dsh-eda-mcp 1.0.2 → 1.1.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 1.1.1 — 2026-10-21
+
+### 设置卡片：下载仍是本地那份，但**能校验服务器副本**
+
+- 事实澄清（改前就是如此）：设置卡片的「下载 JLCEDA 扩展包」是 `<a href="/api/dsh-eda-mcp/extension.zip">`，由插件读**包内自带**的 zip 直接回传，**不经过服务器**。这是有意的：离线也能装、不会被限流、不依赖服务器可用性。
+- 现在响应头带 `x-extension-version`、`x-extension-sha256`、`content-length`，下载到的文件可自行核对。
+- 新增路由 `GET /api/dsh-eda-mcp/extension/verify`：从下载服务器取回同一文件并逐字节比对，返回 `verified: match | mismatch | unverified`（429 会带 `httpStatus` 与"是限流不是不一致"的说明）。卡片上多一个「校验服务器副本」按钮直接显示结果。
+- 新增第 **11** 套单测 `extension-routes`：用真实本地 HTTP 服务模拟三种服务器响应（同字节 / 不同字节 / 429），断言 `match`、`mismatch`、`unverified + 429`，并断言下载响应的 sha256 头与实际发出的字节一致。
+
+
+## 1.1.0 — 2026-10-21
+
+### `/eda/` 下载限流（服务器侧，5 次/分钟/IP）
+
+服务器新增 nginx 令牌桶限流：`limit_req_zone $eda_rate_key zone=eda_download:10m rate=5r/m`，`burst=5 nodelay`，超限返回 **429** 并带可读响应体；`127.0.0.1`/`::1` 用 `geo` 置空 key 白名单放行，服务器自查与上传校验不会被限流。区域配置在 `/etc/nginx/conf.d/eda-ratelimit.conf`，限流指令在 `/eda/` location 内。
+
+- 实测：连续请求 → 前 6 次 `200`，第 7 次起 `429`；被限流期间 `/dreamspeedrun/` 仍 `200`、`/files/` 仍 `403`（未受影响）。
+- `eda_extension_package` 遇 `429` 时返回 `verified: unverified` + `httpStatus: 429` 并明确说明"是限流，不是校验不一致"（真机触发验证过）；`verified` 绝不会把限流误报成 `mismatch`。
+- 记录一个事实：nginx **不支持 `rate=20r/h`**（单位只有 `r/s`、`r/m`，实测 `invalid rate`），所以按你的决定改为 `5r/m`。
+
+
+
+### 扩展 zip 的下载与校验（线协议不变 0.4.9）
+
+之前只有"本地那份"和"服务器那份"，**没有任何东西能证明二者一致**，也没有从服务器下载的能力：
+
+- 新增工具 `eda_extension_package`：报告插件自带 zip 的路径/字节数/sha256；`download:true` 时从下载服务器取回同一文件并**逐字节比较**，给出 `verified: match | mismatch`；一致才写入 `outDir`（默认临时目录），不一致**不落盘**并提示重新上传；`base` 可用 `DSH_EDA_EXTENSION_BASE` 覆盖。
+- 新增纯函数模块 `src/bridge/extension-package.ts`（sha256、URL 拼接、"缺摘要算 unverified 而不是通过"）+ `test/extension-package.test.ts`（进入 `pnpm test`，共 10 套）。
+- **修掉一个真 bug**：`build.mjs` 的 `Compress-Archive` 把文件 mtime 打进 zip，同一份源码两次构建得到**不同字节**（实测同为 9827 字节、sha256 不同），校验因此永远假阴性。现在打包前把暂存目录（含子目录）mtime 固定为 2020-01-01，**构建可复现**：连续两次 build 同为 `827e9ad9…`。
+- 真机验证：上传可复现 zip → 服务器 `sha256sum` 与本地一致 → `eda_extension_package({download:true})` 返回 `verified: match` 并落盘。
+
 ## 1.0.2 — 2026-10-20
 
 ### 覆铜调查结案（扩展 0.4.7 / 0.4.8 真机）

package/CONTRIBUTING.md

@@ -106,6 +106,39 @@ git push origin main --follow-tags
 extension have their own version pair (they are the wire contract between the
 bridge process and JLCEDA, and `eda_status` reports a mismatch).
 
+### Uploading the extension zip to the download server
+
+Every wire-version bump produces a new `dsh-eda-bridge-extension-<version>.zip` (it is
+gitignored, so the file lives only in the npm tarball and on the download server). The
+maintainer asked for the server copy to be refreshed on every update — do it in the same
+session that bumps the extension, not later:
+
+1. upload the new zip to `/var/www/eda-download/` on `tencent` (`root@159.75.130.207`)
+   **without deleting older versions** — the version is in the filename, so old links keep
+   working;
+2. verify the transfer: the remote `sha256sum` must equal `Get-FileHash` locally, and
+   `curl -sI http://159.75.130.207/eda/<zip>` must answer `200` + `Content-Type:
+   application/zip` + the exact byte count;
+3. only then hand the link out:
+   `http://159.75.130.207/eda/dsh-eda-bridge-extension-<version>.zip`
+   (the listing at `http://159.75.130.207/eda/` shows every published zip).
+
+The directory is served by one additive `location /eda/` block in
+`/etc/nginx/conf.d/voice.conf`; adding or replacing files needs no nginx change and no
+reload. Keep every other part of that server untouched.
+
+### Rate limit
+
+`/eda/` is throttled to **5 requests/minute per IP with burst 5** (nginx `limit_req`,
+`rate=5r/m`): six requests pass immediately, the seventh answers `429` with a readable body.
+`127.0.0.1` and `::1` are exempt (geo key is empty), so server-side checks never throttle.
+The zone lives in `/etc/nginx/conf.d/eda-ratelimit.conf`, the limit itself inside the `/eda/`
+location; changing the rate needs `nginx -t` plus a reload.
+
+Verifying an upload from an office IP can therefore hit the limit: `eda_extension_package`
+reports that as `verified: 'unverified'` with `httpStatus: 429` — wait about a minute and
+retry instead of suspecting the artifact. A `429` is never a checksum mismatch.
+
 Publishing to npm is documented step by step in [`docs/release.md`](docs/release.md):
 first release is manual (2FA / staged publishing), afterwards the `publish`
 workflow releases on every `v*` tag through npm trusted publishing (OIDC, no

package/README.md

@@ -41,6 +41,32 @@ toolchain is needed. The extension still has to be imported into JLCEDA Pro by h
 sits at `node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<version>.zip` (or download it from the
 settings card).
 
