dsh-cloudq 0.2.0 → 0.3.0

package/lib/client.js

@@ -408,6 +408,46 @@ linear-gradient(-30deg, transparent 49.5%, #2c2c31 49.5%, #2c2c31 50.5%, transpa
   overflow: hidden;
   text-overflow: ellipsis;
 }
+/* Outdated-plugin badge appended after the sidebar button label. */
+.dsh-cloudq-version-badge {
+  position: relative;
+  flex: none;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 16px;
+  height: 16px;
+  margin-left: 6px;
+  border-radius: 50%;
+  background: var(--dsw-alias-state-warning, #d18400);
+  color: #fff;
+  font-size: 11px;
+  font-weight: 700;
+  line-height: 16px;
+  cursor: pointer;
+}
+.dsh-cloudq-version-badge.is-busy {
+  opacity: .7;
+  cursor: default;
+}
+.dsh-cloudq-version-badge__tip {
+  display: none;
+  position: fixed;
+  z-index: 1000;
+  padding: 6px 10px;
+  border-radius: 6px;
+  background: rgba(20, 24, 31, .92);
+  color: #fff;
+  font-size: 12px;
+  font-weight: 400;
+  line-height: 18px;
+  white-space: nowrap;
+  box-shadow: 0 4px 12px rgba(0, 0, 0, .18);
+}
+.dsh-cloudq-version-badge:hover .dsh-cloudq-version-badge__tip,
+.dsh-cloudq-version-badge:focus .dsh-cloudq-version-badge__tip {
+  display: block;
+}
 /* Persisted CloudQ marker shown on rows whose session id is in the registry. */
 .dsh-cloudq-session-badge {
   flex: none;
@@ -773,6 +813,75 @@ linear-gradient(-30deg, transparent 49.5%, #2c2c31 49.5%, #2c2c31 50.5%, transpa
 				if (button) button.remove();
 			};
 		}
+		const API_VERSION = "/api/dsh-cloudq/version";
+		const API_UPDATE = "/api/dsh-cloudq/update";
+		const API_RESTART = "/api/dsh-cloudq/restart";
+		let cloudqOutdatedInfo = null;
+		let cloudqSelfUpdateRunning = false;
+		function positionVersionTip(badge, tip) {
+			const rect = badge.getBoundingClientRect();
+			tip.style.left = `${Math.max(8, rect.left)}px`;
+			tip.style.top = `${rect.bottom + 6}px`;
+			tip.style.bottom = "auto";
+		}
+		/** Append the "!" badge after the sidebar button label (retries while the
+		*  button is not mounted yet). The button node is reused across sidebar
+		*  re-mounts, so a child badge survives them. */
+		function attachVersionBadge(attempt = 0) {
+			if (!cloudqOutdatedInfo) return;
+			const button = document.getElementById("dsh-cloudq-sidebar-entry");
+			if (!button) {
+				if (attempt < 20) window.setTimeout(() => attachVersionBadge(attempt + 1), 500);
+				return;
+			}
+			if (button.querySelector(".dsh-cloudq-version-badge")) return;
+			const badge = document.createElement("span");
+			badge.className = "dsh-cloudq-version-badge";
+			badge.dataset.testid = "cloudq-version-badge";
+			badge.textContent = "!";
+			badge.setAttribute("role", "button");
+			badge.setAttribute("aria-label", `CloudQ 插件有新版本 ${cloudqOutdatedInfo.latest}，点击更新`);
+			const tip = document.createElement("span");
+			tip.className = "dsh-cloudq-version-badge__tip";
+			tip.textContent = `当前版本 ${cloudqOutdatedInfo.current} 不是最新版本 ${cloudqOutdatedInfo.latest}，点击自动更新`;
+			badge.appendChild(tip);
+			badge.addEventListener("mouseenter", () => positionVersionTip(badge, tip));
+			badge.addEventListener("click", (event) => {
+				event.preventDefault();
+				event.stopPropagation();
