dsh-cliproxyapi-pro 1.5.0 → 1.6.0

package/lib/client.js

@@ -12,6 +12,8 @@ window.__ModuleLoader__.load({
     const PACKAGE_NAME = "dsh-cliproxyapi-pro";
     const MODULE_ID = "dsh-cliproxyapi-pro";
     const NS = "dsh-cliproxyapi-pro";
+    // Stable id of the account/model page in the Settings left navigation.
+    const SETTINGS_SECTION_ID = "cliproxyapi";
 
     // Document-relative API paths (compatible with <base href="./"> in DSH Web/Desktop)
     const API = {
@@ -26,6 +28,17 @@ window.__ModuleLoader__.load({
       updateDownload: "api/dsh-cliproxyapi/updates/download",
     };
 
+    // Public, versioned dshmarket Update API (UPDATE-API-V1.md in dshmarket).
+    // Installation is delegated to the market; this plugin never runs a
+    // package manager. Paths are document-relative like API above.
+    const MARKET_API = {
+      capabilities: "dsh-market/api/v1/capabilities",
+      updates: "dsh-market/api/v1/updates",
+      operations: "dsh-market/api/v1/operations",
+      restart: "dsh-market/api/v1/restart",
+    };
+    const MARKET_SCHEMA = "dsh-market/update-api/v1";
+
     const zh = {
       nav: "CLIProxyAPI",
       title: "CLIProxyAPI 自动发现与模型筛选",
@@ -123,6 +136,7 @@ window.__ModuleLoader__.load({
       paramsHint: "留空并保存即恢复 CLIProxyAPI 自动探测值。修改后请点击「保存模型勾选」才会写入模型选择器。",
       discoveredValue: "探测值",
       updateTitle: "插件更新",
+      updatePageHint: "这里只管理插件自身的更新。CLIProxyAPI 的账号、模型和协议设置位于「设置」左侧导航的「CLIProxyAPI」页。",
       updateToggleDetails: "展开或收起插件更新设置",
       updateCompactCurrent: "当前 {version}",
       updateCompactAvailable: "有新版本 {version}",
@@ -131,7 +145,9 @@ window.__ModuleLoader__.load({
       updateCompactStatusUnavailable: "更新服务未就绪",
       updateCompactErrorNetwork: "网络异常",
       updateCompactErrorChannel: "通道未发布",
-      updateStatusUnavailableHint: "无法读取更新服务，可能是插件宿主代码尚未重载：重载插件后刷新页面，或检查更新接口是否可用。",
+      updateStatusUnavailableHint: "无法读取更新服务，可能是插件宿主代码尚未重载：重启 DSH（仅刷新页面不够），或检查更新接口是否可用。",
+      updateServiceUnavailableError: "更新服务未就绪：当前运行的插件宿主代码仍是旧版，可能尚未重启 DSH。重启 DSH 后重试。",
+      updateOriginError: "请求来源校验未通过，更新操作已拒绝。请从 DSH 打开的页面重试；使用反向代理时请保持与页面一致的地址访问。",
       updateSubtitle: "仅更新 CLIProxyAPI 插件自身，不更新 CPA 服务或 DSH 宿主。设置修改后立即保存。",
       updateNewVersion: "新版本",
       updateVersionSummary: "当前版本 {current} · 最新版本 {latest}",
@@ -194,7 +210,51 @@ window.__ModuleLoader__.load({
       updateDownloadPathLabel: "已校验的离线包",
       updateUpgradeCommandLabel: "关闭 DSH 后执行升级命令",
       updateCommandUnavailable: "未生成升级命令。请先确认 DSH 支持的离线包升级方式；升级前关闭 DSH，完成后重新启动。",
-      updateOfflineHint: "自动下载不等于自动安装。插件不会关闭、重启 DSH，也不会覆盖正在使用的插件文件。",
+      updateOfflineHint: "离线包下载不会自动安装。本插件自身不会运行包管理器、关闭或重启 DSH；一键更新和自动安装都交给 DSH 插件市场（dshmarket）完成。",
+      updateCompactInstalled: "{version} 已安装",
+      updateMarketLabel: "通过插件市场更新",
+      updateMarketDetecting: "正在检测 DSH 插件市场…",
+      updateMarketReadyHint: "已检测到 DSH 插件市场（dshmarket），可一键安装新版本。安装和版本解析都由插件市场完成，可能需要重启 DSH 或刷新页面才能生效。",
+      updateMarketUnavailableHint: "未检测到 DSH 插件市场（dshmarket）的更新接口。安装插件市场后即可在此一键更新或自动更新；目前可使用下方的离线包下载。",
+      updateMarketLinkedHint: "当前为本地链接安装，不通过插件市场安装，以免替换源码链接。",
+      updateMarketInstallBtn: "立即更新",
+      updateMarketInstalledBtn: "已安装",
+      updateMarketInstalling: "正在通过插件市场安装…",
+      updateMarketProgress: "正在通过插件市场安装… {percent}%",
+      updateMarketRedetectBtn: "重新检测",
+      updateMarketConfirmTitle: "通过插件市场安装版本 {version}？",
+      updateMarketConfirmHint: "DSH 插件市场会安装本插件的新版本，并在安装后核对实际装上的版本，不一致时恢复原版本。安装期间请勿关闭 DSH；完成后可能需要重启 DSH 或刷新页面。",
+      updateMarketConfirmBtn: "确认安装",
+      updateMarketAutomaticPrefix: "自动更新：",
+      updateMarketInstalled: "已安装版本 {version}。",
+      updateMarketVersionLower: "插件市场安装的是 {installed}，低于检查到的 {target}：插件市场按其自身的通道与镜像解析版本。",
+      updateMarketRestartHint: "重启 DSH 后新版本生效。",
+      updateMarketRestartDesktopHint: "请完全退出 DSH 桌面版并重新打开，新版本才会生效。",
+      updateMarketRestartManualHint: "请重启 DSH 服务，新版本才会生效。",
+      updateMarketRefreshHint: "刷新页面后新版本界面生效。",
+      updateMarketAppliedHint: "新版本已生效；若界面仍是旧版，请刷新页面。",
+      updateMarketRestartBtn: "重启 DSH",
+      updateMarketRestarting: "正在请求重启…",
+      updateMarketRestartRequested: "已请求重启 DSH，页面将在 DSH 重新启动后恢复。",
+      updateMarketRefreshBtn: "刷新页面",
+      updateMarketUnchanged: "插件市场报告完成，但插件版本没有变化。",
+      updateMarketCancelled: "插件市场的安装任务已取消。",
+      updateMarketRolledBack: "插件市场已回滚此次更新，插件保持原版本。",
+      updateMarketForceBtn: "仍然安装",
+      updateMarketBusy: "插件市场正在执行另一项更新，请稍后重试。",
+      updateMarketAgentsRunning: "有智能体正在运行，插件市场暂不安装。请等待任务结束后重试。",
+      updateMarketTooFresh: "新版本刚发布，仍在插件市场的发布冷却期内。可稍后重试，或选择「仍然安装」。",
+      updateMarketVersionUnchanged: "插件市场没有解析到更新的版本（镜像可能尚未同步）。可稍后重试，或选择「仍然安装」。",
+      updateMarketDowngrade: "插件市场解析到的版本低于当前版本，已自动恢复，未做更改。",
+      updateMarketMismatch: "插件市场安装的版本与目标版本不一致，已自动恢复。请等待镜像同步后重试。",
+      updateMarketTimeout: "插件市场安装超时，请稍后重试。",
