@morehao/dsh-skills-console 0.5.4 → 0.5.6

package/lib/core/plugin-update.js

@@ -0,0 +1,323 @@
+/**
+ * 插件自更新：检查 npm 上的最新版本，并按需把**本插件自己**重装到最新版。
+ *
+ * 与 `updates.js` 的区别：那是「技能」的上游检测（走 GitHub Trees），这里是
+ * 「插件包自身」的版本检查（走 npm registry），两条链路互不相干。
+ *
+ * 为什么不用宿主 `pluginManager.inspect` 查最新版：`inspect` 对**已安装的包名**会直接
+ * 拒绝 `already-installed`（它只答「我马上要装的 spec 指向什么」，不是「查已装包的最新版」），
+ * 宿主 `listBundles` 也不为第三方插件解析最新版（`installTarget` 只给官方目录条目）。
+ * 所以最新版只能自己查 registry —— 但**走宿主 `pluginManager.registries()` 拿到的 registry
+ * 计划**（继承 profile 的镜像 / 私有源 / token 配置），拿不到才退回官方 registry。
+ *
+ * 设计取舍（对齐本机同类插件 archive-manager / ds-bot 的轻量做法，但更保守）：
+ * - 依次问 registry 计划里的 `<base><pkg>/latest`，8s 超时，只取 `version` 字段；失败不抛，返回 null。
+ * - 版本比较手写（本仓 runtime 依赖只有 tar，不引入 semver）；结构非法一律判「不更新」。
+ * - 安装只走宿主 `pluginManager.installBundle`（桌面端官方能力）；拿不到就抛
+ *   `error.plugin-update.manual`，把手动命令放进 detail 让前端展示/复制。
+ * - 不落盘、不加锁：一次点击只触发一次，`applying` 由路由层单飞守住；重启由用户决定。
+ */
+import { readFileSync } from 'node:fs';
+
+import { ServiceError } from './service.js';
+
+export const OFFICIAL_REGISTRY = 'https://registry.npmjs.org/';
+const FETCH_TIMEOUT_MS = 8000;
+const CACHE_TTL_MS = 5 * 60 * 1000;
+const RELEASE_CACHE_TTL_MS = 10 * 60 * 1000;
+
+/** 插件身份：包名与当前版本。从 package.json 读一次，避免和 page 头硬编码漂移。 */
+export const PLUGIN_META = (() => {
+  try {
+    const pkg = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+    const repo = typeof pkg.repository === 'string' ? pkg.repository : pkg.repository?.url;
+    const match = /github\.com[/:]([\w.-]+\/[\w.-]+?)(?:\.git)?$/i.exec(String(repo || ''));
+    return {
+      name: String(pkg.name || ''),
+      version: String(pkg.version || ''),
+      repo: match ? match[1] : null,
+    };
+  } catch {
+    return { name: '', version: '', repo: null };
+  }
+})();
+
+/** 解析 semver：`v1.2.3` / `1.2.3-beta.1` / `1.2.3+build`。非法返回 undefined。 */
+function parseSemver(value) {
+  const text = String(value ?? '').trim();
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(text);
+  if (match === null) return undefined;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4] ? match[4].split('.') : [],
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) {
+    return left.length === right.length ? 0 : left.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index];
+    const b = right[index];
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1;
+    if (a === b) continue;
+    const aNumeric = /^\d+$/.test(a);
+    const bNumeric = /^\d+$/.test(b);
+    if (aNumeric && bNumeric) {
+      const an = BigInt(a);
+      const bn = BigInt(b);
+      if (an !== bn) return an > bn ? 1 : -1;
+      continue;
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+    return a > b ? 1 : -1;
+  }
+  return 0;
+}
+
+/** `candidate` 是否严格新于 `current`。任一方不是合法 semver 都判 false（宁可不更新）。 */
+export function isNewerVersion(current, candidate) {
+  const a = parseSemver(current);
+  const b = parseSemver(candidate);
+  if (a === undefined || b === undefined) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (b.core[index] !== a.core[index]) return b.core[index] > a.core[index];
+  }
+  return comparePrerelease(b.prerelease, a.prerelease) > 0;
+}
+
+/** npm 包名转成 registry 路径：`@scope/name` → `@scope%2Fname`。 */
+function encodePackageName(name) {
+  return name.startsWith('@') ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
+}
+
+/** 手动更新命令（前端展示/复制用），按已发布包 + 当前 profile 拼。 */
+function manualCommand(meta, profileName) {
+  const spec = `${meta.name}@latest`;
+  return profileName
+    ? `dsh plugin --profile ${profileName} add ${spec}`
+    : `dsh plugin add ${spec}`;
+}
+
+/** registry 归一成 `https://host/` 形式；非法返回 null。 */
+function normalizeRegistry(value) {
+  if (typeof value !== 'string' || value.trim() === '') return null;
