@linxin666/dsh-remote-web-ui 0.4.2 → 0.4.4

package/src/mount-once.ts

@@ -5,44 +5,138 @@
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections
- * and fail the boot. mountOnce makes the second host apply a no-op for the
- * lifetime of the first instance (the browser half is already deduped by
- * package name in the client module host).
+ * and fail the boot. mountOnce makes a mount of an already-mounted package a
+ * no-op for as long as the first instance lives (the browser half is already
+ * deduped by package name in the client module host).
+ *
+ * A no-op is only safe while the holder is ALIVE. The holder can be disposed
+ * long after the refused mount ran its course: the Host reloads a profile by
+ * creating the new loader entries before the old ones are torn down (a
+ * plugin-manager enable/disable/install write, a settings-driven row reload,
+ * HMR), so the new aggregate shell entry mounts its family plugin while the
+ * previous entry still owns the name. Dropping that refused mount lost the
+ * plugin for good - the previous entry then disposed its own mount, releasing
+ * the name with nobody left to take it, and the family row stayed listed as
+ * active while its host routes 404ed (the task-board panel showed
+ * "board.hostError.notMounted", no degraded record appeared, and only a Host
+ * restart recovered it).
+ *
+ * The refused mount is therefore QUEUED, not dropped, and replayed the moment
+ * the holder releases the name - if the waiting fiber is still alive then. The
+ * single-instance guarantee is unchanged: exactly one mount is live per
+ * package name, and the replay re-enters the guard so a later mount still
+ * dedupes against it.
  *
  * The registry rides a global symbol so two module instances of the same
- * package (npm copy vs repository link) still share one verdict. cordis
- * `ctx.effect` runs its callback immediately and treats the callback's
+ * package (npm copy vs repository link) still share one verdict. That symbol
+ * is a CROSS-REPOSITORY contract, not this file's private state: the four
+ * satellite packages (dsh-skins / dsh-pet / dsh-presets /
+ * dsh-community-plugins) are separate repositories carrying their own copy of
+ * this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+ * must keep the shape every published copy reads (a `Set` of package names
+ * with `has`/`add`/`delete`). The wait queues this guard added therefore live
+ * under their own additive key, and the registry reads back a `Set` even when
+ * some other build left a different value there. Changing `MOUNTED`'s shape
+ * in place broke that contract once: a satellite's legacy copy created a
+ * `Set`, the family's new copy read it as a `Map`, and every family row
+ * mounted after it failed with "claims.get is not a function".
+ *
+ * cordis `ctx.effect` runs its callback immediately and treats the callback's
  * return value as the fiber disposer, so the unmarker is returned, not run.
  */
 
+/** Published cross-repository contract: package names currently mounted. */
 const MOUNTED = Symbol.for('dsh-web.mounted-plugins')
 
+/** Additive key this guard owns: refused mounts waiting for the name. */
+const WAITERS = Symbol.for('dsh-web.mounted-plugins.waiters')
+
+/** The slice of a cordis context this guard touches. */
+interface MountContext {
+  effect?: (effect: () => unknown) => unknown
+}
+
+/** One mount that was refused while another fiber owned the package name. */
+interface PendingMount {
+  /** Replay the refused mount; a no-op once its own fiber has been disposed. */
+  run(): void
+}
+
 interface MountRegistry {
-  [MOUNTED]?: Set<string>
+  [MOUNTED]?: unknown
+  [WAITERS]?: Map<string, PendingMount[]>
 }
 
+/**
+ * The shared name registry, always a `Set` whatever another build stored here:
+ * a foreign value (an interim shape, a hand-written global) must not take every
+ * family plugin down with it.
+ * @returns the process-wide set of mounted package names.
+ */
 function mountedSet(): Set<string> {
   const registry = globalThis as MountRegistry
-  return (registry[MOUNTED] ??= new Set())
+  const existing = registry[MOUNTED]
+  if (existing instanceof Set) return existing as Set<string>
+  const created = new Set<string>()
+  registry[MOUNTED] = created
+  return created
+}
+
+/** Queue per package name for mounts refused while a holder was alive. */
+function mountWaiters(): Map<string, PendingMount[]> {
+  const registry = globalThis as MountRegistry
+  return (registry[WAITERS] ??= new Map())
 }
 
