@linxin666/dsh-remote-web-ui 0.1.9 → 0.1.11

package/lib/types/client/UpdateEntry.js

@@ -0,0 +1,68 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * The sidebar update seat: the download trigger beside the remote-control
+ * trigger plus the update panel modal. Owns the flow — probe the registry
+ * on open, auto-run the update when a newer release exists, report the
+ * outcome (restart hint on success, translated failure on error).
+ * Component-local state per the client stack rules.
+ */
+import { useCallback, useEffect, useRef, useState } from "react";
+import { createPortal } from "react-dom";
+import { IconDownloadOutline16 } from '@deepseek-ai/dsh-client-ui-primitives';
+import { fetchUpdateStatus, runUpdate } from "./update-api.js";
+import { UpdatePanel } from "./UpdatePanel.js";
+import css from "./remote.module.css";
+/**
+ * Render the update trigger and panel.
+ * @param props - column state and locale seat.
+ * @returns the entry element tree.
+ */
+export function UpdateEntry({ wide, t }) {
+    const [open, setOpen] = useState(false);
+    const [view, setView] = useState({ kind: "checking" });
+    const runToken = useRef(0);
+    const check = useCallback(async () => {
+        setView({ kind: "checking" });
+        let status;
+        try {
+            status = await fetchUpdateStatus();
+        }
+        catch {
+            setView({ kind: "error", message: t("update.offline"), detail: t("update.offlineDetail") });
+            return;
+        }
+        if (status.error === "registry-unreachable") {
+            setView({ kind: "result", status });
+            return;
+        }
+        setView({ kind: "result", status });
+        // Auto-update: an npm install with a newer release proceeds without a
+        // second confirmation — clicking the update trigger is the intent.
+        if (status.mode !== "npm" || !status.outdated)
+            return;
+        setView({ kind: "updating", status });
+        const token = ++runToken.current;
+        try {
+            const result = await runUpdate();
+            if (token !== runToken.current)
+                return;
+            setView({ kind: "done", result });
+        }
+        catch {
+            if (token !== runToken.current)
+                return;
+            setView({ kind: "error", message: t("update.error"), detail: t("update.offlineDetail") });
+        }
+    }, [t]);
+    const openPanel = useCallback(() => {
+        setOpen(true);
+        void check();
+    }, [check]);
+    const closePanel = useCallback(() => {
+        runToken.current++;
+        setOpen(false);
+    }, []);
+    // Unmount safety: an in-flight update must not land on a dead component.
+    useEffect(() => () => { runToken.current++; }, []);
+    return (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", className: css.trigger, "data-wide": wide ? undefined : "rail", "aria-label": t("update.label"), title: t("update.label"), onClick: openPanel, children: _jsx(IconDownloadOutline16, { size: wide ? 16 : 18 }) }), open && createPortal((_jsxs("div", { className: css.overlay, role: "presentation", children: [_jsx("div", { className: css.mask, "aria-hidden": "true", onClick: closePanel }), _jsx(UpdatePanel, { t: t, view: view, onClose: closePanel, onRecheck: () => { void check(); } })] })), document.body)] }));
+}

package/lib/types/client/UpdatePanel.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The update panel body: check progress, version comparison, the
+ * auto-update in-flight state, and the outcome (restart hint on success,
+ * translated failure on error). Pure presentation — all state arrives
+ * through props from the entry behavior component.
+ */
+import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots';
+import type { UpdateRunResult, UpdateStatus } from '../update.ts';
+/** The panel view state, owned by the entry component. */
+export type UpdateView = {
+    kind: 'checking';
+} | {
+    kind: 'result';
+    status: UpdateStatus;
+} | {
+    kind: 'updating';
+    status: UpdateStatus;
+} | {
+    kind: 'done';
+    result: UpdateRunResult;
+} | {
+    kind: 'error';
+    message: string;
+    detail?: string;
+};
+/** Full panel props: copy + view state + actions. */
+export interface UpdatePanelProps {
+    t: TranslateNS<'remote'>;
+    view: UpdateView;
+    onClose(): void;
+    /** Re-run the check from a terminal state. */
+    onRecheck(): void;
+}
+/**
+ * Render the update panel.
+ * @param props - copy, view state, and actions.
+ * @returns the panel element tree.
+ */
+export declare function UpdatePanel({ t, view, onClose, onRecheck }: UpdatePanelProps): import("react").JSX.Element;
+//# sourceMappingURL=UpdatePanel.d.ts.map

