@linxin666/dsh-remote-web-ui 0.1.10 → 0.1.11

package/lib/types/client/UpdatePanel.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The update panel body: check progress, version comparison, the
+ * auto-update in-flight state, and the outcome (restart hint on success,
+ * translated failure on error). Pure presentation — all state arrives
+ * through props from the entry behavior component.
+ */
+import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots';
+import type { UpdateRunResult, UpdateStatus } from '../update.ts';
+/** The panel view state, owned by the entry component. */
+export type UpdateView = {
+    kind: 'checking';
+} | {
+    kind: 'result';
+    status: UpdateStatus;
+} | {
+    kind: 'updating';
+    status: UpdateStatus;
+} | {
+    kind: 'done';
+    result: UpdateRunResult;
+} | {
+    kind: 'error';
+    message: string;
+    detail?: string;
+};
+/** Full panel props: copy + view state + actions. */
+export interface UpdatePanelProps {
+    t: TranslateNS<'remote'>;
+    view: UpdateView;
+    onClose(): void;
+    /** Re-run the check from a terminal state. */
+    onRecheck(): void;
+}
+/**
+ * Render the update panel.
+ * @param props - copy, view state, and actions.
+ * @returns the panel element tree.
+ */
+export declare function UpdatePanel({ t, view, onClose, onRecheck }: UpdatePanelProps): import("react").JSX.Element;
+//# sourceMappingURL=UpdatePanel.d.ts.map

package/lib/types/client/UpdatePanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdatePanel.d.ts","sourceRoot":"","sources":["../../../src/client/UpdatePanel.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAEnE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGjE,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,IAAI,IAAI,CAAA;IACf,8CAA8C;IAC9C,SAAS,IAAI,IAAI,CAAA;CAClB;AAYD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,gBAAgB,+BAyC5E"}

