dsh-cliproxyapi-pro 1.5.1 → 1.6.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this plugin. Versions follow [Semantic Versioning](https://semver.org/).
 
+## 1.6.0 — 2026-10-20
+
+### Changed
+- **Accounts and models moved to the Settings dialog's left navigation.** The account/model page is now its own `settings.section` entry ("CLIProxyAPI"), like the dshmarket "Market" section. The plugin's bundle page (Sidebar → Plugins) and its Built-in plugins tab now contain only plugin updates: a pointer to the new section plus the update card, expanded by default there.
+
+### Fixed
+- **"Check for Updates" always failed on the DSH desktop app.** The desktop shell strips the `Origin` header when it forwards page requests to the Host, and update POSTs (`check`, `save`, `download`) required an explicit exact `Origin`, so every one was refused with `forbidden-origin`. Update POSTs now follow the host connection fence: a missing `Origin` relies on the host session authentication, while a present `Origin` must still be this listener's own authority (compared under its own `http(s)` scheme). A refused origin now has its own localized message.
+
+### Added
+- **One-click updates through the DSH plugin market.** When dshmarket's public Update API v1 is detected (`GET /dsh-market/api/v1/capabilities`), the update card offers **Update Now**: after a version confirmation it submits the update to the market, follows the operation's progress, reports the version actually installed (and warns when it is below the checked target), and shows restart/refresh guidance from the market's outcome, with a restart button only when the market owns restarts. Market failure codes are localized; **Install Anyway** is offered only after a release-age wait or unresolved version. Linked installs are never installed through the market. This plugin still never runs a package manager itself.
+- **Automatic installation (opt-in, `autoInstall`, default off).** With automatic checks on and dshmarket present, a version found by the Host's automatic check is installed through the market while a DSH page is open; each version is tried at most once every 6 hours and never again once installed, and automatic mode never forces. Stored as an optional field of the v1 `update-settings.json`; older files load as off.
+
 ## 1.5.1 — 2026-10-19
 
 ### Fixed

package/README.en.md

@@ -14,7 +14,7 @@ Enter a server URL and an API key, and the plugin reads the CPA model catalog an
 - **Works out of the box**: on the first connection, the newest model of each family in that server's own catalog is checked (at most 12), so the picker isn't flooded with hundreds of models.
 - **Native protocols**: Claude over Anthropic Messages, GPT / Codex / Grok over OpenAI Responses, everything else over OpenAI Chat — fewer protocol translations inside CPA.
 - **Visual management**: check models and edit per-model parameters in the settings panel, or let the DSH agent configure things for you through the `cliproxyapi` tool.
-- **Plugin updates**: automatically check Stable / Beta / Dev channels, choose global / Mainland China sources, and optionally download verified offline packages. Upgrade manually with DSH closed; nothing installs or restarts automatically.
+- **Plugin updates**: automatically check Stable / Beta / Dev channels and choose global / Mainland China sources. With the [DSH plugin market (dshmarket)](https://github.com/dsh-market/dsh-market) installed, new versions install in one click or automatically; otherwise download a verified offline package and upgrade with DSH closed.
 - **Secure**: API keys live only in the DSH credentials service, never in configuration files.
 - **Zero dependencies**: no npm dependencies and no build step; installs in seconds.
 
@@ -49,7 +49,7 @@ The plugin is published on npm as [`dsh-cliproxyapi-pro`](https://www.npmjs.com/
    dsh-cliproxyapi-pro
    ```
 
-   To pin a version, write `dsh-cliproxyapi-pro@1.5.1`.
+   To pin a version, write `dsh-cliproxyapi-pro@1.6.0`.
 4. Click **Install**. When it finishes, the dialog offers to enable the plugin right away — accept it.
 
 > If downloads are slow in mainland China, open **Registry** next to the input and choose **the mainland China mirror**.
@@ -78,7 +78,7 @@ In **Add plugin**, or as the `plugin_manager` `target`, you can also enter:
 
 | Source | What to enter |
 |---|---|
-| A released version | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#v1.5.1` |
+| A released version | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#v1.6.0` |
 | Latest development version | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#main` |
 | Offline package | Download [`dsh-cliproxyapi-pro.tgz`](https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro/releases/latest/download/dsh-cliproxyapi-pro.tgz) (always the latest release) and enter its absolute local path |
 | Local source (development) | Absolute path of a cloned repository; installed as a link, so code changes go live when the plugin reloads |
@@ -87,7 +87,7 @@ All versions are listed under [Releases](https://github.com/TinyBOOOOM/dsh-clipr
 
 ## Getting started
 
-1. **Open the settings panel**: sidebar **Plugins** → **CLIProxyAPI**, or **Settings** → **Built-in plugins** → the **CLIProxyAPI** tab.
+1. **Open the settings panel**: **Settings** → the **CLIProxyAPI** page in the left navigation (accounts, models and protocols live there). The plugin's own updates are on sidebar **Plugins** → **CLIProxyAPI** and on **Settings** → **Built-in plugins** → the **CLIProxyAPI** tab; those two places contain only update features.
 2. **Enter the connection**: under **Connection & Authentication**, fill in the **CLIProxyAPI Base URL** (e.g. `http://127.0.0.1:8317`, without `/v1`) and the **API Key** (leave it empty for a local CPA without authentication), then click **Save & Apply**.
 3. **Choose models**: once connected, **Model Picker Filter** lists every model on the server, with the newest model of each family already checked. Adjust the selection and click **Apply Selected Models**.
 4. **Use them**: open the model picker in a conversation; the models appear in a group named after the account.
@@ -110,7 +110,7 @@ The panel follows the DSH display language; the screenshots show the Chinese UI.
 
 ![Connection settings of a disabled account with its own credential ref](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/connection.png)
 
-**4. Plugin update card (collapsed by default).** The real component is rendered offline with fictional update state: it takes a single row showing the current version and update status, and expands to reveal channels, download regions and automatic-update switches. This is not a live GUI screenshot and does not indicate an actual published version.
+**4. Plugin update card.** The real component is rendered offline with fictional update state (captured when the card still sat collapsed at the top of the account page): a single row shows the current version and update status, and expanding it reveals channels, download regions and automatic-update switches. It now lives alone on the plugin page and starts expanded there. This is not a live GUI screenshot and does not indicate an actual published version.
 
 ![Collapsed plugin update row showing the current version and an available update](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/updates.png)
 
@@ -162,9 +162,9 @@ CPA serves every model on OpenAI Chat, OpenAI Responses and Anthropic Messages,
 
 ## Updating this plugin
 
-The **Plugin Updates** card near the top of the settings panel is collapsed to one row by default, showing only the current version and update status; click it to expand channels, download regions and automatic-update settings. Background checks still follow the saved switches, and polling never resets the expanded state. It manages only `dsh-cliproxyapi-pro`. It does not update the CPA server or DSH, or change CPA routes, accounts or model selections. Update settings save immediately; the card polls independently without reloading unsaved account forms.
+**Plugin Updates** live on the plugin page (sidebar **Plugins** → **CLIProxyAPI**) and on **Settings** → **Built-in plugins** → the **CLIProxyAPI** tab; those places contain only update features, while accounts and models are on the **CLIProxyAPI** page in the Settings dialog's left navigation. On the plugin page the update card starts expanded, with a summary row showing the current version and update status, and can be collapsed at any time. Background checks still follow the saved switches, and polling never resets the expanded state. It manages only `dsh-cliproxyapi-pro`. It does not update the CPA server or DSH, or change CPA routes, accounts or model selections. Update settings save immediately; the card polls independently without reloading unsaved account forms.
 
-> **Downloading is not installing.** Current DSH versions cannot replace an installed plugin while running. This plugin only checks versions and downloads verified offline packages: it never automatically installs, uninstalls, overwrites source code, or restarts DSH. Close DSH before manually upgrading, then start it again.
+> **Installation is handed to the plugin market.** This plugin itself never runs a package manager, uninstalls, overwrites source code, or restarts DSH. With the [DSH plugin market (dshmarket)](https://github.com/dsh-market/dsh-market) installed, the card installs new versions in one click or automatically through the market's public Update API v1. Without the market it can only download and verify an offline package for a manual upgrade with DSH closed.
 
 ### Channels, regions and automatic controls
 
@@ -173,15 +173,26 @@ The **Plugin Updates** card near the top of the settings panel is collapsed to o
 | Update channel | Stable (`stable`) | Stable / Beta / Dev read the npm `latest` / `beta` / `dev` dist-tags respectively. An unpublished Beta / Dev channel reports an error rather than silently falling back to Stable. |
 | Download region | Auto (`auto`) | Auto races global npmjs and Mainland China npmmirror, selecting the first source with **valid version metadata**. Global (`global`) uses only `https://registry.npmjs.org`; Mainland China (`cn`) uses `https://registry.npmmirror.com` and its official `cdn.npmmirror.com` package host. The offline package uses the selected source, with at most 3 HTTPS redirects validated against the host allowlist and exact package/version path; it never falls back across regions. |
 | Automatically check for updates | On | Check about 3 seconds after plugin startup or rescheduling update settings, then every 6 hours. **Check for Updates** remains available when disabled. |
-| Automatically download updates | Off | Download and verify an offline package only when an **automatic check** finds a newer version. Never installs or restarts automatically. Enabling this while automatic checks are off does not trigger background downloads. |
+| Automatically download updates | Off | Download and verify an offline package only when an **automatic check** finds a newer version. Downloading itself never installs or restarts. Enabling this while automatic checks are off does not trigger background downloads. |
+| Automatically install updates | Off | Requires automatic checks and dshmarket (cannot be enabled while the market is not detected). When an **automatic check** finds a newer version, an open DSH page asks the plugin market to install it; each version is tried at most once every 6 hours and never again once installed. Market rules such as its release-age wait still apply, and automatic mode never forces an install. A DSH restart or page refresh may be needed for it to take effect. |
 
 - Strict SemVer comparison offers downloads only when the selected channel is newer than the running version; there is no automatic downgrade. Automatic region selection never falls back across channels.
 - The region affects only this plugin's update metadata and package downloads, **not CPA connections, model requests, or other plugins' installation sources**.
 - Check again after switching channel or region. Opening the card, polling, or reloading status only reads in-memory state and does not itself contact an update source; background checks follow the controls above.
 - Errors are localized, including unpublished channels, network failures, package integrity failures and storage failures, without exposing backend stack traces.
 
