@marktrue/dsh-mobile-remote 3.2.1-alpha.3 → 3.2.1-rc.1

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## v3.2.1-rc.1（build 26，issue #39）— NPM-only 自动更新（v3.2.1 线）
+
+> 插件 `3.2.1-rc.1` / App `3.2.1+26` / 载体 `3.2.1-rc.1-app`。本 fork 的 v3.2.1 预发布候选；仅发布到本地 registry 做本机验收，不触发公共 npm 发布或 tag。
+
+### 更新源与安全
+
+- 插件更新唯一来源为宿主有效 npm 配置（`@marktrue:registry` 优先，未设置时用默认 `registry`），手机不直连 npm，registry 凭据不下发。
+- 稳定版跟随 `latest`；预发布跟随自身通道（`alpha` / `rc`）；carrier 使用精确 `<插件完整版本>-app` 并由 `app` tag 约束。
+- 校验 npm `dist.integrity`、插件内容哈希、载体清单、APK 身份与签名；缺 carrier、元数据不一致、降级一律 fail-closed，不改 profile、不触发重启。
+- profile 依赖保持精确 npm 版本，不保留长期 `file:` tarball；回滚恢复更新前精确 spec。
+- 旧 carrier 缺轻量元数据时：仅用户显式操作后准备并校验 carrier，先展示真实 App build，再要求最终确认；最终 POST 前不改 profile。
+
+### 手机 / 桌面
+
+- 移除 App 更新源菜单；App-only 入口改名「检查 App 更新」。
+- 插件更新详情与安装日志合并为可折叠、可复制的脱敏面板，按 opId + 序号回放，重启后仍可查看。
+- 新增「更新进度」卡片：六步时间线、当前阶段、已用时、目标版本、最近一行 pnpm 输出；失败直接显示可读原因与稳定码。
+- 完成后等待宿主固定 App 发布就绪再显示完成；「检查 App 更新」自动接续，无需回首页刷新。
+- 历史失败/未确认事务不再阻塞 App 更新；APK 按 sha 复用，安装未完成给出可执行指引。
+- 桌面「连接移动端」同步显示阶段文本与最新输出。
+
+### 平台
+
+- Windows：npm/pnpm 经 shell 调用，缺失客户端给出稳定原因；桌面原生自更新仍受 `restart-unsupported` 限制（Linux/WSL 宿主可完成自更新）。
+
 ## v3.2.1-alpha.3（2026-10-26）— Android release 签名密钥迁移
 
 > 插件 `3.2.1-alpha.3` / App `3.2.1+25` / 载体 `3.2.1-alpha.3-app`。插件更新 `alpha` dist-tag；`latest` 保持在 alpha1。

package/lib/app-carrier.js

@@ -391,6 +391,13 @@ function validateCarrierCandidate(candidate, plugin) {
 	if (!manifestFile.ok) return { ok: false, reason: manifestFile.code === "missing" ? "carrier-manifest-missing" : "carrier-manifest-unreadable" };
 	const problem = manifestProblem(manifestFile.value, plugin);
 	if (problem) return { ok: false, reason: problem };
+	// New carriers expose this in NPM packument for lightweight checks; old carriers may omit it.
+	if (pkg.appVersion !== undefined && pkg.appVersion !== manifestFile.value.app.version) {
+		return { ok: false, reason: "carrier-app-version-metadata-mismatch" };
+	}
+	if (pkg.pluginContentSha256 !== undefined && pkg.pluginContentSha256 !== manifestFile.value.plugin.contentSha256) {
+		return { ok: false, reason: "carrier-plugin-content-sha256-metadata-mismatch" };
+	}
 	const apk = validateCarrierApk(candidate.source, manifestFile.value.app);
 	if (!apk.ok) return { ok: false, reason: apk.reason };
 	let contentSha256 = null;

package/lib/client.js

@@ -331,6 +331,153 @@ window.__ModuleLoader__.load({
 		}
 		exports.buildSectionModel = buildSectionModel;
 
+		/** Normalize the host's authenticated NPM check response for the settings panel. */
+		function buildPluginUpdateModel(status) {
+			var value = status && typeof status === "object" ? status : {};
+			var candidate = value.candidate && typeof value.candidate === "object" ? value.candidate : null;
+			var plugin = candidate && candidate.plugin && typeof candidate.plugin === "object" ? candidate.plugin : {};
+			var carrier = candidate && candidate.carrier && typeof candidate.carrier === "object" ? candidate.carrier : {};
+			var state = String(value.state || "unknown");
+			var transaction = value.transaction && typeof value.transaction === "object" ? value.transaction : null;
+			var appVersion = String(carrier.appVersion || transaction?.targetAppVersion || "");
+			return {
+				state: state,
+				reason: String(value.reason || ""),
+				candidate: candidate,
+				hasUpdate: state === "update-available" && Boolean(plugin.version),
+				canSelfUpdate: value.canSelfUpdate === true,
+				pluginVersion: String(plugin.version || transaction?.targetVersion || ""),
+				appVersion: appVersion,
+				needsPreparation: state === "update-available" && !appVersion,
+				transaction: value.transaction && typeof value.transaction === "object" ? value.transaction : null,
+				guidance: value.guidance && typeof value.guidance === "object" ? value.guidance : null,
+				checkLog: pluginUpdateCheckLogLines(value),
+			};
+		}
+		exports.buildPluginUpdateModel = buildPluginUpdateModel;
+
+		/** 检查日志投影：只保留有界字符串行，桌面与手机显示同一份脱敏诊断。 */
+		function pluginUpdateCheckLogLines(value) {
+			var source = value && typeof value === "object" && Array.isArray(value.checkLog) ? value.checkLog : [];
+			return source
+				.map(function (line) { return String(line == null ? "" : line).trim(); })
+				.filter(function (line) { return line !== ""; })
+				.slice(-40);
+		}
+		exports.pluginUpdateCheckLogLines = pluginUpdateCheckLogLines;
+