 /**
  * Wrap a cordis plugin apply so the package runs at most once per process.
- * The first mount registers normally and unmarks when its fiber disposes;
- * any later mount of the same package name is a no-op.
+ * The first mount registers normally and releases the name when its fiber
+ * disposes; a mount refused while that name is held waits for the release and
+ * then runs, unless its own fiber disposes first.
  * @param packageName - npm package identity shared by every install source.
  * @param fn - the original plugin apply.
  * @returns an apply of the same shape.
  */
 export function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T {
-  return ((...args: unknown[]) => {
+  const mount = (...args: unknown[]): unknown => {
     const mounted = mountedSet()
-    if (mounted.has(packageName)) return
+    const ctx = args[0] as MountContext | undefined
+    if (mounted.has(packageName)) {
+      // Another fiber (the aggregate row, a standalone install, or a copy built
+      // from an older revision of this guard) owns the name. Queue instead of
+      // dropping: dropping lost the plugin for the rest of the process when the
+      // holder was disposed by a reload.
+      const waiters = mountWaiters()
+      const queue = waiters.get(packageName) ?? []
+      let alive = true
+      const pending: PendingMount = {
+        run: () => {
+          if (alive) mount(...args)
+        },
+      }
+      // A fiber that dies while it waits must not be replayed afterwards: its
+      // context is disposed and registering effects on it would throw.
+      ctx?.effect?.(() => () => {
+        alive = false
+        const index = queue.indexOf(pending)
+        if (index >= 0) queue.splice(index, 1)
+      })
+      queue.push(pending)
+      waiters.set(packageName, queue)
+      return
+    }
     mounted.add(packageName)
-    const ctx = args[0] as { effect?: (effect: () => unknown) => unknown } | undefined
     ctx?.effect?.(() => () => {
       mounted.delete(packageName)
+      const waiters = mountWaiters()
+      const queue = waiters.get(packageName)
+      if (queue === undefined) return
+      waiters.delete(packageName)
+      // Defer the handover one microtask so the disposing mount's own effects
+      // (routes, ledger, timers) are torn down before the next one registers.
+      for (const waiter of queue.splice(0)) queueMicrotask(() => { waiter.run() })
     })
     return fn(...args)
-  }) as T
+  }
+  return mount as T
 }

package/src/pairing.ts

@@ -24,7 +24,7 @@
 import { randomBytes } from 'node:crypto'
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
 import { dirname } from 'node:path'
-import type { PostureSnapshot } from './posture.ts'
+import type { PostureHost, PostureSnapshot } from './posture.ts'
 
 /** The observable pairing phases the panel renders. */
 export type PairingPhase =
@@ -663,6 +663,7 @@ function snapshotsEqual(a: PairingSnapshot, b: PairingSnapshot): boolean {
     && a.publicUrl === b.publicUrl
     && tunnelEqual(a.tunnel, b.tunnel)
     && relayEqual(a.relay, b.relay)
+    && postureEqual(a.posture, b.posture)
     && a.tokenId === b.tokenId
     && a.tokenExpiresAt === b.tokenExpiresAt
     && a.deviceCount === b.deviceCount
@@ -695,6 +696,48 @@ function relayEqual(a: RelayStatus | undefined, b: RelayStatus | undefined): boo
     && a.state === b.state && a.url === b.url && a.error === b.error)
 }
 