+### One-click and automatic updates through the plugin market
+
+1. The card only reads the market's local `GET /dsh-market/api/v1/capabilities` when it opens and never contacts a registry for it; once detected it shows **Update Now**.
+2. After a check finds a newer version, click **Update Now** and confirm the version. The card submits `POST /dsh-market/api/v1/updates { "packageName": "dsh-cliproxyapi-pro" }` to the market, then polls that operation's progress and result. Version resolution, download, installation, version verification and recovery are all done by the market.
+3. When it finishes, the card shows the version actually installed and, following the market's result, asks you to **Restart DSH** (a button appears only when the market says it owns restarts; quit and reopen the desktop app completely) or **Refresh Page**. If the market, using its own channel, installed an older version than this card found, the card says so.
+4. During the market's release-age wait (`RELEASE_TOO_FRESH`) or before its mirror catches up (`VERSION_UNCHANGED`) you can choose **Install Anyway**; other failures show only a localized reason, never backend text.
+5. Linked local installations (`link:`) are not installed through the market, so their source link is never replaced.
+
 ### Download, verification and offline upgrade
 
+Use this without the plugin market or for offline upgrades:
+
 1. Click **Check for Updates**. If a newer version is available, click **Download Update** and confirm its version, or wait for enabled automatic checks and downloads.
 2. The download must match the npm metadata's **SHA-512** integrity, then pass gzip / tar, expected file and directory, package name and version checks. Path traversal, links and other special entries, dependencies and installation lifecycle scripts are rejected. The package is saved without extracting into the installation directory or executing its code.
 3. After verification, the card displays the absolute package path and an upgrade command when applicable. Packages are stored at `<profile dir>/.dsh-cliproxyapi/updates/dsh-cliproxyapi-pro-<version>.tgz`.
@@ -255,12 +266,12 @@ Used by the settings panel. Requires the DSH Web session's authentication; POST
 | POST | `/api/dsh-cliproxyapi/accounts/remove` | `{ accountId }` | Delete an account and its routes |
 | GET | `/api/dsh-cliproxyapi/updates/status` | — | Read update state without contacting a registry |
 | POST | `/api/dsh-cliproxyapi/updates/check` | `{}` | Check the selected channel and region now; a manual check does not trigger automatic downloading |
-| POST | `/api/dsh-cliproxyapi/updates/save` | `{ autoCheck?, autoDownload?, channel?, region? }` | Save only these four update preferences, independently of accounts |
+| POST | `/api/dsh-cliproxyapi/updates/save` | `{ autoCheck?, autoDownload?, autoInstall?, channel?, region? }` | Save only these five update preferences, independently of accounts |
 | POST | `/api/dsh-cliproxyapi/updates/download` | `{ version }` | Download the newer version confirmed by the latest check, verify it, and save an offline package without installing |
 
-Update operation responses use `{ ok, update }`. State includes `currentVersion`, `latestVersion`, `available`, `channel`, `region`, `effectiveRegion`, `autoCheck`, `autoDownload`, `checking`, `downloading`, `lastCheckedAt`, `error` / `errorCode`, `blockedReason`, `downloadedVersion`, `downloadPath` and `upgradeCommand`. Fields without a check or download result are `null`. `channel` is `stable` / `beta` / `dev`; `region` is `auto` / `global` / `cn`; `effectiveRegion` is the `global` / `cn` source used by the last successful check (`null` before one).
+Update operation responses use `{ ok, update }`. State includes `currentVersion`, `latestVersion`, `available`, `channel`, `region`, `effectiveRegion`, `autoCheck`, `autoDownload`, `autoInstall`, `checking`, `downloading`, `lastCheckedAt`, `error` / `errorCode`, `blockedReason`, `downloadedVersion`, `downloadPath` and `upgradeCommand`. Fields without a check or download result are `null`. `channel` is `stable` / `beta` / `dev`; `region` is `auto` / `global` / `cn`; `effectiveRegion` is the `global` / `cn` source used by the last successful check (`null` before one).
 
-Failures use a top-level `errorCode` or `update.errorCode`; HTTP status or `ok` alone does not establish success. Common codes include `network-error`, `invalid-metadata`, `channel-unavailable`, `integrity-error`, `invalid-package`, `storage-error`, `busy`, `stale-version` and `disposed`. In addition to host authentication and trusted-host policy, update POSTs **require an explicit `Origin` matching the actual connection protocol and Host exactly**. Missing or mismatched origins are rejected; the account endpoints' compatibility with absent origins does not apply. Plain unauthenticated `curl` cannot call these endpoints. Scheme validation uses the actual connection, not arbitrary `Forwarded` / `X-Forwarded-*` claims; the `Origin` must match end to end. A proxy that terminates HTTPS and connects to DSH over HTTP will have update POSTs rejected. In that case, use the local DSH page on the machine running DSH first; compatibility with every reverse-proxy deployment is not implied.
+Failures use a top-level `errorCode` or `update.errorCode`; HTTP status or `ok` alone does not establish success. Common codes include `network-error`, `invalid-metadata`, `channel-unavailable`, `integrity-error`, `invalid-package`, `storage-error`, `busy`, `stale-version`, `service-unavailable`, `forbidden-origin` and `disposed`. Update POSTs still rely on the host's session authentication and trusted-host policy: when a request carries `Origin`, it must belong to the same authority as this listener (host and port compared under the Origin's own scheme, matching the host's own rule), otherwise the response is `forbidden-origin`. The desktop carrier may proxy API calls without an `Origin`; such a request is allowed once the host session authenticates it, while unauthenticated callers are still rejected before reaching the route. Plain unauthenticated `curl` cannot call these endpoints.
 
 ## Storage and configuration
 
@@ -291,6 +302,7 @@ Failures use a top-level `errorCode` or `update.errorCode`; HTTP status or `ok`
     "version": 1,
     "autoCheck": true,
     "autoDownload": false,
+    "autoInstall": false,
     "channel": "stable",
     "region": "auto"
   }
@@ -303,7 +315,7 @@ Failures use a top-level `errorCode` or `update.errorCode`; HTTP status or `ok`
 
 ## Upgrading and uninstalling
 
-- **Upgrade**: preferably download a verified offline package through the card above, save your work and close DSH, run the displayed `dsh plugin --profile 'name' add 'absolute-package-path'` command, then restart. There is no need to uninstall first. Alternatively, with DSH closed, run `dsh plugin --profile <profile name> add dsh-cliproxyapi-pro@latest` to upgrade from npm. Accounts, selections and parameters remain in the profile directory, and keys in the credentials service; the updater never rewrites them. To preserve a linked source installation, update its source yourself rather than reinstalling from an offline package.
+- **Upgrade**: with dshmarket installed, click **Update Now** on the plugin update card (or enable automatic installation), then restart DSH or refresh the page as prompted. Without the market, download a verified offline package through the card, save your work and close DSH, run the displayed `dsh plugin --profile 'name' add 'absolute-package-path'` command, then restart. There is no need to uninstall first. Alternatively, with DSH closed, run `dsh plugin --profile <profile name> add dsh-cliproxyapi-pro@latest` to upgrade from npm. Accounts, selections and parameters remain in the profile directory, and keys in the credentials service; the updater never rewrites them. To preserve a linked source installation, update its source yourself rather than reinstalling from an offline package.
 - **Uninstall**: uninstall on the **Plugins** page. The synchronized model routes are stored in DSH settings and are not removed with the plugin; to remove those models from the picker too, disable or delete every account before uninstalling.
 
 ## FAQ
@@ -320,8 +332,11 @@ Make sure the base URL is reachable from the machine running DSH and the API key
 **A just-published version won't install?**
 The pnpm used by DSH may enforce a waiting period for new releases (`minimumReleaseAge`); the install screen shows which version it actually installed. Try again later or name the version explicitly.
 
-**Why automatic downloads, but no automatic installation?**
-Current DSH versions reject replacing an installed plugin while running. To avoid interrupting sessions using this plugin's routes, the updater never tries to uninstall, overwrite files or restart DSH; it prepares an offline package for an upgrade after DSH is closed.
+**How do I install updates automatically?**
+Install and enable the [DSH plugin market (dshmarket)](https://github.com/dsh-market/dsh-market), then turn on **Automatically Check for Updates** and **Automatically Install Updates** on the plugin update card. The market performs the installation (package manager, version verification and recovery); this plugin itself never runs a package manager, overwrites files or restarts DSH. Without the market it can only prepare an offline package for an upgrade with DSH closed.
+
+**"Check for Updates" fails immediately (especially on the desktop app)?**
+Versions 1.5.1 and earlier required an `Origin` header on update POSTs, but the DSH desktop app strips that header when it forwards page requests, so checks, update-setting saves and downloads were all refused. Since 1.6.0 the plugin follows the host's own rule: without `Origin` the host session authentication decides; with `Origin` it must still be same-origin. Upgrade older versions through the plugin market, the plugin manager or the offline path.
 
 **No release available on Beta / Dev?**
 A channel is usable only after the maintainer publishes its npm dist-tag. Stable is never presented as an unpublished Beta / Dev build. A channel version no newer than the running version does not offer a downgrade download either.
@@ -341,7 +356,7 @@ Downloading and verification do not install anything. Exit DSH, run the card's u
    - Local CPA on `http://127.0.0.1:8317` without auth: nothing to configure; call `{"action": "refresh"}`.
    - Remote URL or key: `{"action": "configure", "baseURL": "...", "apiKey": "..."}` (first account), or `{"action": "add_account", ...}` for another account. Pass `"account": "<id>"` to target a specific account.
    - Narrow the picker with `selectedModels` (exact ids from the `status` output).
-3. **Verify**: `{"action": "status"}` shows `state: "connected"` and `modelCount > 0` for each enabled account. Tell the user the models are in the DSH model picker under the account's name, and that accounts are managed in **Sidebar → Plugins → CLIProxyAPI** or **Settings → Built-in plugins → CLIProxyAPI**.
+3. **Verify**: `{"action": "status"}` shows `state: "connected"` and `modelCount > 0` for each enabled account. Tell the user the models are in the DSH model picker under the account's name, and that accounts are managed on the **CLIProxyAPI** page in the Settings dialog's left navigation.
 
 Never echo API keys back to the user or write them into files.
 
