@michengai/dsh-skills-manager 0.1.40 → 0.1.43

package/CHANGELOG.md

@@ -6,6 +6,19 @@ The five most recent published versions are listed below.
 
 ## Unreleased
 
+## 0.1.43 - 2026-09-08
+
+- Fixed Settings opening with the Codex Skill list expanded by default. All Skill sources now start collapsed while matching search results still expand automatically.
+
+## 0.1.42 - 2026-09-07
+
+- Fixed the release-contract check so valid package version updates no longer block verification and npm publishing.
+
+## 0.1.41 - 2026-09-07
+
+- Added independent in-product update checks with automatic updates when a verified DSH update service is available and a profile-specific manual fallback otherwise.
+- Removed the update-button dependency on `react-dom/client` so the client can load on Hosts that do not register that module id.
+
 ## 0.1.40 - 2026-09-05
 
 - 修复禁用的外部同名技能遮蔽已启用 DSH 技能的问题，统一管理页与运行时的赢家选择。
@@ -16,10 +29,6 @@ The five most recent published versions are listed below.
 
 - Added Cursor as a read-only, locally toggleable Skill source at `%USERPROFILE%\.cursor\skills`, with `DSH_CURSOR_HOME` override and state-file migration.
 
-## 0.1.37 - 2026-09-03
-
-- Added compatibility with DeepSeek Harness `0.1.2-rc.1`.
-
 ## 0.1.36 - 2026-09-03
 
 - Separated maintained runtime source under `src` from generated `lib` package artifacts, with a reproducible Host and AMD-client build.

package/CHANGELOG.zh-CN.md

@@ -6,6 +6,19 @@
 
 ## 未发布
 
+## 0.1.43 - 2026-09-08
+
+- 修复设置页首次进入时默认展开 Codex 技能列表的问题；现在所有技能来源初始保持折叠，搜索匹配时仍会自动展开相应分组。
+
+## 0.1.42 - 2026-09-07
+
+- 修复发布契约校验，合法的包版本升级不再阻断验证和 npm 发布。
+
+## 0.1.41 - 2026-09-07
+
+- 新增独立的插件内检查更新能力：仅在已验证的 DSH 更新服务可用时自动更新，其余环境提供与 Profile 对应的手工更新命令。
+- 更新按钮图标不再依赖 `react-dom/client`，避免宿主未注册该模块 id 时客户端无法加载。
+
 ## 0.1.40 - 2026-09-05
 
 - 修复禁用的外部同名技能遮蔽已启用 DSH 技能的问题，统一管理页与运行时的赢家选择。
@@ -16,10 +29,6 @@
 
 - 新增 Cursor 用户级只读技能来源，默认读取 `%USERPROFILE%\.cursor\skills`，支持 `DSH_CURSOR_HOME` 覆盖，并兼容迁移既有状态文件。
 
-## 0.1.37 - 2026-09-03
-
-- 支持 DeepSeek Harness `0.1.2-rc.1`。
-
 ## 0.1.36 - 2026-09-03
 
 - 将可维护运行源码统一迁移到 `src`，`lib` 改为可复现生成的 Host 与 AMD 客户端发布产物。

package/README.md

@@ -129,6 +129,10 @@ dsh --profile web --dump-config
 
 Restart DSH Web and hard-refresh the browser. `dsh plugin ... add .` reads the package metadata and `cordis.patch.yml`; do not install by copying `lib` directly.
 
+## Updates
+
+The settings title shows the installed version and a **Check for updates** button. When a newer release is available, **Update automatically** runs only when the DSH CLI or Desktop update service is available; otherwise, the dialog provides a profile-specific manual command to copy and run.
+
 ## Usage
 
 Open **Settings → Skills**, then use the panel as follows:

package/README.zh-CN.md

@@ -129,6 +129,10 @@ dsh --profile web --dump-config
 
 完成后重启 DSH Web 并硬刷新浏览器。`dsh plugin ... add .` 会读取当前目录的包信息和 `cordis.patch.yml`；不要改为直接复制 `lib` 目录。
 
+## 在线更新
+
+设置标题会显示当前版本和“检查更新”按钮。发现新版后，只有检测到 DSH CLI 或 Desktop 更新服务时才可使用“自动更新”；其他环境会在弹窗中提供可复制、与当前 Profile 对应的手工更新命令。
+
 ## 使用
 
