@morehao/dsh-skills-console 0.5.4 → 0.5.5

package/README.en.md

@@ -24,7 +24,7 @@ It gathers the skills on your machine into one list: what you have, where it cam
 | --- | --- |
 | Inventory | Collects the skills on this machine — source, version, visibility and shared agents in one view; skills already in the shared directory are adopted automatically the first time you open it |
 | Install | Enter `owner/repo` or a GitHub URL; first detects which skills the repo has and what each does; install everything or pick a few |
-| Update | Checks upstream commits, lists the commit range and affected skills, updates in one click after you confirm; locally modified skills ask for confirmation first |
+| Update | Checks upstream commits, lists the commit range and affected skills, updates in one click after you confirm; skills with local edits ask for confirmation first |
 | Remove | Pre-flight check (never touches what others created), then a snapshot into the trash (kept 7 days) |
 | Toggle | One-click on/off; once disabled, neither DSH's model invocations nor `/` manual invocations see it; other agents and files on disk are unaffected |
 | Share | Links only agents that read their own directory; nothing is shared by default; agents that read the shared directory directly are not listed |
@@ -61,7 +61,7 @@ Screenshots are from a real DSH Web session on v0.5.2 (dark theme). All assets l
 
 - **Two entry points**: by default it lives in the "Skills Console" section of DSH settings; turn on "Sidebar entry" in the header ⚙ and a standalone panel appears in the left sidebar, effective immediately.
 - **One page, two tabs**: Installed / Subscriptions. The header holds "Auto-share on install" and "Add skill / Add subscription" on the right.
-- **Five actions per row**: toggle, view, update, share settings, delete; the ✨ next to a skill name opens the AI intro; "View" is hidden on narrow panels, and the skill name itself remains the entry point. Status labels cover up to date / update available / locally modified / removed upstream / broken link / no upstream.
+- **Five actions per row**: toggle, view, update, share settings, delete; the ✨ next to a skill name opens the AI intro; "View" is hidden on narrow panels, and the skill name itself remains the entry point. Status labels cover up to date / update available / changed since install / removed upstream / broken link / no upstream.
 - **No layout jumps on narrow panels**: the action group wraps naturally with panel width and the plugin name always stays whole; the list switches to two columns by width; scrolling happens only in the list area, so switching tabs or resizing never flips the whole page.
 - **Many agents don't crowd**: at most 3 are shown per row and the rest fold into `+n`; hover or focus reveals all.
 - **Findable**: search by name / source / agent, filter by "updates / not checked / disabled", view flat or grouped by agent.
@@ -73,7 +73,7 @@ While managing skills you may want to know "what does this skill say, and is it
 
 - **Drawer quick look**: the list stays put and a read-only drawer slides in from the right; close it with Esc / the overlay / ×, and you return to the previous filter and scroll position.
 - **Full page for a deep read**: "Open as page" at the bottom of the drawer switches to a full page (body + contents on the left), with a top bar to go back to the list.
-- **Three tabs**: Content (rendered / raw toggle; raw keeps the frontmatter), Files (directory tree + single-file preview; `.md` renders by default and can switch to raw, other text shows its source directly), Info (source, ref, commit, skillPath, content hash, install / update time, shared agents, enabled state, local changes).
+- **Three tabs**: Content (rendered / raw toggle; raw keeps the frontmatter), Files (directory tree + single-file preview; `.md` renders by default and can switch to raw, other text shows its source directly), Info (source, ref, commit, skillPath, content hash, install / update time, shared agents, enabled state, changes since install).
 - **Read-only**: no inputs and no save button. Update / share settings are enabled depending on writability; when the state file is corrupt you can still view, but management actions are disabled.
 - **What can be previewed**: text files that decode as UTF-8 (`.md` / `.html` / `.jsx` / `.css` / `.sh` / extension-less scripts…) show their source directly; the per-file cap is 256 KB (longer content is truncated with a notice); images, audio/video, archives and other binaries show "Preview not supported" with the file name / size.
 
@@ -89,6 +89,16 @@ Some skills only have an English description, and some titles alone don't tell y
 - **Subscription candidates too**: expanded subscriptions have `✨ Intro` on each entry; it fetches the remote `SKILL.md` at the snapshot `commit` and generates from that, with the commit in the cache key, and it never blocks "Install". Expanding also shows the author's own frontmatter description for free.
 - **How to turn it off**: `config.intro.enabled = false` (hides the ✨ entry). Other knobs are under "Data and configuration".
 
+## Check and update the plugin itself
+
+The **refresh button** next to the identity capsule in the page header checks whether *Skills Console itself* has a new release. This is a different axis from skill updates — it checks this plugin's own npm releases:
+
+- **How it checks**: follows the registry plan from the host's `pluginManager.registries()` (inheriting the profile's mirror / private source / token config) and asks `<registry>/<package>/latest` in turn (8s timeout, version only; falls back to the official `registry.npmjs.org` only if none answer), then compares with the installed version; the host caches for 5 minutes so repeated opens don't hit the network. About 20 seconds after startup it warms the cache once, silently.
+- **One-click update**: when the desktop host exposes `pluginManager`, clicking "Update to x.y.z" reinstalls this plugin to the latest version (installed from the registry that reported it); **restart DSH to apply** (no auto-reload).
+- **Manual fallback**: if one-click update is unavailable, the dialog shows a copyable command (`dsh plugin --profile <profile> add <package>@latest`).
+- **When a new version exists**: a small dot lights up on the refresh button; open it to see current / latest version and the update button, plus the release's **GitHub Release notes** body pulled for that version (if unavailable, a "view release notes on GitHub" link instead).
+- **Boundaries**: it only queries registries and only (re)installs this plugin itself, touching no other plugin's state directory; failures degrade silently to "could not reach the registry" and never affect any skill-management feature.
+
 ## Installation
 
 The plugin ships its own download and extraction code: **no Node / npm / npx / git required beforehand**; the first install needs network access to fetch dependencies.
@@ -113,7 +123,7 @@ The panel shows up in DSH Web's settings page / sidebar.
 
 1. **Add skill**: click "Add skill" in the top right, enter `owner/repo` or a GitHub URL, then click "Detect"; when the repo has several skills, tick the ones to install (multi-select, all selected by default, each with its description), and a single skill is selected automatically. If nothing is detected you can type skill names by hand; leaving them empty installs everything in the repo.
 2. **Share with other agents**: only needed for agents that read their own directory (for example Claude Code). Click "Share settings" on a row and tick the target agents; agents that already read the shared directory are not listed. To choose which agents new installs are shared with by default, use "Auto-share on install" in the header (nothing is ticked by default).
-3. **Check for updates**: manual checks and the background auto-check are **complementary** paths sharing the same verdict — both land in the installed view's update status. Click the refresh icon in the list header to check now, light up "Update", or "Update all"; the background also runs a check every 6 hours (reusing DSH's timer service, which is silently skipped when unavailable — manual checks are unaffected), so the panel is usually already current when you open it. Locally modified skills ask for confirmation before updating.
+3. **Check for updates**: manual checks and the background auto-check are **complementary** paths sharing the same verdict — both land in the installed view's update status. Click the refresh icon in the list header to check now, light up "Update", or "Update all"; the background also runs a check every 6 hours (reusing DSH's timer service, which is silently skipped when unavailable — manual checks are unaffected), so the panel is usually already current when you open it. Skills with local edits ask for confirmation before updating.
 4. **Invocation policy**: click the "Auto / Manual only / Fully disabled" status button on a row and switch in the centered invocation-policy dialog. Auto = both the model and `/` can invoke it; Manual only = only the `disable-model-invocation` frontmatter key in `SKILL.md` changes and `/` still works; Fully disabled = `SKILL.md` is renamed to `SKILL.md.disabled` with a marker left behind, and restoring returns to the mode from before. When the author already declared manual-only in `SKILL.md`, the chip is read-only and is never overridden. While parked, install and update are rejected so the file cannot be silently written back.
 
