
+		function pluginSourceGroup(report, copy, actions) {
+			const source = normalizeSource(report.pluginSource);
+			if (source === null) return null;
+			const section = el("section", "hqpu-group");
+			section.dataset.group = "plugin-source";
+			const head = el("div", "hqpu-group-head");
+			head.append(el("h3", "hqpu-group-title", copy.pluginSource.title));
+			section.append(head);
+			const facts = el("dl", "hqpu-facts");
+			sourceFactRow(facts, source, copy);
+			section.append(facts);
+			section.append(sourceEditor("plugin", source, copy, actions));
+			return section;
+		}
 		/** The independent HQ Edge runtime report, as ruled fact rows. */
-		function runtimeGroup(report, copy) {
+		function runtimeGroup(report, copy, actions) {
 			const section = el("section", "hqpu-group");
 			section.dataset.group = "runtime";
 			const head = el("div", "hqpu-group-head");
@@ -628,6 +910,7 @@ window.__ModuleLoader__.load({
 			section.append(head);
 			const facts = el("dl", "hqpu-facts");
 			const runtime = report.runtime;
+			const latestVersion = runtimeLatestVersion(runtime);
 			const row = (label, value, code = false) => {
 				const wrap = el("div");
 				wrap.append(el("dt", "", label));
@@ -639,15 +922,51 @@ window.__ModuleLoader__.load({
 				wrap.append(dd);
 				facts.append(wrap);
 			};
-			if (runtime.configured === false) row(copy.runtime.source, copy.runtime.notConfigured);
-			else {
+			const source = normalizeSource(runtime.source);
+			if (runtime.configured === false) {
+				if (source !== null) sourceFactRow(facts, source, copy);
+				else row(copy.runtime.source, copy.runtime.notConfigured);
+			} else {
 				row(copy.runtime.current, runtime.currentVersion ?? copy.runtime.unknown);
-				if (runtime.updateAvailable && runtime.latest != null) row(copy.runtime.latest, runtime.latest);
+				if (runtime.updateAvailable && latestVersion !== null) row(copy.runtime.latest, latestVersion);
 				if (report.manifestVersion !== null) row(copy.runtime.set, report.manifestVersion, true);
 				if (typeof runtime.checkedAt === "string" && runtime.checkedAt.length > 0) row(copy.runtime.checkedAt, new Date(runtime.checkedAt).toLocaleString());
+				if (source !== null) sourceFactRow(facts, source, copy);
 			}
 			section.append(facts);
-			section.append(el("p", "hqpu-status", copy.runtime.note));
+			if (source !== null) section.append(sourceEditor("runtime", source, copy, actions));
+			if (runtime.updateAvailable && latestVersion !== null) {
+				const row = el("div", "hqpu-actions hqpu-runtime-actions");
+				if (actions.accepted) {
+					const line = el("span", "hqpu-status hqpu-status--dot");
+					line.setAttribute("role", "status");
+					line.append(el("span", "hqpu-spinner"), el("span", "", copy.runtime.updateAccepted));
+					row.append(line);
+				} else if (actions.busy) {
+					const line = el("span", "hqpu-status hqpu-status--dot");
+					line.setAttribute("role", "status");
+					line.append(el("span", "hqpu-spinner"), el("span", "", copy.runtime.updating));
+					row.append(line);
+				} else if (actions.armed) {
+					row.append(el("p", "hqpu-status hqpu-runtime-confirm", copy.runtime.updateConfirm(latestVersion)));
+					const yes = el("button", "hqpu-btn hqpu-btn--primary hqpu-btn--sm", copy.confirmInstall);
+					yes.type = "button";
+					yes.dataset.runtimeConfirm = "";
+					yes.addEventListener("click", actions.onConfirm);
+					const no = el("button", "hqpu-btn hqpu-btn--outline hqpu-btn--sm", copy.cancel);
+					no.type = "button";
+					no.addEventListener("click", actions.onCancel);
+					row.append(yes, no);
+				} else {
+					const start = el("button", "hqpu-btn hqpu-btn--primary hqpu-btn--sm");
+					start.type = "button";
+					start.dataset.runtimeUpdate = "";
+					start.innerHTML = `${DOWNLOAD_ICON(13)}<span>${copy.runtime.update}</span>`;
+					start.addEventListener("click", actions.onArm);
+					row.append(start);
+				}
+				section.append(row);
+			} else section.append(el("p", "hqpu-status", copy.runtime.note));
 			if (typeof runtime.lastError === "string" && runtime.lastError.length > 0) {
 				const line = el("p", "hqpu-status hqpu-status--dot");
 				line.setAttribute("role", "status");
@@ -680,10 +999,17 @@ window.__ModuleLoader__.load({
 				if (node !== null) section.append(node);