+      updateMarketForbidden: "插件市场拒绝了此次更新请求，请从 DSH 打开的页面重试。",
+      updateMarketLost: "无法继续跟踪插件市场的安装任务（DSH 可能已重启）。请重新检查更新以确认当前版本。",
+      updateMarketUnreachable: "无法连接 DSH 插件市场的更新接口，请确认 dshmarket 已启用后重试。",
+      updateMarketRestartFailed: "重启请求失败，请手动重启 DSH。",
+      updateMarketFailed: "插件市场安装失败。可在插件市场中查看详情，稍后重试，或使用离线包下载。",
+      updateAutoInstallLabel: "自动安装更新",
+      updateAutoInstallHint: "自动检查发现新版本后，通过 DSH 插件市场自动安装（需开启自动检查并安装 dshmarket，仅在 DSH 页面打开时进行；同一版本 6 小时内最多尝试一次）。生效可能需要重启 DSH 或刷新页面。",
     };
 
     const en = {
@@ -294,6 +354,7 @@ window.__ModuleLoader__.load({
       paramsHint: "Clear a value and save to restore the value discovered from CLIProxyAPI. Click Apply Selected Models to write changes to the picker.",
       discoveredValue: "Discovered",
       updateTitle: "Plugin Updates",
+      updatePageHint: "This page only manages updates of the plugin itself. CLIProxyAPI accounts, models and protocol settings are on the \"CLIProxyAPI\" page in the Settings dialog's left navigation.",
       updateToggleDetails: "Expand or collapse plugin update settings",
       updateCompactCurrent: "Current {version}",
       updateCompactAvailable: "Update {version}",
@@ -302,7 +363,9 @@ window.__ModuleLoader__.load({
       updateCompactStatusUnavailable: "Update service unavailable",
       updateCompactErrorNetwork: "Network error",
       updateCompactErrorChannel: "Channel unpublished",
-      updateStatusUnavailableHint: "Could not reach the update service; the host plugin code may not be reloaded yet. Reload the plugin and refresh the page, or check that the update endpoint is registered.",
+      updateStatusUnavailableHint: "Could not reach the update service; the running host plugin code may still be the previous version. Restart DSH (refreshing the page is not enough), or check that the update endpoint is registered.",
+      updateServiceUnavailableError: "The update service is not ready: the running host plugin code is still the previous version, so DSH may not have been restarted. Restart DSH and retry.",
+      updateOriginError: "The request origin was rejected, so the update action was refused. Retry from the page DSH opened, and reach it through the same address you see (relevant behind a reverse proxy).",
       updateSubtitle: "Updates this CLIProxyAPI plugin only, not the CPA server or DSH. Changes to update settings are saved immediately.",
       updateNewVersion: "New Version",
       updateVersionSummary: "Current {current} · Latest {latest}",
@@ -365,7 +428,51 @@ window.__ModuleLoader__.load({
       updateDownloadPathLabel: "Verified Offline Package",
       updateUpgradeCommandLabel: "Upgrade Command — Run After Closing DSH",
       updateCommandUnavailable: "No upgrade command was generated. First verify the offline-package upgrade method supported by your DSH version. Close DSH before upgrading, then start it again.",
-      updateOfflineHint: "Automatic downloading is not automatic installation. This plugin never closes or restarts DSH, or overwrites plugin files that are in use.",
+      updateOfflineHint: "Downloading an offline package never installs it. This plugin itself never runs a package manager, closes or restarts DSH; one-click and automatic installation are handed to the DSH plugin market (dshmarket).",
+      updateCompactInstalled: "{version} installed",
+      updateMarketLabel: "Update Through Plugin Market",
+      updateMarketDetecting: "Detecting the DSH plugin market…",
+      updateMarketReadyHint: "The DSH plugin market (dshmarket) was detected, so new versions can be installed in one click. The market installs and resolves the version; a DSH restart or page refresh may be needed for it to take effect.",
+      updateMarketUnavailableHint: "The DSH plugin market (dshmarket) update API was not detected. Install the plugin market to enable one-click and automatic updates here; until then, use the offline package download below.",
+      updateMarketLinkedHint: "This is a linked local installation, so it is not installed through the plugin market, which would replace the source link.",
+      updateMarketInstallBtn: "Update Now",
+      updateMarketInstalledBtn: "Installed",
+      updateMarketInstalling: "Installing through the plugin market…",
+      updateMarketProgress: "Installing through the plugin market… {percent}%",
+      updateMarketRedetectBtn: "Detect Again",
+      updateMarketConfirmTitle: "Install version {version} through the plugin market?",
+      updateMarketConfirmHint: "The DSH plugin market installs the new version of this plugin, then verifies the version it actually placed and restores the previous one on a mismatch. Keep DSH open while it runs; a DSH restart or page refresh may be needed afterwards.",
+      updateMarketConfirmBtn: "Confirm Install",
+      updateMarketAutomaticPrefix: "Automatic update:",