package/lib/types/client/UpdatePanel.js

@@ -0,0 +1,82 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { IconCloseOutline16, IconRefreshOutline16 } from '@deepseek-ai/dsh-client-ui-primitives';
+import css from "./remote.module.css";
+/** The anchor package name (aggregate first) for copy purposes. */
+function anchorName(status) {
+    return status?.anchor ?? status?.packages[0]?.name;
+}
+/** The latest npm release of the anchor, for reference copy. */
+function anchorLatest(status) {
+    return status?.packages[0]?.latest;
+}
+/**
+ * Render the update panel.
+ * @param props - copy, view state, and actions.
+ * @returns the panel element tree.
+ */
+export function UpdatePanel({ t, view, onClose, onRecheck }) {
+    const status = view.kind === "result" || view.kind === "updating" ? view.status : undefined;
+    const title = view.kind === "done" && view.result.ok ? t("update.done") : t("update.title");
+    const subtitle = subtitleOf(t, view);
+    return (_jsxs("div", { className: css.panel, role: "dialog", "aria-modal": "true", "aria-label": title, children: [_jsxs("div", { className: css.header, children: [_jsxs("div", { className: css.heading, children: [_jsx("h2", { className: css.title, children: title }), subtitle !== undefined && _jsx("p", { className: css.subtitle, children: subtitle })] }), _jsx("button", { type: "button", className: css.close, "aria-label": t("update.close"), onClick: onClose, children: _jsx(IconCloseOutline16, {}) })] }), view.kind === "checking" && _jsx("p", { className: css.updateStatus, children: t("update.checking") }), view.kind === "result" && status !== undefined && _jsx(ResultBody, { t: t, status: status }), view.kind === "updating" && status !== undefined && (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.updating", { name: anchorName(status) ?? "", version: anchorLatest(status) ?? "" }) }), _jsx(PackageList, { status: status })] })), view.kind === "done" && _jsx(DoneBody, { t: t, result: view.result }), view.kind === "error" && (_jsxs("div", { children: [_jsx("p", { className: css.updateError, children: view.message }), view.detail !== undefined && _jsx("pre", { className: css.updateOutput, children: view.detail })] })), (view.kind === "done" || view.kind === "error") && (_jsx("div", { className: css.updateActions, children: _jsxs("button", { type: "button", className: css.updateRetry, onClick: onRecheck, children: [_jsx(IconRefreshOutline16, {}), " ", t("update.retry")] }) }))] }));
+}
+/** The subtitle copy per view state (absent on plain results). */
+function subtitleOf(t, view) {
+    switch (view.kind) {
+        case "checking":
+            return t("update.checking");
+        case "updating":
+            return t("update.updatingTitle");
+        case "result":
+            return undefined;
+        case "done":
+            return view.result.ok ? t("update.doneDetail") : t("update.error");
+        case "error":
+            // The error body below carries the message; no subtitle duplication.
+            return undefined;
+    }
+}
+/** The checked result body: mode banner + version list. */
+function ResultBody({ t, status }) {
+    const anchor = anchorName(status);
+    const latest = anchorLatest(status);
+    if (status.mode === "link") {
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.linkMode") }), _jsx("p", { className: css.updateDetail, children: t("update.linkModeDetail", { version: latest ?? "-" }) })] }));
+    }
+    if (status.mode === "missing") {
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.missing") }), _jsx("p", { className: css.updateDetail, children: t("update.missingDetail") })] }));
+    }
+    if (status.error === "registry-unreachable") {
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.offline") }), _jsx("p", { className: css.updateDetail, children: t("update.offlineDetail") })] }));
+    }
+    if (status.outdated) {
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.found") }), _jsx("p", { className: css.updateDetail, children: anchor !== undefined ? t("update.foundDetail", { name: anchor, version: latest ?? "" }) : "" })] }));
+    }
+    return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.upToDate") }), anchor !== undefined && latest !== undefined && (_jsx("p", { className: css.updateDetail, children: t("update.upToDateDetail", { name: anchor, version: latest }) })), _jsx(PackageList, { status: status })] }));
+}
+/** The per-package current → latest comparison list. */
+function PackageList({ status }) {
+    if (status.packages.length === 0)
+        return null;
+    return (_jsx("ul", { className: css.updateList, children: status.packages.map(packageStatus => (_jsxs("li", { className: css.updateListItem, children: [_jsx("span", { className: css.updateListName, children: packageStatus.name }), _jsxs("span", { className: css.updateListVersions, children: [packageStatus.current, packageStatus.latest !== undefined && packageStatus.latest !== packageStatus.current && (_jsxs(_Fragment, { children: [" \u2192 ", packageStatus.latest] }))] })] }, packageStatus.name))) }));
+}
+/** The outcome body: success + restart hint, or the translated failure. */
+function DoneBody({ t, result }) {
+    if (result.ok) {
+        // The title already reads "Update complete"; the body carries the details.
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateDetail, children: t("update.doneDetail") }), _jsx("p", { className: css.updateDetail, children: t("update.restartHint") })] }));
+    }
+    const message = errorMessageOf(t, result);
+    return (_jsxs("div", { children: [_jsx("p", { className: css.updateError, children: message }), result.output.trim() !== "" && _jsx("pre", { className: css.updateOutput, children: result.output.trim() })] }));
+}
+/** Translate a structured failure code; fall back to the raw message. */
+function errorMessageOf(t, result) {
+    switch (result.errorCode) {
+        case "pnpm-missing": return t("update.error.pnpmMissing");
+        case "timeout": return t("update.error.timeout");
+        case "not-found": return t("update.error.notFound");
+        case "link": return t("update.error.link");
+        case "pnpm-failed": return t("update.error.pnpmFailed", { code: String(result.exitCode ?? "?") });
+        default: return result.error ?? t("update.error.unknown");
+    }
+}

package/lib/types/client/index.d.ts

@@ -5,6 +5,8 @@ export type { PanelState, RemotePanelProps } from './RemotePanel.tsx';
 export type { PairFailedNoticeProps } from './PairFailedNotice.tsx';
 export type { RemoteKey } from './locales.ts';
 export type { RemoteSettingsCardFace, RemoteSettingsCardState } from './RemoteSettingsCard.tsx';
+export type { UpdateEntryProps } from './UpdateEntry.tsx';
+export type { UpdatePanelProps, UpdateView } from './UpdatePanel.tsx';
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
         /** Mobile remote-control surface copy. */

