@linxin666/dsh-remote-web-ui 0.1.10 → 0.1.11

package/lib/types/update.d.ts

@@ -0,0 +1,191 @@
+/**
+ * Remote update support for the dsh-web-ui family — host half. Detects the
+ * installed aggregate package (@linxin666/dsh-web-ui-all) and its family
+ * children, probes the npm registry for newer releases, and runs the actual
+ * update as `pnpm update` inside the owning dsh profile directory.
+ *
+ * Pure logic with injected seams (manifest reading, registry fetches, process
+ * spawning) so the whole surface is unit-testable without touching disk,
+ * network, or a real profile.
+ */
+import { spawn } from 'node:child_process';
+/** npm registry base used for version probes. */
+export declare const NPM_REGISTRY = "https://registry.npmjs.org";
+/** The family scope every dsh-web-ui package is published under. */
+export declare const FAMILY_SCOPE = "@linxin666/";
+/** The aggregate package that is the canonical update entry point. */
+export declare const AGGREGATE_PACKAGE = "@linxin666/dsh-web-ui-all";
+/** Fallback anchor: this plugin's own package when the aggregate is absent. */
+export declare const SELF_PACKAGE = "@linxin666/dsh-remote-web-ui";
+/** A parsed semantic version (prerelease identifiers kept as strings). */
+export interface SemverParts {
+    major: number;
+    minor: number;
+    patch: number;
+    /** Dot-split prerelease identifiers; empty when absent. */
+    prerelease: string[];
+}
+/**
+ * Parse a semantic version string (leading `v` tolerated, build metadata
+ * ignored). Returns undefined for unparseable input.
+ * @param value - the version string, e.g. `0.1.10` or `0.1.11-rc.1`.
+ * @returns the parsed parts, or undefined.
+ */
+export declare function parseSemver(value: string): SemverParts | undefined;
+/**
+ * Compare two semantic versions per the semver precedence rules (a release
+ * outranks any of its prereleases; numeric prerelease identifiers compare
+ * numerically and sort below alphanumeric ones). An unparseable version sorts
+ * below every parseable one; two unparseable versions compare equal.
+ * @param a - first version.
+ * @param b - second version.
+ * @returns negative when a < b, 0 when equal, positive when a > b.
+ */
+export declare function compareVersions(a: string, b: string): number;
+/** The found dsh profile owning an installed package. */
+export interface FoundProfile {
+    /** Profile name (e.g. `web`). */
+    name: string;
+    /** Absolute profile directory. */
+    dir: string;
+}
+/**
+ * Locate the owning dsh profile by walking up from an installed package's
+ * manifest until a manifest named `dsh-profile-*` appears (the profile
+ * directory is the first ancestor whose package.json carries that name).
+ * @param anchorManifestPath - absolute path of the anchor package.json.
+ * @returns the profile name/dir, or undefined when not profile-installed.
+ */
+export declare function findProfile(anchorManifestPath: string): FoundProfile | undefined;
+/** A package version spec in a manifest dependencies map. */
+type DependencySpec = string | {
+    version: string;
+} | undefined;
+/** Whether a dependency spec is a local link/file/dev-mode install. */
+export declare function isLinkedSpec(spec: DependencySpec): boolean;
+/** One package's current-vs-latest comparison. */
+export interface UpdatePackageStatus {
+    /** Package name. */
+    name: string;
+    /** Locally installed version. */
+    current: string;
+    /** Latest npm release — undefined when the registry probe failed. */
+    latest?: string;
+    /** Whether npm carries a strictly newer release. */
+    outdated: boolean;
+}
+/** The full update-status snapshot served to the browser half. */
+export interface UpdateStatus {
+    /** npm = registry-managed (updatable); link = local dev install; missing = no anchor package. */
+    mode: 'npm' | 'link' | 'missing';
+    /** Owning profile name (npm mode). */
+    profileName?: string;
+    /** The anchor package the update targets. */
+    anchor?: string;
+    /** Per-package version comparison (anchor first). */
+    packages: UpdatePackageStatus[];
+    /** True when any package has a newer npm release. */
+    outdated: boolean;
+    /** Whole-check failure (e.g. registry unreachable). */
+    error?: string;
+}
+/** Dependency-injection seam for checkUpdates (testable without network). */
+export interface UpdateCheckDeps {
+    /** Absolute path of the anchor package manifest, when resolvable. */
+    anchorManifestPath?: string;
+    /** Resolve a package.json specifier to its absolute path (host require). */
+    resolve(specifier: string): string | undefined;
+    /** Probe one package's latest npm version; undefined on failure. */
+    fetchLatest(name: string): Promise<string | undefined>;
+}
+/**
+ * Resolve the anchor package's manifest path. The aggregate package is the
+ * canonical entry point; this plugin's own package is the fallback.