+      updateMarketInstalled: "Version {version} is installed.",
+      updateMarketVersionLower: "The plugin market installed {installed}, older than the checked {target}: the market resolves versions with its own channel and mirror.",
+      updateMarketRestartHint: "Restart DSH for the new version to take effect.",
+      updateMarketRestartDesktopHint: "Quit the DSH desktop app completely and reopen it for the new version to take effect.",
+      updateMarketRestartManualHint: "Restart the DSH service for the new version to take effect.",
+      updateMarketRefreshHint: "Refresh the page to load the new interface.",
+      updateMarketAppliedHint: "The new version is active; refresh the page if the interface still looks old.",
+      updateMarketRestartBtn: "Restart DSH",
+      updateMarketRestarting: "Requesting restart…",
+      updateMarketRestartRequested: "A DSH restart was requested. The page recovers once DSH is back.",
+      updateMarketRefreshBtn: "Refresh Page",
+      updateMarketUnchanged: "The plugin market reported success, but the plugin version did not change.",
+      updateMarketCancelled: "The plugin market cancelled the installation.",
+      updateMarketRolledBack: "The plugin market rolled this update back; the previous version is kept.",
+      updateMarketForceBtn: "Install Anyway",
+      updateMarketBusy: "The plugin market is running another update. Retry shortly.",
+      updateMarketAgentsRunning: "Agents are running, so the plugin market will not install now. Retry when they finish.",
+      updateMarketTooFresh: "This release is still inside the plugin market's release-age wait. Retry later, or choose Install Anyway.",
+      updateMarketVersionUnchanged: "The plugin market did not resolve a newer version (its mirror may still be syncing). Retry later, or choose Install Anyway.",
+      updateMarketDowngrade: "The plugin market resolved a version older than the current one and restored it; nothing changed.",
+      updateMarketMismatch: "The plugin market installed a version other than the target and restored the previous one. Retry after the mirror catches up.",
+      updateMarketTimeout: "The plugin market installation timed out. Retry later.",
+      updateMarketForbidden: "The plugin market refused this update request. Retry from the page DSH opened.",
+      updateMarketLost: "The plugin market operation can no longer be followed (DSH may have restarted). Check for updates again to confirm the current version.",
+      updateMarketUnreachable: "Could not reach the DSH plugin market update API. Make sure dshmarket is enabled and retry.",
+      updateMarketRestartFailed: "The restart request failed. Restart DSH manually.",
+      updateMarketFailed: "The plugin market installation failed. See the plugin market for details, retry later, or use the offline package download.",
+      updateAutoInstallLabel: "Automatically Install Updates",
+      updateAutoInstallHint: "Install versions found by automatic checks through the DSH plugin market (requires Auto Check and dshmarket; runs only while a DSH page is open, at most once per version every 6 hours). A DSH restart or page refresh may be needed for it to take effect.",
     };
 
     const CSS = `
@@ -856,7 +963,9 @@ window.__ModuleLoader__.load({
 .dcpa-update-summary-current { flex: 0 1 auto; }
 .dcpa-update-summary-status { flex: 1; text-align: right; }
 .dcpa-update-summary-status[data-state="available"],
-.dcpa-update-summary-status[data-state="downloaded"] { color: var(--dsw-alias-brand-primary); }
+.dcpa-update-summary-status[data-state="downloaded"],
+.dcpa-update-summary-status[data-state="installing"],
+.dcpa-update-summary-status[data-state="installed"] { color: var(--dsw-alias-brand-primary); }
 .dcpa-update-summary-status[data-state="error"] { color: var(--dsw-alias-state-error-primary); }
 .dcpa-update-summary::after {
   content: "";
@@ -985,10 +1094,13 @@ window.__ModuleLoader__.load({
         : "dcpa-dot dcpa-dot-idle";
     }
 
+    const SERVICE_UNAVAILABLE_STATUS = new Set([404, 405, 501]);
     const UPDATE_ERROR_KEYS = {
       "network-error": "updateNetworkError",
       "invalid-metadata": "updateMetadataError",
       "invalid-response": "updateMetadataError",
+      "service-unavailable": "updateServiceUnavailableError",
+      "forbidden-origin": "updateOriginError",
       "channel-unavailable": "updateChannelUnavailable",
       "unavailable-channel": "updateChannelUnavailable",
       "integrity-error": "updateIntegrityError",
@@ -1039,7 +1151,9 @@ window.__ModuleLoader__.load({
         body = await res.json();
       } catch {
         const failure = new Error("Invalid update response");
-        failure.updateCode = "invalid-response";
+        // A missing route (host plugin not reloaded) answers 404/405 with no
+        // update payload; that is "service unavailable", not bad metadata.