+/**
+ * Posture equality. A probe round can change this frame while every other field
+ * stays put — the common case, since the probe re-runs on a settings change and
+ * on a tunnel reaching running, and a quick-tunnel restart churns the probed
+ * host set. Leaving the frame out of the comparison suppressed those emits, so
+ * the loopback SSE stream and the desktop panel could sit on a stale "exposed"
+ * (or stale "clean") verdict for as long as the phase and roster stayed put.
+ */
+function postureEqual(a: PostureSnapshot | undefined, b: PostureSnapshot | undefined): boolean {
+  if (a === b) return true
+  // A frame that is not an object at all (a hand-built context can pass
+  // anything) counts as changed instead of throwing out of the setter.
+  if (!isPostureFrame(a) || !isPostureFrame(b)) return false
+  return a.checkedAt === b.checkedAt && hostsEqual(a.hosts, b.hosts)
+}
+
+/** Whether a value has the shape a posture frame is compared on. */
+function isPostureFrame(value: unknown): value is PostureSnapshot {
+  return typeof value === 'object' && value !== null
+}
+
+/**
+ * Per-host posture equality (a round's verdicts, in probe order). Tolerates a
+ * frame that is not the expected shape: this runs inside the emit path, outside
+ * the listener error containment, so a malformed snapshot handed in by another
+ * host-fiber caller must degrade to "changed" instead of throwing out of the
+ * setter that produced it.
+ */
+function hostsEqual(a: readonly PostureHost[] | undefined, b: readonly PostureHost[] | undefined): boolean {
+  if (a === b) return true
+  if (!Array.isArray(a) || !Array.isArray(b)) return false
+  return a.length === b.length && a.every((host, index) => {
+    const other = b[index]
+    return isPostureHost(host) && isPostureHost(other) && host.host === other.host && host.exposed === other.exposed
+  })
+}
+
+/** Whether a value has the shape one probed host is compared on. */
+function isPostureHost(value: unknown): value is PostureHost {
+  return typeof value === 'object' && value !== null
+}
+
 /** Element-wise string list equality (interface order is meaningful). */
 function sameStrings(a: readonly string[], b: readonly string[]): boolean {
   return a.length === b.length && a.every((value, index) => value === b[index])

package/src/remote-api.ts

@@ -182,7 +182,19 @@ export function makeRemoteApiRoutes(deps: RemoteApiDeps): WebRoute[] {
 }
 
 /**
- * Map one outer upgrade URL onto the loopback path (query string included).
+ * Map one outer upgrade URL onto the loopback path, dropping the cookieless
+ * device credential on the way in.
+ *
+ * The outer handshake carries the device id as `?device=<id>` because WebSocket
+ * handshakes cannot carry headers from the Web API. That id is a live session
+ * credential — it opens the full host API through this same channel — and the
+ * inner leg is a request the rest of the loopback origin sees (on a WebSocket
+ * leg, a raw handshake request line written to a loopback socket), so forwarding
+ * it handed a working credential to every other observer of the local port for
+ * no benefit: the gate above has already authenticated the caller, and no
+ * upstream route reads the parameter (the gateway mux matches on path alone).
+ * The rest of the query rides through unchanged, so a caller's own parameters
+ * still reach the upstream.
  */
 export function upgradeInnerPath(reqUrl: string | undefined, fallbackPath: string): string {
   if (reqUrl === undefined || reqUrl === '') return fallbackPath
@@ -194,6 +206,7 @@ export function upgradeInnerPath(reqUrl: string | undefined, fallbackPath: strin
   }
   const inner = innerPathOf(url.pathname)
   if (inner === undefined) return fallbackPath
+  url.searchParams.delete(REMOTE_DEVICE_QUERY)
   return `${inner}${url.search}`
 }
 

package/src/tunnel.ts

@@ -12,9 +12,16 @@
  *
  * The cloudflared package's Tunnel is a thin spawn wrapper; this manager
  * owns the lifecycle policy (binary readiness, URL timeout, restart
- * backoff) around it. All seams — the tunnel factory, binary readiness,
- * timers — are injectable so the whole lifecycle is unit-testable without
- * a real binary or network.
+ * backoff, and the public-URL readiness watchdog) around it. All seams — the
+ * tunnel factory, binary readiness, the URL probe, timers — are injectable
+ * so the whole lifecycle is unit-testable without a real binary or network.
+ *
+ * 'running' is not a terminal state: the connector can lose its edge
+ * registration while the process keeps living, which leaves a hostname that
+ * no longer resolves. The watchdog below probes the public URL of a running
+ * tunnel and reuses the crash-restart path when it stops answering, so the
+ * relay is re-registered against a freshly minted URL instead of proxying a
+ * dead one (issue #1723).
  */
 
 import { existsSync } from 'node:fs'
@@ -108,6 +115,45 @@ export interface TunnelHandle {
   stop(): boolean
 }
 