 打开「设置 → 技能」，再按下表操作：

package/lib/client.js

@@ -1,4 +1,295 @@
 (() => {
+  // src/plugin-update-ui.js
+  var UPDATE_HEADER = "x-michengai-plugin-update";
+  var STYLE_ID = "michengai-plugin-update-ui";
+  var CSS = `
+.mpi-version{margin-left:8px;color:var(--dsw-alias-label-tertiary,#9da1aa);font-family:inherit;font-size:12px;font-weight:500;line-height:18px;letter-spacing:0;white-space:nowrap;vertical-align:baseline}.mpi-check{display:inline-flex;align-items:center;justify-content:center;gap:6px;min-height:28px;padding:0 8px;border:1px solid var(--dsw-alias-border-l2,#4b4d52);border-radius:7px;background:transparent;color:var(--dsw-alias-label-secondary,#b8bbc2);font:inherit;font-size:12px;font-weight:500;line-height:18px;white-space:nowrap;cursor:pointer}.mpi-check:hover{background:var(--dsw-alias-interactive-bg-hover,#3a3b3f);color:var(--dsw-alias-label-primary,#fff)}.mpi-check:focus-visible,.mpi-action:focus-visible,.mpi-dialog-close:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary,#4f8cff);outline-offset:2px}.mpi-icon{display:inline-flex;flex:0 0 auto;width:16px;height:16px;align-items:center;justify-content:center;pointer-events:none}.mpi-icon svg{display:block;width:16px;height:16px}
+.mpi-overlay{position:fixed;inset:0;z-index:2147483647;display:flex;align-items:center;justify-content:center;padding:24px;background:rgba(0,0,0,.62)}.mpi-dialog{position:relative;box-sizing:border-box;width:min(680px,100%);max-height:calc(100vh - 48px);overflow:auto;border:1px solid var(--dsw-alias-border-l2,#4b4d52);border-radius:14px;padding:22px;background:var(--dsw-alias-bg-layer-2,var(--dsw-specific-menu,#202124));color:var(--dsw-alias-label-primary,#fff);box-shadow:var(--dsw-shadow-lv3,0 16px 48px rgba(0,0,0,.24));font-family:inherit}.mpi-head{display:flex;align-items:center;justify-content:space-between;gap:12px}.mpi-dialog h2{margin:0;font-size:18px;line-height:26px}.mpi-dialog-close{display:inline-flex;flex:0 0 28px;width:28px;height:28px;align-items:center;justify-content:center;padding:0;border:0;border-radius:8px;background:transparent;color:var(--dsw-alias-label-secondary,#b8bbc2);cursor:pointer}.mpi-dialog-close:hover{background:var(--dsw-alias-interactive-bg-hover,#3a3b3f);color:var(--dsw-alias-label-primary,#fff)}.mpi-intro{margin:8px 0 18px;color:var(--dsw-alias-label-secondary,#c2c4ca);font-size:13px;line-height:20px}.mpi-meta{display:grid;grid-template-columns:max-content minmax(0,1fr);gap:8px 18px;margin:0 0 16px;font-size:12px;line-height:18px}.mpi-meta dt{color:var(--dsw-alias-label-secondary,#c2c4ca)}.mpi-meta dd{margin:0;font-family:ui-monospace,SFMono-Regular,Consolas,monospace}.mpi-status{margin:0 0 18px;border-radius:7px;padding:12px 14px;background:var(--dsw-alias-bg-layer-3,var(--dsw-specific-menu-item-hover,#252527));font-size:13px;font-weight:600;line-height:20px}.mpi-status[data-kind=error]{color:var(--dsw-alias-state-error-primary,#ff6464)}.mpi-status[data-kind=success]{color:var(--dsw-alias-state-success-primary,#36d67a)}.mpi-manual{border-top:1px solid var(--dsw-alias-border-l2,#4b4d52);padding-top:16px}.mpi-manual h3{margin:0 0 6px;font-size:14px;line-height:20px}.mpi-manual p{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#c2c4ca);font-size:12px;line-height:18px}.mpi-command{display:flex;align-items:center;gap:8px;border:1px solid var(--dsw-alias-border-l2,#4b4d52);border-radius:7px;padding:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-specific-menu-item-hover,#252527))}.mpi-command code{min-width:0;flex:1;overflow:auto;font-family:ui-monospace,SFMono-Regular,Consolas,monospace;font-size:12px;line-height:18px;white-space:nowrap}.mpi-actions{display:flex;align-items:center;justify-content:flex-end;gap:12px;margin-top:18px}.mpi-actions-group{display:flex;gap:8px}.mpi-action{display:inline-flex;align-items:center;justify-content:center;gap:6px;min-height:32px;border:1px solid var(--dsw-alias-border-l2,#4b4d52);border-radius:7px;padding:6px 10px;background:transparent;color:inherit;font:inherit;font-size:12px;cursor:pointer}.mpi-action:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover,#414247)}.mpi-action:disabled{cursor:not-allowed;opacity:.55}.mpi-primary{border-color:var(--dsw-alias-state-business-primary,#4f8cff);background:var(--dsw-alias-state-business-primary,#4f8cff);color:#fff}.mpi-progress{height:4px;margin-top:10px;overflow:hidden;border-radius:99px;background:var(--dsw-alias-border-l2,#4b4d52)}.mpi-progress::after{display:block;width:32%;height:100%;background:var(--dsw-alias-state-business-primary,#4f8cff);content:'';animation:mpi-wave 1.15s ease-in-out infinite}@keyframes mpi-wave{from{transform:translateX(-110%)}to{transform:translateX(330%)}}@media(max-width:560px){.mpi-overlay{padding:10px}.mpi-dialog{max-height:calc(100vh - 20px);padding:16px}.mpi-actions{align-items:stretch}.mpi-actions-group{justify-content:flex-end;flex-wrap:wrap}.mpi-meta{grid-template-columns:1fr;gap:2px}.mpi-meta dd{margin-bottom:6px}}
+`;
+  var ZH = {
+    check: "\u68C0\u67E5\u66F4\u65B0",
+    update: "\u66F4\u65B0",
+    close: "\u5173\u95ED",
+    recheck: "\u91CD\u65B0\u68C0\u67E5",
+    auto: "\u81EA\u52A8\u66F4\u65B0",
+    updating: "\u6B63\u5728\u66F4\u65B0\u2026",
+    copy: "\u590D\u5236\u547D\u4EE4",
+    copied: "\u5DF2\u590D\u5236",
+    copyFailed: "\u590D\u5236\u5931\u8D25",
+    checking: "\u6B63\u5728\u68C0\u67E5\u66F4\u65B0\u2026",
+    latest: "\u5DF2\u662F\u6700\u65B0\u7248\u672C",
