@michengai/dsh-codex-ui 0.2.106 → 0.2.107

package/CHANGELOG.md

@@ -4,16 +4,31 @@
 
 This changelog records recent releases of DSH Codex UI and its one-click installer. Earlier changes remain available in the [Git history](https://github.com/MichengAI/dsh-codex-ui/commits/main).
 
+## suite-installer-v0.1.25 - 2026-09-07
+
+- Updated the bundled Codex UI to `0.2.107` and refreshed direct member versions from the official npm registry for reproducible installation.
+
+## 0.2.107 - 2026-09-07
+
+- Displayed the running Codex UI version beside the About title and aligned Channel and Schedule session-group layout with Tasks.
+- Restricted dependency update requests to loopback same-origin callers and avoided redundant Desktop reload IPC while preserving independent Web reloads.
+- Standardized the package contract on Node.js 22.19.0+ and pnpm 11.22.0.
+
+## suite-installer-v0.1.24 — 2026-09-07
+
+- Added BTW side questions and Simplify code cleanup to the Suite, installing all eight companion plugins together.
+- Refreshed and pinned member versions from the official npm registry for reproducible installations.
+- Requires Node.js 22.19.0 or later to support Simplify.
+
 ## 0.2.106 — 2026-09-07
 
 - Added Wallpaper Engine sidebar glass support while keeping settings and search dialogs correctly positioned and clickable.
 - Integrated the billing plugin entry into the sidebar, aligning icon size, colors, typography, and spacing with Settings while preserving billing details and the collapsed entry.
-- Added visual regression assertions. Glass and billing have been verified separately; combined verification remains pending because the current test profile does not include the wallpaper plugin.
 
 ## suite-installer-v0.1.23 — 2026-09-07
 
 - Updated the bundled Codex UI to `0.2.106`, including sidebar glass support and billing entry styling.
-- Other Suite members remain unchanged. Combined glass and billing verification remains pending.
+- Other Suite members remain unchanged.
 
 ## 0.2.105 — 2026-09-06
 

package/CHANGELOG.zh-CN.md

@@ -4,16 +4,31 @@
 
 本日志记录 DSH Codex UI 及其一键安装器的最近发布；更早的变更可查看 [Git 提交历史](https://github.com/MichengAI/dsh-codex-ui/commits/main)。
 
+## suite-installer-v0.1.25 - 2026-09-07
+
+- 将套件中的 Codex UI 更新至 `0.2.107`，并从官方 npm 刷新直装成员版本，保证安装可复现。
+
+## 0.2.107 - 2026-09-07
+
+- 在 Codex UI 大标题旁显示当前运行版本，并将频道、定时的会话分组布局与任务页对齐。
+- 将依赖更新请求限制为本机同源调用，并避免 Desktop 重复发送重载 IPC，同时保留独立 Web 的重载能力。
+- 统一包契约为 Node.js 22.19.0+ 与 pnpm 11.22.0。
+
+## suite-installer-v0.1.24 — 2026-09-07
+
+- 套件新增 BTW 旁问和 Simplify 代码简化，一次安装八个配套插件。
+- 从官方 npm 刷新并锁定成员版本，保证安装结果可复现。
+- 为支持 Simplify，要求 Node.js 22.19.0 或更高版本。
+
 ## 0.2.106 — 2026-09-07
 
 - 新增 Wallpaper Engine 侧栏玻璃兼容，并保持设置和搜索弹窗定位、点击正常。
 - 将费用插件入口融入侧栏，统一与设置入口的图标大小、颜色、字号和间距，保留费用详情及收缩态入口。
-- 补充视觉回归断言。玻璃与费用入口已分别验证；当前测试 profile 不含壁纸插件，组合验收仍待完成。
 
 ## suite-installer-v0.1.23 — 2026-09-07
 
 - 更新套件中的 Codex UI 至 `0.2.106`，包含侧栏玻璃兼容和费用入口样式适配。
-- 其他套件成员保持不变，玻璃与费用入口组合验收仍待完成。
+- 其他套件成员保持不变。
 