package/lib/types/client/UpdatePanel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdatePanel.d.ts","sourceRoot":"","sources":["../../../src/client/UpdatePanel.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAEnE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGjE,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,IAAI,IAAI,CAAA;IACf,8CAA8C;IAC9C,SAAS,IAAI,IAAI,CAAA;CAClB;AAYD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,gBAAgB,+BAyC5E"}

package/lib/types/client/UpdatePanel.js

@@ -0,0 +1,82 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { IconCloseOutline16, IconRefreshOutline16 } from '@deepseek-ai/dsh-client-ui-primitives';
+import css from "./remote.module.css";
+/** The anchor package name (aggregate first) for copy purposes. */
+function anchorName(status) {
+    return status?.anchor ?? status?.packages[0]?.name;
+}
+/** The latest npm release of the anchor, for reference copy. */
+function anchorLatest(status) {
+    return status?.packages[0]?.latest;
+}
+/**
+ * Render the update panel.
+ * @param props - copy, view state, and actions.
+ * @returns the panel element tree.
+ */
+export function UpdatePanel({ t, view, onClose, onRecheck }) {
+    const status = view.kind === "result" || view.kind === "updating" ? view.status : undefined;
+    const title = view.kind === "done" && view.result.ok ? t("update.done") : t("update.title");
+    const subtitle = subtitleOf(t, view);
+    return (_jsxs("div", { className: css.panel, role: "dialog", "aria-modal": "true", "aria-label": title, children: [_jsxs("div", { className: css.header, children: [_jsxs("div", { className: css.heading, children: [_jsx("h2", { className: css.title, children: title }), subtitle !== undefined && _jsx("p", { className: css.subtitle, children: subtitle })] }), _jsx("button", { type: "button", className: css.close, "aria-label": t("update.close"), onClick: onClose, children: _jsx(IconCloseOutline16, {}) })] }), view.kind === "checking" && _jsx("p", { className: css.updateStatus, children: t("update.checking") }), view.kind === "result" && status !== undefined && _jsx(ResultBody, { t: t, status: status }), view.kind === "updating" && status !== undefined && (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.updating", { name: anchorName(status) ?? "", version: anchorLatest(status) ?? "" }) }), _jsx(PackageList, { status: status })] })), view.kind === "done" && _jsx(DoneBody, { t: t, result: view.result }), view.kind === "error" && (_jsxs("div", { children: [_jsx("p", { className: css.updateError, children: view.message }), view.detail !== undefined && _jsx("pre", { className: css.updateOutput, children: view.detail })] })), (view.kind === "done" || view.kind === "error") && (_jsx("div", { className: css.updateActions, children: _jsxs("button", { type: "button", className: css.updateRetry, onClick: onRecheck, children: [_jsx(IconRefreshOutline16, {}), " ", t("update.retry")] }) }))] }));
+}
+/** The subtitle copy per view state (absent on plain results). */
+function subtitleOf(t, view) {
+    switch (view.kind) {
+        case "checking":
+            return t("update.checking");
+        case "updating":
+            return t("update.updatingTitle");
+        case "result":
+            return undefined;
+        case "done":
+            return view.result.ok ? t("update.doneDetail") : t("update.error");
+        case "error":
+            // The error body below carries the message; no subtitle duplication.
+            return undefined;
+    }
+}
+/** The checked result body: mode banner + version list. */
+function ResultBody({ t, status }) {
+    const anchor = anchorName(status);
+    const latest = anchorLatest(status);
+    if (status.mode === "link") {
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.linkMode") }), _jsx("p", { className: css.updateDetail, children: t("update.linkModeDetail", { version: latest ?? "-" }) })] }));
+    }
+    if (status.mode === "missing") {
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.missing") }), _jsx("p", { className: css.updateDetail, children: t("update.missingDetail") })] }));
+    }
+    if (status.error === "registry-unreachable") {
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.offline") }), _jsx("p", { className: css.updateDetail, children: t("update.offlineDetail") })] }));
+    }
+    if (status.outdated) {
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.found") }), _jsx("p", { className: css.updateDetail, children: anchor !== undefined ? t("update.foundDetail", { name: anchor, version: latest ?? "" }) : "" })] }));
+    }
+    return (_jsxs("div", { children: [_jsx("p", { className: css.updateStatus, children: t("update.upToDate") }), anchor !== undefined && latest !== undefined && (_jsx("p", { className: css.updateDetail, children: t("update.upToDateDetail", { name: anchor, version: latest }) })), _jsx(PackageList, { status: status })] }));
+}
+/** The per-package current → latest comparison list. */
+function PackageList({ status }) {
+    if (status.packages.length === 0)
+        return null;
+    return (_jsx("ul", { className: css.updateList, children: status.packages.map(packageStatus => (_jsxs("li", { className: css.updateListItem, children: [_jsx("span", { className: css.updateListName, children: packageStatus.name }), _jsxs("span", { className: css.updateListVersions, children: [packageStatus.current, packageStatus.latest !== undefined && packageStatus.latest !== packageStatus.current && (_jsxs(_Fragment, { children: [" \u2192 ", packageStatus.latest] }))] })] }, packageStatus.name))) }));
+}
+/** The outcome body: success + restart hint, or the translated failure. */
+function DoneBody({ t, result }) {
+    if (result.ok) {
+        // The title already reads "Update complete"; the body carries the details.
+        return (_jsxs("div", { children: [_jsx("p", { className: css.updateDetail, children: t("update.doneDetail") }), _jsx("p", { className: css.updateDetail, children: t("update.restartHint") })] }));
+    }
+    const message = errorMessageOf(t, result);
+    return (_jsxs("div", { children: [_jsx("p", { className: css.updateError, children: message }), result.output.trim() !== "" && _jsx("pre", { className: css.updateOutput, children: result.output.trim() })] }));
+}
+/** Translate a structured failure code; fall back to the raw message. */
+function errorMessageOf(t, result) {
+    switch (result.errorCode) {
+        case "pnpm-missing": return t("update.error.pnpmMissing");
+        case "timeout": return t("update.error.timeout");
+        case "not-found": return t("update.error.notFound");
+        case "link": return t("update.error.link");
+        case "pnpm-failed": return t("update.error.pnpmFailed", { code: String(result.exitCode ?? "?") });
+        default: return result.error ?? t("update.error.unknown");
+    }
+}