 ## Safety and reliability

package/README.md

@@ -61,7 +61,7 @@ DSH（DeepSeek Harness）的技能控制台：**安装、更新、删除、启
 
 - **两个入口**：默认在 DSH 设置页的「技能控制台」分区；页头 ⚙ 里打开「侧边栏入口」，左侧栏就会出现独立面板，切换立即生效。
 - **一页两 tab**：已安装 / 订阅。页头右侧是「新安装时自动共享」与「添加技能 / 添加订阅」。
-- **每行五个动作**：开关（启停）、查看、更新、共享设置、删除；技能名旁的 ✨ 打开 AI 简介；窄面板下隐藏「查看」，技能名本身仍是入口。状态标签覆盖最新 / 可更新 / 本地已改 / 上游已移除 / 软链断裂 / 无上游等。
+- **每行五个动作**：开关（启停）、查看、更新、共享设置、删除；技能名旁的 ✨ 打开 AI 简介；窄面板下隐藏「查看」，技能名本身仍是入口。状态标签覆盖最新 / 可更新 / 安装后有改动 / 上游已移除 / 软链断裂 / 无上游等。
 - **窄面板不跳版**：动作组按面板宽度自然换行，插件名始终完整；列表按宽度切两列；滚动只发生在列表区，切 tab、调整窗口都不会让整页翻面。
 - **Agent 多了不挤**：每行最多展示 3 个，其余折成 `+n`，悬浮或聚焦即可看全。
 - **找得到**：支持按名称 / 来源 / Agent 搜索，按「可更新 / 待检查 / 已停用」筛选，平铺或按 Agent 分组。
@@ -73,7 +73,7 @@ DSH（DeepSeek Harness）的技能控制台：**安装、更新、删除、启
 
 - **抽屉速览**：列表不动，右侧滑出只读抽屉；Esc / 点遮罩 / × 关闭，关闭后回到原来的筛选与滚动位置。
 - **整页深读**：抽屉底部「在整页打开」切到整页阅读（正文 + 左侧目录），顶部返回条回列表。
-- **三个 tab**：正文（渲染 / 原文切换，原文保留 frontmatter）、文件（目录树 + 单文件预览；`.md` 默认渲染、可切原文，其他文本直接出源码）、信息（来源、ref、commit、skillPath、内容哈希、安装 / 更新时间、共享至哪些 Agent、启停、本地改动）。
+- **三个 tab**：正文（渲染 / 原文切换，原文保留 frontmatter）、文件（目录树 + 单文件预览；`.md` 默认渲染、可切原文，其他文本直接出源码）、信息（来源、ref、commit、skillPath、内容哈希、安装 / 更新时间、共享至哪些 Agent、启停、安装后改动）。
 - **只读**：没有输入框和保存按钮。更新 / 共享设置按可写状态决定是否可用；状态文件损坏时仍可查看，管理动作禁用。
 - **能预览什么**：能按 UTF-8 解码的文本文件（`.md` / `.html` / `.jsx` / `.css` / `.sh` / 无扩展名脚本…）直接显示源码；单文件上限 256 KB（超出截断并提示）；图片、音视频、压缩包等二进制显示「暂不支持预览」和文件名 / 大小。
 
@@ -89,6 +89,16 @@ DSH（DeepSeek Harness）的技能控制台：**安装、更新、删除、启
 - **订阅候选也能看**：展开订阅后，条目行同样有 `✨ 简介`；按快照 `commit` 拉远端 `SKILL.md` 再生成，缓存 key 带 commit，不挡「安装」。展开时还会显示作者自己的 frontmatter 描述，不花额度。
 - **关闭方式**：`config.intro.enabled = false`（界面隐藏 ✨ 入口）。其他可调项见「数据与配置」。
 
+## 检查与更新插件自身
+
+页头身份胶囊旁的**刷新按钮**用来检查「技能控制台」这个插件自己有没有新版本，而管的是另一个维度——它不是检查技能的上游，而是检查本插件在 npm 上的发布：
+
+- **怎么查**：按宿主 `pluginManager.registries()` 给的 registry 计划（继承 profile 的镜像 / 私有源 / token 配置）依次问 `<registry>/<包名>/latest`（8 秒超时，只取版本号，取不到才回退官方 `registry.npmjs.org`），与本机安装的版本比较；Host 端 5 分钟缓存，连续打开不重复打网络。启动后约 20 秒会静默热身一次，不打扰你。
+- **一键更新**：桌面端有 `pluginManager` 服务时，弹窗里点「更新到 x.y.z」即可把本插件重装到最新版（装到查到最新版的那个 registry）；更新成功后**重启 DSH 生效**（不自动刷新）。
+- **手动兜底**：环境不支持一键更新时，弹窗给出可复制的手动命令（`dsh plugin --profile <profile> add <包名>@latest`）。
+- **有新版本时**：刷新按钮上会亮一个小圆点，点开即见当前版本 / 最新版本与更新按钮；弹窗还会拉取该版本在 GitHub 上的 **Release 发布说明**正文一并展示（拉不到时给「在 GitHub 查看发布说明」链接）。
+- **边界**：只问 registry、只装本插件自身，不读写其他插件的状态目录；失败静默降级为「暂时无法获取最新版本」，不影响技能管理的任何功能。
+
 ## 安装
 
 插件自带下载与解压能力，**不需要预装 Node / npm / npx / git**；首次安装需要联网拉取依赖。

package/client.js

@@ -69,6 +69,15 @@ async function apiCall(method, path, body, options = {}) {
   return json;
 }
 var GITHUB_URL = "https://github.com/morehao/dsh-skills-console";
+function checkPluginUpdate({ fresh = false } = {}) {
+  return apiCall("GET", `/plugin-update${fresh ? "?fresh=1" : ""}`);
+}
+function applyPluginUpdate() {
+  return apiCall("POST", "/plugin-update/apply", {});
+}
+function fetchPluginRelease(version) {
+  return apiCall("GET", `/plugin-update/release?version=${encodeURIComponent(version || "")}`);
+}
 
 // client/copy.js
 var DICT = {
@@ -117,10 +126,33 @@ var DICT = {
     "placement.off": "已关闭",
     "placement.hint": "开启后侧栏出现「技能控制台」入口；关闭则只在「设置 → 技能」显示。",
     "github.open": "打开 GitHub 仓库",
+    "pluginUpdate.check": "检查插件更新",
+    "pluginUpdate.title": "检查插件更新",
+    "pluginUpdate.current": "当前版本",
+    "pluginUpdate.latest": "最新版本",
+    "pluginUpdate.checking": "正在检查…",
+    "pluginUpdate.upToDate": "已是最新版本",
+    "pluginUpdate.available": "有新版本可用",
+    "pluginUpdate.checkFailed": "暂时无法获取最新版本，请稍后再试",
+    "pluginUpdate.recheck": "重新检查",
+    "pluginUpdate.update": "更新到 {version}",
+    "pluginUpdate.applying": "正在更新…",
+    "pluginUpdate.updated": "已更新到 {version}，重启 DSH 后生效",
+    "pluginUpdate.restartHint": "更新已安装，请重启 DSH 使新版本生效。",
+    "pluginUpdate.manual": "当前环境不支持一键更新，请手动执行：",
+    "pluginUpdate.copy": "复制命令",
+    "pluginUpdate.copied": "已复制",
+    "pluginUpdate.close": "关闭",
+    "pluginUpdate.whatsNew": "v{version} 更新内容",
+    "pluginUpdate.releaseLoading": "正在加载更新内容…",
+    "pluginUpdate.viewReleaseNotes": "在 GitHub 查看发布说明",
+    "pluginUpdate.releaseUnavailable": "暂无该版本的发布说明。",
     "status.current": "最新",
     "status.update": "可更新",
-    "status.local": "本地已改",
-    "status.conflict": "本地已改 + 上游已变",
+    "status.local": "安装后有改动",
+    "status.localHint": "安装或更新后，这个技能的文件被改过；再次更新会覆盖这些改动，会先请你确认。可在「查看 → 信息」里核对",
+    "status.conflict": "有改动 · 可更新",
+    "status.conflictHint": "本地文件有改动，上游也有新提交；更新会覆盖你的改动（旧内容有备份，可回滚）",
     "status.deleted": "上游已移除",
     "status.broken": "异常：软链断裂",
     "status.unmanaged": "未纳入追踪",
@@ -295,9 +327,9 @@ var DICT = {
     "viewer.info.updatedAt": "更新",
     "viewer.info.size": "大小",
     "viewer.info.local": "本地",
-    "viewer.info.localChange": "本地改动",
+    "viewer.info.localChange": "安装后改动",
     "viewer.info.localChangeNone": "无（与安装时一致）",
-    "viewer.info.localChangeYes": "有本地改动",
+    "viewer.info.localChangeYes": "有改动",
     "viewer.info.links": "共享",
     "viewer.info.exported": "已共享",
     "viewer.info.visibility": "可见性",
@@ -376,10 +408,33 @@ var DICT = {
     "placement.off": "off",
     "placement.hint": "On: a Skills Console entry appears in the sidebar. Off: it only shows under Settings → Skills.",
     "github.open": "Open GitHub repository",
+    "pluginUpdate.check": "Check for plugin updates",
+    "pluginUpdate.title": "Check for plugin updates",
+    "pluginUpdate.current": "Current version",
+    "pluginUpdate.latest": "Latest version",
+    "pluginUpdate.checking": "Checking…",
+    "pluginUpdate.upToDate": "You are on the latest version",
+    "pluginUpdate.available": "A new version is available",
+    "pluginUpdate.checkFailed": "Could not reach the registry; please try again later",
+    "pluginUpdate.recheck": "Check again",
+    "pluginUpdate.update": "Update to {version}",
+    "pluginUpdate.applying": "Updating…",
+    "pluginUpdate.updated": "Updated to {version}; restart DSH to apply",
+    "pluginUpdate.restartHint": "The update is installed. Restart DSH to use the new version.",
+    "pluginUpdate.manual": "One-click update is unavailable here; run this manually:",
+    "pluginUpdate.copy": "Copy command",
+    "pluginUpdate.copied": "Copied",
+    "pluginUpdate.close": "Close",
+    "pluginUpdate.whatsNew": "What's new in v{version}",
+    "pluginUpdate.releaseLoading": "Loading release notes…",
+    "pluginUpdate.viewReleaseNotes": "View release notes on GitHub",
+    "pluginUpdate.releaseUnavailable": "No release notes for this version.",
     "status.current": "Up to date",
     "status.update": "Update available",
-    "status.local": "Locally modified",
-    "status.conflict": "Local + upstream changed",
+    "status.local": "Changed since install",
+    "status.localHint": "Files were changed after install or update. Updating overwrites them and asks for confirmation first. Check “View → Info” to compare",
+    "status.conflict": "Changed · update available",
+    "status.conflictHint": "Local files changed and upstream has new commits; updating overwrites your edits (old content is backed up and can be rolled back)",
     "status.deleted": "Removed upstream",
     "status.broken": "Broken link",
     "status.unmanaged": "Untracked",
@@ -554,9 +609,9 @@ var DICT = {
     "viewer.info.updatedAt": "Updated",
     "viewer.info.size": "Size",
     "viewer.info.local": "Local",
-    "viewer.info.localChange": "Local changes",
+    "viewer.info.localChange": "Changes since install",
     "viewer.info.localChangeNone": "None (matches install)",
-    "viewer.info.localChangeYes": "Modified locally",
+    "viewer.info.localChangeYes": "Changed",
     "viewer.info.links": "Shared",
     "viewer.info.exported": "Shared",
     "viewer.info.visibility": "Visibility",
@@ -1040,7 +1095,7 @@ function FolderIcon({ size = 12 }) {
 }
 