 ## 0.2.105 — 2026-09-06
 

package/lib/client.js

@@ -4478,77 +4478,80 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 												[group.id]: !isExpanded
 											}));
 										}
-									}), isExpanded && group.sessions.map((session) => {
-										const id = session.sessionId;
-										const title = session.title;
-										const selected = sessions.current === id;
-										const running = session.running || sessions.byId[id]?.running === true;
-										const updatedAt = session.updatedAt ?? sessions.byId[id]?.updatedAt;
-										const unread = flags.unreadSessionIds.includes(id);
-										const pendingInteraction = pendingInteractionForSession(id, pendingInteractions, sessions.byId[id]?.pendingInteraction);
-										const moveTargets = moveSession === void 0 || workspaces === void 0 ? void 0 : sessionMoveTargets(workspaces.items, id).map((target) => ({
-											...target,
-											id: moveSessionActionId(target.id)
-										}));
-										return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionRow, {
-											id,
-											title,
-											selected,
-											menuOpen: menu?.id === id,
-											unread,
-											running,
-											pendingInteraction,
-											t,
-											menuItems: sessionMenuItems(t, {
+									}), isExpanded && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "dcu-wb-project-body",
+										children: group.sessions.map((session) => {
+											const id = session.sessionId;
+											const title = session.title;
+											const selected = sessions.current === id;
+											const running = session.running || sessions.byId[id]?.running === true;
+											const updatedAt = session.updatedAt ?? sessions.byId[id]?.updatedAt;
+											const unread = flags.unreadSessionIds.includes(id);
+											const pendingInteraction = pendingInteractionForSession(id, pendingInteractions, sessions.byId[id]?.pendingInteraction);
+											const moveTargets = moveSession === void 0 || workspaces === void 0 ? void 0 : sessionMoveTargets(workspaces.items, id).map((target) => ({
+												...target,
+												id: moveSessionActionId(target.id)
+											}));
+											return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionRow, {
+												id,
+												title,
+												selected,
+												menuOpen: menu?.id === id,
 												unread,
-												moveTargets
-											}),
-											menuPoint: menu?.id === id && menu.x !== void 0 && menu.y !== void 0 ? {
-												x: menu.x,
-												y: menu.y
-											} : void 0,
-											onOpen: () => {
-												flags.setUnreadSessionIds((ids) => ids.filter((item) => item !== id));
-												openSession(id);
-											},
-											onMenuChange: (open) => {
-												setMenu(open ? { id } : void 0);
-											},
-											onArchive: () => {
-												run("archive", () => archiveSession(id));
-											},
-											onHover: (event) => {
-												const box = hoverCardAnchor(event.currentTarget.getBoundingClientRect());
-												showTip({
-													title,
-													project: label,
-													time: updatedAt === void 0 ? void 0 : formatHoverTime(updatedAt, t),
-													left: box.left,
-													top: box.top
-												});
-											},
-											onLeave: hideTip,
-											onContextMenu: (event) => {
-												event.preventDefault();
-												event.stopPropagation();
-												dismissTip();
-												setMenu({
-													id,
-													x: event.clientX,
-													y: event.clientY
-												});
-											},
-											onSelectAction: (action) => {
-												if (busy !== void 0) return;
-												const targetWorkspaceId = parseMoveSessionActionId(action);
-												if (targetWorkspaceId !== void 0 && moveSession !== void 0) {
-													setMenu(void 0);
-													run("session-move", () => moveSession(id, targetWorkspaceId));
-													return;
+												running,
+												pendingInteraction,
+												t,
+												menuItems: sessionMenuItems(t, {
+													unread,
+													moveTargets
+												}),
+												menuPoint: menu?.id === id && menu.x !== void 0 && menu.y !== void 0 ? {
+													x: menu.x,
+													y: menu.y
+												} : void 0,
+												onOpen: () => {
+													flags.setUnreadSessionIds((ids) => ids.filter((item) => item !== id));
