@mrrisega/dsh-remote 0.4.2 → 0.4.4

package/README.md

@@ -79,6 +79,12 @@ npx @mrrisega/dsh-remote setup --server wss://<你的域名>:端口 --key <访
 其他命令：`settings`（设置页）、`status`（查看状态）、`run`（前台调试）、
 `plugin`（重装/卸载 dsh web 插件）。运行 `npx @mrrisega/dsh-remote --help` 查看完整说明。
 
+> **版本与更新 / 卸载**：dsh 官方插件市场目前不提供更新按钮，也不会改写用户补丁（因此市场
+> 卸载会提示「仍通过 insert 引用 dsh-remote-ui」而拒绝）。插件设置面板里已内置管理入口
+> （dsh web → 设置 → 「远程控制」→「🔄 版本与更新」卡片）：显示当前版本、自动检测 npm 新版、
+> **一键在线更新**（后台补运行环境并重启 bridge，完成后重启 dsh web 生效）、以及**彻底卸载**
+> （移除补丁 include / 依赖 / bundle 与本地文件，之后市场卸载或直接重启均可完成卸载）。
+
 源码安装（开发 / 自建服务器）：`git clone https://github.com/mrRisega/dsh-remote.git`
 并 `npm install`，见下文各组件说明。
 

package/dsh-setup.mjs

@@ -41,6 +41,63 @@ const DEFAULT_API = "https://n.risegao.cn:13443/relay-api";
 const DEFAULT_APP_URL = "https://n.risegao.cn:13443/app/";
 const REPO_URL = "https://github.com/mrRisega/dsh-remote";
 
+// ---------- 运行时自物化（npm/npx 安装 → 固化到配置目录，脱离 npx 缓存） ----------
+// npx 每次安装的缓存目录（~/.npm/_npx/<hash>）不固定：缓存一旦清理，指向它的自启动服务
+// 就会像“找不到模块”一样崩溃。因此 npm 形态安装时把 dsh-setup.mjs + clients + 依赖(ws)
+// 固化到 CONFIG_DIR（~/.dsh-remote），自启动服务只指向这个稳定路径。
+// 插件（dsh-remote-ui）的“运行环境已就绪”判断同样以 CONFIG_DIR/dsh-setup.mjs 为准。
+
+function pkgVersion() {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(THIS_DIR, "package.json"), "utf8")).version || "";
+  } catch { return ""; }
+}
+
+/** 向上查找依赖树里的 ws（npx 布局通常提升到缓存根 node_modules，npm 布局则内嵌）。 */
+function findDepWs(startDir) {
+  let d = startDir;
+  while (true) {
+    const cand = path.join(d, "node_modules", "ws");
+    if (fs.existsSync(cand)) return cand;
+    const parent = path.dirname(d);
+    if (parent === d) break;
+    d = parent;
+  }
+  return null;
+}
+
+function ensureRuntimeCopy() {
+  if (!IS_NPM_INSTALL) return; // 仓库开发形态：原地使用
+  fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  const ver = pkgVersion();
+  const setupTarget = path.join(CONFIG_DIR, "dsh-setup.mjs");
+  if (setupTarget === path.join(THIS_DIR, "dsh-setup.mjs")) return; // 已在配置目录内执行
+  const verFile = path.join(CONFIG_DIR, ".dsh-setup-version");
+  let cur = "";
+  try { cur = fs.readFileSync(verFile, "utf8").trim(); } catch { /* 首次 */ }
+  if (fs.existsSync(setupTarget) && cur === ver) return; // 同版本幂等跳过
+  fs.cpSync(path.join(THIS_DIR, "dsh-setup.mjs"), setupTarget);
+  fs.cpSync(path.join(THIS_DIR, "clients"), path.join(CONFIG_DIR, "clients"), { recursive: true, force: true });
+  const wsSrc = findDepWs(THIS_DIR);
+  if (wsSrc) {
+    fs.mkdirSync(path.join(CONFIG_DIR, "node_modules"), { recursive: true });
+    fs.cpSync(wsSrc, path.join(CONFIG_DIR, "node_modules", "ws"), { recursive: true, force: true });
+  }
+  fs.writeFileSync(verFile, ver);
+  console.log(`✅ 运行时已固化到 ${CONFIG_DIR}（自启动指向稳定路径，不再依赖 npx 缓存）`);
+}
+try { ensureRuntimeCopy(); } catch (e) { console.warn(`⚠️ 运行时固化跳过: ${e.message}`); }
+
+/** 自启动服务应指向的 dsh-setup.mjs：优先配置目录内的固化副本，否则当前执行文件。 */
+function runtimeSetupPath() {
+  const local = path.join(CONFIG_DIR, "dsh-setup.mjs");
+  try {
+    fs.accessSync(local, fs.constants.R_OK);
+    return local;
+  } catch { /* 未固化（如仓库开发）→ 用当前文件 */ }
+  return fileURLToPath(import.meta.url);
+}
+
 // ---------- 工具 ----------
 
 function sh(cmd, timeoutMs = 15000, cwd = undefined) {
@@ -137,7 +194,7 @@ function autostartFilePath() {
 }
 
 function writeAutostartFile() {
-  const runCmd = `"${NODE_BIN}" "${fileURLToPath(import.meta.url)}" run`;
+  const runCmd = `"${NODE_BIN}" "${runtimeSetupPath()}" run`;
   if (process.platform === "darwin") {
     const plistPath = autostartFilePath();
     const plist = `<?xml version="1.0" encoding="UTF-8"?>
@@ -145,7 +202,7 @@ function writeAutostartFile() {
 <plist version="1.0"><dict>
   <key>Label</key><string>com.dshremote.bridge</string>
   <key>ProgramArguments</key>
-  <array><string>${NODE_BIN}</string><string>${fileURLToPath(import.meta.url)}</string><string>run</string></array>
+  <array><string>${NODE_BIN}</string><string>${runtimeSetupPath()}</string><string>run</string></array>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
   <key>StandardOutPath</key><string>${path.join(CONFIG_DIR, ".dsh-bridge.log")}</string>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrisega/dsh-remote",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "手机远程控制 DeepSeek Harness · Remote control DeepSeek Harness (dsh web) from any phone browser — 100% 全功能 App 级体验：发消息、看工具执行、审批权限、改设置、管凭据，含特权操作，免内网穿透。一条命令安装 npx @mrrisega/dsh-remote。Mobile remote control for DSH, self-host or SaaS, no server needed on LAN.",
   "keywords": [
     "deepseek-harness",

