@tanweilabs/daiti 0.0.3 → 0.0.5

package/README.md

@@ -2,19 +2,29 @@
 
 在你的电脑上运行，通过网页或微信使用的个人助理。基于 DeepSeek Harness 和 DSH-IM，通过独立插件提供单主会话、助理设置和首次使用流程。
 
-**0.0.3 为开发者预览版。** 本包不包含个人记忆、历史会话、密钥或 IM 登录数据。
+**0.0.5 为开发者预览版。** 本包不包含个人记忆、历史会话、密钥或 IM 登录数据。
 
 ## 安装
 
 需要 Node.js `^22.19.0` 或 `>=24.0.0`：
 
 ```sh
-npm install -g @tanweilabs/daiti@0.0.3
+npm install -g @tanweilabs/daiti@0.0.5
 daiti start
 ```
 
 启动后自动打开本机网页。可用 `daiti status`、`daiti open` 和 `daiti stop` 管理服务。
 
+## 查看版本与升级
+
+```sh
+daiti version        # 当前版本；有新版本时会提示
+daiti update --check # 只检查
+daiti update         # 安装最新版并自动重启服务（服务原本在跑才重启）
+```
+
+设置页"助理"下方也会显示当前版本。`start`/`status` 同样会打印版本；`daiti update` 会写进 `service.log`。
+
 ## 从源码体验
 
 安装 Node.js `^22.19.0` 或 `>=24.0.0`，然后在仓库根目录运行：
@@ -79,7 +89,7 @@ npm run pack:local
 
 构建将四个插件打包到 `artifacts/`，生成文件名和 SHA-256 清单。`pack:local` 在 `.local/releases/` 生成 CLI 安装包；包含运行入口、插件包和文档，不包含仓库工作目录、上游源码、个人配置或测试数据。
 
-未发布的本地安装包可用 `npm install -g /path/to/tanweilabs-daiti-0.0.3.tgz` 安装，随后使用 `daiti start`。安装仍需联网获取声明的运行依赖。
+未发布的本地安装包可用 `npm install -g /path/to/tanweilabs-daiti-0.0.5.tgz` 安装，随后使用 `daiti start`。安装仍需联网获取声明的运行依赖。
 
 - `bin/`、`lib/`：CLI 和后台进程管理。
 - `packages/assistant-ui/`：界面、首次设置和助理配置。
@@ -98,3 +108,5 @@ npm run pack:local
 ## 许可证
 
 代体代码采用 MIT；依赖保留各自许可证。见 [LICENSE](LICENSE) 和 [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md)。本项目不是 DeepSeek 官方客户端。
+
+发布维护步骤见 [发布指南](docs/releasing.md)。

package/artifacts/manifest.json

@@ -2,27 +2,27 @@
   "plugins": [
     {
       "name": "@tanweilabs/daiti-ui",
-      "version": "0.0.3",
-      "file": "tanweilabs-daiti-ui-0.0.3-5625684c363a.tgz",
-      "sha256": "5625684c363a28b912cb6862c2063f2c304dfa02039127a16dd1a7a1b0a7f6e5"
+      "version": "0.0.5",
+      "file": "tanweilabs-daiti-ui-0.0.5-35ca52ba5687.tgz",
+      "sha256": "35ca52ba5687592caeafc3a0e879b1ee0d95f89ec5c32458d2204eae46165331"
     },
     {
       "name": "@tanweilabs/daiti-preferences",
-      "version": "0.0.3",
-      "file": "tanweilabs-daiti-preferences-0.0.3-8137cd254b7b.tgz",
-      "sha256": "8137cd254b7be52ff8219be31bcfd466d50a727b5a888d1b1324e5017a5b0797"
+      "version": "0.0.5",
+      "file": "tanweilabs-daiti-preferences-0.0.5-501242b3c269.tgz",
+      "sha256": "501242b3c2693dc3787ed0907a8f2ab8c24e5fcd9519f1ad91b637e7477859cb"
     },
     {
       "name": "@tanweilabs/daiti-loading",
-      "version": "0.0.3",
-      "file": "tanweilabs-daiti-loading-0.0.3-b61364395143.tgz",
-      "sha256": "b613643951436c2e565b953a6a04a7d0c2cdcc619fae6bc98d7cddb535b27b77"
+      "version": "0.0.5",
+      "file": "tanweilabs-daiti-loading-0.0.5-25d3a3be10fb.tgz",
+      "sha256": "25d3a3be10fb4ecbaa5f84083fa557ff6886986cea1a96909db607bb543f1a94"
     },
     {
       "name": "@tanweilabs/daiti-im",
-      "version": "0.0.3",
-      "file": "tanweilabs-daiti-im-0.0.3-52e45084fd59.tgz",
-      "sha256": "52e45084fd59d83bc9abba3c4a06fcab2578fe7430e99619a1fa490cb339dbb2"
+      "version": "0.0.5",
+      "file": "tanweilabs-daiti-im-0.0.5-840b72814195.tgz",
+      "sha256": "840b72814195ccf1f3c65283265b8fb8794441ae0d396cb005a68ae7b55f3e99"
     }
   ]
 }