+													openSession(id);
+												},
+												onMenuChange: (open) => {
+													setMenu(open ? { id } : void 0);
+												},
+												onArchive: () => {
+													run("archive", () => archiveSession(id));
+												},
+												onHover: (event) => {
+													const box = hoverCardAnchor(event.currentTarget.getBoundingClientRect());
+													showTip({
+														title,
+														project: label,
+														time: updatedAt === void 0 ? void 0 : formatHoverTime(updatedAt, t),
+														left: box.left,
+														top: box.top
+													});
+												},
+												onLeave: hideTip,
+												onContextMenu: (event) => {
+													event.preventDefault();
+													event.stopPropagation();
+													dismissTip();
+													setMenu({
+														id,
+														x: event.clientX,
+														y: event.clientY
+													});
+												},
+												onSelectAction: (action) => {
+													if (busy !== void 0) return;
+													const targetWorkspaceId = parseMoveSessionActionId(action);
+													if (targetWorkspaceId !== void 0 && moveSession !== void 0) {
+														setMenu(void 0);
+														run("session-move", () => moveSession(id, targetWorkspaceId));
+														return;
+													}
+													dialogs.handleAction(action, id, title);
 												}
-												dialogs.handleAction(action, id, title);
-											}
-										}, id);
+											}, id);
+										})
 									})]
 								}, group.id);
 							})
@@ -4780,74 +4783,77 @@ header [data-dcu-title-folder] svg,header [data-dcu-title-more] svg{display:bloc
 												children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconEllipsisOutline16, { size: 16 })
 											})
 										})
-									}), isExpanded && group.sessions.map((session) => {
-										const id = session.id;
-										const title = session.title;
-										const unread = flags.unreadSessionIds.includes(id);
-										const pendingInteraction = pendingInteractionForSession(id, pendingInteractions, sessions.byId[id]?.pendingInteraction);
-										const moveTargets = moveSession === void 0 ? void 0 : sessionMoveTargets(workspaces.items ?? [], id).map((target) => ({
-											...target,
-											id: moveSessionActionId(target.id)
-										}));
-										return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionRow, {
-											id,
-											title,
-											selected: sessions.current === id,
-											menuOpen: menu?.id === id,
-											unread,
-											running: session.running,
-											pendingInteraction,
-											t,
-											menuItems: sessionMenuItems(t, {
+									}), isExpanded && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "dcu-wb-project-body",
+										children: group.sessions.map((session) => {
+											const id = session.id;
+											const title = session.title;
+											const unread = flags.unreadSessionIds.includes(id);
+											const pendingInteraction = pendingInteractionForSession(id, pendingInteractions, sessions.byId[id]?.pendingInteraction);
+											const moveTargets = moveSession === void 0 ? void 0 : sessionMoveTargets(workspaces.items ?? [], id).map((target) => ({
+												...target,
+												id: moveSessionActionId(target.id)
+											}));
+											return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionRow, {
+												id,
+												title,
+												selected: sessions.current === id,
+												menuOpen: menu?.id === id,
 												unread,
-												moveTargets
-											}),
-											menuPoint: menu?.id === id && menu.x !== void 0 && menu.y !== void 0 ? {
-												x: menu.x,
-												y: menu.y
-											} : void 0,
-											onOpen: () => {
-												flags.setUnreadSessionIds((ids) => ids.filter((item) => item !== id));
-												openSession(id);
-											},
-											onMenuChange: (open) => {
-												setMenu(open ? { id } : void 0);
-											},
-											onArchive: () => {
-												run("archive", () => archiveSession(id));
-											},
-											onHover: (event) => {
-												const box = hoverCardAnchor(event.currentTarget.getBoundingClientRect());
-												showTip({
-													title,
-													project: group.label,