+  const text = value.trim().replace(/\/+$/, '');
+  try {
+    const url = new URL(`${text}/`);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 由宿主 `registries()` 结果拼出要问的 registry 顺序：
+ * `resolved`（pnpm 实际用的）→ `registry` → `fallbackRegistries`，去重；空则回退官方 registry。
+ */
+function registryPlan(registries) {
+  const ordered = [];
+  const push = (value) => {
+    const normalized = normalizeRegistry(value);
+    if (normalized && !ordered.includes(normalized)) ordered.push(normalized);
+  };
+  if (registries && typeof registries === 'object') {
+    push(registries.resolved);
+    push(registries.registry);
+    for (const item of Array.isArray(registries.fallbackRegistries) ? registries.fallbackRegistries : []) push(item);
+  }
+  if (ordered.length === 0) ordered.push(OFFICIAL_REGISTRY);
+  return ordered;
+}
+
+/**
+ * @param {object} deps
+ * @param {() => any} deps.getPluginManager  取宿主 `pluginManager`（可能 undefined）
+ * @param {() => string | null} [deps.getProfileName]  取当前 profile 名（仅用于手动命令）
+ * @param {typeof fetch} [deps.fetchImpl]  测试注入
+ * @param {() => number} [deps.now]  测试注入
+ */
+export function createPluginUpdate({ getPluginManager, getProfileName, fetchImpl = globalThis.fetch, now = Date.now, meta = PLUGIN_META } = {}) {
+  let cache = null; // { version, expiresAt }
+  let applying = false; // 路由层单飞：同一时刻只允许一次安装
+
+  /**
+   * 依次问 registry 计划里的 `<base><pkg>/latest`；第一个给出合法版本的为准。
+   * 全部失败返回 null（不抛，交给视图标 checkFailed）。
+   */
+  async function latestVersion() {
+    if (!meta.name) return null;
+    if (cache && now() < cache.expiresAt) return cache.version;
+    const plan = registryPlan(await readRegistries());
+    for (const base of plan) {
+      try {
+        const response = await fetchImpl(`${base}${encodePackageName(meta.name)}/latest`, {
+          headers: { accept: 'application/json' },
+          redirect: 'error',
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok) continue;
+        const value = await response.json();
+        const version = typeof value?.version === 'string' ? value.version.trim() : '';
+        if (parseSemver(version) === undefined) continue;
+        cache = { version, expiresAt: now() + CACHE_TTL_MS, registry: base };
+        return version;
+      } catch {
+        // 这个 registry 不通 / 超时：试下一个
+      }
+    }
+    return null;
+  }
+
+  /** 从宿主 `pluginManager.registries()` 取 registry 配置；拿不到返回 null（走官方 registry）。 */
+  async function readRegistries() {
+    const service = rawService();
+    if (service === null || typeof service.registries !== 'function') return null;
+    try {
+      return await service.registries();
+    } catch {
+      return null;
+    }
+  }
+
+  /** 宿主的 `pluginManager` 服务（任意能力）；拿不到返回 null。 */
+  function rawService() {
+    try {
+      const value = typeof getPluginManager === 'function' ? getPluginManager() : undefined;
+      return value && typeof value === 'object' ? value : null;
+    } catch {
+      return null;
+    }
+  }
+
+  /** 能做安装的 `pluginManager`（需 `installBundle`）；拿不到返回 null。 */
+  function manager() {
+    const service = rawService();
+    return service && typeof service.installBundle === 'function' ? service : null;
+  }
+
+  function profileName() {
+    try {
+      const value = typeof getProfileName === 'function' ? getProfileName() : null;
+      return typeof value === 'string' && value ? value : null;
+    } catch {
+      return null;
+    }
+  }
+
+  /** 组一份给前端的视图；`canAutoUpdate=false` 时前端只展示手动命令。 */
+  function view({ latest, checkFailed = false } = {}) {
+    const current = meta.version;
+    const updateAvailable = latest !== null && latest !== undefined && isNewerVersion(current, latest);
+    return {
+      packageName: meta.name,
+      currentVersion: current,
+      latestVersion: latest ?? null,
+      updateAvailable,
+      checkFailed,