+ * @param resolve - a Node resolve implementation scoped to the host process.
+ * @returns the absolute manifest path, or undefined when neither is installed.
+ */
+export declare function resolveAnchorManifest(resolve: (specifier: string) => string): string | undefined;
+/** The resolved update target: the profile pnpm runs in plus the package list. */
+export interface UpdateTarget {
+    /** Owning profile name. */
+    profileName: string;
+    /** Absolute profile directory pnpm runs in. */
+    profileDir: string;
+    /** The package names pnpm updates (anchor first). */
+    packages: string[];
+}
+/**
+ * Resolve what an update would touch: the owning profile directory and the
+ * family package list. Fails with an error code when the anchor is missing
+ * ('not-found') or is a local dev install ('link').
+ * @param deps - the anchor manifest path (resolveAnchorManifest output).
+ * @returns the target, or the failure code.
+ */
+export declare function resolveUpdateTarget(deps: {
+    anchorManifestPath?: string;
+}): UpdateTarget | {
+    error: 'not-found' | 'link';
+};
+/** Family children of the anchor: its dependencies under the family scope. */
+export declare function familyChildren(anchorManifest: Record<string, unknown>): string[];
+/**
+ * Probe the npm registry for one package's latest release.
+ * @param name - the package name (scope slash URL-encoded).
+ * @param fetchImpl - the fetch implementation (global fetch in the host).
+ * @param timeoutMs - probe timeout.
+ * @returns the latest version string, or undefined on any failure.
+ */
+export declare function fetchLatestVersion(name: string, fetchImpl: (url: string) => Promise<{
+    ok: boolean;
+    json(): Promise<unknown>;
+}>, timeoutMs?: number): Promise<string | undefined>;
+/**
+ * Build the update status: locate the anchor, detect the install mode, and
+ * compare every family package against the npm registry.
+ * @param deps - manifest resolution + registry probe seams.
+ * @returns the status snapshot.
+ */
+export declare function checkUpdates(deps: UpdateCheckDeps): Promise<UpdateStatus>;
+/** Structured failure codes the browser half translates. */
+export type UpdateErrorCode = 
+/** pnpm is not on PATH. */
+'pnpm-missing'
+/** The install exceeded the hard timeout. */
+ | 'timeout'
+/** The anchor package is not installed. */
+ | 'not-found'
+/** The anchor is a local link/dev install pnpm cannot update. */
+ | 'link'
+/** pnpm exited non-zero. */
+ | 'pnpm-failed';
+/** Result of one update run. */
+export interface UpdateRunResult {
+    ok: boolean;
+    /** pnpm exit code (null when the process never started or was killed). */
+    exitCode: number | null;
+    /** Captured pnpm output tail (diagnostics for the panel). */
+    output: string;
+    /** Human-readable failure description (fallback copy). */
+    error?: string;
+    /** Structured failure code (translated by the browser half). */
+    errorCode?: UpdateErrorCode;
+}
+/** Dependency-injection seam for runUpdate. */
+export interface UpdateRunDeps {
+    /** The profile directory pnpm runs in. */
+    profileDir: string;
+    /** The package names pnpm updates. */
+    packages: readonly string[];
+    /** Spawn seam (defaults to child_process.spawn). */
+    spawnImpl?: typeof spawn;
+    /** Hard timeout; the child is killed on expiry. */
+    timeoutMs?: number;
+}
+/**
+ * Run the update: `pnpm update <packages>` inside the profile directory.
+ * @param deps - profile dir, package list, and spawn/timeout seams.
+ * @returns the outcome with captured output.
+ */
+export declare function runUpdate(deps: UpdateRunDeps): Promise<UpdateRunResult>;
+export {};
+//# sourceMappingURL=update.d.ts.map

package/lib/types/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GACrC,MAAM,GAAG,SAAS,CASpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAaD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa,CAAA;AAEjB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAKD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAuCvE"}

package/lib/types/update.js

@@ -0,0 +1,333 @@
+/**
+ * Remote update support for the dsh-web-ui family — host half. Detects the
+ * installed aggregate package (@linxin666/dsh-web-ui-all) and its family
+ * children, probes the npm registry for newer releases, and runs the actual
+ * update as `pnpm update` inside the owning dsh profile directory.