 // client/section.js
-var import_react9 = __toESM(require("react"), 1);
+var import_react10 = __toESM(require("react"), 1);
 
 // client/scroll.js
 function isScroller(node, tolerance = 4) {
@@ -1121,6 +1176,10 @@ var CSS = `
   .dshsc-tool:hover { background: var(--dsw-alias-bg-layer-2); color: var(--dsw-alias-label-primary); }
   .dshsc-tool:focus-visible { outline: 2px solid var(--dsw-alias-brand-primary); outline-offset: 1px; }
   .dshsc-tool[aria-expanded="true"] { background: var(--dsw-alias-bg-layer-2); color: var(--dsw-alias-label-primary); }
+  /* 刷新按钮：检查到新版本时右上角点个品牌色圆点 */
+  .dshsc-tool-dot { position: relative; color: var(--dsw-alias-brand-primary); }
+  .dshsc-tool-dot::after { content: ""; position: absolute; top: 3px; right: 3px; width: 6px; height: 6px;
+    border-radius: 50%; background: var(--dsw-alias-state-warning-primary, #e8b15a); box-shadow: 0 0 0 1.5px var(--dsw-alias-bg-base); }
   .dshsc-settings { position: relative; display: inline-flex; }
   /* 设置面板留在 Host 对话框内（焦点陷阱 / 层级都跟着走）；开启时按左右余量选边和宽度 */
   .dshsc-pop { position: absolute; top: calc(100% + 8px); z-index: 30; box-sizing: border-box;
@@ -1483,6 +1542,10 @@ var CSS = `
   /* 64ch 是主页面长文的舒适行长；弹窗说明只有一两句，用满弹窗宽度，避免没必要的折行 */
   .dshsc-modal .dshsc-sub { max-width: none; }
   .dshsc-modal h3 { margin: 0; font-size: 15px; font-weight: 600; padding-right: 26px; }
+  /* 插件更新弹窗的「当前 / 最新」键值对 */
+  .dshsc-kv { display: grid; grid-template-columns: auto 1fr; gap: 6px 12px; margin: 0; font-size: 12px; align-items: baseline; }
+  .dshsc-kv dt { color: var(--dsw-alias-label-secondary); }
+  .dshsc-kv dd { margin: 0; }
   .dshsc-modal-close { position: absolute; top: 10px; right: 10px; width: 26px; height: 26px; border: 0; border-radius: 7px;
     background: transparent; color: var(--dsw-alias-label-secondary); font-size: 18px; line-height: 1; cursor: pointer; }
   .dshsc-modal-close:hover { background: var(--dsw-alias-bg-layer-2); color: var(--dsw-alias-label-primary); }
@@ -1532,6 +1595,14 @@ var CSS = `
   .dshsc-panel .dshsc-check.locked:hover { background: transparent; }
 
   .dshsc-modal-foot { display: flex; justify-content: flex-end; gap: 8px; padding-top: 12px; border-top: 1px solid var(--dsw-alias-border-l1); }
+  /* 弹窗页脚按钮可能是「图标 + 文字」：统一成水平排列，避免 svg(display:block) 把文字挤到下一行 */
+  .dshsc-modal-foot .dshsc-btn { display: inline-flex; align-items: center; justify-content: center; gap: 5px; }
+  .dshsc-modal-foot .dshsc-btn svg { display: block; }
+  /* 插件更新弹窗里的「更新内容」（GitHub Release 正文）：限高滚动，长说明不撑爆弹窗 */
+  .dshsc-release-head { font-size: 12px; font-weight: 600; color: var(--dsw-alias-label-primary); margin-bottom: 6px; }
+  .dshsc-release-body { max-height: 260px; overflow: auto; padding: 10px 12px; border-radius: 10px;
+    background: var(--dsw-alias-bg-layer-2); border: 1px solid var(--dsw-alias-border-l1); }
+  .dshsc-release-body .dshsc-md { font-size: 12.5px; }
   /* ---------- 查看器：抽屉（B1）/ 整页（A1）共用 ---------- */
   .dshsc-drawer-wrap { position: fixed; inset: 0; z-index: 55; }
   .dshsc-drawer-scrim { position: absolute; inset: 0; background: rgba(4,6,9,.55); }
@@ -2254,6 +2325,64 @@ function useSkillIntro({ name, lang, stamp, enabled = true, endpoint = null }) {
   }, [name, lang, base]);
   return { ...state, generating, genError, generate };
 }
+function usePluginUpdate() {
+  const [status, setStatus] = import_react2.default.useState(null);
+  const [checking, setChecking] = import_react2.default.useState(false);
+  const [applying, setApplying] = import_react2.default.useState(false);
+  const [checkError, setCheckError] = import_react2.default.useState(null);
+  const [applyError, setApplyError] = import_react2.default.useState(null);
+  const [release, setRelease] = import_react2.default.useState({ loading: false, data: null, version: null });
+  const inFlight = import_react2.default.useRef(false);
+  const check = import_react2.default.useCallback(async (fresh = false) => {
+    if (inFlight.current) return null;
+    inFlight.current = true;
+    setChecking(true);
+    setCheckError(null);
+    try {
+      const next = await checkPluginUpdate({ fresh });
+      setStatus(next);
+      return next;
+    } catch (error) {
+      setCheckError({ code: error?.code || null, message: error?.message || "检查失败" });
+      return null;
+    } finally {
+      inFlight.current = false;
+      setChecking(false);
+    }
+  }, []);
+  const apply2 = import_react2.default.useCallback(async () => {
+    setApplying(true);
+    setApplyError(null);
+    try {
+      const next = await applyPluginUpdate();
+      setStatus(next);
+      return next;
+    } catch (error) {
+      setApplyError({
+        code: error?.code || null,
+        message: error?.message || "更新失败",
+        detail: error?.detail || null
+      });
+      return null;
+    } finally {
+      setApplying(false);
+    }
+  }, []);
+  const loadRelease = import_react2.default.useCallback(async (version) => {
+    const target = String(version || "").trim();
+    if (!target) return null;
+    setRelease({ loading: true, data: null, version: target });
+    try {
+      const data = await fetchPluginRelease(target);
+      setRelease({ loading: false, data: data || null, version: target });
+      return data;
+    } catch {
+      setRelease({ loading: false, data: null, version: target });
+      return null;
+    }
+  }, []);
+  return { status, checking, applying, checkError, applyError, check, apply: apply2, release, loadRelease };
+}
 