package/packages/dsh-remote-ui/lib/client.js

@@ -124,6 +124,11 @@ window.__ModuleLoader__.load({
       ".dru-popup-foot button{border:none;background:none;color:#57606a;cursor:pointer;font-size:12px;font-family:inherit;padding:4px 6px}",
       ".dru-popup-foot button:hover{color:#0969da}",
       ".dru-popup .dru-msg{text-align:left}",
+      // ── 自管理：版本与更新（插件面板内提供在线更新/彻底卸载，市场无更新按钮） ──
+      ".dru-ver-badge{display:inline-block;font-size:11px;border-radius:999px;padding:1px 8px;margin-left:6px;vertical-align:1px}",
+      ".dru-ver-badge-new{color:#9a6700;background:#fff8c5;border:1px solid #eed888}",
+      ".dru-ver-badge-ok{color:#1a7f37;background:#dafbe1;border:1px solid #aceebb}",
+      ".dru-up-log{margin-top:8px;background:#0d1117;color:#e6edf3;border-radius:8px;padding:8px 10px;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11.5px;line-height:1.5;white-space:pre-wrap;word-break:break-word;max-height:150px;overflow:auto}",
     ].join("\n");
     document.head.appendChild(styleEl);
 
@@ -607,6 +612,161 @@ window.__ModuleLoader__.load({
     // 通用「远程控制」图标（🖥 风格 emoji，与面板内既有 emoji 图标体系一致）：
     // 栏目导航 label 与栏目头部均使用它。原侧边栏入口（电源图标按钮）已随入口迁移移除。
 