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAa3E,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAIrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACnE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAE/F,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0CAA0C;QAC1C,MAAM,EAAE,SAAS,CAAA;KAClB;IAED,UAAU,OAAO;QACf;;;;WAIG;QACH,gBAAgB,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,uBAAuB,CAAA;SAAE,CAAA;QACnF;;;;;WAKG;QACH,oBAAoB,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,4BAA4B,CAAA;SAAE,CAAA;KAC3F;CACF;AAED,4GAA4G;AAC5G,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,KAAK,CAAA;CACjB;AAWD,wCAAwC;AACxC,eAAO,MAAM,MAAM,UAA+D,CAAA;AAElF;;;GAGG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAyG9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAa3E,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAIrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACnE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAC/F,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAErE,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0CAA0C;QAC1C,MAAM,EAAE,SAAS,CAAA;KAClB;IAED,UAAU,OAAO;QACf;;;;WAIG;QACH,gBAAgB,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,uBAAuB,CAAA;SAAE,CAAA;QACnF;;;;;WAKG;QACH,oBAAoB,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,4BAA4B,CAAA;SAAE,CAAA;KAC3F;CACF;AAED,4GAA4G;AAC5G,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,KAAK,CAAA;CACjB;AAWD,wCAAwC;AACxC,eAAO,MAAM,MAAM,UAA+D,CAAA;AAElF;;;GAGG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAyG9C"}

package/lib/types/client/locales.d.ts

@@ -68,6 +68,34 @@ export declare const zh: {
     'settings.unsaved': string;
     'settings.saveFailed': string;
     'settings.invalidNumber': string;
+    'update.label': string;
+    'update.title': string;
+    'update.checking': string;
+    'update.upToDate': string;
+    'update.upToDateDetail': string;
+    'update.found': string;
+    'update.foundDetail': string;
+    'update.updating': string;
+    'update.updatingTitle': string;
+    'update.done': string;
+    'update.doneDetail': string;
+    'update.restartHint': string;
+    'update.linkMode': string;
+    'update.linkModeDetail': string;
+    'update.missing': string;
+    'update.missingDetail': string;
+    'update.offline': string;
+    'update.offlineDetail': string;
+    'update.error': string;
+    'update.packages': string;
+    'update.retry': string;
+    'update.close': string;
+    'update.error.pnpmMissing': string;
+    'update.error.timeout': string;
+    'update.error.notFound': string;
+    'update.error.link': string;
+    'update.error.pnpmFailed': string;
+    'update.error.unknown': string;
 };
 /** The remote namespace key union. */
 export type RemoteKey = keyof typeof zh;
@@ -142,5 +170,33 @@ export declare const en: {
     'settings.unsaved': string;
     'settings.saveFailed': string;
     'settings.invalidNumber': string;
+    'update.label': string;
+    'update.title': string;
+    'update.checking': string;
+    'update.upToDate': string;
+    'update.upToDateDetail': string;
+    'update.found': string;
+    'update.foundDetail': string;
+    'update.updating': string;
+    'update.updatingTitle': string;
+    'update.done': string;
+    'update.doneDetail': string;
+    'update.restartHint': string;
+    'update.linkMode': string;
+    'update.linkModeDetail': string;
+    'update.missing': string;
+    'update.missingDetail': string;
+    'update.offline': string;
+    'update.offlineDetail': string;
+    'update.error': string;
+    'update.packages': string;
+    'update.retry': string;
+    'update.close': string;
+    'update.error.pnpmMissing': string;
+    'update.error.timeout': string;
+    'update.error.notFound': string;
+    'update.error.link': string;
+    'update.error.pnpmFailed': string;
+    'update.error.unknown': string;
 };
 //# sourceMappingURL=locales.d.ts.map