 // client/views/header.js
 function installSpec(plugin) {
@@ -2275,6 +2404,8 @@ function Header({
   placement,
   placementBusy,
   readOnly,
+  pluginUpdate,
+  onCheckUpdate,
   onToggleSettings,
   onChangePlacement,
   onOpenAutoLink,
@@ -2282,9 +2413,18 @@ function Header({
   onAddSubscription
 }) {
   const spec = installSpec(plugin);
+  const updateAvailable = Boolean(pluginUpdate?.status?.updateAvailable);
   const headTools = h(
     "div",
     { className: "dshsc-tools" },
+    // 刷新按钮放在 GitHub 前面：点一下检查插件自身版本，有新版本时高亮提示
+    h("button", {
+      className: `dshsc-tool${updateAvailable ? " dshsc-tool-dot" : ""}`,
+      type: "button",
+      title: t("pluginUpdate.check"),
+      "aria-label": t("pluginUpdate.check"),
+      onClick: onCheckUpdate
+    }, h(RefreshIcon, { size: 15 })),
     // 先源码、后设置：GitHub 紧挨包名，齿轮留在工具组最外侧
     h("a", {
       className: "dshsc-tool",
@@ -2805,14 +2945,17 @@ function InstalledTab({
     const map = {
       current: ["status.current", "ok", true],
       "update-available": ["status.update", "warn"],
-      "locally-modified": ["status.local", "warn"],
-      conflict: ["status.conflict", "warn"],
+      "locally-modified": ["status.local", "warn", false, "status.localHint"],
+      conflict: ["status.conflict", "warn", false, "status.conflictHint"],
       "upstream-deleted": ["status.deleted", "warn"],
       "broken-link": ["status.broken", "err"],
       unmanaged: ["status.unmanaged", ""]
     };
-    const [key, cls, check] = map[row.status] || ["status.unknown", ""];
-    return h("span", { className: `dshsc-tag ${cls}` }, check ? `✓ ${t(key)}` : t(key));
+    const [key, cls, check, hint] = map[row.status] || ["status.unknown", ""];
+    return h("span", {
+      className: `dshsc-tag ${cls}`,
+      title: hint ? t(hint) : void 0
+    }, check ? `✓ ${t(key)}` : t(key));
   }
   function sourceLine(row) {
     if (!row.source) {
@@ -4281,6 +4424,10 @@ var STATUS_KEY = {
   "broken-link": "status.broken",
   unmanaged: "status.unmanaged"
 };
+var STATUS_HINT = {
+  "locally-modified": "status.localHint",
+  conflict: "status.conflictHint"
+};
 function TabButton({ id, label, count, active, onSelect }) {
   return h("button", {
     type: "button",
@@ -4474,7 +4621,10 @@ function SkillReader({
       "div",
       { className: "dshsc-reader-title" },
       h("h2", { id: "dshsc-reader-name", tabIndex: -1 }, name || t("viewer.title")),
-      row?.status && STATUS_KEY[row.status] ? h("span", { className: `dshsc-tag ${row.status === "current" ? "ok" : "warn"}` }, t(STATUS_KEY[row.status])) : null,
+      row?.status && STATUS_KEY[row.status] ? h("span", {
+        className: `dshsc-tag ${row.status === "current" ? "ok" : "warn"}`,
+        title: STATUS_HINT[row.status] ? t(STATUS_HINT[row.status]) : void 0
+      }, t(STATUS_KEY[row.status])) : null,
       row?.enabled === false ? h("span", { className: "dshsc-tag off" }, t("status.off")) : null,
       variant === "drawer" ? h("button", {
         type: "button",
@@ -4848,25 +4998,122 @@ function SkillReader({
   ), overlayHost());
 }
 