-													time: session.updatedAt === void 0 ? void 0 : formatHoverTime(session.updatedAt, t),
-													left: box.left,
-													top: box.top
-												});
-											},
-											onLeave: hideTip,
-											onContextMenu: (event) => {
-												event.preventDefault();
-												event.stopPropagation();
-												dismissTip();
-												setMenu({
-													id,
-													x: event.clientX,
-													y: event.clientY
-												});
-											},
-											onSelectAction: (action) => {
-												if (busy !== void 0) return;
-												const targetWorkspaceId = parseMoveSessionActionId(action);
-												if (targetWorkspaceId !== void 0 && moveSession !== void 0) {
-													setMenu(void 0);
-													run("session-move", () => moveSession(id, targetWorkspaceId));
-													return;
+												running: session.running,
+												pendingInteraction,
+												t,
+												menuItems: sessionMenuItems(t, {
+													unread,
+													moveTargets
+												}),
+												menuPoint: menu?.id === id && menu.x !== void 0 && menu.y !== void 0 ? {
+													x: menu.x,
+													y: menu.y
+												} : void 0,
+												onOpen: () => {
+													flags.setUnreadSessionIds((ids) => ids.filter((item) => item !== id));
+													openSession(id);
+												},
+												onMenuChange: (open) => {
+													setMenu(open ? { id } : void 0);
+												},
+												onArchive: () => {
+													run("archive", () => archiveSession(id));
+												},
+												onHover: (event) => {
+													const box = hoverCardAnchor(event.currentTarget.getBoundingClientRect());
+													showTip({
+														title,
+														project: group.label,
+														time: session.updatedAt === void 0 ? void 0 : formatHoverTime(session.updatedAt, t),
+														left: box.left,
+														top: box.top
+													});
+												},
+												onLeave: hideTip,
+												onContextMenu: (event) => {
+													event.preventDefault();
+													event.stopPropagation();
+													dismissTip();
+													setMenu({
+														id,
+														x: event.clientX,
+														y: event.clientY
+													});
+												},
+												onSelectAction: (action) => {
+													if (busy !== void 0) return;
+													const targetWorkspaceId = parseMoveSessionActionId(action);
+													if (targetWorkspaceId !== void 0 && moveSession !== void 0) {
+														setMenu(void 0);
+														run("session-move", () => moveSession(id, targetWorkspaceId));
+														return;
+													}
+													dialogs.handleAction(action, id, title);
 												}
-												dialogs.handleAction(action, id, title);
-											}
-										}, id);
+											}, id);
+										})
 									})]
 								}, group.id);
 							})
@@ -5999,6 +6005,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 		const stylesheet$2 = `
 .dcu-about{color:var(--dsw-alias-label-primary)}.dcu-about h2{margin:0;font-size:20px;line-height:28px}.dcu-about-intro{margin:6px 0 22px;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:20px}.dcu-about h3{margin:24px 0 8px;font-size:14px;line-height:20px}.dcu-about-features{margin:0;padding-left:20px;color:var(--dsw-alias-label-secondary);font-size:13px;line-height:24px}.dcu-about-dependencies-heading{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-top:24px}.dcu-about-dependencies-heading h3{margin:0}.dcu-about-dependencies-heading+.dcu-about-intro{margin-bottom:14px}.dcu-about-dependencies{overflow:hidden;border:1px solid var(--dsw-alias-border-l2);border-radius:10px}.dcu-about-dependency{display:flex;align-items:center;gap:12px;min-height:64px;padding:12px;border-bottom:1px solid var(--dsw-alias-border-l2)}.dcu-about-dependency:last-child{border-bottom:0}.dcu-about-copy{min-width:0;flex:1}.dcu-about-name{font-size:13px;line-height:20px;font-weight:600}.dcu-about-package{overflow:hidden;margin-top:2px;color:var(--dsw-alias-label-tertiary);font-size:12px;text-overflow:ellipsis;white-space:nowrap}.dcu-about-status{display:flex;align-items:center;gap:5px;font-size:12px}.dcu-about-status[data-installed=true]{color:var(--dsw-alias-state-success-primary)}.dcu-about-status[data-installed=false]{color:var(--dsw-alias-state-error-primary)}.dcu-about-status[data-update=true]{color:var(--dsw-alias-state-warning-primary)}.dcu-about-install{display:inline-flex;align-items:center;justify-content:center;gap:5px;min-height:32px;border:1px