package/docs/releasing.md

@@ -0,0 +1,68 @@
+# npm 发布指南（供维护者与 AI 使用）
+
+包名为 `@tanweilabs/daiti`，发布到官方 registry；GitHub 仓库为 `tanweilabs/daiti`。Git 提交、Git 标签和 npm 发布是三件独立的事。只有 Git 标签不表示 npm 已发布；本机安装的版本也不证明 npm 上存在。
+
+发布必须有用户明确授权。不得为了绕过二次验证而降低账户安全配置。以下以 0.0.5 为例，后续替换版本号；已经发布的版本不可覆盖。
+
+## 1. 检查与同步版本
+
+在产品仓库根目录执行：
+
+```sh
+git status --short
+npm whoami
+npm view @tanweilabs/daiti versions dist-tags --json --registry https://registry.npmjs.org/
+```
+
+保留他人未提交改动，不使用 reset/clean。同步根 `package.json`、`packages/*/package.json`、`npm-shrinkwrap.json` 的顶层与 `packages[""].version`、README 安装示例。不要改动依赖的版本来凑产品版本。
+
+## 2. 验证、构建、检查实际安装包
+
+```sh
+npm test
+npm run build
+mkdir -p .local/releases
+npm pack --json --pack-destination .local/releases
+ tar -tzf .local/releases/tanweilabs-daiti-0.0.5.tgz
+```
+
+检查外层文件清单及 `artifacts/` 内的四个插件包：版本一致，许可证保留，没有个人工作目录、聊天、密钥、登录数据、日志或 `.local/` 文件。运行逻辑有改动时，用独立 `DAITI_HOME` 验证启动/状态/停止、重复启动及重启后主会话不变，不接入用户的真实微信账号。不要将服务 ready 等同于真实消息收发验收。
+
+发布的是检查过的 `.tgz`，不是另一次临时生成的目录包。若修改了任何发布文件，重新构建和打包。
+
+## 3. 提交与标签
+
+在用户授权范围内，逐项检查并暂存此次发布文件，提交、推送。创建 `v0.0.5` 标签并推送；若标签已存在，核对其提交，不强行移动或覆盖。提交 ID 和实际安装包摘要保留在发布结果中。
+
+## 4. npm 发布：必须保留交互终端
+
+```sh
+npm publish .local/releases/tanweilabs-daiti-0.0.5.tgz --access public --registry https://registry.npmjs.org/ --auth-type=web
+```
+
+AI 使用终端工具时设置 **`tty: true`**。保留返回的终端 `session_id`，不要关闭等待中的进程。非交互发布可能直接报 `EOTP`，即 npm 要求本次发布的二次验证，不代表包有问题或未登录。
+
+终端显示 `https://www.npmjs.com/auth/cli/...` 后，按回车打开浏览器；若页面未打开，把本次链接打开并交给用户完成验证。每次使用新链接，不复制旧发布的认证链接。登录状态不代表以后每次发布都可免二次验证。不向用户索取或记录长期 Token、OTP、认证链接到仓库。
+
+用户说验证完成后，继续读取**原终端会话**的输出，不要立即重新执行 publish。若会话失效，先查询 registry 和日志确认是否已接受发布，避免重复发布。
+
+## 5. 分清“接受发布”和“可下载”
+
+`+ @tanweilabs/daiti@0.0.5` 表示 npm 接受了发布；若同时显示 processing，仍可能暂时查询不到。此时不能立刻声称用户已可安装，也不要反复发布。
+
+```sh
+npm view @tanweilabs/daiti@0.0.5 version dist.shasum --json --registry https://registry.npmjs.org/
+npm view @tanweilabs/daiti dist-tags --json --registry https://registry.npmjs.org/
+```
+
+确认版本可查询、`dist.shasum` 与 `npm pack --json` 的 shasum 一致，以及 `latest` 指向目标版本。若具体版本已可查询但标签仍旧，先排除短暂同步延迟；确需修正且用户授权默认发布时，可执行 `npm dist-tag add @tanweilabs/daiti@0.0.5 latest --registry https://registry.npmjs.org/`（也可能触发验证）。遇到 E403/权限错误先核对账号与组织权限，不能把所有错误都归因于 EOTP。
+
+## 6. 用户升级
+
+```sh
+daiti stop
+npm install -g @tanweilabs/daiti@0.0.5
+daiti start
+```
+
+在独立终端执行，不能让代体在自己的运行会话里关闭自身后再负责启动。升级不应更换 `DAITI_HOME`；保留现有数据并先备份。其他浏览器提示无权限时运行 `daiti open` 打开认证入口。