package/lib/types/client/index.d.ts

@@ -5,6 +5,8 @@ export type { PanelState, RemotePanelProps } from './RemotePanel.tsx';
 export type { PairFailedNoticeProps } from './PairFailedNotice.tsx';
 export type { RemoteKey } from './locales.ts';
 export type { RemoteSettingsCardFace, RemoteSettingsCardState } from './RemoteSettingsCard.tsx';
+export type { UpdateEntryProps } from './UpdateEntry.tsx';
+export type { UpdatePanelProps, UpdateView } from './UpdatePanel.tsx';
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
         /** Mobile remote-control surface copy. */

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAa3E,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAIrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACnE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAE/F,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0CAA0C;QAC1C,MAAM,EAAE,SAAS,CAAA;KAClB;IAED,UAAU,OAAO;QACf;;;;WAIG;QACH,gBAAgB,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,uBAAuB,CAAA;SAAE,CAAA;QACnF;;;;;WAKG;QACH,oBAAoB,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,4BAA4B,CAAA;SAAE,CAAA;KAC3F;CACF;AAED,4GAA4G;AAC5G,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,KAAK,CAAA;CACjB;AAWD,wCAAwC;AACxC,eAAO,MAAM,MAAM,UAA+D,CAAA;AAElF;;;GAGG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAyG9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAa3E,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAIrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACnE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAC/F,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAErE,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0CAA0C;QAC1C,MAAM,EAAE,SAAS,CAAA;KAClB;IAED,UAAU,OAAO;QACf;;;;WAIG;QACH,gBAAgB,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,uBAAuB,CAAA;SAAE,CAAA;QACnF;;;;;WAKG;QACH,oBAAoB,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,4BAA4B,CAAA;SAAE,CAAA;KAC3F;CACF;AAED,4GAA4G;AAC5G,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,KAAK,CAAA;CACjB;AAWD,wCAAwC;AACxC,eAAO,MAAM,MAAM,UAA+D,CAAA;AAElF;;;GAGG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAyG9C"}