+		/** pnpm/宿主 stage → 面向用户的阶段名（与手机端一致）。 */
+		function pluginUpdateStageText(stage) {
+			var value = String(stage || "").toLowerCase();
+			var known = {
+				staging: "准备更新", prepare: "准备更新", download: "下载插件与载体", verify: "校验下载产物",
+				extract: "校验插件内容", snapshot: "生成安装快照", switch: "写入 profile 依赖",
+				install: "安装依赖（pnpm install）", restart: "重启宿主", "restart-pending": "等待宿主重启",
+				supervisor: "等待健康确认", worker: "电脑端工人进程处理中", finished: "更新完成", failed: "更新失败",
+			};
+			return known[value] || String(stage || "");
+		}
+		exports.pluginUpdateStageText = pluginUpdateStageText;
+
+		var PLUGIN_UPDATE_STEPS = ["检查候选", "下载校验", "安装依赖", "重启宿主", "健康确认", "完成"];
+
+		/** 事务 + 最新日志事件 → 六步进度（桌面与手机端同一套语义）。 */
+		function pluginUpdateProgress(model, lastEvent) {
+			var transaction = model && model.transaction && typeof model.transaction === "object" ? model.transaction : null;
+			var phase = String(transaction && transaction.phase || "");
+			var result = transaction && transaction.result && typeof transaction.result === "object" ? transaction.result : null;
+			var rolledBack = Boolean(transaction && transaction.rolledBack === true);
+			var failed = rolledBack || phase === "rolled-back" || phase === "failed" || (phase === "settled" && result && result.ok === false);
+			var terminal = ["settled", "failed", "rolled-back"].includes(phase);
+			if (failed) return { step: 4, text: "更新失败/已回滚", terminal: true, failed: true };
+			if (phase === "settled") return { step: 5, text: "更新完成", terminal: true, failed: false };
+			if (phase === "rolling-back") return { step: 4, text: "健康确认失败，正在回滚", terminal: false, failed: true };
+			var stage = String(lastEvent && lastEvent.stage || "").toLowerCase();
+			var byStage = {
+				staging: 0, prepare: 0, download: 1, verify: 1, extract: 1, snapshot: 1,
+				switch: 2, install: 2, worker: 2, restart: 3, "restart-pending": 3,
+				supervisor: 4, finished: 5, failed: 4,
+			};
+			if (byStage[stage] !== undefined) return { step: byStage[stage], text: pluginUpdateStageText(stage) || "处理中", terminal: false, failed: false };
+			var byPhase = { staging: 0, installing: 2, "restart-pending": 3 };
+			if (byPhase[phase] !== undefined) return { step: byPhase[phase], text: pluginUpdateProgressPhaseText(phase), terminal: false, failed: false };
+			return { step: 0, text: "准备中", terminal: false, failed: false };
+		}
+		function pluginUpdateProgressPhaseText(phase) {
+			if (phase === "staging") return "准备更新";
+			if (phase === "installing") return "安装依赖（pnpm install）";
+			if (phase === "restart-pending") return "等待宿主重启";
+			return pluginUpdateStageText(phase) || "处理中";
+		}
+		exports.pluginUpdateProgress = pluginUpdateProgress;
+		exports.pluginUpdateProgressSteps = PLUGIN_UPDATE_STEPS;
+
+		/** 安装进度事件 → 一行文本（与手机端一致）。 */
+		function pluginUpdateEventLine(event) {
+			var stage = String(event && event.stage || "update");
+			var stream = String(event && event.stream || "status");
+			var text = String(event && event.text || "");
+			return stream === "status" ? "[" + stage + "] " + text : "[" + stage + "][" + stream + "] " + text;
+		}
+
+		/** 失败原因的稳定码 → 可读文案（未知码原样显示，绝不隐藏）。 */
+		function updateFailureReasonText(reason) {
+			var value = String(reason || "");
+			var known = {
+				"npm-carrier-plugin-identity-mismatch": "载体清单与 NPM 包身份不一致（版本/大小校验失败）",
+				"npm-carrier-manifest-unreadable": "载体清单不可读",
+				"npm-carrier-extract-failed": "载体解包失败",
+				"npm-plugin-tarball-sha256-mismatch": "插件 tarball 字节哈希与载体清单不一致",
+				"npm-plugin-content-sha256-mismatch": "插件内容标识与载体清单不一致",
+				"npm-packument-content-sha256-mismatch": "NPM 包内容与载体清单不一致",
+				"npm-packument-app-version-mismatch": "NPM 包 App build 与载体清单不一致",
+				"npm-pack-failed": "宿主机 npm pack 下载插件/载体失败",
+				"npm-pack-integrity-mismatch": "npm pack 产物完整性不符（registry 返回异常）",
+				"npm-pack-metadata-mismatch": "npm pack 返回的包版本/完整性不符",
+				"npm-pack-tarball-missing": "npm pack 产物缺失",
+				"install-failed": "pnpm 安装失败",
+				"health-check-failed": "新插件健康检查失败，已回滚",
+				"rollback-failed": "回滚失败，需要人工处理",
+				"restart-unsupported": "宿主形态不支持自动重启",
+			};
+			return known[value] ? known[value] + "（" + value + "）" : value;
+		}
+		exports.updateFailureReasonText = updateFailureReasonText;
+
+		/** 合并检查详情与安装详情：一个“插件更新详情”列表，桌面/手机同源。 */
+		function pluginUpdateDetailLines(model, events) {
+			var lines = pluginUpdateCheckLogLines(model).slice();