+ *
+ * Pure logic with injected seams (manifest reading, registry fetches, process
+ * spawning) so the whole surface is unit-testable without touching disk,
+ * network, or a real profile.
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { spawn } from 'node:child_process';
+/** npm registry base used for version probes. */
+export const NPM_REGISTRY = 'https://registry.npmjs.org';
+/** The family scope every dsh-web-ui package is published under. */
+export const FAMILY_SCOPE = '@linxin666/';
+/** The aggregate package that is the canonical update entry point. */
+export const AGGREGATE_PACKAGE = '@linxin666/dsh-web-ui-all';
+/** Fallback anchor: this plugin's own package when the aggregate is absent. */
+export const SELF_PACKAGE = '@linxin666/dsh-remote-web-ui';
+/** A profile manifest `name` prefix (e.g. `dsh-profile-web`). */
+const PROFILE_NAME_PREFIX = 'dsh-profile-';
+/** How many ancestor directories a profile search walks before giving up. */
+const PROFILE_WALK_DEPTH = 12;
+/**
+ * Parse a semantic version string (leading `v` tolerated, build metadata
+ * ignored). Returns undefined for unparseable input.
+ * @param value - the version string, e.g. `0.1.10` or `0.1.11-rc.1`.
+ * @returns the parsed parts, or undefined.
+ */
+export function parseSemver(value) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value.trim());
+    if (match === null)
+        return undefined;
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2]),
+        patch: Number(match[3]),
+        prerelease: match[4] === undefined ? [] : match[4].split('.'),
+    };
+}
+/**
+ * Compare two semantic versions per the semver precedence rules (a release
+ * outranks any of its prereleases; numeric prerelease identifiers compare
+ * numerically and sort below alphanumeric ones). An unparseable version sorts
+ * below every parseable one; two unparseable versions compare equal.
+ * @param a - first version.
+ * @param b - second version.
+ * @returns negative when a < b, 0 when equal, positive when a > b.
+ */
+export function compareVersions(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (pa === undefined && pb === undefined)
+        return 0;
+    if (pa === undefined)
+        return -1;
+    if (pb === undefined)
+        return 1;
+    for (const key of ['major', 'minor', 'patch']) {
+        if (pa[key] !== pb[key])
+            return pa[key] < pb[key] ? -1 : 1;
+    }
+    if (pa.prerelease.length === 0 && pb.prerelease.length === 0)
+        return 0;
+    if (pa.prerelease.length === 0)
+        return 1;
+    if (pb.prerelease.length === 0)
+        return -1;
+    for (let index = 0; index < Math.max(pa.prerelease.length, pb.prerelease.length); index++) {
+        const ra = pa.prerelease[index];
+        const rb = pb.prerelease[index];
+        if (ra === undefined)
+            return -1;
+        if (rb === undefined)
+            return 1;
+        if (ra === rb)
+            continue;
+        const numericA = /^\d+$/.test(ra);
+        const numericB = /^\d+$/.test(rb);
+        if (numericA && numericB)
+            return Number(ra) < Number(rb) ? -1 : 1;
+        // Numeric identifiers always sort below alphanumeric ones.
+        if (numericA)
+            return -1;
+        if (numericB)
+            return 1;
+        return ra < rb ? -1 : 1;
+    }
+    return 0;
+}
+/** Read a package.json at a path, tolerating any parse/IO failure. */
+function readManifest(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return typeof parsed === 'object' && parsed !== null ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Locate the owning dsh profile by walking up from an installed package's
+ * manifest until a manifest named `dsh-profile-*` appears (the profile
+ * directory is the first ancestor whose package.json carries that name).
+ * @param anchorManifestPath - absolute path of the anchor package.json.
+ * @returns the profile name/dir, or undefined when not profile-installed.
+ */
+export function findProfile(anchorManifestPath) {
+    let dir = dirname(anchorManifestPath);
+    for (let depth = 0; depth < PROFILE_WALK_DEPTH; depth++) {
+        const manifest = readManifest(join(dir, 'package.json'));
+        const name = manifest?.name;
+        if (typeof name === 'string' && name.startsWith(PROFILE_NAME_PREFIX)) {
+            return { name: name.slice(PROFILE_NAME_PREFIX.length), dir };
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+    return undefined;
+}
+/** Whether a dependency spec is a local link/file/dev-mode install. */
+export function isLinkedSpec(spec) {
+    if (typeof spec !== 'string')
+        return false;
+    return /^(?:link|file):|^\.{1,2}(?:[/\\]|$)/.test(spec);
+}
+/**
+ * Resolve the anchor package's manifest path. The aggregate package is the
+ * canonical entry point; this plugin's own package is the fallback.
