dsh-deepseek-balance-widget 2.3.0 → 2.3.1

package/lib/index.js

@@ -567,16 +567,27 @@ async function runPackageUpdate() {
   const target = versionInfo.latest;
   const pm = await detectPackageManager();
   const isWin = process.platform === "win32";
-  const cmd = isWin ? (pm === "pnpm" ? "pnpm.cmd" : "npm.cmd") : pm;
+  const cmd = isWin ? (pm === "pnpm" ? "pnpm" : "npm") : pm;
   const args = pm === "pnpm"
     ? ["add", `dsh-deepseek-balance-widget@${target}`]
     : ["install", `dsh-deepseek-balance-widget@${target}`];
   return new Promise((resolve) => {
-    const child = spawn(cmd, args, {
-      cwd: UPDATE_CWD,
-      shell: isWin,
-      env: { ...process.env, NPM_CONFIG_FUND: "false", NPM_CONFIG_AUDIT: "false" }
-    });
+    let child;
+    if (isWin) {
+      // Avoid Node.js DEP0190: spawn with shell:true and a separate args array is deprecated.
+      // Build a single command string and let cmd.exe parse it; hide the console window.
+      const quotedArgs = args.map((a) => `"${a.replace(/"/g, '\\"')}"`).join(" ");
+      child = spawn("cmd.exe", ["/d", "/s", "/c", `${cmd} ${quotedArgs}`], {
+        cwd: UPDATE_CWD,
+        windowsHide: true,
+        env: { ...process.env, NPM_CONFIG_FUND: "false", NPM_CONFIG_AUDIT: "false" }
+      });
+    } else {
+      child = spawn(cmd, args, {
+        cwd: UPDATE_CWD,
+        env: { ...process.env, NPM_CONFIG_FUND: "false", NPM_CONFIG_AUDIT: "false" }
+      });
+    }
     let stdout = "";
     let stderr = "";
     child.stdout.on("data", (chunk) => { stdout += String(chunk); });
@@ -584,13 +595,26 @@ async function runPackageUpdate() {
     child.on("error", (error) => {
       resolve({ ok: false, output: stdout + stderr, error: String(error?.message ?? error) });
     });
-    child.on("close", (code) => {
+    child.on("close", async (code) => {
       const output = (stdout + "\n" + stderr).trim();
-      if (code === 0) {
-        resolve({ ok: true, output: output.slice(-800) });
-      } else {
+      if (code !== 0) {
         resolve({ ok: false, output, error: `${pm} ${args.join(" ")} exited with code ${code}` });
+        return;
+      }
+      // Verify the on-disk version actually changed so the user can't be misled into
+      // restarting dsh when the install silently wrote to a different location.
+      try {
+        const installedPkgPath = resolve(UPDATE_CWD, "node_modules", "dsh-deepseek-balance-widget", "package.json");
+        const installedPkg = JSON.parse(await readFile(installedPkgPath, "utf8"));
+        if (installedPkg.version !== target) {
+          resolve({ ok: false, output, error: `installed version mismatch: expected ${target}, found ${installedPkg.version}` });
+          return;
+        }
+      } catch (verifyError) {
+        resolve({ ok: false, output, error: `update appeared to succeed but could not verify installed version: ${String(verifyError?.message ?? verifyError)}` });
+        return;
       }
+      resolve({ ok: true, output: output.slice(-800) });
     });
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-deepseek-balance-widget",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "type": "module",
   "description": "Multi-provider AI balance widget for the dsh web sidebar: a live, auto-refreshing balance pill plus a detail popover listing DeepSeek and any added providers (MiMo etc.). Keys are stored per-machine in ~/.dsh/ai-balances.json and resolved from the local credential seam, never hardcoded.",
   "keywords": [