@linxin666/dsh-remote-web-ui 0.1.14 → 0.1.16

package/lib/types/update.js

@@ -2,7 +2,7 @@
  * Remote update support for the dsh-web-ui family — host half. Detects the
  * installed aggregate package (@linxin666/dsh-web-ui-all) and its family
  * children, probes the npm registry for newer releases, and runs the actual
- * update as `pnpm update` inside the owning dsh profile directory.
+ * update as `pnpm update --latest` inside the owning dsh profile directory.
  *
  * Pure logic with injected seams (manifest reading, registry fetches, process
  * spawning) so the whole surface is unit-testable without touching disk,
@@ -130,14 +130,18 @@ export function isLinkedSpec(spec) {
 }
 /**
  * Resolve the anchor package's manifest path. The aggregate package is the
- * canonical entry point; this plugin's own package is the fallback.
+ * canonical entry point; this plugin's own package is the fallback. Both a
+ * throwing resolve and an undefined return mean "not installed" and move on
+ * to the next candidate.
  * @param resolve - a Node resolve implementation scoped to the host process.
  * @returns the absolute manifest path, or undefined when neither is installed.
  */
 export function resolveAnchorManifest(resolve) {
     for (const name of [AGGREGATE_PACKAGE, SELF_PACKAGE]) {
         try {
-            return resolve(name + '/package.json');
+            const path = resolve(name + '/package.json');
+            if (path !== undefined)
+                return path;
         }
         catch {
             // Not installed — try the next candidate.
@@ -216,15 +220,22 @@ export async function fetchLatestVersion(name, fetchImpl, timeoutMs = 10_000) {
         return undefined;
     }
 }
+/**
+ * Sentinel for an installed version that could not be read (missing manifest
+ * or resolve failure). It is a real-looking version so `checkUpdates` can
+ * render the affected row, but the verified-update comparison must never
+ * treat it as evidence — a read failure is not a version that "moved".
+ */
+const VERSION_UNKNOWN = '0.0.0';
 /** The resolved current version of one family package (probe failure tolerated). */
 function readInstalledVersion(resolve, name) {
     try {
         const path = resolve(name + '/package.json');
         const version = path === undefined ? undefined : readManifest(path)?.version;
-        return typeof version === 'string' ? version : '0.0.0';
+        return typeof version === 'string' ? version : VERSION_UNKNOWN;
     }
     catch {
-        return '0.0.0';
+        return VERSION_UNKNOWN;
     }
 }
 /**
@@ -313,10 +324,14 @@ export function runUpdate(deps) {
         };
         // Ordered fallback chain: each is tried only when the previous one is
         // missing on PATH (ENOENT on the spawn error event, never on close).
+        // `--latest` is required: dsh plugin writes exact-version specs (e.g.
+        // "0.1.12" without a range), and plain `pnpm update` treats an exact spec
+        // as pinned — it prints "Already up to date" and exits 0 without moving
+        // the installed version, so the panel would report a false success.
         const candidates = [
-            { command: 'pnpm', args: ['update', ...packages] },
-            { command: 'corepack', args: ['pnpm', 'update', ...packages] },
-            { command: 'npx', args: ['--yes', 'pnpm', 'update', ...packages] },
+            { command: 'pnpm', args: ['update', '--latest', ...packages] },
+            { command: 'corepack', args: ['pnpm', 'update', '--latest', ...packages] },
+            { command: 'npx', args: ['--yes', 'pnpm', 'update', '--latest', ...packages] },
         ];
         // `output` accumulates across candidates for UI display; `currentOutput`
         // is reset per candidate and carries only that candidate's own diagnostics
@@ -427,3 +442,98 @@ export function runUpdate(deps) {
         runCandidate(0);
     });
 }
+/**
+ * Run the update, then verify the installed versions actually moved. pnpm
+ * exits 0 even when it silently kept the installed versions — the pnpm 11
+ * `minimumReleaseAge` gate refuses same-day releases by default — so a green
+ * exit alone would report a misleading "update complete". Re-read the
+ * installed versions afterwards and surface a `stale` failure (with the
+ * captured pnpm output) when nothing moved, so the panel can tell the user
+ * how to unblock the gate instead of claiming success.
+ *
+ * The stale decision anchors on the pre-run installed versions, not on the
+ * registry latest: under a lenient gate pnpm may move 0.1.12 -> 0.1.13 while