package/docs/validation.md

@@ -65,3 +65,11 @@
 - 未验证（发布前已知）：真实的浏览器会话里 Team 工具是否按预期出现；"标准模式"预设内自带的子代理工具行不受 profile patch 影响，可能与 Team 的 `list_agents`／`send_message` 同名共存（参数不同），需要真实会话验收；Team 策略会引导 Lead 使用 `wait_agent`（10s–1h），是否加重主会话阻塞待观察。
 
 ## 2026-09-21 自动端口选择（0.0.2）
+
+## 2026-09-21 版本可见与自助升级（0.0.4）
+
+- 新增 `daiti version`：打印当前版本，并从 npm 查询最新版本，有新版本时提示运行 `daiti update`；查不到网络时明确说明而不是静默。
+- 新增 `daiti update [--check]`：`--check` 只比对；不带参数时 `npm install -g @tanweilabs/daiti@<latest>`，若服务原本在跑则先 stop、再用**全局安装的** `bin/daiti.mjs` 拉起新版本，最后等就绪并打印端口；原本没跑就只装不启动。安装失败或服务未就绪都会抛错，不静默当作成功。
+- `start`／`status` 现在打印版本行，并把带时间戳的版本记录写进 `service.log`；设置页「助理」下方显示 `代体 v<版本>` 与升级命令。
+- `npm test` 39 项通过（新增 2 项：版本读取与版本比较、`update/version` 参数校验；原有参数断言补 `check: false`）；`npm run build` 通过，四个插件包升到 0.0.4。
+- 未验证：`daiti update` 的**真实升级路径**（需要有比当前更高的已发布版本才能端到端验证）、升级中断电或网络失败时的恢复、Windows 下的 `npm root -g` 路径。