solid var(--dsw-alias-border-l2);border-radius:7px;padding:6px 9px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;cursor:pointer}.dcu-about-install:hover:not(:disabled){background:var(--dsw-specific-menu-item-hover)}.dcu-about-install:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary);outline-offset:2px}.dcu-about-install:disabled{cursor:wait;opacity:.65}.dcu-about-update-all{min-width:92px}.dcu-about-message{margin:10px 0 0;border-radius:8px;padding:9px 10px;background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 12%,transparent);color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px}.dcu-about-message[data-error=true]{background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 12%,transparent);color:var(--dsw-alias-state-error-primary)}.dcu-about-progress{display:grid;grid-template-columns:auto 1fr auto;gap:8px 10px;align-items:center;margin-top:10px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:9px 10px}.dcu-about-progress code{min-width:0;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.dcu-about-progress-pct{color:var(--dsw-alias-label-tertiary);font-size:12px;font-variant-numeric:tabular-nums}.dcu-about-progress-bar{grid-column:1/-1;height:4px;overflow:hidden;border-radius:99px;background:var(--dsw-alias-border-l2)}.dcu-about-progress-fill{height:100%;background:var(--dsw-alias-state-business-primary);transition:width .2s ease}.dcu-about-progress-fill[data-wave=true]{width:28%;animation:dcu-about-progress-wave 1.2s ease-in-out infinite}@keyframes dcu-about-progress-wave{0%{transform:translateX(-60%)}100%{transform:translateX(280%)}}
 .dcu-about-title-row{display:flex;align-items:center;gap:8px;min-width:0}.dcu-about-links{display:flex;align-items:center;gap:4px}.dcu-about-external-link{display:inline-flex;align-items:center;gap:5px;min-height:28px;padding:0 8px;color:var(--dsw-alias-label-secondary);background:transparent;border:1px solid var(--dsw-alias-border-l2);border-radius:7px;font-size:12px;font-weight:500;line-height:18px;text-decoration:none;white-space:nowrap}.dcu-about-external-link:hover{color:var(--dsw-alias-label-primary);background:var(--dsw-alias-interactive-bg-hover)}.dcu-about-external-link:focus-visible{outline:2px solid var(--dsw-alias-state-success-primary);outline-offset:2px}.dcu-about-external-link svg{flex:none}@media(max-width:720px){.dcu-about-title-row{flex-wrap:wrap}}
+.dcu-about-version{margin-left:8px;color:var(--dsw-alias-label-tertiary);font-family:inherit;font-size:12px;font-weight:500;line-height:18px;letter-spacing:0;white-space:nowrap;vertical-align:baseline}
 `;
 		/** 宿主图标库不提供 GitHub 品牌标识，内联后可离线使用并继承当前文字颜色。 */
 		function GithubMark16() {
@@ -6187,6 +6194,7 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 				}
 			};
 			const actionableCount = dependencies.filter((dependency) => !dependency.installed || dependency.updateAvailable).length;
+			const selfVersion = dependencies.find((dependency) => dependency.id === "ui")?.version;
 			const title = (id) => t(`about.dependency.${id}`);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				ref: root,
@@ -6196,7 +6204,10 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("style", { children: stylesheet$2 }),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dcu-about-title-row",
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", { children: t("about.title") }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("h2", { children: [t("about.title"), selfVersion === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+							className: "dcu-about-version",
+							children: ["v", selfVersion]
+						})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: "dcu-about-links",
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("a", {
 								className: "dcu-about-external-link",
@@ -6957,7 +6968,12 @@ html[data-dcu-official-turn-navigator-supported=true] .dcu-turn-navigator,html:h
 			[["连接器", "Connectors"], "connectors"],
 			[["定时任务", "Scheduled tasks"], "schedule"],
 			[["IM助理", "IM Assistant"], "assistant"],
-			[["已归档", "Archived"], "archive"],
+			[[
+				"已归档",
+				"归档会话",
+				"Archived",
+				"Archived sessions"
+			], "archive"],
 			[["Codex UI"], "about"]
 		];
 		/** 按设置导航可见文案解析侧栏同款图标；插件市场复用插件图标。 */