+ * @param resolve - a Node resolve implementation scoped to the host process.
+ * @returns the absolute manifest path, or undefined when neither is installed.
+ */
+export function resolveAnchorManifest(resolve) {
+    for (const name of [AGGREGATE_PACKAGE, SELF_PACKAGE]) {
+        try {
+            return resolve(name + '/package.json');
+        }
+        catch {
+            // Not installed — try the next candidate.
+        }
+    }
+    return undefined;
+}
+/**
+ * Resolve what an update would touch: the owning profile directory and the
+ * family package list. Fails with an error code when the anchor is missing
+ * ('not-found') or is a local dev install ('link').
+ * @param deps - the anchor manifest path (resolveAnchorManifest output).
+ * @returns the target, or the failure code.
+ */
+export function resolveUpdateTarget(deps) {
+    const manifestPath = deps.anchorManifestPath;
+    if (manifestPath === undefined)
+        return { error: 'not-found' };
+    const manifest = readManifest(manifestPath);
+    if (manifest === undefined)
+        return { error: 'not-found' };
+    const anchor = typeof manifest.name === 'string' ? manifest.name : undefined;
+    if (anchor === undefined)
+        return { error: 'not-found' };
+    const profile = findProfile(manifestPath);
+    if (profile === undefined)
+        return { error: 'link' };
+    const profileManifest = readManifest(join(profile.dir, 'package.json'));
+    const spec = profileManifest?.dependencies?.[anchor];
+    if (isLinkedSpec(spec))
+        return { error: 'link' };
+    return {
+        profileName: profile.name,
+        profileDir: profile.dir,
+        packages: [anchor, ...familyChildren(manifest)],
+    };
+}
+/** Family children of the anchor: its dependencies under the family scope. */
+export function familyChildren(anchorManifest) {
+    const dependencies = anchorManifest.dependencies;
+    if (typeof dependencies !== 'object' || dependencies === null)
+        return [];
+    const names = [];
+    for (const [name, spec] of Object.entries(dependencies)) {
+        if (name.startsWith(FAMILY_SCOPE) && typeof spec === 'string')
+            names.push(name);
+    }
+    return names;
+}
+/**
+ * Probe the npm registry for one package's latest release.
+ * @param name - the package name (scope slash URL-encoded).
+ * @param fetchImpl - the fetch implementation (global fetch in the host).
+ * @param timeoutMs - probe timeout.
+ * @returns the latest version string, or undefined on any failure.
+ */
+export async function fetchLatestVersion(name, fetchImpl, timeoutMs = 10_000) {
+    try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+        try {
+            const response = await fetchImpl(NPM_REGISTRY + '/' + name.replace('/', '%2F') + '/latest');
+            if (!response.ok)
+                return undefined;
+            const body = await response.json();
+            if (typeof body !== 'object' || body === null)
+                return undefined;
+            const version = body.version;
+            return typeof version === 'string' ? version : undefined;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The resolved current version of one family package (probe failure tolerated). */
+function readInstalledVersion(resolve, name) {
+    try {
+        const path = resolve(name + '/package.json');
+        const version = path === undefined ? undefined : readManifest(path)?.version;
+        return typeof version === 'string' ? version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/**
+ * Build the update status: locate the anchor, detect the install mode, and
+ * compare every family package against the npm registry.
+ * @param deps - manifest resolution + registry probe seams.
+ * @returns the status snapshot.
+ */
+export async function checkUpdates(deps) {
+    const manifestPath = deps.anchorManifestPath;
+    if (manifestPath === undefined) {
+        return { mode: 'missing', packages: [], outdated: false };
+    }
+    const manifest = readManifest(manifestPath);
+    if (manifest === undefined) {
+        return { mode: 'missing', packages: [], outdated: false };
+    }
+    const anchor = typeof manifest.name === 'string' ? manifest.name : undefined;
+    if (anchor === undefined) {
+        return { mode: 'missing', packages: [], outdated: false };
+    }
+    // A package inside a dsh profile directory is a registry install; one that
+    // lives outside every profile (e.g. a repo checkout wired through
+    // link-profile.mjs) is a local dev install pnpm cannot update.