+// client/views/plugin-update-modal.js
+var import_react9 = __toESM(require("react"), 1);
+function PluginUpdateModal({ t, update, onClose, repoUrl }) {
+  const { status, checking, applying, checkError, applyError, check, apply: apply2, release, loadRelease } = update;
+  const [copied, setCopied] = import_react9.default.useState(false);
+  import_react9.default.useEffect(() => {
+    void check();
+  }, [check]);
+  const latest = status?.latestVersion || null;
+  const current = status?.currentVersion || "—";
+  const available = Boolean(status?.updateAvailable);
+  const canAuto = status?.canAutoUpdate !== false;
+  const manual = status?.manualCommand || "";
+  const restartRequired = status?.restartRequired === true;
+  const updatedVersion = status?.updatedVersion || null;
+  import_react9.default.useEffect(() => {
+    if (available && latest) void loadRelease(latest);
+  }, [available, latest, loadRelease]);
+  const releaseData = release?.version === latest ? release.data : null;
+  const releaseLoading = release?.version === latest && release.loading;
+  const releaseBody = typeof releaseData?.body === "string" ? releaseData.body.trim() : "";
+  const releaseUrl = releaseData?.htmlUrl || (repoUrl ? `${repoUrl}/releases` : null);
+  const copy = () => {
+    if (!manual || typeof navigator === "undefined" || !navigator.clipboard?.writeText) return;
+    Promise.resolve(navigator.clipboard.writeText(manual)).then(() => {
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1500);
+    }).catch(() => {
+    });
+  };
+  let stateLine;
+  if (checking && !status) stateLine = t("pluginUpdate.checking");
+  else if (checkError || status?.checkFailed) stateLine = t("pluginUpdate.checkFailed");
+  else if (restartRequired) stateLine = t("pluginUpdate.updated", { version: updatedVersion || latest });
+  else if (available) stateLine = t("pluginUpdate.available");
+  else if (status) stateLine = t("pluginUpdate.upToDate");
+  else stateLine = t("pluginUpdate.checking");
+  const stateTone = checkError || status?.checkFailed ? "err" : available ? "update" : "ok";
+  const footer = [
+    h("button", {
+      key: "check",
+      className: "dshsc-btn ghost",
+      disabled: checking || applying,
+      onClick: () => void check(true)
+    }, h(RefreshIcon, { size: 13 }), t("pluginUpdate.recheck"))
+  ];
+  if (available && canAuto) {
+    footer.push(h("button", {
+      key: "apply",
+      className: "dshsc-btn primary",
+      disabled: applying,
+      onClick: () => void apply2()
+    }, applying ? t("pluginUpdate.applying") : t("pluginUpdate.update", { version: latest })));
+  }
+  footer.push(h("button", { key: "close", className: "dshsc-btn ghost", onClick: onClose }, t("pluginUpdate.close")));
+  return h(
+    Overlay,
+    { t, title: t("pluginUpdate.title"), onCancel: onClose, footer },
+    h(
+      "dl",
+      { className: "dshsc-kv" },
+      h("dt", null, t("pluginUpdate.current")),
+      h("dd", null, h("span", { className: "dshsc-code" }, current)),
+      h("dt", null, t("pluginUpdate.latest")),
+      h("dd", null, h("span", { className: "dshsc-code" }, latest || "—"))
+    ),
+    h("p", { className: "dshsc-sub", "data-kind": stateTone, role: "status", style: stateTone === "err" ? { color: "var(--dsw-alias-state-error-primary)" } : null }, stateLine),
+    // 有新版本：展示该版本的发布说明（拉了 GitHub Release 正文就渲染，拉不到给外链）
+    available ? h(
+      "div",
+      { className: "dshsc-release" },
+      h("div", { className: "dshsc-release-head" }, t("pluginUpdate.whatsNew", { version: latest })),
+      releaseLoading ? h("p", { className: "dshsc-sub" }, t("pluginUpdate.releaseLoading")) : releaseBody ? h("div", { className: "dshsc-release-body" }, h(Markdown, { text: releaseBody })) : h(
+        "p",
+        { className: "dshsc-sub" },
+        releaseUrl ? h("a", { className: "dshsc-md-link", href: releaseUrl, target: "_blank", rel: "noopener noreferrer" }, t("pluginUpdate.viewReleaseNotes")) : t("pluginUpdate.releaseUnavailable")
+      )
+    ) : null,
+    applyError ? h("p", { className: "dshsc-sub", role: "alert", style: { color: "var(--dsw-alias-state-error-primary)" } }, applyError.message) : null,
+    restartRequired ? h("p", { className: "dshsc-sub" }, t("pluginUpdate.restartHint")) : null,
+    // 一键更新不可用（或本次安装失败后想手动兜底）：给命令 + 复制
+    !canAuto && manual ? h(
+      "div",
+      { className: "dshsc-field" },
+      h("span", null, t("pluginUpdate.manual")),
+      h(
+        "div",
+        { className: "dshsc-inline", style: { display: "flex", gap: 8, alignItems: "center" } },
+        h("code", { className: "dshsc-code", style: { flex: 1, wordBreak: "break-all" } }, manual),
+        h("button", { className: "dshsc-btn ghost", onClick: copy }, copied ? t("pluginUpdate.copied") : t("pluginUpdate.copy"))
+      )
+    ) : null
+  );
+}
+
 // client/section.js
 var UPDATABLE2 = /* @__PURE__ */ new Set(["update-available", "locally-modified", "conflict"]);
 function Section({ t, page = false, pickDirectory, onPlacementChange }) {
   const { data, error, busy, toast, setToast, setBusy, reload, run } = useSkillsData();
-  const [tab, setTab] = import_react9.default.useState("installed");
-  const [view, setView] = import_react9.default.useState("flat");
-  const [modal, setModal] = import_react9.default.useState(null);
-  const [expanded, setExpanded] = import_react9.default.useState({});
-  const [placementBusy, setPlacementBusy] = import_react9.default.useState(null);
-  const [placementOverride, setPlacementOverride] = import_react9.default.useState(null);
-  const [query, setQuery] = import_react9.default.useState("");
-  const [viewer, setViewer] = import_react9.default.useState(null);
-  const rootRef = import_react9.default.useRef(null);
-  const scrollPos = import_react9.default.useRef(null);
-  const restoreScroll = import_react9.default.useRef(null);
-  const [filter, setFilter] = import_react9.default.useState("all");
-  const [builtinOpen, setBuiltinOpen] = import_react9.default.useState(false);
+  const [tab, setTab] = import_react10.default.useState("installed");
+  const [view, setView] = import_react10.default.useState("flat");
+  const [modal, setModal] = import_react10.default.useState(null);
+  const [expanded, setExpanded] = import_react10.default.useState({});
+  const [placementBusy, setPlacementBusy] = import_react10.default.useState(null);
+  const [placementOverride, setPlacementOverride] = import_react10.default.useState(null);
+  const [query, setQuery] = import_react10.default.useState("");
+  const [viewer, setViewer] = import_react10.default.useState(null);
+  const rootRef = import_react10.default.useRef(null);
+  const scrollPos = import_react10.default.useRef(null);
+  const restoreScroll = import_react10.default.useRef(null);
+  const [filter, setFilter] = import_react10.default.useState("all");
+  const [builtinOpen, setBuiltinOpen] = import_react10.default.useState(false);
   const { settingsOpen, settingsRef, settingsPlacement, closeSettings, toggleSettings } = useSettingsPopover();
   const { agentTip, agentTipPos, agentTipRef, openAgentTip, closeAgentTip } = useAgentTip();
+  const pluginUpdate = usePluginUpdate();
+  const [updateOpen, setUpdateOpen] = import_react10.default.useState(false);
   const rows = data?.installs || [];
   const actions = useSkillActions({ t, rows, reload, run, setBusy, setToast, setModal });
   const writable = Boolean(data) && !data?.readOnly && data?.cli?.usable;
@@ -4887,7 +5134,7 @@ function Section({ t, page = false, pickDirectory, onPlacementChange }) {
     const agentLabels = row.exports.map((item) => item.label);
     return [row.name, row.source || "", ...agentLabels].join(" ").toLowerCase().includes(queryText);
   });
-  import_react9.default.useEffect(() => {
+  import_react10.default.useEffect(() => {
     if (!viewer || !data) return;
     if (rows.some((row) => row.name === viewer.name)) return;
     setViewer(null);
@@ -4921,7 +5168,7 @@ function Section({ t, page = false, pickDirectory, onPlacementChange }) {
     if (viewer?.mode === "page") restoreScroll.current = scrollPos.current;
     setViewer(null);
   }
-  import_react9.default.useLayoutEffect(() => {
+  import_react10.default.useLayoutEffect(() => {
     if (restoreScroll.current === null) return;
     const target = restoreScroll.current;
     restoreScroll.current = null;
@@ -4990,7 +5237,7 @@ function Section({ t, page = false, pickDirectory, onPlacementChange }) {
     onToast: (next) => setToast(next)
   }) : null;
   const listNode = h(
-    import_react9.default.Fragment,
+    import_react10.default.Fragment,
     null,
     h(Header, {
       t,
@@ -5006,6 +5253,8 @@ function Section({ t, page = false, pickDirectory, onPlacementChange }) {
       placement,
       placementBusy,
       readOnly: Boolean(data?.readOnly),
+      pluginUpdate,
+      onCheckUpdate: () => setUpdateOpen(true),
       onToggleSettings: toggleSettings,
       onChangePlacement: (next) => void changePlacement(next),
       onOpenAutoLink: () => setModal({ type: "autolink" }),
@@ -5075,7 +5324,8 @@ function Section({ t, page = false, pickDirectory, onPlacementChange }) {
       onClose: () => setModal(null),
       onSaveAutoLink: saveAutoLink
     }) : null,
-    agentTip ? h(AgentTip, { t, agentTip, agentTipPos, nodeRef: agentTipRef }) : null
+    agentTip ? h(AgentTip, { t, agentTip, agentTipPos, nodeRef: agentTipRef }) : null,
+    updateOpen ? h(PluginUpdateModal, { t, update: pluginUpdate, repoUrl: GITHUB_URL, onClose: () => setUpdateOpen(false) }) : null
   );
   return page ? h("div", { className: "dshsc-page" }, root) : root;
 }

package/lib/core/hash.js

@@ -22,8 +22,28 @@ function collectFiles(dir, out) {
 }
 
 /**
- * 逐字复刻 skills CLI 的内容哈希（F6）：
- * 只收普通文件 → 跳过 `.git` / `node_modules` → 相对路径 `/` 归一 → localeCompare 排序
+ * 排序口径：UTF-16 code unit 序（等价 `Array#sort()` 默认序），**与进程 locale 无关**。
+ *
+ * 绝不能用 `localeCompare`：它按默认 locale 的 collation 比较，同一个目录在不同
+ * LANG / ICU 版本下会排出不同顺序，同一份内容就能算出两个哈希。真实案例：
+ * `script.md` 与 `什么是token.html` 在 en 下 script 在前、在 zh 下汉字在前，
+ * 于是「安装时 en、读时 zh」的技能被误报成「本地已改」。
+ */
+export function comparePaths(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+/**
+ * 旧口径（v0.6.x 之前）：进程 / 显式 locale 的 collation。
+ * 只用于识别历史基线（`matchesLegacyHash`），不得用于写新基线。
+ */
+export function localeComparator(locale) {
+  return (a, b) => a.localeCompare(b, locale);
+}
+
+/**
+ * 目录内容哈希（F6）：
+ * 只收普通文件 → 跳过 `.git` / `node_modules` → 相对路径 `/` 归一 → code unit 排序
  * → 先 update(路径) 再 update(内容) → sha256。
  *
  * 用途只有一个：进 L1「本地有没有被改过」的基线，绝不与上游 tree SHA 混用。
@@ -36,12 +56,13 @@ export function contentHash(dir) {
  * 同 `contentHash`，但允许按相对路径改写文件内容后再参与哈希。
  * `transform(rel, buffer)` 返回 Buffer；返回 `null` 表示无法归一化（调用方保守处理）。
  * 用于「仅手动」：把插件写入的 frontmatter 行按 state 还原后再与基线比较。
+ * `compare` 只给历史基线识别用，正常路径保持默认的 locale 无关排序。
  */
-export function contentHashWith(dir, transform = null) {
+export function contentHashWith(dir, transform = null, compare = comparePaths) {
   const files = collectFiles(dir, []).map((file) =>
     path.relative(dir, file).split(path.sep).join('/'),
   );
-  files.sort((a, b) => a.localeCompare(b));
+  files.sort(compare);
   const hash = crypto.createHash('sha256');
   for (const rel of files) {
     const raw = fs.readFileSync(path.join(dir, rel));

package/lib/core/invocation.js

@@ -2,7 +2,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 
-import { contentHashWith } from './hash.js';
+import { contentHashWith, localeComparator } from './hash.js';
 