+			var install = (Array.isArray(events) ? events : []).map(pluginUpdateEventLine).filter(Boolean);
+			if (install.length) {
+				lines.push("# 安装详情（宿主 pnpm 输出，已脱敏）");
+				lines = lines.concat(install);
+			}
+			var transaction = model && model.transaction && typeof model.transaction === "object" ? model.transaction : null;
+			var result = transaction && transaction.result && typeof transaction.result === "object" ? transaction.result : null;
+			if (result && result.reason) {
+				lines.push("# 安装结果：" + String(transaction.phase || "failed") + " · 原因：" + updateFailureReasonText(result.reason));
+			}
+			return lines;
+		}
+		exports.pluginUpdateDetailLines = pluginUpdateDetailLines;
+
+		/** 检查不可用的可读原因：区分「npm 客户端缺失」与「registry 不可用」。 */
+		function updateCheckReasonText(reason) {
+			if (reason === "npm-client-unavailable") return "找不到 npm 客户端（请确认 DSH 进程的 PATH 包含 npm）";
+			if (reason === "npm-registry-unavailable") return "无法访问 npm registry（请检查主机 npm 配置与网络）";
+			if (reason === "npm-channel-version-missing") return "npm 上没有本机预发布通道对应的 dist-tag（展开检查日志查看查询步骤）";
+			if (reason === "npm-plugin-metadata-unavailable") return "读取插件版本元数据失败（展开检查日志查看查询步骤）";
+			if (reason === "npm-carrier-metadata-unavailable") return "读取配对载体元数据失败（展开检查日志查看查询步骤）";
+			return reason || "registry-unavailable";
+		}
+		exports.updateCheckReasonText = updateCheckReasonText;
+
+		function apiRoute(basePath, route) {
+			var mount = String(basePath || "/m").replace(/\/+$/, "");
+			if (!mount || mount === "/") mount = "/m";
+			return mount + "/api" + route;
+		}
+
 		/** 选项卡按钮（内联样式，与设置页现有观感一致）。 */
 		function tabButton(tab, active, onSelect) {
 			return jsxRuntime.jsx(
@@ -578,6 +725,112 @@ window.__ModuleLoader__.load({
 			});
 		}
 
+		function pluginUpdatePane(model, workflow, logs, logExpanded, showAllLogs, actions) {
+			var candidate = workflow.candidate || model.candidate || {};
+			var plugin = candidate.plugin && typeof candidate.plugin === "object" ? candidate.plugin : {};
+			var carrier = candidate.carrier && typeof candidate.carrier === "object" ? candidate.carrier : {};
+			var transaction = model.transaction && typeof model.transaction === "object" ? model.transaction : {};
+			var pluginVersion = String(workflow.transaction && transaction.targetVersion || plugin.version || model.pluginVersion || "");
+			var appVersion = String(workflow.transaction && transaction.targetAppVersion || carrier.appVersion || model.appVersion || "");
+			var events = Array.isArray(logs.events) ? logs.events : [];
+			var installLines = events.map(pluginUpdateEventLine).filter(Boolean);
+			var visibleInstallLines = installLines;
+			if (!showAllLogs && installLines.length > 12) {
+				visibleInstallLines = installLines.slice(0, 4).concat(["… 中间 " + (installLines.length - 12) + " 行已折叠 …"], installLines.slice(-8));
+			}
+			var checkLines = pluginUpdateCheckLogLines(model);
+			var displayLines = checkLines.concat(installLines.length ? ["# 安装详情（宿主 pnpm 输出，已脱敏）"] : [], visibleInstallLines);
+			var detailLineCount = pluginUpdateDetailLines(model, events).length;
+			var working = ["preparing", "submitting", "running"].includes(workflow.status);
+			var statusText = model.state === "loading" ? "正在检查 NPM 更新…"
+				: model.state === "update-available" ? "发现插件更新候选"
+				: model.state === "up-to-date" || model.state === "local-ahead" ? "当前插件已是最新"
+				: model.state === "disabled" ? "NPM 自动更新已关闭"
+				: model.state === "unavailable" ? "检查暂不可用：" + updateCheckReasonText(model.reason)
+				: "等待检查";
+			var operationTarget = workflow.transaction && (pluginVersion || appVersion)
+				? jsxRuntime.jsx("div", { style: { fontSize: "12px", lineHeight: "1.6" }, children: "操作目标：插件 v" + (pluginVersion || "未知") + (appVersion ? " · App build " + appVersion : "") })
+				: null;
+			var actionButton = model.hasUpdate && model.canSelfUpdate && !["preparing", "submitting", "running", "confirming"].includes(workflow.status)
+				? jsxRuntime.jsx("button", {
+						style: Object.assign({}, btnStyle, { marginLeft: 0 }),
+						disabled: working,
+						onClick: actions.onBegin,
+						children: model.needsPreparation ? "准备更新" : "更新插件",
+					})
+				: null;
+			var confirmBox = workflow.status === "confirming"
+				? jsxRuntime.jsx("div", {
+						style: { padding: "10px", borderRadius: "8px", border: "1px solid var(--dsw-alias-brand-primary, #4d6bfe)", background: "rgba(77,107,254,.08)" },