+Direct links (no package install needed):
+
+- `http://159.75.130.207/eda/dsh-eda-bridge-extension-0.4.9.zip` (current wire version)
+- `http://159.75.130.207/eda/` - directory listing of every uploaded extension zip
+
+The filename always carries the wire version; check `eda_status` after importing and restart JLCEDA
+Pro when the version differs from the bridge.
+
+Verification: `eda_extension_package` reports the zip this plugin ships (path, bytes, sha256) and,
+with `download: true`, fetches the served copy and compares the two byte for byte (`verified: match |
+mismatch`). On a match it saves the file to `outDir` (default: the temp directory); on a mismatch it
+writes nothing and tells you to re-upload. The zip build is reproducible, so equal sources always
+produce the same sha256.
+
+The download server throttles `/eda/` to 5 requests/minute per IP (burst 5, loopback exempt), so
+a `429` shows up as `verified: 'unverified'` with `httpStatus: 429` — that is throttling, not a
+checksum mismatch; wait a minute and retry.
+The settings card serves the **bundled** copy (works offline, never throttled) and stamps
+`x-extension-version` / `x-extension-sha256` on the response; its "Verify server copy" button calls
+`/api/dsh-eda-mcp/extension/verify` and reports match / mismatch / why verification was impossible
+(429 throttling included).
+The settings card serves the **bundled** copy (works offline, never throttled) and stamps
+`x-extension-version` / `x-extension-sha256` on the response; its "Verify server copy" button calls
+`/api/dsh-eda-mcp/extension/verify` and reports match / mismatch / why verification was impossible
+(429 throttling included).
+
 ### 1. Install into the DSH web profile
 
 ```sh

package/README.zh.md

@@ -50,6 +50,21 @@ pnpm add dsh-eda-mcp            # 或用 Web GUI 的插件管理器安装
 发布包里已包含 `lib/` 与 `dsh-eda-bridge-extension-<线协议版本>.zip`，**不需要构建工具链**。扩展仍需手动导入
 嘉立创EDA：zip 位于 `node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<线协议版本>.zip`（也可从设置卡片下载，下载到的文件名自带版本号）。
 
+直链（不用装包也能下）：
+
+- `http://159.75.130.207/eda/dsh-eda-bridge-extension-0.4.9.zip`（当前线协议版本）
+- `http://159.75.130.207/eda/` —— 所有已上传扩展 zip 的目录列表
+
+文件名自带线协议版本：导入后用 `eda_status` 核对，版本与桥接不一致就重启嘉立创EDA专业版。
+
+校验：`eda_extension_package` 报告插件自带的 zip（路径、字节数、sha256）；传 `download: true` 时会把服务器那份取回来逐字节比对（`verified: match | mismatch`），一致才存到 `outDir`（默认临时目录），不一致则不落盘并提示重新上传。zip 构建已改为可复现，同样的源码永远得到同一个 sha256。
+
+下载服务器对 `/eda/` 限流 **5 次/分钟/IP**（burst 5，回环地址豁免）：被限流时工具返回 `verified: unverified` 且 `httpStatus: 429` —— 这是限流，不是校验不一致，等一分钟重试即可。
+
+设置卡片的下载按钮给的是**插件自带的那份**（离线可用、不被限流），响应头带 `x-extension-version` 与 `x-extension-sha256`；旁边的「校验服务器副本」按钮调用 `/api/dsh-eda-mcp/extension/verify`，逐字节比对后给出 `match / mismatch / 无法校验（含 429 限流原因）`。
+
+设置卡片的下载按钮给的是**插件自带的那份**（离线可用、不被限流），响应头带 `x-extension-version` 与 `x-extension-sha256`；旁边的「校验服务器副本」按钮调用 `/api/dsh-eda-mcp/extension/verify`，逐字节比对后直接给出 `match / mismatch / 无法校验（含 429 限流原因）`。
+
 ### 1. 安装到 DSH Web profile
 
 ```sh

package/docs/schematic-workflow.md

@@ -292,5 +292,6 @@ C. 只做 PCB：
 - **插件代码改动对当前会话完全不生效**：宿主在启动时把 `lib/index.js` 载入内存，之后改文件、重新 build 都不会热更新。
 - 版本纪律：扩展线协议**只递增最小位**（`0.4.1 → 0.4.2`），每次改动必须同时改 `jlc-extension/extension.json` 的 `version` 与桥接的 `VERSION`；不一致时 `eda_status.versionMismatch` 为 true。
 - 新会话开工顺序：`eda_status`（连没连、版本对不对）→ 本技能（怎么干）→ 再动手；不要先假设环境就绪。
+| 需要扩展 zip（换机器/给别人） | 不清楚该给哪一份 | `eda_extension_package` 报路径+sha256；`download:true` 从服务器取回并逐字节比对（`verified`），一致才落盘 |
 - 扩展 zip 位置：`node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<版本>.zip`，或设置卡片下载（文件名自带版本号）。
 - 排查顺序：`eda_status` → `/api/dsh-eda-mcp/diagnostics`（`clientStartupError` / `skills` / `bridgeHealth`）→ `eda_list_api_methods`（白名单）→ 应用侧 DRC 面板。

package/docs/tools.md

@@ -176,3 +176,9 @@ Design limits enforced by these tools (track widths, via sizes, net naming) are
 |---|---|---|
 | `eda_api_call` | Call an allow-listed JLCEDA Pro extension API method directly. | `method: string, args: array` |
 
+## Other
+
+| Tool | Description | Parameters |
+|---|---|---|
+| `eda_extension_package` | Report the extension zip this plugin ships (absolute path, bytes, sha256) and, with download:true, fetch the copy served at the download base URL and compare the two byte for byte. On a match the served file is saved to outDir (default: the temp directory) so it can be imported into JLCEDA Pro; on a mismatch nothing is written and the tool says to re-upload. base defaults to DSH_EDA_EXTENSION_BASE or the project download server. | `download?: boolean, outDir?: string, base?: string` |
+

package/lib/bridge.mjs

@@ -1,11 +1,12 @@
 // src/bridge/index.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { execFileSync, spawn } from "node:child_process";
-import { statSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { mkdir, unlink, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { createServer } from "node:http";
 import { createInterface } from "node:readline";
 
@@ -624,6 +625,26 @@ function runNetlistErc(rawNetlist) {
   return { ok: counts.fail === 0, counts, componentCount: components.length, netCount: nets.size, checks };
 }
 