+    // ── 版本与更新卡片（自管理：市场没有更新按钮，这里提供在线一键更新/彻底卸载） ──
+    // 数据来自 node 半新增的 /dsh-remote/self* 路由；逻辑均在插件 node 半实现，
+    // 因此无论插件从「插件市场」还是 npx 安装，界面与行为完全一致。
+    function SelfManageCard() {
+      var verArr = useState(null); var ver = verArr[0]; var setVer = verArr[1];       // {version, runtimeReady}
+      var chkArr = useState(null); var chk = chkArr[0]; var setChk = chkArr[1];       // {current, latest, outdated}
+      var chkBusyArr = useState(false); var chkBusy = chkBusyArr[0]; var setChkBusy = chkBusyArr[1];
+      var upBusyArr = useState(false); var upBusy = upBusyArr[0]; var setUpBusy = upBusyArr[1];
+      var unBusyArr = useState(false); var unBusy = unBusyArr[0]; var setUnBusy = unBusyArr[1];
+      var logArr = useState(""); var log = logArr[0]; var setLog = logArr[1];         // 更新日志尾部
+      var updArr = useState(false); var updating = updArr[0]; var setUpdating = updArr[1]; // 更新任务是否仍在跑
+      var doneArr = useState(false); var updated = doneArr[0]; var setUpdated = doneArr[1]; // 本轮已更新完成（提示重启）
+      var armArr = useState(false); var armed = armArr[0]; var setArmed = armArr[1];   // 彻底卸载二次确认
+      var msgArr = useState(null); var selfMsg = msgArr[0]; var setSelfMsg = msgArr[1]; // {kind, text}
+
+      var loadVer = useCallback(function () {
+        api("/dsh-remote/self").then(function (b) {
+          if (b && b.ok) setVer(b);
+        }).catch(function () {});
+      }, []);
+
+      var doCheck = useCallback(function () {
+        setChkBusy(true);
+        api("/dsh-remote/self/update-check").then(function (b) {
+          if (b && b.ok) setChk(b);
+          else setSelfMsg({ kind: "err", text: "检查更新失败：" + ((b && (b.error || b.detail)) || "未知错误") });
+        }).catch(function (e) {
+          setSelfMsg({ kind: "err", text: "无法连接更新服务：" + e.message });
+        }).finally(function () { setChkBusy(false); });
+      }, []);
+
+      // 轮询更新日志：点击一键更新后，每 2s 拉一次日志；直到 running=false 视为完成
+      var logTimer = useCallback(function (force) {
+        if (!force && updating) return;
+        api("/dsh-remote/self/update-log").then(function (b) {
+          if (b && b.ok) {
+            setLog(b.log || "");
+            if (!b.running) {
+              setUpdating(false);
+              setUpdated(true);
+              loadVer();
+              return;
+            }
+          }
+          setUpdating(true);
+        }).catch(function () { setUpdating(false); });
+      }, [updating, loadVer]);
+
+      useEffect(function () { loadVer(); doCheck(); }, [loadVer, doCheck]);
+      useEffect(function () {
+        if (!updating) return;
+        var iv = setInterval(function () {
+          api("/dsh-remote/self/update-log").then(function (b) {
+            if (!b || !b.ok) return;
+            setLog(b.log || "");
+            if (!b.running) {
+              clearInterval(iv);
+              setUpdating(false);
+              setUpdated(true);
+              loadVer();
+              doCheck();
+            }
+          }).catch(function () {});
+        }, 2000);
+        return function () { clearInterval(iv); };
+      }, [updating, loadVer, doCheck]);
+
+      var doUpdate = function () {
+        setUpBusy(true);
+        setUpdated(false);
+        setSelfMsg(null);
+        post("/dsh-remote/self/update", {}).then(function (b) {
+          if (b && b.ok) {
+            setSelfMsg({ kind: "ok", text: "更新已在后台开始，正在下载安装…（本页会实时显示进度日志）" });
+            setUpdating(true);
+            logTimer(true);
+          } else {
+            var detail = String((b && (b.detail || b.error)) || "更新启动失败");
+            // 另一种常见情况：node 半返回 ok:false + “已有更新在进行中” → 转为跟踪进度而非报错
+            api("/dsh-remote/self/update-log").then(function (lb) {
+              if (lb && lb.ok && lb.running) {
+                setSelfMsg({ kind: "ok", text: "检测到已有一次更新正在进行，正在跟踪进度…" });
+                setUpdating(true);
+                logTimer(true);
+              } else {
+                setSelfMsg({ kind: "err", text: detail });
+              }
+            }).catch(function () { setSelfMsg({ kind: "err", text: detail }); });
+          }
+        }).catch(function (e) {
+          setSelfMsg({ kind: "err", text: "更新失败：" + e.message });
+        }).finally(function () { setUpBusy(false); });
+      };
+
+      var doUninstall = function () {
+        if (!armed) { setArmed(true); return; }
+        setUnBusy(true);
+        setSelfMsg(null);
+        post("/dsh-remote/self/uninstall", {}).then(function (b) {
+          if (b && b.ok) {
+            setArmed(false);
+            setSelfMsg({ kind: "ok", text: "已移除插件引用与本地文件。请重启 dsh web：插件将完全卸载（本栏目也会消失）。之后如需重新安装，直接在插件市场再次安装即可。" });
+          } else {
+            setArmed(false);
+            setSelfMsg({ kind: "err", text: "卸载失败：" + ((b && (b.error || b.detail)) || "未知错误") });
+          }
+        }).catch(function (e) {
+          setArmed(false);
+          setSelfMsg({ kind: "err", text: "卸载失败：" + e.message });
+        }).finally(function () { setUnBusy(false); });
+      };
+
+      var outdated = !!(chk && chk.outdated && chk.latest && chk.latest !== chk.current);
+      var currentV = (ver && ver.version) || (chk && chk.current) || "…";
+      var runtimeReady = ver ? !!ver.runtimeReady : null;
+
+      return h("div", { className: "dru-card", style: { marginTop: 2 } },
+        h("h3", null, "🔄 版本与更新"),
+        h("div", { className: "dru-status-line" },
+          h("span", null, "插件版本 v" + currentV),
+          chk === null && chkBusy ? h("span", { className: "dru-meta", style: { margin: 0 } }, "（检查新版本中…）") : null,
+          chk && outdated
+            ? h("span", { className: "dru-ver-badge dru-ver-badge-new" }, "发现新版本 v" + chk.latest)
+            : chk && !outdated ? h("span", { className: "dru-ver-badge dru-ver-badge-ok" }, "已是最新版本") : null
+        ),
+        h("div", { className: "dru-meta" },
+          runtimeReady === false ? "⚠ 桌面运行环境缺失（点击下方「一键更新」会自动补全并启动）" : runtimeReady === true ? "桌面运行环境正常" : "读取运行环境中…"
+        ),
+        h("div", { className: "dru-actions", style: { marginTop: 10 } },
+          outdated
+            ? h("button", { type: "button", className: "dru-btn dru-btn-primary", disabled: upBusy || unBusy || chkBusy || updating, onClick: doUpdate },
+                upBusy ? "更新启动中…" : updating ? "正在更新…" : "一键更新到 v" + chk.latest)
+            : h("button", { type: "button", className: "dru-btn dru-btn-ghost", disabled: upBusy || unBusy || chkBusy || updating, onClick: doUpdate },
+                updating ? "正在更新…" : (ver && !ver.runtimeReady) ? "安装并启动（一键修复）" : "重新检查 / 修复"),
+          h("button", { type: "button", className: "dru-btn dru-btn-ghost", disabled: chkBusy || updating || upBusy, onClick: doCheck }, chkBusy ? "检查中…" : "检查更新"),
+          h("button", {
+            type: "button",
+            className: "dru-btn dru-btn-danger",
+            style: { marginLeft: "auto" },
+            disabled: unBusy || updating || upBusy,
+            onClick: doUninstall
+          }, unBusy ? "卸载中…" : armed ? "⚠ 再点一次确认彻底卸载" : "彻底卸载")
+        ),
+        updated
+          ? h("div", { className: "dru-msg dru-msg-ok" },
+              "✅ 更新已完成，最新代码已就位。请", h("strong", null, "重启 dsh web"), "后生效；桌面 bridge 会随系统自启自动运行新版本。")
+          : null,
+        log ? h("div", { className: "dru-up-log", title: "更新日志（尾部）" }, log) : null,
+        selfMsg ? h("div", { className: "dru-msg dru-msg-" + selfMsg.kind }, selfMsg.text) : null,
+        h("div", { className: "dru-hint", style: { marginTop: 8 } },
+          armed ? "卸载会移除插件引用与本地文件；远程控制用的桌面 bridge 与数据目录保留，可随时重新安装。" :
+            "插件市场没有更新/卸载按钮（dsh 官方市场暂不提供），本卡片即官方管理入口：检测新版、一键在线更新、彻底卸载都在这里完成。")
+      );
+    }
+
     // ── 面板主体（渲染于设置页 settings.section 栏目内） ─────────────────────
     function RemoteControlSection(props) {
 