+    found: "\u53D1\u73B0\u65B0\u7248\u672C",
+    failed: "\u68C0\u67E5\u66F4\u65B0\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002",
+    current: "\u8FD0\u884C\u7248\u672C",
+    latestLabel: "\u6700\u65B0\u7248\u672C",
+    profile: "\u76EE\u6807 profile",
+    unknown: "\u672A\u77E5",
+    manual: "\u624B\u5DE5\u66F4\u65B0",
+    manualHint: "\u81EA\u52A8\u66F4\u65B0\u5931\u8D25\u65F6\uFF0C\u53EF\u5728\u5F53\u524D DSH \u7EC8\u7AEF\u6267\u884C\u4EE5\u4E0B\u547D\u4EE4\uFF0C\u5B8C\u6210\u540E\u91CD\u542F DSH Web\u3002",
+    intro: "\u4EC5\u68C0\u67E5\u5E76\u66F4\u65B0\u5F53\u524D\u63D2\u4EF6\uFF0C\u4E0D\u4F1A\u8054\u52A8\u5B89\u88C5\u5176\u4ED6\u63D2\u4EF6\u3002",
+    restart: "\u66F4\u65B0\u5B8C\u6210\uFF0C\u8BF7\u91CD\u542F DSH Web\u3002",
+    restarting: "\u66F4\u65B0\u5B8C\u6210\uFF0C\u6B63\u5728\u91CD\u542F DSH Desktop\u2026",
+    unavailable: "\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301\u81EA\u52A8\u66F4\u65B0\uFF0C\u8BF7\u4F7F\u7528\u624B\u5DE5\u66F4\u65B0\u547D\u4EE4\u3002"
+  };
+  var EN = {
+    check: "Check for updates",
+    update: "Update",
+    close: "Close",
+    recheck: "Check again",
+    auto: "Update automatically",
+    updating: "Updating\u2026",
+    copy: "Copy command",
+    copied: "Copied",
+    copyFailed: "Copy failed",
+    checking: "Checking for updates\u2026",
+    latest: "You are up to date",
+    found: "New version available",
+    failed: "Could not check for updates. Try again later.",
+    current: "Running version",
+    latestLabel: "Latest version",
+    profile: "Target profile",
+    unknown: "Unknown",
+    manual: "Manual update",
+    manualHint: "If automatic update fails, run this command in the current DSH terminal, then restart DSH Web.",
+    intro: "Only this plugin is checked and updated. Other plugins are not changed.",
+    restart: "Update complete. Restart DSH Web.",
+    restarting: "Update complete. Restarting DSH Desktop\u2026",
+    unavailable: "Automatic update is unavailable. Use the manual command."
+  };
+  function strings() {
+    const lang = document.documentElement.lang.toLowerCase();
+    const settings = document.querySelector('[role="dialog"]')?.textContent ?? "";
+    return lang.startsWith("en") || settings.includes("Settings") && !settings.includes("\u8BBE\u7F6E") ? EN : ZH;
+  }
+  function ensureStyle() {
+    if (document.getElementById(STYLE_ID) !== null) return;
+    const style = document.createElement("style");
+    style.id = STYLE_ID;
+    style.textContent = CSS;
+    (document.head ?? document.documentElement).append(style);
+  }
+  function validPayload(value) {
+    if (value === null || typeof value !== "object") return false;
+    const item = value;
+    return typeof item.packageName === "string" && typeof item.currentVersion === "string" && typeof item.updateAvailable === "boolean" && typeof item.profileName === "string" && typeof item.canAutoUpdate === "boolean" && typeof item.latestCheckFailed === "boolean" && (item.latestVersion === void 0 || typeof item.latestVersion === "string");
+  }
+  async function requestStatus(endpoint, method, signal) {
+    const signalOption = signal === void 0 ? {} : { signal };
+    const response = await fetch(endpoint, method === "GET" ? { cache: "no-store", ...signalOption } : {
+      method: "POST",
+      headers: { "content-type": "application/json", [UPDATE_HEADER]: "1" },
+      body: "{}",
+      ...signalOption
+    });
+    const value = await response.json();
+    if (!response.ok || !validPayload(value)) throw new Error(typeof value.error === "string" ? value.error : strings().failed);
+    return value;
+  }
+  function manualPluginUpdateCommand(profileName, packageName, version) {
+    const profile = profileName.trim() === "" ? "" : ` --profile ${profileName.trim()}`;
+    return `dsh plugin${profile} add ${packageName}@${version} --registry=https://registry.npmjs.org/`;
+  }
+  function handlePluginUpdateEscape(event, close) {
+    if (event.key !== "Escape") return false;
+    event.preventDefault();
+    event.stopPropagation();
+    event.stopImmediatePropagation();
+    close();
+    return true;
+  }
+  function observePluginUpdate(options) {
+    if (typeof document === "undefined" || document.body === null) return () => {
+    };
+    ensureStyle();
+    const controller = new AbortController();
+    let payload;
+    let overlay;
+    let frame;
+    const setButtonContent = (button, label, iconName) => {
+      const icon = options.createIcon(iconName);
+      icon.classList.add("mpi-icon");
+      icon.setAttribute("aria-hidden", "true");
+      const text = document.createElement("span");
+      text.dataset.mpiLabel = "";
+      text.textContent = label;
+      button.replaceChildren(icon, text);
+    };
+    const setButtonLabel = (button, label) => {
+      const text = button.querySelector("[data-mpi-label]");
+      if (text === null) button.textContent = label;
+      else text.textContent = label;
+    };
+    const applyControls = () => {
+      const row = document.querySelector(options.titleRowSelector);
+      if (row === null) return;
+      const heading = row.querySelector("h1,h2");
+      if (heading !== null && payload !== void 0) {
+        let version = heading.querySelector(`.mpi-version[data-package="${options.packageName}"]`);
+        if (version === null) {
+          version = document.createElement("span");