 			}
 		}
-		function renderRuntime(section, report, copy) {
+		function renderRuntime(section, report, copy, actions) {
 			section.textContent = "";
 			if (report === null) return;
-			section.append(runtimeGroup(report, copy));
+			section.append(runtimeGroup(report, copy, actions));
+		}
+		/** The plugin-source group, above the plugin groups. No-op without the field. */
+		function renderPluginSource(section, report, copy, actions) {
+			section.textContent = "";
+			if (report === null) return;
+			const node = pluginSourceGroup(report, copy, actions);
+			if (node !== null) section.append(node);
 		}
 		/** Run the install transaction, then keep polling until the state settles. */
 		async function runInstall(store, copy) {
@@ -826,10 +1152,11 @@ window.__ModuleLoader__.load({
 			panel.append(head);
 			const scroll = el("div", "hqpu-scroll");
 			const column = el("div", "hqpu-column");
+			const pluginSourceSection = el("div", "hqpu-stack");
 			const listSection = el("div", "hqpu-stack");
 			const runtimeSection = el("div", "hqpu-stack");
 			const toastSection = el("div", "hqpu-toast-host");
-			column.append(listSection, runtimeSection, toastSection);
+			column.append(pluginSourceSection, listSection, runtimeSection, toastSection);
 			scroll.append(column);
 			panel.append(scroll);
 			const footer = el("div", "hqpu-footer");
@@ -841,6 +1168,144 @@ window.__ModuleLoader__.load({
 			toastHost = toastSection;
 			panel.focus();
 			const disposers = [];
+			let runtimeArmed = false;
+			let runtimeBusy = false;
+			let runtimeAccepted = false;
+			const runtimeSourceState = {
+				editing: false,
+				saving: false,
+				draft: ""
+			};
+			const pluginSourceState = {
+				editing: false,
+				saving: false,
+				draft: ""
+			};
+			const runtimeSourceActions = sourceActionsFor("runtime", runtimeSourceState);
+			const runtimeActions = {
+				get busy() {
+					return runtimeBusy;
+				},
+				get armed() {
+					return runtimeArmed;
+				},
+				get accepted() {
+					return runtimeAccepted;
+				},
+				onArm: () => {
+					runtimeArmed = true;
+					render();
+				},
+				onCancel: () => {
+					runtimeArmed = false;
+					render();
+				},
+				onConfirm: () => {
+					requestRuntime();
+				},
+				get sourceEditing() {
+					return runtimeSourceActions.sourceEditing;
+				},
+				get sourceSaving() {
+					return runtimeSourceActions.sourceSaving;
+				},
+				get sourceDraft() {
+					return runtimeSourceActions.sourceDraft;
+				},
+				onSourceEdit: () => runtimeSourceActions.onSourceEdit(),
+				onSourceDraft: (value) => runtimeSourceActions.onSourceDraft(value),
+				onSourceSave: () => runtimeSourceActions.onSourceSave(),
+				onSourceCancel: () => runtimeSourceActions.onSourceCancel(),
+				onSourceReset: () => runtimeSourceActions.onSourceReset()
+			};
+			const pluginActions = sourceActionsFor("plugin", pluginSourceState);
+			/** Build the {@link SourceEditorActions} half for one manifest source. */
+			function sourceActionsFor(kind, state) {
+				return {
+					get sourceEditing() {
+						return state.editing;
+					},
+					get sourceSaving() {
+						return state.saving;
+					},
+					get sourceDraft() {
+						return state.draft;
+					},
+					onSourceEdit: () => {
+						const report = store.report();
+						state.draft = (kind === "runtime" ? normalizeSource(report?.runtime.source) : normalizeSource(report?.pluginSource))?.url ?? "";
+						state.editing = true;
+						render();
+					},
+					onSourceDraft: (value) => {
+						state.draft = value;
+					},
+					onSourceSave: () => {
+						submitSource(kind, state);
+					},
+					onSourceCancel: () => {
+						state.editing = false;
+						render();
+					},
+					onSourceReset: () => {
+						submitSource(kind, state, "");
+					}
+				};
+			}
+			/**
+			* Save one manifest source — or clear the override with an empty URL —
+			* then re-run discovery.
+			*
+			* The re-check is not optional: the report is cached, so without a fresh
+			* `POST /check` the facts and the update button would keep naming the OLD
+			* manifest's offer after the source changed. hq-edge answers 422 with a
+			* message meant for a person on refusal (bad scheme, credentials, …), which
+			* the toast shows verbatim.