+				runCloudqSelfUpdate(badge, tip);
+			});
+			button.appendChild(badge);
+		}
+		/** Badge click flow: update → restart host → wait for it → reload page. */
+		async function runCloudqSelfUpdate(badge, tip) {
+			if (cloudqSelfUpdateRunning) return;
+			cloudqSelfUpdateRunning = true;
+			badge.classList.add("is-busy");
+			tip.textContent = "正在更新到最新版本…";
+			try {
+				await cloudqRequest(API_UPDATE, { method: "POST" }, 15e4);
+			} catch (error) {
+				tip.textContent = `更新失败：${error.message}`;
+				badge.classList.remove("is-busy");
+				cloudqSelfUpdateRunning = false;
+				return;
+			}
+			tip.textContent = "更新完成，正在重启 DSH 服务…";
+			try {
+				await cloudqRequest(API_RESTART, { method: "POST" }, 5e3);
+			} catch {}
+			const sleep = (ms) => new Promise((resolvePromise) => window.setTimeout(resolvePromise, ms));
+			const deadline = Date.now() + 6e4;
+			while (Date.now() < deadline) try {
+				await cloudqRequest(API_VERSION, void 0, 3e3);
+				window.location.reload();
+				return;
+			} catch {
+				await sleep(1e3);
+			}
+			tip.textContent = "服务重启超时，请手动重启 DSH 后刷新页面。";
+		}
 		/** Build the exact visible row order from Host workspace membership. */
 		function orderedVisibleSessions(snapshot, workspaces, sortByUpdated) {
 			const archived = new Set(workspaces?.archivedSessionIds ?? []);
@@ -3696,6 +3805,20 @@ display: none;
 					}
 				});
 			}, "dsh-cloudq: refresh artifacts on turn completion");
+			ctx.effect(() => {
+				let disposed = false;
+				cloudqRequest(API_VERSION).then((data) => {
+					if (disposed || data?.outdated !== true || typeof data?.latest !== "string") return;
+					cloudqOutdatedInfo = {
+						current: String(data.current ?? ""),
+						latest: data.latest
+					};
+					attachVersionBadge();
+				}).catch(() => {});
+				return () => {
+					disposed = true;
+				};
+			}, "dsh-cloudq: version check");
 			ctx.effect(() => {
 				const markIfCloudqClaim = () => {
 					const textarea = document.querySelector("textarea[class*=input]");

package/lib/index.js

@@ -1,11 +1,14 @@
 import { createRequire } from "node:module";
-import { existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { get, request } from "node:https";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import Schema from "@deepseek-ai/schemastery";
-import { Buffer as Buffer$1 } from "node:buffer";
+import { Buffer } from "node:buffer";
 import yaml from "js-yaml";
-import { spawn } from "node:child_process";
+import { createHash, createHmac } from "node:crypto";
+import { homedir } from "node:os";
 //#region src/http.js
 /** Maximum accepted JSON request body size. */
 const MAX_JSON_BODY_BYTES = 65536;
@@ -114,7 +117,7 @@ function readJsonBody(request, { maxBytes = MAX_JSON_BODY_BYTES } = {}) {
 		};
 		request.on("data", (chunk) => {
 			if (settled) return;
-			const buffer = Buffer$1.isBuffer(chunk) ? chunk : Buffer$1.from(chunk);
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 			bytes += buffer.byteLength;
 			if (bytes > maxBytes) {
 				rejectOnce(new HttpError(413, "payload-too-large", "The JSON request body is too large."));
@@ -130,7 +133,7 @@ function readJsonBody(request, { maxBytes = MAX_JSON_BODY_BYTES } = {}) {