+ * latest stays 0.1.15 — that is a real update, not stale. The post-run anchor
+ * path is re-resolved rather than reused from boot time: pnpm removes the old
+ * version's .pnpm directory on update, so a boot-time captured path would
+ * fail to read and collapse a successful update into a bogus 'missing'.
+ *
+ * A green exit whose verification has nothing to compare (registry probe
+ * outage, missing anchor, non-npm mode) is reported as `verify-failed` — it
+ * must never read as success. A green exit where no package moved but the
+ * post-run check could not prove the install is fully current (a partial
+ * probe failure hides whether a gate kept something back) is also
+ * `verify-failed`: it must not collapse into a success either.
+ * @param deps - the run and check seams.
+ * @returns the run result; `stale` when exit 0 left every version in place,
+ * `verify-failed` when the post-run check could not verify anything.
+ */
+export async function runUpdateVerified(deps) {
+    // Pre-run snapshot: the installed versions the update starts from. Only
+    // successfully-read versions are recorded — a read failure (VERSION_UNKNOWN)
+    // is not a baseline and must not look like a version that "moved", or a
+    // green exit that left everything in place could be mistaken for success.
+    const before = new Map();
+    for (const name of deps.run.packages) {
+        const version = readInstalledVersion(deps.check.resolve, name);
+        if (version !== VERSION_UNKNOWN)
+            before.set(name, version);
+    }
+    const result = await runUpdate(deps.run);
+    if (!result.ok)
+        return result;
+    // Re-resolve the anchor after the run: pnpm removes the old version's
+    // .pnpm directory, so a boot-time captured path no longer reads. Fall back
+    // to the provided path only when nothing resolves now.
+    const anchorManifestPath = resolveAnchorManifest(deps.check.resolve) ?? deps.check.anchorManifestPath;
+    const status = await checkUpdates({ ...deps.check, anchorManifestPath });
+    // A green exit with no comparable result is not a success: registry probe
+    // outage, missing anchor, or a non-npm install mode all mean the post-run
+    // check could not verify anything.
+    if (status.error !== undefined || status.mode !== 'npm') {
+        return {
+            ...result,
+            ok: false,
+            errorCode: 'verify-failed',
+            error: 'pnpm exited 0 but the post-run version check could not verify the install',
+        };
+    }
+    // A package "moved" only when a known pre-run version differs from a known
+    // post-run version. A read failure on either side (VERSION_UNKNOWN) is not
+    // evidence of movement and must not turn a no-op update into a success; a
+    // package without a pre-run baseline is ignored — only the packages pnpm
+    // was told to update count as evidence.
+    const moved = status.packages.some(packageStatus => {
+        const beforeVersion = before.get(packageStatus.name);
+        if (beforeVersion === undefined || packageStatus.current === VERSION_UNKNOWN)
+            return false;
+        return packageStatus.current !== beforeVersion;
+    });
+    if (moved)
+        return result;
+    // Nothing moved. A green exit is only a true no-op when the post-run check
+    // proves the install is already current: every probe succeeded and nothing
+    // is outdated. If a probe failed we cannot tell "already up to date" from
+    // "a gate silently kept it back", so report verify-failed rather than a
+    // false success.
+    if (status.outdated) {
+        // stale: the check ran, a newer release exists, and no package moved
+        // (e.g. the minimumReleaseAge gate kept everything in place).
+        return {
+            ...result,
+            ok: false,
+            errorCode: 'stale',
+            error: 'pnpm exited 0 but the installed versions did not change',
+        };
+    }
+    const unverifiable = status.packages.some(packageStatus => packageStatus.latest === undefined);
+    if (unverifiable) {
+        return {
+            ...result,
+            ok: false,
+            errorCode: 'verify-failed',
+            error: 'pnpm exited 0 but the post-run version check could not verify the install',
+        };
+    }
+    return result;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Mobile remote control for the dsh web GUI: scan-to-pair QR entry beside the settings button, one-time pairing tokens, live device status, and revocable mobile sessions",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/PluginSettingsCard.tsx