package/lib/types/client/locales.d.ts

@@ -58,6 +58,7 @@ export declare const zh: {
     'settings.off': string;
     'settings.overridden': string;
     'settings.reset': string;
+    'settings.notExposed': string;
     'settings.readOnly': string;
     'settings.expand': string;
     'settings.collapse': string;
@@ -67,6 +68,34 @@ export declare const zh: {
     'settings.unsaved': string;
     'settings.saveFailed': string;
     'settings.invalidNumber': string;
+    'update.label': string;
+    'update.title': string;
+    'update.checking': string;
+    'update.upToDate': string;
+    'update.upToDateDetail': string;
+    'update.found': string;
+    'update.foundDetail': string;
+    'update.updating': string;
+    'update.updatingTitle': string;
+    'update.done': string;
+    'update.doneDetail': string;
+    'update.restartHint': string;
+    'update.linkMode': string;
+    'update.linkModeDetail': string;
+    'update.missing': string;
+    'update.missingDetail': string;
+    'update.offline': string;
+    'update.offlineDetail': string;
+    'update.error': string;
+    'update.packages': string;
+    'update.retry': string;
+    'update.close': string;
+    'update.error.pnpmMissing': string;
+    'update.error.timeout': string;
+    'update.error.notFound': string;
+    'update.error.link': string;
+    'update.error.pnpmFailed': string;
+    'update.error.unknown': string;
 };
 /** The remote namespace key union. */
 export type RemoteKey = keyof typeof zh;
@@ -131,6 +160,7 @@ export declare const en: {
     'settings.off': string;
     'settings.overridden': string;
     'settings.reset': string;
+    'settings.notExposed': string;
     'settings.readOnly': string;
     'settings.expand': string;
     'settings.collapse': string;
@@ -140,5 +170,33 @@ export declare const en: {
     'settings.unsaved': string;
     'settings.saveFailed': string;
     'settings.invalidNumber': string;
+    'update.label': string;
+    'update.title': string;
+    'update.checking': string;
+    'update.upToDate': string;
+    'update.upToDateDetail': string;
+    'update.found': string;
+    'update.foundDetail': string;
+    'update.updating': string;
+    'update.updatingTitle': string;
+    'update.done': string;
+    'update.doneDetail': string;
+    'update.restartHint': string;
+    'update.linkMode': string;
+    'update.linkModeDetail': string;
+    'update.missing': string;
+    'update.missingDetail': string;
+    'update.offline': string;
+    'update.offlineDetail': string;
+    'update.error': string;
+    'update.packages': string;
+    'update.retry': string;
+    'update.close': string;
+    'update.error.pnpmMissing': string;
+    'update.error.timeout': string;
+    'update.error.notFound': string;
+    'update.error.link': string;
+    'update.error.pnpmFailed': string;
+    'update.error.unknown': string;
 };
 //# sourceMappingURL=locales.d.ts.map

package/lib/types/client/locales.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoEsB,CAAA"}
+{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkGmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkGsB,CAAA"}