+						children: [
+							jsxRuntime.jsx("div", { style: { fontWeight: 600, marginBottom: "4px" }, children: "请确认安装目标" }),
+							jsxRuntime.jsx("div", { style: { fontSize: "12.5px", lineHeight: "1.6" }, children: "插件 v" + pluginVersion + (appVersion ? " · App build " + appVersion : "") }),
+							jsxRuntime.jsx("div", { style: { fontSize: "12px", margin: "4px 0 8px", color: "var(--dsw-alias-label-secondary, #888)" }, children: "确认后电脑端会使用主机 npm 配置安装，并重启 DSH；连接短暂中断属正常。" }),
+							jsxRuntime.jsx("div", { style: { display: "flex", gap: "8px" }, children: [
+								jsxRuntime.jsx("button", { style: Object.assign({}, btnStyle, { marginLeft: 0 }), onClick: actions.onCancel, children: "取消" }),
+								jsxRuntime.jsx("button", { style: Object.assign({}, btnStyle, { marginLeft: 0, borderColor: "var(--dsw-alias-brand-primary, #4d6bfe)" }), onClick: actions.onConfirm, children: "确认并安装" }),
+							] }),
+						],
+					})
+				: null;
+			var lastEvent = events.length ? events[events.length - 1] : null;
+			var progress = pluginUpdateProgress(model, lastEvent);
+			var liveLine = lastEvent && lastEvent.text ? String(lastEvent.text).trim() : "";
+			if (liveLine.length > 140) liveLine = liveLine.slice(0, 140) + "…";
+			var progressSteps = PLUGIN_UPDATE_STEPS.map(function (name, index) {
+				var done = index <= progress.step;
+				return jsxRuntime.jsx("span", { style: { color: done ? (progress.failed ? "var(--dsw-alias-text-danger, #e5484d)" : "var(--dsw-alias-brand-primary, #4d6bfe)") : "var(--dsw-alias-label-tertiary, #9aa0a6)", fontWeight: index === progress.step ? 700 : 400, marginRight: "6px" }, children: (done ? "● " : "○ ") + name }, "update-step-" + index);
+			});
+			var progressBox = (workflow.transaction || model.transaction || events.length)
+				? jsxRuntime.jsx("div", { style: { display: "flex", flexDirection: "column", gap: "3px" }, children: [
+					jsxRuntime.jsx("div", { style: { fontSize: "12px", fontWeight: 600 }, children: "当前阶段：" + progress.text }),
+					jsxRuntime.jsx("div", { style: { fontSize: "10.5px", display: "flex", flexWrap: "wrap" }, children: progressSteps }),
+					liveLine ? jsxRuntime.jsx("div", { style: { fontSize: "11px", fontFamily: "monospace", color: "var(--dsw-alias-label-secondary, #888)", whiteSpace: "pre-wrap", overflowWrap: "anywhere" }, children: "最新输出：" + liveLine }) : null,
+				] })
+				: null;
+			var checkLog = Array.isArray(model.checkLog) ? model.checkLog.slice(-40) : [];
+			var detailsVisible = detailLineCount > 0 || workflow.transaction || events.length;
+			var detailsPanel = detailsVisible
+				? jsxRuntime.jsx("div", { style: { marginTop: "4px", display: "flex", flexDirection: "column", gap: "8px" }, children: [
+					jsxRuntime.jsx("button", { style: Object.assign({}, btnStyle, { marginLeft: 0, alignSelf: "flex-start" }), "aria-expanded": !!logExpanded, onClick: actions.onToggleLogs,
+						children: (logExpanded ? "收起" : "查看") + "插件更新详情（" + detailLineCount + " 行）" }),
+					logExpanded ? jsxRuntime.jsx("div", { style: { border: "1px solid var(--dsw-alias-divider-strong, rgba(128,128,128,.2))", borderRadius: "8px", overflow: "hidden" }, children: displayLines.length ? displayLines.map(function (line, index) {
+						var command = line.charAt(0) === "$";
+						var note = line.charAt(0) === "#";
+						var failed = /^\[(failed|rolled-back|rollback)\]/.test(line);
+						if (command) {
+							return jsxRuntime.jsx("div", { style: { display: "flex", alignItems: "center", gap: "8px", padding: "6px 10px", background: "rgba(0,0,0,.05)", fontFamily: "monospace", fontSize: "11.5px" }, children: [
+								jsxRuntime.jsx("span", { style: { color: "#1f9d55", lineHeight: 1 }, children: "●" }),
+								jsxRuntime.jsx("span", { style: { flex: 1, whiteSpace: "pre-wrap", overflowWrap: "anywhere" }, children: line }),
+								jsxRuntime.jsx("button", { style: Object.assign({}, btnStyle, { marginLeft: 0, padding: "1px 8px", fontSize: "11px" }), onClick: actions.onCopyDetails, children: "复制" }),
+							] }, "update-details-cmd-" + index);
+						}
+						return jsxRuntime.jsx("div", { style: { padding: "2px 10px", fontFamily: "monospace", fontSize: "11px", lineHeight: "1.55", whiteSpace: "pre-wrap", overflowWrap: "anywhere", color: failed ? "var(--dsw-alias-text-danger, #e5484d)" : note ? "var(--dsw-alias-label-tertiary, #9aa0a6)" : "inherit" }, children: line }, "update-details-line-" + index);