 				return;
 			}
 			try {
-				resolveBody(JSON.parse(Buffer$1.concat(chunks).toString("utf8")));
+				resolveBody(JSON.parse(Buffer.concat(chunks).toString("utf8")));
 			} catch {
 				rejectBody(new HttpError(400, "invalid-json", "The request body is not valid JSON."));
 			}
@@ -147,13 +150,13 @@ function readJsonBody(request, { maxBytes = MAX_JSON_BODY_BYTES } = {}) {
 //#region src/plugin-manager.js
 /** Host-side management of optional profile bundle entries. */
 const PROTECTED_BUNDLES = /* @__PURE__ */ new Set(["@deepseek-ai/dsh-base", "@deepseek-ai/dsh-web-app"]);
-function profileDirectory(baseUrl) {
+function profileDirectory$1(baseUrl) {
 	const url = new URL(".", baseUrl);
 	if (url.protocol !== "file:") throw new Error("The active DSH profile URL must use the file protocol.");
 	return fileURLToPath(url);
 }
 function patchPath(baseUrl) {
-	return resolve(profileDirectory(baseUrl), "cordis.patch.yml");
+	return resolve(profileDirectory$1(baseUrl), "cordis.patch.yml");
 }
 function parsePatchList(content) {
 	if (!content.trim()) return [];
@@ -226,7 +229,7 @@ function writePatchAtomically(path, content, originalSnapshot) {
 * @returns {Array<{id: string, name: string, bundle: string, disabled: boolean, self: boolean}>}
 */
 function listPlugins(baseUrl) {
-	const profileDir = profileDirectory(baseUrl);
+	const profileDir = profileDirectory$1(baseUrl);
 	const userPatchPath = patchPath(baseUrl);
 	const overrides = (existsSync(userPatchPath) ? parsePatchList(readFileSync(userPatchPath, "utf8")) : []).filter((entry) => entry && typeof entry === "object" && typeof entry.id === "string");
 	const plugins = [];
@@ -287,99 +290,157 @@ function setPluginDisabled(baseUrl, id, disabled) {
 	};
 }
 //#endregion
-//#region src/script-runner.js
-const MAX_SCRIPT_OUTPUT_BYTES = 1048576;
-function safeCode(value) {
-	return typeof value === "string" && /^[a-zA-Z0-9._-]{1,80}$/.test(value) ? value : "script-failed";
+//#region src/tcloud.js
+/**
+* Node-native Tencent Cloud API client (TC3-HMAC-SHA256) and credential
+* store for the dsh-cloudq host.
+*
+* The DSH host itself runs on Node, so — same as dsh-cos — every panel API
+* call happens in-process with zero external runtime dependency. Python only
+* remains for the agent-driven skill conversation flow.
+*
+* @module dsh-cloudq/tcloud
+*/
+const CREDENTIAL_FILE = join(homedir(), ".tencent-cloudq", "credential.json");
+const sha256 = (value) => createHash("sha256").update(value, "utf8").digest("hex");
+const hmacSha256 = (key, value) => createHmac("sha256", key).update(value, "utf8").digest();
+const hmacSha256Hex = (key, value) => createHmac("sha256", key).update(value, "utf8").digest("hex");
+/** Mask a SecretId exactly like the Python helpers: keep only the last 4. */
+function maskSecretId(value) {
+	const text = String(value ?? "");
+	return text.length <= 4 ? "*".repeat(text.length) : "*".repeat(text.length - 4) + text.slice(-4);
+}
+/**
+* Read the stored credential shared with the CloudQ skill.
+* Only the AK/SK entries (`type: "ak"`, optional STS token) can TC3-sign;
+* OAuth/Connector entries carry no SecretKey and surface as NeedAuth.