package/lib/types/client/locales.js

@@ -59,6 +59,7 @@ export const zh = {
     'settings.off': '关',
     'settings.overridden': '已覆盖',
     'settings.reset': '恢复默认',
+    'settings.notExposed': '当前 DSH 版本未向设置页暴露本插件的配置命名空间，表单不可用。可编辑 ~/.dsh/settings.yaml 直接配置，或为 dsh-host-apiproxy 的 WEB_SETTINGS_NAMESPACES 白名单补充本命名空间后重启。',
     'settings.readOnly': '当前部署的设置只读。',
     'settings.expand': '展开设置',
     'settings.collapse': '收起设置',
@@ -68,6 +69,35 @@ export const zh = {
     'settings.unsaved': '未保存',
     'settings.saveFailed': '部署未接受这些值，已保留供你修改。',
     'settings.invalidNumber': '请输入数字，留空则使用默认值。',
+    // 更新面板（侧边栏更新按钮）。
+    'update.label': '检查更新',
+    'update.title': '检查更新',
+    'update.checking': '正在检查远程仓库中的新版本…',
+    'update.upToDate': '当前已是最新版本',
+    'update.upToDateDetail': '{name} 已是最新版本 v{version}。',
+    'update.found': '发现新版本',
+    'update.foundDetail': '{name} 有新版本 v{version}，正在自动更新…',
+    'update.updating': '正在更新 {name} 至 v{version}，可能需要 1-2 分钟…',
+    'update.updatingTitle': '正在自动更新…',
+    'update.done': '更新完成',
+    'update.doneDetail': '所有组件已更新到最新版本。',
+    'update.restartHint': '请重启 dsh web 使新版本生效：在终端按 Ctrl+C 停止后重新运行 dsh web。',
+    'update.linkMode': '当前为本地开发模式',
+    'update.linkModeDetail': 'dsh-web-ui 通过本地链接安装（开发模式），无法自动更新。npm 上最新版本：{version}。请在仓库中执行 git pull 更新。',
+    'update.missing': '未找到 dsh-web-ui 安装',
+    'update.missingDetail': '无法定位已安装的 dsh-web-ui 聚合包。请先运行 dsh plugin --profile <profile> add @linxin666/dsh-web-ui-all。',
+    'update.offline': '无法连接更新源',
+    'update.offlineDetail': '网络不可用或更新服务异常，请稍后重试。',
+    'update.error': '更新失败',
+    'update.packages': '组件版本',
+    'update.retry': '重新检查',
+    'update.close': '关闭更新面板',
+    'update.error.pnpmMissing': '未找到 pnpm，请先安装 pnpm（brew install pnpm 或 corepack enable）。',
+    'update.error.timeout': '更新超时，已终止安装进程，请重试。',
+    'update.error.notFound': '未找到 dsh-web-ui 聚合包安装，无法更新。',
+    'update.error.link': '当前为本地开发模式（链接安装），无法自动更新。',
+    'update.error.pnpmFailed': '更新执行失败（pnpm 退出码 {code}），详见下方输出。',
+    'update.error.unknown': '更新失败，请重试。',
 };
 /** English dictionary, checked complete against the zh key set. */
 export const en = {
@@ -129,6 +159,7 @@ export const en = {
     'settings.off': 'Off',
     'settings.overridden': 'Overridden',
     'settings.reset': 'Reset to default',
+    'settings.notExposed': 'This DSH version does not expose this plugin\'s settings namespace to the configuration page, so the form is unavailable. Edit ~/.dsh/settings.yaml directly, or add the namespace to dsh-host-apiproxy\'s WEB_SETTINGS_NAMESPACES allowlist and restart.',
     'settings.readOnly': 'This deployment stores settings read-only.',
     'settings.expand': 'Show settings',
     'settings.collapse': 'Hide settings',
@@ -138,4 +169,33 @@ export const en = {
     'settings.unsaved': 'Unsaved',
     'settings.saveFailed': 'The deployment did not accept these values; they were left for you to correct.',
     'settings.invalidNumber': 'Enter a number, or leave blank to use the default.',
+    // Update panel (the sidebar update trigger).
+    'update.label': 'Check for updates',
+    'update.title': 'Check for updates',
+    'update.checking': 'Checking the remote repository for newer releases…',
+    'update.upToDate': 'Everything is up to date',
+    'update.upToDateDetail': '{name} is at the latest version v{version}.',
+    'update.found': 'A new version is available',
+    'update.foundDetail': '{name} has a newer release v{version}; updating automatically…',
+    'update.updating': 'Updating {name} to v{version}; this may take 1-2 minutes…',
+    'update.updatingTitle': 'Updating automatically…',
+    'update.done': 'Update complete',
+    'update.doneDetail': 'All components are up to date.',
+    'update.restartHint': 'Restart dsh web for the new version to take effect: stop it with Ctrl+C in the terminal, then run dsh web again.',
+    'update.linkMode': 'Local development mode',
+    'update.linkModeDetail': 'dsh-web-ui is installed via a local link (development mode) and cannot be updated remotely. Latest npm release: {version}. Run git pull in the repository to update.',
+    'update.missing': 'dsh-web-ui not found',
+    'update.missingDetail': 'Could not locate the installed dsh-web-ui aggregate package. Install it with: dsh plugin --profile <profile> add @linxin666/dsh-web-ui-all',
+    'update.offline': 'Cannot reach the update source',
+    'update.offlineDetail': 'The network is unavailable or the update service is failing; try again later.',
+    'update.error': 'Update failed',
+    'update.packages': 'Component versions',
+    'update.retry': 'Check again',
+    'update.close': 'Close update panel',
+    'update.error.pnpmMissing': 'pnpm was not found. Install it first (brew install pnpm or corepack enable).',
+    'update.error.timeout': 'The update timed out and the install process was killed; try again.',
+    'update.error.notFound': 'The dsh-web-ui aggregate package is not installed; nothing to update.',
+    'update.error.link': 'Local development mode (link install) — automatic update is unavailable.',
+    'update.error.pnpmFailed': 'The update failed (pnpm exited with code {code}); see the output below.',
+    'update.error.unknown': 'Update failed; try again.',
 };