@@ -1023,6 +1183,8 @@ window.__ModuleLoader__.load({
             h("div", { className: "dru-hint", style: { marginBottom: 6 } }, "③ 也可以自建：项目完全开源，有服务器可自行部署，流量走自己的服务器，闭环自控。"),
             h("div", { className: "dru-hint" }, "④ 一句话总结：简单省心用 SaaS，技术玩家可自建。")
           ]),
+          // 版本与更新（自管理：检测新版 / 一键在线更新 / 彻底卸载）
+          h(SelfManageCard, null),
           message && h("div", { className: "dru-msg dru-msg-" + message.kind }, message.text)
         );
       }

package/packages/dsh-remote-ui/lib/index.js

@@ -4,12 +4,17 @@
 //   - 读写 dsh-remote-open/.dsh-config.json（0600）
 //   - 查询/启停 bridge（launchctl，plist 缺失时自动生成，逻辑与 dsh-setup.mjs 一致）
 //   - 代理 relay API（captcha / register / login / public-config），直连、不走系统代理
+//   - 自管理 self*（版本可见 / 新版检测 / 一键在线更新 / 彻底卸载）：插件市场没有更新卸载按钮，
+//     面板内即官方管理入口；更新=后台 npx @mrrisega/dsh-remote@latest（幂等补齐运行环境并重启 bridge）
+//   - 运行时自愈：缺运行环境自动后台安装、登录后自动拉起 bridge（0.4.2 起）
+//   - 0.1.2+ ?token 浏览器鉴权会话代持（0.4.1 起）
 //
 // 不依赖任何第三方包：只使用 node 内置模块与 cordis 注入的 webServer 服务。
-import { readFileSync, writeFileSync, mkdirSync, existsSync, realpathSync, accessSync, chmodSync, openSync, rmSync, constants as fsConstants } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, realpathSync, accessSync, chmodSync, openSync, closeSync, rmSync, constants as fsConstants } from "node:fs";
 import { join, dirname } from "node:path";
 import { execSync, spawn } from "node:child_process";
 import { homedir, hostname, platform } from "node:os";
+import { fileURLToPath } from "node:url";
 
 /** 本插件在 host 侧的服务依赖。 */
 export const inject = ["webServer"];
@@ -59,6 +64,89 @@ function preferredNode() {
 
 const NODE_BIN = preferredNode();
 
+/**
+ * 解析 npx 绝对路径。DeepSeek App 拉起 dsh web 时 PATH 只有 /usr/bin:/bin:/usr/sbin:/sbin
+ * （没有 /opt/homebrew/bin 等），裸 `npx` 会 spawn ENOENT 而静默失败——必须按绝对路径找，
+ * 且子进程 env 的 PATH 要把当前 node 所在目录补在最前（npx 的 #!/usr/bin/env node 依赖它）。
+ */
+function npxCommand() {
+  const name = process.platform === "win32" ? "npx.cmd" : "npx";
+  const dirs = [
+    dirname(process.execPath),           // 与当前 node 同目录（homebrew/usr/local 均可覆盖）
+    process.env.DSH_SETUP_NPX_DIR || "",
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/opt/homebrew/opt/node@20/bin",
+    "/usr/local/opt/node@20/bin",
+    "/usr/bin",
+  ].filter(Boolean);
+  for (const d of dirs) {
+    const real = resolveExecutable(join(d, name));
+    if (real) return real;
+  }
+  return name; // 全找不到 → 退回裸名（普通 shell 场景仍可用）
+}
+
+/** 子进程环境：把 node 目录补进 PATH（npx 及其 shebang 需要），可附加额外变量。 */
+function spawnEnv(extra) {
+  const nodeDir = dirname(process.execPath);
+  const base = process.env.PATH || "";
+  const PATH = [nodeDir, base, "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin"].filter(Boolean).join(":");
+  return { ...process.env, PATH, ...(extra || {}) };
+}
+
+// ---------- 后台子进程标记（防重入 + 宿主重启自愈） ----------
+// marker 内容 = JSON {pid, at}：pid 供“宿主重启后立即清理死进程残留”判断；
+// 兼容旧格式（纯时间戳数字 → 只按超时清理）。
+
+function readMarkerInfo(filePath) {
+  try {
+    const raw = readFileSync(filePath, "utf8").trim();
+    const j = JSON.parse(raw);
+    if (Number.isInteger(j?.pid) || Number.isInteger(j?.at)) return j;
+  } catch { /* 非 JSON → 数字时间戳或空 */ }
+  const t = Number(raw || "0");
+  return Number.isFinite(t) && t > 0 ? { pid: null, at: t } : null;
+}
+
+function writeMarker(filePath, pid) {
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify({ pid: pid ?? null, at: Date.now() }), { mode: 0o600 });
+}
+
+/** pid 是否存活（ESRCH=已死）。 */
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return null; // 未知 → 由超时规则兜底
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM" ? true : false; // EPERM=存在但无权限
+  }
+}
+
+/**
+ * 清理残留标记：宿主 dsh web 在后台安装/更新期间被重启/强杀时，子进程清理回调随之丢失，
+ * 若只按“30 分钟超时”清理，用户会在这半小时内反复遇到“已有更新进行中/正在安装”。
+ * 现在：记录 pid → 重启后立刻清掉已死进程的标记；pid 不可读的旧标记仍按超时兜底。
+ */
+function sweepStaleMarkers(relayDir) {
+  const now = Date.now();
+  for (const name of [PROVISION_MARKER, UPDATE_MARKER]) {
+    const p = join(relayDir, name);
+    let info;
+    try { info = readMarkerInfo(p); } catch { continue; }
+    if (!info) continue;
+    const dead = pidAlive(info.pid);
+    const expired = now - info.at > STALE_MARKER_MS;
+    if (dead === false || (dead === null && expired)) {
+      try { rmSync(p, { force: true }); } catch { /* ignore */ }
+      appendLogLine(relayDir, AUTO_INSTALL_LOG,
+        `[dsh-remote-ui] 清理残留标记 ${name}（pid=${info.pid ?? "?"}, at=${new Date(info.at).toISOString()}${dead === false ? ", 进程已死" : ", 已超时"}）`);
+    }
+  }
+}
+
 /** 读取 JSON body。 */
 async function readJsonBody(req) {
   let raw = "";
@@ -254,6 +342,23 @@ function manualStatus() {
 
 const PROVISION_MARKER = ".dsh-setup-installing";
 const AUTO_INSTALL_LOG = ".dsh-setup-install.log";
+const STALE_MARKER_MS = 30 * 60 * 1000; // 超过该时长视为上次进程残留，插件启动时清理
+
+/** 向日志追加一行（多个子进程写同一日志用 append 模式，互不覆盖）。 */
+function appendLogLine(relayDir, name, line) {
+  try {
+    const fd = openSync(join(relayDir, name), "a");
+    try {
+      writeFileSync(fd, `\n${line}\n`);
+    } finally {
+      closeSync(fd);
+    }
+  } catch { /* 非关键 */ }
+}
+
+/**
+ * 清理“进程残留”标记的实现见上方小工具区 sweepStaleMarkers（pid 存活 + 超时双保险）。
+ */
 