+					}) : jsxRuntime.jsx("div", { style: { padding: "6px 10px", fontFamily: "monospace", fontSize: "11px", color: "var(--dsw-alias-label-secondary, #888)" }, children: "等待 pnpm 输出…" }) }) : null,
+					logExpanded && installLines.length > 12 ? jsxRuntime.jsx("button", { style: Object.assign({}, btnStyle, { marginLeft: 0, alignSelf: "flex-start" }), onClick: actions.onToggleAllLogs, children: showAllLogs ? "折叠中间安装日志" : "展开全部安装日志" }) : null,
+				] })
+				: null;
+			return jsxRuntime.jsx("div", {
+				style: { marginTop: "14px", padding: "12px", borderRadius: "10px", border: "1px solid var(--dsw-alias-divider-strong, rgba(128,128,128,.2))", display: "flex", flexDirection: "column", gap: "8px" },
+				children: [
+					jsxRuntime.jsx("div", { style: { fontSize: "14px", fontWeight: 650 }, children: "电脑端插件更新" }),
+					jsxRuntime.jsx("div", { style: { fontSize: "12.5px", color: "var(--dsw-alias-label-secondary, #888)" }, children: statusText }),
+					progressBox,
+					model.hasUpdate ? jsxRuntime.jsx("div", { style: { fontSize: "12.5px", lineHeight: "1.6" }, children: "插件 v" + pluginVersion + (appVersion ? " · App build " + appVersion : " · App build 将在准备后核验") }) : null,
+					operationTarget,
+					model.hasUpdate && !model.canSelfUpdate ? jsxRuntime.jsx("div", { style: { fontSize: "12px", color: "var(--dsw-alias-label-secondary, #888)" }, children: model.guidance?.summary || "当前安装形态需要按电脑端指引更新。" }) : null,
+					workflow.status === "preparing" ? jsxRuntime.jsx("div", { style: { fontSize: "12px" }, children: "正在从主机 NPM 源准备并校验 carrier；profile 尚未修改…" }) : null,
+					workflow.status === "submitting" ? jsxRuntime.jsx("div", { style: { fontSize: "12px" }, children: "正在提交安装事务…" }) : null,
+					workflow.status === "running" ? jsxRuntime.jsx("div", { style: { fontSize: "12px" }, children: "pnpm 安装/重启进行中；输出会保留并可在重连后继续查看。" }) : null,
+					workflow.message ? jsxRuntime.jsx("div", { style: { fontSize: "12px", color: workflow.status === "failed" ? "var(--dsw-alias-text-danger, #e5484d)" : "inherit" }, children: workflow.message }) : null,
+					detailsPanel,
+					actionButton,
+					confirmBox,
+					jsxRuntime.jsx("button", { style: Object.assign({}, btnStyle, { marginLeft: 0, alignSelf: "flex-start" }), disabled: model.state === "loading", onClick: actions.onCheck, children: model.state === "loading" ? "检查中…" : "手动检查更新" }),
+				],
+			});
+		}
+
 		/**
 		 * 设置页 section：连接移动端设备（两个选项卡：已安装 App / 未安装 App）。
 		 * 挂载后从 /m/api/qr-config 拉取地址、口令与下载码数据。
@@ -597,8 +850,38 @@ window.__ModuleLoader__.load({
 			var refreshState = useState(0);
 			var refreshTick = refreshState[0];
 			var setRefreshTick = refreshState[1];
+			var updateCheckState = useState({ state: "loading", reason: "not-checked", hasUpdate: false, canSelfUpdate: false, candidate: null });
+			var updateStatus = updateCheckState[0];
+			var setUpdateStatus = updateCheckState[1];
+			var updateTickState = useState(0);
+			var updateTick = updateTickState[0];
+			var setUpdateTick = updateTickState[1];
+			var workflowState = useState({ status: "idle", opId: "", prepareId: "", candidate: null, transaction: false, message: "" });
+			var workflow = workflowState[0];
+			var setWorkflow = workflowState[1];
+			var logsState = useState({ events: [], lastSeq: 0, firstSeq: 0, truncated: false });
+			var logs = logsState[0];
+			var setLogs = logsState[1];
+			var logExpandedState = useState(false);
+			var logExpanded = logExpandedState[0];
+			var setLogExpanded = logExpandedState[1];
+			var showAllLogsState = useState(false);
+			var showAllLogs = showAllLogsState[0];
+			var setShowAllLogs = showAllLogsState[1];
+			// 检查日志展开状态与复制：桌面端与手机端使用同一份宿主 checkLog。
 			var requestGeneration = 0;
 
+			var copyUpdateDetails = function () {
+				var lines = pluginUpdateDetailLines(updateStatus, logs.events);
+				if (!lines.length) return;
+				var text = lines.join("\n");
+				try {
+					if (navigator.clipboard && typeof navigator.clipboard.writeText === "function") {
+						navigator.clipboard.writeText(text);
+					}
+				} catch (_) { /* 复制失败不影响日志展示 */ }
+			};
+
 			useEffect(function () {
 				var alive = true;
 				var timer = null;
@@ -655,9 +938,185 @@ window.__ModuleLoader__.load({
 					if (timer) clearTimeout(timer);
 				};
 			}, [refreshTick]);
+
+			// Automatically check the host's NPM candidate when the connection token becomes available.