@@ -349,7 +364,7 @@ Never echo API keys back to the user or write them into files.
 
 ```text
 lib/index.js        Host plugin (discovery, sync, multi-account controller, tool, commands, HTTP API)
-lib/client.js       Web settings panel (ModuleLoader; isolated update card and account forms, no build)
+lib/client.js       Web UI (ModuleLoader: account page in Settings, update card on the plugin pages, no build)
 lib/updater.js      Update settings, SemVer/channels, region race, SHA-512/package checks, offline storage
 locale/*.json       Title and description shown by the plugin manager
 cordis.patch.yml    Bundle patch inserting the dsh-cliproxyapi-pro row

package/README.md

@@ -14,7 +14,7 @@
 - **开箱即用**：首次连接时按该服务自己的模型目录，为每个模型家族勾选最新的一个（最多 12 个），模型选择器不会被上百个模型淹没。
 - **原生协议**：Claude 走 Anthropic Messages，GPT / Codex / Grok 走 OpenAI Responses，其余走 OpenAI Chat，减少 CPA 的协议转换。
 - **可视化管理**：设置面板里勾选模型、编辑单个模型的参数；也可以让 DSH 的 Agent 通过 `cliproxyapi` 工具帮你配置。
-- **插件更新**：自动检查稳定 / Beta / 开发通道，可选择全球 / 中国大陆下载源并自动下载校验离线包；关闭 DSH 后手动升级，不会自动安装或重启。
+- **插件更新**：自动检查稳定 / Beta / 开发通道，可选择全球 / 中国大陆下载源；装有 [DSH 插件市场（dshmarket）](https://github.com/dsh-market/dsh-market) 时可一键或自动安装新版本，否则下载校验离线包，在关闭 DSH 后手动升级。
 - **安全**：API Key 只保存在 DSH 凭证服务里，不写入任何配置文件。
 - **零依赖**：不依赖任何 npm 包，无需构建，安装几秒完成。
 
@@ -49,7 +49,7 @@
    dsh-cliproxyapi-pro
    ```
 
-   需要固定版本时可以写成 `dsh-cliproxyapi-pro@1.5.1`。
+   需要固定版本时可以写成 `dsh-cliproxyapi-pro@1.6.0`。
 4. 点击 **安装**，完成后点击 **立即启用**。
 
 > 在中国大陆下载慢，可以点输入框旁的 **安装源**，切换到 **中国大陆镜像源**。
@@ -78,7 +78,7 @@ dsh plugin --profile <profile 名称> add dsh-cliproxyapi-pro
 
 | 来源 | 填写内容 |
 |---|---|
-| 某个发布版本 | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#v1.5.1` |
+| 某个发布版本 | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#v1.6.0` |
 | 最新开发版 | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#main` |
 | 离线安装包 | 下载 [`dsh-cliproxyapi-pro.tgz`](https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro/releases/latest/download/dsh-cliproxyapi-pro.tgz)（始终是最新版），填写它的本地绝对路径 |
 | 本地源码（开发用） | 克隆后的仓库目录绝对路径；以链接方式安装，改代码后重载插件即生效 |
@@ -87,7 +87,7 @@ dsh plugin --profile <profile 名称> add dsh-cliproxyapi-pro
 
 ## 快速上手
 
-1. **打开设置面板**：左侧栏 **插件** → **CLIProxyAPI**，或 **设置** → **内置插件** → **CLIProxyAPI** 标签页。
+1. **打开设置面板**：**设置** → 左侧导航的 **CLIProxyAPI** 页（账号、模型与协议都在这里）。插件自身的更新在左侧栏 **插件** → **CLIProxyAPI**，或 **设置** → **内置插件** → **CLIProxyAPI** 标签页，这两处只有更新功能。
 2. **填写连接信息**：在「连接与认证配置」里填 **CLIProxyAPI 服务地址**（如 `http://127.0.0.1:8317`，不用加 `/v1`）和 **API Key**（本地免密的 CPA 可留空），点 **保存设置并应用**。
 3. **选择模型**：连接成功后，「模型显示筛选」会列出 CPA 上的全部模型，并已为每个家族勾好最新的一个。按需增减后点 **保存模型勾选**。
 4. **开始使用**：回到对话框，打开模型选择器，就能在以账号名称命名的分组里看到这些模型。
@@ -108,7 +108,7 @@ CPA 就在本机默认端口 `8317` 且没有设置密钥时，什么都不用
 
 ![未启用账号的连接设置，使用独立的密钥引用名](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/connection.png)
 
-**4. 插件更新卡片（默认收起）。** 使用真实组件与虚构的更新状态离线渲染：默认只占一行，显示当前版本与更新状态；点击后展开通道、下载区域和自动更新开关。不是正在运行的 GUI 截图，也不代表实际发布版本。
+**4. 插件更新卡片。** 使用真实组件与虚构的更新状态离线渲染（拍摄于更新卡片仍位于账号页顶部、默认收起的版本）：一行显示当前版本与更新状态，展开后是通道、下载区域和自动更新开关。现在它单独位于插件页，并默认展开。不是正在运行的 GUI 截图，也不代表实际发布版本。
 
 ![插件更新卡片默认收起：一行显示当前版本与新版本提示](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/updates.png)
 
@@ -160,9 +160,9 @@ CPA 对每个模型同时提供 OpenAI Chat、OpenAI Responses、Anthropic Messa
 
 ## 插件自身更新
 
-设置面板顶部的 **插件更新** 卡片默认收起为一行，只显示当前版本和更新状态，点击才会展开通道、下载区域与自动更新设置；后台检查仍按保存的开关运行，展开状态不会被轮询重置。它只管理 `dsh-cliproxyapi-pro` 自身，不会更新 CPA 服务或 DSH 宿主，也不改变 CPA 请求的路由、账号或模型勾选。更新设置修改后立即保存；卡片独立轮询状态，不会重载未保存的账号表单。
+**插件更新** 位于左侧栏 **插件** → **CLIProxyAPI** 的插件页，以及 **设置** → **内置插件** → **CLIProxyAPI** 标签页；这两处只有更新功能，账号与模型设置在 **设置** 左侧导航的 **CLIProxyAPI** 页。更新卡片在插件页默认展开，摘要行显示当前版本和更新状态，可随时收起；后台检查仍按保存的开关运行，展开状态不会被轮询重置。它只管理 `dsh-cliproxyapi-pro` 自身，不会更新 CPA 服务或 DSH 宿主，也不改变 CPA 请求的路由、账号或模型勾选。更新设置修改后立即保存；卡片独立轮询状态，不会重载未保存的账号表单。
 
-> **下载不等于安装。** 当前 DSH 不允许在运行中替换已安装的插件。本插件只检查版本、下载并校验离线包：不会自动安装、卸载插件、覆盖源码或重启 DSH。升级须在关闭 DSH 后手动执行，再启动生效。
+> **安装交给插件市场。** 本插件自身从不运行包管理器、卸载插件、覆盖源码或重启 DSH。装有 [DSH 插件市场（dshmarket）](https://github.com/dsh-market/dsh-market) 时，卡片通过它公开的 Update API v1 一键或自动安装新版本；没有插件市场时，只能下载并校验离线包，在关闭 DSH 后手动升级。
 
 ### 通道、区域与自动开关
 
@@ -171,15 +171,26 @@ CPA 对每个模型同时提供 OpenAI Chat、OpenAI Responses、Anthropic Messa
 | 更新通道 | 稳定（`stable`） | 稳定 / Beta / 开发分别读取 npm 的 `latest` / `beta` / `dev` dist-tag。Beta / 开发通道尚未发布时明确报错，不悄悄回退稳定版。 |
 | 下载区域 | 自动（`auto`） | 自动模式同时请求全球 npmjs 与中国大陆 npmmirror，选择最先返回**有效版本元数据**的源；全球（`global`）只使用 `https://registry.npmjs.org`，中国大陆（`cn`）使用 `https://registry.npmmirror.com` 及其官方 `cdn.npmmirror.com` 包下载域名。离线包从本次检查选中的源下载，至多跟随 3 次经过白名单与精确包名／版本路径校验的 HTTPS 跳转，不跨区域回退。 |
 | 自动检查更新 | 开启 | 插件启动或更新设置重新调度后约 3 秒检查，之后每 6 小时检查所选通道；关闭后仍可手动点 **检查更新**。 |
-| 自动下载更新 | 关闭 | 仅在**自动检查**发现新版本时，自动下载并校验离线包；不会自动安装或重启。仅开启此项而关闭自动检查，不会触发后台下载。 |
+| 自动下载更新 | 关闭 | 仅在**自动检查**发现新版本时，自动下载并校验离线包；下载本身不安装、不重启。仅开启此项而关闭自动检查，不会触发后台下载。 |
+| 自动安装更新 | 关闭 | 需要开启自动检查并装有 dshmarket（未检测到插件市场时无法开启）。**自动检查**发现新版本后，由打开着的 DSH 页面调用插件市场安装；同一版本 6 小时内最多尝试一次，安装成功的版本不再重试。插件市场的发布冷却期等限制照常生效，自动模式从不强制安装。生效可能需要重启 DSH 或刷新页面。 |
 
 - 检查使用严格 SemVer 比较：只有所选通道版本高于当前运行版本时才提供下载，不自动降级。自动区域选择也不会跨通道回退。
 - 区域只影响本插件的更新元数据与安装包下载，**不影响 CPA 的连接、模型请求或其他插件的安装源**。
 - 切换通道或区域后，请重新检查更新。打开卡片、轮询或重新读取状态本身只读取内存状态，不主动访问更新源；后台自动检查由上述开关控制。
 - 失败时卡片显示本地化提示，例如通道未发布、网络异常、包完整性校验失败或磁盘写入失败，不显示后端堆栈。
 
+### 通过插件市场一键更新 / 自动更新
+
+1. 卡片打开时只读取插件市场本地的 `GET /dsh-market/api/v1/capabilities`，不访问任何更新源；检测到后显示 **立即更新**。
+2. 检查到新版本后点 **立即更新** 并确认版本号；卡片向插件市场提交 `POST /dsh-market/api/v1/updates { "packageName": "dsh-cliproxyapi-pro" }`，再轮询该任务的进度与结果。版本解析、下载、安装、版本核对与恢复都由插件市场完成。
+3. 完成后卡片显示实际装上的版本，并按插件市场的结果提示 **重启 DSH**（仅插件市场声明可以重启时显示按钮；桌面版需完全退出后重新打开）或 **刷新页面**。若插件市场按其自身通道装上的版本低于本卡片检查到的版本，会明确提示。
+4. 遇到发布冷却期（`RELEASE_TOO_FRESH`）或镜像未同步（`VERSION_UNCHANGED`）时可手动选择 **仍然安装**；其他失败只显示本地化原因，不显示后端信息。
+5. 本地链接安装（`link:`）不提供插件市场安装，以免替换源码链接。
+
 ### 下载、校验与离线升级
 
+没有插件市场或需要离线升级时使用：
+
 1. 点击 **检查更新**；有更高版本时，点 **下载更新** 并确认版本号，或等待已启用的自动检查 / 自动下载。
 2. 下载先通过 npm 元数据中的 **SHA-512** 完整性校验，再验证 gzip / tar、预期文件与目录、包名和版本；拒绝路径穿越、链接等特殊条目、依赖和安装生命周期脚本。只保存离线包，不解压到安装目录，也不执行包内代码。
 3. 校验成功后，卡片显示安装包的绝对路径与适用的升级命令。包保存在 `<Profile 目录>/.dsh-cliproxyapi/updates/dsh-cliproxyapi-pro-<version>.tgz`。
@@ -253,12 +264,12 @@ DSH 的 Agent 可以用这个工具查看和配置插件，你只需用自然语
 | POST | `/api/dsh-cliproxyapi/accounts/remove` | `{ accountId }` | 删除账号及其路由 |
 | GET | `/api/dsh-cliproxyapi/updates/status` | — | 只读更新状态，不主动联网检查 |
 | POST | `/api/dsh-cliproxyapi/updates/check` | `{}` | 主动检查所选通道与区域；手动检查不触发自动下载 |
-| POST | `/api/dsh-cliproxyapi/updates/save` | `{ autoCheck?, autoDownload?, channel?, region? }` | 只保存四项更新设置，与账号配置独立 |
+| POST | `/api/dsh-cliproxyapi/updates/save` | `{ autoCheck?, autoDownload?, autoInstall?, channel?, region? }` | 只保存这五项更新设置，与账号配置独立 |
 | POST | `/api/dsh-cliproxyapi/updates/download` | `{ version }` | 下载最近一次检查确认的新版本，完成校验后保存离线包；不安装 |
 
-更新接口的操作响应采用 `{ ok, update }`，状态包含 `currentVersion`、`latestVersion`、`available`、`channel`、`region`、`effectiveRegion`、`autoCheck`、`autoDownload`、`checking`、`downloading`、`lastCheckedAt`、`error` / `errorCode`、`blockedReason`、`downloadedVersion`、`downloadPath` 与 `upgradeCommand`。未检查或未下载的相关字段为 `null`。`channel` 为 `stable` / `beta` / `dev`，`region` 为 `auto` / `global` / `cn`；`effectiveRegion` 为本次成功检查使用的 `global` / `cn`（此前为 `null`）。
+更新接口的操作响应采用 `{ ok, update }`，状态包含 `currentVersion`、`latestVersion`、`available`、`channel`、`region`、`effectiveRegion`、`autoCheck`、`autoDownload`、`autoInstall`、`checking`、`downloading`、`lastCheckedAt`、`error` / `errorCode`、`blockedReason`、`downloadedVersion`、`downloadPath` 与 `upgradeCommand`。未检查或未下载的相关字段为 `null`。`channel` 为 `stable` / `beta` / `dev`，`region` 为 `auto` / `global` / `cn`；`effectiveRegion` 为本次成功检查使用的 `global` / `cn`（此前为 `null`）。
 
-失败用顶层 `errorCode` 或 `update.errorCode` 表达，不能只凭 HTTP 状态或 `ok` 判断操作成功；常见值包括 `network-error`、`invalid-metadata`、`channel-unavailable`、`integrity-error`、`invalid-package`、`storage-error`、`busy`、`stale-version` 与 `disposed`。更新 POST 在宿主鉴权和可信主机策略之外，**必须带与当前连接协议和 Host 完全匹配的显式 `Origin`**；缺失或不匹配会拒绝，不沿用账号接口对缺省 `Origin` 的兼容行为。普通未认证 `curl` 不能调用这些接口。协议判断使用实际连接，不信任任意 `Forwarded` / `X-Forwarded-*` 声明；需要端到端一致的 `Origin`。若反向代理在 HTTPS 终止后以 HTTP 连接 DSH，更新 POST 会被拒绝，请先从运行 DSH 机器上的本机 DSH 页面操作，不要假定所有反代部署都兼容。
+失败用顶层 `errorCode` 或 `update.errorCode` 表达，不能只凭 HTTP 状态或 `ok` 判断操作成功；常见值包括 `network-error`、`invalid-metadata`、`channel-unavailable`、`integrity-error`、`invalid-package`、`storage-error`、`busy`、`stale-version`、`service-unavailable`、`forbidden-origin` 与 `disposed`。更新 POST 仍然依赖宿主的会话鉴权与可信主机策略：请求带 `Origin` 时必须属于当前监听的同一 authority（按 `Origin` 自身协议比较主机与端口，与宿主规则一致），否则返回 `forbidden-origin`；桌面端桥接请求可能不带 `Origin`，此时只要通过宿主会话鉴权即可执行，未认证请求仍会在到达路由前被拒绝。普通未认证 `curl` 不能调用这些接口。
 
 ## 存储与配置
 
@@ -289,6 +300,7 @@ DSH 的 Agent 可以用这个工具查看和配置插件，你只需用自然语
     "version": 1,
     "autoCheck": true,
     "autoDownload": false,
+    "autoInstall": false,
     "channel": "stable",
     "region": "auto"
   }
@@ -301,7 +313,7 @@ DSH 的 Agent 可以用这个工具查看和配置插件，你只需用自然语
 
 ## 升级与卸载
 
-- **升级**：优先使用上方插件更新卡片下载校验后的离线包，保存工作并关闭 DSH，再执行卡片的 `dsh plugin --profile '名称' add '离线包绝对路径'` 命令，最后重新启动；无需先卸载。也可在关闭 DSH 后运行 `dsh plugin --profile <profile 名称> add dsh-cliproxyapi-pro@latest` 从 npm 升级。账号、勾选和参数仍保存在原 profile 目录里，密钥仍在凭证服务里；更新下载功能不会改写这些数据。本地链接安装要保留源码方式时应自行更新源码，而不是从离线包重装。
+- **升级**：装有 dshmarket 时，直接在插件更新卡片点 **立即更新**（或开启自动安装），完成后按提示重启 DSH 或刷新页面。没有插件市场时，使用卡片下载校验后的离线包，保存工作并关闭 DSH，再执行卡片的 `dsh plugin --profile '名称' add '离线包绝对路径'` 命令，最后重新启动；无需先卸载。也可在关闭 DSH 后运行 `dsh plugin --profile <profile 名称> add dsh-cliproxyapi-pro@latest` 从 npm 升级。账号、勾选和参数仍保存在原 profile 目录里，密钥仍在凭证服务里；更新下载功能不会改写这些数据。本地链接安装要保留源码方式时应自行更新源码，而不是从离线包重装。
 - **卸载**：在 **插件** 页卸载。已同步的模型路由保存在 DSH 设置里，卸载插件不会自动删除它们；想让这些模型一并从选择器消失，请在卸载前把各账号停用或删除。
 
 ## 常见问题
@@ -318,8 +330,11 @@ DSH 的 Agent 可以用这个工具查看和配置插件，你只需用自然语
 **刚发布的新版本装不上？**
 DSH 使用的 pnpm 可能设置了新版本发布后的等待期（`minimumReleaseAge`），安装界面会说明实际装到的版本。稍后再装，或明确写出版本号。
 
-**为什么只有自动下载，没有自动安装？**
-当前 DSH 不允许覆盖运行中的已装插件。为避免中断正在使用本插件路由的会话，更新器不会尝试卸载、覆盖文件或重启，只准备离线包供关闭 DSH 后升级。
+**怎样自动安装更新？**
+安装并启用 [DSH 插件市场（dshmarket）](https://github.com/dsh-market/dsh-market)，在插件更新卡片打开 **自动检查更新** 和 **自动安装更新**。安装由插件市场完成（它负责包管理器、版本核对与恢复），本插件自身不会运行包管理器、覆盖文件或重启。没有插件市场时只能准备离线包，在关闭 DSH 后升级。
+
+**点「检查更新」就报错（尤其是桌面版）？**
+1.5.1 及以前的版本要求更新 POST 必须带 `Origin`，而 DSH 桌面版转发页面请求时会去掉这个请求头，所以检查、保存更新设置和下载都会被拒绝。1.6.0 起已与宿主规则一致：缺少 `Origin` 时依靠宿主会话鉴权，带 `Origin` 时仍须同源。旧版本请通过插件市场、插件管理器或离线方式升级到新版本。
 
 **Beta / 开发通道提示暂无版本？**
 只有维护者发布对应 npm dist-tag 后才可使用；插件不会把稳定版伪装成 Beta / 开发版。若通道版本不高于当前版本，也不会提供降级下载。
@@ -339,7 +354,7 @@ DSH 使用的 pnpm 可能设置了新版本发布后的等待期（`minimumRelea
    - CPA 在本机 `http://127.0.0.1:8317` 且无鉴权：无需配置，调用 `{"action": "refresh"}`。
    - 远程地址或有密钥：`{"action": "configure", "baseURL": "...", "apiKey": "..."}`（作用于第一个账号）；额外的账号用 `{"action": "add_account", ...}`；指定账号时传 `"account": "<id>"`。
    - 用 `selectedModels`（取自 `status` 输出中的精确 id）精简模型选择器。
-3. **验证**：`{"action": "status"}` 中每个启用的账号 `state` 为 `connected` 且 `modelCount > 0`。告诉用户模型已出现在 DSH 模型选择器中（按账号名称分组），可在 **左侧栏 → 插件 → CLIProxyAPI** 或 **设置 → 内置插件 → CLIProxyAPI** 管理账号。
+3. **验证**：`{"action": "status"}` 中每个启用的账号 `state` 为 `connected` 且 `modelCount > 0`。告诉用户模型已出现在 DSH 模型选择器中（按账号名称分组），可在 **设置** 左侧导航的 **CLIProxyAPI** 页管理账号。
 
 不要把 API Key 回显给用户，也不要写入任何文件。
 
@@ -347,7 +362,7 @@ DSH 使用的 pnpm 可能设置了新版本发布后的等待期（`minimumRelea
 