package/lib/index.d.mts

@@ -4,13 +4,14 @@ type HostRequest = {
   method?: string;
   url?: string;
   headers?: Record<string, string | string[] | undefined>;
+  socket?: {
+    remoteAddress?: string;
+  };
   [Symbol.asyncIterator]?: () => AsyncIterator<Uint8Array | string>;
 };
 /**
- * 判断浏览器请求是否跨站。依赖安装会改写用户配置并拉起子进程，
- * 恶意网页只需一个表单就能跨站触发，必须先按 Sec-Fetch-Site（优先，
- * 且无法被页面伪造）再按 Origin 与 Host 的比对阻断；无这些头的
- * 非浏览器客户端（curl、CLI）仍然放行。
+ * 依赖安装会改写用户配置并拉起子进程，只允许回环地址上的同源浏览器请求。
+ * Origin、Host 和 Sec-Fetch-Site 都可被非浏览器客户端伪造，不能单独作为授权依据。
  */
 declare function crossSiteRequest(request: HostRequest): boolean;
 /** 把安装错误收成可给浏览器看的文案：我们自己的中文说明保留，带本地路径的底层错误脱敏。 */

package/lib/index.mjs

@@ -350,6 +350,10 @@ function requestDesktopHotUpdate(send = process.send) {
 	send(APPLY_PLUGIN_UPDATES_IPC);
 	return true;
 }
+/** Desktop 的包管理服务会自行安排重载；只有独立 Web 子进程需要通知父进程。 */
+function canRequestParentReload(runtime, send = process.send) {
+	return runtime.environmentKind === "cli" && typeof send === "function";
+}
 async function recordPendingUpdate(packageName, version, runtime) {
 	const pendingPath = resolve(profileDirectory(runtime), PROFILE_PENDING_UPDATES_FILE);
 	let packages = [];
@@ -1554,29 +1558,31 @@ const explorerEndpoint = "/api/michengai/codex-ui/open-in-explorer";
 const preferencesEndpoint = "/api/michengai/codex-ui/preferences";
 const sessionMoveEndpoint = "/api/michengai/codex-ui/session-move";
 const maxPreferencesBodyBytes = 32768;
+function isLoopbackAddress(value) {
+	const address = value?.toLowerCase().replace(/^\[|\]$/g, "");
+	return address === "localhost" || address === "localhost." || address === "::1" || address?.startsWith("127.") === true || address?.startsWith("::ffff:127.") === true;
+}
 function headerValue(headers, name) {
 	const value = headers[name];
 	if (typeof value === "string") return value;
 	if (Array.isArray(value)) return value[0];
 }
 /**
-* 判断浏览器请求是否跨站。依赖安装会改写用户配置并拉起子进程，
-* 恶意网页只需一个表单就能跨站触发，必须先按 Sec-Fetch-Site（优先，
-* 且无法被页面伪造）再按 Origin 与 Host 的比对阻断；无这些头的
-* 非浏览器客户端（curl、CLI）仍然放行。
+* 依赖安装会改写用户配置并拉起子进程，只允许回环地址上的同源浏览器请求。
+* Origin、Host 和 Sec-Fetch-Site 都可被非浏览器客户端伪造，不能单独作为授权依据。
 */
 function crossSiteRequest(request) {
+	if (!isLoopbackAddress(request.socket?.remoteAddress)) return true;
 	const headers = request.headers;
-	if (headers === void 0) return false;
+	if (headers === void 0) return true;
 	const site = headerValue(headers, "sec-fetch-site");
-	if (site === "same-origin" || site === "none") return false;
-	if (site !== void 0) return true;
+	if (site !== void 0 && site !== "same-origin") return true;
 	const origin = headerValue(headers, "origin");
-	if (origin === void 0) return false;
 	const host = headerValue(headers, "host");
-	if (host === void 0) return true;
+	if (origin === void 0 || host === void 0) return true;
 	try {
-		return new URL(origin).host !== host;
+		const url = new URL(origin);
+		return url.protocol !== "http:" && url.protocol !== "https:" || !isLoopbackAddress(url.hostname) || url.host !== host;