+*/
+function readCredential() {
+	let data;
+	try {
+		data = JSON.parse(readFileSync(CREDENTIAL_FILE, "utf8"));
+	} catch {
+		return null;
+	}
+	const secretId = typeof data?.secretId === "string" ? data.secretId : "";
+	const secretKey = typeof data?.secretKey === "string" ? data.secretKey : "";
+	if (!secretId || !secretKey) return null;
+	return {
+		secretId,
+		secretKey,
+		token: typeof data?.token === "string" ? data.token : "",
+		authType: typeof data?.type === "string" ? data.type : "ak"
+	};
+}
+/** Credential state for the settings UI (never exposes the SecretKey). */
+function credentialStatus$1() {
+	const credential = readCredential();
+	if (!credential) return { logged_in: false };
+	return {
+		logged_in: true,
+		secret_id_masked: maskSecretId(credential.secretId),
+		auth_type: credential.authType
+	};
 }
-function redact(value, sensitiveValues) {
-	let text = String(value ?? "");
-	for (const sensitive of sensitiveValues) if (sensitive) text = text.replaceAll(sensitive, "[redacted]");
-	return text.replace(/[\r\n\t]+/g, " ").slice(0, 300);
+/** Persist an AK/SK pair atomically, mirroring credential_manager (dir 700, file 600). */
+function saveCredential(secretId, secretKey) {
+	const data = {
+		type: "ak",
+		secretId,
+		secretKey,
+		token: "",
+		expiresAt: 0,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const directory = dirname(CREDENTIAL_FILE);
+	mkdirSync(directory, { recursive: true });
+	const temporary = `${CREDENTIAL_FILE}.tmp-${process.pid}`;
+	writeFileSync(temporary, JSON.stringify(data, null, 2), {
+		encoding: "utf8",
+		mode: 384
+	});
+	renameSync(temporary, CREDENTIAL_FILE);
+	if (process.platform !== "win32") try {
+		chmodSync(directory, 448);
+		chmodSync(CREDENTIAL_FILE, 384);
+	} catch {}
+}
+/** Remove the stored credential (退出登录). */
+function deleteCredential() {
+	try {
+		unlinkSync(CREDENTIAL_FILE);
+	} catch {}
 }
 /**
-* Run one bundled Python helper with bounded output and optional stdin.
-* @param {string} scriptsDirectory Absolute scripts directory.
-* @param {string} scriptName Bundled script filename.
-* @param {string[]} args Non-sensitive command-line arguments.
-* @param {object} options Execution options.
-* @returns {Promise<Record<string, unknown>>} Parsed helper response.
+* Call a Tencent Cloud API with TC3-HMAC-SHA256 signing.
+* Returns the unwrapped `Response` payload; API errors become HttpError with
+* the upstream code (AuthFailure.* etc.) so callers can map them like the
+* Python helpers did.
 */
-function runScript$1(scriptsDirectory, scriptName, args, { timeoutMs = 3e4, jsonOnly = true, stdin, sensitiveValues = [], spawnProcess = spawn } = {}) {
-	return new Promise((resolveRun, rejectRun) => {
-		const child = spawnProcess("python3", [resolve(scriptsDirectory, scriptName), ...args], {
-			stdio: [
-				stdin === void 0 ? "ignore" : "pipe",
-				"pipe",
-				"pipe"
-			],
-			timeout: timeoutMs
-		});
-		let stdout = "";
-		let stderr = "";
-		let outputBytes = 0;
-		let settled = false;
-		const rejectOnce = (error) => {
-			if (settled) return;
-			settled = true;
-			rejectRun(error);
-		};
-		const resolveOnce = (value) => {
-			if (settled) return;
-			settled = true;
-			resolveRun(value);
-		};
-		const collect = (current, chunk) => {
-			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-			outputBytes += buffer.byteLength;
-			if (outputBytes > MAX_SCRIPT_OUTPUT_BYTES) {
-				child.kill();
-				rejectOnce(new HttpError(502, "script-output-too-large", "The CloudQ helper returned too much data."));
-				return current;
-			}
-			return current + buffer.toString("utf8");
-		};
-		child.stdout.on("data", (chunk) => {
-			stdout = collect(stdout, chunk);
-		});
-		child.stderr.on("data", (chunk) => {
-			stderr = collect(stderr, chunk);
-		});
-		child.on("error", () => {
-			rejectOnce(new HttpError(502, "script-launch-failed", "The CloudQ helper could not be started."));