+          version.className = "mpi-version";
+          version.dataset.package = options.packageName;
+          heading.append(version);
+        }
+        const versionLabel = `v${payload.currentVersion}`;
+        if (version.textContent !== versionLabel) version.textContent = versionLabel;
+      }
+      const links = row.querySelector(options.linksSelector);
+      if (links === null || links.querySelector(`[data-mpi-check="${options.packageName}"]`) !== null) return;
+      const button = document.createElement("button");
+      button.type = "button";
+      button.className = "mpi-check";
+      button.dataset.mpiCheck = options.packageName;
+      setButtonContent(button, strings().check, "refresh");
+      button.addEventListener("click", openDialog);
+      links.append(button);
+    };
+    const load = async () => {
+      payload = await requestStatus(options.endpoint, "GET", controller.signal);
+      applyControls();
+      return payload;
+    };
+    const closeDialog = () => {
+      overlay?.remove();
+      overlay = void 0;
+    };
+    function openDialog() {
+      closeDialog();
+      const text = strings();
+      overlay = document.createElement("div");
+      overlay.className = "mpi-overlay";
+      const dialog = document.createElement("section");
+      dialog.className = "mpi-dialog";
+      dialog.setAttribute("role", "dialog");
+      dialog.setAttribute("aria-modal", "true");
+      dialog.innerHTML = `<header class="mpi-head"><h2></h2><button type="button" class="mpi-dialog-close" data-action="close"></button></header><p class="mpi-intro"></p><dl class="mpi-meta"><dt></dt><dd data-role="current"></dd><dt></dt><dd data-role="latest"></dd><dt></dt><dd data-role="profile"></dd></dl><div class="mpi-status" role="status"></div><div class="mpi-progress" hidden></div><section class="mpi-manual"><h3></h3><p></p><div class="mpi-command"><code></code><button type="button" class="mpi-action" data-action="copy"></button></div></section><footer class="mpi-actions"><div class="mpi-actions-group"><button type="button" class="mpi-action" data-action="check"></button><button type="button" class="mpi-action mpi-primary" data-action="update"></button></div></footer>`;
+      const name = document.documentElement.lang.toLowerCase().startsWith("en") ? options.enName : options.zhName;
+      dialog.querySelector("h2").textContent = `${name} ${text.update}`;
+      dialog.querySelector(".mpi-intro").textContent = text.intro;
+      const terms = dialog.querySelectorAll("dt");
+      terms[0].textContent = text.current;
+      terms[1].textContent = text.latestLabel;
+      terms[2].textContent = text.profile;
+      dialog.querySelector(".mpi-manual h3").textContent = text.manual;
+      dialog.querySelector(".mpi-manual p").textContent = text.manualHint;
+      const status = dialog.querySelector(".mpi-status");
+      const progress = dialog.querySelector(".mpi-progress");
+      const command = dialog.querySelector(".mpi-command code");
+      const close = dialog.querySelector("[data-action=close]");
+      const check = dialog.querySelector("[data-action=check]");
+      const update = dialog.querySelector("[data-action=update]");
+      const copy = dialog.querySelector("[data-action=copy]");
+      setButtonContent(close, text.close, "close");
+      close.querySelector("[data-mpi-label]")?.remove();
+      close.setAttribute("aria-label", text.close);
+      close.title = text.close;
+      setButtonContent(check, text.recheck, "refresh");
+      setButtonContent(update, text.auto, "download");
+      setButtonContent(copy, text.copy, "copy");
+      let busy = false;
+      const setMessage = (message, kind = "") => {
+        status.textContent = message;
+        status.dataset.kind = kind;
+      };
+      const setBusy = (value) => {
+        busy = value;
+        check.disabled = value;
+        copy.disabled = value;
+        update.disabled = value || payload?.canAutoUpdate !== true || payload.updateAvailable !== true;
+        progress.hidden = !value;
+      };
+      const render = () => {
+        dialog.querySelector("[data-role=current]").textContent = payload === void 0 ? text.unknown : `v${payload.currentVersion}`;
+        dialog.querySelector("[data-role=latest]").textContent = payload?.latestVersion === void 0 ? text.unknown : `v${payload.latestVersion}`;
+        dialog.querySelector("[data-role=profile]").textContent = payload?.profileName ?? text.unknown;
+        command.textContent = manualPluginUpdateCommand(payload?.profileName ?? "", options.packageName, payload?.latestVersion ?? "latest");
+        update.disabled = busy || payload?.canAutoUpdate !== true || payload.updateAvailable !== true;
+        if (payload === void 0) setMessage(text.checking);
+        else if (payload.latestCheckFailed) setMessage(text.failed, "error");
+        else if (payload.updateAvailable) setMessage(`${text.found}: v${payload.latestVersion ?? text.unknown}`);
+        else setMessage(text.latest, "success");
+        if (payload !== void 0 && !payload.canAutoUpdate && payload.updateAvailable) setMessage(text.unavailable);
+      };
+      const checkNow = async () => {
+        if (busy) return;
+        setBusy(true);
+        setMessage(text.checking);
+        try {
+          await load();
+          setBusy(false);
+          render();
+        } catch (error) {