+/**
+ * Probe one public tunnel URL from the host. Resolves true when the URL is
+ * served (any HTTP answer below 500 — a harness without credentials answers
+ * 401/403, which is a healthy round trip), false for a DNS failure, a refused
+ * connection, a timeout, or a Cloudflare 5xx (530 "Origin DNS error" / 1033)
+ * — the shapes a tunnel that lost its edge registration produces.
+ *
+ * The probe must never reject: the watchdog reads a rejection as a dead
+ * tunnel and restarts on it, so a local programming error would otherwise
+ * recycle working tunnels forever.
+ * @param url - the tunnel's public URL.
+ * @param timeoutMs - how long one probe may take.
+ * @returns whether the URL answered as a live origin.
+ */
+export async function probeTunnelUrl(url: string, timeoutMs: number): Promise<boolean> {
+  const controller = new AbortController()
+  const timer = setTimeout(() => { controller.abort() }, timeoutMs)
+  try {
+    const response = await fetch(url, {
+      method: 'GET',
+      redirect: 'manual',
+      cache: 'no-store',
+      signal: controller.signal,
+    })
+    // Drain so the connection is reusable instead of half-read.
+    await response.body?.cancel().catch(() => undefined)
+    return response.status < 500
+  } catch {
+    return false
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+/** Default probe: the real network round trip. */
+async function defaultProbe(url: string, timeoutMs: number): Promise<boolean> {
+  return await probeTunnelUrl(url, timeoutMs)
+}
+
 /** Injectable seams (defaults are the real cloudflared package + node timers). */
 export interface TunnelManagerOptions {
   /** Spawn one tunnel process for the target (quick or named). */
@@ -122,6 +168,14 @@ export interface TunnelManagerOptions {
   restartMaxMs?: number
   /** Timer source (injected in tests). */
   timer?: { setTimeout(fn: () => void, ms: number): unknown; clearTimeout(t: unknown): void }
+  /** Probe one public URL; false means the tunnel stopped answering. */
+  probe?: (url: string, timeoutMs: number) => Promise<boolean>
+  /** How often to probe the public URL of a running tunnel (0 disables it). */
+  healthCheckIntervalMs?: number
+  /** Consecutive probe failures after which the tunnel is restarted. */
+  healthCheckFailures?: number
+  /** How long one probe may take. */
+  probeTimeoutMs?: number
 }
 
 /** Time box for the `--version` probe that validates a staged binary. */
@@ -195,6 +249,13 @@ export function createBinaryReadiness(executable: string, seams: BinaryReadiness
 /** How many archive downloads one process may attempt before giving up. */
 export const MAX_BINARY_INSTALL_ATTEMPTS = 3
 
+/** How often a running tunnel's public URL is probed (issue #1723). */
+export const DEFAULT_HEALTH_CHECK_INTERVAL_MS = 60_000
+/** Consecutive failed probes before the tunnel is declared dead. */
+export const DEFAULT_HEALTH_CHECK_FAILURES = 2
+/** How long one public-URL probe may take. */
+export const DEFAULT_PROBE_TIMEOUT_MS = 10_000
+
 /** The readiness policy the manager uses by default: the package's real binary path. */
 const defaultBinaryReadiness = createBinaryReadiness(bin)
 
@@ -289,6 +350,10 @@ export class TunnelManager {
   private readonly restartBaseMs: number
   private readonly restartMaxMs: number
   private readonly timer: { setTimeout(fn: () => void, ms: number): unknown; clearTimeout(t: unknown): void }
+  private readonly probe: (url: string, timeoutMs: number) => Promise<boolean>
+  private readonly healthCheckIntervalMs: number
+  private readonly healthCheckFailures: number
+  private readonly probeTimeoutMs: number
 
   private phase: TunnelPhase = 'stopped'
   private url: string | undefined
@@ -297,6 +362,8 @@ export class TunnelManager {
   private handle: TunnelHandle | undefined
   private urlTimer: unknown | undefined
   private restartTimer: unknown | undefined
+  private healthTimer: unknown | undefined
+  private healthFailures = 0
   private attempts = 0
   // Generation counter: a stale ensureBinary resolution from an earlier
   // start() must not spawn a second handle after a stop/start cycle.
@@ -315,6 +382,10 @@ export class TunnelManager {
     this.restartBaseMs = options.restartBaseMs ?? 5_000
     this.restartMaxMs = options.restartMaxMs ?? 60_000
     this.timer = options.timer ?? nodeTimer
+    this.probe = options.probe ?? defaultProbe
+    this.healthCheckIntervalMs = options.healthCheckIntervalMs ?? DEFAULT_HEALTH_CHECK_INTERVAL_MS
+    this.healthCheckFailures = options.healthCheckFailures ?? DEFAULT_HEALTH_CHECK_FAILURES
+    this.probeTimeoutMs = options.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS
   }
 