+async function callTcloudApi({ service, host, action, version, payload = {} }, credential = readCredential()) {
+	if (!credential) throw new HttpError(401, "NeedAuth", "尚未配置 AK/SK，请前往「设置 → 插件 → CloudQ」完成配置。");
+	const body = JSON.stringify(payload);
+	const timestamp = Math.floor(Date.now() / 1e3);
+	const date = (/* @__PURE__ */ new Date(timestamp * 1e3)).toISOString().slice(0, 10);
+	const canonicalRequest = [
+		"POST",
+		"/",
+		"",
+		`content-type:application/json\nhost:${host}\nx-tc-action:${action.toLowerCase()}`,
+		"",
+		"content-type;host;x-tc-action",
+		sha256(body)
+	].join("\n");
+	const stringToSign = [
+		"TC3-HMAC-SHA256",
+		String(timestamp),
+		`${date}/${service}/tc3_request`,
+		sha256(canonicalRequest)
+	].join("\n");
+	const keyDate = hmacSha256(`TC3${credential.secretKey}`, date);
+	const keyService = hmacSha256(keyDate, service);
+	const keySigning = hmacSha256(keyService, "tc3_request");
+	const signature = hmacSha256Hex(keySigning, stringToSign);
+	const authorization = `TC3-HMAC-SHA256 Credential=${credential.secretId}/${date}/${service}/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=${signature}`;
+	const headers = {
+		"Content-Type": "application/json",
+		"X-TC-Action": action,
+		"X-TC-Version": version,
+		"X-TC-Timestamp": String(timestamp),
+		Authorization: authorization
+	};
+	if (credential.token) headers["X-TC-Token"] = credential.token;
+	const text = await new Promise((resolveRequest, rejectRequest) => {
+		const request$1 = request({
+			host,
+			path: "/",
+			method: "POST",
+			headers,
+			timeout: 3e4
+		}, (response) => {
+			let bodyText = "";
+			response.on("data", (chunk) => {
+				bodyText += chunk;
+				if (bodyText.length > 1048576) request$1.destroy();
+			});
+			response.on("end", () => resolveRequest(bodyText));
 		});
-		child.on("close", (code) => {
-			if (settled) return;
-			const trimmed = stdout.trim();
-			if (!jsonOnly) {
-				if (code !== 0) rejectOnce(new HttpError(502, "script-failed", "The CloudQ helper failed."));
-				else resolveOnce({
-					success: true,
-					message: redact(trimmed, sensitiveValues)
-				});
-				return;
-			}
-			let parsed;
-			try {
-				parsed = trimmed ? JSON.parse(trimmed) : {};
-			} catch {
-				rejectOnce(new HttpError(502, "script-invalid-output", "The CloudQ helper returned an invalid response."));
-				return;
-			}
-			if (code !== 0 || parsed?.ok === false || parsed?.success === false) {
-				const codeValue = safeCode(parsed?.error?.code ?? parsed?.code);
-				rejectOnce(new HttpError(502, codeValue, "The CloudQ helper failed."));
-				return;
-			}
-			resolveOnce(parsed);
+		request$1.on("error", () => rejectRequest(new HttpError(502, "network-error", "无法连接腾讯云服务，请检查网络后重试。")));
+		request$1.on("timeout", () => {
+			request$1.destroy();
+			rejectRequest(new HttpError(504, "network-timeout", "腾讯云服务响应超时，请稍后重试。"));
 		});
-		if (stdin !== void 0) {
-			child.stdin.on("error", () => {
-				rejectOnce(new HttpError(502, "script-input-failed", "The CloudQ helper could not receive its input."));
-			});
-			child.stdin.end(stdin);
-		}
+		request$1.end(body);
 	});
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new HttpError(502, "invalid-response", "腾讯云服务返回了无法识别的响应。");
+	}
+	const envelope = parsed?.Response ?? {};
+	if (envelope.Error) throw new HttpError(502, String(envelope.Error.Code ?? "api-error"), String(envelope.Error.Message ?? "腾讯云接口调用失败。"));
+	return envelope;
 }
 //#endregion
 //#region src/index.js
@@ -405,6 +466,121 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 function skillDirectory() {
 	return resolve(__dirname, "../skills/cloudq");
 }
+/** This plugin's own version, read from the installed package manifest. */
+const PACKAGE_VERSION = (() => {
+	try {
+		return JSON.parse(readFileSync(resolve(__dirname, "../package.json"), "utf8"))?.version ?? "0.0.0";
+	} catch {
+		return "0.0.0";
+	}
+})();
+/**
+* Profile directory holding this plugin (`<profile>/node_modules/dsh-cloudq`).