+// src/bridge/extension-package.ts
+import { createHash } from "node:crypto";
+function sha256Of(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function extensionZipName(version) {
+  return "dsh-eda-bridge-extension-" + version + ".zip";
+}
+function extensionDownloadUrl(base, version) {
+  const normalised = base.endsWith("/") ? base : base + "/";
+  return new URL(extensionZipName(version), normalised).toString();
+}
+function compareDigest(expected, actual) {
+  if (typeof expected !== "string" || typeof actual !== "string") return "unverified";
+  const left = expected.trim().toLowerCase();
+  const right = actual.trim().toLowerCase();
+  if (left === "" || right === "") return "unverified";
+  return left === right ? "match" : "mismatch";
+}
+
 // src/bridge/design-rules.ts
 var MIL_PER_MM = 39.37007874015748;
 function milToMm(mil) {
@@ -1100,6 +1121,7 @@ var TOOLS = [
   { name: "eda_pcb_canvas_origin", description: "Read (or align) the PCB canvas origin and convert points between the two coordinate spaces. JLCEDA displays CANVAS coordinates in its UI but every API takes DATA coordinates; the two differ by this offset, so a coordinate read off the screen will land somewhere else unless you convert or align. align:true calls setCanvasOrigin(0,0) so the display matches the API.", inputSchema: objectSchema({ align: { type: "boolean" }, offsetX: { type: "number" }, offsetY: { type: "number" }, point: { type: "object", additionalProperties: true } }) },
   { name: "eda_capture", description: "Render the active document to a PNG (dmt_EditorControl.getCurrentRenderedAreaImage) and write it to outPath or return a data URL. Use it to LOOK at the sheet/board instead of trusting coordinate math. The PNG is a scratch file: read it, then call eda_capture({cleanup:true}) to delete every capture path this session wrote.", inputSchema: objectSchema({ outPath: { type: "string" }, inline: { type: "boolean" }, cleanup: { type: "boolean" } }) },
   { name: "eda_workflow_guide", description: "Return the schematic working standard: grid-aligned manual placement, signal flow, when net labels/ports are required (a wire net name is overridden by connectivity), net-label fallback behaviour, batch placement and the verification order. Read it before laying out a sheet.", inputSchema: objectSchema({}) },
+  { name: "eda_extension_package", description: "Report the extension zip this plugin ships (absolute path, bytes, sha256) and, with download:true, fetch the copy served at the download base URL and compare the two byte for byte. On a match the served file is saved to outDir (default: the temp directory) so it can be imported into JLCEDA Pro; on a mismatch nothing is written and the tool says to re-upload. base defaults to DSH_EDA_EXTENSION_BASE or the project download server.", inputSchema: objectSchema({ download: { type: "boolean" }, outDir: { type: "string" }, base: { type: "string" } }, []) },
   { name: "eda_list_api_methods", description: "Ask the CONNECTED EXTENSION for the API methods it accepts right now (dsh.internal.listApiMethods) and report source/version/counts. Falls back to the bridge copy with stale:true only when the extension is an older zip. Use refresh:true to re-query.", inputSchema: objectSchema({ refresh: { type: "boolean" } }) },
   { name: "eda_delete_primitive", description: 'Delete a schematic primitive by kind and primitive id. Net ports, net flags and net labels are attribute primitives and need kind "netport"/"netflag"/"netlabel"; the text fallback labels are kind "text".', inputSchema: objectSchema({ kind: { type: "string", enum: ["component", "wire", "rectangle", "circle", "arc", "polygon", "text", "netport", "netflag", "netlabel"] }, primitiveId: { type: "string" } }, ["kind", "primitiveId"]) },
   { name: "eda_create_board", description: "Create a board linking a schematic and a PCB (dmt_Board.createBoard).", inputSchema: objectSchema({ schematicUuid: { type: "string" }, pcbUuid: { type: "string" } }) },
@@ -1544,6 +1566,9 @@ function buildPolygonSource(points) {
   for (let i = 2; i < points.length; i += 2) source.push(points[i], points[i + 1]);
   return source;
 }
+function packageRoot() {
+  return fileURLToPath(new URL("../", import.meta.url));
+}
 function requireFlatPoints(value, tool) {
   const points = flattenPoints(value);
   if (points.length < 6 || points.length % 2 !== 0 || !points.every(Number.isFinite)) {
@@ -2993,6 +3018,71 @@ async function executeTool(name, rawArgs, timeoutMs) {
         rotation: args.rotation === void 0 ? void 0 : Number(args.rotation),
         mirror: args.mirror === void 0 ? void 0 : Boolean(args.mirror)
       }], timeoutMs);
+    case "eda_extension_package": {
+      const manifestCandidates = [
+        join(packageRoot(), "jlc-extension", "extension.json"),
+        join(packageRoot(), "dsh-eda-bridge-extension.zip")
+      ];
+      let version = VERSION;
+      try {
+        const manifest = JSON.parse(await readFile(manifestCandidates[0], "utf8"));
+        if (typeof manifest.version === "string" && manifest.version !== "") version = manifest.version;
+      } catch {
+      }
+      const localCandidates = [
+        join(packageRoot(), extensionZipName(version)),
+        join(packageRoot(), "dsh-eda-bridge-extension.zip")
+      ];
+      let localPath = "";
+      for (const candidate of localCandidates) {
+        if (existsSync(candidate)) {
+          localPath = candidate;
+          break;
+        }
+      }
+      if (localPath === "") {
+        throw new Error("eda_extension_package: no extension zip next to the plugin (looked for " + localCandidates.join(", ") + ")");
+      }
+      const localBytes = await readFile(localPath);
+      const localSha256 = sha256Of(localBytes);
+      const base = typeof args.base === "string" && args.base !== "" ? args.base : process.env.DSH_EDA_EXTENSION_BASE ?? "http://159.75.130.207/eda/";
+      const url = extensionDownloadUrl(base, version);
+      const report = {
+        version,
+        local: { path: localPath, bytes: localBytes.byteLength, sha256: localSha256 },
+        url
+      };
+      if (args.download !== true) return report;
+      const response = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+      if (!response.ok) {
+        const throttled = response.status === 429;
+        return {
+          ...report,
+          verified: "unverified",
+          httpStatus: response.status,
+          error: throttled ? "the download server throttled this IP (HTTP 429, 5 downloads/min per IP \u2014 burst 5). Wait about a minute and retry; nothing is wrong with the zip or the upload." : "download failed: HTTP " + response.status + " from " + url
+        };
+      }
+      const remoteBytes = new Uint8Array(await response.arrayBuffer());
+      const remoteSha256 = sha256Of(remoteBytes);
+      const verdict = compareDigest(localSha256, remoteSha256);
+      const result2 = {
+        ...report,
+        remote: { url, bytes: remoteBytes.byteLength, sha256: remoteSha256 },
+        verified: verdict
+      };
+      if (verdict === "match") {
+        const outDir = typeof args.outDir === "string" && args.outDir !== "" ? args.outDir : tmpdir();
+        await mkdir(outDir, { recursive: true });
+        const savedPath = join(outDir, extensionZipName(version));
+        await writeFile(savedPath, remoteBytes);
+        result2.savedPath = savedPath;
+        result2.next = "In JLCEDA Pro: \u6269\u5C55 \u2192 \u5BFC\u5165\u6269\u5C55 \u2192 select this zip \u2192 restart the application (not a reload).";
+      } else {
+        result2.next = "The served copy differs from the one this plugin ships. Do not import it: re-upload " + extensionZipName(version) + " from the plugin directory to the download server.";
+      }
+      return result2;
+    }
     case "eda_list_api_methods": {
       const live = await extensionApiMethods(timeoutMs, args.refresh === true);
       if (live !== void 0) {
@@ -4051,7 +4141,7 @@ server.on("upgrade", (req, socket) => {
     socket.destroy();
     return;
   }
-  const accept = createHash("sha1").update(key + WS_GUID).digest("base64");
+  const accept = createHash2("sha1").update(key + WS_GUID).digest("base64");
   socket.write("HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: " + accept + "\r\n\r\n");
   const client = new WsConnection(socket);
   clients.add(client);