@@ -1,25 +1,44 @@
+// Generated by scripts/sync-shared.mjs from shared/client/settings/PluginSettingsCard.tsx. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
 /**
- * Shared chrome for the plugin settings card: a disclosure header naming the
- * plugin and what its settings govern, the controls inside, and the save that
- * writes them. Renders nothing while the namespace is unavailable — a
+ * Family-shared chrome for plugin settings cards: a disclosure header naming
+ * the plugin and what its settings govern, the controls inside, and the save
+ * that writes them. Renders nothing while the namespace is unavailable — a
  * deployment that does not compose the owning plugin should show no trace of
- * it. Mirrors the official ui-plugin-config PluginCard in a self-contained
- * slice (this package must not depend on a sibling UI package).
+ * it. Inlined into each consumer's client bundle; mirrors the official
+ * ui-plugin-config PluginCard in a self-contained slice.
  */
 
 import { useState, type ReactNode } from 'react'
 import type { CardShell } from './settings-form.ts'
-import type { SettingsCardKey } from './locales.ts'
 import css from './settings-card.module.css'
 
+/** Copy keys the card chrome itself reads; every consumer locale carries this shared vocabulary. */
+export const CARD_COPY_KEYS = [
+  'settings.collapse',
+  'settings.expand',
+  'settings.notExposed',
+  'settings.unsaved',
+  'settings.readOnly',
+  'settings.saveFailed',
+  'settings.discard',
+  'settings.save',
+  'settings.saving',
+] as const
+
+/** Copy key the card chrome itself reads. */
+export type CardCopyKey = (typeof CARD_COPY_KEYS)[number]
+
+/** Key domain for the plugin's own copy (inferred per consumer). */
+export type SettingsCardKey<TKey extends string = string> = TKey | CardCopyKey
+
 /** Card chrome shared by every plugin settings card. */
-export interface PluginSettingsCardProps {
+export interface PluginSettingsCardProps<TKey extends string = string> {
   /** Locale reader for this card's copy. */
-  t: (key: SettingsCardKey) => string
+  t: (key: SettingsCardKey<TKey>, params?: Record<string, string | number>) => string
   /** Locale key of the plugin's name. */
-  titleKey: SettingsCardKey
+  titleKey: TKey
   /** Locale key of the line describing what this plugin's settings govern. */
-  descriptionKey: SettingsCardKey
+  descriptionKey: TKey
   /** The card's form state: availability, writability, and what a save would do. */
   state: CardShell
   /** Write every staged edit. */
@@ -35,11 +54,12 @@ export interface PluginSettingsCardProps {
  * @param props - the plugin's copy keys, its form state, and its controls.
  * @returns the card, or nothing while the namespace is still loading.
  */
-export function PluginSettingsCard(props: PluginSettingsCardProps) {
+export function PluginSettingsCard<TKey extends string = string>(props: PluginSettingsCardProps<TKey>) {
   const [open, setOpen] = useState(false)
   const { state } = props
   if (!state.available) return null
   const title = props.t(props.titleKey)
+  const description = props.t(props.descriptionKey)
   const blocked = !state.dirty || state.invalid || state.saving
   const cardClass = open ? `${css.cardOpen} ${css.card}` : css.card
   // The namespace exists but the Host does not serve it to this client (the
@@ -57,8 +77,8 @@ export function PluginSettingsCard(props: PluginSettingsCardProps) {
           onClick={() => { setOpen(!open) }}
         >
           <span className={css.headText}>
-            <span className={css.name}>{title}</span>
-            <span className={css.description}>{props.t(props.descriptionKey)}</span>
+            <span className={css.name} title={title}>{title}</span>
+            <span className={css.description} title={description}>{description}</span>
           </span>
           <svg
             width="14"
@@ -94,10 +114,10 @@ export function PluginSettingsCard(props: PluginSettingsCardProps) {
         onClick={() => { setOpen(!open) }}
       >
         <span className={css.headText}>
-          <span className={css.name}>{title}</span>
-          <span className={css.description}>{props.t(props.descriptionKey)}</span>
+          <span className={css.name} title={title}>{title}</span>
+          <span className={css.description} title={description}>{description}</span>
         </span>
-        {state.dirty ? <span className={css.pending}>{props.t('settings.unsaved')}</span> : null}
+        {state.dirty ? <span className={css.pending} title={props.t('settings.unsaved')}>{props.t('settings.unsaved')}</span> : null}
         <svg
           width="14"
           height="14"
@@ -118,7 +138,13 @@ export function PluginSettingsCard(props: PluginSettingsCardProps) {
             {!state.writable ? <p className={css.readOnly} role="status">{props.t('settings.readOnly')}</p> : null}
             {props.children}
             <div className={css.footer}>
-              {state.failed ? <p className={css.failed} role="status">{props.t('settings.saveFailed')}</p> : null}
+              {state.failed
+                ? (
+                  <p className={css.failed} role="status">
+                    {props.t('settings.saveFailed')}{state.failedReason ? ' - ' + state.failedReason : ''}
+                  </p>
+                )
+                : null}
               <button
                 type="button"
                 className={css.discard}
@@ -259,4 +285,50 @@ export function BooleanField(props: FieldProps & {
       <p className={css.hint}>{props.hint}</p>
     </div>
   )
-}
+}
+
+/** A staged enumerated field rendered as a select. */
+export function ChoiceField(props: FieldProps & {
+  /** Copy for the inherit option (draft text is the empty string). */
+  inheritLabel: string
+  /** Choices rendered in order; `value` is the draft/stored text. */
+  choices: ReadonlyArray<{ value: string; label: string }>
+}) {
+  return (
+    <div className={css.field}>
+      <div className={css.head}>
+        <label className={css.label} htmlFor={props.id}>{props.label}</label>
+        {props.overridden
+          ? (
+            <span className={css.badges}>
+              <span className={css.badge}>{props.overriddenLabel}</span>
+              <button
+                type="button"
+                className={css.reset}
+                disabled={props.disabled}
+                onClick={props.onReset}
+              >
+                {props.resetLabel}
+              </button>
+            </span>
+          )
+          : null}
+      </div>
+      <select
+        id={props.id}
+        className={css.select}
+        value={props.text}
+        disabled={props.disabled}
+        onChange={(event) => { props.onEdit(event.target.value) }}
+      >
+        <option value="">{props.inheritLabel}</option>
+        {props.choices.map(choice => (
+          <option key={choice.value} value={choice.value}>{choice.label}</option>
+        ))}
+      </select>
+      <p className={props.invalid ? css.invalid : css.hint}>
+        {props.invalid ? props.invalidLabel : props.hint}
+      </p>
+    </div>
+  )
+}

