@morehao/dsh-skills-console 0.5.4 → 0.5.6

package/README.en.md

@@ -24,7 +24,7 @@ It gathers the skills on your machine into one list: what you have, where it cam
 | --- | --- |
 | Inventory | Collects the skills on this machine — source, version, visibility and shared agents in one view; skills already in the shared directory are adopted automatically the first time you open it |
 | Install | Enter `owner/repo` or a GitHub URL; first detects which skills the repo has and what each does; install everything or pick a few |
-| Update | Checks upstream commits, lists the commit range and affected skills, updates in one click after you confirm; locally modified skills ask for confirmation first |
+| Update | Checks upstream commits, lists the commit range and affected skills, updates in one click after you confirm; skills with local edits ask for confirmation first |
 | Remove | Pre-flight check (never touches what others created), then a snapshot into the trash (kept 7 days) |
 | Toggle | One-click on/off; once disabled, neither DSH's model invocations nor `/` manual invocations see it; other agents and files on disk are unaffected |
 | Share | Links only agents that read their own directory; nothing is shared by default; agents that read the shared directory directly are not listed |
@@ -61,7 +61,7 @@ Screenshots are from a real DSH Web session on v0.5.2 (dark theme). All assets l
 
 - **Two entry points**: by default it lives in the "Skills Console" section of DSH settings; turn on "Sidebar entry" in the header ⚙ and a standalone panel appears in the left sidebar, effective immediately.
 - **One page, two tabs**: Installed / Subscriptions. The header holds "Auto-share on install" and "Add skill / Add subscription" on the right.
-- **Five actions per row**: toggle, view, update, share settings, delete; the ✨ next to a skill name opens the AI intro; "View" is hidden on narrow panels, and the skill name itself remains the entry point. Status labels cover up to date / update available / locally modified / removed upstream / broken link / no upstream.
+- **Five actions per row**: toggle, view, update, share settings, delete; the ✨ next to a skill name opens the AI intro; "View" is hidden on narrow panels, and the skill name itself remains the entry point. Status labels cover up to date / update available / changed since install / removed upstream / broken link / no upstream.
 - **No layout jumps on narrow panels**: the action group wraps naturally with panel width and the plugin name always stays whole; the list switches to two columns by width; scrolling happens only in the list area, so switching tabs or resizing never flips the whole page.
 - **Many agents don't crowd**: at most 3 are shown per row and the rest fold into `+n`; hover or focus reveals all.
 - **Findable**: search by name / source / agent, filter by "updates / not checked / disabled", view flat or grouped by agent.
@@ -73,7 +73,7 @@ While managing skills you may want to know "what does this skill say, and is it
 
 - **Drawer quick look**: the list stays put and a read-only drawer slides in from the right; close it with Esc / the overlay / ×, and you return to the previous filter and scroll position.
 - **Full page for a deep read**: "Open as page" at the bottom of the drawer switches to a full page (body + contents on the left), with a top bar to go back to the list.
-- **Three tabs**: Content (rendered / raw toggle; raw keeps the frontmatter), Files (directory tree + single-file preview; `.md` renders by default and can switch to raw, other text shows its source directly), Info (source, ref, commit, skillPath, content hash, install / update time, shared agents, enabled state, local changes).
+- **Three tabs**: Content (rendered / raw toggle; raw keeps the frontmatter), Files (directory tree + single-file preview; `.md` renders by default and can switch to raw, other text shows its source directly), Info (source, ref, commit, skillPath, content hash, install / update time, shared agents, enabled state, changes since install).
 - **Read-only**: no inputs and no save button. Update / share settings are enabled depending on writability; when the state file is corrupt you can still view, but management actions are disabled.
 - **What can be previewed**: text files that decode as UTF-8 (`.md` / `.html` / `.jsx` / `.css` / `.sh` / extension-less scripts…) show their source directly; the per-file cap is 256 KB (longer content is truncated with a notice); images, audio/video, archives and other binaries show "Preview not supported" with the file name / size.
 