+        failure.updateCode = !res.ok && SERVICE_UNAVAILABLE_STATUS.has(res.status) ? "service-unavailable" : "invalid-response";
         if (!res.ok) failure.httpStatus = res.status;
         throw failure;
       }
@@ -1047,7 +1161,8 @@ window.__ModuleLoader__.load({
       if (!res.ok || body?.ok === false || !validState ||
           payload !== undefined && (body.update.error || body.update.errorCode)) {
         const failure = new Error("Update request failed");
-        failure.updateCode = body?.errorCode || body?.update?.errorCode || (!validState ? "invalid-response" : null);
+        failure.updateCode = body?.errorCode || body?.update?.errorCode ||
+          (!validState ? (!res.ok && SERVICE_UNAVAILABLE_STATUS.has(res.status) ? "service-unavailable" : "invalid-response") : null);
         failure.httpStatus = !res.ok ? res.status : null;
         failure.updateState = validState ? body.update : null;
         throw failure;
@@ -1055,8 +1170,303 @@ window.__ModuleLoader__.load({
       return body.update;
     }
 
+    // #region dshmarket installation (Update API v1)
+
+    const MARKET_TERMINAL_STATES = new Set(["succeeded", "failed", "cancelled", "rolled-back"]);
+    const MARKET_POLL_MS = 1500;
+    const MARKET_MAX_POLL_FAILURES = 20;
+    const MARKET_FORCEABLE = new Set(["RELEASE_TOO_FRESH", "VERSION_UNCHANGED"]);
+    const AUTO_INSTALL_FIRST_MS = 15000;
+    const AUTO_INSTALL_INTERVAL_MS = 5 * 60 * 1000;
+    const AUTO_INSTALL_RETRY_MS = 6 * 60 * 60 * 1000;
+    const AUTO_INSTALL_MEMORY_KEY = `${PACKAGE_NAME}:market-auto-install`;
+    const MARKET_ERROR_KEYS = {
+      OPERATION_BUSY: "updateMarketBusy",
+      AGENTS_RUNNING: "updateMarketAgentsRunning",
+      RELEASE_TOO_FRESH: "updateMarketTooFresh",
+      VERSION_UNCHANGED: "updateMarketVersionUnchanged",
+      DOWNGRADE_DETECTED: "updateMarketDowngrade",
+      RESOLVED_VERSION_MISMATCH: "updateMarketMismatch",
+      UPDATE_TIMEOUT: "updateMarketTimeout",
+      UPDATE_FORBIDDEN: "updateMarketForbidden",
+      PLUGIN_NOT_INSTALLED: "updateNotInstalledHint",
+      OPERATION_LOST: "updateMarketLost",
+      MARKET_UNREACHABLE: "updateMarketUnreachable",
+      RESTART_FAILED: "updateMarketRestartFailed",
+    };
+
+    function parseVersion(value) {
+      const match = typeof value === "string"
+        ? /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value)
+        : null;
+      return match ? { parts: match.slice(1, 4).map(Number), pre: match[4] ? match[4].split(".") : [] } : null;
+    }
+
+    /** SemVer precedence, or null when either side is not a version. */
+    function compareVersions(a, b) {
+      const x = parseVersion(a), y = parseVersion(b);
+      if (!x || !y) return null;
+      for (let i = 0; i < 3; i++) if (x.parts[i] !== y.parts[i]) return x.parts[i] > y.parts[i] ? 1 : -1;
+      if (!x.pre.length || !y.pre.length) return x.pre.length ? -1 : y.pre.length ? 1 : 0;
+      for (let i = 0; i < Math.max(x.pre.length, y.pre.length); i++) {
+        const p = x.pre[i], q = y.pre[i];
+        if (p === undefined || q === undefined) return p === undefined ? -1 : 1;
+        if (p === q) continue;
+        const pn = /^\d+$/.test(p), qn = /^\d+$/.test(q);
+        if (pn && qn) return Number(p) > Number(q) ? 1 : -1;
+        if (pn !== qn) return pn ? -1 : 1;
+        return p > q ? 1 : -1;
+      }
+      return 0;
+    }
+
+    function validMarketOperation(value) {
+      return !!value && typeof value === "object" && value.schema === MARKET_SCHEMA &&
+        typeof value.operationId === "string" && value.operationId !== "" &&
+        value.packageName === PACKAGE_NAME && typeof value.state === "string";
+    }
+
+    const marketFailureCode = (operation) =>
+      typeof operation?.failure?.code === "string" && operation.failure.code ? operation.failure.code : "UPDATE_FAILED";
+
+    function marketErrorText(t, code) {
+      return t(Object.prototype.hasOwnProperty.call(MARKET_ERROR_KEYS, code) ? MARKET_ERROR_KEYS[code] : "updateMarketFailed");
+    }
+
+    /**
+     * Shared, page-wide client of the dshmarket Update API. One instance lives
+     * per client activation so the settings card and the background
+     * auto-install runner observe the same operation.
+     */
+    function createMarketUpdater(io = {}) {
+      const doFetch = io.fetch ?? ((url, init) => fetch(url, init));
+      const later = io.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+      const cancelLater = io.clearTimeout ?? ((id) => clearTimeout(id));
+      let state = {
+        phase: "unknown", // unknown | discovering | ready | unavailable
+        runtime: null,
+        restartSupported: false,
+        installing: false,
+        automatic: false,
+        targetVersion: null,
+        operation: null,
+        errorCode: null,
+        restarting: false,
+        restartRequested: false,
+      };
+      const listeners = new Set();
+      const controllers = new Set();
+      let disposed = false;
+      let discovering = null;
+      let pollTimer = null;
+      let pollFailures = 0;
+
+      const set = (patch) => {
+        if (disposed) return;
+        state = { ...state, ...patch };
+        for (const listener of [...listeners]) listener(state);
+      };
+      const request = async (url, init = {}) => {
+        const controller = new AbortController();
+        controllers.add(controller);
+        try {
+          const res = await doFetch(url, { cache: "no-store", ...init, signal: controller.signal });
+          let body = null;
+          try { body = await res.json(); } catch {}
+          return { status: res.status, ok: res.ok, body };
+        } finally {
+          controllers.delete(controller);
+        }
+      };
+      const post = (url, payload) => request(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(payload),
+      });
+      const applyOperation = (operation) => {
+        const done = MARKET_TERMINAL_STATES.has(operation.state);
+        set({
+          operation,
+          installing: !done,
+          errorCode: done && operation.state === "failed" ? marketFailureCode(operation) : null,
+        });
+        if (!done) schedulePoll();
+      };
+      const schedulePoll = () => {
+        if (pollTimer !== null) cancelLater(pollTimer);
+        pollTimer = later(poll, MARKET_POLL_MS);
+      };
+      const poll = async () => {
+        pollTimer = null;
+        const id = state.operation?.operationId;
+        if (disposed || !id) return;
+        try {
+          const { status, body } = await request(`${MARKET_API.operations}?operationId=${encodeURIComponent(id)}`);
+          if (disposed || state.operation?.operationId !== id) return;
+          if (status === 404) {
+            // Operations live in the current Host process only.