 ```text
 lib/index.js        Host 插件（发现、同步、多账号控制器、工具、命令、HTTP 接口）
-lib/client.js       Web 设置面板（ModuleLoader 格式，独立更新卡片与账号表单，无需构建）
+lib/client.js       Web 界面（ModuleLoader 格式：设置左侧的账号页、插件页的更新卡片，无需构建）
 lib/updater.js      更新设置、SemVer/通道、区域竞速、SHA-512/包结构检查与离线包存储
 locale/*.json       插件管理器中显示的标题与描述
 cordis.patch.yml    Bundle patch，插入 dsh-cliproxyapi-pro 行

package/lib/client.js

@@ -12,6 +12,8 @@ window.__ModuleLoader__.load({
     const PACKAGE_NAME = "dsh-cliproxyapi-pro";
     const MODULE_ID = "dsh-cliproxyapi-pro";
     const NS = "dsh-cliproxyapi-pro";
+    // Stable id of the account/model page in the Settings left navigation.
+    const SETTINGS_SECTION_ID = "cliproxyapi";
 
     // Document-relative API paths (compatible with <base href="./"> in DSH Web/Desktop)
     const API = {
@@ -26,6 +28,17 @@ window.__ModuleLoader__.load({
       updateDownload: "api/dsh-cliproxyapi/updates/download",
     };
 
+    // Public, versioned dshmarket Update API (UPDATE-API-V1.md in dshmarket).
+    // Installation is delegated to the market; this plugin never runs a
+    // package manager. Paths are document-relative like API above.
+    const MARKET_API = {
+      capabilities: "dsh-market/api/v1/capabilities",
+      updates: "dsh-market/api/v1/updates",
+      operations: "dsh-market/api/v1/operations",
+      restart: "dsh-market/api/v1/restart",
+    };
+    const MARKET_SCHEMA = "dsh-market/update-api/v1";
+
     const zh = {
       nav: "CLIProxyAPI",
       title: "CLIProxyAPI 自动发现与模型筛选",
@@ -123,6 +136,7 @@ window.__ModuleLoader__.load({
       paramsHint: "留空并保存即恢复 CLIProxyAPI 自动探测值。修改后请点击「保存模型勾选」才会写入模型选择器。",
       discoveredValue: "探测值",
       updateTitle: "插件更新",
+      updatePageHint: "这里只管理插件自身的更新。CLIProxyAPI 的账号、模型和协议设置位于「设置」左侧导航的「CLIProxyAPI」页。",
       updateToggleDetails: "展开或收起插件更新设置",
       updateCompactCurrent: "当前 {version}",
       updateCompactAvailable: "有新版本 {version}",
@@ -133,6 +147,7 @@ window.__ModuleLoader__.load({
       updateCompactErrorChannel: "通道未发布",
       updateStatusUnavailableHint: "无法读取更新服务，可能是插件宿主代码尚未重载：重启 DSH（仅刷新页面不够），或检查更新接口是否可用。",
       updateServiceUnavailableError: "更新服务未就绪：当前运行的插件宿主代码仍是旧版，可能尚未重启 DSH。重启 DSH 后重试。",
+      updateOriginError: "请求来源校验未通过，更新操作已拒绝。请从 DSH 打开的页面重试；使用反向代理时请保持与页面一致的地址访问。",
       updateSubtitle: "仅更新 CLIProxyAPI 插件自身，不更新 CPA 服务或 DSH 宿主。设置修改后立即保存。",
       updateNewVersion: "新版本",
       updateVersionSummary: "当前版本 {current} · 最新版本 {latest}",
@@ -195,7 +210,51 @@ window.__ModuleLoader__.load({
       updateDownloadPathLabel: "已校验的离线包",
       updateUpgradeCommandLabel: "关闭 DSH 后执行升级命令",
       updateCommandUnavailable: "未生成升级命令。请先确认 DSH 支持的离线包升级方式；升级前关闭 DSH，完成后重新启动。",
-      updateOfflineHint: "自动下载不等于自动安装。插件不会关闭、重启 DSH，也不会覆盖正在使用的插件文件。",
+      updateOfflineHint: "离线包下载不会自动安装。本插件自身不会运行包管理器、关闭或重启 DSH；一键更新和自动安装都交给 DSH 插件市场（dshmarket）完成。",
+      updateCompactInstalled: "{version} 已安装",
+      updateMarketLabel: "通过插件市场更新",
+      updateMarketDetecting: "正在检测 DSH 插件市场…",
+      updateMarketReadyHint: "已检测到 DSH 插件市场（dshmarket），可一键安装新版本。安装和版本解析都由插件市场完成，可能需要重启 DSH 或刷新页面才能生效。",
+      updateMarketUnavailableHint: "未检测到 DSH 插件市场（dshmarket）的更新接口。安装插件市场后即可在此一键更新或自动更新；目前可使用下方的离线包下载。",
+      updateMarketLinkedHint: "当前为本地链接安装，不通过插件市场安装，以免替换源码链接。",
+      updateMarketInstallBtn: "立即更新",
+      updateMarketInstalledBtn: "已安装",
+      updateMarketInstalling: "正在通过插件市场安装…",
+      updateMarketProgress: "正在通过插件市场安装… {percent}%",
+      updateMarketRedetectBtn: "重新检测",
+      updateMarketConfirmTitle: "通过插件市场安装版本 {version}？",
+      updateMarketConfirmHint: "DSH 插件市场会安装本插件的新版本，并在安装后核对实际装上的版本，不一致时恢复原版本。安装期间请勿关闭 DSH；完成后可能需要重启 DSH 或刷新页面。",
+      updateMarketConfirmBtn: "确认安装",
+      updateMarketAutomaticPrefix: "自动更新：",
+      updateMarketInstalled: "已安装版本 {version}。",
+      updateMarketVersionLower: "插件市场安装的是 {installed}，低于检查到的 {target}：插件市场按其自身的通道与镜像解析版本。",
+      updateMarketRestartHint: "重启 DSH 后新版本生效。",
+      updateMarketRestartDesktopHint: "请完全退出 DSH 桌面版并重新打开，新版本才会生效。",
+      updateMarketRestartManualHint: "请重启 DSH 服务，新版本才会生效。",
+      updateMarketRefreshHint: "刷新页面后新版本界面生效。",
+      updateMarketAppliedHint: "新版本已生效；若界面仍是旧版，请刷新页面。",
+      updateMarketRestartBtn: "重启 DSH",
+      updateMarketRestarting: "正在请求重启…",
+      updateMarketRestartRequested: "已请求重启 DSH，页面将在 DSH 重新启动后恢复。",
+      updateMarketRefreshBtn: "刷新页面",
+      updateMarketUnchanged: "插件市场报告完成，但插件版本没有变化。",
+      updateMarketCancelled: "插件市场的安装任务已取消。",
+      updateMarketRolledBack: "插件市场已回滚此次更新，插件保持原版本。",
+      updateMarketForceBtn: "仍然安装",
+      updateMarketBusy: "插件市场正在执行另一项更新，请稍后重试。",
+      updateMarketAgentsRunning: "有智能体正在运行，插件市场暂不安装。请等待任务结束后重试。",
+      updateMarketTooFresh: "新版本刚发布，仍在插件市场的发布冷却期内。可稍后重试，或选择「仍然安装」。",
+      updateMarketVersionUnchanged: "插件市场没有解析到更新的版本（镜像可能尚未同步）。可稍后重试，或选择「仍然安装」。",
+      updateMarketDowngrade: "插件市场解析到的版本低于当前版本，已自动恢复，未做更改。",
+      updateMarketMismatch: "插件市场安装的版本与目标版本不一致，已自动恢复。请等待镜像同步后重试。",
+      updateMarketTimeout: "插件市场安装超时，请稍后重试。",
+      updateMarketForbidden: "插件市场拒绝了此次更新请求，请从 DSH 打开的页面重试。",
+      updateMarketLost: "无法继续跟踪插件市场的安装任务（DSH 可能已重启）。请重新检查更新以确认当前版本。",
+      updateMarketUnreachable: "无法连接 DSH 插件市场的更新接口，请确认 dshmarket 已启用后重试。",
+      updateMarketRestartFailed: "重启请求失败，请手动重启 DSH。",
+      updateMarketFailed: "插件市场安装失败。可在插件市场中查看详情，稍后重试，或使用离线包下载。",
+      updateAutoInstallLabel: "自动安装更新",
+      updateAutoInstallHint: "自动检查发现新版本后，通过 DSH 插件市场自动安装（需开启自动检查并安装 dshmarket，仅在 DSH 页面打开时进行；同一版本 6 小时内最多尝试一次）。生效可能需要重启 DSH 或刷新页面。",
     };
 