@@ -89,6 +89,16 @@ Some skills only have an English description, and some titles alone don't tell y
 - **Subscription candidates too**: expanded subscriptions have `✨ Intro` on each entry; it fetches the remote `SKILL.md` at the snapshot `commit` and generates from that, with the commit in the cache key, and it never blocks "Install". Expanding also shows the author's own frontmatter description for free.
 - **How to turn it off**: `config.intro.enabled = false` (hides the ✨ entry). Other knobs are under "Data and configuration".
 
+## Check and update the plugin itself
+
+The **refresh button** next to the identity capsule in the page header checks whether *Skills Console itself* has a new release. This is a different axis from skill updates — it checks this plugin's own npm releases:
+
+- **How it checks**: follows the registry plan from the host's `pluginManager.registries()` (inheriting the profile's mirror / private source / token config) and asks `<registry>/<package>/latest` in turn (8s timeout, version only; falls back to the official `registry.npmjs.org` only if none answer), then compares with the installed version; the host caches for 5 minutes so repeated opens don't hit the network. About 20 seconds after startup it warms the cache once, silently.
+- **One-click update**: when the desktop host exposes `pluginManager`, clicking "Update to x.y.z" reinstalls this plugin to the latest version (installed from the registry that reported it); **restart DSH to apply** (no auto-reload).
+- **Manual fallback**: if one-click update is unavailable, the dialog shows a copyable command (`dsh plugin --profile <profile> add <package>@latest`).
+- **When a new version exists**: a small dot lights up on the refresh button; open it to see current / latest version and the update button, plus the release's **GitHub Release notes** body pulled for that version (if unavailable, a "view release notes on GitHub" link instead).
+- **Boundaries**: it only queries registries and only (re)installs this plugin itself, touching no other plugin's state directory; failures degrade silently to "could not reach the registry" and never affect any skill-management feature.
+
 ## Installation
 
 The plugin ships its own download and extraction code: **no Node / npm / npx / git required beforehand**; the first install needs network access to fetch dependencies.
@@ -113,7 +123,7 @@ The panel shows up in DSH Web's settings page / sidebar.
 
 1. **Add skill**: click "Add skill" in the top right, enter `owner/repo` or a GitHub URL, then click "Detect"; when the repo has several skills, tick the ones to install (multi-select, all selected by default, each with its description), and a single skill is selected automatically. If nothing is detected you can type skill names by hand; leaving them empty installs everything in the repo.
 2. **Share with other agents**: only needed for agents that read their own directory (for example Claude Code). Click "Share settings" on a row and tick the target agents; agents that already read the shared directory are not listed. To choose which agents new installs are shared with by default, use "Auto-share on install" in the header (nothing is ticked by default).
-3. **Check for updates**: manual checks and the background auto-check are **complementary** paths sharing the same verdict — both land in the installed view's update status. Click the refresh icon in the list header to check now, light up "Update", or "Update all"; the background also runs a check every 6 hours (reusing DSH's timer service, which is silently skipped when unavailable — manual checks are unaffected), so the panel is usually already current when you open it. Locally modified skills ask for confirmation before updating.
+3. **Check for updates**: manual checks and the background auto-check are **complementary** paths sharing the same verdict — both land in the installed view's update status. Click the refresh icon in the list header to check now, light up "Update", or "Update all"; the background also runs a check every 6 hours (reusing DSH's timer service, which is silently skipped when unavailable — manual checks are unaffected), so the panel is usually already current when you open it. Skills with local edits ask for confirmation before updating.
 4. **Invocation policy**: click the "Auto / Manual only / Fully disabled" status button on a row and switch in the centered invocation-policy dialog. Auto = both the model and `/` can invoke it; Manual only = only the `disable-model-invocation` frontmatter key in `SKILL.md` changes and `/` still works; Fully disabled = `SKILL.md` is renamed to `SKILL.md.disabled` with a marker left behind, and restoring returns to the mode from before. When the author already declared manual-only in `SKILL.md`, the chip is read-only and is never overridden. While parked, install and update are rejected so the file cannot be silently written back.
 