package/lib/types/client/settings-form.d.ts

@@ -37,8 +37,16 @@ export interface FieldState {
 }
 /** Form state every plugin settings card shares. */
 export interface CardShell {
-    /** False while the namespace is not served to this client; the card renders nothing. */
+    /** False while the namespace is still loading; the card renders nothing. */
     available: boolean;
+    /**
+     * Whether the namespace is actually served to this client. False when the
+     * Host deployment does not expose it (e.g. the official apiproxy settings
+     * allowlist omits third-party namespaces): the card renders an explanation
+     * instead of its form, so a missing namespace never looks like a missing
+     * plugin.
+     */
+    exposed: boolean;
     /** Whether the Host document accepts writes. */
     writable: boolean;
     /** Whether the form holds edits that a save would write. */

package/lib/types/client/settings-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-form.d.ts","sourceRoot":"","sources":["../../../src/client/settings-form.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAGjH,yEAAyE;AACzE,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErB,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAA;IAClC;;;OAGG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAA;CAChD;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAA;IACnB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,SAAS,EAAE,OAAO,CAAA;IAClB,gDAAgD;IAChD,QAAQ,EAAE,OAAO,CAAA;IACjB,4DAA4D;IAC5D,KAAK,EAAE,OAAO,CAAA;IACd,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAChB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,CAAA;IACf,sFAAsF;IACtF,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3C,gFAAgF;IAChF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAkBD,0HAA0H;AAC1H,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAWpD;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CASlD;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAUrD;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ,CAAC,CAAC;IASnB,OAAO,CAAC,QAAQ,CAAC,KAAK;IARxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAQ;IAEtB,yEAAyE;gBAEtD,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EACxC,KAAK,EAAE,SAAS,EAAE;IAMpB,wFAAwF;IACxF,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;IAM3C,iFAAiF;IACjF,KAAK,IAAI,SAAS;IAalB,8EAA8E;IAC9E,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAchC,wDAAwD;IACxD,OAAO,IAAI,WAAW;IAgBtB;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B;;;;;;OAMG;IACH,OAAO,CAAC,IAAI;YAiBE,KAAK;YAKL,KAAK;IAKnB,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,OAAO;CAGhB"}
+{"version":3,"file":"settings-form.d.ts","sourceRoot":"","sources":["../../../src/client/settings-form.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAGjH,yEAAyE;AACzE,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErB,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAA;IAClC;;;OAGG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAA;CAChD;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAA;IACnB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAA;IAClB;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,gDAAgD;IAChD,QAAQ,EAAE,OAAO,CAAA;IACjB,4DAA4D;IAC5D,KAAK,EAAE,OAAO,CAAA;IACd,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAChB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,CAAA;IACf,sFAAsF;IACtF,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3C,gFAAgF;IAChF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAkBD,0HAA0H;AAC1H,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAWpD;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CASlD;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAUrD;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ,CAAC,CAAC;IASnB,OAAO,CAAC,QAAQ,CAAC,KAAK;IARxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAQ;IAEtB,yEAAyE;gBAEtD,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EACxC,KAAK,EAAE,SAAS,EAAE;IAMpB,wFAAwF;IACxF,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;IAM3C,iFAAiF;IACjF,KAAK,IAAI,SAAS;IAclB,8EAA8E;IAC9E,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAchC,wDAAwD;IACxD,OAAO,IAAI,WAAW;IAgBtB;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B;;;;;;OAMG;IACH,OAAO,CAAC,IAAI;YAiBE,KAAK;YAKL,KAAK;IAKnB,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,OAAO;CAGhB"}