     const en = {
@@ -295,6 +354,7 @@ window.__ModuleLoader__.load({
       paramsHint: "Clear a value and save to restore the value discovered from CLIProxyAPI. Click Apply Selected Models to write changes to the picker.",
       discoveredValue: "Discovered",
       updateTitle: "Plugin Updates",
+      updatePageHint: "This page only manages updates of the plugin itself. CLIProxyAPI accounts, models and protocol settings are on the \"CLIProxyAPI\" page in the Settings dialog's left navigation.",
       updateToggleDetails: "Expand or collapse plugin update settings",
       updateCompactCurrent: "Current {version}",
       updateCompactAvailable: "Update {version}",
@@ -305,6 +365,7 @@ window.__ModuleLoader__.load({
       updateCompactErrorChannel: "Channel unpublished",
       updateStatusUnavailableHint: "Could not reach the update service; the running host plugin code may still be the previous version. Restart DSH (refreshing the page is not enough), or check that the update endpoint is registered.",
       updateServiceUnavailableError: "The update service is not ready: the running host plugin code is still the previous version, so DSH may not have been restarted. Restart DSH and retry.",
+      updateOriginError: "The request origin was rejected, so the update action was refused. Retry from the page DSH opened, and reach it through the same address you see (relevant behind a reverse proxy).",
       updateSubtitle: "Updates this CLIProxyAPI plugin only, not the CPA server or DSH. Changes to update settings are saved immediately.",
       updateNewVersion: "New Version",
       updateVersionSummary: "Current {current} · Latest {latest}",
@@ -367,7 +428,51 @@ window.__ModuleLoader__.load({
       updateDownloadPathLabel: "Verified Offline Package",
       updateUpgradeCommandLabel: "Upgrade Command — Run After Closing DSH",
       updateCommandUnavailable: "No upgrade command was generated. First verify the offline-package upgrade method supported by your DSH version. Close DSH before upgrading, then start it again.",
-      updateOfflineHint: "Automatic downloading is not automatic installation. This plugin never closes or restarts DSH, or overwrites plugin files that are in use.",
+      updateOfflineHint: "Downloading an offline package never installs it. This plugin itself never runs a package manager, closes or restarts DSH; one-click and automatic installation are handed to the DSH plugin market (dshmarket).",
+      updateCompactInstalled: "{version} installed",
+      updateMarketLabel: "Update Through Plugin Market",
+      updateMarketDetecting: "Detecting the DSH plugin market…",
+      updateMarketReadyHint: "The DSH plugin market (dshmarket) was detected, so new versions can be installed in one click. The market installs and resolves the version; a DSH restart or page refresh may be needed for it to take effect.",
+      updateMarketUnavailableHint: "The DSH plugin market (dshmarket) update API was not detected. Install the plugin market to enable one-click and automatic updates here; until then, use the offline package download below.",
+      updateMarketLinkedHint: "This is a linked local installation, so it is not installed through the plugin market, which would replace the source link.",
+      updateMarketInstallBtn: "Update Now",
+      updateMarketInstalledBtn: "Installed",
+      updateMarketInstalling: "Installing through the plugin market…",
+      updateMarketProgress: "Installing through the plugin market… {percent}%",
+      updateMarketRedetectBtn: "Detect Again",
+      updateMarketConfirmTitle: "Install version {version} through the plugin market?",
+      updateMarketConfirmHint: "The DSH plugin market installs the new version of this plugin, then verifies the version it actually placed and restores the previous one on a mismatch. Keep DSH open while it runs; a DSH restart or page refresh may be needed afterwards.",
+      updateMarketConfirmBtn: "Confirm Install",
+      updateMarketAutomaticPrefix: "Automatic update:",
+      updateMarketInstalled: "Version {version} is installed.",
+      updateMarketVersionLower: "The plugin market installed {installed}, older than the checked {target}: the market resolves versions with its own channel and mirror.",
+      updateMarketRestartHint: "Restart DSH for the new version to take effect.",
+      updateMarketRestartDesktopHint: "Quit the DSH desktop app completely and reopen it for the new version to take effect.",
+      updateMarketRestartManualHint: "Restart the DSH service for the new version to take effect.",
+      updateMarketRefreshHint: "Refresh the page to load the new interface.",
+      updateMarketAppliedHint: "The new version is active; refresh the page if the interface still looks old.",
+      updateMarketRestartBtn: "Restart DSH",
+      updateMarketRestarting: "Requesting restart…",
+      updateMarketRestartRequested: "A DSH restart was requested. The page recovers once DSH is back.",
+      updateMarketRefreshBtn: "Refresh Page",
+      updateMarketUnchanged: "The plugin market reported success, but the plugin version did not change.",
+      updateMarketCancelled: "The plugin market cancelled the installation.",
+      updateMarketRolledBack: "The plugin market rolled this update back; the previous version is kept.",
+      updateMarketForceBtn: "Install Anyway",
+      updateMarketBusy: "The plugin market is running another update. Retry shortly.",
+      updateMarketAgentsRunning: "Agents are running, so the plugin market will not install now. Retry when they finish.",
+      updateMarketTooFresh: "This release is still inside the plugin market's release-age wait. Retry later, or choose Install Anyway.",
+      updateMarketVersionUnchanged: "The plugin market did not resolve a newer version (its mirror may still be syncing). Retry later, or choose Install Anyway.",
+      updateMarketDowngrade: "The plugin market resolved a version older than the current one and restored it; nothing changed.",
+      updateMarketMismatch: "The plugin market installed a version other than the target and restored the previous one. Retry after the mirror catches up.",
+      updateMarketTimeout: "The plugin market installation timed out. Retry later.",
+      updateMarketForbidden: "The plugin market refused this update request. Retry from the page DSH opened.",
+      updateMarketLost: "The plugin market operation can no longer be followed (DSH may have restarted). Check for updates again to confirm the current version.",
+      updateMarketUnreachable: "Could not reach the DSH plugin market update API. Make sure dshmarket is enabled and retry.",
+      updateMarketRestartFailed: "The restart request failed. Restart DSH manually.",
+      updateMarketFailed: "The plugin market installation failed. See the plugin market for details, retry later, or use the offline package download.",
+      updateAutoInstallLabel: "Automatically Install Updates",
+      updateAutoInstallHint: "Install versions found by automatic checks through the DSH plugin market (requires Auto Check and dshmarket; runs only while a DSH page is open, at most once per version every 6 hours). A DSH restart or page refresh may be needed for it to take effect.",
     };
 
     const CSS = `
@@ -858,7 +963,9 @@ window.__ModuleLoader__.load({
 .dcpa-update-summary-current { flex: 0 1 auto; }
 .dcpa-update-summary-status { flex: 1; text-align: right; }
 .dcpa-update-summary-status[data-state="available"],
-.dcpa-update-summary-status[data-state="downloaded"] { color: var(--dsw-alias-brand-primary); }
+.dcpa-update-summary-status[data-state="downloaded"],
+.dcpa-update-summary-status[data-state="installing"],
+.dcpa-update-summary-status[data-state="installed"] { color: var(--dsw-alias-brand-primary); }
 .dcpa-update-summary-status[data-state="error"] { color: var(--dsw-alias-state-error-primary); }
 .dcpa-update-summary::after {
   content: "";
@@ -993,6 +1100,7 @@ window.__ModuleLoader__.load({
       "invalid-metadata": "updateMetadataError",
       "invalid-response": "updateMetadataError",
       "service-unavailable": "updateServiceUnavailableError",
+      "forbidden-origin": "updateOriginError",
       "channel-unavailable": "updateChannelUnavailable",
       "unavailable-channel": "updateChannelUnavailable",
       "integrity-error": "updateIntegrityError",
@@ -1062,8 +1170,303 @@ window.__ModuleLoader__.load({
       return body.update;
     }
 