 ## Safety and reliability
@@ -147,8 +157,10 @@ AI intro settings (in the plugin `config` of the profile / `cordis.patch.yml`):
 | `intro.enabled` | `true` | `false` hides the ✨ entry and the API returns 501 |
 | `intro.provider` / `intro.model` | empty | empty uses DSH's current default model; both must be set together |
 | `intro.maxInputBytes` | `24576` | cap on the `SKILL.md` sent to the model (8–48 KB); longer input is truncated and marked in the prompt |
-| `intro.maxOutputTokens` | `300` | output cap (96–1024) |
-| `intro.timeoutMs` | `30000` | per-generation timeout (5–60 s); timeouts return 504 |
+| `intro.maxOutputTokens` | `4096` | output ceiling (96–8192). This is a runaway guard, not a length target; reasoning tokens count toward it, and the effective floor is raised per model |
+| `intro.timeoutMs` | `60000` | per-generation timeout (5–60 s); timeouts return 504 |
+
+The intro length is controlled by the 160-character prompt target. Do not treat `maxOutputTokens` as a length target; lowering it does not save cost, it only leaves a reasoning model no room for visible text.
 
 ## Development and publishing
 

package/README.md

@@ -61,7 +61,7 @@ DSH（DeepSeek Harness）的技能控制台：**安装、更新、删除、启
 
 - **两个入口**：默认在 DSH 设置页的「技能控制台」分区；页头 ⚙ 里打开「侧边栏入口」，左侧栏就会出现独立面板，切换立即生效。
 - **一页两 tab**：已安装 / 订阅。页头右侧是「新安装时自动共享」与「添加技能 / 添加订阅」。
-- **每行五个动作**：开关（启停）、查看、更新、共享设置、删除；技能名旁的 ✨ 打开 AI 简介；窄面板下隐藏「查看」，技能名本身仍是入口。状态标签覆盖最新 / 可更新 / 本地已改 / 上游已移除 / 软链断裂 / 无上游等。
+- **每行五个动作**：开关（启停）、查看、更新、共享设置、删除；技能名旁的 ✨ 打开 AI 简介；窄面板下隐藏「查看」，技能名本身仍是入口。状态标签覆盖最新 / 可更新 / 安装后有改动 / 上游已移除 / 软链断裂 / 无上游等。
 - **窄面板不跳版**：动作组按面板宽度自然换行，插件名始终完整；列表按宽度切两列；滚动只发生在列表区，切 tab、调整窗口都不会让整页翻面。
 - **Agent 多了不挤**：每行最多展示 3 个，其余折成 `+n`，悬浮或聚焦即可看全。
 - **找得到**：支持按名称 / 来源 / Agent 搜索，按「可更新 / 待检查 / 已停用」筛选，平铺或按 Agent 分组。
@@ -73,7 +73,7 @@ DSH（DeepSeek Harness）的技能控制台：**安装、更新、删除、启
 
 - **抽屉速览**：列表不动，右侧滑出只读抽屉；Esc / 点遮罩 / × 关闭，关闭后回到原来的筛选与滚动位置。
 - **整页深读**：抽屉底部「在整页打开」切到整页阅读（正文 + 左侧目录），顶部返回条回列表。
-- **三个 tab**：正文（渲染 / 原文切换，原文保留 frontmatter）、文件（目录树 + 单文件预览；`.md` 默认渲染、可切原文，其他文本直接出源码）、信息（来源、ref、commit、skillPath、内容哈希、安装 / 更新时间、共享至哪些 Agent、启停、本地改动）。
+- **三个 tab**：正文（渲染 / 原文切换，原文保留 frontmatter）、文件（目录树 + 单文件预览；`.md` 默认渲染、可切原文，其他文本直接出源码）、信息（来源、ref、commit、skillPath、内容哈希、安装 / 更新时间、共享至哪些 Agent、启停、安装后改动）。
 - **只读**：没有输入框和保存按钮。更新 / 共享设置按可写状态决定是否可用；状态文件损坏时仍可查看，管理动作禁用。
 - **能预览什么**：能按 UTF-8 解码的文本文件（`.md` / `.html` / `.jsx` / `.css` / `.sh` / 无扩展名脚本…）直接显示源码；单文件上限 256 KB（超出截断并提示）；图片、音视频、压缩包等二进制显示「暂不支持预览」和文件名 / 大小。
 