+      canAutoUpdate: manager() !== null,
+      manualCommand: manualCommand(meta, profileName()),
+      applying,
+    };
+  }
+
+  /** GET：读最新版本并返回视图。网络失败不抛，用 checkFailed 标记。 */
+  async function check({ fresh = false } = {}) {
+    if (fresh) cache = null;
+    const latest = await latestVersion();
+    return view({ latest, checkFailed: latest === null });
+  }
+
+  /**
+   * POST：把本插件重装到最新版。
+   * - 先再查一次，确认确实落后，避免拿过期信息装一个「已是最新」；
+   * - 没有 pluginManager → 抛 manual，带手动命令；
+   * - 安装中重复点击 → 抛 busy。
+   */
+  async function apply() {
+    if (applying) {
+      throw new ServiceError('error.plugin-update.busy', '插件正在更新，请稍候', null, 409);
+    }
+    const latest = await latestVersion();
+    if (latest === null) {
+      throw new ServiceError('error.plugin-update.check-failed', '暂时无法获取最新版本，请稍后再试', manualCommand(meta, profileName()), 503);
+    }
+    if (!isNewerVersion(meta.version, latest)) {
+      return { ...view({ latest }), updatedVersion: null };
+    }
+    const pm = manager();
+    if (pm === null) {
+      throw new ServiceError(
+        'error.plugin-update.manual',
+        '当前环境不支持自动更新，请手动执行命令',
+        manualCommand(meta, profileName()),
+        409,
+      );
+    }
+    applying = true;
+    try {
+      // 用查到最新版的那个 registry 去装，和「问」保持一致；没有就用宿主默认（不传 options）
+      const registry = cache?.version === latest ? cache.registry : undefined;
+      const result = await pm.installBundle(
+        `${meta.name}@${latest}`,
+        registry ? { registry } : undefined,
+      );
+      if (result?.error || !['applied', 'restart-required', 'overridden'].includes(result?.application)) {
+        const message = result?.error?.diagnostic || result?.error?.message || result?.error?.code || '更新失败';
+        throw new ServiceError('error.plugin-update.install-failed', String(message).slice(0, 600), manualCommand(meta, profileName()), 500);
+      }
+      cache = { version: latest, expiresAt: now() + CACHE_TTL_MS, registry };
+      return {
+        ...view({ latest }),
+        updateAvailable: false,
+        updatedVersion: latest,
+        restartRequired: true,
+      };
+    } finally {
+      applying = false;
+    }
+  }
+
+  // GitHub Release 正文缓存：key = version
+  const releaseCache = new Map();
+
+  /**
+   * 拉某个版本的 GitHub Release 正文（发布说明）。
+   * - tag 用 `vX.Y.Z`（本仓发布约定），请求 `api.github.com/repos/<repo>/releases/tags/vX`;
+   * - 失败（无 repo / 网络 / 404 / 超时）返回 null，不抛；前端据此退回「查看发布说明」链接；
+   * - 只读 GitHub 公开 API，不读本机任何文件。
+   */
+  async function releaseNotes(version) {
+    const target = String(version || '').trim();
+    if (!meta.repo || parseSemver(target) === undefined) return null;
+    const cached = releaseCache.get(target);
+    if (cached && now() < cached.expiresAt) return cached.value;
+    const tag = `v${target.replace(/^v/, '')}`;
+    try {
+      const response = await fetchImpl(`https://api.github.com/repos/${meta.repo}/releases/tags/${tag}`, {
+        headers: { accept: 'application/vnd.github+json' },
+        redirect: 'error',
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      });
+      const value = response.ok
+        ? await response.json().then((release) => ({
+            version: target,
+            body: typeof release?.body === 'string' ? release.body : '',
+            htmlUrl: typeof release?.html_url === 'string' ? release.html_url : null,
+            name: typeof release?.name === 'string' ? release.name : null,
+          }))
+        : null;
+      releaseCache.set(target, { value, expiresAt: now() + RELEASE_CACHE_TTL_MS });
+      return value;
+    } catch {
+      // 失败也短缓存，避免连点重复打网络；10 分钟后自然重试
+      releaseCache.set(target, { value: null, expiresAt: now() + RELEASE_CACHE_TTL_MS });
+      return null;
+    }
+  }
+
+  return { check, apply, releaseNotes };
+}