package/lib/client.js

@@ -1135,6 +1135,30 @@ function EdaMcpSettingsCard(props) {
   const [testing, setTesting] = (0, import_react.useState)(false);
   const [reconnecting, setReconnecting] = (0, import_react.useState)(false);
   const [notice, setNotice] = (0, import_react.useState)();
+  const [verifyingExtension, setVerifyingExtension] = (0, import_react.useState)(false);
+  const [extensionVerdict, setExtensionVerdict] = (0, import_react.useState)();
+  const verifyExtension = async () => {
+    if (verifyingExtension) return;
+    setVerifyingExtension(true);
+    try {
+      const response = await fetch("/api/dsh-eda-mcp/extension/verify");
+      const body = await response.json();
+      if (body.verified === "match") {
+        const short = String(body.local?.sha256 ?? "").slice(0, 16) + "\u2026";
+        setExtensionVerdict({ kind: "ok", text: t("settings.verifyMatch").replace("{hash}", short) });
+      } else if (body.verified === "mismatch") {
+        setExtensionVerdict({ kind: "error", text: t("settings.verifyMismatch").replace("{hash}", String(body.file ?? "")) });
+      } else {
+        const reason = String(body.error ?? "unknown");
+        setExtensionVerdict({ kind: "error", text: t("settings.verifyUnverified").replace("{reason}", reason) });
+      }
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      setExtensionVerdict({ kind: "error", text: t("settings.verifyUnverified").replace("{reason}", reason) });
+    } finally {
+      setVerifyingExtension(false);
+    }
+  };
   (0, import_react.useEffect)(() => {
     if (!seeded && state.status === "ready") {
       setDraft(state.config ?? {});
@@ -1292,14 +1316,29 @@ function EdaMcpSettingsCard(props) {
         }
       ),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { ...hintStyle, margin: "8px 0 0" }, children: t("settings.portLabel") }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { label: t("settings.downloadExtension"), hint: t("settings.installHint"), children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-        "a",
-        {
-          href: "/api/dsh-eda-mcp/extension.zip",
-          style: { ...secondaryButtonStyle, textDecoration: "none", display: "inline-flex", width: "fit-content" },
-          children: t("settings.downloadExtension")
-        }
-      ) })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Field, { label: t("settings.downloadExtension"), hint: t("settings.installHint"), children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "a",
+          {
+            href: "/api/dsh-eda-mcp/extension.zip",
+            style: { ...secondaryButtonStyle, textDecoration: "none", display: "inline-flex", width: "fit-content" },
+            children: t("settings.downloadExtension")
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "button",
+          {
+            type: "button",
+            onClick: () => {
+              void verifyExtension();
+            },
+            disabled: verifyingExtension,
+            style: verifyingExtension ? { ...secondaryButtonStyle, ...disabledButtonStyle, marginLeft: 8 } : { ...secondaryButtonStyle, marginLeft: 8 },
+            children: verifyingExtension ? t("settings.verifyBusy") : t("settings.verifyExtension")
+          }
+        ),
+        extensionVerdict !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", style: { ...hintStyle, margin: "6px 0 0", color: extensionVerdict.kind === "ok" ? void 0 : "#c0392b" }, children: extensionVerdict.text }) : null
+      ] })
     ] }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("footer", { style: footerStyle, children: [
       notice !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: noticeStyle, role: "status", children: notice.text }) : null,
@@ -1478,6 +1517,11 @@ var zh = {
   "settings.reconnectFailed": "\u91CD\u8FDE\u5931\u8D25",
   "settings.portLabel": "\u6865\u63A5 WebSocket \u7AEF\u53E3\uFF1A39009\uFF08\u56FA\u5B9A\uFF09",
   "settings.downloadExtension": "\u4E0B\u8F7D JLCEDA \u6269\u5C55\u5305",
+  "settings.verifyExtension": "\u6821\u9A8C\u670D\u52A1\u5668\u526F\u672C",
+  "settings.verifyBusy": "\u6821\u9A8C\u4E2D\u2026",
+  "settings.verifyMatch": "\u4E00\u81F4\uFF1A\u670D\u52A1\u5668\u4E0A\u7684 zip \u4E0E\u672C\u5730\u8FD9\u4EFD\u9010\u5B57\u8282\u76F8\u540C\uFF08sha256 {hash}\uFF09",
+  "settings.verifyMismatch": "\u4E0D\u4E00\u81F4\uFF1A\u670D\u52A1\u5668\u90A3\u4EFD\u4E0E\u672C\u5730\u4E0D\u540C\uFF0C\u8BF7\u91CD\u65B0\u4E0A\u4F20 {hash}",
+  "settings.verifyUnverified": "\u65E0\u6CD5\u6821\u9A8C\uFF1A{reason}",
   "settings.installHint": "\u5728\u5609\u7ACB\u521BEDA\u4E13\u4E1A\u7248\u4E2D\uFF1A\u6269\u5C55 \u2192 \u5BFC\u5165 \u2192 \u9009\u62E9\u4E0B\u8F7D\u7684 zip \u2192 \u5728\u6269\u5C55\u5217\u8868\u5F00\u542F\u672C\u6269\u5C55\u7684\u300C\u5141\u8BB8\u5916\u90E8\u4EA4\u4E92\u300D\u3002"
 };
 var en = {
@@ -1510,6 +1554,11 @@ var en = {
   "settings.reconnectFailed": "Reconnect failed",
   "settings.portLabel": "Bridge WebSocket port: 39009 (fixed)",
   "settings.downloadExtension": "Download JLCEDA extension zip",
+  "settings.verifyExtension": "Verify server copy",
+  "settings.verifyBusy": "Verifying\u2026",
+  "settings.verifyMatch": "Match: the served zip is byte-identical to the local one (sha256 {hash})",
+  "settings.verifyMismatch": "Mismatch: the served zip differs \u2014 re-upload {hash}",
+  "settings.verifyUnverified": "Could not verify: {reason}",
   "settings.installHint": 'In JLCEDA Pro: Extensions \u2192 Import \u2192 select the downloaded zip \u2192 enable "Allow external interactions" for this extension.'
 };
 