+            set({ installing: false, errorCode: "OPERATION_LOST" });
+            return;
+          }
+          if (status !== 200 || !validMarketOperation(body?.operation) || body.operation.operationId !== id) {
+            throw new Error("Invalid market operation");
+          }
+          pollFailures = 0;
+          applyOperation(body.operation);
+        } catch (error) {
+          if (disposed || error?.name === "AbortError") return;
+          if (++pollFailures >= MARKET_MAX_POLL_FAILURES) set({ installing: false, errorCode: "OPERATION_LOST" });
+          else schedulePoll();
+        }
+      };
+
+      return {
+        getState: () => state,
+        subscribe(listener) {
+          listeners.add(listener);
+          return () => listeners.delete(listener);
+        },
+        /** Reads only the local capability document; never contacts a registry. */
+        discover() {
+          if (disposed) return Promise.resolve(state);
+          if (discovering) return discovering;
+          if (state.phase !== "ready") set({ phase: "discovering" });
+          discovering = request(MARKET_API.capabilities)
+            .then(({ ok, body }) => {
+              const usable = ok && body?.schema === MARKET_SCHEMA && body.apiVersion === 1 && body.features?.update === true;
+              set({
+                phase: usable ? "ready" : "unavailable",
+                runtime: usable && typeof body.runtime === "string" ? body.runtime : null,
+                restartSupported: usable && body.features?.restart === true && body.restart?.supported === true,
+              });
+            }, () => {
+              set({ phase: "unavailable", runtime: null, restartSupported: false });
+            })
+            .finally(() => { discovering = null; })
+            .then(() => state);
+          return discovering;
+        },
+        /** Starts one market update operation, then follows it until it settles. */
+        async install({ targetVersion = null, force = false, automatic = false } = {}) {
+          if (disposed || state.phase !== "ready" || state.installing) return state;
+          set({ installing: true, automatic, targetVersion, operation: null, errorCode: null, restartRequested: false });
+          try {
+            const { status, body } = await post(
+              MARKET_API.updates,
+              force ? { packageName: PACKAGE_NAME, force: true } : { packageName: PACKAGE_NAME }
+            );
+            if (disposed) return state;
+            if (status === 202 && validMarketOperation(body?.operation)) {
+              pollFailures = 0;
+              applyOperation(body.operation);
+              return state;
+            }
+            const code = typeof body?.failure?.code === "string" && body.failure.code ? body.failure.code
+              : status === 409 ? "OPERATION_BUSY"
+              : status === 403 ? "UPDATE_FORBIDDEN"
+              : status === 400 ? "UPDATE_REJECTED"
+              : status === 404 ? "MARKET_UNREACHABLE"
+              : "UPDATE_FAILED";
+            set({ installing: false, errorCode: code });
+          } catch (error) {
+            if (!disposed) set({ installing: false, errorCode: error?.name === "AbortError" ? null : "MARKET_UNREACHABLE" });
+          }
+          return state;
+        },
+        /** Only offered when the market reports that it owns process restarts. */
+        async restart() {
+          if (disposed || !state.restartSupported || state.restarting) return state;
+          set({ restarting: true, errorCode: null });
+          try {
+            const { ok } = await post(MARKET_API.restart, {});
+            set({ restarting: false, restartRequested: ok, errorCode: ok ? null : "RESTART_FAILED" });
+          } catch (error) {
+            set({ restarting: false, errorCode: error?.name === "AbortError" ? null : "RESTART_FAILED" });
+          }
+          return state;
+        },
+        dispose() {
+          disposed = true;
+          if (pollTimer !== null) cancelLater(pollTimer);
+          pollTimer = null;
+          for (const controller of controllers) controller.abort();
+          controllers.clear();
+          listeners.clear();
+        },
+      };
+    }
+
+    function readAutoInstallMemory() {
+      try {
+        const raw = JSON.parse(globalThis.localStorage?.getItem(AUTO_INSTALL_MEMORY_KEY) ?? "null");
+        return raw && typeof raw.version === "string" && Number.isFinite(raw.at) ? raw : null;
+      } catch {
+        return null;
+      }
+    }
+
+    function writeAutoInstallMemory(record) {
+      try { globalThis.localStorage?.setItem(AUTO_INSTALL_MEMORY_KEY, JSON.stringify(record)); } catch {}
+    }
+
+    /**
+     * Opt-in automatic installation. The Host's own automatic check finds the
+     * version (channel/region aware); dshmarket installs it. Runs only while a
+     * DSH page is open, reads the local status endpoint only, and tries each
+     * version at most once per {@link AUTO_INSTALL_RETRY_MS} across reloads.
+     */
+    function startAutoInstall(market, io = {}) {
+      const later = io.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+      const cancelLater = io.clearTimeout ?? ((id) => clearTimeout(id));
+      const now = io.now ?? (() => Date.now());
+      const memory = io.memory ?? { read: readAutoInstallMemory, write: writeAutoInstallMemory };
+      const controller = new AbortController();
+      const readStatus = io.readStatus ?? ((signal) => requestPluginUpdate(API.updateStatus, undefined, signal));
+      let stopped = false;
+      let timer = null;
+      const unsubscribe = market.subscribe((state) => {
+        const operation = state.operation;
+        if (state.automatic && operation?.state === "succeeded" && typeof state.targetVersion === "string" &&
+            compareVersions(operation.installedVersion, operation.beforeVersion) === 1) {
+          memory.write({ version: state.targetVersion, at: now(), done: true });
+        }
+      });
+      const tick = async () => {
+        timer = null;
+        try {
+          const status = await readStatus(controller.signal);
+          if (stopped) return;
+          const version = status?.latestVersion;
+          if (status?.autoInstall !== true || status.autoCheck !== true || status.available !== true ||
+              status.blockedReason || typeof version !== "string" || compareVersions(version, status.currentVersion) !== 1) return;
+          const last = memory.read();
+          if (last && last.version === version && (last.done === true || now() - last.at < AUTO_INSTALL_RETRY_MS)) return;
+          if (market.getState().phase !== "ready") await market.discover();
+          const snapshot = market.getState();
+          if (stopped || snapshot.phase !== "ready" || snapshot.installing) return;
+          memory.write({ version, at: now() });
+          await market.install({ targetVersion: version, automatic: true });
+        } catch {
+          // Background work never surfaces errors; the card shows the market state.
