@morehao/dsh-skills-console 0.5.6 → 0.5.7

package/README.en.md

@@ -94,7 +94,7 @@ Some skills only have an English description, and some titles alone don't tell y
 The **refresh button** next to the identity capsule in the page header checks whether *Skills Console itself* has a new release. This is a different axis from skill updates — it checks this plugin's own npm releases:
 
 - **How it checks**: follows the registry plan from the host's `pluginManager.registries()` (inheriting the profile's mirror / private source / token config) and asks `<registry>/<package>/latest` in turn (8s timeout, version only; falls back to the official `registry.npmjs.org` only if none answer), then compares with the installed version; the host caches for 5 minutes so repeated opens don't hit the network. About 20 seconds after startup it warms the cache once, silently.
-- **One-click update**: when the desktop host exposes `pluginManager`, clicking "Update to x.y.z" reinstalls this plugin to the latest version (installed from the registry that reported it); **restart DSH to apply** (no auto-reload).
+- **One-click update**: when the desktop host exposes `pluginManager`, clicking "Update to x.y.z" reinstalls this plugin to the latest version (installed from the registry that reported it). With HMR, the host refuses to overwrite an installed package by name with `already-installed`; the plugin follows the official update path (`removeBundle` then `installBundle`); **restart DSH to apply** (no auto-reload).
 - **Manual fallback**: if one-click update is unavailable, the dialog shows a copyable command (`dsh plugin --profile <profile> add <package>@latest`).
 - **When a new version exists**: a small dot lights up on the refresh button; open it to see current / latest version and the update button, plus the release's **GitHub Release notes** body pulled for that version (if unavailable, a "view release notes on GitHub" link instead).
 - **Boundaries**: it only queries registries and only (re)installs this plugin itself, touching no other plugin's state directory; failures degrade silently to "could not reach the registry" and never affect any skill-management feature.

package/README.md

@@ -94,7 +94,7 @@ DSH（DeepSeek Harness）的技能控制台：**安装、更新、删除、启
 页头身份胶囊旁的**刷新按钮**用来检查「技能控制台」这个插件自己有没有新版本，而管的是另一个维度——它不是检查技能的上游，而是检查本插件在 npm 上的发布：
 
 - **怎么查**：按宿主 `pluginManager.registries()` 给的 registry 计划（继承 profile 的镜像 / 私有源 / token 配置）依次问 `<registry>/<包名>/latest`（8 秒超时，只取版本号，取不到才回退官方 `registry.npmjs.org`），与本机安装的版本比较；Host 端 5 分钟缓存，连续打开不重复打网络。启动后约 20 秒会静默热身一次，不打扰你。
-- **一键更新**：桌面端有 `pluginManager` 服务时，弹窗里点「更新到 x.y.z」即可把本插件重装到最新版（装到查到最新版的那个 registry）；更新成功后**重启 DSH 生效**（不自动刷新）。
+- **一键更新**：桌面端有 `pluginManager` 服务时，弹窗里点「更新到 x.y.z」即可把本插件重装到最新版（装到查到最新版的那个 registry）。HMR 开启时宿主会以 `already-installed` 拒绝覆盖同名已安装包，插件按官方更新路径先 `removeBundle` 再 `installBundle`；更新成功后**重启 DSH 生效**（不自动刷新）。
 - **手动兜底**：环境不支持一键更新时，弹窗给出可复制的手动命令（`dsh plugin --profile <profile> add <包名>@latest`）。
 - **有新版本时**：刷新按钮上会亮一个小圆点，点开即见当前版本 / 最新版本与更新按钮；弹窗还会拉取该版本在 GitHub 上的 **Release 发布说明**正文一并展示（拉不到时给「在 GitHub 查看发布说明」链接）。
 - **边界**：只问 registry、只装本插件自身，不读写其他插件的状态目录；失败静默降级为「暂时无法获取最新版本」，不影响技能管理的任何功能。