+* Both src/ (dev) and lib/ (packed) sit one level under the package root.
+*/
+function profileDirectory() {
+	return resolve(__dirname, "../../..");
+}
+/** Fetch the latest published version from the npm registry (best effort). */
+function fetchLatestPackageVersion() {
+	return new Promise((resolvePromise) => {
+		const request = get("https://registry.npmjs.org/dsh-cloudq/latest", { timeout: 8e3 }, (res) => {
+			if (res.statusCode !== 200) {
+				res.resume();
+				resolvePromise(null);
+				return;
+			}
+			let body = "";
+			res.on("data", (chunk) => {
+				body += chunk;
+				if (body.length > 65536) request.destroy();
+			});
+			res.on("end", () => {
+				try {
+					resolvePromise(JSON.parse(body)?.version ?? null);
+				} catch {
+					resolvePromise(null);
+				}
+			});
+		});
+		request.on("error", () => resolvePromise(null));
+		request.on("timeout", () => {
+			request.destroy();
+			resolvePromise(null);
+		});
+	});
+}
+let latestVersionCache = {
+	at: 0,
+	version: null
+};
+async function latestPackageVersion() {
+	if (latestVersionCache.version && Date.now() - latestVersionCache.at < 6e5) return latestVersionCache.version;
+	const version = await fetchLatestPackageVersion();
+	if (version) latestVersionCache = {
+		at: Date.now(),
+		version
+	};
+	return version;
+}
+/** Semver-ish compare: is `latest` strictly newer than `current`? */
+function isNewerVersion(latest, current) {
+	const parse = (value) => String(value).split(".").map((part) => parseInt(part, 10) || 0);
+	const next = parse(latest);
+	const now = parse(current);
+	for (let index = 0; index < 3; index += 1) if (next[index] !== now[index]) return next[index] > now[index];
+	return false;
+}
+const UPDATE_TIMEOUT_MS = 12e4;
+/** Install the latest published plugin version into the active profile. */
+function runProfileUpdate() {
+	return new Promise((resolveRun, rejectRun) => {
+		const child = spawn("pnpm", [
+			"add",
+			"dsh-cloudq@latest",
+			"--registry=https://registry.npmjs.org/"
+		], { cwd: profileDirectory() });
+		let output = "";
+		const collect = (chunk) => {
+			output += chunk;
+			if (output.length > 65536) child.kill();
+		};
+		child.stdout.on("data", collect);
+		child.stderr.on("data", collect);
+		const timer = setTimeout(() => {
+			child.kill();
+			rejectRun(new HttpError(504, "update-timeout", "更新超时，请检查网络后重试。"));
+		}, UPDATE_TIMEOUT_MS);
+		child.on("error", () => {
+			clearTimeout(timer);
+			rejectRun(new HttpError(502, "update-failed", "无法启动 pnpm，请在终端手动执行：dsh plugin --profile web add dsh-cloudq"));
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			if (code === 0) resolveRun();
+			else rejectRun(new HttpError(502, "update-failed", `更新失败：${output.trim().slice(-200) || "pnpm 执行异常"}`));
+		});
+	});
+}
+/**
+* Restart the DSH host after an update. A detached watcher respawns the same
+* command line the moment this process exits; there is no supervisor, so the
+* plugin exits itself once the watcher is armed.