   /** The current status frame. */
@@ -418,6 +489,9 @@ export class TunnelManager {
     this.error = undefined
     this.attempts = 0
     this.setPhase('running')
+    // The URL is out; from here the connector can still lose its edge
+    // registration without the process exiting, so readiness is supervised.
+    this.startHealthWatch(value)
     for (const listener of this.urlListeners) {
       try {
         listener(value)
@@ -427,6 +501,69 @@ export class TunnelManager {
     }
   }
 
+  /**
+   * Watch the readiness of a running tunnel. cloudflared can keep its process
+   * (and its metrics port) alive while every edge connection is gone, leaving
+   * a minted hostname that no longer resolves: the manager used to report
+   * 'running' forever and the relay kept forwarding to that dead address, so
+   * the phone hit Cloudflare 1016 instead of the relay's offline page
+   * (issue #1723). A bounded number of consecutive probe failures ends the
+   * attempt through the ordinary fail/backoff path, which mints a new URL and
+   * re-announces the relay.
+   */
+  private startHealthWatch(url: string): void {
+    this.stopHealthWatch()
+    // A phase listener may have stopped the tunnel or replaced its target
+    // while this URL was being announced; only a live running phase schedules.
+    if (this.stopping || this.phase !== 'running') return
+    if (this.healthCheckIntervalMs <= 0 || this.healthCheckFailures <= 0) return
+    this.healthFailures = 0
+    const schedule = (): void => {
+      this.healthTimer = this.timer.setTimeout(() => {
+        this.healthTimer = undefined
+        void this.healthCheck(url)
+      }, this.healthCheckIntervalMs)
+    }
+    schedule()
+  }
+
+  /** One probe round of the running tunnel's public URL. */
+  private async healthCheck(url: string): Promise<void> {
+    // The tunnel may have been stopped, failed, or replaced while the probe
+    // was in flight; only a still-running tunnel toward this same URL is
+    // judged by the result.
+    if (this.stopping || this.phase !== 'running' || this.url !== url) return
+    let alive = false
+    try {
+      alive = await this.probe(url, this.probeTimeoutMs)
+    } catch {
+      alive = false
+    }
+    if (this.stopping || this.phase !== 'running' || this.url !== url) return
+    if (alive) {
+      this.healthFailures = 0
+    } else {
+      this.healthFailures += 1
+      if (this.healthFailures >= this.healthCheckFailures) {
+        this.fail('the tunnel stopped answering on its public URL')
+        return
+      }
+    }
+    this.healthTimer = this.timer.setTimeout(() => {
+      this.healthTimer = undefined
+      void this.healthCheck(url)
+    }, this.healthCheckIntervalMs)
+  }
+
+  /** Cancel the readiness watchdog (teardown, restart, stop). */
+  private stopHealthWatch(): void {
+    if (this.healthTimer !== undefined) {
+      this.timer.clearTimeout(this.healthTimer)
+      this.healthTimer = undefined
+    }
+    this.healthFailures = 0
+  }
+
   private handleExit(): void {
     // The exit handler is detached during teardown, so reaching this point
     // means an unexpected death: fail the current phase and schedule a retry.
@@ -446,6 +583,7 @@ export class TunnelManager {
       this.timer.clearTimeout(this.urlTimer)
       this.urlTimer = undefined
     }
+    this.stopHealthWatch()
     this.setPhase('failed')
     this.attempts += 1
     const delay = Math.min(this.restartBaseMs * 2 ** (this.attempts - 1), this.restartMaxMs)
@@ -458,6 +596,7 @@ export class TunnelManager {
   /** Stop the current process and cancel every pending timer (no phase change). */
   private teardown(): void {
     this.stopping = true
+    this.stopHealthWatch()
     if (this.urlTimer !== undefined) {
       this.timer.clearTimeout(this.urlTimer)
       this.urlTimer = undefined