+    // #region dshmarket installation (Update API v1)
+
+    const MARKET_TERMINAL_STATES = new Set(["succeeded", "failed", "cancelled", "rolled-back"]);
+    const MARKET_POLL_MS = 1500;
+    const MARKET_MAX_POLL_FAILURES = 20;
+    const MARKET_FORCEABLE = new Set(["RELEASE_TOO_FRESH", "VERSION_UNCHANGED"]);
+    const AUTO_INSTALL_FIRST_MS = 15000;
+    const AUTO_INSTALL_INTERVAL_MS = 5 * 60 * 1000;
+    const AUTO_INSTALL_RETRY_MS = 6 * 60 * 60 * 1000;
+    const AUTO_INSTALL_MEMORY_KEY = `${PACKAGE_NAME}:market-auto-install`;
+    const MARKET_ERROR_KEYS = {
+      OPERATION_BUSY: "updateMarketBusy",
+      AGENTS_RUNNING: "updateMarketAgentsRunning",
+      RELEASE_TOO_FRESH: "updateMarketTooFresh",
+      VERSION_UNCHANGED: "updateMarketVersionUnchanged",
+      DOWNGRADE_DETECTED: "updateMarketDowngrade",
+      RESOLVED_VERSION_MISMATCH: "updateMarketMismatch",
+      UPDATE_TIMEOUT: "updateMarketTimeout",
+      UPDATE_FORBIDDEN: "updateMarketForbidden",
+      PLUGIN_NOT_INSTALLED: "updateNotInstalledHint",
+      OPERATION_LOST: "updateMarketLost",
+      MARKET_UNREACHABLE: "updateMarketUnreachable",
+      RESTART_FAILED: "updateMarketRestartFailed",
+    };
+
+    function parseVersion(value) {
+      const match = typeof value === "string"
+        ? /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value)
+        : null;
+      return match ? { parts: match.slice(1, 4).map(Number), pre: match[4] ? match[4].split(".") : [] } : null;
+    }
+
+    /** SemVer precedence, or null when either side is not a version. */
+    function compareVersions(a, b) {
+      const x = parseVersion(a), y = parseVersion(b);
+      if (!x || !y) return null;
+      for (let i = 0; i < 3; i++) if (x.parts[i] !== y.parts[i]) return x.parts[i] > y.parts[i] ? 1 : -1;
+      if (!x.pre.length || !y.pre.length) return x.pre.length ? -1 : y.pre.length ? 1 : 0;
+      for (let i = 0; i < Math.max(x.pre.length, y.pre.length); i++) {
+        const p = x.pre[i], q = y.pre[i];
+        if (p === undefined || q === undefined) return p === undefined ? -1 : 1;
+        if (p === q) continue;
+        const pn = /^\d+$/.test(p), qn = /^\d+$/.test(q);
+        if (pn && qn) return Number(p) > Number(q) ? 1 : -1;
+        if (pn !== qn) return pn ? -1 : 1;
+        return p > q ? 1 : -1;
+      }
+      return 0;
+    }
+
+    function validMarketOperation(value) {
+      return !!value && typeof value === "object" && value.schema === MARKET_SCHEMA &&
+        typeof value.operationId === "string" && value.operationId !== "" &&
+        value.packageName === PACKAGE_NAME && typeof value.state === "string";
+    }
+
+    const marketFailureCode = (operation) =>
+      typeof operation?.failure?.code === "string" && operation.failure.code ? operation.failure.code : "UPDATE_FAILED";
+
+    function marketErrorText(t, code) {
+      return t(Object.prototype.hasOwnProperty.call(MARKET_ERROR_KEYS, code) ? MARKET_ERROR_KEYS[code] : "updateMarketFailed");
+    }
+
+    /**
+     * Shared, page-wide client of the dshmarket Update API. One instance lives
+     * per client activation so the settings card and the background
+     * auto-install runner observe the same operation.
+     */
+    function createMarketUpdater(io = {}) {
+      const doFetch = io.fetch ?? ((url, init) => fetch(url, init));
+      const later = io.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+      const cancelLater = io.clearTimeout ?? ((id) => clearTimeout(id));
+      let state = {
+        phase: "unknown", // unknown | discovering | ready | unavailable
+        runtime: null,
+        restartSupported: false,
+        installing: false,
+        automatic: false,
+        targetVersion: null,
+        operation: null,
+        errorCode: null,
+        restarting: false,
+        restartRequested: false,
+      };
+      const listeners = new Set();
+      const controllers = new Set();
+      let disposed = false;
+      let discovering = null;
+      let pollTimer = null;
+      let pollFailures = 0;
+
+      const set = (patch) => {
+        if (disposed) return;
+        state = { ...state, ...patch };
+        for (const listener of [...listeners]) listener(state);
+      };
+      const request = async (url, init = {}) => {
+        const controller = new AbortController();
+        controllers.add(controller);
+        try {
+          const res = await doFetch(url, { cache: "no-store", ...init, signal: controller.signal });
+          let body = null;
+          try { body = await res.json(); } catch {}
+          return { status: res.status, ok: res.ok, body };
+        } finally {
+          controllers.delete(controller);
+        }
+      };
+      const post = (url, payload) => request(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(payload),
+      });
+      const applyOperation = (operation) => {
+        const done = MARKET_TERMINAL_STATES.has(operation.state);
+        set({
+          operation,
+          installing: !done,
+          errorCode: done && operation.state === "failed" ? marketFailureCode(operation) : null,
+        });
+        if (!done) schedulePoll();
+      };
+      const schedulePoll = () => {
+        if (pollTimer !== null) cancelLater(pollTimer);
+        pollTimer = later(poll, MARKET_POLL_MS);
+      };
+      const poll = async () => {
+        pollTimer = null;
+        const id = state.operation?.operationId;
+        if (disposed || !id) return;
+        try {
+          const { status, body } = await request(`${MARKET_API.operations}?operationId=${encodeURIComponent(id)}`);
+          if (disposed || state.operation?.operationId !== id) return;
+          if (status === 404) {
+            // Operations live in the current Host process only.
+            set({ installing: false, errorCode: "OPERATION_LOST" });
+            return;
+          }
+          if (status !== 200 || !validMarketOperation(body?.operation) || body.operation.operationId !== id) {
+            throw new Error("Invalid market operation");
+          }
+          pollFailures = 0;
+          applyOperation(body.operation);
+        } catch (error) {
+          if (disposed || error?.name === "AbortError") return;
+          if (++pollFailures >= MARKET_MAX_POLL_FAILURES) set({ installing: false, errorCode: "OPERATION_LOST" });
+          else schedulePoll();
+        }
+      };
+
+      return {
+        getState: () => state,
+        subscribe(listener) {
+          listeners.add(listener);
+          return () => listeners.delete(listener);
+        },
+        /** Reads only the local capability document; never contacts a registry. */
+        discover() {
+          if (disposed) return Promise.resolve(state);
+          if (discovering) return discovering;
+          if (state.phase !== "ready") set({ phase: "discovering" });
+          discovering = request(MARKET_API.capabilities)
+            .then(({ ok, body }) => {
+              const usable = ok && body?.schema === MARKET_SCHEMA && body.apiVersion === 1 && body.features?.update === true;
+              set({
+                phase: usable ? "ready" : "unavailable",
+                runtime: usable && typeof body.runtime === "string" ? body.runtime : null,
+                restartSupported: usable && body.features?.restart === true && body.restart?.supported === true,
+              });
+            }, () => {
+              set({ phase: "unavailable", runtime: null, restartSupported: false });
+            })
+            .finally(() => { discovering = null; })
+            .then(() => state);
+          return discovering;
+        },
+        /** Starts one market update operation, then follows it until it settles. */
+        async install({ targetVersion = null, force = false, automatic = false } = {}) {
+          if (disposed || state.phase !== "ready" || state.installing) return state;
+          set({ installing: true, automatic, targetVersion, operation: null, errorCode: null, restartRequested: false });
+          try {
+            const { status, body } = await post(
+              MARKET_API.updates,
+              force ? { packageName: PACKAGE_NAME, force: true } : { packageName: PACKAGE_NAME }
+            );
+            if (disposed) return state;
+            if (status === 202 && validMarketOperation(body?.operation)) {
+              pollFailures = 0;
+              applyOperation(body.operation);
+              return state;
+            }
+            const code = typeof body?.failure?.code === "string" && body.failure.code ? body.failure.code
+              : status === 409 ? "OPERATION_BUSY"
+              : status === 403 ? "UPDATE_FORBIDDEN"
+              : status === 400 ? "UPDATE_REJECTED"
+              : status === 404 ? "MARKET_UNREACHABLE"
+              : "UPDATE_FAILED";
+            set({ installing: false, errorCode: code });
+          } catch (error) {
+            if (!disposed) set({ installing: false, errorCode: error?.name === "AbortError" ? null : "MARKET_UNREACHABLE" });
+          }
+          return state;
+        },
+        /** Only offered when the market reports that it owns process restarts. */
+        async restart() {
+          if (disposed || !state.restartSupported || state.restarting) return state;
+          set({ restarting: true, errorCode: null });
+          try {
+            const { ok } = await post(MARKET_API.restart, {});
+            set({ restarting: false, restartRequested: ok, errorCode: ok ? null : "RESTART_FAILED" });
+          } catch (error) {
+            set({ restarting: false, errorCode: error?.name === "AbortError" ? null : "RESTART_FAILED" });
+          }
+          return state;
+        },
+        dispose() {
+          disposed = true;
+          if (pollTimer !== null) cancelLater(pollTimer);
+          pollTimer = null;
+          for (const controller of controllers) controller.abort();
+          controllers.clear();
+          listeners.clear();
+        },
+      };
+    }
+
+    function readAutoInstallMemory() {
+      try {
+        const raw = JSON.parse(globalThis.localStorage?.getItem(AUTO_INSTALL_MEMORY_KEY) ?? "null");
+        return raw && typeof raw.version === "string" && Number.isFinite(raw.at) ? raw : null;
+      } catch {
+        return null;
+      }
+    }
+
+    function writeAutoInstallMemory(record) {
+      try { globalThis.localStorage?.setItem(AUTO_INSTALL_MEMORY_KEY, JSON.stringify(record)); } catch {}
+    }
+
+    /**
+     * Opt-in automatic installation. The Host's own automatic check finds the
+     * version (channel/region aware); dshmarket installs it. Runs only while a
+     * DSH page is open, reads the local status endpoint only, and tries each
+     * version at most once per {@link AUTO_INSTALL_RETRY_MS} across reloads.
+     */
+    function startAutoInstall(market, io = {}) {
+      const later = io.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+      const cancelLater = io.clearTimeout ?? ((id) => clearTimeout(id));
+      const now = io.now ?? (() => Date.now());
+      const memory = io.memory ?? { read: readAutoInstallMemory, write: writeAutoInstallMemory };
+      const controller = new AbortController();
+      const readStatus = io.readStatus ?? ((signal) => requestPluginUpdate(API.updateStatus, undefined, signal));
+      let stopped = false;
+      let timer = null;
+      const unsubscribe = market.subscribe((state) => {
+        const operation = state.operation;
+        if (state.automatic && operation?.state === "succeeded" && typeof state.targetVersion === "string" &&
+            compareVersions(operation.installedVersion, operation.beforeVersion) === 1) {
+          memory.write({ version: state.targetVersion, at: now(), done: true });
+        }
+      });
+      const tick = async () => {
+        timer = null;
+        try {
+          const status = await readStatus(controller.signal);
+          if (stopped) return;
+          const version = status?.latestVersion;
+          if (status?.autoInstall !== true || status.autoCheck !== true || status.available !== true ||
+              status.blockedReason || typeof version !== "string" || compareVersions(version, status.currentVersion) !== 1) return;
+          const last = memory.read();
+          if (last && last.version === version && (last.done === true || now() - last.at < AUTO_INSTALL_RETRY_MS)) return;
+          if (market.getState().phase !== "ready") await market.discover();
+          const snapshot = market.getState();
+          if (stopped || snapshot.phase !== "ready" || snapshot.installing) return;
+          memory.write({ version, at: now() });
+          await market.install({ targetVersion: version, automatic: true });
+        } catch {
+          // Background work never surfaces errors; the card shows the market state.
+        } finally {
+          if (!stopped) timer = later(tick, AUTO_INSTALL_INTERVAL_MS);
+        }
+      };
+      timer = later(tick, AUTO_INSTALL_FIRST_MS);
+      return () => {
+        stopped = true;
+        if (timer !== null) cancelLater(timer);
+        controller.abort();
+        unsubscribe();
+      };
+    }
+
+    let sharedMarket = null;
+
+    // #endregion
+
     /** Update state is isolated: polling never reloads account data or drafts. */
-    function PluginUpdatePanel({ t }) {
+    function PluginUpdatePanel({ t, market = null, initiallyOpen = false }) {
       const [update, setUpdate] = useState(null);
       const [loading, setLoading] = useState(true);
       const [busy, setBusy] = useState(null);
@@ -1169,6 +1572,21 @@ window.__ModuleLoader__.load({
         }
       }, []);
 