package/client.js

@@ -5083,6 +5083,11 @@ function SkillReader({
 
 // client/views/plugin-update-modal.js
 var import_react9 = __toESM(require("react"), 1);
+function flattenDetails(text) {
+  return String(text ?? "").replace(/<details[^>]*>\s*<summary>([\s\S]*?)<\/summary>/gi, (_, summary) => `**${String(summary).trim()}**
+
+`).replace(/<\/details>/gi, "");
+}
 function PluginUpdateModal({ t, update, onClose, repoUrl }) {
   const { status, checking, applying, checkError, applyError, check, apply: apply2, release, loadRelease } = update;
   const [copied, setCopied] = import_react9.default.useState(false);
@@ -5101,7 +5106,7 @@ function PluginUpdateModal({ t, update, onClose, repoUrl }) {
   }, [available, latest, loadRelease]);
   const releaseData = release?.version === latest ? release.data : null;
   const releaseLoading = release?.version === latest && release.loading;
-  const releaseBody = typeof releaseData?.body === "string" ? releaseData.body.trim() : "";
+  const releaseBody = typeof releaseData?.body === "string" ? flattenDetails(releaseData.body.trim()).trim() : "";
   const releaseUrl = releaseData?.htmlUrl || (repoUrl ? `${repoUrl}/releases` : null);
   const copy = () => {
     if (!manual || typeof navigator === "undefined" || !navigator.clipboard?.writeText) return;
@@ -5114,7 +5119,7 @@ function PluginUpdateModal({ t, update, onClose, repoUrl }) {
   let stateLine;
   if (checking && !status) stateLine = t("pluginUpdate.checking");
   else if (checkError || status?.checkFailed) stateLine = t("pluginUpdate.checkFailed");
-  else if (restartRequired) stateLine = t("pluginUpdate.updated", { version: updatedVersion || latest });
+  else if (restartRequired) stateLine = t("pluginUpdate.updated").replace("{version}", String(updatedVersion || latest || ""));
   else if (available) stateLine = t("pluginUpdate.available");
   else if (status) stateLine = t("pluginUpdate.upToDate");
   else stateLine = t("pluginUpdate.checking");
@@ -5133,7 +5138,7 @@ function PluginUpdateModal({ t, update, onClose, repoUrl }) {
       className: "dshsc-btn primary",
       disabled: applying,
       onClick: () => void apply2()
-    }, applying ? t("pluginUpdate.applying") : t("pluginUpdate.update", { version: latest })));
+    }, applying ? t("pluginUpdate.applying") : t("pluginUpdate.update").replace("{version}", String(latest || ""))));
   }
   footer.push(h("button", { key: "close", className: "dshsc-btn ghost", onClick: onClose }, t("pluginUpdate.close")));
   return h(
@@ -5152,7 +5157,7 @@ function PluginUpdateModal({ t, update, onClose, repoUrl }) {
     available ? h(
       "div",
       { className: "dshsc-release" },
-      h("div", { className: "dshsc-release-head" }, t("pluginUpdate.whatsNew", { version: latest })),
+      h("div", { className: "dshsc-release-head" }, t("pluginUpdate.whatsNew").replace("{version}", String(latest || ""))),
       releaseLoading ? h("p", { className: "dshsc-sub" }, t("pluginUpdate.releaseLoading")) : releaseBody ? h("div", { className: "dshsc-release-body" }, h(Markdown, { text: releaseBody })) : h(
         "p",
         { className: "dshsc-sub" },

package/lib/core/plugin-update.js

@@ -13,9 +13,10 @@
  * 设计取舍（对齐本机同类插件 archive-manager / ds-bot 的轻量做法，但更保守）：
  * - 依次问 registry 计划里的 `<base><pkg>/latest`，8s 超时，只取 `version` 字段；失败不抛，返回 null。
  * - 版本比较手写（本仓 runtime 依赖只有 tar，不引入 semver）；结构非法一律判「不更新」。
- * - 安装只走宿主 `pluginManager.installBundle`（桌面端官方能力）；拿不到就抛
- *   `error.plugin-update.manual`，把手动命令放进 detail 让前端展示/复制。
- * - 不落盘、不加锁：一次点击只触发一次，`applying` 由路由层单飞守住；重启由用户决定。
+ * - 安装只走宿主 `pluginManager.installBundle`（桌面端官方能力）；HMR 下已安装的包会被以
+ *   `already-installed` 拒绝，此时按官方更新路径先 `removeBundle` 再 `installBundle`；拿不到
+ *   这些能力就抛 `error.plugin-update.manual`，把手动命令放进 detail 让前端展示/复制。
+ * - 不落盘、不加锁：本模块用 `applying` 单飞（进入 `apply()` 立即置位，覆盖查询 + 安装全程）；重启由用户决定。
  */
 import { readFileSync } from 'node:fs';
 
@@ -101,6 +102,26 @@ function manualCommand(meta, profileName) {
     : `dsh plugin add ${spec}`;
 }
 