package/lib/index.js

@@ -325,6 +325,7 @@ var SKILL_PLAYBOOK_LINES = [
   "- **\u63D2\u4EF6\u4EE3\u7801\u6539\u52A8\u5BF9\u5F53\u524D\u4F1A\u8BDD\u5B8C\u5168\u4E0D\u751F\u6548**\uFF1A\u5BBF\u4E3B\u5728\u542F\u52A8\u65F6\u628A `lib/index.js` \u8F7D\u5165\u5185\u5B58\uFF0C\u4E4B\u540E\u6539\u6587\u4EF6\u3001\u91CD\u65B0 build \u90FD\u4E0D\u4F1A\u70ED\u66F4\u65B0\u3002",
   "- \u7248\u672C\u7EAA\u5F8B\uFF1A\u6269\u5C55\u7EBF\u534F\u8BAE**\u53EA\u9012\u589E\u6700\u5C0F\u4F4D**\uFF08`0.4.1 \u2192 0.4.2`\uFF09\uFF0C\u6BCF\u6B21\u6539\u52A8\u5FC5\u987B\u540C\u65F6\u6539 `jlc-extension/extension.json` \u7684 `version` \u4E0E\u6865\u63A5\u7684 `VERSION`\uFF1B\u4E0D\u4E00\u81F4\u65F6 `eda_status.versionMismatch` \u4E3A true\u3002",
   "- \u65B0\u4F1A\u8BDD\u5F00\u5DE5\u987A\u5E8F\uFF1A`eda_status`\uFF08\u8FDE\u6CA1\u8FDE\u3001\u7248\u672C\u5BF9\u4E0D\u5BF9\uFF09\u2192 \u672C\u6280\u80FD\uFF08\u600E\u4E48\u5E72\uFF09\u2192 \u518D\u52A8\u624B\uFF1B\u4E0D\u8981\u5148\u5047\u8BBE\u73AF\u5883\u5C31\u7EEA\u3002",
+  "| \u9700\u8981\u6269\u5C55 zip\uFF08\u6362\u673A\u5668/\u7ED9\u522B\u4EBA\uFF09 | \u4E0D\u6E05\u695A\u8BE5\u7ED9\u54EA\u4E00\u4EFD | `eda_extension_package` \u62A5\u8DEF\u5F84+sha256\uFF1B`download:true` \u4ECE\u670D\u52A1\u5668\u53D6\u56DE\u5E76\u9010\u5B57\u8282\u6BD4\u5BF9\uFF08`verified`\uFF09\uFF0C\u4E00\u81F4\u624D\u843D\u76D8 |",
   "- \u6269\u5C55 zip \u4F4D\u7F6E\uFF1A`node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<\u7248\u672C>.zip`\uFF0C\u6216\u8BBE\u7F6E\u5361\u7247\u4E0B\u8F7D\uFF08\u6587\u4EF6\u540D\u81EA\u5E26\u7248\u672C\u53F7\uFF09\u3002",
   "- \u6392\u67E5\u987A\u5E8F\uFF1A`eda_status` \u2192 `/api/dsh-eda-mcp/diagnostics`\uFF08`clientStartupError` / `skills` / `bridgeHealth`\uFF09\u2192 `eda_list_api_methods`\uFF08\u767D\u540D\u5355\uFF09\u2192 \u5E94\u7528\u4FA7 DRC \u9762\u677F\u3002"
 ];
@@ -433,7 +434,7 @@ function createEdaSkillProvider() {
 }
 
 // src/routes.ts
-import { createReadStream } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { basename } from "node:path";
 import { SettingsConflictError } from "@deepseek-ai/dsh-settings";
 