+      // dshmarket state is shared with the background auto-install runner.
+      const [marketState, setMarketState] = useState(() => market?.getState() ?? null);
+      const [confirmInstall, setConfirmInstall] = useState(null);
+      useEffect(() => {
+        if (!market) return undefined;
+        let live = true;
+        const unsubscribe = market.subscribe((next) => { if (live) setMarketState(next); });
+        setMarketState(market.getState());
+        if (market.getState().phase === "unknown") void market.discover();
+        return () => {
+          live = false;
+          unsubscribe();
+        };
+      }, [market]);
+
       const working = loading || busy !== null || update?.checking === true || update?.downloading === true;
       const blockedReason = update?.blockedReason;
       const downloadBlocked = !!blockedReason && blockedReason !== "linked-install";
@@ -1189,7 +1607,17 @@ window.__ModuleLoader__.load({
       const statusError = update?.error || update?.errorCode
         ? { updateCode: update.errorCode }
         : null;
-      const compactState = loading ? "loading" : downloading ? "downloading" : checking ? "checking" :
+      const linkedInstall = blockedReason === "linked-install";
+      const marketReady = marketState?.phase === "ready";
+      const marketOperation = marketState?.operation ?? null;
+      const marketInstalling = marketState?.installing === true;
+      const marketInstalledVersion = marketOperation?.state === "succeeded" &&
+        compareVersions(marketOperation.installedVersion, marketOperation.beforeVersion) === 1
+        ? marketOperation.installedVersion : null;
+      const canMarketInstall = marketReady && !linkedInstall && !downloadBlocked && !marketInstalling &&
+        !marketInstalledVersion && !!update?.available && typeof update.latestVersion === "string" && !!update.latestVersion;
+      const compactState = loading ? "loading" : marketInstalling ? "installing" : downloading ? "downloading" : checking ? "checking" :
+        marketInstalledVersion ? "installed" :
         error || statusError ? "error" : update?.downloadedVersion && update.downloadedVersion === update.latestVersion ? "downloaded" :
           update?.available ? "available" : "idle";
       // Name the actual failure instead of a generic "update error": the
@@ -1202,7 +1630,9 @@ window.__ModuleLoader__.load({
         : failureCode === "service-unavailable" ? "updateCompactStatusUnavailable"
         : failureCode === "channel-unavailable" ? "updateCompactErrorChannel"
         : "updateCompactError";
-      const compactText = loading ? t("updateLoading") : downloading ? t("updateDownloading") : checking ? t("updateChecking") :
+      const compactText = loading ? t("updateLoading") : marketInstalling ? t("updateMarketInstalling") :
+        downloading ? t("updateDownloading") : checking ? t("updateChecking") :
+        marketInstalledVersion ? t("updateCompactInstalled").replace("{version}", marketInstalledVersion) :
         error || statusError ? t(compactErrorKey) : compactState === "downloaded"
           ? t("updateCompactDownloaded").replace("{version}", update.downloadedVersion)
           : update?.available ? t("updateCompactAvailable").replace("{version}", availableVersion)
@@ -1229,7 +1659,7 @@ window.__ModuleLoader__.load({
             }, t(key))
           )
         );
-      const toggle = (field, label, hint, checked) =>
+      const toggle = (field, label, hint, checked, unavailable = false) =>
         h(
           "div",
           { className: "dcpa-update-row dcpa-switch-row" },
@@ -1243,16 +1673,143 @@ window.__ModuleLoader__.load({
             className: "dcpa-switch",
             "aria-label": t(label),
             "aria-checked": checked,
-            disabled: working || !update,
+            // An unavailable feature can still be switched off, never on.
+            disabled: working || !update || unavailable && !checked,
             onClick: () => { void runAction("save", { [field]: !checked }); },
           }, h("span", { className: "dcpa-switch-thumb" }))
         );
 
+      // One-click/automatic installation through dshmarket. Hidden entirely
+      // when the card is rendered without a market client (tests, previews).
+      let marketSection = null;
+      if (market) {
+        const phase = marketState?.phase ?? "unknown";
+        const hintKey = phase === "ready"
+          ? linkedInstall ? "updateMarketLinkedHint" : "updateMarketReadyHint"
+          : phase === "unavailable" ? "updateMarketUnavailableHint" : "updateMarketDetecting";
+        const operation = marketOperation;
+        const progress = operation?.progress;
+        const percent = typeof progress?.percent === "number" && Number.isFinite(progress.percent) ? Math.round(progress.percent) : null;
+        const errorCode = marketState?.errorCode ?? null;
+        const outcome = operation?.outcome ?? {};
+        const target = marketState?.targetVersion;
+        const prefix = marketState?.automatic ? `${t("updateMarketAutomaticPrefix")} ` : "";
+        let result = null;
+        if (marketInstalling) {
+          result = h("div", { className: "dcpa-update-notice", role: "status" },
+            h("p", { className: "dcpa-label" }, prefix + (percent === null
+              ? t("updateMarketInstalling")
+              : t("updateMarketProgress").replace("{percent}", String(percent))))
+          );
+        } else if (marketInstalledVersion) {
+          const restartHint = outcome.restartRequired
+            ? marketState?.restartSupported ? "updateMarketRestartHint"
+              : marketState?.runtime === "desktop" ? "updateMarketRestartDesktopHint" : "updateMarketRestartManualHint"
+            : outcome.refreshRequired ? "updateMarketRefreshHint" : "updateMarketAppliedHint";
+          result = h("div", { className: "dcpa-update-notice", role: "status" },
+            h("p", { className: "dcpa-success" }, prefix + t("updateMarketInstalled").replace("{version}", marketInstalledVersion)),
+            typeof target === "string" && compareVersions(marketInstalledVersion, target) === -1
+              ? h("p", { className: "dcpa-hint" }, t("updateMarketVersionLower").replace("{installed}", marketInstalledVersion).replace("{target}", target))
+              : null,
+            h("p", { className: "dcpa-hint" }, t(marketState?.restartRequested ? "updateMarketRestartRequested" : restartHint)),
+            outcome.restartRequired && marketState?.restartSupported && !marketState?.restartRequested
+              ? h("div", { className: "dcpa-actions" },
+                  h("button", {
+                    type: "button",
+                    className: "dcpa-btn dcpa-btn-primary",
+                    disabled: marketState?.restarting === true,
+                    onClick: () => { void market.restart(); },
+                  }, marketState?.restarting ? t("updateMarketRestarting") : t("updateMarketRestartBtn")))
+              : !outcome.restartRequired && outcome.refreshRequired
+              ? h("div", { className: "dcpa-actions" },
+                  h("button", {
+                    type: "button",
+                    className: "dcpa-btn dcpa-btn-primary",
+                    onClick: () => { globalThis.location?.reload(); },
+                  }, t("updateMarketRefreshBtn")))
+              : null
+          );
+        } else if (operation?.state === "succeeded") {
+          result = h("div", { className: "dcpa-update-notice", role: "status" },
+            h("p", { className: "dcpa-hint" }, prefix + t("updateMarketUnchanged")));
+        } else if (operation?.state === "cancelled" || operation?.state === "rolled-back") {
+          result = h("div", { className: "dcpa-update-notice", role: "status" },
+            h("p", { className: "dcpa-hint" }, prefix + t(operation.state === "cancelled" ? "updateMarketCancelled" : "updateMarketRolledBack")));
+        }
+        const errorBlock = errorCode && !marketInstalling
+          ? h("div", { className: "dcpa-update-notice" },
+              h("p", { className: "dcpa-error", role: "alert" }, prefix + marketErrorText(t, errorCode)),
+              MARKET_FORCEABLE.has(errorCode) && canMarketInstall
+                ? h("div", { className: "dcpa-actions" },
+                    h("button", {
+                      type: "button",
+                      className: "dcpa-btn",
+                      disabled: working,
+                      onClick: () => { void market.install({ targetVersion: update.latestVersion, force: true }); },
+                    }, t("updateMarketForceBtn")))
+                : null)
+          : null;
+        marketSection = h(React.Fragment, null,
+          h("div", { className: "dcpa-update-row" },
+            h("div", { className: "dcpa-field" },
+              h("span", { className: "dcpa-label" }, t("updateMarketLabel")),
+              h("p", { className: "dcpa-hint" }, t(hintKey))
+            ),
+            phase === "ready" && !linkedInstall
+              ? h("div", { className: "dcpa-actions" },
+                  h("button", {
+                    type: "button",
+                    className: "dcpa-btn dcpa-btn-primary",
+                    disabled: working || !canMarketInstall,
+                    onClick: () => { setConfirmVersion(null); setConfirmInstall(update.latestVersion); },
+                  }, marketInstalling ? t("updateMarketInstalling")
+                    : marketInstalledVersion ? t("updateMarketInstalledBtn") : t("updateMarketInstallBtn")))
+              : phase === "unavailable"
+              ? h("div", { className: "dcpa-actions" },
+                  h("button", { type: "button", className: "dcpa-btn", onClick: () => { void market.discover(); } }, t("updateMarketRedetectBtn")))
+              : null
+          ),
+          confirmInstall ? h("div", {
+            className: "dcpa-update-notice",
+            role: "alertdialog",
+            "aria-modal": false,
+            "aria-label": t("updateMarketConfirmTitle").replace("{version}", confirmInstall),
+          },
+            h("p", { className: "dcpa-label" }, t("updateMarketConfirmTitle").replace("{version}", confirmInstall)),
+            h("p", { className: "dcpa-hint" }, t("updateMarketConfirmHint")),
+            h("div", { className: "dcpa-actions" },
+              h("button", {
+                type: "button",
+                className: "dcpa-btn dcpa-btn-primary",
+                disabled: working || !canMarketInstall || confirmInstall !== update?.latestVersion,
+                onClick: () => {
+                  const version = confirmInstall;
+                  setConfirmInstall(null);
+                  void market.install({ targetVersion: version });
+                },
+              }, t("updateMarketConfirmBtn")),
+              h("button", { type: "button", className: "dcpa-btn", onClick: () => setConfirmInstall(null) }, t("updateCancelBtn"))
+            ),
+            confirmInstall !== update?.latestVersion ? h("p", { className: "dcpa-hint" }, t("updateStaleVersion")) : null
+          ) : null,
+          result,
+          errorBlock
+        );
+      }
+
       // Native details starts closed. Do not control `open`: polling and saves
       // must preserve the user's expanded/collapsed choice without remounting.
+      // `initiallyOpen` (the update-only plugin page) passes a constant `true`
+      // that never changes, so React never rewrites it after mount and the
+      // user can still collapse the card.
       return h(
         "details",
-        { className: "dcpa-card dcpa-update-card", "aria-label": t("updateTitle"), "aria-busy": working },
+        {
+          className: "dcpa-card dcpa-update-card",
+          "aria-label": t("updateTitle"),
+          "aria-busy": working,
+          ...(initiallyOpen ? { open: true } : {}),
+        },
         h("summary", { className: "dcpa-update-summary", title: t("updateToggleDetails") },
           h("span", { className: "dcpa-update-summary-title" }, t("updateTitle")),
           h("span", { className: "dcpa-update-summary-current" },
@@ -1280,9 +1837,9 @@ window.__ModuleLoader__.load({
             }, checking ? t("updateChecking") : !update && !loading ? t("updateRetryBtn") : t("updateCheckBtn")),
             h("button", {
               type: "button",
-              className: "dcpa-btn dcpa-btn-primary",
+              className: marketReady && !linkedInstall ? "dcpa-btn" : "dcpa-btn dcpa-btn-primary",
               disabled: working || !canDownload,
-              onClick: () => setConfirmVersion(update.latestVersion),
+              onClick: () => { setConfirmInstall(null); setConfirmVersion(update.latestVersion); },
             }, downloading ? t("updateDownloading") : update?.downloadedVersion === update?.latestVersion && update?.downloadedVersion
               ? t("updateDownloadedBtn") : t("updateDownloadBtn"))
           )
@@ -1306,6 +1863,7 @@ window.__ModuleLoader__.load({
           ),
           confirmVersion !== update?.latestVersion ? h("p", { className: "dcpa-hint" }, t("updateStaleVersion")) : null
         ) : null,
+        marketSection,
         h("div", { className: "dcpa-update-row" },
           h("div", { className: "dcpa-field" },
             h("span", { className: "dcpa-label" }, t("updateChannelLabel")),
@@ -1327,6 +1885,8 @@ window.__ModuleLoader__.load({
         ),
         toggle("autoCheck", "updateAutoCheckLabel", "updateAutoCheckHint", update?.autoCheck !== false),
         toggle("autoDownload", "updateAutoDownloadLabel", "updateAutoDownloadHint", update?.autoDownload === true),
+        toggle("autoInstall", "updateAutoInstallLabel", "updateAutoInstallHint", update?.autoInstall === true,
+          !marketReady || linkedInstall || downloadBlocked),
         blockedReason ? h("div", { className: "dcpa-update-notice" }, h("p", { className: "dcpa-hint" }, t(blockedKey))) : null,
         update?.downloadedVersion && update?.downloadPath ? h("div", { className: "dcpa-update-notice", role: "status" },
           h("p", { className: "dcpa-label" }, t(blockedReason === "linked-install" ? "updateLinkedDownloadedHint" : "updateDownloadedHint").replace("{version}", update.downloadedVersion)),
@@ -1351,8 +1911,23 @@ window.__ModuleLoader__.load({
     }
 