 /**
  * 「自动 / 仅手动 / 完全停用」的落盘层。
@@ -527,7 +527,11 @@ export function unparkSkill({ dir, name, fallbackMode = 'auto', keep = null }) {
   let hashMismatch = false;
   if (marker?.canonicalHash) {
     const current = contentHashWith(dir);
-    hashMismatch = current !== null && current !== marker.canonicalHash;
+    // 旧版 marker 里的哈希是按 locale collation 排出来的；换 locale 后同一份内容
+    // 也会对不上，先按旧口径复核一次，避免把「排序变了」报成「内容漂移」。
+    hashMismatch = current !== null
+      && current !== marker.canonicalHash
+      && !matchesLegacyHash(dir, null, marker.canonicalHash);
   }
   const previousMode = (marker?.previousMode === 'manual' || marker?.previousMode === 'auto')
     ? marker.previousMode
@@ -547,9 +551,11 @@ export function unparkSkill({ dir, name, fallbackMode = 'auto', keep = null }) {
  * 归一化哈希：把插件写入的 `disable-model-invocation: true` 按 state 还原后再算目录哈希。
  * 只有 origin='plugin' 才归一化；author 声明属于上游内容，必须原样计入。
  * 解析失败 / 当前值不是 true 时返回 null —— 调用方保守判为「本地有改动」。
+ *
+ * `compare` 仅供 `matchesLegacyHash` 复核旧口径使用；新基线一律用默认的 locale 无关排序。
  */
-export function hashWithoutInvocation(dir, manual) {
-  if (!manual || manual.origin !== 'plugin') return contentHashWith(dir);
+export function hashWithoutInvocation(dir, manual, compare) {
+  if (!manual || manual.origin !== 'plugin') return contentHashWith(dir, null, compare);
   const expected = manual.original;
   if (expected !== 'absent' && expected !== 'false') return null;
   return contentHashWith(dir, (relative, buffer) => {
@@ -565,7 +571,27 @@ export function hashWithoutInvocation(dir, manual) {
     if (expected === 'absent') lines.splice(parsed.keyIndex, 1);
     else lines[parsed.keyIndex] = renderLine(lines[parsed.keyIndex], 'false');
     return Buffer.from(join(parsed, lines), 'utf8');
-  });
+  }, compare);
+}
+
+/**
+ * 旧基线识别：v0.6.x 之前的内容哈希按进程 locale 的 collation 排序，同一份内容
+ * 换 locale / ICU 版本就会得到不同 digest。用几个最常见的 collation 反查，
+ * 命中即说明「内容没变、只是排序口径变了」，可以安全地把基线改写成新口径。
+ *
+ * 只是识别手段：某个旧口径能精确复现记录值，等价于内容逐字节相同。
+ */
+export function matchesLegacyHash(dir, manual, digest) {
+  if (typeof digest !== 'string' || !digest) return false;
+  const defaultLocale = new Intl.Collator().resolvedOptions().locale;
+  // 覆盖最常见的几类 collation：拉丁（en）、中文（zh）、日文（ja）。
+  // 都不命中就保守地维持「本地已改」，让用户确认 —— 绝不靠猜去改基线。
+  const locales = new Set([defaultLocale, 'en', 'zh', 'ja']);
+  for (const locale of locales) {
+    const compare = locale === defaultLocale ? undefined : localeComparator(locale);
+    if (hashWithoutInvocation(dir, manual, compare) === digest) return true;
+  }
+  return false;
 }
 