package/lib/types/client/settings-form.js

@@ -78,7 +78,8 @@ export class CardForm {
         const snapshot = this.scope.getSnapshot();
         const plan = this.plan();
         return {
-            available: snapshot.status === 'ready',
+            available: snapshot.status !== 'loading',
+            exposed: snapshot.status === 'ready',
             writable: snapshot.writable,
             dirty: plan.length > 0,
             invalid: plan.some(item => item.run === undefined),

package/lib/types/client/update-api.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Browser-side wire helpers for the /api/update surface. Plain fetch over
+ * same-origin /api like the pairing client; the host half enforces the
+ * loopback-only fence and owns the pnpm run.
+ */
+import type { UpdateRunResult, UpdateStatus } from '../update.ts';
+/**
+ * Probe the update status: install mode, owning profile, and the
+ * current-vs-latest comparison for every family package.
+ * @returns the status snapshot.
+ */
+export declare function fetchUpdateStatus(): Promise<UpdateStatus>;
+/**
+ * Run the update (pnpm update in the owning profile). Blocks until pnpm
+ * exits — the panel shows an in-flight state meanwhile.
+ * @returns the run outcome.
+ */
+export declare function runUpdate(): Promise<UpdateRunResult>;
+//# sourceMappingURL=update-api.d.ts.map

package/lib/types/client/update-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-api.d.ts","sourceRoot":"","sources":["../../../src/client/update-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEjE;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,YAAY,CAAC,CAI/D;AAED;;;;GAIG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC,CAI1D"}

package/lib/types/client/update-api.js

@@ -0,0 +1,27 @@
+/**
+ * Browser-side wire helpers for the /api/update surface. Plain fetch over
+ * same-origin /api like the pairing client; the host half enforces the
+ * loopback-only fence and owns the pnpm run.
+ */
+/**
+ * Probe the update status: install mode, owning profile, and the
+ * current-vs-latest comparison for every family package.
+ * @returns the status snapshot.
+ */
+export async function fetchUpdateStatus() {
+    const response = await fetch('/api/update/status');
+    if (!response.ok)
+        throw new Error('update status unavailable');
+    return await response.json();
+}
+/**
+ * Run the update (pnpm update in the owning profile). Blocks until pnpm
+ * exits — the panel shows an in-flight state meanwhile.
+ * @returns the run outcome.
+ */
+export async function runUpdate() {
+    const response = await fetch('/api/update/run', { method: 'POST' });
+    if (!response.ok)
+        throw new Error('update run unavailable');
+    return await response.json();
+}

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,CAAC,MAAM,aAAa,CAAA;AAU3B,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;WAKG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA4B,CAAA;AAE/C;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,uDAAqC,CAAA;AAElF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAS3B,CAAA;AAwBF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CA8JzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,CAAC,MAAM,aAAa,CAAA;AAmB3B,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;WAKG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA4B,CAAA;AAE/C;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,uDAAqC,CAAA;AAElF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAS3B,CAAA;AAwBF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAsMzD"}