 	} catch {
 		return true;
 	}
@@ -1724,16 +1730,18 @@ function apply(ctx) {
 								"content-type": "application/json; charset=utf-8",
 								"cache-control": "no-store"
 							});
-							response.end(JSON.stringify({ error: "已拒绝跨站请求。" }));
+							response.end(JSON.stringify({ error: "已拒绝非本机同源请求。" }));
 							return;
 						}
 						if (url.searchParams.get("action") === "update-all") {
-							const autoReload = typeof process.send === "function";
+							const runtime = resolveDependencyRuntime(ctx);
+							const notifyParent = canRequestParentReload(runtime);
+							const autoReload = runtime.environmentKind === "desktop" || notifyParent;
 							let restartAfterResponse = false;
 							const { dependencies, updatedCount } = await updateAllDependencies(() => {
-								restartAfterResponse = autoReload;
+								restartAfterResponse = notifyParent;
 								return restartAfterResponse;
-							}, resolveDependencyRuntime(ctx));
+							}, runtime);
 							response.writeHead(200, {
 								"content-type": "application/json; charset=utf-8",
 								"cache-control": "no-store"
@@ -1741,19 +1749,21 @@ function apply(ctx) {
 							response.end(JSON.stringify({
 								dependencies,
 								restartRequired: updatedCount > 0,
-								autoReload: typeof process.send === "function"
+								autoReload
 							}));
 							if (restartAfterResponse) setTimeout(() => {
 								requestDesktopHotUpdate();
 							}, 150).unref?.();
 							return;
 						}
-						const autoReload = typeof process.send === "function";
+						const runtime = resolveDependencyRuntime(ctx);
+						const notifyParent = canRequestParentReload(runtime);
+						const autoReload = runtime.environmentKind === "desktop" || notifyParent;
 						let restartAfterResponse = false;
 						const dependencies = await installDependency(url.searchParams.get("dependency"), () => {
-							restartAfterResponse = autoReload;
+							restartAfterResponse = notifyParent;
 							return restartAfterResponse;
-						}, resolveDependencyRuntime(ctx));
+						}, runtime);
 						response.writeHead(200, {
 							"content-type": "application/json; charset=utf-8",
 							"cache-control": "no-store"
@@ -1761,7 +1771,7 @@ function apply(ctx) {
 						response.end(JSON.stringify({
 							dependencies,
 							restartRequired: true,
-							autoReload: typeof process.send === "function"
+							autoReload
 						}));
 						if (restartAfterResponse) setTimeout(() => {
 							requestDesktopHotUpdate();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-codex-ui",
-  "version": "0.2.106",
+  "version": "0.2.107",
   "description": "以 Codex 风格重构 DSH Web 侧栏的独立客户端插件",
   "license": "Apache-2.0",
   "publishConfig": {
@@ -17,6 +17,9 @@
   "homepage": "https://github.com/MichengAI/dsh-codex-ui#readme",
   "type": "module",
   "packageManager": "pnpm@11.22.0",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
   "main": "lib/index.mjs",
   "types": "lib/index.d.mts",
   "exports": {