 /** 供 Host 层判断「这行到底是不是被 park 了」，不读 state。 */

package/lib/core/plugin-update.js

@@ -0,0 +1,323 @@
+/**
+ * 插件自更新：检查 npm 上的最新版本，并按需把**本插件自己**重装到最新版。
+ *
+ * 与 `updates.js` 的区别：那是「技能」的上游检测（走 GitHub Trees），这里是
+ * 「插件包自身」的版本检查（走 npm registry），两条链路互不相干。
+ *
+ * 为什么不用宿主 `pluginManager.inspect` 查最新版：`inspect` 对**已安装的包名**会直接
+ * 拒绝 `already-installed`（它只答「我马上要装的 spec 指向什么」，不是「查已装包的最新版」），
+ * 宿主 `listBundles` 也不为第三方插件解析最新版（`installTarget` 只给官方目录条目）。
+ * 所以最新版只能自己查 registry —— 但**走宿主 `pluginManager.registries()` 拿到的 registry
+ * 计划**（继承 profile 的镜像 / 私有源 / token 配置），拿不到才退回官方 registry。
+ *
+ * 设计取舍（对齐本机同类插件 archive-manager / ds-bot 的轻量做法，但更保守）：
+ * - 依次问 registry 计划里的 `<base><pkg>/latest`，8s 超时，只取 `version` 字段；失败不抛，返回 null。
+ * - 版本比较手写（本仓 runtime 依赖只有 tar，不引入 semver）；结构非法一律判「不更新」。
+ * - 安装只走宿主 `pluginManager.installBundle`（桌面端官方能力）；拿不到就抛
+ *   `error.plugin-update.manual`，把手动命令放进 detail 让前端展示/复制。
+ * - 不落盘、不加锁：一次点击只触发一次，`applying` 由路由层单飞守住；重启由用户决定。
+ */
+import { readFileSync } from 'node:fs';
+
+import { ServiceError } from './service.js';
+
+export const OFFICIAL_REGISTRY = 'https://registry.npmjs.org/';
+const FETCH_TIMEOUT_MS = 8000;
+const CACHE_TTL_MS = 5 * 60 * 1000;
+const RELEASE_CACHE_TTL_MS = 10 * 60 * 1000;
+
+/** 插件身份：包名与当前版本。从 package.json 读一次，避免和 page 头硬编码漂移。 */
+export const PLUGIN_META = (() => {
+  try {
+    const pkg = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+    const repo = typeof pkg.repository === 'string' ? pkg.repository : pkg.repository?.url;
+    const match = /github\.com[/:]([\w.-]+\/[\w.-]+?)(?:\.git)?$/i.exec(String(repo || ''));
+    return {
+      name: String(pkg.name || ''),
+      version: String(pkg.version || ''),
+      repo: match ? match[1] : null,
+    };
+  } catch {
+    return { name: '', version: '', repo: null };
+  }
+})();
+
+/** 解析 semver：`v1.2.3` / `1.2.3-beta.1` / `1.2.3+build`。非法返回 undefined。 */
+function parseSemver(value) {
+  const text = String(value ?? '').trim();
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(text);
+  if (match === null) return undefined;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4] ? match[4].split('.') : [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) {
+    return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const an = BigInt(a);
+      const bn = BigInt(b);
+      if (an !== bn) return an > bn ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+
+/** `candidate` 是否严格新于 `current`。任一方不是合法 semver 都判 false（宁可不更新）。 */
+export function isNewerVersion(current, candidate) {
+  const a = parseSemver(current);
+  const b = parseSemver(candidate);
+  if (a === undefined || b === undefined) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (b.core[index] !== a.core[index]) return b.core[index] > a.core[index];
+  }
+  return comparePrerelease(b.prerelease, a.prerelease) > 0;
+}
+
+/** npm 包名转成 registry 路径：`@scope/name` → `@scope%2Fname`。 */
+function encodePackageName(name) {
+  return name.startsWith('@') ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
+}
+
+/** 手动更新命令（前端展示/复制用），按已发布包 + 当前 profile 拼。 */
+function manualCommand(meta, profileName) {
+  const spec = `${meta.name}@latest`;
+  return profileName
+    ? `dsh plugin --profile ${profileName} add ${spec}`
+    : `dsh plugin add ${spec}`;
+}
+
+/** registry 归一成 `https://host/` 形式；非法返回 null。 */
+function normalizeRegistry(value) {
+  if (typeof value !== 'string' || value.trim() === '') return null;
+  const text = value.trim().replace(/\/+$/, '');
+  try {
+    const url = new URL(`${text}/`);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 由宿主 `registries()` 结果拼出要问的 registry 顺序：
+ * `resolved`（pnpm 实际用的）→ `registry` → `fallbackRegistries`，去重；空则回退官方 registry。
+ */
+function registryPlan(registries) {
+  const ordered = [];
+  const push = (value) => {
+    const normalized = normalizeRegistry(value);
+    if (normalized && !ordered.includes(normalized)) ordered.push(normalized);
+  };
+  if (registries && typeof registries === 'object') {
+    push(registries.resolved);
+    push(registries.registry);
+    for (const item of Array.isArray(registries.fallbackRegistries) ? registries.fallbackRegistries : []) push(item);
+  }
+  if (ordered.length === 0) ordered.push(OFFICIAL_REGISTRY);
+  return ordered;
+}
+
+/**
+ * @param {object} deps
+ * @param {() => any} deps.getPluginManager  取宿主 `pluginManager`（可能 undefined）
+ * @param {() => string | null} [deps.getProfileName]  取当前 profile 名（仅用于手动命令）
+ * @param {typeof fetch} [deps.fetchImpl]  测试注入
+ * @param {() => number} [deps.now]  测试注入
+ */
+export function createPluginUpdate({ getPluginManager, getProfileName, fetchImpl = globalThis.fetch, now = Date.now, meta = PLUGIN_META } = {}) {
+  let cache = null; // { version, expiresAt }
+  let applying = false; // 路由层单飞：同一时刻只允许一次安装
+
+  /**
+   * 依次问 registry 计划里的 `<base><pkg>/latest`；第一个给出合法版本的为准。
+   * 全部失败返回 null（不抛，交给视图标 checkFailed）。
+   */
+  async function latestVersion() {
+    if (!meta.name) return null;
+    if (cache && now() < cache.expiresAt) return cache.version;
+    const plan = registryPlan(await readRegistries());
+    for (const base of plan) {
+      try {
+        const response = await fetchImpl(`${base}${encodePackageName(meta.name)}/latest`, {
+          headers: { accept: 'application/json' },
+          redirect: 'error',
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok) continue;
+        const value = await response.json();
+        const version = typeof value?.version === 'string' ? value.version.trim() : '';
+        if (parseSemver(version) === undefined) continue;
+        cache = { version, expiresAt: now() + CACHE_TTL_MS, registry: base };
+        return version;
+      } catch {
+        // 这个 registry 不通 / 超时：试下一个
+      }
+    }
+    return null;
+  }
+
+  /** 从宿主 `pluginManager.registries()` 取 registry 配置；拿不到返回 null（走官方 registry）。 */
+  async function readRegistries() {
+    const service = rawService();
+    if (service === null || typeof service.registries !== 'function') return null;
+    try {
+      return await service.registries();
+    } catch {
+      return null;
+    }
+  }
+
+  /** 宿主的 `pluginManager` 服务（任意能力）；拿不到返回 null。 */
+  function rawService() {
+    try {
+      const value = typeof getPluginManager === 'function' ? getPluginManager() : undefined;
+      return value && typeof value === 'object' ? value : null;
+    } catch {
+      return null;
+    }
+  }
+
+  /** 能做安装的 `pluginManager`（需 `installBundle`）；拿不到返回 null。 */
+  function manager() {
+    const service = rawService();
+    return service && typeof service.installBundle === 'function' ? service : null;
+  }
+
+  function profileName() {
+    try {
+      const value = typeof getProfileName === 'function' ? getProfileName() : null;
+      return typeof value === 'string' && value ? value : null;
+    } catch {
+      return null;
+    }
+  }
+
+  /** 组一份给前端的视图；`canAutoUpdate=false` 时前端只展示手动命令。 */
+  function view({ latest, checkFailed = false } = {}) {
+    const current = meta.version;
+    const updateAvailable = latest !== null && latest !== undefined && isNewerVersion(current, latest);
+    return {
+      packageName: meta.name,
+      currentVersion: current,
+      latestVersion: latest ?? null,
+      updateAvailable,
+      checkFailed,
+      canAutoUpdate: manager() !== null,
+      manualCommand: manualCommand(meta, profileName()),
+      applying,
+    };
+  }
+
+  /** GET：读最新版本并返回视图。网络失败不抛，用 checkFailed 标记。 */
+  async function check({ fresh = false } = {}) {
+    if (fresh) cache = null;
+    const latest = await latestVersion();
+    return view({ latest, checkFailed: latest === null });
+  }
+
+  /**
+   * POST：把本插件重装到最新版。
+   * - 先再查一次，确认确实落后，避免拿过期信息装一个「已是最新」；
+   * - 没有 pluginManager → 抛 manual，带手动命令；
+   * - 安装中重复点击 → 抛 busy。
+   */
+  async function apply() {
+    if (applying) {
+      throw new ServiceError('error.plugin-update.busy', '插件正在更新，请稍候', null, 409);
+    }
+    const latest = await latestVersion();
+    if (latest === null) {
+      throw new ServiceError('error.plugin-update.check-failed', '暂时无法获取最新版本，请稍后再试', manualCommand(meta, profileName()), 503);
+    }
+    if (!isNewerVersion(meta.version, latest)) {
+      return { ...view({ latest }), updatedVersion: null };
+    }
+    const pm = manager();
+    if (pm === null) {
+      throw new ServiceError(
+        'error.plugin-update.manual',
+        '当前环境不支持自动更新，请手动执行命令',
+        manualCommand(meta, profileName()),
+        409,
+      );
+    }
+    applying = true;
+    try {
+      // 用查到最新版的那个 registry 去装，和「问」保持一致；没有就用宿主默认（不传 options）
+      const registry = cache?.version === latest ? cache.registry : undefined;
+      const result = await pm.installBundle(
+        `${meta.name}@${latest}`,
+        registry ? { registry } : undefined,
+      );
+      if (result?.error || !['applied', 'restart-required', 'overridden'].includes(result?.application)) {
+        const message = result?.error?.diagnostic || result?.error?.message || result?.error?.code || '更新失败';
+        throw new ServiceError('error.plugin-update.install-failed', String(message).slice(0, 600), manualCommand(meta, profileName()), 500);
+      }
+      cache = { version: latest, expiresAt: now() + CACHE_TTL_MS, registry };
+      return {
+        ...view({ latest }),
+        updateAvailable: false,
+        updatedVersion: latest,
+        restartRequired: true,
+      };
+    } finally {
+      applying = false;
+    }
+  }
+
+  // GitHub Release 正文缓存：key = version
+  const releaseCache = new Map();
+
+  /**
+   * 拉某个版本的 GitHub Release 正文（发布说明）。
+   * - tag 用 `vX.Y.Z`（本仓发布约定），请求 `api.github.com/repos/<repo>/releases/tags/vX`;
+   * - 失败（无 repo / 网络 / 404 / 超时）返回 null，不抛；前端据此退回「查看发布说明」链接；
+   * - 只读 GitHub 公开 API，不读本机任何文件。
+   */
+  async function releaseNotes(version) {
+    const target = String(version || '').trim();
+    if (!meta.repo || parseSemver(target) === undefined) return null;
+    const cached = releaseCache.get(target);
+    if (cached && now() < cached.expiresAt) return cached.value;
+    const tag = `v${target.replace(/^v/, '')}`;
+    try {
+      const response = await fetchImpl(`https://api.github.com/repos/${meta.repo}/releases/tags/${tag}`, {
+        headers: { accept: 'application/vnd.github+json' },
+        redirect: 'error',
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      });
+      const value = response.ok
+        ? await response.json().then((release) => ({
+            version: target,
+            body: typeof release?.body === 'string' ? release.body : '',
+            htmlUrl: typeof release?.html_url === 'string' ? release.html_url : null,
+            name: typeof release?.name === 'string' ? release.name : null,
+          }))
+        : null;
+      releaseCache.set(target, { value, expiresAt: now() + RELEASE_CACHE_TTL_MS });
+      return value;
+    } catch {
+      // 失败也短缓存，避免连点重复打网络；10 分钟后自然重试
+      releaseCache.set(target, { value: null, expiresAt: now() + RELEASE_CACHE_TTL_MS });
+      return null;
+    }
+  }
+
+  return { check, apply, releaseNotes };
+}

package/lib/core/service.js

@@ -18,6 +18,7 @@ import {
   backupInvocation,
   hashWithoutInvocation,
   inspectPark,
+  matchesLegacyHash,
   parkSkill,
   parseInvocation,
   planManualRestore,
@@ -906,6 +907,65 @@ export function createService({
     return records;
   }
 