 /** 插件市场只装了 UI 插件;若桌面缺 dsh-remote 运行环境(dsh-setup.mjs=bridge/自启动),
  * 由插件在后台自动执行一次 `npx @mrrisega/dsh-remote` 补齐,用户无需手动跑命令。
@@ -264,13 +369,23 @@ function ensureRuntime(relayDir) {
   if (existsSync(marker)) return false; // 正在安装中
   try {
     mkdirSync(relayDir, { recursive: true });
-    writeFileSync(marker, String(Date.now()), { mode: 0o600 });
     const log = join(relayDir, AUTO_INSTALL_LOG);
-    const npx = process.platform === "win32" ? "npx.cmd" : "npx";
-    const child = spawn(npx, ["--yes", "@mrrisega/dsh-remote"], {
+    const child = spawn(npxCommand(), ["--yes", "@mrrisega/dsh-remote"], {
       detached: true,
+      env: spawnEnv(),
       stdio: ["ignore", openSync(log, "a"), openSync(log, "a")]
     });
+    writeMarker(marker, child.pid); // 记 pid：宿主重启后可立即清理死进程残留
+    const clear = () => { try { rmSync(marker, { force: true }); } catch { /* ignore */ } };
+    child.on("exit", (code) => {
+      clear();
+      appendLogLine(relayDir, AUTO_INSTALL_LOG, `[auto-install] npx 退出 code=${code ?? "?"}`);
+    });
+    child.on("error", (e) => {
+      clear();
+      appendLogLine(relayDir, AUTO_INSTALL_LOG, `[auto-install] 启动失败: ${e.message}`);
+      console.warn(`[dsh-remote-ui] 自动安装子进程启动失败: ${e.message}`);
+    });
     child.unref();
     console.log(`[dsh-remote-ui] 检测到缺少桌面运行环境,已在后台自动安装(日志: ${log}),完成后将自动启动 bridge`);
     return false;
@@ -331,14 +446,15 @@ function scheduleRuntime(relayDir) {
       const cfg = loadConfig(relayDir);
       const hasAcct = Boolean((cfg.phone || cfg.email) && cfg.password) || Boolean(cfg.local_key);
       if (!hasAcct) return;
+      // 先看服务是否已在运行（runtime 可能位于 npx 缓存/固化目录，不必重复安装）
+      const st = launchdStatus();
+      if (st.running) { done = true; clearInterval(iv); return; }
       const setupUrl = join(relayDir, "dsh-setup.mjs");
       if (!existsSync(setupUrl)) {
-        ensureRuntime(relayDir);
+        ensureRuntime(relayDir); // 什么环境都没有 → 后台 npx 安装一次
         return;
       }
-      const st = launchdStatus();
-      if (st.running) { done = true; clearInterval(iv); return; }
-      startBridge(relayDir);
+      startBridge(relayDir); // 环境在但服务没起 → 拉起
     } catch { /* 下一轮再试 */ }
   }, 12_000);
   iv.unref?.();
@@ -592,11 +708,172 @@ async function proxyFeedback(relayDir, req, res, pathname) {
   }
 }
 