+			*/
+			async function submitSource(kind, state, url = state.draft) {
+				state.saving = true;
+				render();
+				const labels = kind === "runtime" ? copy.runtime : copy.pluginSource;
+				try {
+					if (kind === "runtime") await setRuntimeUpdateSource(url);
+					else await setPluginUpdateSource(url);
+					state.editing = false;
+					showToast(labels.saved, "success");
+					try {
+						await checkUpdates();
+						await store.refresh();
+					} catch {}
+				} catch (err) {
+					showToast(`${labels.saveFailed}: ${err instanceof Error ? err.message : String(err)}`, "error");
+				} finally {
+					state.saving = false;
+					render();
+				}
+			}
+			async function requestRuntime() {
+				const version = runtimeLatestVersion(store.report()?.runtime);
+				if (version === null) {
+					showToast(copy.checkFailed, "error");
+					return;
+				}
+				runtimeArmed = false;
+				runtimeBusy = true;
+				render();
+				try {
+					const result = await requestRuntimeUpdate(version);
+					if (result?.error !== void 0) {
+						showToast(`${copy.installError}: ${result.error}`, "error");
+						return;
+					}
+					runtimeAccepted = true;
+					showToast(copy.runtime.updateAccepted, "success");
+				} catch (err) {
+					showToast(`${copy.installError}: ${err instanceof Error ? err.message : String(err)}`, "error");
+				} finally {
+					runtimeBusy = false;
+					render();
+				}
+			}
 			const render = () => {
 				const report = store.report();
 				const installing = store.installing();
@@ -850,7 +1315,8 @@ window.__ModuleLoader__.load({
 					listSection.textContent = "";
 					listSection.append(skeleton(copy));
 				} else renderList(listSection, report, copy, installing, store);
-				renderRuntime(runtimeSection, report, copy);
+				renderPluginSource(pluginSourceSection, report, copy, pluginActions);
+				renderRuntime(runtimeSection, report, copy, runtimeActions);
 				renderActions(actionBar, report, copy, store, installing);
 			};
 			const unsubscribe = store.subscribe(render);
@@ -1559,6 +2025,69 @@ window.__ModuleLoader__.load({
   gap: 8px;
 }
 
+/* ── Runtime update action row (arm → confirm step) ───────────────────── */
+.hqpu-runtime-actions {
+  margin-top: 12px;
+}
+.hqpu-runtime-confirm {
+  flex: 1 1 100%;
+  margin: 0;
+}
+
+/* ── Runtime update source (fact row + editable URL field) ────────────── */
+.hqpu-source-line {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+  max-width: 100%;
+}
+.hqpu-source-url {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.hqpu-source-editor {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-top: 12px;
+}
+/* The plugin-source editor sits inside its own group right under the fact
+ * row, so it needs less air than the runtime one under the facts block. */
+.hqpu-source-editor--plugin {
+  margin-top: 4px;
+}
+.hqpu-source-hint {
+  flex: 1 1 100%;
+  margin: 0;
+}
+.hqpu-source-controls {
+  flex: 1 1 100%;
+}
+.hqpu-source-input {
+  flex: 1 1 240px;
+  min-width: 0;
+  height: 28px;
+  box-sizing: border-box;
+  padding: 0 10px;
+  border: 0.5px solid var(--dsw-alias-border-l4);
+  border-radius: var(--dsw-radius-md);
+  background: var(--dsw-alias-bg-layer-3);
+  color: var(--dsw-alias-label-primary);
+  font: inherit;
+  font-size: 12.5px;
+}
+.hqpu-source-input:disabled {
+  opacity: 0.5;
+}
+.hqpu-source-input:focus-visible {
+  outline: var(--dsw-focus-ring-width) solid var(--dsw-focus-ring-color, var(--dsw-alias-state-business-primary));
+  outline-offset: 1px;
+}
+
 /* ── Footer action row (ui-primitives Modal .footer) ───────────────────── */
 .hqpu-footer {
   display: flex;
@@ -1815,10 +2344,6 @@ window.__ModuleLoader__.load({
 					fn();
 				} catch {}
 			});
-			const labelState = {
-				label: entryCopy(locale).label,
-				tooltip: entryCopy(locale).tooltip
-			};
 			const openView = () => {
 				ensureDesignTokens();
 				store.check().then((report) => {
@@ -1831,8 +2356,8 @@ window.__ModuleLoader__.load({
 				plugin: PLUGIN_ID,
 				icon: UPDATE_ICON,
 				css: ENTRY_CSS,
-				label: () => labelState.label,
-				tooltip: () => labelState.tooltip,
+				label: () => entryCopy(locale).label,
+				tooltip: () => entryCopy(locale).tooltip,
 				refresh: { subscribe: refreshSubscribe },
 				badge: {
 					subscribe: (listener) => store.subscribe(listener),