+  /**
+   * 一次性重基线：v0.6.x 之前的内容哈希按进程 locale 的 collation 排序，换启动环境
+   * （或 Node / ICU 版本）后同一份内容会算出不同 digest，被误报成「本地已改」。
+   *
+   * 只改写**能证明没被改过**的基线：新口径对不上，但某个旧 collation 能精确复现
+   * 记录值。内容真的动过的技能一条都不碰 —— 继续按「本地已改」让用户确认覆盖。
+   * 停用（parked）期间的技能也跳过：那时 SKILL.md 已改名、目录里多了 marker，
+   * 基线由 unpark 重放。
+   */
+  function rebaselineHashes() {
+    const rebaselined = [];
+    const unresolved = [];
+    if (store.readOnly) return { rebaselined, unresolved, skipped: 'read-only' };
+    for (const install of state().installs) {
+      if (typeof install.installedHash !== 'string' || !install.installedHash) continue;
+      const dir = canonicalDir(install.name);
+      let stat;
+      try {
+        stat = fs.statSync(dir);
+      } catch {
+        continue;
+      }
+      if (!stat.isDirectory()) continue;
+      if (inspectPark(dir).parked) continue;
+      const current = hashWithoutInvocation(dir, install.manual);
+      if (!current || current === install.installedHash) continue;
+      if (matchesLegacyHash(dir, install.manual, install.installedHash)) {
+        rebaselined.push({ name: install.name, from: install.installedHash, to: current });
+      } else {
+        unresolved.push(install.name);
+      }
+    }
+    if (rebaselined.length > 0) {
+      const next = new Map(rebaselined.map((item) => [item.name, item.to]));
+      store.update((draft) => {
+        for (const row of draft.installs) {
+          if (next.has(row.name)) row.installedHash = next.get(row.name);
+        }
+      });
+      logger('state.hash-order.rebaseline', {
+        names: rebaselined.map((item) => item.name),
+        count: rebaselined.length,
+      });
+    }
+    return { rebaselined, unresolved };
+  }
+
+  // 每个进程只跑一次：写盘后新基线自洽，不必（也不该）每次请求都试旧口径。
+  let hashBaselineChecked = false;
+  function ensureHashBaseline() {
+    if (hashBaselineChecked || store.readOnly || enqueue.pending() > 0) return;
+    hashBaselineChecked = true;
+    try {
+      rebaselineHashes();
+    } catch (error) {
+      logger('state.hash-order.rebaseline.failed', { message: error?.message || String(error) });
+    }
+  }
+
   function canonicalDir(name) {
     return path.join(paths.canonical, name);
   }
@@ -1119,6 +1179,8 @@ export function createService({
           logger('state.migrate.failed', { message: error.message });
         }
       }
+      // 旧版内容哈希按 locale 排序，升级后先做一次性重基线，别把「排序变了」显示成「本地已改」
+      ensureHashBaseline();
       return store.state;
     },
 
@@ -1138,6 +1200,9 @@ export function createService({
       return reconcileInvocations();
     },
 
+    /** 诊断/测试用：手动跑一次旧哈希口径的重基线（启动时已自动跑过一次）。 */
+    rebaselineHashes,
+
     async getState({ cwd, workspace } = {}) {
       const lock = readLock(paths);
       reconcileTracking(lock);

package/lib/index.js

@@ -6,6 +6,7 @@ import { createPolicyProvider, installPolicyProviders } from './core/policy.js';
 import { createService } from './core/service.js';
 import { normalizeIntroConfig } from './core/intro.js';
 import { createIntroStore } from './core/intro-store.js';
+import { createPluginUpdate } from './core/plugin-update.js';
 import { StateStore } from './core/state.js';
 import { createRoutes, ROUTE_PREFIX } from './routes.js';
 
@@ -113,7 +114,19 @@ export function apply(ctx, config = {}) {
     logger('plugin.migrate.failed', { message: error?.message, code: error?.code });
   }
 
-  const handler = createRoutes({ service, logger });
+  /**
+   * 插件自更新：检查 npm 最新版 / 一键重装自身。
+   * `pluginManager` 是桌面端官方能力（installBundle），按可选服务取；拿不到时路由只报手动命令。
+   */
+  const pluginUpdate = createPluginUpdate({
+    getPluginManager: () => ctx.get('pluginManager'),
+    getProfileName: () => {
+      const profile = ctx.get('profileContext');
+      return typeof profile?.name === 'string' ? profile.name : null;
+    },
+  });
+
+  const handler = createRoutes({ service, pluginUpdate, logger });
   ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: ROUTE_PREFIX, handler }), 'dsh-skills-console:routes');
   ctx.effect(() => () => policies.dispose(), 'dsh-skills-console:policy');
 
@@ -137,5 +150,20 @@ export function apply(ctx, config = {}) {
     logger('plugin.autoCheck.off', { reason: 'timer-service-missing' });
   }
 
+  // 插件自身的版本检查：启动后延迟一次（有 timer 用它，没有就 setTimeout），只热身缓存不打扰用户。
+  // 失败静默——真正的展示交给前端打开刷新按钮/弹窗时再查。
+  const warmPluginUpdate = () => {
+    void pluginUpdate.check().catch((error) => logger('plugin.update.warm.failed', { message: error?.message }));
+  };
+  if (timer && typeof timer.timeout === 'function') {
+    ctx.effect(() => timer.timeout(warmPluginUpdate, 20 * 1000), 'dsh-skills-console:plugin-update-warm');
+  } else {
+    ctx.effect(() => {
+      const handle = setTimeout(warmPluginUpdate, 20 * 1000);
+      handle.unref?.();
+      return () => clearTimeout(handle);
+    }, 'dsh-skills-console:plugin-update-warm');
+  }
+
   logger('plugin.apply', { stateDir: paths.stateDir, canonical: paths.canonical, readOnly: store.readOnly });
 }

package/lib/routes.js

@@ -118,10 +118,20 @@ function matchRoute(method, pathname) {
     if (segments.length === 2 && segments[1] === 'rollback' && method === 'POST') return { name: 'updates.rollback' };
   }
 
+  // 插件自身版本检查 / 更新（与技能上游 updates.* 是两回事，见 core/plugin-update.js）
+  if (segments.length === 1 && segments[0] === 'plugin-update' && method === 'GET') return { name: 'plugin.update.check' };
+  if (segments.length === 2 && segments[0] === 'plugin-update' && segments[1] === 'apply' && method === 'POST') {
+    return { name: 'plugin.update.apply' };
+  }
+  // 拉某版本的发布说明（GitHub Release 正文）：GET /plugin-update/release?version=x.y.z
+  if (segments.length === 2 && segments[0] === 'plugin-update' && segments[1] === 'release' && method === 'GET') {
+    return { name: 'plugin.update.release' };
+  }
+
   return null;
 }
 
-export function createRoutes({ service, logger }) {
+export function createRoutes({ service, pluginUpdate = null, logger }) {
   return async function handler(req, res) {
     const url = new URL(req.url || '/', 'http://127.0.0.1');
     const pathname = url.pathname.startsWith(ROUTE_PREFIX)
@@ -153,7 +163,7 @@ export function createRoutes({ service, logger }) {
       service.reloadState();
       const body = method === 'GET' ? {} : await readBody(req);
       const query = Object.fromEntries(url.searchParams.entries());
-      const result = await dispatch(route, { body, query, service, signal: abort.signal });
+      const result = await dispatch(route, { body, query, service, pluginUpdate, signal: abort.signal });
       // 生成期间客户端可能已经走了：往已关闭的响应写会抛 ERR_STREAM_WRITE_AFTER_END
       if (res.writableEnded || res.destroyed) return;
       sendJson(res, 200, result);
@@ -181,7 +191,7 @@ export function createRoutes({ service, logger }) {
   };
 }
 
-async function dispatch(route, { body, query, service, signal = null }) {
+async function dispatch(route, { body, query, service, pluginUpdate = null, signal = null }) {
   switch (route.name) {
     case 'state': {
       const state = await service.getState({ cwd: query.cwd || body.cwd, workspace: query.workspace });
@@ -257,6 +267,19 @@ async function dispatch(route, { body, query, service, signal = null }) {
       return service.applyUpdate({ name: body.name, token: body.token, overwrite: Boolean(body.overwrite) });
     case 'updates.rollback':
       return service.rollback({ name: body.name });
+    case 'plugin.update.check': {
+      if (!pluginUpdate) throw new ServiceError('error.plugin-update.unavailable', '插件自更新不可用');
+      return pluginUpdate.check({ fresh: query.fresh === '1' || body.fresh === true });
+    }
+    case 'plugin.update.apply': {
+      if (!pluginUpdate) throw new ServiceError('error.plugin-update.unavailable', '插件自更新不可用');
+      return pluginUpdate.apply();
+    }
+    case 'plugin.update.release': {
+      if (!pluginUpdate) throw new ServiceError('error.plugin-update.unavailable', '插件自更新不可用');
+      const version = query.version || body.version;
+      return pluginUpdate.releaseNotes(version);
+    }
     default:
       throw new ServiceError('error.skills.no-route', `unhandled route ${route.name}`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-skills-console",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "统一管理本地技能的安装、更新、删除与接入，让同一份技能在多个 Agent 间复用。A skill manager for DeepSeek Harness: install, update, remove, link and toggle agent skills.",
   "license": "MIT",
   "author": "morehao <morehao@qq.com>",