@@ -89,6 +89,16 @@ DSH（DeepSeek Harness）的技能控制台：**安装、更新、删除、启
 - **订阅候选也能看**：展开订阅后，条目行同样有 `✨ 简介`；按快照 `commit` 拉远端 `SKILL.md` 再生成，缓存 key 带 commit，不挡「安装」。展开时还会显示作者自己的 frontmatter 描述，不花额度。
 - **关闭方式**：`config.intro.enabled = false`（界面隐藏 ✨ 入口）。其他可调项见「数据与配置」。
 
+## 检查与更新插件自身
+
+页头身份胶囊旁的**刷新按钮**用来检查「技能控制台」这个插件自己有没有新版本，而管的是另一个维度——它不是检查技能的上游，而是检查本插件在 npm 上的发布：
+
+- **怎么查**：按宿主 `pluginManager.registries()` 给的 registry 计划（继承 profile 的镜像 / 私有源 / token 配置）依次问 `<registry>/<包名>/latest`（8 秒超时，只取版本号，取不到才回退官方 `registry.npmjs.org`），与本机安装的版本比较；Host 端 5 分钟缓存，连续打开不重复打网络。启动后约 20 秒会静默热身一次，不打扰你。
+- **一键更新**：桌面端有 `pluginManager` 服务时，弹窗里点「更新到 x.y.z」即可把本插件重装到最新版（装到查到最新版的那个 registry）；更新成功后**重启 DSH 生效**（不自动刷新）。
+- **手动兜底**：环境不支持一键更新时，弹窗给出可复制的手动命令（`dsh plugin --profile <profile> add <包名>@latest`）。
+- **有新版本时**：刷新按钮上会亮一个小圆点，点开即见当前版本 / 最新版本与更新按钮；弹窗还会拉取该版本在 GitHub 上的 **Release 发布说明**正文一并展示（拉不到时给「在 GitHub 查看发布说明」链接）。
+- **边界**：只问 registry、只装本插件自身，不读写其他插件的状态目录；失败静默降级为「暂时无法获取最新版本」，不影响技能管理的任何功能。
+
 ## 安装
 
 插件自带下载与解压能力，**不需要预装 Node / npm / npx / git**；首次安装需要联网拉取依赖。
@@ -147,8 +157,10 @@ plugin_manager install_bundle(target = <本仓库绝对路径>)
 | `intro.enabled` | `true` | `false` 时界面隐藏 ✨ 入口，接口返回 501 |
 | `intro.provider` / `intro.model` | 空 | 留空用 DSH 当前默认模型；两个必须同时给 |
 | `intro.maxInputBytes` | `24576` | 发给模型的 `SKILL.md` 上限（8–48 KB），超出截断并在提示词里标注 |
-| `intro.maxOutputTokens` | `300` | 输出上限（96–1024） |
-| `intro.timeoutMs` | `30000` | 单次生成超时（5–60 秒），超时返回 504 |
+| `intro.maxOutputTokens` | `4096` | 输出上限（96–8192）。这是防跑飞的预算，不是长度目标；推理模型的思考 token 也计入，实际会按模型自动抬高保底 |
+| `intro.timeoutMs` | `60000` | 单次生成超时（5–60 秒），超时返回 504 |
+
+简介长度由提示词里的 160 字控制，不要把 `maxOutputTokens` 当成目标长度；调小它不会省钱，只会让推理模型没有输出正文的空间。
 
 ## 开发与发布