+    const profile = findProfile(manifestPath);
+    const profileManifest = profile === undefined ? undefined : readManifest(join(profile.dir, "package.json"));
+    const linked = profile === undefined
+        || isLinkedSpec(profileManifest?.dependencies?.[anchor]);
+    if (profile === undefined) {
+        return { mode: 'link', packages: [], outdated: false };
+    }
+    const names = [anchor, ...familyChildren(manifest)];
+    const packages = [];
+    let probeFailures = 0;
+    for (const name of names) {
+        const latest = await deps.fetchLatest(name);
+        if (latest === undefined)
+            probeFailures++;
+        const current = readInstalledVersion(deps.resolve, name);
+        packages.push({
+            name,
+            current,
+            latest,
+            outdated: latest !== undefined && latest !== current && compareVersions(latest, current) > 0,
+        });
+    }
+    // Registry unreachable: every probe failed — report the outage distinctly
+    // instead of a misleading "all up to date" (the panel needs the reason).
+    const error = probeFailures === names.length && names.length > 0 ? 'registry-unreachable' : undefined;
+    return {
+        mode: linked ? 'link' : 'npm',
+        profileName: profile.name,
+        anchor,
+        packages,
+        outdated: packages.some(packageStatus => packageStatus.outdated),
+        ...(error !== undefined ? { error } : {}),
+    };
+}
+/** Cap on captured pnpm output (keeps error payloads bounded). */
+const OUTPUT_CAP = 16 * 1024;
+/**
+ * Run the update: `pnpm update <packages>` inside the profile directory.
+ * @param deps - profile dir, package list, and spawn/timeout seams.
+ * @returns the outcome with captured output.
+ */
+export function runUpdate(deps) {
+    return new Promise((resolve) => {
+        const child = (deps.spawnImpl ?? spawn)('pnpm', ['update', ...deps.packages], {
+            cwd: deps.profileDir,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let output = '';
+        const append = (chunk) => {
+            output += chunk.toString('utf8');
+            if (output.length > OUTPUT_CAP)
+                output = output.slice(output.length - OUTPUT_CAP);
+        };
+        child.stdout?.on('data', append);
+        child.stderr?.on('data', append);
+        const timer = setTimeout(() => {
+            child.kill('SIGTERM');
+            resolve({ ok: false, exitCode: null, output, error: 'update timed out; install process killed', errorCode: 'timeout' });
+        }, deps.timeoutMs ?? 10 * 60_000);
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            const missing = error.code === 'ENOENT';
+            resolve({
+                ok: false,
+                exitCode: null,
+                output,
+                error: missing ? 'pnpm not found on PATH' : error.message,
+                errorCode: missing ? 'pnpm-missing' : undefined,
+            });
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            resolve({
+                ok: code === 0,
+                exitCode: code,
+                output,
+                error: code === 0 ? undefined : 'pnpm exited with code ' + String(code),
+                ...(code === 0 ? {} : { errorCode: 'pnpm-failed' }),
+            });
+        });
+    });
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Mobile remote control for the dsh web GUI: scan-to-pair QR entry beside the settings button, one-time pairing tokens, live device status, and revocable mobile sessions",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/RemoteEntry.tsx

@@ -1,10 +1,11 @@
 /**
- * The sidebar remote-control seat: the phone-icon trigger beside the
- * settings button plus the pairing panel modal. Owns the panel behavior —
- * token minting on open, the status SSE subscription, stop/refresh/copy —
- * and renders the pure {@link RemotePanel} body. Component-local state per
- * the client stack rules: nothing here survives remounts or crosses
- * entries.
+ * The sidebar remote-control seat: the update trigger plus the phone-icon
+ * trigger beside the settings button, and the pairing panel modal. Owns the
+ * panel behavior — token minting on open, the status SSE subscription,
+ * stop/refresh/copy — and renders the pure {@link RemotePanel} body. The
+ * update seat (the dsh-web-ui self-update flow) rides the same footer row,
+ * rendered by {@link UpdateEntry}. Component-local state per the client
+ * stack rules: nothing here survives remounts or crosses entries.