package/lib/core/service.js

@@ -18,6 +18,7 @@ import {
   backupInvocation,
   hashWithoutInvocation,
   inspectPark,
+  matchesLegacyHash,
   parkSkill,
   parseInvocation,
   planManualRestore,
@@ -906,6 +907,65 @@ export function createService({
     return records;
   }
 
+  /**
+   * 一次性重基线：v0.6.x 之前的内容哈希按进程 locale 的 collation 排序，换启动环境
+   * （或 Node / ICU 版本）后同一份内容会算出不同 digest，被误报成「本地已改」。
+   *
+   * 只改写**能证明没被改过**的基线：新口径对不上，但某个旧 collation 能精确复现
+   * 记录值。内容真的动过的技能一条都不碰 —— 继续按「本地已改」让用户确认覆盖。
+   * 停用（parked）期间的技能也跳过：那时 SKILL.md 已改名、目录里多了 marker，
+   * 基线由 unpark 重放。
+   */
+  function rebaselineHashes() {
+    const rebaselined = [];
+    const unresolved = [];
+    if (store.readOnly) return { rebaselined, unresolved, skipped: 'read-only' };
+    for (const install of state().installs) {
+      if (typeof install.installedHash !== 'string' || !install.installedHash) continue;
+      const dir = canonicalDir(install.name);
+      let stat;
+      try {
+        stat = fs.statSync(dir);
+      } catch {
+        continue;
+      }
+      if (!stat.isDirectory()) continue;
+      if (inspectPark(dir).parked) continue;
+      const current = hashWithoutInvocation(dir, install.manual);
+      if (!current || current === install.installedHash) continue;
+      if (matchesLegacyHash(dir, install.manual, install.installedHash)) {
+        rebaselined.push({ name: install.name, from: install.installedHash, to: current });
+      } else {
+        unresolved.push(install.name);
+      }
+    }
+    if (rebaselined.length > 0) {
+      const next = new Map(rebaselined.map((item) => [item.name, item.to]));
+      store.update((draft) => {
+        for (const row of draft.installs) {
+          if (next.has(row.name)) row.installedHash = next.get(row.name);
+        }
+      });
+      logger('state.hash-order.rebaseline', {
+        names: rebaselined.map((item) => item.name),
+        count: rebaselined.length,
+      });
+    }
+    return { rebaselined, unresolved };
+  }
+
+  // 每个进程只跑一次：写盘后新基线自洽，不必（也不该）每次请求都试旧口径。
+  let hashBaselineChecked = false;
+  function ensureHashBaseline() {
+    if (hashBaselineChecked || store.readOnly || enqueue.pending() > 0) return;
+    hashBaselineChecked = true;
+    try {
+      rebaselineHashes();
+    } catch (error) {
+      logger('state.hash-order.rebaseline.failed', { message: error?.message || String(error) });
+    }
+  }
+
   function canonicalDir(name) {
     return path.join(paths.canonical, name);
   }
@@ -1119,6 +1179,8 @@ export function createService({
           logger('state.migrate.failed', { message: error.message });
         }
       }
+      // 旧版内容哈希按 locale 排序，升级后先做一次性重基线，别把「排序变了」显示成「本地已改」
+      ensureHashBaseline();
       return store.state;
     },
 
@@ -1138,6 +1200,9 @@ export function createService({
       return reconcileInvocations();
     },
 