+          setBusy(false);
+          setMessage(error instanceof Error ? error.message : text.failed, "error");
+        }
+      };
+      const updateNow = async () => {
+        if (busy) return;
+        setBusy(true);
+        setButtonLabel(update, text.updating);
+        setMessage(text.updating);
+        try {
+          payload = await requestStatus(options.endpoint, "POST", controller.signal);
+          applyControls();
+          render();
+          setMessage(payload.autoReload === true ? text.restarting : text.restart, "success");
+        } catch (error) {
+          setMessage(error instanceof Error ? error.message : text.failed, "error");
+        } finally {
+          setButtonLabel(update, text.auto);
+          setBusy(false);
+        }
+      };
+      close.addEventListener("click", closeDialog);
+      check.addEventListener("click", () => {
+        void checkNow();
+      });
+      update.addEventListener("click", () => {
+        void updateNow();
+      });
+      copy.addEventListener("click", () => {
+        void navigator.clipboard?.writeText(command.textContent ?? "").then(() => {
+          setButtonLabel(copy, text.copied);
+          setTimeout(() => {
+            setButtonLabel(copy, text.copy);
+          }, 1400);
+        }).catch(() => {
+          setButtonLabel(copy, text.copyFailed);
+        });
+      });
+      overlay.addEventListener("click", (event) => {
+        if (event.target === overlay) closeDialog();
+      });
+      overlay.addEventListener("keydown", (event) => {
+        handlePluginUpdateEscape(event, closeDialog);
+      }, true);
+      overlay.append(dialog);
+      document.body.append(overlay);
+      render();
+      close.focus();
+      void checkNow();
+    }
+    const observer = new MutationObserver(() => {
+      if (frame !== void 0) return;
+      frame = window.requestAnimationFrame(() => {
+        frame = void 0;
+        applyControls();
+      });
+    });
+    observer.observe(document.body, { childList: true, subtree: true });
+    applyControls();
+    void load().catch(() => {
+    });
+    return () => {
+      controller.abort();
+      observer.disconnect();
+      closeDialog();
+      if (frame !== void 0) window.cancelAnimationFrame(frame);
+      document.querySelectorAll(`[data-mpi-check="${options.packageName}"],.mpi-version[data-package="${options.packageName}"]`).forEach((node) => node.remove());
+    };
+  }
+
+  // src/client.js
   window.__ModuleLoader__.load({
     id: "@michengai/dsh-skills-manager",
     factory: (require2) => {
@@ -7,6 +298,32 @@
       var react = require2("react");
       var h = react.createElement;
       var primitives = require2("@deepseek-ai/dsh-client-ui-primitives");
+      var UPDATE_ICON_PATHS = {
+        refresh: ["M13.5 5.5V2.5m0 0h-3m3 0-2.1 2.1A5.5 5.5 0 1 0 13.2 12"],
+        download: ["M8 2v8m0 0 3-3m-3 3-3-3M3 13v2h10v-2"],
+        copy: ["M5 5h8v8H5z", "M3 3h8"],
+        close: ["m4 4 8 8M12 4 4 12"]
+      };
+      function createPluginUpdateIcon(name) {
+        var element = document.createElement("span");
+        var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+        svg.setAttribute("viewBox", "0 0 16 16");
+        svg.setAttribute("width", "16");
+        svg.setAttribute("height", "16");
+        svg.setAttribute("fill", "none");
+        svg.setAttribute("stroke", "currentColor");
+        svg.setAttribute("stroke-width", "1.5");
+        svg.setAttribute("stroke-linecap", "round");
+        svg.setAttribute("stroke-linejoin", "round");
+        svg.setAttribute("aria-hidden", "true");
+        UPDATE_ICON_PATHS[name].forEach(function(d) {
+          var path = document.createElementNS("http://www.w3.org/2000/svg", "path");
+          path.setAttribute("d", d);
+          svg.append(path);
+        });
+        element.append(svg);
+        return element;
+      }
       var MUTATION_HEADERS = { "content-type": "application/json", "x-dsh-skills-manager": "1" };
       var NS = "skills-manager";
       var DICT = {
@@ -369,7 +686,7 @@
           "root.cursor": "Cursor"
         }
       };
-      var CSS = `
+      var CSS2 = `
 .dssm-section{box-sizing:border-box;display:flex;width:100%;max-width:820px;min-width:0;margin:0 auto;padding:2px 0 36px;container-type:inline-size;flex-direction:column;gap:14px;color:var(--dsw-alias-label-primary);font-family:inherit}.dssm-head{display:flex;align-items:flex-start;gap:20px}.dssm-title-block{min-width:0}.dssm-title-row{display:flex;align-items:center;gap:8px;min-width:0}.dssm-feedback-links{display:flex;align-items:center;gap:4px}.dssm-title{margin:0;font-size:22px;line-height:30px;font-weight:680;letter-spacing:-.3px}.dssm-feedback-link{display:inline-flex;min-height:28px;align-items:center;gap:5px;padding:0 8px;border:1px solid var(--dsw-alias-border-l2);border-radius:7px;background:transparent;color:var(--dsw-alias-label-secondary);font:inherit;font-size:12px;font-weight:500;line-height:18px;text-decoration:none;white-space:nowrap}.dssm-feedback-link:hover{background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary)}.dssm-feedback-link:focus-visible{outline:2px solid var(--dsw-alias-state-success-primary);outline-offset:2px}.dssm-feedback-link svg{flex:none}.dssm-desc{margin:3px 0 0;color:var(--dsw-alias-label-tertiary);font-size:13px;line-height:20px}.dssm-actions{display:flex;gap:8px;margin-left:auto;flex:none}