+			useEffect(function () {
+				if (data.status !== "ready" || !data.token) {
+					if (data.status === "ready") setUpdateStatus({ state: "unavailable", reason: "auth-token-unavailable", hasUpdate: false, canSelfUpdate: false, candidate: null });
+					return;
+				}
+				var alive = true;
+				setUpdateStatus(function (previous) { return Object.assign({}, previous, { state: "loading", reason: "checking" }); });
+				fetch(apiRoute(data.basePath, "/plugin-update/check"), {
+					method: "GET",
+					headers: { accept: "application/json", "x-mobile-token": data.token },
+				})
+					.then(function (res) { if (!res.ok) throw new Error("HTTP " + res.status); return res.json(); })
+					.then(function (body) {
+						if (!alive) return;
+						var model = buildPluginUpdateModel(body.pluginUpdate);
+					setUpdateStatus(model);
+					var tx = model.transaction;
+					if (tx && tx.opId) {
+						var terminal = ["settled", "rolled-back", "failed"].includes(String(tx.phase));
+						if (!terminal) setLogExpanded(true);
+						setWorkflow(function (previous) {
+							if (previous.opId === tx.opId && previous.transaction) return previous;
+						return { status: terminal ? (tx.phase === "settled" ? "done" : "failed") : "running",
+							opId: tx.opId, prepareId: "", candidate: model.candidate, transaction: true,
+							message: terminal ? (tx.phase === "settled" ? "最近一次插件更新已完成。" : "最近一次插件更新结束：" + tx.phase) : "接续电脑端正在进行的插件更新。" };
+						});
+					}
+					})
+					.catch(function (err) {
+						if (alive) setUpdateStatus({ state: "unavailable", reason: String(err?.message ?? "update-check-failed"), hasUpdate: false, canSelfUpdate: false, candidate: null });
+					});
+				return function () { alive = false; };
+			}, [data.status, data.basePath, data.token, updateTick]);
+
 			var refresh = function () {
 				setRefreshTick(function (n) { return n + 1; });
 			};
+			var checkPluginUpdate = function () { setUpdateTick(function (n) { return n + 1; }); };
+			var makeOperationId = function () {
+				if (window.crypto && typeof window.crypto.randomUUID === "function") return window.crypto.randomUUID();
+				return "web-" + Date.now().toString(36) + "-" + Math.random().toString(36).slice(2, 12);
+			};
+			var postUpdateJson = function (route, payload) {
+				return fetch(apiRoute(data.basePath, route), {
+					method: "POST",
+					headers: { accept: "application/json", "content-type": "application/json", "x-mobile-token": data.token },
+					body: JSON.stringify(payload),
+				}).then(function (res) {
+					return res.json().catch(function () { return {}; }).then(function (body) {
+						if (!res.ok) {
+						var error = new Error(String(body.error || ("HTTP " + res.status)));
+						error.code = String(body.error || ("http-" + res.status));
+						error.status = res.status;
+						error.body = body;
+						throw error;
+					}
+					return body;
+					});
+				});
+			};
+			var beginPluginUpdate = function () {
+				var candidate = updateStatus.candidate;
+				if (!updateStatus.hasUpdate || !candidate) return;
+				var opId = makeOperationId();
+				setLogs({ events: [], lastSeq: 0, firstSeq: 0, truncated: false });
+				setWorkflow({ status: updateStatus.needsPreparation ? "preparing" : "confirming", opId: opId,
+					prepareId: "", candidate: candidate, transaction: false, message: "" });
+				if (!updateStatus.needsPreparation) return;
+				postUpdateJson("/plugin-update/prepare", { opId: opId })
+					.then(function (body) {
+						if (body.action === "prepared" && body.candidate && body.prepareId) {
+						var preparedModel = buildPluginUpdateModel({ state: "update-available", canSelfUpdate: true,
+							candidate: body.candidate, transaction: updateStatus.transaction });
+						setUpdateStatus(preparedModel);
+						setWorkflow({ status: "confirming", opId: opId, prepareId: body.prepareId,
+							candidate: body.candidate, transaction: false, message: "Carrier 已验证，请确认实际 App build 后继续。" });
+					} else if (body.action === "confirmation-required") {
+						setWorkflow({ status: "confirming", opId: opId, prepareId: "", candidate: body.candidate || candidate,
+							transaction: false, message: "请确认更新目标后继续。" });
+					} else {
+						setWorkflow({ status: "failed", opId: opId, prepareId: "", candidate: candidate, transaction: false,
+							message: "无法准备更新：" + String(body.error || body.action || "no-update-candidate") });