+        } finally {
+          if (!stopped) timer = later(tick, AUTO_INSTALL_INTERVAL_MS);
+        }
+      };
+      timer = later(tick, AUTO_INSTALL_FIRST_MS);
+      return () => {
+        stopped = true;
+        if (timer !== null) cancelLater(timer);
+        controller.abort();
+        unsubscribe();
+      };
+    }
+
+    let sharedMarket = null;
+
+    // #endregion
+
     /** Update state is isolated: polling never reloads account data or drafts. */
-    function PluginUpdatePanel({ t }) {
+    function PluginUpdatePanel({ t, market = null, initiallyOpen = false }) {
       const [update, setUpdate] = useState(null);
       const [loading, setLoading] = useState(true);
       const [busy, setBusy] = useState(null);
@@ -1162,6 +1572,21 @@ window.__ModuleLoader__.load({
         }
       }, []);
 
+      // dshmarket state is shared with the background auto-install runner.
+      const [marketState, setMarketState] = useState(() => market?.getState() ?? null);
+      const [confirmInstall, setConfirmInstall] = useState(null);
+      useEffect(() => {
+        if (!market) return undefined;
+        let live = true;
+        const unsubscribe = market.subscribe((next) => { if (live) setMarketState(next); });
+        setMarketState(market.getState());
+        if (market.getState().phase === "unknown") void market.discover();
+        return () => {
+          live = false;
+          unsubscribe();
+        };
+      }, [market]);
+
       const working = loading || busy !== null || update?.checking === true || update?.downloading === true;
       const blockedReason = update?.blockedReason;
       const downloadBlocked = !!blockedReason && blockedReason !== "linked-install";
@@ -1182,7 +1607,17 @@ window.__ModuleLoader__.load({
       const statusError = update?.error || update?.errorCode
         ? { updateCode: update.errorCode }
         : null;
-      const compactState = loading ? "loading" : downloading ? "downloading" : checking ? "checking" :
+      const linkedInstall = blockedReason === "linked-install";
+      const marketReady = marketState?.phase === "ready";
+      const marketOperation = marketState?.operation ?? null;
+      const marketInstalling = marketState?.installing === true;
+      const marketInstalledVersion = marketOperation?.state === "succeeded" &&
+        compareVersions(marketOperation.installedVersion, marketOperation.beforeVersion) === 1
+        ? marketOperation.installedVersion : null;
+      const canMarketInstall = marketReady && !linkedInstall && !downloadBlocked && !marketInstalling &&
+        !marketInstalledVersion && !!update?.available && typeof update.latestVersion === "string" && !!update.latestVersion;
+      const compactState = loading ? "loading" : marketInstalling ? "installing" : downloading ? "downloading" : checking ? "checking" :
+        marketInstalledVersion ? "installed" :
         error || statusError ? "error" : update?.downloadedVersion && update.downloadedVersion === update.latestVersion ? "downloaded" :
           update?.available ? "available" : "idle";
       // Name the actual failure instead of a generic "update error": the
@@ -1192,9 +1627,12 @@ window.__ModuleLoader__.load({
       const compactErrorKey = error
         ? error.source === "status" ? "updateCompactStatusUnavailable" : "updateCompactError"
         : failureCode === "network-error" ? "updateCompactErrorNetwork"
+        : failureCode === "service-unavailable" ? "updateCompactStatusUnavailable"
         : failureCode === "channel-unavailable" ? "updateCompactErrorChannel"
         : "updateCompactError";
-      const compactText = loading ? t("updateLoading") : downloading ? t("updateDownloading") : checking ? t("updateChecking") :
+      const compactText = loading ? t("updateLoading") : marketInstalling ? t("updateMarketInstalling") :
+        downloading ? t("updateDownloading") : checking ? t("updateChecking") :
+        marketInstalledVersion ? t("updateCompactInstalled").replace("{version}", marketInstalledVersion) :
         error || statusError ? t(compactErrorKey) : compactState === "downloaded"
           ? t("updateCompactDownloaded").replace("{version}", update.downloadedVersion)
           : update?.available ? t("updateCompactAvailable").replace("{version}", availableVersion)
@@ -1221,7 +1659,7 @@ window.__ModuleLoader__.load({
             }, t(key))
           )
         );
-      const toggle = (field, label, hint, checked) =>
+      const toggle = (field, label, hint, checked, unavailable = false) =>
         h(
           "div",
           { className: "dcpa-update-row dcpa-switch-row" },
@@ -1235,16 +1673,143 @@ window.__ModuleLoader__.load({
             className: "dcpa-switch",
             "aria-label": t(label),
             "aria-checked": checked,
-            disabled: working || !update,
+            // An unavailable feature can still be switched off, never on.
+            disabled: working || !update || unavailable && !checked,
             onClick: () => { void runAction("save", { [field]: !checked }); },
           }, h("span", { className: "dcpa-switch-thumb" }))
         );
 
+      // One-click/automatic installation through dshmarket. Hidden entirely
+      // when the card is rendered without a market client (tests, previews).