@@ -474,11 +475,32 @@ function isLoopbackRequest(request) {
   }
 }
 
+// src/bridge/extension-package.ts
+import { createHash } from "node:crypto";
+function sha256Of(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function extensionZipName(version) {
+  return "dsh-eda-bridge-extension-" + version + ".zip";
+}
+function extensionDownloadUrl(base, version) {
+  const normalised = base.endsWith("/") ? base : base + "/";
+  return new URL(extensionZipName(version), normalised).toString();
+}
+function compareDigest(expected, actual) {
+  if (typeof expected !== "string" || typeof actual !== "string") return "unverified";
+  const left = expected.trim().toLowerCase();
+  const right = actual.trim().toLowerCase();
+  if (left === "" || right === "") return "unverified";
+  return left === right ? "match" : "mismatch";
+}
+
 // src/routes.ts
 var EDA_MCP_API = {
   test: "/api/dsh-eda-mcp/test",
   reconnect: "/api/dsh-eda-mcp/reconnect",
   extensionZip: "/api/dsh-eda-mcp/extension.zip",
+  extensionVerify: "/api/dsh-eda-mcp/extension/verify",
   diagnostics: "/api/dsh-eda-mcp/diagnostics",
   selfTest: "/api/dsh-eda-mcp/self-test",
   settingsDescribe: "/api/dsh-eda-mcp/settings/describe",
@@ -606,20 +628,68 @@ function makeEdaMcpRoutes(deps) {
     handler: async (req, res) => {
       if (req.method !== "GET") return json(res, 405, { ok: false, error: "method-not-allowed" });
       if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: "forbidden" });
+      let bytes;
+      try {
+        bytes = await readFile(deps.extensionZipPath);
+      } catch {
+        return json(res, 404, { ok: false, error: "extension zip missing next to the plugin" });
+      }
       res.writeHead(200, {
         "content-type": "application/zip",
         // Keep the versioned file name the browser saves it as.
         "content-disposition": 'attachment; filename="' + basename(deps.extensionZipPath) + '"',
-        "cache-control": "no-store"
+        "cache-control": "no-store",
+        "x-extension-version": deps.extensionVersion,
+        "x-extension-sha256": sha256Of(bytes),
+        "content-length": String(bytes.byteLength)
       });
-      const stream = createReadStream(deps.extensionZipPath);
-      stream.on("error", () => {
-        res.destroy();
+      res.end(bytes);
+    }
+  };
+  const extensionVerify = {
+    kind: "exact",
+    path: EDA_MCP_API.extensionVerify,
+    handler: async (req, res) => {
+      if (req.method !== "GET") return json(res, 405, { ok: false, error: "method-not-allowed" });
+      if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: "forbidden" });
+      let localBytes;
+      try {
+        localBytes = await readFile(deps.extensionZipPath);
+      } catch {
+        return json(res, 404, { ok: false, error: "extension zip missing next to the plugin" });
+      }
+      const localSha256 = sha256Of(localBytes);
+      const url = extensionDownloadUrl(deps.extensionDownloadBase, deps.extensionVersion);
+      const report = {
+        version: deps.extensionVersion,
+        file: basename(deps.extensionZipPath),
+        local: { bytes: localBytes.byteLength, sha256: localSha256 },
+        url
+      };
+      let response;
+      try {
+        response = await fetch(url, { signal: AbortSignal.timeout(2e4) });
+      } catch (error) {
+        return json(res, 200, { ...report, verified: "unverified", error: "download failed: " + (error instanceof Error ? error.message : String(error)) });
+      }
+      if (!response.ok) {
+        return json(res, 200, {
+          ...report,
+          verified: "unverified",
+          httpStatus: response.status,
+          error: response.status === 429 ? "the download server throttled this IP (HTTP 429, 5 downloads/min). Wait about a minute and verify again." : "download failed: HTTP " + response.status
+        });
+      }
+      const remoteBytes = new Uint8Array(await response.arrayBuffer());
+      const remoteSha256 = sha256Of(remoteBytes);
+      return json(res, 200, {
+        ...report,
+        remote: { bytes: remoteBytes.byteLength, sha256: remoteSha256 },
+        verified: compareDigest(localSha256, remoteSha256)
       });
-      stream.pipe(res);
     }
   };
-  return [test, reconnect, extensionZip, diagnostics, selfTest];
+  return [test, reconnect, extensionZip, extensionVerify, diagnostics, selfTest];
 }
 function makeEdaMcpSettingsRoutes(settings) {
   const ns = "eda-mcp";
@@ -950,6 +1020,14 @@ function installSettingsSection(ctx, scoped, ns, schema, entry, hooks) {
 }
 var inject = ["webServer", "systemPrompt"];
 var BRIDGE_URL = new URL("../lib/bridge.mjs", import.meta.url);
+function resolveExtensionVersion() {
+  try {
+    const manifest = JSON.parse(readFileSync(fileURLToPath(new URL("../jlc-extension/extension.json", import.meta.url)), "utf8"));
+    return typeof manifest.version === "string" ? manifest.version : "";
+  } catch {
+    return "";
+  }
+}
 function resolveExtensionZipPath() {
   const plain = fileURLToPath(new URL("../dsh-eda-bridge-extension.zip", import.meta.url));
   try {
@@ -1053,6 +1131,8 @@ function apply(ctx, config) {
     const disposers = makeEdaMcpRoutes({
       getConfig: () => current(),
       extensionZipPath: resolveExtensionZipPath(),
+      extensionVersion: resolveExtensionVersion(),
+      extensionDownloadBase: process.env.DSH_EDA_EXTENSION_BASE ?? "http://159.75.130.207/eda/",
       reconnect: remountClient,
       bridgeLaunch: describeBridgeLaunch,
       // Surface the skill registration so "did it register?" is answerable from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-eda-mcp",
-  "version": "1.0.2",
+  "version": "1.1.1",
   "description": "DeepSeek Harness (DSH) plugin — connects DSH to JLCEDA Pro (EasyEDA Pro) via a local MCP bridge and draws schematics through the JLCEDA extension API.",
   "license": "Apache-2.0",
   "author": {
@@ -72,7 +72,7 @@
   "scripts": {
     "build": "node build.mjs",
     "typecheck": "tsc --noEmit",
-    "test": "node --experimental-strip-types test/node-runtime.test.ts && node --experimental-strip-types test/config-values.test.ts && node --experimental-strip-types test/design-rules.test.ts && node --experimental-strip-types test/seams.test.ts && node --experimental-strip-types test/eda-launch.test.ts && node --experimental-strip-types test/schematic-audit.test.ts && node --experimental-strip-types test/design-intake.test.ts && node --experimental-strip-types test/netlist-erc.test.ts && node --experimental-strip-types test/skills.test.ts",
+    "test": "node --experimental-strip-types test/node-runtime.test.ts && node --experimental-strip-types test/config-values.test.ts && node --experimental-strip-types test/design-rules.test.ts && node --experimental-strip-types test/seams.test.ts && node --experimental-strip-types test/eda-launch.test.ts && node --experimental-strip-types test/schematic-audit.test.ts && node --experimental-strip-types test/design-intake.test.ts && node --experimental-strip-types test/extension-package.test.ts && node --experimental-strip-types test/extension-routes.test.ts && node --experimental-strip-types test/netlist-erc.test.ts && node --experimental-strip-types test/skills.test.ts",
     "seam-check": "node scripts/seam-check.mjs",
     "contract-check": "node scripts/contract-check.mjs",
     "guard:bundle": "node scripts/guard-bundle-paths.mjs",

package/src/bridge/extension-package.ts

@@ -0,0 +1,35 @@
+/**
+ * Extension zip packaging helpers: the plugin ships
+ * `dsh-eda-bridge-extension-<wire version>.zip`, the download server publishes the same
+ * file, and a user who installs the plugin from npm must be able to tell whether the copy
+ * they got is byte-identical to the one the bridge expects.
+ */
+import { createHash } from 'node:crypto'
+
+export function sha256Of(bytes: Uint8Array): string {
+  return createHash('sha256').update(bytes).digest('hex')
+}
+
+export function extensionZipName(version: string): string {
+  return 'dsh-eda-bridge-extension-' + version + '.zip'
+}
+
+/** Normalises a base URL ('…/eda' or '…/eda/') and appends the zip name. */
+export function extensionDownloadUrl(base: string, version: string): string {
+  const normalised = base.endsWith('/') ? base : base + '/'
+  return new URL(extensionZipName(version), normalised).toString()
+}
+
+export type DigestVerdict = 'match' | 'mismatch' | 'unverified'
+
+/**
+ * A missing expected digest is reported as 'unverified', never as a pass: an absent
+ * comparison is not evidence of equality.
+ */
+export function compareDigest(expected: string | null | undefined, actual: string | null | undefined): DigestVerdict {
+  if (typeof expected !== 'string' || typeof actual !== 'string') return 'unverified'
+  const left = expected.trim().toLowerCase()
+  const right = actual.trim().toLowerCase()
+  if (left === '' || right === '') return 'unverified'
+  return left === right ? 'match' : 'mismatch'
+}