+*/
+function scheduleSelfRestart() {
+	if (process.platform === "win32") throw new HttpError(501, "restart-unsupported", "当前系统不支持自动重启，请手动重启 DSH 服务。");
+	const quote = (value) => `'${String(value).replaceAll("'", "'\\''")}'`;
+	const command = [
+		`while kill -0 ${process.pid} 2>/dev/null; do sleep 0.5; done`,
+		"sleep 1",
+		`cd ${quote(process.cwd())} && nohup ${quote(process.argv[0])} ${process.argv.slice(1).map(quote).join(" ")} >> /tmp/dsh-cloudq-restart.log 2>&1 &`
+	].join("; ");
+	spawn("/bin/sh", ["-c", command], {
+		detached: true,
+		stdio: "ignore"
+	}).unref();
+	setTimeout(() => process.exit(0), 300).unref();
+}
 /** Raw SKILL.md body. */
 function rawSkillContent() {
 	return readFileSync(resolve(skillDirectory(), "SKILL.md"), "utf8");
@@ -419,119 +595,124 @@ function renderedSkillContent() {
 	const baseDir = skillDirectory();
 	return rawSkillContent().replace(/\{baseDir\}/g, baseDir);
 }
-/** Run one helper from the bundled CloudQ skill. */
-async function runScript(scriptName, args, options) {
+/** Map upstream TC error codes to stable, actionable client-facing errors. */
+function normalizeApiError(error) {
+	if (error instanceof HttpError) {
+		if (error.code === "NeedAuth") throw error;
+		if (typeof error.code === "string" && error.code.startsWith("AuthFailure")) throw new HttpError(401, "AuthFailure", "AK/SK 无效或权限不足，请前往「设置 → 插件 → CloudQ」检查配置。");
+	}
+	throw error;
+}
+/** Wrap one API call with the credential-error mapping. */
+async function callCloudq(spec) {
 	try {
-		return await runScript$1(resolve(skillDirectory(), "scripts"), scriptName, args, options);
+		return { data: await callTcloudApi(spec) };
 	} catch (error) {
-		if (error instanceof HttpError) {
-			if (error.code === "NeedAuth") throw new HttpError(401, "NeedAuth", "尚未配置 AK/SK，请前往「设置 → 插件 → CloudQ」完成配置。");
-			if (error.code === "CredentialExpired") throw new HttpError(401, "CredentialExpired", "凭证已过期，请前往「设置 → 插件 → CloudQ」重新配置。");
-			if (typeof error.code === "string" && error.code.startsWith("AuthFailure")) throw new HttpError(401, "AuthFailure", "AK/SK 无效或权限不足，请前往「设置 → 插件 → CloudQ」检查配置。");
-		}
+		normalizeApiError(error);
 		throw error;
 	}
 }
-/** Remove host filesystem details before returning credential state to the browser. */
-function publicCredentialStatus(status) {
-	if (!status || typeof status !== "object" || Array.isArray(status)) return status;
-	const safeStatus = { ...status };
-	delete safeStatus.credential_file;
-	return safeStatus;
-}
-/** Wrap runScript so failures keep a stable envelope for the client. */
-async function credentialStatus() {
-	return publicCredentialStatus(await runScript("login.py", ["--status"]));
+/** Credential state for the settings UI (never exposes the SecretKey). */
+function credentialStatus() {
+	return credentialStatus$1();
 }
 function logout() {
-	return runScript("logout.py", [], { jsonOnly: false });
+	deleteCredential();
+	return { message: "已退出登录。" };
 }
 /**
 * Validate a long-lived Tencent Cloud AK/SK pair without persisting it.
-* The script performs one read-only CloudQ call to prove the key works.
+* DescribeCloudQUsageOverview is read-only, parameterless, and CloudQ's own
+* API — a successful call proves both the key and the CloudQ enrollment.