     /**
-     * Account list + switcher. Each account is edited in its own
-     * {@link AccountPanel}, remounted when the selection changes.
+     * The plugin's own page under Plugins (bundle page and Plugins tab): only
+     * plugin updates. Account and model settings live in their own settings
+     * section ({@link CpaSettingsPanel}).
+     */
+    function PluginUpdatePage({ t }) {
+      return h(
+        "div",
+        { className: "dcpa-wrap", "data-dsh-plugin": MODULE_ID },
+        h("p", { className: "dcpa-hint" }, t("updatePageHint")),
+        h(PluginUpdatePanel, { t, market: sharedMarket, initiallyOpen: true })
+      );
+    }
+
+    /**
+     * Account list + switcher (the "CLIProxyAPI" settings section). Each
+     * account is edited in its own {@link AccountPanel}, remounted when the
+     * selection changes.
      */
     function CpaSettingsPanel({ t }) {
       const [loading, setLoading] = useState(true);
@@ -1504,7 +2079,6 @@ window.__ModuleLoader__.load({
           error ? h("p", { className: "dcpa-error", role: "alert" }, error) : null,
           toast ? h("p", { className: "dcpa-success", role: "status" }, toast) : null
         ),
-        h(PluginUpdatePanel, { t }),
         active
           ? h(AccountPanel, {
               key: active.id,
@@ -2478,7 +3052,37 @@ window.__ModuleLoader__.load({
         );
       }
 
-      // 1. Register on the Bundle detail page in Sidebar -> Plugins -> CLIProxyAPI
+      // dshmarket installation client, shared by the card and the opt-in
+      // background auto-install runner. No DOM writes; timers and requests
+      // are disposed with this activation (HMR/unmount).
+      ctx.effect(() => {
+        const market = createMarketUpdater();
+        sharedMarket = market;
+        const stopAutoInstall = startAutoInstall(market);
+        return () => {
+          stopAutoInstall();
+          market.dispose();
+          if (sharedMarket === market) sharedMarket = null;
+        };
+      }, "dsh-cliproxyapi: market updates");
+
+      // 1. Accounts and models: a page of its own in the Settings dialog's left
+      //    navigation (like dshmarket's "Market" section). The slot owner gives
+      //    unregistered ids the default nav glyph; no DOM is touched here.
+      ctx.slots.inject("settings.section", () =>
+        ctx.slots.register(
+          {
+            name: "settings.section",
+            id: SETTINGS_SECTION_ID,
+            order: 45,
+            label: () => t("nav"),
+            locale: NS,
+          },
+          () => h(CpaSettingsPanel, { t })
+        )
+      );
+
+      // 2. Plugin updates only, on the bundle page in Sidebar -> Plugins.
       ctx.slots.inject("plugins.bundle.config", () =>
         ctx.slots.register(
           {
@@ -2486,11 +3090,11 @@ window.__ModuleLoader__.load({
             key: MODULE_ID,
             locale: NS,
           },
-          (ownerProps = {}) => (ownerProps.view === "summary" ? null : h(CpaSettingsPanel, { t }))
+          (ownerProps = {}) => (ownerProps.view === "summary" ? null : h(PluginUpdatePage, { t }))
         )
       );
 
-      // 2. Register as a dedicated tab in Settings -> Built-in plugins -> CLIProxyAPI
+      // 3. Plugin updates only, as a tab in Settings -> Plugins.
       ctx.slots.inject("settings.plugins.tab", () =>
         ctx.slots.register(
           {
@@ -2500,7 +3104,7 @@ window.__ModuleLoader__.load({
             label: () => t("nav"),
             locale: NS,
           },
-          () => h(CpaSettingsPanel, { t })
+          () => h(PluginUpdatePage, { t })
         )
       );
     }

package/lib/index.js

@@ -1695,18 +1695,33 @@ function admitRequest(ctx, req, res, expectedMethod) {
   return true;
 }
 
-/** Update writes are browser-only: require an explicit, exact same Origin. */
+/** Same authority, using the scheme the Origin itself declares (host comparison only). */
+function sameAuthorityOrigin(origin, host) {
+  let originUrl;
+  try { originUrl = new URL(origin); } catch { return false; }
+  if (originUrl.protocol !== "http:" && originUrl.protocol !== "https:") return false;
+  if (originUrl.username || originUrl.password) return false;
+  try {
+    return originUrl.host === new URL(`${originUrl.protocol}//${host}`).host;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Update writes need an authenticated browser request. The host connection
+ * service already enforces the Host/Origin fence and its session cookie, so
+ * this only narrows it: when a browser sends an Origin it must belong to this
+ * listener. A carrier that omits Origin (the desktop shell proxies API calls
+ * without it) is allowed, because the session cookie is still required and an
+ * unauthenticated caller is rejected before reaching the route.
+ */
 function admitUpdateRequest(ctx, req, res, method) {
   if (!admitRequest(ctx, req, res, method)) return false;
   if (method === "GET") return true;
-  const protocol = req.socket?.encrypted ? "https:" : "http:";
-  try {
-    const origin = new URL(req.headers.origin);
-    const target = new URL(`${protocol}//${req.headers.host}`);
-    if (!req.headers.host || origin.origin !== target.origin || req.headers.origin !== origin.origin || origin.username || origin.password) {
-      throw new Error("Origin mismatch");
-    }
-  } catch {
+  const host = req.headers.host;
+  const origin = req.headers.origin;
+  if (host === undefined || origin !== undefined && !sameAuthorityOrigin(origin, host)) {
     sendJson(res, 403, { ok: false, errorCode: "forbidden-origin", error: "Same-origin browser request required" });
     return false;
   }

package/lib/updater.js

@@ -13,8 +13,9 @@ export const UPDATE_REGISTRIES = Object.freeze({
 export const UPDATE_TAGS = Object.freeze({ stable: "latest", beta: "beta", dev: "dev" });
 export const UPDATE_INTERVAL_MS = 6 * 60 * 60 * 1000;
 export const DEFAULT_UPDATE_SETTINGS = Object.freeze({
-  autoCheck: true, autoDownload: false, channel: "stable", region: "auto",
+  autoCheck: true, autoDownload: false, autoInstall: false, channel: "stable", region: "auto",
 });
+const BOOLEAN_SETTINGS = ["autoCheck", "autoDownload", "autoInstall"];
 const MAX_METADATA_BYTES = 512 * 1024;
 const MAX_PACKAGE_BYTES = 8 * 1024 * 1024;
 const MAX_UNPACKED_BYTES = 16 * 1024 * 1024;
@@ -29,6 +30,8 @@ export function normalizeUpdateSettings(raw = {}) {
   return {
     autoCheck: typeof raw?.autoCheck === "boolean" ? raw.autoCheck : true,
     autoDownload: raw?.autoDownload === true,
+    // Consumed by the Web client, which delegates installation to dshmarket.
+    autoInstall: raw?.autoInstall === true,
     channel: Object.hasOwn(UPDATE_TAGS, raw?.channel ?? "") ? raw.channel : "stable",
     region: ["auto", "global", "cn"].includes(raw?.region) ? raw.region : "auto",
   };
@@ -38,7 +41,7 @@ export function loadUpdateSettings(file) {
   try {
     const raw = JSON.parse(readFileSync(file, "utf8"));
     if (!raw || typeof raw !== "object" || Array.isArray(raw) || raw.version !== 1 ||
-        ["autoCheck", "autoDownload"].some((key) => raw[key] !== undefined && typeof raw[key] !== "boolean") ||
+        BOOLEAN_SETTINGS.some((key) => raw[key] !== undefined && typeof raw[key] !== "boolean") ||
         raw.channel !== undefined && !Object.hasOwn(UPDATE_TAGS, raw.channel) ||
         raw.region !== undefined && !["auto", "global", "cn"].includes(raw.region)) fail("invalid-settings");
     return normalizeUpdateSettings(raw);
@@ -340,7 +343,7 @@ export function createPluginUpdater(deps) {
       if (!patch || typeof patch !== "object" || Array.isArray(patch)) fail("invalid-settings");
       if (Object.keys(patch).some((key) => !Object.hasOwn(DEFAULT_UPDATE_SETTINGS, key))) fail("invalid-settings");
       if (Object.hasOwn(patch, "channel") && !Object.hasOwn(UPDATE_TAGS, patch.channel) || Object.hasOwn(patch, "region") && !["auto", "global", "cn"].includes(patch.region)) fail("invalid-settings");
-      for (const key of ["autoCheck", "autoDownload"]) if (Object.hasOwn(patch, key) && typeof patch[key] !== "boolean") fail("invalid-settings");
+      for (const key of BOOLEAN_SETTINGS) if (Object.hasOwn(patch, key) && typeof patch[key] !== "boolean") fail("invalid-settings");
       const next = normalizeUpdateSettings({ ...settings, ...patch });
       saving = true;
       try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cliproxyapi-pro",
-  "version": "1.5.1",
+  "version": "1.6.0",
   "description": "Auto-discovery CLIProxyAPI provider and management UI for DeepSeek Harness — multiple accounts, dynamic model sync, capability detection, and visual settings.",
   "keywords": [
     "dsh",