+// ---------- 自管理：版本 / 在线更新 / 彻底卸载（面板内“版本与更新”卡片） ----------
+
+/** 插件自身发布版本（与 dsh-remote 根包同步递增）。 */
+const PLUGIN_VERSION = "0.4.4";
+const UPDATE_LOG = ".dsh-update.log";
+const UPDATE_MARKER = ".dsh-update-running";
+
+/** 查询 npm 最新版（官方源优先，失败回退 npmmirror；纯服务端无 CORS 限制）。 */
+async function npmLatestVersion() {
+  for (const reg of ["https://registry.npmjs.org/@mrrisega/dsh-remote", "https://registry.npmmirror.com/@mrrisega/dsh-remote"]) {
+    try {
+      const res = await fetch(reg, { signal: AbortSignal.timeout(8000) });
+      if (!res.ok) continue;
+      const j = await res.json();
+      if (j && j["dist-tags"] && typeof j["dist-tags"].latest === "string") return j["dist-tags"].latest;
+    } catch { /* 试下一个源 */ }
+  }
+  return "";
+}
+
+/** 以 detached 子进程执行 `npx --yes @mrrisega/dsh-remote@latest`（env 可覆盖 npm 源）。 */
+function spawnUpdater(relayDir, extraEnv) {
+  const log = join(relayDir, UPDATE_LOG);
+  return spawn(npxCommand(), ["--yes", "@mrrisega/dsh-remote@latest"], {
+    detached: true,
+    cwd: homedir(),
+    env: spawnEnv(extraEnv), // PATH 补 node 目录：App 最小 PATH 下也能跑 npx
+    stdio: ["ignore", openSync(log, "a"), openSync(log, "a")]
+  });
+}
+
+/**
+ * 后台执行在线一键更新：npx @mrrisega/dsh-remote@latest（幂等自愈：补运行环境/更新 bridge/重写 include）。
+ * 稳健性：
+ *   - npx 用绝对路径 + PATH 补全解析（App 拉起的 dsh web PATH 最小化时不再 ENOENT 静默失败）；
+ *   - 默认 npx 源（国内常为 npmmirror）未同步到最新版导致失败时，自动用官方 npm 源重试一次；
+ *   - marker 记录 pid，子进程退出/出错即清理；宿主重启后由 sweepStaleMarkers 立即清掉死进程残留。
+ */
+function runOnlineUpdate(relayDir) {
+  try {
+    mkdirSync(relayDir, { recursive: true });
+    const marker = join(relayDir, UPDATE_MARKER);
+    if (existsSync(marker)) return { ok: false, detail: "已有更新在进行中，请稍候" };
+    appendLogLine(relayDir, UPDATE_LOG, `[update] 开始在线更新 @mrrisega/dsh-remote@latest (${new Date().toISOString()})`);
+
+    let retried = false;
+    const clear = () => { try { rmSync(marker, { force: true }); } catch { /* ignore */ } };
+    const run = () => {
+      const child = spawnUpdater(relayDir, retried ? { npm_config_registry: "https://registry.npmjs.org" } : {});
+      writeMarker(marker, child.pid);
+      child.on("exit", (code) => {
+        if (!retried && code !== 0) {
+          retried = true;
+          appendLogLine(relayDir, UPDATE_LOG, `[update] 默认源安装失败(exit=${code})，改用官方 npm 源重试…`);
+          run();
+          return;
+        }
+        appendLogLine(relayDir, UPDATE_LOG, `[update] npx 退出 code=${code ?? "?"}（默认源${retried ? "/官方源" : ""}）`);
+        clear();
+      });
+      child.on("error", (e) => {
+        appendLogLine(relayDir, UPDATE_LOG, `[update] 子进程启动失败: ${e.message}`);
+        clear();
+      });
+      child.unref();
+      return child;
+    };
+    const child = run();
+    return { ok: true, pid: child.pid, log: join(relayDir, UPDATE_LOG) };
+  } catch (e) {
+    try { rmSync(join(relayDir, UPDATE_MARKER), { force: true }); } catch { /* ignore */ }
+    return { ok: false, detail: String(e.message || e) };
+  }
+}
+
+/** 读日志尾部(更新进度展示)。 */
+function tailOf(filePath, lines = 24) {
+  try {
+    const all = readFileSync(filePath, "utf8").split("\n");
+    return all.slice(-lines).join("\n");
+  } catch { return ""; }
+}
+
+/** 彻底卸载（兼容市场“拒绝改写用户补丁”的场景）：移除 include、依赖、bundle、本地目录与链接。 */
+function uninstallSelf(relayDir, profileDir, patchFile, pkgFile) {
+  const out = { removedPatch: false, removedDep: false, removedDir: false, removedBundle: false };
+  try {
+    const patch = readFileSync(patchFile, "utf8");
+    const cleaned = patch
+      .replace(/\n?# >>> dsh-remote-ui .*?# <<< dsh-remote-ui\s*/s, "\n")
+      .replace(/\n{3,}/g, "\n\n")
+      .trimEnd() + "\n";
+    if (cleaned !== patch) { writeFileSync(patchFile, cleaned); out.removedPatch = true; }
+  } catch { /* 无 patch 忽略 */ }
+  try {
+    const pkg = JSON.parse(readFileSync(pkgFile, "utf8"));
+    if (pkg.dependencies && pkg.dependencies["dsh-remote-ui"]) { delete pkg.dependencies["dsh-remote-ui"]; out.removedDep = true; }
+    const bundles = pkg.dsh && pkg.dsh.profile && Array.isArray(pkg.dsh.profile.bundles) ? pkg.dsh.profile.bundles : null;
+    if (bundles) {
+      const i = bundles.indexOf("dsh-remote-ui");
+      if (i >= 0) { bundles.splice(i, 1); out.removedBundle = true; }
+    }
+    if (out.removedDep || out.removedBundle) writeFileSync(pkgFile, JSON.stringify(pkg, null, 2) + "\n");
+  } catch { /* 无 package.json 忽略 */ }
+  try {
+    rmSync(join(profileDir, "dsh-remote-ui-plugin"), { recursive: true, force: true });
+    rmSync(join(profileDir, "node_modules", "dsh-remote-ui"), { recursive: true, force: true });
+    out.removedDir = true;
+  } catch { /* ignore */ }
+  return out;
+}
+
 // ---------- 路由 ----------
 
 /** 路由表：{method, path, handler}。 */
 function registerRoutes(ctx, relayDir) {
+  // 本插件所在 profile(由插件自身文件位置推导,覆盖市场 git 安装与本地 include 两种形态)
+  let profileDir = join(homedir(), ".dsh", "profiles", "web");
+  try {
+    const here = fileURLToPath(import.meta.url);
+    // 依次尝试两种安装布局；split()[0] 未命中时返回原串，需显式判断后再试下一种
+    let m = here.split("/dsh-remote-ui-plugin/")[0];
+    if (m === here) m = here.split("/node_modules/dsh-remote-ui/")[0];
+    if (m !== here) profileDir = m;
+  } catch { /* 保持默认 */ }
   const routes = [
+    // 自管理：版本信息 / 检查更新 / 一键更新 / 更新日志 / 彻底卸载
+    {
+      method: "GET",
+      path: "/dsh-remote/self",
+      handler: async (_req, res) => {
+        const runtimeReady = existsSync(join(relayDir, "dsh-setup.mjs"));
+        sendJson(res, 200, { ok: true, version: PLUGIN_VERSION, runtimeReady, relayDir });
+      },
+    },
+    {
+      method: "GET",
+      path: "/dsh-remote/self/update-check",
+      handler: async (_req, res) => {
+        const latest = await npmLatestVersion();
+        const current = PLUGIN_VERSION;
+        sendJson(res, 200, { ok: true, current, latest, outdated: !!latest && latest !== current });
+      },
+    },
+    {
+      method: "POST",
+      path: "/dsh-remote/self/update",
+      handler: async (_req, res) => {
+        sendJson(res, 200, { ok: true, ...runOnlineUpdate(relayDir) });
+      },
+    },
+    {
+      method: "GET",
+      path: "/dsh-remote/self/update-log",
+      handler: async (_req, res) => {
+        sendJson(res, 200, { ok: true, running: existsSync(join(relayDir, UPDATE_MARKER)), log: tailOf(join(relayDir, UPDATE_LOG)) });
+      },
+    },
+    {
+      method: "POST",
+      path: "/dsh-remote/self/uninstall",
+      handler: async (_req, res) => {
+        const r = uninstallSelf(relayDir, profileDir, join(profileDir, "cordis.patch.yml"), join(profileDir, "package.json"));
+        sendJson(res, 200, { ok: true, ...r, detail: "已移除插件引用与本地文件，重启 dsh web 后完全卸载生效" });
+      },
+    },
     {
       method: "GET",
       path: "/dsh-remote/status",
@@ -865,6 +1142,8 @@ function registerRoutes(ctx, relayDir) {
  */
 export function apply(ctx, config = {}) {
   const relayDir = config.relayDir || process.env.DSH_RELAY_DIR || DEFAULT_RELAY_DIR;
+  // 清理上次进程残留的安装/更新 marker（宿主被重启/强杀时子进程清理回调会丢失）
+  sweepStaleMarkers(relayDir);
   ctx.effect(() => registerRoutes(ctx, relayDir), "dsh-remote-ui: /dsh-remote routes");
   // 0.1.2-rc.1+ 浏览器会话代持：换取 Harness 会话 Cookie 供 bridge 上游携带（手机点设备不再 401 白页）
   ctx.effect(() => scheduleHarnessMint(ctx, relayDir), "dsh-remote-ui: harness browser-session mint");