package/src/bridge/index.ts

@@ -6,6 +6,7 @@ import { readFile } from 'node:fs/promises'
 import { mkdir, unlink, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { basename, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http'
 import type { Socket } from 'node:net'
 import { createInterface } from 'node:readline'
@@ -13,6 +14,7 @@ import { buildLaunchArgs, buildLaunchScript, decodeRegistryOutput, resolveExecut
 import { buildIntake } from './design-intake.ts'
 import { auditSchematicGeometry } from './schematic-audit.ts'
 import { runNetlistErc } from './netlist-erc.ts'
+import { compareDigest, extensionDownloadUrl, extensionZipName, sha256Of } from './extension-package.ts'
 import {
   ANNULUS_MIN_MM, BOARD_OUTLINE_WIDTH_MIL, MIN_TRACK_WIDTH_MIL, POUR_CLEARANCE_MIN_MIL,
   POUR_CLEARANCE_RECOMMENDED_MIL, SILKSCREEN_HEIGHT_MIN_MM, SILKSCREEN_WIDTH_MIN_MM,
@@ -324,6 +326,7 @@ const TOOLS = [
   { name: 'eda_pcb_canvas_origin', description: 'Read (or align) the PCB canvas origin and convert points between the two coordinate spaces. JLCEDA displays CANVAS coordinates in its UI but every API takes DATA coordinates; the two differ by this offset, so a coordinate read off the screen will land somewhere else unless you convert or align. align:true calls setCanvasOrigin(0,0) so the display matches the API.', inputSchema: objectSchema({ align: { type: 'boolean' }, offsetX: { type: 'number' }, offsetY: { type: 'number' }, point: { type: 'object', additionalProperties: true } }) },
   { name: 'eda_capture', description: 'Render the active document to a PNG (dmt_EditorControl.getCurrentRenderedAreaImage) and write it to outPath or return a data URL. Use it to LOOK at the sheet/board instead of trusting coordinate math. The PNG is a scratch file: read it, then call eda_capture({cleanup:true}) to delete every capture path this session wrote.', inputSchema: objectSchema({ outPath: { type: 'string' }, inline: { type: 'boolean' }, cleanup: { type: 'boolean' } }) },
   { name: 'eda_workflow_guide', description: 'Return the schematic working standard: grid-aligned manual placement, signal flow, when net labels/ports are required (a wire net name is overridden by connectivity), net-label fallback behaviour, batch placement and the verification order. Read it before laying out a sheet.', inputSchema: objectSchema({}) },
+  { name: 'eda_extension_package', description: 'Report the extension zip this plugin ships (absolute path, bytes, sha256) and, with download:true, fetch the copy served at the download base URL and compare the two byte for byte. On a match the served file is saved to outDir (default: the temp directory) so it can be imported into JLCEDA Pro; on a mismatch nothing is written and the tool says to re-upload. base defaults to DSH_EDA_EXTENSION_BASE or the project download server.', inputSchema: objectSchema({ download: { type: 'boolean' }, outDir: { type: 'string' }, base: { type: 'string' } }, []) },
   { name: 'eda_list_api_methods', description: 'Ask the CONNECTED EXTENSION for the API methods it accepts right now (dsh.internal.listApiMethods) and report source/version/counts. Falls back to the bridge copy with stale:true only when the extension is an older zip. Use refresh:true to re-query.', inputSchema: objectSchema({ refresh: { type: 'boolean' } }) },
   { name: 'eda_delete_primitive', description: 'Delete a schematic primitive by kind and primitive id. Net ports, net flags and net labels are attribute primitives and need kind "netport"/"netflag"/"netlabel"; the text fallback labels are kind "text".', inputSchema: objectSchema({ kind: { type: 'string', enum: ['component', 'wire', 'rectangle', 'circle', 'arc', 'polygon', 'text', 'netport', 'netflag', 'netlabel'] }, primitiveId: { type: 'string' } }, ['kind', 'primitiveId']) },
   { name: 'eda_create_board', description: 'Create a board linking a schematic and a PCB (dmt_Board.createBoard).', inputSchema: objectSchema({ schematicUuid: { type: 'string' }, pcbUuid: { type: 'string' } }) },
@@ -790,6 +793,15 @@ function buildPolygonSource(points) {
   return source
 }
 
+
+/**
+ * Directory that holds the packaged artifacts: the bridge runs from <package>/lib/bridge.mjs,
+ * so its grandparent is the package root both for a published install and for the repo.
+ */
+function packageRoot(): string {
+  return fileURLToPath(new URL('../', import.meta.url))
+}
+
 function requireFlatPoints(value, tool) {
   const points = flattenPoints(value)
   if (points.length < 6 || points.length % 2 !== 0 || !points.every(Number.isFinite)) {
@@ -2363,6 +2375,79 @@ async function executeTool(name, rawArgs, timeoutMs) {
         mirror: args.mirror === undefined ? undefined : Boolean(args.mirror),
       }], timeoutMs)
 