+      let marketSection = null;
+      if (market) {
+        const phase = marketState?.phase ?? "unknown";
+        const hintKey = phase === "ready"
+          ? linkedInstall ? "updateMarketLinkedHint" : "updateMarketReadyHint"
+          : phase === "unavailable" ? "updateMarketUnavailableHint" : "updateMarketDetecting";
+        const operation = marketOperation;
+        const progress = operation?.progress;
+        const percent = typeof progress?.percent === "number" && Number.isFinite(progress.percent) ? Math.round(progress.percent) : null;
+        const errorCode = marketState?.errorCode ?? null;
+        const outcome = operation?.outcome ?? {};
+        const target = marketState?.targetVersion;
+        const prefix = marketState?.automatic ? `${t("updateMarketAutomaticPrefix")} ` : "";
+        let result = null;
+        if (marketInstalling) {
+          result = h("div", { className: "dcpa-update-notice", role: "status" },
+            h("p", { className: "dcpa-label" }, prefix + (percent === null
+              ? t("updateMarketInstalling")
+              : t("updateMarketProgress").replace("{percent}", String(percent))))
+          );
+        } else if (marketInstalledVersion) {
+          const restartHint = outcome.restartRequired
+            ? marketState?.restartSupported ? "updateMarketRestartHint"
+              : marketState?.runtime === "desktop" ? "updateMarketRestartDesktopHint" : "updateMarketRestartManualHint"
+            : outcome.refreshRequired ? "updateMarketRefreshHint" : "updateMarketAppliedHint";
+          result = h("div", { className: "dcpa-update-notice", role: "status" },
+            h("p", { className: "dcpa-success" }, prefix + t("updateMarketInstalled").replace("{version}", marketInstalledVersion)),
+            typeof target === "string" && compareVersions(marketInstalledVersion, target) === -1
+              ? h("p", { className: "dcpa-hint" }, t("updateMarketVersionLower").replace("{installed}", marketInstalledVersion).replace("{target}", target))
+              : null,
+            h("p", { className: "dcpa-hint" }, t(marketState?.restartRequested ? "updateMarketRestartRequested" : restartHint)),
+            outcome.restartRequired && marketState?.restartSupported && !marketState?.restartRequested
+              ? h("div", { className: "dcpa-actions" },
+                  h("button", {
+                    type: "button",
+                    className: "dcpa-btn dcpa-btn-primary",
+                    disabled: marketState?.restarting === true,
+                    onClick: () => { void market.restart(); },
+                  }, marketState?.restarting ? t("updateMarketRestarting") : t("updateMarketRestartBtn")))
+              : !outcome.restartRequired && outcome.refreshRequired
+              ? h("div", { className: "dcpa-actions" },
+                  h("button", {
+                    type: "button",
+                    className: "dcpa-btn dcpa-btn-primary",
+                    onClick: () => { globalThis.location?.reload(); },
+                  }, t("updateMarketRefreshBtn")))
+              : null
+          );
+        } else if (operation?.state === "succeeded") {
+          result = h("div", { className: "dcpa-update-notice", role: "status" },
+            h("p", { className: "dcpa-hint" }, prefix + t("updateMarketUnchanged")));
+        } else if (operation?.state === "cancelled" || operation?.state === "rolled-back") {
+          result = h("div", { className: "dcpa-update-notice", role: "status" },
+            h("p", { className: "dcpa-hint" }, prefix + t(operation.state === "cancelled" ? "updateMarketCancelled" : "updateMarketRolledBack")));
+        }
+        const errorBlock = errorCode && !marketInstalling
+          ? h("div", { className: "dcpa-update-notice" },
+              h("p", { className: "dcpa-error", role: "alert" }, prefix + marketErrorText(t, errorCode)),
+              MARKET_FORCEABLE.has(errorCode) && canMarketInstall
+                ? h("div", { className: "dcpa-actions" },
+                    h("button", {
+                      type: "button",
+                      className: "dcpa-btn",
+                      disabled: working,
+                      onClick: () => { void market.install({ targetVersion: update.latestVersion, force: true }); },
+                    }, t("updateMarketForceBtn")))
+                : null)
+          : null;
+        marketSection = h(React.Fragment, null,
+          h("div", { className: "dcpa-update-row" },
+            h("div", { className: "dcpa-field" },
+              h("span", { className: "dcpa-label" }, t("updateMarketLabel")),
+              h("p", { className: "dcpa-hint" }, t(hintKey))
+            ),
+            phase === "ready" && !linkedInstall
+              ? h("div", { className: "dcpa-actions" },
+                  h("button", {
+                    type: "button",
+                    className: "dcpa-btn dcpa-btn-primary",
+                    disabled: working || !canMarketInstall,
+                    onClick: () => { setConfirmVersion(null); setConfirmInstall(update.latestVersion); },
+                  }, marketInstalling ? t("updateMarketInstalling")
+                    : marketInstalledVersion ? t("updateMarketInstalledBtn") : t("updateMarketInstallBtn")))
+              : phase === "unavailable"
+              ? h("div", { className: "dcpa-actions" },
+                  h("button", { type: "button", className: "dcpa-btn", onClick: () => { void market.discover(); } }, t("updateMarketRedetectBtn")))
+              : null
+          ),
+          confirmInstall ? h("div", {
+            className: "dcpa-update-notice",
+            role: "alertdialog",
+            "aria-modal": false,
+            "aria-label": t("updateMarketConfirmTitle").replace("{version}", confirmInstall),
+          },
+            h("p", { className: "dcpa-label" }, t("updateMarketConfirmTitle").replace("{version}", confirmInstall)),
+            h("p", { className: "dcpa-hint" }, t("updateMarketConfirmHint")),
+            h("div", { className: "dcpa-actions" },
+              h("button", {
+                type: "button",
+                className: "dcpa-btn dcpa-btn-primary",
+                disabled: working || !canMarketInstall || confirmInstall !== update?.latestVersion,
+                onClick: () => {
+                  const version = confirmInstall;
+                  setConfirmInstall(null);
+                  void market.install({ targetVersion: version });
+                },
+              }, t("updateMarketConfirmBtn")),
+              h("button", { type: "button", className: "dcpa-btn", onClick: () => setConfirmInstall(null) }, t("updateCancelBtn"))
+            ),
+            confirmInstall !== update?.latestVersion ? h("p", { className: "dcpa-hint" }, t("updateStaleVersion")) : null
+          ) : null,
+          result,
+          errorBlock
+        );
+      }
+
       // Native details starts closed. Do not control `open`: polling and saves
       // must preserve the user's expanded/collapsed choice without remounting.