package/packages/dsh-remote-ui/test/self-manage.test.mjs

@@ -0,0 +1,213 @@
+// 插件 node 半「自管理」回归：/dsh-remote/self | update-check | update | update-log | uninstall。
+// 覆盖用户三项诉求对应的机制：
+//   1) 插件市场没有「更新按钮」→ 面板内 self* 路由提供版本检测与一键在线更新；
+//   2) 市场无法卸载（我们的 include 引用挡住）→ uninstall 路由移除 include/依赖/bundle/本地文件；
+//   3) 版本可见 + 新版本检测 + 稳健更新（含残留 marker 清理兜底逻辑在 apply 时执行）。
+import assert from "node:assert/strict";
+import http from "node:http";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtemp, mkdir, rm, writeFile, readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { apply } from "../lib/index.js";
+
+const PLUGIN_BLOCK = `# >>> dsh-remote-ui (managed by dsh-remote plugin; do not edit)
+- type: plugin
+  name: dsh-remote-ui
+  apply: dsh-remote-ui
+# <<< dsh-remote-ui
+`;
+
+/** 加载插件（tempHome 可覆盖 os.homedir()，供 uninstall 的默认 profile 推导用）。 */
+function boot(tempHome, relayDir) {
+  const routes = new Map();
+  const previousHome = process.env.HOME;
+  if (tempHome) process.env.HOME = tempHome;
+  try {
+    apply({
+      webServer: { register(route) { routes.set(route.path, route.handler); return () => {}; } },
+      effect(register) { return register(); },
+      logger: { info() {}, warn() {} }
+    }, { relayDir });
+  } finally {
+    if (tempHome) process.env.HOME = previousHome;
+  }
+  return routes;
+}
+
+/** 起一个指向 routes 的 http server，返回 base url。 */
+async function serve(routes) {
+  const host = http.createServer((req, res) => {
+    const url = new URL(req.url, "http://x");
+    const handler = routes.get(url.pathname);
+    (handler || ((_r, rs) => { rs.writeHead(404); rs.end(); }))(req, res);
+  });
+  await new Promise((resolve) => host.listen(0, "127.0.0.1", resolve));
+  return { host, base: `http://127.0.0.1:${host.address().port}` };
+}
+
+test("self 路由：版本可见 + 运行环境状态（无 npx 环境时不谎报已就绪）", async () => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-ui-self-"));
+  try {
+    const routes = boot(null, tempDir);
+    const { host, base } = await serve(routes);
+    try {
+      const self = await (await fetch(`${base}/dsh-remote/self`)).json();
+      assert.equal(self.ok, true);
+      assert.match(self.version, /^\d+\.\d+\.\d+$/, `version 应为 semver，实际 ${self.version}`);
+      assert.equal(self.runtimeReady, false, "temp 目录没有 dsh-setup.mjs → runtimeReady=false");
+      assert.equal(self.relayDir, tempDir);
+    } finally {
+      host.close();
+    }
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("update-check 路由：从 npm 检测新版本（dist-tags.latest 9.9.9 > 当前）", async () => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-ui-upchk-"));
+  const origFetch = globalThis.fetch;
+  try {
+    const routes = boot(null, tempDir);
+    const { host, base } = await serve(routes);
+    // 假 npm 源：registry 请求回 9.9.9，其余请求（本测试自身的 HTTP 调用）走真实 fetch
+    globalThis.fetch = async (url, init) => {
+      if (String(url).startsWith("https://registry.")) {
+        return { ok: true, status: 200, json: async () => ({ "dist-tags": { latest: "9.9.9" } }) };
+      }
+      return origFetch(url, init);
+    };
+    try {
+      const r = await (await fetch(`${base}/dsh-remote/self/update-check`)).json();
+      assert.equal(r.ok, true);
+      assert.equal(r.latest, "9.9.9");
+      assert.equal(r.outdated, true, "9.9.9 > 当前版本 → outdated 应为 true");
+      assert.notEqual(r.current, r.latest);
+    } finally {
+      host.close();
+    }
+  } finally {
+    globalThis.fetch = origFetch;
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("update-log 路由：running 由 marker 决定，日志返回尾部", async () => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-ui-uplog-"));
+  try {
+    const routes = boot(null, tempDir);
+    const { host, base } = await serve(routes);
+    try {
+      // 无 marker：不 running
+      let r = await (await fetch(`${base}/dsh-remote/self/update-log`)).json();
+      assert.equal(r.ok, true);
+      assert.equal(r.running, false);
+
+      // 写入 marker + 日志 → running=true 且返回日志尾部
+      const lines = Array.from({ length: 30 }, (_, i) => `line ${i}`);
+      await writeFile(path.join(tempDir, ".dsh-update-running"), String(Date.now()));
+      await writeFile(path.join(tempDir, ".dsh-update.log"), lines.join("\n"));
+      r = await (await fetch(`${base}/dsh-remote/self/update-log`)).json();
+      assert.equal(r.running, true);
+      assert.ok(r.log.includes("line 29"), "日志应含尾部内容");
+      assert.ok(!r.log.includes("line 0"), "日志过长时应只截尾部（tailOf 生效）");