package/lib/types/client/UpdateEntry.d.ts

@@ -1,14 +0,0 @@
-import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots';
-/** Entry props: the sidebar column state + the standard locale seat. */
-export interface UpdateEntryProps {
-    /** Whether the sidebar renders wide content (false = 56px rail). */
-    wide: boolean;
-    t: TranslateNS<'remote'>;
-}
-/**
- * Render the update trigger and panel.
- * @param props - column state and locale seat.
- * @returns the entry element tree.
- */
-export declare function UpdateEntry({ wide, t }: UpdateEntryProps): import("react").JSX.Element;
-//# sourceMappingURL=UpdateEntry.d.ts.map

package/lib/types/client/UpdateEntry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UpdateEntry.d.ts","sourceRoot":"","sources":["../../../src/client/UpdateEntry.tsx"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAOnE,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;IACb,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;CACzB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,gBAAgB,+BAkHxD"}

package/lib/types/client/UpdateEntry.js

@@ -1,112 +0,0 @@
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-/**
- * The sidebar update seat: the download trigger beside the remote-control
- * trigger plus the update panel modal. Owns the flow — probe the registry
- * on open, show the result, and let the user start the update from the
- * result view (#507), then report the outcome (restart hint on success,
- * translated failure on error).
- * Component-local state per the client stack rules.
- */
-import { useCallback, useEffect, useRef, useState } from "react";
-import { createPortal } from "react-dom";
-import { IconDownloadOutlineRegular } from '@deepseek-ai/dsh-client-ui-primitives';
-import { fetchUpdateStatus, runUpdate, UpdateStatusError } from "./update-api.js";
-import { UpdatePanel } from "./UpdatePanel.js";
-import css from "./remote.module.css";
-/**
- * Render the update trigger and panel.
- * @param props - column state and locale seat.
- * @returns the entry element tree.
- */
-export function UpdateEntry({ wide, t }) {
-    const [open, setOpen] = useState(false);
-    const [view, setView] = useState({ kind: "checking" });
-    const [updateAvailable, setUpdateAvailable] = useState(false);
-    const runToken = useRef(0);
-    const availabilityToken = useRef(0);
-    const mounted = useRef(false);
-    const probeAvailability = useCallback(async () => {
-        const token = ++availabilityToken.current;
-        try {
-            const status = await fetchUpdateStatus();
-            if (token === availabilityToken.current) {
-                setUpdateAvailable(status.mode === "npm" && status.outdated);
-            }
-        }
-        catch {
-            if (token === availabilityToken.current)
-                setUpdateAvailable(false);
-        }
-    }, []);
-    const check = useCallback(async () => {
-        const availabilityCheck = ++availabilityToken.current;
-        setView({ kind: "checking" });
-        let status;
-        try {
-            status = await fetchUpdateStatus();
-        }
-        catch (error) {
-            if (availabilityCheck === availabilityToken.current)
-                setUpdateAvailable(false);
-            // HTTP 404: the update route is not mounted — the host process runs an
-            // older plugin build (client refreshed, host did not). Restarting dsh
-            // web loads the new plugin; a plain network failure gets the generic
-            // offline copy instead of a misleading "cannot reach update source".
-            if (error instanceof UpdateStatusError && error.status === 404) {
-                setView({ kind: "error", message: t("update.unmounted"), detail: t("update.unmountedDetail") });
-                return;
-            }
-            setView({ kind: "error", message: t("update.offline"), detail: t("update.offlineDetail") });
-            return;
-        }
-        if (availabilityCheck === availabilityToken.current) {
-            setUpdateAvailable(status.mode === "npm" && status.outdated);
-        }
-        if (status.error === "registry-unreachable") {
-            setView({ kind: "result", status });
-            return;
-        }
-        // Checking never starts an update by itself (#507): the result view
-        // carries the confirmation button that calls startUpdate.
-        setView({ kind: "result", status });
-    }, [t]);
-    const startUpdate = useCallback(async (status) => {
-        if (status.mode !== "npm" || !status.outdated)
-            return;
-        setView({ kind: "updating", status });
-        const token = ++runToken.current;
-        try {
-            const result = await runUpdate();
-            if (result.ok && mounted.current)
-                setUpdateAvailable(false);
-            if (token !== runToken.current)
-                return;
-            setView({ kind: "done", result });
-        }
-        catch {
-            if (token !== runToken.current)
-                return;
-            setView({ kind: "error", message: t("update.error"), detail: t("update.offlineDetail") });
-        }
-    }, [t]);
-    const openPanel = useCallback(() => {
-        setOpen(true);
-        void check();
-    }, [check]);
-    const closePanel = useCallback(() => {
-        runToken.current++;
-        setOpen(false);
-    }, []);
-    // Check once after mount without opening the panel or starting an update.
-    useEffect(() => {
-        mounted.current = true;
-        void probeAvailability();
-        return () => {
-            mounted.current = false;
-            runToken.current++;
-            availabilityToken.current++;
-        };
-    }, [probeAvailability]);
-    const updateLabel = updateAvailable ? t("update.availableLabel") : t("update.label");
-    return (_jsxs(_Fragment, { children: [_jsxs("button", { type: "button", className: css.trigger, "data-wide": wide ? (updateAvailable ? "wide" : undefined) : "rail", "data-update-available": updateAvailable ? "true" : undefined, "aria-label": updateLabel, "aria-expanded": open, title: updateLabel, onClick: openPanel, children: [_jsx(IconDownloadOutlineRegular, { size: wide ? 16 : 18 }), updateAvailable && wide && (_jsx("span", { className: css.updateBadgeText, children: t("update.badge") }))] }), open && createPortal((_jsxs("div", { className: css.overlay, role: "presentation", children: [_jsx("div", { className: css.mask, "aria-hidden": "true", onClick: closePanel }), _jsx(UpdatePanel, { t: t, view: view, onClose: closePanel, onRecheck: () => { void check(); }, onStartUpdate: (status) => { void startUpdate(status); } })] })), document.body)] }));
-}