package/lib/types/index.js

@@ -7,16 +7,19 @@
  * `./client` entry) renders the sidebar entry, the pairing panel, and the
  * phone-side pair/accept + deep-link flow.
  */
+import { createRequire } from 'node:module';
 import { setInterval as nodeSetInterval } from 'node:timers';
 import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings';
 import z from 'schemastery';
 import { PairingService } from "./pairing.js";
 import { makeGateListener } from "./gate.js";
-import { makeRoutes } from "./routes.js";
+import { isTrustedApiRequest, makeRoutes } from "./routes.js";
 import { makeMobileRoutes } from "./mobile-routes.js";
 import { makeMobileApiRoutes } from "./mobile-api.js";
 import { lanIPv4Addresses } from "./lan.js";
 import { TunnelManager } from "./tunnel.js";
+import { checkUpdates, fetchLatestVersion, resolveAnchorManifest, resolveUpdateTarget, runUpdate, } from "./update.js";
+import { makeUpdateRoutes } from "./update-routes.js";
 /** Stable cordis plugin name. */
 export const name = 'remote-web-ui';
 /** Services required before the pairing surfaces can mount. */
@@ -143,10 +146,51 @@ export function apply(ctx, config) {
     if (apiProxy === undefined) {
         console.warn('remote-web-ui: apiProxy service unavailable — the mobile data channel is disabled');
     }
+    // ── remote update ────────────────────────────────────────────────────────
+    // The dsh-web-ui self-update surface: probe the npm registry for family
+    // releases and run `pnpm update` in the owning profile. Resolutions anchor
+    // on the host process's own module graph, so the update always targets the
+    // profile the running web GUI was booted from. The probe path resolves once
+    // (the anchor stays the same package across updates); versions are re-read
+    // from disk per check.
+    const requireFromHost = createRequire(import.meta.url);
+    const anchorManifestPath = resolveAnchorManifest(specifier => requireFromHost.resolve(specifier));
+    const updateRoutes = makeUpdateRoutes({
+        // Control endpoints are host-surface only: a LAN/phone origin must never
+        // trigger a real install on this machine.
+        fence: request => isTrustedApiRequest(request, []),
+        check: () => checkUpdates({
+            anchorManifestPath,
+            resolve: specifier => {
+                try {
+                    return requireFromHost.resolve(specifier);
+                }
+                catch {
+                    return undefined;
+                }
+            },
+            fetchLatest: name => fetchLatestVersion(name, fetch),
+        }),
+        run: async () => {
+            const target = resolveUpdateTarget({ anchorManifestPath });
+            if ('error' in target) {
+                const code = target.error;
+                return {
+                    ok: false,
+                    exitCode: null,
+                    output: '',
+                    error: code === 'not-found' ? 'dsh-web-ui aggregate not installed' : 'local link install — update unavailable',
+                    errorCode: code,
+                };
+            }
+            return runUpdate({ profileDir: target.profileDir, packages: target.packages });
+        },
+    });
     const routes = [
         ...makeRoutes({ service, lanAddresses }),
         ...makeMobileRoutes(),
         ...(apiProxy !== undefined ? makeMobileApiRoutes({ service, apiProxy }) : []),
+        ...updateRoutes,
     ];
     const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
     ctx.effect(() => ctx.on('api/gate', gate), 'remote-web-ui: api gate');

package/lib/types/routes.d.ts

@@ -10,6 +10,21 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
 import { type PairingService, type PairingSnapshot } from './pairing.ts';
+/**
+ * Browser-trust fence for the /api/pair routes, mirroring the connection
+ * package's internal fence semantics (Host/Origin based, DNS-rebinding and
+ * cross-site defense). The connection package no longer exports its trust
+ * predicate — the fence for the /api prefix lives inside the connection
+ * plugin — so the pairing routes, which must stay reachable from LAN phones
+ * ahead of the connection prefix route (exact routes match first), carry
+ * their own copy scoped to the literals the QR links advertise.
+ * @param request - the node HTTP request.
+ * @param trustedHosts - non-loopback authorities this surface serves: exact
+ * `host:port`, or port-less `host` matching any port.
+ * @returns true when the Host is ours (loopback or trusted) and any attached
+ * browser markers are same-origin.
+ */
+export declare function isTrustedApiRequest(request: IncomingMessage, trustedHosts: readonly string[]): boolean;
 /**
  * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
  * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —

package/lib/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAmDhG;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;CAOb,CAAA;AAiCV,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAgK3D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAGhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;CAOb,CAAA;AAiCV,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAgK3D"}

package/lib/types/routes.js

@@ -23,7 +23,7 @@ import { isLoopbackClient, readCookie } from "./gate.js";
  * @returns true when the Host is ours (loopback or trusted) and any attached
  * browser markers are same-origin.
  */
-function isTrustedApiRequest(request, trustedHosts) {
+export function isTrustedApiRequest(request, trustedHosts) {
     const host = request.headers.host;
     if (typeof host !== 'string')
         return false;