 .dssm-btn{box-sizing:border-box;display:inline-flex;min-height:34px;align-items:center;justify-content:center;padding:0 13px;border:1px solid transparent;border-radius:8px;background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground);font:inherit;font-size:13px;font-weight:580;white-space:nowrap;cursor:pointer}.dssm-btn:hover:not(:disabled){filter:brightness(1.08)}.dssm-btn:disabled{opacity:.48;cursor:default}.dssm-btn-secondary,.dssm-btn-quiet{border-color:var(--dsw-alias-border-l2);background:transparent;color:var(--dsw-alias-label-primary)}.dssm-btn-quiet{min-height:28px;padding:0 9px;color:var(--dsw-alias-label-secondary);font-size:12px}.dssm-btn-danger{border-color:var(--dsw-alias-state-error-primary);background:transparent;color:var(--dsw-alias-state-error-primary)}.dssm-btn:focus-visible,.dssm-control:focus-visible,.dssm-select-trigger:focus-visible,.dssm-source-head:focus-visible,.dssm-switch:focus-visible,.dssm-upload-link:focus-visible,.dssm-file-remove:focus-visible{outline:2px solid var(--dsw-alias-state-success-primary);outline-offset:2px}
 .dssm-summary{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));overflow:hidden;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-2)}.dssm-stat{padding:12px 14px;border-right:1px solid var(--dsw-alias-border-l1);font-size:13px;color:var(--dsw-alias-label-secondary)}.dssm-stat:last-child{border-right:0}.dssm-stat strong{margin-right:5px;color:var(--dsw-alias-label-primary);font-size:17px;font-weight:680}.dssm-filters{display:flex;gap:9px}.dssm-search{flex:1}.dssm-source-filter{width:210px;flex:none}
@@ -620,7 +937,7 @@
         var bs = react.useState(false), busy = bs[0], setBusy = bs[1];
         var qs = react.useState(""), query = qs[0], setQuery = qs[1];
         var fs = react.useState(""), source = fs[0], setSource = fs[1];
-        var es = react.useState({ codex: true }), expanded = es[0], setExpanded = es[1];
+        var es = react.useState({}), expanded = es[0], setExpanded = es[1];
         var ms = react.useState(null), modal = ms[0], setModal = ms[1];
         var rs = react.useState(null), result = rs[0], setResult = rs[1];
         var fms = react.useState({ root: "dsh", name: "", description: "", body: "" }), form = fms[0], setForm = fms[1];
@@ -772,7 +1089,7 @@
           })) : h("div", { className: "dssm-empty" }, query ? t("empty.search") : t("empty.source"))) : null);
         }
         var summary = data.summary || { total: 0, enabled: 0, disabled: 0, issues: 0 };
-        var content = [h("style", { key: "css" }, CSS), h("div", { key: "head", className: "dssm-head" }, h("div", { className: "dssm-title-block" }, h("div", { className: "dssm-title-row" }, h("h2", { className: "dssm-title" }, t("title")), h("div", { className: "dssm-feedback-links" }, h("a", { className: "dssm-feedback-link", href: "https://github.com/MichengAI/dsh-skills-manager", target: "_blank", rel: "noreferrer", "aria-label": t("link.project") }, h(GithubMark16, null), t("link.project")), h("a", { className: "dssm-feedback-link", href: "https://github.com/MichengAI/dsh-skills-manager/issues", target: "_blank", rel: "noreferrer", "aria-label": t("link.feedback") }, h(primitives.IconListPenOutline16, null), t("link.feedback")))), h("p", { className: "dssm-desc" }, t("desc"))), h("div", { className: "dssm-actions" }, h("button", { type: "button", className: "dssm-btn dssm-btn-secondary", disabled: busy || snapshot.loading, onClick: function() {
+        var content = [h("style", { key: "css" }, CSS2), h("div", { key: "head", className: "dssm-head" }, h("div", { className: "dssm-title-block" }, h("div", { className: "dssm-title-row" }, h("h2", { className: "dssm-title" }, t("title")), h("div", { className: "dssm-feedback-links" }, h("a", { className: "dssm-feedback-link", href: "https://github.com/MichengAI/dsh-skills-manager", target: "_blank", rel: "noreferrer", "aria-label": t("link.project") }, h(GithubMark16, null), t("link.project")), h("a", { className: "dssm-feedback-link", href: "https://github.com/MichengAI/dsh-skills-manager/issues", target: "_blank", rel: "noreferrer", "aria-label": t("link.feedback") }, h(primitives.IconListPenOutline16, null), t("link.feedback")))), h("p", { className: "dssm-desc" }, t("desc"))), h("div", { className: "dssm-actions" }, h("button", { type: "button", className: "dssm-btn dssm-btn-secondary", disabled: busy || snapshot.loading, onClick: function() {
           refresh(false);
         } }, t("btn.refresh")), h("button", { type: "button", className: "dssm-btn", onClick: openCreate }, t("btn.create")), h("button", { type: "button", className: "dssm-btn dssm-btn-secondary", onClick: function() {
           setResult(null);
@@ -893,6 +1210,9 @@
         ctx.effect(function() {
           return ctx.locale.register(NS, DICT);
         });
+        ctx.effect(function() {
+          return observePluginUpdate({ endpoint: "/api/michengai/dsh-skills-manager/update", packageName: "@michengai/dsh-skills-manager", titleRowSelector: ".dssm-title-row", linksSelector: ".dssm-feedback-links", zhName: "\u6280\u80FD", enName: "Skills", createIcon: createPluginUpdateIcon });
+        }, "skills-manager: plugin update ui");
         ctx.slots.inject("settings.section", function() {
           return ctx.slots.register({ name: "settings.section", id: "skills-manager", order: 17, label: function() {
             return ctx.locale.bind(NS)("title");