+    } finally {
+      host.close();
+    }
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("update 路由：已有更新进行中时拒绝重复触发（防重入）", async () => {
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "dsh-ui-up-"));
+  try {
+    const routes = boot(null, tempDir);
+    const { host, base } = await serve(routes);
+    try {
+      await writeFile(path.join(tempDir, ".dsh-update-running"), String(Date.now()));
+      const r = await (await fetch(`${base}/dsh-remote/self/update`, { method: "POST" })).json();
+      assert.equal(r.ok, false);
+      assert.match(String(r.detail), /进行中/, `detail 应提示进行中，实际: ${r.detail}`);
+    } finally {
+      host.close();
+    }
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("残留 marker 自愈：记录进程已死的 marker 在插件启动时立即清理（不等 30 分钟超时）", () => {
+  const tempDir = mkdtempSync(path.join(os.tmpdir(), "dsh-ui-sweep-"));
+  try {
+    // 模拟“宿主在更新途中被重启”：更新子进程已死，但清理回调随旧宿主丢失
+    const deadPid = 2147483647; // 不可能存在的 pid
+    writeFileSync(path.join(tempDir, ".dsh-setup-installing"), JSON.stringify({ pid: deadPid, at: Date.now() }));
+    writeFileSync(path.join(tempDir, ".dsh-update-running"), JSON.stringify({ pid: deadPid, at: Date.now() }));
+    writeFileSync(path.join(tempDir, ".dsh-config.json"), "{}");
+    boot(null, tempDir); // apply() → sweepStaleMarkers
+    assert.equal(existsSync(path.join(tempDir, ".dsh-setup-installing")), false, "死进程的安装 marker 应被立即清理");
+    assert.equal(existsSync(path.join(tempDir, ".dsh-update-running")), false, "死进程的更新 marker 应被立即清理");
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("uninstall 路由：移除 include 块 + package.json 依赖/bundle + 本地目录（解锁市场卸载）", async () => {
+  const tempHome = await mkdtemp(path.join(os.tmpdir(), "dsh-ui-home-"));
+  const relayDir = path.join(tempHome, "relay");
+  await mkdir(relayDir, { recursive: true });
+  // 模拟真实 profile 布局：cordis.patch.yml + package.json + 本地插件目录/链接
+  const profile = path.join(tempHome, ".dsh", "profiles", "web");
+  await mkdir(path.join(profile, "dsh-remote-ui-plugin"), { recursive: true });
+  await mkdir(path.join(profile, "node_modules", "dsh-remote-ui"), { recursive: true });
+  const patchFile = path.join(profile, "cordis.patch.yml");
+  const pkgFile = path.join(profile, "package.json");
+  await writeFile(patchFile, `base: .\ninclude:\n${PLUGIN_BLOCK}  - other-plugin\n`);
+  await writeFile(pkgFile, JSON.stringify({
+    dependencies: { "dsh-remote-ui": "github:mrRisega/dsh-remote#path:/packages/dsh-remote-ui", "other": "^1.0.0" },
+    dsh: { profile: { bundles: ["dsh-remote-ui", "other-bundle"] } },
+  }));
+  await writeFile(path.join(profile, "dsh-remote-ui-plugin", "index.js"), "// stub");
+  await writeFile(path.join(profile, "node_modules", "dsh-remote-ui", "index.js"), "// stub");
+  await writeFile(path.join(relayDir, ".dsh-config.json"), "{}");
+
+  try {
+    // 关键：以 tempHome 为 HOME 启动，profileDir 默认推导才会落在 temp profile 而非真实 ~/.dsh
+    const routes = boot(tempHome, relayDir);
+    const { host, base } = await serve(routes);
+    try {
+      const r = await (await fetch(`${base}/dsh-remote/self/uninstall`, { method: "POST" })).json();
+      assert.equal(r.ok, true);
+      assert.equal(r.removedPatch, true, "应移除 patch 中的 include 块");
+      assert.equal(r.removedDep, true, "应移除 package.json 依赖");
+      assert.equal(r.removedBundle, true, "应移除 dsh.profile.bundles 条目");
+      assert.equal(r.removedDir, true, "应删除本地插件目录与 node_modules 链接");
+
+      const patch = await readFile(patchFile, "utf8");
+      assert.ok(!patch.includes("dsh-remote-ui"), "patch 不应再引用 dsh-remote-ui");
+      assert.ok(patch.includes("other-plugin"), "其他插件 include 不应被误伤");
+
+      const pkg = JSON.parse(await readFile(pkgFile, "utf8"));
+      assert.equal(pkg.dependencies["dsh-remote-ui"], undefined, "依赖应被删除");
+      assert.equal(pkg.dependencies["other"], "^1.0.0", "其他依赖应保留");
+      assert.deepEqual(pkg.dsh.profile.bundles, ["other-bundle"], "其他 bundle 应保留");
+    } finally {
+      host.close();
+    }
+  } finally {
+    await rm(tempHome, { recursive: true, force: true });
+  }
+});
+
+test("源码约束：浏览器半提供版本与更新卡片（含彻底卸载确认）", () => {
+  const source = readFileSync(new URL("../lib/client.js", import.meta.url), "utf8");
+  assert.match(source, /🔄 版本与更新/);
+  assert.match(source, /dsh-remote\/self\/update-check/);
+  assert.match(source, /一键更新/);
+  assert.match(source, /彻底卸载/);
+  assert.match(source, /dsh-remote\/self\/uninstall/);
+  assert.match(source, /再点一次确认彻底卸载/);
+});