package/lib/types/client/locales.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqEsB,CAAA"}
+{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkGmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkGsB,CAAA"}

package/lib/types/client/locales.js

@@ -69,6 +69,35 @@ export const zh = {
     'settings.unsaved': '未保存',
     'settings.saveFailed': '部署未接受这些值，已保留供你修改。',
     'settings.invalidNumber': '请输入数字，留空则使用默认值。',
+    // 更新面板（侧边栏更新按钮）。
+    'update.label': '检查更新',
+    'update.title': '检查更新',
+    'update.checking': '正在检查远程仓库中的新版本…',
+    'update.upToDate': '当前已是最新版本',
+    'update.upToDateDetail': '{name} 已是最新版本 v{version}。',
+    'update.found': '发现新版本',
+    'update.foundDetail': '{name} 有新版本 v{version}，正在自动更新…',
+    'update.updating': '正在更新 {name} 至 v{version}，可能需要 1-2 分钟…',
+    'update.updatingTitle': '正在自动更新…',
+    'update.done': '更新完成',
+    'update.doneDetail': '所有组件已更新到最新版本。',
+    'update.restartHint': '请重启 dsh web 使新版本生效：在终端按 Ctrl+C 停止后重新运行 dsh web。',
+    'update.linkMode': '当前为本地开发模式',
+    'update.linkModeDetail': 'dsh-web-ui 通过本地链接安装（开发模式），无法自动更新。npm 上最新版本：{version}。请在仓库中执行 git pull 更新。',
+    'update.missing': '未找到 dsh-web-ui 安装',
+    'update.missingDetail': '无法定位已安装的 dsh-web-ui 聚合包。请先运行 dsh plugin --profile <profile> add @linxin666/dsh-web-ui-all。',
+    'update.offline': '无法连接更新源',
+    'update.offlineDetail': '网络不可用或更新服务异常，请稍后重试。',
+    'update.error': '更新失败',
+    'update.packages': '组件版本',
+    'update.retry': '重新检查',
+    'update.close': '关闭更新面板',
+    'update.error.pnpmMissing': '未找到 pnpm，请先安装 pnpm（brew install pnpm 或 corepack enable）。',
+    'update.error.timeout': '更新超时，已终止安装进程，请重试。',
+    'update.error.notFound': '未找到 dsh-web-ui 聚合包安装，无法更新。',
+    'update.error.link': '当前为本地开发模式（链接安装），无法自动更新。',
+    'update.error.pnpmFailed': '更新执行失败（pnpm 退出码 {code}），详见下方输出。',
+    'update.error.unknown': '更新失败，请重试。',
 };
 /** English dictionary, checked complete against the zh key set. */
 export const en = {
@@ -140,4 +169,33 @@ export const en = {
     'settings.unsaved': 'Unsaved',
     'settings.saveFailed': 'The deployment did not accept these values; they were left for you to correct.',
     'settings.invalidNumber': 'Enter a number, or leave blank to use the default.',
+    // Update panel (the sidebar update trigger).
+    'update.label': 'Check for updates',
+    'update.title': 'Check for updates',
+    'update.checking': 'Checking the remote repository for newer releases…',
+    'update.upToDate': 'Everything is up to date',
+    'update.upToDateDetail': '{name} is at the latest version v{version}.',
+    'update.found': 'A new version is available',
+    'update.foundDetail': '{name} has a newer release v{version}; updating automatically…',
+    'update.updating': 'Updating {name} to v{version}; this may take 1-2 minutes…',
+    'update.updatingTitle': 'Updating automatically…',
+    'update.done': 'Update complete',
+    'update.doneDetail': 'All components are up to date.',
+    'update.restartHint': 'Restart dsh web for the new version to take effect: stop it with Ctrl+C in the terminal, then run dsh web again.',
+    'update.linkMode': 'Local development mode',
+    'update.linkModeDetail': 'dsh-web-ui is installed via a local link (development mode) and cannot be updated remotely. Latest npm release: {version}. Run git pull in the repository to update.',
+    'update.missing': 'dsh-web-ui not found',
+    'update.missingDetail': 'Could not locate the installed dsh-web-ui aggregate package. Install it with: dsh plugin --profile <profile> add @linxin666/dsh-web-ui-all',
+    'update.offline': 'Cannot reach the update source',
+    'update.offlineDetail': 'The network is unavailable or the update service is failing; try again later.',
+    'update.error': 'Update failed',
+    'update.packages': 'Component versions',
+    'update.retry': 'Check again',
+    'update.close': 'Close update panel',
+    'update.error.pnpmMissing': 'pnpm was not found. Install it first (brew install pnpm or corepack enable).',
+    'update.error.timeout': 'The update timed out and the install process was killed; try again.',
+    'update.error.notFound': 'The dsh-web-ui aggregate package is not installed; nothing to update.',
+    'update.error.link': 'Local development mode (link install) — automatic update is unavailable.',
+    'update.error.pnpmFailed': 'The update failed (pnpm exited with code {code}); see the output below.',
+    'update.error.unknown': 'Update failed; try again.',
 };