package/lib/cli.mjs

@@ -20,14 +20,16 @@ export async function atomicJson(file, value) {
   await fs.rename(temp, file);
 }
 export function parseArgs(args) {
-  const command = args[0] || 'help'; let port = 3086, open = true, portExplicit = false;
+  const command = args[0] || 'help'; let port = 3086, open = true, portExplicit = false, check = false;
   for (let i = 1; i < args.length; i++) {
     if (args[i] === '--no-open') open = false;
+    else if (args[i] === '--check') check = true;
     else if (args[i] === '--port') { const value = args[++i]; if (!/^\d+$/.test(value || '') || +value < 1024 || +value > 65535) throw new Error('--port must be between 1024 and 65535'); port = +value; portExplicit = true; }
     else throw new Error(`Unknown option: ${args[i]}`);
   }
-  if (!['setup','start','stop','status','open','help','--help','-h'].includes(command)) throw new Error(`Unknown command: ${command}`);
-  return { command, port, open, portExplicit };
+  if (!['setup','start','stop','status','open','update','version','help','--help','-h'].includes(command)) throw new Error(`Unknown command: ${command}`);
+  if (check && command !== 'update') throw new Error('--check is only valid with daiti update');
+  return { command, port, open, portExplicit, check };
 }
 export function runtimeBin() {
   const require = createRequire(path.join(root, 'package.json'));
@@ -67,7 +69,10 @@ export function orderedBundles(bundles, available = () => true) {
   for (const name of ['@xmanrui/dsh-im', '@tanweilabs/daiti-im']) {
     if (unique.includes(name) && !available(name)) throw new Error(`Profile bundle ${name} is unavailable; run npm ci.`);
   }
-  const known = bundleOrder.filter(name => unique.includes(name) && available(name));
+  // Package manifest exports are not a reliable availability check: built-in
+  // bundles resolve through Harness, and some plugins do not export package.json.
+  // Preserve configured layers; let the Harness loader resolve or report them.
+  const known = bundleOrder.filter(name => unique.includes(name));
   if (known.includes('@xmanrui/dsh-im') && known.includes('@tanweilabs/daiti-im') && known.indexOf('@xmanrui/dsh-im') > known.indexOf('@tanweilabs/daiti-im')) throw new Error('Profile bundle order would register the IM service twice.');
   return [...known, ...unique.filter(name => !bundleOrder.includes(name))];
 }
@@ -145,12 +150,76 @@ export async function openUrl(url) {
   const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
   await new Promise((resolve, reject) => { const child = spawn(cmd, args, { stdio: 'ignore' }); child.on('error', reject); child.on('exit', code => code === 0 ? resolve() : reject(new Error('Browser could not be opened.'))); });
 }
+/** Version of the package this process was loaded from. */
+export function runningVersion(directory = root) { try { return createRequire(path.join(root, 'package.json'))(path.join(directory, 'package.json')).version; } catch { return 'unknown'; } }
+/** Where `npm install -g` put this package, so an update can restart the new one. */
+export async function globalRoot() {
+  try { const { stdout } = await execFileAsync('npm', ['root', '-g']); return path.join(stdout.trim(), '@tanweilabs', 'daiti'); } catch { return null; }
+}
+/** Version installed for `npm install -g`, however that prefix resolves. */
+export async function installedVersion() {
+  const directory = await globalRoot();
+  if (directory) { const version = await runningVersion(directory); if (version !== 'unknown') return version; }
+  return runningVersion();
+}
+/** Latest published version, or null when the registry cannot be reached. */
+export async function latestVersion() {
+  try { const { stdout } = await execFileAsync('npm', ['view', '@tanweilabs/daiti', 'dist-tags.latest']); return stdout.trim() || null; } catch { return null; }
+}
+/** Compare semver-ish strings; a prerelease sorts before its release. */
+export function compareVersions(left, right) {
+  const parse = value => String(value).split('-')[0].split('.').map(part => Number.parseInt(part, 10) || 0);
+  const a = parse(left); const b = parse(right);
+  for (let i = 0; i < Math.max(a.length, b.length); i++) { if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) > (b[i] ?? 0) ? 1 : -1; }
+  return left === right ? 0 : left.includes('-') ? -1 : 1;
+}
+/** One-line summary of what version this machine runs, for humans and the log. */
+export async function versionNote(service) {
+  const running = service ? (service.version || 'unknown') : runningVersion();
+  const latest = await latestVersion();
+  const head = service ? `代体运行版本 v${running}（已安装 v${runningVersion()}）` : `代体已安装 v${running}`;
+  if (!latest) return `${head}（无法连接 npm 查询最新版本）`;
+  if (running === 'unknown') return `${head}，重启后可识别运行版本`;
+  if (compareVersions(running, latest) > 0) return `${head}（本地版本；npm 最新 v${latest}）`;
+  if (compareVersions(latest, running) > 0) return `${head} → 有新版本 v${latest}，运行 daiti update 升级`;
+  return `${head}（已是最新）`;
+}
+/** Install the published version and restart the service when it was running. */
+export async function update(p, options = {}) {
+  const running = runningVersion();
+  const latest = await latestVersion();
+  if (!latest) throw new Error('无法从 npm 查询最新版本；检查网络后重试。');
+  const outdated = compareVersions(latest, running) > 0;
+  if (options.check) { console.log(outdated ? `有新版本：v${running} → v${latest}` : `已是最新：v${running}`); return { running, latest, updated: false }; }
+  if (!outdated) { console.log(`已是最新：v${running}`); return { running, latest, updated: false }; }
+  const wasRunning = Boolean(await control(await readJson(p.state)));
+  console.log(`正在安装 v${latest}…`);
+  await execFileAsync('npm', ['install', '-g', '@tanweilabs/daiti@' + latest, '--ignore-scripts']);
+  if (!wasRunning) { console.log(`已更新到 v${latest}。下次 daiti start 会用新版本。`); return { running, latest, updated: true }; }
+  const state = await readJson(p.state);
+  console.log('正在重启服务…');
+  await control(state, 'stop');
+  for (let i = 0; i < 60; i++) { if (!(await control(state))) break; await pause(250); }
+  const global = await globalRoot();
+  const entry = global ? path.join(global, 'bin/daiti.mjs') : path.join(root, 'bin/daiti.mjs');
+  const child = spawn(process.execPath, [entry, 'start'], { detached: true, stdio: 'ignore' });
+  await new Promise(resolve => child.once('spawn', resolve));
+  child.unref();
+  for (let i = 0; i < 240; i++) {
+    const next = await control(await readJson(p.state));
+    if (next?.ready) { console.log(`已更新到 v${latest}：http://127.0.0.1:${next.port}/`); return { running, latest, updated: true }; }
+    await pause(250);
+  }
+  throw new Error(`已安装 v${latest}，但服务没有就绪；查看 ${p.log}`);
+}
 export async function main(argv = process.argv.slice(2)) {
   const options = parseArgs(argv); const p = paths();
-  if (['help','--help','-h'].includes(options.command)) { console.log('daiti setup | start [--port 3086] [--no-open] | stop | status | open\nDAITI_HOME selects isolated application data (default ~/.daiti).'); return; }
+  if (['help','--help','-h'].includes(options.command)) { console.log('daiti start [--port 3086] [--no-open] | stop | status | open | update [--check] | version\nDAITI_HOME selects isolated application data (default ~/.daiti).'); return; }
   if (options.command === 'setup') { await setup(p); console.log(`Daiti prepared: ${p.home}`); return; }
   let current = await control(await readJson(p.state));
-  if (options.command === 'status') { console.log(current ? `Daiti ${current.ready ? 'running' : 'starting'}: http://127.0.0.1:${current.port}/` : 'Daiti stopped'); return; }
+  if (options.command === 'version') { console.log(await versionNote()); return; }
+  if (options.command === 'update') { await update(p, options); return; }
+  if (options.command === 'status') { console.log(await versionNote(current)); console.log(current ? `Daiti ${current.ready ? 'running' : 'starting'}: http://127.0.0.1:${current.port}/` : 'Daiti stopped'); return; }
   if (options.command === 'stop') {
     const state = await readJson(p.state);
     if (!current) { console.log('Daiti stopped (no verified owned service).'); return; }
@@ -159,11 +228,13 @@ export async function main(argv = process.argv.slice(2)) {
     throw new Error('Service is still stopping; no unrelated process was signalled.');
   }
   if (options.command === 'open' && !current?.ready) throw new Error('Daiti is not ready. Run daiti start first.');
+  const note = await versionNote();
   if (options.command === 'start' && !current) {
     // Fail clearly before installing anything when a fixed port is occupied.
     if (options.portExplicit) await selectPort(options.port, false);
     await setup(p);
     const log = await fs.open(p.log, 'a', 0o600); await log.chmod(0o600);
+    await log.write(`\n${new Date().toISOString()} ${note}\n`);
     const child = spawn(process.execPath, [path.join(root, 'lib/supervisor.mjs'), String(options.port), options.portExplicit ? 'fixed' : 'auto'], { detached: true, stdio: ['ignore', log.fd, log.fd], env: { ...process.env, DAITI_HOME: p.home } });
     await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
     child.unref(); await log.close();
@@ -172,5 +243,6 @@ export async function main(argv = process.argv.slice(2)) {
   }
   if (!current?.ready) throw new Error('Daiti is still starting.');
   if (options.open || options.command === 'open') await openUrl(current.url);
+  console.log(note);
   console.log(`Daiti running: http://127.0.0.1:${current.port}/ (use daiti open for authenticated access)`);
 }