+					}
+					})
+					.catch(function (err) {
+						var tx = err.body && err.body.transaction && typeof err.body.transaction === "object" ? err.body.transaction : null;
+						if (tx && typeof tx.opId === "string" && tx.opId) {
+							setLogs({ events: [], lastSeq: 0, firstSeq: 0, truncated: false });
+						setUpdateStatus(buildPluginUpdateModel({ state: "up-to-date", canSelfUpdate: false, candidate: null, transaction: tx }));
+						setWorkflow({ status: "running", opId: tx.opId, prepareId: "", candidate: null,
+							transaction: true, message: "电脑端已有另一客户端启动的更新，接续查看同一事务日志。" });
+						setLogExpanded(true);
+						checkPluginUpdate();
+						return;
+						}
+						setWorkflow({ status: "failed", opId: opId, prepareId: "", candidate: candidate, transaction: false,
+							message: "Carrier 预检失败：" + String(err.code || "npm-preparation-failed") });
+					});
+			};
+			var confirmPluginUpdate = function () {
+				if (!workflow.opId || !workflow.candidate) return;
+				var plugin = workflow.candidate.plugin || {};
+				var payload = { opId: workflow.opId, targetVersion: String(plugin.version || "") };
+				if (workflow.prepareId) payload.prepareId = workflow.prepareId;
+				setWorkflow(function (previous) { return Object.assign({}, previous, { status: "submitting", message: "正在提交电脑端安装事务…" }); });
+				postUpdateJson("/plugin-update", payload)
+					.then(function (body) {
+						if (body.action === "accepted") {
+						setWorkflow(function (previous) { return Object.assign({}, previous, { status: "running", transaction: true, message: "安装/重启进行中；日志会在重连后继续显示。" }); });
+						setLogExpanded(true);
+						checkPluginUpdate();
+					} else if (body.action === "prepare-required") {
+						setWorkflow(function (previous) { return Object.assign({}, previous, { status: "failed", transaction: false, message: "更新目标需要重新准备；请再次点击准备更新。" }); });
+						checkPluginUpdate();
+					} else if (body.action === "none") {
+						setWorkflow(function (previous) { return Object.assign({}, previous, { status: "idle", transaction: false, message: "检查后未发现可安装的新版本。" }); });
+						checkPluginUpdate();
+					} else {
+						setWorkflow(function (previous) { return Object.assign({}, previous, { status: "failed", transaction: false, message: "更新未接受：" + String(body.error || body.action || "unknown") }); });
+					}
+					})
+					.catch(function (err) {
+						var tx = err.body && err.body.transaction && typeof err.body.transaction === "object" ? err.body.transaction : null;
+						if (tx && typeof tx.opId === "string" && tx.opId) {
+							var terminal = ["settled", "rolled-back", "failed"].includes(String(tx.phase));
+							setLogs({ events: [], lastSeq: 0, firstSeq: 0, truncated: false });
+							setUpdateStatus(buildPluginUpdateModel({ state: "up-to-date", canSelfUpdate: false, candidate: null, transaction: tx }));
+							setWorkflow({ status: terminal ? (tx.phase === "settled" ? "done" : "failed") : "running",
+								opId: tx.opId, prepareId: "", candidate: null, transaction: true,
+								message: "电脑端已有另一客户端启动的更新，接续查看同一事务日志。" });
+							setLogExpanded(true);
+							checkPluginUpdate();
+							return;
+						}
+						setWorkflow(function (previous) { return Object.assign({}, previous, { status: "failed", transaction: false, message: "更新请求失败：" + String(err.code || "request-failed") }); });
+						if (err.code === "update-busy") checkPluginUpdate();
+					});
+			};
+			var cancelPluginUpdateConfirm = function () {
+				setWorkflow({ status: "idle", opId: "", prepareId: "", candidate: null, transaction: false, message: "" });
+			};
+
+			useEffect(function () {
+				if (data.status !== "ready" || !data.token || !workflow.opId || !workflow.transaction) return;
+				var alive = true;
+				var timer = null;
+				var cursor = 0;
+				var poll = function () {
+					var route = apiRoute(data.basePath, "/plugin-update/log") + "?opId=" + encodeURIComponent(workflow.opId) + "&afterSeq=" + cursor;
+					fetch(route, { method: "GET", headers: { accept: "application/json", "x-mobile-token": data.token } })
+						.then(function (res) { if (!res.ok) throw new Error("HTTP " + res.status); return res.json(); })
+						.then(function (body) {
+							if (!alive) return;
+						var events = Array.isArray(body.events) ? body.events : [];
+						if (Number.isSafeInteger(body.lastSeq)) cursor = Math.max(cursor, body.lastSeq);