package/src/client/UpdatePanel.tsx

@@ -198,6 +198,8 @@ function errorMessageOf(t: TranslateNS<"remote">, result: UpdateRunResult): stri
     case "not-found": return t("update.error.notFound")
     case "link": return t("update.error.link")
     case "pnpm-failed": return t("update.error.pnpmFailed", { code: String(result.exitCode ?? "?") })
+    case "stale": return t("update.error.stale")
+    case "verify-failed": return t("update.error.verifyFailed")
     default: return result.error ?? t("update.error.unknown")
   }
 }

package/src/client/locales.ts

@@ -102,6 +102,8 @@ export const zh = {
   'update.error.notFound': '未找到 dsh-web-ui 聚合包安装，无法更新。',
   'update.error.link': '当前为本地开发模式（链接安装），无法自动更新。',
   'update.error.pnpmFailed': '更新执行失败（pnpm 退出码 {code}），详见下方输出。',
+  'update.error.stale': '更新命令已执行，但安装版本未变化。常见原因：pnpm 11 的 minimumReleaseAge 门禁会静默跳过发布不足 24 小时的新版本。请在 profile 目录（~/.dsh/profiles/<profile>）的 pnpm-workspace.yaml 中配置 minimumReleaseAgeExclude（例如 "@linxin666/*"）或 minimumReleaseAge: 0 后重新点击更新。',
+  'update.error.verifyFailed': '更新命令已执行，但无法核对安装后的版本（可能是 registry 探测失败或安装路径变化）。请查看下方输出，或稍后重试。',
   'update.error.unknown': '更新失败，请重试。',
 } satisfies Record<string, string>
 
@@ -213,5 +215,7 @@ export const en = {
   'update.error.notFound': 'The dsh-web-ui aggregate package is not installed; nothing to update.',
   'update.error.link': 'Local development mode (link install) — automatic update is unavailable.',
   'update.error.pnpmFailed': 'The update failed (pnpm exited with code {code}); see the output below.',
+  'update.error.stale': 'The update command ran but the installed versions did not change. Likely cause: the pnpm 11 minimumReleaseAge gate silently skips releases published less than 24 hours ago. Add minimumReleaseAgeExclude (e.g. "@linxin666/*") or set minimumReleaseAge: 0 in pnpm-workspace.yaml under the profile directory (~/.dsh/profiles/<profile>), then run the update again.',
+  'update.error.verifyFailed': 'The update command ran but the installed versions could not be verified afterwards (registry probe failed or the install path changed). Inspect the output below, or retry later.',
   'update.error.unknown': 'Update failed; try again.',
 } satisfies Record<RemoteKey, string>

package/src/client/settings-card.module.css

@@ -1,3 +1,4 @@
+/* Generated by scripts/sync-shared.mjs from shared/client/settings/settings-card.module.css. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs". */
 /* Plugin settings card chrome + staged form fields.
  * Aligned with the official ui-settings-plugins PluginCard / fields CSS:
  * same semantic tokens, radius, typography and states so family cards read
@@ -120,6 +121,9 @@
   margin: 0;
   font-size: 12px;
   line-height: 1.5;
+  text-overflow: ellipsis;
+  overflow: hidden;
+  white-space: nowrap;
 }
 
 .discard,
@@ -229,6 +233,11 @@
   outline-offset: 2px;
 }
 
+.reset:focus-visible {
+  outline: 2px solid var(--dsw-alias-brand-primary);
+  outline-offset: 2px;
+}
+
 .input,
 .select {
   border: 1px solid var(--dsw-alias-border-l2);