 */
-function testAccessKey(secretId, secretKey) {
-	return runScript("save_ak.py", ["--test", "--stdin"], {
-		stdin: JSON.stringify({
+async function testAccessKey(secretId, secretKey) {
+	try {
+		await callTcloudApi({
+			service: "advisor",
+			host: "advisor.tencentcloudapi.com",
+			action: "DescribeCloudQUsageOverview",
+			version: "2020-07-21"
+		}, {
 			secretId,
-			secretKey
-		}),
-		sensitiveValues: [secretId, secretKey]
-	});
+			secretKey,
+			token: ""
+		});
+		return {
+			valid: true,
+			secret_id_masked: maskSecretId(secretId)
+		};
+	} catch (error) {
+		normalizeApiError(error);
+		throw error;
+	}
 }
 /** Validate then persist a long-lived AK/SK pair as `type:"ak"`. */
 async function saveAccessKey(secretId, secretKey) {
-	return publicCredentialStatus(await runScript("save_ak.py", ["--save", "--stdin"], {
-		stdin: JSON.stringify({
-			secretId,
-			secretKey
-		}),
-		sensitiveValues: [secretId, secretKey]
-	}));
+	await testAccessKey(secretId, secretKey);
+	saveCredential(secretId, secretKey);
+	return credentialStatus$1();
 }
 function cloudqUsageOverview() {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeCloudQUsageOverview",
-		"2020-07-21",
-		"{}"
-	]);
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeCloudQUsageOverview",
+		version: "2020-07-21"
+	});
 }
 function cloudqUsageDetail({ startTime, endTime, limit = 20, offset = 0 }) {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeCloudQUsageDetail",
-		"2020-07-21",
-		JSON.stringify({
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeCloudQUsageDetail",
+		version: "2020-07-21",
+		payload: {
 			StartTime: startTime,
 			EndTime: endTime,
 			Limit: limit,
 			Offset: offset
-		})
-	]);
+		}
+	});
 }
 function cloudqInspirationList() {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeCloudQInspirationList",
-		"2020-07-21",
-		"{\"Category\":0}"
-	]);
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeCloudQInspirationList",
+		version: "2020-07-21",
+		payload: { Category: 0 }
+	});
 }
 /** Fetch all CloudQ artifact sessions and their archived files. */
 function cloudqArtifactLibrary() {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeCloudQArtifactLibrary",
-		"2020-07-21",
-		"{}"
-	]);
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeCloudQArtifactLibrary",
+		version: "2020-07-21"
+	});
 }
 /** Fetch the architecture directory tree available to the current account. */
 function cloudqArchitectureDirectories() {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"ListDirectoryV2",
-		"2020-07-21",
-		JSON.stringify({
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "ListDirectoryV2",
+		version: "2020-07-21",
+		payload: {
 			Tags: [],
 			TagKeys: []
-		})
-	]);
+		}
+	});
 }
 /** Fetch one page of diagrams in a CloudQ architecture directory. */
 function cloudqArchitectureList({ folderId, pageNumber = 1, pageSize = 30 }) {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeArchList",
-		"2020-07-21",
-		JSON.stringify({
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeArchList",
+		version: "2020-07-21",
+		payload: {
 			PageNumber: pageNumber,
 			PageSize: pageSize,
 			SearchKey: "",
@@ -539,8 +720,8 @@ function cloudqArchitectureList({ folderId, pageNumber = 1, pageSize = 30 }) {
 			WithSvgURL: true,
 			Tags: [],
 			TagKeys: []
-		})
-	]);
+		}
+	});
 }
 /**
 * Extract and validate an AK/SK pair from a request body.
@@ -676,6 +857,53 @@ function apply(ctx) {
 				}
 			}
 		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/version",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "GET");
+					const latest = await latestPackageVersion();
+					sendJson(response, 200, {
+						ok: true,
+						current: PACKAGE_VERSION,
+						latest,
+						outdated: latest !== null && isNewerVersion(latest, PACKAGE_VERSION)
+					});
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/update",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "POST");
+					await runProfileUpdate();
+					sendJson(response, 200, { ok: true });
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
+		disposers.push(ctx.webServer.register({
+			kind: "exact",
+			path: "/api/dsh-cloudq/restart",
+			handler: async (request, response) => {
+				try {
+					assertSafeRequest(request, "POST");
+					sendJson(response, 200, {
+						ok: true,
+						restarting: true
+					});
+					scheduleSelfRestart();
+				} catch (error) {
+					sendError(response, error);
+				}
+			}
+		}));
 		disposers.push(ctx.webServer.register({
 			kind: "exact",
 			path: "/api/dsh-cloudq/credential/test",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cloudq",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "CloudQ integration for DeepSeek Harness with secure credential, workspace, and plugin-management surfaces",
   "license": "MIT",
   "type": "module",