+    /** 诊断/测试用：手动跑一次旧哈希口径的重基线（启动时已自动跑过一次）。 */
+    rebaselineHashes,
+
     async getState({ cwd, workspace } = {}) {
       const lock = readLock(paths);
       reconcileTracking(lock);
@@ -1449,6 +1514,8 @@ export function createService({
             inputBytes: prompt.inputBytes,
             truncated: prompt.truncated,
             sourceBytes: prompt.sourceBytes,
+            maxTokens: result.maxTokens,
+            finish: result.finish,
           });
           introStore.put(name, language, entry);
           logger('intro.generate', {
@@ -1456,6 +1523,9 @@ export function createService({
             lang: language,
             provider: result.provider,
             model: result.model,
+            effort: result.reasoningEffort || null,
+            maxTokens: result.maxTokens ?? null,
+            finish: result.finish || null,
             inputBytes: prompt.inputBytes,
             truncated: prompt.truncated,
             durationMs: Date.now() - startedAt,
@@ -1471,7 +1541,12 @@ export function createService({
           };
         } catch (error) {
           if (!(error instanceof ServiceError)) {
-            logger('intro.generate.failed', { name, message: error?.message, code: error?.code });
+            logger('intro.generate.failed', {
+              name,
+              message: error?.message,
+              code: error?.code,
+              detail: error?.detail || null,
+            });
           }
           throw error;
         }
@@ -1583,6 +1658,8 @@ export function createService({
               inputBytes: prompt.inputBytes,
               truncated: prompt.truncated,
               sourceBytes: prompt.sourceBytes,
+              maxTokens: result.maxTokens,
+              finish: result.finish,
             });
             introStore.put(target.cacheKey, language, entry);
             logger('intro.generate.remote', {
@@ -1592,6 +1669,9 @@ export function createService({
               commit: target.commit,
               provider: result.provider,
               model: result.model,
+              effort: result.reasoningEffort || null,
+              maxTokens: result.maxTokens ?? null,
+              finish: result.finish || null,
               inputBytes: prompt.inputBytes,
               truncated: prompt.truncated,
               durationMs: Date.now() - startedAt,
@@ -1616,6 +1696,7 @@ export function createService({
                 name,
                 message: error?.message,
                 code: error?.code,
+                detail: error?.detail || null,
               });
             }
             throw error;

package/lib/index.js

@@ -6,6 +6,7 @@ import { createPolicyProvider, installPolicyProviders } from './core/policy.js';
 import { createService } from './core/service.js';
 import { normalizeIntroConfig } from './core/intro.js';
 import { createIntroStore } from './core/intro-store.js';
+import { createPluginUpdate } from './core/plugin-update.js';
 import { StateStore } from './core/state.js';
 import { createRoutes, ROUTE_PREFIX } from './routes.js';
 
@@ -113,7 +114,19 @@ export function apply(ctx, config = {}) {
     logger('plugin.migrate.failed', { message: error?.message, code: error?.code });
   }
 
-  const handler = createRoutes({ service, logger });
+  /**
+   * 插件自更新：检查 npm 最新版 / 一键重装自身。
+   * `pluginManager` 是桌面端官方能力（installBundle），按可选服务取；拿不到时路由只报手动命令。
+   */
+  const pluginUpdate = createPluginUpdate({
+    getPluginManager: () => ctx.get('pluginManager'),
+    getProfileName: () => {
+      const profile = ctx.get('profileContext');
+      return typeof profile?.name === 'string' ? profile.name : null;
+    },
+  });
+
+  const handler = createRoutes({ service, pluginUpdate, logger });
   ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: ROUTE_PREFIX, handler }), 'dsh-skills-console:routes');
   ctx.effect(() => () => policies.dispose(), 'dsh-skills-console:policy');
 
@@ -137,5 +150,20 @@ export function apply(ctx, config = {}) {
     logger('plugin.autoCheck.off', { reason: 'timer-service-missing' });
   }
 