+/**
+ * 宿主 `installBundle` / `removeBundle` 的结果两种形态都要接：
+ * 本地服务直接返回 `{ application, error? }`；远程代理可能再包一层 `{ ok, value | error }`。
+ */
+function unwrapResult(result) {
+  if (
+    result && typeof result === 'object'
+    && typeof result.ok === 'boolean'
+    && !('application' in result)
+    && ('value' in result || 'error' in result)
+  ) {
+    return result.ok ? result.value : { application: 'failed', error: result.error ?? { code: 'operation-error' } };
+  }
+  return result;
+}
+
+function failureMessage(result) {
+  return result?.error?.diagnostic || result?.error?.message || result?.error?.code || '更新失败';
+}
+
 /** registry 归一成 `https://host/` 形式；非法返回 null。 */
 function normalizeRegistry(value) {
   if (typeof value !== 'string' || value.trim() === '') return null;
@@ -241,33 +262,45 @@ export function createPluginUpdate({ getPluginManager, getProfileName, fetchImpl
     if (applying) {
       throw new ServiceError('error.plugin-update.busy', '插件正在更新，请稍候', null, 409);
     }
-    const latest = await latestVersion();
-    if (latest === null) {
-      throw new ServiceError('error.plugin-update.check-failed', '暂时无法获取最新版本，请稍后再试', manualCommand(meta, profileName()), 503);
-    }
-    if (!isNewerVersion(meta.version, latest)) {
-      return { ...view({ latest }), updatedVersion: null };
-    }
-    const pm = manager();
-    if (pm === null) {
-      throw new ServiceError(
-        'error.plugin-update.manual',
-        '当前环境不支持自动更新，请手动执行命令',
-        manualCommand(meta, profileName()),
-        409,
-      );
-    }
+    // 进入即置位：先查最新版也有 await，若等查到再置位，两次并发点击会都通过守卫、装两遍
     applying = true;
     try {
+      const latest = await latestVersion();
+      if (latest === null) {
+        throw new ServiceError('error.plugin-update.check-failed', '暂时无法获取最新版本，请稍后再试', manualCommand(meta, profileName()), 503);
+      }
+      if (!isNewerVersion(meta.version, latest)) {
+        return { ...view({ latest }), updatedVersion: null, applying: false };
+      }
+      const pm = manager();
+      if (pm === null) {
+        throw new ServiceError(
+          'error.plugin-update.manual',
+          '当前环境不支持自动更新，请手动执行命令',
+          manualCommand(meta, profileName()),
+          409,
+        );
+      }
       // 用查到最新版的那个 registry 去装，和「问」保持一致；没有就用宿主默认（不传 options）
       const registry = cache?.version === latest ? cache.registry : undefined;
-      const result = await pm.installBundle(
-        `${meta.name}@${latest}`,
-        registry ? { registry } : undefined,
-      );
+      const spec = `${meta.name}@${latest}`;
+      const installOptions = registry ? { registry } : undefined;
+      let result = unwrapResult(await pm.installBundle(spec, installOptions));
+      // HMR 开启时，installBundle 对已安装的包名会在跑 pnpm 前直接拒绝 already-installed；
+      // 官方页面的「更新」就是先 removeBundle 再 installBundle，这里照同一路径做显式更新。
+      if (result?.error?.code === 'already-installed' && typeof pm.removeBundle === 'function') {
+        const removed = unwrapResult(await pm.removeBundle(meta.name));
+        if (removed?.error || removed?.application === 'failed') {
+          const code = removed?.error?.code;
+          const message = code === 'stop-profile'
+            ? '插件正在运行且当前 profile 未启用 HMR，请完全退出 DSH 后手动更新'
+            : failureMessage(removed);
+          throw new ServiceError('error.plugin-update.install-failed', String(message).slice(0, 600), manualCommand(meta, profileName()), 500);
+        }
+        result = unwrapResult(await pm.installBundle(spec, installOptions));
+      }
       if (result?.error || !['applied', 'restart-required', 'overridden'].includes(result?.application)) {
-        const message = result?.error?.diagnostic || result?.error?.message || result?.error?.code || '更新失败';
-        throw new ServiceError('error.plugin-update.install-failed', String(message).slice(0, 600), manualCommand(meta, profileName()), 500);
+        throw new ServiceError('error.plugin-update.install-failed', String(failureMessage(result)).slice(0, 600), manualCommand(meta, profileName()), 500);
       }
       cache = { version: latest, expiresAt: now() + CACHE_TTL_MS, registry };
       return {
@@ -275,6 +308,7 @@ export function createPluginUpdate({ getPluginManager, getProfileName, fetchImpl
         updateAvailable: false,
         updatedVersion: latest,
         restartRequired: true,
+        applying: false,
       };
     } finally {
       applying = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-skills-console",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "统一管理本地技能的安装、更新、删除与接入，让同一份技能在多个 Agent 间复用。A skill manager for DeepSeek Harness: install, update, remove, link and toggle agent skills.",
   "license": "MIT",
   "author": "morehao <morehao@qq.com>",