package/lib/types/client/update-api.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Browser-side wire helpers for the /api/update surface. Plain fetch over
+ * same-origin /api like the pairing client; the host half enforces the
+ * loopback-only fence and owns the pnpm run.
+ */
+import type { UpdateRunResult, UpdateStatus } from '../update.ts';
+/**
+ * Probe the update status: install mode, owning profile, and the
+ * current-vs-latest comparison for every family package.
+ * @returns the status snapshot.
+ */
+export declare function fetchUpdateStatus(): Promise<UpdateStatus>;
+/**
+ * Run the update (pnpm update in the owning profile). Blocks until pnpm
+ * exits — the panel shows an in-flight state meanwhile.
+ * @returns the run outcome.
+ */
+export declare function runUpdate(): Promise<UpdateRunResult>;
+//# sourceMappingURL=update-api.d.ts.map

package/lib/types/client/update-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-api.d.ts","sourceRoot":"","sources":["../../../src/client/update-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEjE;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,YAAY,CAAC,CAI/D;AAED;;;;GAIG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC,CAI1D"}

package/lib/types/client/update-api.js

@@ -0,0 +1,27 @@
+/**
+ * Browser-side wire helpers for the /api/update surface. Plain fetch over
+ * same-origin /api like the pairing client; the host half enforces the
+ * loopback-only fence and owns the pnpm run.
+ */
+/**
+ * Probe the update status: install mode, owning profile, and the
+ * current-vs-latest comparison for every family package.
+ * @returns the status snapshot.
+ */
+export async function fetchUpdateStatus() {
+    const response = await fetch('/api/update/status');
+    if (!response.ok)
+        throw new Error('update status unavailable');
+    return await response.json();
+}
+/**
+ * Run the update (pnpm update in the owning profile). Blocks until pnpm
+ * exits — the panel shows an in-flight state meanwhile.
+ * @returns the run outcome.
+ */
+export async function runUpdate() {
+    const response = await fetch('/api/update/run', { method: 'POST' });
+    if (!response.ok)
+        throw new Error('update run unavailable');
+    return await response.json();
+}

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,CAAC,MAAM,aAAa,CAAA;AAU3B,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;WAKG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA4B,CAAA;AAE/C;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,uDAAqC,CAAA;AAElF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAS3B,CAAA;AAwBF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CA8JzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,CAAC,MAAM,aAAa,CAAA;AAmB3B,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;WAKG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA4B,CAAA;AAE/C;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,uDAAqC,CAAA;AAElF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAS3B,CAAA;AAwBF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAsMzD"}