  */
 import { useCallback, useEffect, useRef, useState } from 'react'
 import { createPortal } from 'react-dom'
@@ -13,6 +14,7 @@ import type { PairingPhase } from '../pairing.ts'
 import { RemotePanel, type PanelState } from './RemotePanel.tsx'
 import { copyText, issuePair, stopPair, type IssueResponse, type PairStateFrame, type TunnelStatusFrame } from './pair-api.ts'
 import { PhoneIcon } from './PhoneIcon.tsx'
+import { UpdateEntry } from './UpdateEntry.tsx'
 import css from './remote.module.css'
 
 /** Entry props: the sidebar column state + the standard locale seat. */
@@ -164,7 +166,10 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
 
   return (
     <>
-      <TooltipAnchor wide={wide} label={t('entry.label')} onClick={openPanel} />
+      <div className={css.entryRow} data-rail={wide ? undefined : 'rail'}>
+        <UpdateEntry wide={wide} t={t} />
+        <TooltipAnchor wide={wide} label={t('entry.label')} onClick={openPanel} />
+      </div>
       {open && createPortal((
         <div className={css.overlay} role="presentation">
           <div className={css.mask} aria-hidden="true" onClick={closePanel} />

package/src/client/UpdateEntry.tsx

@@ -0,0 +1,96 @@
+/**
+ * The sidebar update seat: the download trigger beside the remote-control
+ * trigger plus the update panel modal. Owns the flow — probe the registry
+ * on open, auto-run the update when a newer release exists, report the
+ * outcome (restart hint on success, translated failure on error).
+ * Component-local state per the client stack rules.
+ */
+import { useCallback, useEffect, useRef, useState } from "react"
+import { createPortal } from "react-dom"
+import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'
+import { IconDownloadOutline16 } from '@deepseek-ai/dsh-client-ui-primitives'
+import type { UpdateStatus } from '../update.ts'
+import { fetchUpdateStatus, runUpdate } from "./update-api.ts"
+import { UpdatePanel, type UpdateView } from "./UpdatePanel.tsx"
+import css from "./remote.module.css"
+
+/** Entry props: the sidebar column state + the standard locale seat. */
+export interface UpdateEntryProps {
+  /** Whether the sidebar renders wide content (false = 56px rail). */
+  wide: boolean
+  t: TranslateNS<'remote'>
+}
+
+/**
+ * Render the update trigger and panel.
+ * @param props - column state and locale seat.
+ * @returns the entry element tree.
+ */
+export function UpdateEntry({ wide, t }: UpdateEntryProps) {
+  const [open, setOpen] = useState(false)
+  const [view, setView] = useState<UpdateView>({ kind: "checking" })
+  const runToken = useRef(0)
+
+  const check = useCallback(async (): Promise<void> => {
+    setView({ kind: "checking" })
+    let status: UpdateStatus
+    try {
+      status = await fetchUpdateStatus()
+    } catch {
+      setView({ kind: "error", message: t("update.offline"), detail: t("update.offlineDetail") })
+      return
+    }
+    if (status.error === "registry-unreachable") {
+      setView({ kind: "result", status })
+      return
+    }
+    setView({ kind: "result", status })
+    // Auto-update: an npm install with a newer release proceeds without a
+    // second confirmation — clicking the update trigger is the intent.
+    if (status.mode !== "npm" || !status.outdated) return
+    setView({ kind: "updating", status })
+    const token = ++runToken.current
+    try {
+      const result = await runUpdate()
+      if (token !== runToken.current) return
+      setView({ kind: "done", result })
+    } catch {
+      if (token !== runToken.current) return
+      setView({ kind: "error", message: t("update.error"), detail: t("update.offlineDetail") })
+    }
+  }, [t])
+
+  const openPanel = useCallback((): void => {
+    setOpen(true)
+    void check()
+  }, [check])
+
+  const closePanel = useCallback((): void => {
+    runToken.current++
+    setOpen(false)
+  }, [])
+
+  // Unmount safety: an in-flight update must not land on a dead component.
+  useEffect(() => () => { runToken.current++ }, [])
+
+  return (
+    <>
+      <button
+        type="button"
+        className={css.trigger}
+        data-wide={wide ? undefined : "rail"}
+        aria-label={t("update.label")}
+        title={t("update.label")}
+        onClick={openPanel}
+      >
+        <IconDownloadOutline16 size={wide ? 16 : 18} />
+      </button>
+      {open && createPortal((
+        <div className={css.overlay} role="presentation">
+          <div className={css.mask} aria-hidden="true" onClick={closePanel} />
+          <UpdatePanel t={t} view={view} onClose={closePanel} onRecheck={() => { void check() }} />
+        </div>
+      ), document.body)}
+    </>
+  )
+}