+  // 插件自身的版本检查：启动后延迟一次（有 timer 用它，没有就 setTimeout），只热身缓存不打扰用户。
+  // 失败静默——真正的展示交给前端打开刷新按钮/弹窗时再查。
+  const warmPluginUpdate = () => {
+    void pluginUpdate.check().catch((error) => logger('plugin.update.warm.failed', { message: error?.message }));
+  };
+  if (timer && typeof timer.timeout === 'function') {
+    ctx.effect(() => timer.timeout(warmPluginUpdate, 20 * 1000), 'dsh-skills-console:plugin-update-warm');
+  } else {
+    ctx.effect(() => {
+      const handle = setTimeout(warmPluginUpdate, 20 * 1000);
+      handle.unref?.();
+      return () => clearTimeout(handle);
+    }, 'dsh-skills-console:plugin-update-warm');
+  }
+
   logger('plugin.apply', { stateDir: paths.stateDir, canonical: paths.canonical, readOnly: store.readOnly });
 }

package/lib/routes.js

@@ -118,10 +118,20 @@ function matchRoute(method, pathname) {
     if (segments.length === 2 && segments[1] === 'rollback' && method === 'POST') return { name: 'updates.rollback' };
   }
 
+  // 插件自身版本检查 / 更新（与技能上游 updates.* 是两回事，见 core/plugin-update.js）
+  if (segments.length === 1 && segments[0] === 'plugin-update' && method === 'GET') return { name: 'plugin.update.check' };
+  if (segments.length === 2 && segments[0] === 'plugin-update' && segments[1] === 'apply' && method === 'POST') {
+    return { name: 'plugin.update.apply' };
+  }
+  // 拉某版本的发布说明（GitHub Release 正文）：GET /plugin-update/release?version=x.y.z
+  if (segments.length === 2 && segments[0] === 'plugin-update' && segments[1] === 'release' && method === 'GET') {
+    return { name: 'plugin.update.release' };
+  }
+
   return null;
 }
 
-export function createRoutes({ service, logger }) {
+export function createRoutes({ service, pluginUpdate = null, logger }) {
   return async function handler(req, res) {
     const url = new URL(req.url || '/', 'http://127.0.0.1');
     const pathname = url.pathname.startsWith(ROUTE_PREFIX)
@@ -153,7 +163,7 @@ export function createRoutes({ service, logger }) {
       service.reloadState();
       const body = method === 'GET' ? {} : await readBody(req);
       const query = Object.fromEntries(url.searchParams.entries());
-      const result = await dispatch(route, { body, query, service, signal: abort.signal });
+      const result = await dispatch(route, { body, query, service, pluginUpdate, signal: abort.signal });
       // 生成期间客户端可能已经走了：往已关闭的响应写会抛 ERR_STREAM_WRITE_AFTER_END
       if (res.writableEnded || res.destroyed) return;
       sendJson(res, 200, result);
@@ -181,7 +191,7 @@ export function createRoutes({ service, logger }) {
   };
 }
 
-async function dispatch(route, { body, query, service, signal = null }) {
+async function dispatch(route, { body, query, service, pluginUpdate = null, signal = null }) {
   switch (route.name) {
     case 'state': {
       const state = await service.getState({ cwd: query.cwd || body.cwd, workspace: query.workspace });
@@ -257,6 +267,19 @@ async function dispatch(route, { body, query, service, signal = null }) {
       return service.applyUpdate({ name: body.name, token: body.token, overwrite: Boolean(body.overwrite) });
     case 'updates.rollback':
       return service.rollback({ name: body.name });
+    case 'plugin.update.check': {
+      if (!pluginUpdate) throw new ServiceError('error.plugin-update.unavailable', '插件自更新不可用');
+      return pluginUpdate.check({ fresh: query.fresh === '1' || body.fresh === true });
+    }
+    case 'plugin.update.apply': {
+      if (!pluginUpdate) throw new ServiceError('error.plugin-update.unavailable', '插件自更新不可用');
+      return pluginUpdate.apply();
+    }
+    case 'plugin.update.release': {
+      if (!pluginUpdate) throw new ServiceError('error.plugin-update.unavailable', '插件自更新不可用');
+      const version = query.version || body.version;
+      return pluginUpdate.releaseNotes(version);
+    }
     default:
       throw new ServiceError('error.skills.no-route', `unhandled route ${route.name}`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-skills-console",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "统一管理本地技能的安装、更新、删除与接入，让同一份技能在多个 Agent 间复用。A skill manager for DeepSeek Harness: install, update, remove, link and toggle agent skills.",
   "license": "MIT",
   "author": "morehao <morehao@qq.com>",