package/lib/index.js

@@ -17,6 +17,7 @@ import {
   projectRoots,
   logPath
 } from "./core.js";
+import { registerPluginUpdater } from "./plugin-updater.js";
 const name = "skills-manager";
 const inject = ["webServer", "webRuntime", "skills", "tools", "sessions"];
 const CLIENT_MARKER_HEADER = "x-dsh-skills-manager";
@@ -252,6 +253,11 @@ function registerAgentSkillProviders(ctx, invalidators) {
   };
 }
 function apply(ctx) {
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    endpoint: "/api/michengai/dsh-skills-manager/update",
+    packageName: "@michengai/dsh-skills-manager",
+    manifestUrl: new URL("../package.json", import.meta.url)
+  }), "skills-manager: plugin updater");
   const log = makeLog();
   const trustedHosts = Array.isArray(ctx.webRuntime.trustedHosts) ? ctx.webRuntime.trustedHosts : [];
   const roots = userRoots();

package/lib/plugin-updater.js

@@ -0,0 +1,257 @@
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const PLUGIN_UPDATE_HEADER = "x-michengai-plugin-update";
+const PLUGIN_UPDATE_IPC = "apply-plugin-updates";
+function header(request, name) {
+  const value = request.headers?.[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+function isLoopbackAddress(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, "");
+  return address === "localhost" || address === "localhost." || address === "::1" || address?.startsWith("127.") === true || address?.startsWith("::ffff:127.") === true;
+}
+function isTrustedUpdateRequest(request) {
+  if (header(request, PLUGIN_UPDATE_HEADER) !== "1") return false;
+  if (!isLoopbackAddress(request.socket?.remoteAddress)) return false;
+  const site = header(request, "sec-fetch-site");
+  if (site !== void 0 && site !== "same-origin") return false;
+  const origin = header(request, "origin");
+  const host = header(request, "host");
+  if (origin === void 0 || host === void 0) return false;
+  try {
+    const url = new URL(origin);
+    return (url.protocol === "http:" || url.protocol === "https:") && isLoopbackAddress(url.hostname) && url.host === host;
+  } catch {
+    return false;
+  }
+}
+function validProfileName(value) {
+  return typeof value === "string" && value !== "" && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !/[\0-\x1f\x7f]/.test(value);
+}
+function profileNameFromArgv(argv) {
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === "--profile") return argv[index + 1];
+    if (argv[index]?.startsWith("--profile=")) return argv[index].slice("--profile=".length);
+  }
+  return argv[2] === "web" ? "web" : void 0;
+}
+function isDshCliEntry(entry, manifest, packageRoot) {
+  if (typeof manifest !== "object" || manifest === null) return false;
+  if (manifest.name !== "@deepseek-ai/dsh") return false;
+  const bin = typeof manifest.bin === "string" ? manifest.bin : typeof manifest.bin === "object" && manifest.bin !== null ? manifest.bin.dsh : void 0;
+  return typeof bin === "string" && bin !== "" && !isAbsolute(bin) && resolve(packageRoot, bin) === resolve(entry);
+}
+function cliEntry() {
+  const value = process.argv[1];
+  if (value === void 0 || value === "") return void 0;
+  const entry = value.startsWith("file:") ? fileURLToPath(value) : resolve(process.cwd(), value);
+  if (!existsSync(entry)) return void 0;
+  for (let directory = dirname(entry); ; ) {
+    const manifestPath = resolve(directory, "package.json");
+    if (existsSync(manifestPath)) {
+      try {
+        if (isDshCliEntry(entry, JSON.parse(readFileSync(manifestPath, "utf8")), directory)) return entry;
+      } catch {
+      }
+    }
+    const parent = dirname(directory);
+    if (parent === directory) return void 0;
+    directory = parent;
+  }
+}
+function runtime(ctx) {
+  const profiles = ctx.get?.("desktopProfiles");
+  const desktopPnpm = ctx.get?.("desktopPnpm");
+  if (profiles?.current !== void 0) {
+    const current = profiles.current;
+    if (!validProfileName(current.name) || typeof current.dir !== "string" || !isAbsolute(current.dir)) {
+      throw new Error("\u5F53\u524D Desktop Profile \u4FE1\u606F\u65E0\u6548\uFF0C\u8BF7\u91CD\u542F\u540E\u91CD\u8BD5\u3002");
+    }
+    return { profileName: current.name, profileDir: resolve(current.dir), ...typeof desktopPnpm?.runPlugin === "function" ? { desktopPnpm } : {} };
+  }
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR ?? resolve(homedir(), ".dsh", "profiles", "web"));
+  const selected = profileNameFromArgv(process.argv);
+  const profileName = validProfileName(selected) ? selected : validProfileName(basename(profileDir)) ? basename(profileDir) : "web";
+  const entry = cliEntry();
+  return { profileName, profileDir, ...entry === void 0 ? {} : { cliEntry: entry } };
+}
+function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (match === null) return void 0;
+  return { core: [Number(match[1]), Number(match[2]), Number(match[3])], prerelease: match[4]?.split(".") ?? [] };
+}
+function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue);
+  const candidate = parseSemver(candidateValue);
+  if (current === void 0 || candidate === void 0) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index];
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0;
+}
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === void 0 || b === void 0) return a === b ? 0 : a === void 0 ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a);
+      const bNumber = BigInt(b);
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+let latestCache;
+async function latestVersion(packageName) {
+  if (latestCache?.packageName === packageName && Date.now() < latestCache.expiresAt) return latestCache.version;
+  try {
+    const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, { signal: AbortSignal.timeout(8e3) });
+    if (!response.ok) return void 0;
+    const value = await response.json();