+      // `initiallyOpen` (the update-only plugin page) passes a constant `true`
+      // that never changes, so React never rewrites it after mount and the
+      // user can still collapse the card.
       return h(
         "details",
-        { className: "dcpa-card dcpa-update-card", "aria-label": t("updateTitle"), "aria-busy": working },
+        {
+          className: "dcpa-card dcpa-update-card",
+          "aria-label": t("updateTitle"),
+          "aria-busy": working,
+          ...(initiallyOpen ? { open: true } : {}),
+        },
         h("summary", { className: "dcpa-update-summary", title: t("updateToggleDetails") },
           h("span", { className: "dcpa-update-summary-title" }, t("updateTitle")),
           h("span", { className: "dcpa-update-summary-current" },
@@ -1272,9 +1837,9 @@ window.__ModuleLoader__.load({
             }, checking ? t("updateChecking") : !update && !loading ? t("updateRetryBtn") : t("updateCheckBtn")),
             h("button", {
               type: "button",
-              className: "dcpa-btn dcpa-btn-primary",
+              className: marketReady && !linkedInstall ? "dcpa-btn" : "dcpa-btn dcpa-btn-primary",
               disabled: working || !canDownload,
-              onClick: () => setConfirmVersion(update.latestVersion),
+              onClick: () => { setConfirmInstall(null); setConfirmVersion(update.latestVersion); },
             }, downloading ? t("updateDownloading") : update?.downloadedVersion === update?.latestVersion && update?.downloadedVersion
               ? t("updateDownloadedBtn") : t("updateDownloadBtn"))
           )
@@ -1298,6 +1863,7 @@ window.__ModuleLoader__.load({
           ),
           confirmVersion !== update?.latestVersion ? h("p", { className: "dcpa-hint" }, t("updateStaleVersion")) : null
         ) : null,
+        marketSection,
         h("div", { className: "dcpa-update-row" },
           h("div", { className: "dcpa-field" },
             h("span", { className: "dcpa-label" }, t("updateChannelLabel")),
@@ -1319,6 +1885,8 @@ window.__ModuleLoader__.load({
         ),
         toggle("autoCheck", "updateAutoCheckLabel", "updateAutoCheckHint", update?.autoCheck !== false),
         toggle("autoDownload", "updateAutoDownloadLabel", "updateAutoDownloadHint", update?.autoDownload === true),
+        toggle("autoInstall", "updateAutoInstallLabel", "updateAutoInstallHint", update?.autoInstall === true,
+          !marketReady || linkedInstall || downloadBlocked),
         blockedReason ? h("div", { className: "dcpa-update-notice" }, h("p", { className: "dcpa-hint" }, t(blockedKey))) : null,
         update?.downloadedVersion && update?.downloadPath ? h("div", { className: "dcpa-update-notice", role: "status" },
           h("p", { className: "dcpa-label" }, t(blockedReason === "linked-install" ? "updateLinkedDownloadedHint" : "updateDownloadedHint").replace("{version}", update.downloadedVersion)),
@@ -1343,8 +1911,23 @@ window.__ModuleLoader__.load({
     }
 
     /**
-     * Account list + switcher. Each account is edited in its own
-     * {@link AccountPanel}, remounted when the selection changes.
+     * The plugin's own page under Plugins (bundle page and Plugins tab): only
+     * plugin updates. Account and model settings live in their own settings
+     * section ({@link CpaSettingsPanel}).
+     */
+    function PluginUpdatePage({ t }) {
+      return h(
+        "div",
+        { className: "dcpa-wrap", "data-dsh-plugin": MODULE_ID },
+        h("p", { className: "dcpa-hint" }, t("updatePageHint")),
+        h(PluginUpdatePanel, { t, market: sharedMarket, initiallyOpen: true })
+      );
+    }
+
+    /**
+     * Account list + switcher (the "CLIProxyAPI" settings section). Each
+     * account is edited in its own {@link AccountPanel}, remounted when the
+     * selection changes.
      */
     function CpaSettingsPanel({ t }) {
       const [loading, setLoading] = useState(true);
@@ -1496,7 +2079,6 @@ window.__ModuleLoader__.load({
           error ? h("p", { className: "dcpa-error", role: "alert" }, error) : null,
           toast ? h("p", { className: "dcpa-success", role: "status" }, toast) : null
         ),
-        h(PluginUpdatePanel, { t }),
         active
           ? h(AccountPanel, {
               key: active.id,
@@ -2470,7 +3052,37 @@ window.__ModuleLoader__.load({
         );
       }
 
-      // 1. Register on the Bundle detail page in Sidebar -> Plugins -> CLIProxyAPI
+      // dshmarket installation client, shared by the card and the opt-in
+      // background auto-install runner. No DOM writes; timers and requests
+      // are disposed with this activation (HMR/unmount).
+      ctx.effect(() => {
+        const market = createMarketUpdater();
+        sharedMarket = market;
+        const stopAutoInstall = startAutoInstall(market);
+        return () => {
+          stopAutoInstall();
+          market.dispose();
+          if (sharedMarket === market) sharedMarket = null;
+        };
+      }, "dsh-cliproxyapi: market updates");
+
+      // 1. Accounts and models: a page of its own in the Settings dialog's left
+      //    navigation (like dshmarket's "Market" section). The slot owner gives
+      //    unregistered ids the default nav glyph; no DOM is touched here.
+      ctx.slots.inject("settings.section", () =>
+        ctx.slots.register(
+          {
+            name: "settings.section",
+            id: SETTINGS_SECTION_ID,
+            order: 45,
+            label: () => t("nav"),
+            locale: NS,
+          },
+          () => h(CpaSettingsPanel, { t })
+        )
+      );
+
+      // 2. Plugin updates only, on the bundle page in Sidebar -> Plugins.
       ctx.slots.inject("plugins.bundle.config", () =>
         ctx.slots.register(
           {
@@ -2478,11 +3090,11 @@ window.__ModuleLoader__.load({
             key: MODULE_ID,
             locale: NS,
           },
-          (ownerProps = {}) => (ownerProps.view === "summary" ? null : h(CpaSettingsPanel, { t }))
+          (ownerProps = {}) => (ownerProps.view === "summary" ? null : h(PluginUpdatePage, { t }))
         )
       );
 
-      // 2. Register as a dedicated tab in Settings -> Built-in plugins -> CLIProxyAPI
+      // 3. Plugin updates only, as a tab in Settings -> Plugins.
       ctx.slots.inject("settings.plugins.tab", () =>
         ctx.slots.register(
           {
@@ -2492,7 +3104,7 @@ window.__ModuleLoader__.load({
             label: () => t("nav"),
             locale: NS,
           },
-          () => h(CpaSettingsPanel, { t })
+          () => h(PluginUpdatePage, { t })
         )
       );
     }