package/lib/types/index.js

@@ -7,16 +7,19 @@
  * `./client` entry) renders the sidebar entry, the pairing panel, and the
  * phone-side pair/accept + deep-link flow.
  */
+import { createRequire } from 'node:module';
 import { setInterval as nodeSetInterval } from 'node:timers';
 import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings';
 import z from 'schemastery';
 import { PairingService } from "./pairing.js";
 import { makeGateListener } from "./gate.js";
-import { makeRoutes } from "./routes.js";
+import { isTrustedApiRequest, makeRoutes } from "./routes.js";
 import { makeMobileRoutes } from "./mobile-routes.js";
 import { makeMobileApiRoutes } from "./mobile-api.js";
 import { lanIPv4Addresses } from "./lan.js";
 import { TunnelManager } from "./tunnel.js";
+import { checkUpdates, fetchLatestVersion, resolveAnchorManifest, resolveUpdateTarget, runUpdate, } from "./update.js";
+import { makeUpdateRoutes } from "./update-routes.js";
 /** Stable cordis plugin name. */
 export const name = 'remote-web-ui';
 /** Services required before the pairing surfaces can mount. */
@@ -143,10 +146,51 @@ export function apply(ctx, config) {
     if (apiProxy === undefined) {
         console.warn('remote-web-ui: apiProxy service unavailable — the mobile data channel is disabled');
     }
+    // ── remote update ────────────────────────────────────────────────────────
+    // The dsh-web-ui self-update surface: probe the npm registry for family
+    // releases and run `pnpm update` in the owning profile. Resolutions anchor
+    // on the host process's own module graph, so the update always targets the
+    // profile the running web GUI was booted from. The probe path resolves once
+    // (the anchor stays the same package across updates); versions are re-read
+    // from disk per check.
+    const requireFromHost = createRequire(import.meta.url);
+    const anchorManifestPath = resolveAnchorManifest(specifier => requireFromHost.resolve(specifier));
+    const updateRoutes = makeUpdateRoutes({
+        // Control endpoints are host-surface only: a LAN/phone origin must never
+        // trigger a real install on this machine.
+        fence: request => isTrustedApiRequest(request, []),
+        check: () => checkUpdates({
+            anchorManifestPath,
+            resolve: specifier => {
+                try {
+                    return requireFromHost.resolve(specifier);
+                }
+                catch {
+                    return undefined;
+                }
+            },
+            fetchLatest: name => fetchLatestVersion(name, fetch),
+        }),
+        run: async () => {
+            const target = resolveUpdateTarget({ anchorManifestPath });
+            if ('error' in target) {
+                const code = target.error;
+                return {
+                    ok: false,
+                    exitCode: null,
+                    output: '',
+                    error: code === 'not-found' ? 'dsh-web-ui aggregate not installed' : 'local link install — update unavailable',
+                    errorCode: code,
+                };
+            }
+            return runUpdate({ profileDir: target.profileDir, packages: target.packages });
+        },
+    });
     const routes = [
         ...makeRoutes({ service, lanAddresses }),
         ...makeMobileRoutes(),
         ...(apiProxy !== undefined ? makeMobileApiRoutes({ service, apiProxy }) : []),
+        ...updateRoutes,
     ];
     const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
     ctx.effect(() => ctx.on('api/gate', gate), 'remote-web-ui: api gate');

package/lib/types/routes.d.ts

@@ -10,6 +10,21 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
 import { type PairingService, type PairingSnapshot } from './pairing.ts';
+/**
+ * Browser-trust fence for the /api/pair routes, mirroring the connection
+ * package's internal fence semantics (Host/Origin based, DNS-rebinding and
+ * cross-site defense). The connection package no longer exports its trust
+ * predicate — the fence for the /api prefix lives inside the connection
+ * plugin — so the pairing routes, which must stay reachable from LAN phones
+ * ahead of the connection prefix route (exact routes match first), carry
+ * their own copy scoped to the literals the QR links advertise.
+ * @param request - the node HTTP request.
+ * @param trustedHosts - non-loopback authorities this surface serves: exact
+ * `host:port`, or port-less `host` matching any port.
+ * @returns true when the Host is ours (loopback or trusted) and any attached
+ * browser markers are same-origin.
+ */
+export declare function isTrustedApiRequest(request: IncomingMessage, trustedHosts: readonly string[]): boolean;
 /**
  * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
  * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —

package/lib/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAmDhG;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;CAOb,CAAA;AAiCV,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAgK3D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAGhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;CAOb,CAAA;AAiCV,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAgK3D"}

package/lib/types/routes.js

@@ -23,7 +23,7 @@ import { isLoopbackClient, readCookie } from "./gate.js";
  * @returns true when the Host is ours (loopback or trusted) and any attached
  * browser markers are same-origin.
  */
-function isTrustedApiRequest(request, trustedHosts) {
+export function isTrustedApiRequest(request, trustedHosts) {
     const host = request.headers.host;
     if (typeof host !== 'string')
         return false;

package/lib/types/update-routes.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The /api/update route family: the status probe and the update run. Both
+ * are loopback-only control surfaces — the run endpoint triggers a real
+ * pnpm install inside the owning profile, so it must never be reachable
+ * from a LAN/phone origin.
+ */
+import type { IncomingMessage } from 'node:http';
+import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+import type { UpdateRunResult, UpdateStatus } from './update.ts';
+/** Route paths (exact matches under /api). */
+export declare const UPDATE_PATHS: {
+    readonly status: "/api/update/status";
+    readonly run: "/api/update/run";
+};
+/** Route-family dependencies (test seam). */
+export interface UpdateRoutesDeps {
+    /** Loopback-only fence: the control endpoints are host-surface only. */
+    fence(request: IncomingMessage): boolean;
+    /** Probe registry versions and report the comparison. */
+    check(): Promise<UpdateStatus>;
+    /** Run the pnpm update (resolves when pnpm exits). */
+    run(): Promise<UpdateRunResult>;
+}
+/**
+ * Build the /api/update route family.
+ * @param deps - fence + check/run seams.
+ * @returns the exact routes to register on webServer.
+ */
+export declare function makeUpdateRoutes(deps: UpdateRoutesDeps): WebRoute[];
+//# sourceMappingURL=update-routes.d.ts.map

package/lib/types/update-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-routes.d.ts","sourceRoot":"","sources":["../../src/update-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAEhE,8CAA8C;AAC9C,eAAO,MAAM,YAAY;;;CAGf,CAAA;AAEV,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,KAAK,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAA;IACxC,yDAAyD;IACzD,KAAK,IAAI,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9B,sDAAsD;IACtD,GAAG,IAAI,OAAO,CAAC,eAAe,CAAC,CAAA;CAChC;AASD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,QAAQ,EAAE,CA+BnE"}

package/lib/types/update-routes.js

@@ -0,0 +1,52 @@
+/**
+ * The /api/update route family: the status probe and the update run. Both
+ * are loopback-only control surfaces — the run endpoint triggers a real
+ * pnpm install inside the owning profile, so it must never be reachable
+ * from a LAN/phone origin.
+ */
+/** Route paths (exact matches under /api). */
+export const UPDATE_PATHS = {
+    status: '/api/update/status',
+    run: '/api/update/run',
+};
+/** One JSON response. */
+function writeJson(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' });
+    res.end(payload);
+}
+/**
+ * Build the /api/update route family.
+ * @param deps - fence + check/run seams.
+ * @returns the exact routes to register on webServer.
+ */
+export function makeUpdateRoutes(deps) {
+    const handleStatus = async (req, res) => {
+        if (req.method !== 'GET') {
+            res.writeHead(405, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('method not allowed');
+            return;
+        }
+        if (!deps.fence(req)) {
+            writeJson(res, 403, { ok: false, code: "forbidden" });
+            return;
+        }
+        writeJson(res, 200, await deps.check());
+    };
+    const handleRun = async (req, res) => {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('method not allowed');
+            return;
+        }
+        if (!deps.fence(req)) {
+            writeJson(res, 403, { ok: false, code: "forbidden" });
+            return;
+        }
+        writeJson(res, 200, await deps.run());
+    };
+    return [
+        { kind: 'exact', path: UPDATE_PATHS.status, handler: handleStatus },
+        { kind: 'exact', path: UPDATE_PATHS.run, handler: handleRun },
+    ];
+}