+    if (typeof value.version !== "string" || value.version === "") return void 0;
+    latestCache = { packageName, version: value.version, expiresAt: Date.now() + 5 * 6e4 };
+    return value.version;
+  } catch {
+    return void 0;
+  }
+}
+async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, "utf8"));
+  if (typeof value.version !== "string" || value.version === "") throw new Error("\u65E0\u6CD5\u8BFB\u53D6\u5F53\u524D\u63D2\u4EF6\u7248\u672C\u3002");
+  return value.version;
+}
+async function status(options, target) {
+  const current = await currentVersion(options.manifestUrl);
+  const latest = await latestVersion(options.packageName);
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...latest === void 0 ? {} : { latestVersion: latest },
+    latestCheckFailed: latest === void 0,
+    updateAvailable: latest !== void 0 && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.desktopPnpm !== void 0 || target.cliEntry !== void 0
+  };
+}
+async function runCliInstall(target, packageSpec) {
+  if (target.cliEntry === void 0) throw new Error("\u5F53\u524D\u73AF\u5883\u4E0D\u652F\u6301\u81EA\u52A8\u66F4\u65B0\uFF0C\u8BF7\u4F7F\u7528\u624B\u5DE5\u66F4\u65B0\u547D\u4EE4\u3002");
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [target.cliEntry, "plugin", "--profile", target.profileName, "add", "--config.minimumReleaseAge=0", packageSpec, "--registry=https://registry.npmjs.org/"], {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, NO_COLOR: "1" }
+    });
+    let detail = "";
+    child.stdout?.on("data", (chunk) => {
+      detail = (detail + String(chunk)).slice(-4e3);
+    });
+    child.stderr?.on("data", (chunk) => {
+      detail = (detail + String(chunk)).slice(-4e3);
+    });
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(new Error("\u66F4\u65B0\u8D85\u65F6\uFF0C\u8BF7\u6539\u7528\u624B\u5DE5\u66F4\u65B0\u3002"));
+    }, 10 * 6e4);
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.once("exit", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolvePromise();
+      else reject(new Error(detail.trim() || `\u66F4\u65B0\u8FDB\u7A0B\u9000\u51FA\u7801 ${String(code)}`));
+    });
+  });
+}
+async function install(target, packageSpec) {
+  if (target.desktopPnpm === void 0) return runCliInstall(target, packageSpec);
+  const handle = target.desktopPnpm.runPlugin(["add", "--config.minimumReleaseAge=0", packageSpec, "--registry=https://registry.npmjs.org/"], target.profileDir);
+  const result = await handle.done;
+  if (result.exitCode !== 0) throw new Error(`\u66F4\u65B0\u8FDB\u7A0B\u9000\u51FA\u7801 ${String(result.exitCode)}\u3002`);
+}
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+  response.end(JSON.stringify(value));
+}
+function publicError(error) {
+  const message = error instanceof Error ? error.message : "\u66F4\u65B0\u6682\u4E0D\u53EF\u7528\u3002";
+  return /[A-Za-z]:[\\/]|\/(?:home|root|Users|var|tmp)\//.test(message) ? "\u66F4\u65B0\u5931\u8D25\uFF0C\u8BF7\u67E5\u770B\u670D\u52A1\u7AEF\u65E5\u5FD7\u3002" : message;
+}
+function registerPluginUpdater(ctx, options) {
+  const host = ctx;
+  let installing = false;
+  return host.webServer.register({
+    kind: "exact",
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = runtime(host);
+        if (request.method === "GET" || request.method === "HEAD") {
+          const payload = await status(options, target);
+          response.writeHead(200, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
+          response.end(request.method === "HEAD" ? void 0 : JSON.stringify(payload));
+          return;
+        }
+        if (request.method !== "POST") {
+          response.writeHead(405, { allow: "GET, HEAD, POST" });
+          response.end();
+          return;
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          json(response, 403, { error: "\u5DF2\u62D2\u7EDD\u975E\u672C\u673A\u540C\u6E90\u66F4\u65B0\u8BF7\u6C42\u3002" });
+          return;
+        }
+        if (installing) {
+          json(response, 409, { error: "\u5F53\u524D\u63D2\u4EF6\u6B63\u5728\u66F4\u65B0\uFF0C\u8BF7\u7A0D\u5019\u3002" });
+          return;
+        }
+        const before = await status(options, target);
+        if (before.latestVersion === void 0) {
+          json(response, 503, { error: "\u6682\u65F6\u65E0\u6CD5\u83B7\u53D6\u6700\u65B0\u7248\u672C\u3002" });
+          return;
+        }
+        if (!before.updateAvailable) {
+          json(response, 200, before);
+          return;
+        }
+        installing = true;
+        try {
+          await install(target, `${options.packageName}@${before.latestVersion}`);
+        } finally {
+          installing = false;
+        }
+        const notifyParent = target.desktopPnpm === void 0 && typeof process.send === "function";
+        const autoReload = target.desktopPnpm !== void 0 || notifyParent;
+        json(response, 200, { ...before, updatedVersion: before.latestVersion, restartRequired: true, autoReload });
+        if (notifyParent) setTimeout(() => {
+          process.send?.(PLUGIN_UPDATE_IPC);
+        }, 150).unref?.();
+      } catch (error) {
+        ctx.logger.warn(`plugin updater failed: ${String(error)}`);
+        json(response, 503, { error: publicError(error) });
+      }
+    }
+  });
+}
+export {
+  PLUGIN_UPDATE_HEADER,
+  PLUGIN_UPDATE_IPC,
+  isDshCliEntry,
+  isNewerVersion,
+  isTrustedUpdateRequest,
+  registerPluginUpdater
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-skills-manager",
-  "version": "0.1.40",
+  "version": "0.1.43",
   "description": "NPM-installable DSH Web plugin for safely loading and managing skills across DSH and common local Agents.",
   "license": "Apache-2.0",
   "repository": {
@@ -77,7 +77,7 @@
     "esbuild": "0.25.0"
   },
   "engines": {
-    "node": ">=20"
+    "node": "^22.19.0 || >=24.0.0"
   },
   "keywords": [
     "deepseek-harness",