package/lib/supervisor.mjs

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { selectPort } from './ports.mjs';
-import { paths, atomicJson, runtimeBin, runtimePath, root } from './cli.mjs';
+import { paths, atomicJson, runtimeBin, runtimePath, root, runningVersion } from './cli.mjs';
 
 
 // Browser launch authentication exchanges a URL token for a cookie.
@@ -38,6 +38,7 @@ export async function verifyLaunchUrl(value) {
 // Only this parent signals its own ChildProcess. CLI clients never signal a PID
 // obtained from disk, so stale state / PID reuse cannot terminate another app.
 export async function supervise({ p = paths(), port, autoPort = false, command = process.execPath, args, timeoutMs = 60000 }) {
+  const version = runningVersion();
   const lockPath = path.join(p.home, 'service.lock');
   let lock;
   try { lock = await fs.open(lockPath, 'wx', 0o600); }
@@ -50,7 +51,7 @@ export async function supervise({ p = paths(), port, autoPort = false, command =
     if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(403).end(); return; }
     res.setHeader('Content-Type', 'application/json');
     if (req.method !== 'POST' || !['/status', '/stop'].includes(req.url)) { res.writeHead(404).end('{}'); return; }
-    res.end(JSON.stringify({ instance, ready, port, ...(ready ? { url } : {}) }));
+    res.end(JSON.stringify({ instance, ready, port, version, ...(ready ? { url } : {}) }));
     if (req.url === '/stop') stop();
   });
   function stop() {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@tanweilabs/daiti",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@tanweilabs/daiti",
-      "version": "0.0.3",
+      "version": "0.0.5",
       "license": "MIT",
       "dependencies": {
         "@deepseek-ai/dsh": "0.1.6-alpha.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanweilabs/daiti",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "代体：本地运行、通过网页和 IM 使用的个人助理。",
   "type": "module",
   "license": "MIT",