package/lib/types/client/UpdatePanel.d.ts

@@ -1,42 +0,0 @@
-/**
- * The update panel body: check progress, version comparison, the
- * auto-update in-flight state, and the outcome (restart hint on success,
- * translated failure on error). Pure presentation — all state arrives
- * through props from the entry behavior component.
- */
-import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots';
-import type { UpdateRunResult, UpdateStatus } from '../update.ts';
-/** The panel view state, owned by the entry component. */
-export type UpdateView = {
-    kind: 'checking';
-} | {
-    kind: 'result';
-    status: UpdateStatus;
-} | {
-    kind: 'updating';
-    status: UpdateStatus;
-} | {
-    kind: 'done';
-    result: UpdateRunResult;
-} | {
-    kind: 'error';
-    message: string;
-    detail?: string;
-};
-/** Full panel props: copy + view state + actions. */
-export interface UpdatePanelProps {
-    t: TranslateNS<'remote'>;
-    view: UpdateView;
-    onClose(): void;
-    /** Re-run the check from a terminal state. */
-    onRecheck(): void;
-    /** Start the update from the result view (the confirmation step, #507). */
-    onStartUpdate(status: UpdateStatus): void;
-}
-/**
- * Render the update panel.
- * @param props - copy, view state, and actions.
- * @returns the panel element tree.
- */
-export declare function UpdatePanel({ t, view, onClose, onRecheck, onStartUpdate }: UpdatePanelProps): import("react").JSX.Element;
-//# sourceMappingURL=UpdatePanel.d.ts.map

package/lib/types/client/UpdatePanel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"UpdatePanel.d.ts","sourceRoot":"","sources":["../../../src/client/UpdatePanel.tsx"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAEnE,OAAO,KAAK,EAAsB,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGrF,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvD,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,IAAI,IAAI,CAAA;IACf,8CAA8C;IAC9C,SAAS,IAAI,IAAI,CAAA;IACjB,2EAA2E;IAC3E,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;CAC1C;AAYD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,gBAAgB,+BAiD3F"}