+						if (events.length) {
+							setLogs(function (previous) {
+								var bySeq = new Map((previous.events || []).map(function (event) { return [event.seq, event]; }));
+								events.forEach(function (event) { bySeq.set(event.seq, event); });
+								var merged = Array.from(bySeq.values()).sort(function (a, b) { return a.seq - b.seq; }).slice(-400);
+								return { events: merged, lastSeq: cursor, firstSeq: body.firstSeq || previous.firstSeq || 0, truncated: Boolean(body.truncated) };
+							});
+						}
+						if (["settled", "rolled-back", "failed"].includes(String(body.phase))) {
+							setWorkflow(function (previous) { return Object.assign({}, previous, { status: body.phase === "settled" ? "done" : "failed", message: body.phase === "settled" ? "电脑端插件更新完成。" : "电脑端插件更新结束：" + body.phase }); });
+							return;
+						}
+						timer = setTimeout(poll, 1000);
+					})
+						.catch(function () { if (alive) timer = setTimeout(poll, 1500); });
+				};
+				poll();
+				return function () { alive = false; if (timer) clearTimeout(timer); };
+			}, [data.status, data.basePath, data.token, workflow.opId, workflow.transaction]);
+
+			var toggleLog = function () { setLogExpanded(function (open) { return !open; }); };
+			var toggleAllLogs = function () { setShowAllLogs(function (open) { return !open; }); };
 
 			if (data.status === "loading") {
 				return jsxRuntime.jsx("div", { style: { padding: "20px 0", color: "var(--dsw-alias-label-secondary, #888)" }, children: "加载中…" });
@@ -681,6 +1140,15 @@ window.__ModuleLoader__.load({
 						}),
 					}),
 					activeIsDownload ? downloadPane(model, refresh) : connectionPane(model, data, refresh, data.retryExhausted === true),
+					pluginUpdatePane(updateStatus, workflow, logs, logExpanded, showAllLogs, {
+						onCheck: checkPluginUpdate,
+						onBegin: beginPluginUpdate,
+						onConfirm: confirmPluginUpdate,
+						onCancel: cancelPluginUpdateConfirm,
+						onToggleLogs: toggleLog,
+						onToggleAllLogs: toggleAllLogs,
+						onCopyDetails: copyUpdateDetails,
+					}),
 				],
 			});
 		}

package/lib/endpoint-registry.js

@@ -34,7 +34,7 @@ export function extractEndpointDetails(source) {
 		const next = markLines.find((l) => l > index);
 		const segment = lines.slice(index, next ?? Math.min(lines.length, index + 400)).join("\n");
 		let methods = "GET/POST";
-		if (/requireGet\(method,\s*res\)/.test(segment)) methods = "GET";
+		if (/requireGet\(method,\s*res\)/.test(segment) || /method\s*!==\s*['"]GET['"]/.test(segment)) methods = "GET";
 		else if (/method\s*!==\s*['"]POST['"]/.test(segment)) methods = "POST";
 		out.set(path, methods);
 	}
@@ -115,7 +115,7 @@ export const REGISTERED_ENDPOINTS = Object.freeze([
 	{ path: "/diagnostics", methods: "GET", capability: null, why: NO_CAPABILITY_NEEDED },
 	{ path: "/directories", methods: "GET", capability: null, why: NO_CAPABILITY_NEEDED },
 	{ path: "/event-detail", methods: "GET", capability: "eventTimeline" },
-	{ path: "/events", methods: "GET/POST", capability: "eventTimeline" },
+	{ path: "/events", methods: "GET", capability: "eventTimeline" },
 	{ path: "/feedback", methods: "GET/POST", capability: null, why: NO_CAPABILITY_NEEDED },
 	{ path: "/files", methods: "GET/POST", capability: null, why: NO_CAPABILITY_NEEDED },
 	{ path: "/files/upload", methods: "GET/POST", capability: null, why: NO_CAPABILITY_NEEDED },
@@ -136,6 +136,9 @@ export const REGISTERED_ENDPOINTS = Object.freeze([
 	{ path: "/notifications", methods: "GET", capability: null, why: NO_CAPABILITY_NEEDED },
 	{ path: "/notifications/delete", methods: "GET/POST", capability: null, why: NO_CAPABILITY_NEEDED },
 	{ path: "/notifications/read", methods: "GET/POST", capability: null, why: NO_CAPABILITY_NEEDED },
+	{ path: "/plugin-update/check", methods: "GET", capability: null, auth: "required", why: NO_CAPABILITY_NEEDED },
+	{ path: "/plugin-update/prepare", methods: "POST", capability: null, auth: "required", why: NO_CAPABILITY_NEEDED },
+	{ path: "/plugin-update/log", methods: "GET", capability: null, auth: "required", why: NO_CAPABILITY_NEEDED },
 	{ path: "/plugin-update", methods: "POST", capability: null, why: NO_CAPABILITY_NEEDED },
 	{ path: "/push-test", methods: "GET/POST", capability: null, why: NO_CAPABILITY_NEEDED },
 	{ path: "/qr-config", methods: "GET", capability: null, auth: "local-privileged", why: NO_CAPABILITY_NEEDED },