+    case 'eda_extension_package': {
+      // Two copies of the same artifact exist: the zip inside this npm package and the one
+      // on the download server. Nobody could tell whether they match, so this tool reports
+      // the local digest and, with download:true, fetches the served copy and compares the
+      // two byte for byte. A mismatch is never written to disk.
+      const manifestCandidates = [
+        join(packageRoot(), 'jlc-extension', 'extension.json'),
+        join(packageRoot(), 'dsh-eda-bridge-extension.zip'),
+      ]
+      let version = VERSION
+      try {
+        const manifest = JSON.parse(await readFile(manifestCandidates[0], 'utf8')) as { version?: string }
+        if (typeof manifest.version === 'string' && manifest.version !== '') version = manifest.version
+      } catch { /* keep the bridge VERSION */ }
+      const localCandidates = [
+        join(packageRoot(), extensionZipName(version)),
+        join(packageRoot(), 'dsh-eda-bridge-extension.zip'),
+      ]
+      let localPath = ''
+      for (const candidate of localCandidates) {
+        if (existsSync(candidate)) { localPath = candidate; break }
+      }
+      if (localPath === '') {
+        throw new Error('eda_extension_package: no extension zip next to the plugin (looked for ' + localCandidates.join(', ') + ')')
+      }
+      const localBytes = await readFile(localPath)
+      const localSha256 = sha256Of(localBytes)
+      const base = typeof args.base === 'string' && args.base !== ''
+        ? args.base
+        : (process.env.DSH_EDA_EXTENSION_BASE ?? 'http://159.75.130.207/eda/')
+      const url = extensionDownloadUrl(base, version)
+      const report = {
+        version,
+        local: { path: localPath, bytes: localBytes.byteLength, sha256: localSha256 },
+        url,
+      }
+      if (args.download !== true) return report
+      const response = await fetch(url, { signal: AbortSignal.timeout(30000) })
+      if (!response.ok) {
+        // 429 is the download server's rate limit (5 req/min per IP), not a broken artifact:
+        // say so, otherwise the caller retries in a loop and never succeeds.
+        const throttled = response.status === 429
+        return {
+          ...report,
+          verified: 'unverified',
+          httpStatus: response.status,
+          error: throttled
+            ? 'the download server throttled this IP (HTTP 429, 5 downloads/min per IP — burst 5). Wait about a minute and retry; nothing is wrong with the zip or the upload.'
+            : 'download failed: HTTP ' + response.status + ' from ' + url,
+        }
+      }
+      const remoteBytes = new Uint8Array(await response.arrayBuffer())
+      const remoteSha256 = sha256Of(remoteBytes)
+      const verdict = compareDigest(localSha256, remoteSha256)
+      const result: Record<string, unknown> = {
+        ...report,
+        remote: { url, bytes: remoteBytes.byteLength, sha256: remoteSha256 },
+        verified: verdict,
+      }
+      if (verdict === 'match') {
+        const outDir = typeof args.outDir === 'string' && args.outDir !== '' ? args.outDir : tmpdir()
+        await mkdir(outDir, { recursive: true })
+        const savedPath = join(outDir, extensionZipName(version))
+        await writeFile(savedPath, remoteBytes)
+        result.savedPath = savedPath
+        result.next = 'In JLCEDA Pro: 扩展 → 导入扩展 → select this zip → restart the application (not a reload).'
+      } else {
+        result.next = 'The served copy differs from the one this plugin ships. Do not import it: re-upload ' +
+          extensionZipName(version) + ' from the plugin directory to the download server.'
+      }
+      return result
+    }
+
     case 'eda_list_api_methods': {
       // Ask the running extension first: its answer is the real capability boundary.
       const live = await extensionApiMethods(timeoutMs, args.refresh === true)

package/src/client/EdaMcpSettingsCard.tsx

@@ -327,6 +327,36 @@ export function EdaMcpSettingsCard(props: EdaMcpSettingsCardProps) {
   const [testing, setTesting] = useState(false)
   const [reconnecting, setReconnecting] = useState(false)
   const [notice, setNotice] = useState<{ kind: 'ok' | 'error'; text: string } | undefined>()
+  const [verifyingExtension, setVerifyingExtension] = useState(false)
+  const [extensionVerdict, setExtensionVerdict] = useState<{ kind: 'ok' | 'error'; text: string } | undefined>()
+
+  const verifyExtension = async (): Promise<void> => {
+    if (verifyingExtension) return
+    setVerifyingExtension(true)
+    try {
+      const response = await fetch('/api/dsh-eda-mcp/extension/verify')
+      const body = await response.json() as {
+        verified?: 'match' | 'mismatch' | 'unverified'
+        file?: string
+        local?: { sha256?: string }
+        error?: string
+      }
+      if (body.verified === 'match') {
+        const short = String(body.local?.sha256 ?? '').slice(0, 16) + '…'
+        setExtensionVerdict({ kind: 'ok', text: t('settings.verifyMatch').replace('{hash}', short) })
+      } else if (body.verified === 'mismatch') {
+        setExtensionVerdict({ kind: 'error', text: t('settings.verifyMismatch').replace('{hash}', String(body.file ?? '')) })
+      } else {
+        const reason = String(body.error ?? 'unknown')
+        setExtensionVerdict({ kind: 'error', text: t('settings.verifyUnverified').replace('{reason}', reason) })
+      }
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error)
+      setExtensionVerdict({ kind: 'error', text: t('settings.verifyUnverified').replace('{reason}', reason) })
+    } finally {
+      setVerifyingExtension(false)
+    }
+  }
 
   useEffect(() => {
     if (!seeded && state.status === 'ready') {
@@ -470,6 +500,17 @@ export function EdaMcpSettingsCard(props: EdaMcpSettingsCardProps) {
           >
             {t('settings.downloadExtension')}
           </a>
+          <button
+            type="button"
+            onClick={() => { void verifyExtension() }}
+            disabled={verifyingExtension}
+            style={verifyingExtension ? { ...secondaryButtonStyle, ...disabledButtonStyle, marginLeft: 8 } : { ...secondaryButtonStyle, marginLeft: 8 }}
+          >
+            {verifyingExtension ? t('settings.verifyBusy') : t('settings.verifyExtension')}
+          </button>
+          {extensionVerdict !== undefined
+            ? <p role="status" style={{ ...hintStyle, margin: '6px 0 0', color: extensionVerdict.kind === 'ok' ? undefined : '#c0392b' }}>{extensionVerdict.text}</p>
+            : null}
         </Field>
       </div>
 

package/src/client/locales.ts

@@ -28,6 +28,11 @@ export const zh = {
   'settings.reconnectFailed': '重连失败',
   'settings.portLabel': '桥接 WebSocket 端口：39009（固定）',
   'settings.downloadExtension': '下载 JLCEDA 扩展包',
+  'settings.verifyExtension': '校验服务器副本',
+  'settings.verifyBusy': '校验中…',
+  'settings.verifyMatch': '一致：服务器上的 zip 与本地这份逐字节相同（sha256 {hash}）',
+  'settings.verifyMismatch': '不一致：服务器那份与本地不同，请重新上传 {hash}',
+  'settings.verifyUnverified': '无法校验：{reason}',
   'settings.installHint': '在嘉立创EDA专业版中：扩展 → 导入 → 选择下载的 zip → 在扩展列表开启本扩展的「允许外部交互」。',
 } as const
 
@@ -61,6 +66,11 @@ export const en = {
   'settings.reconnectFailed': 'Reconnect failed',
   'settings.portLabel': 'Bridge WebSocket port: 39009 (fixed)',
   'settings.downloadExtension': 'Download JLCEDA extension zip',
+  'settings.verifyExtension': 'Verify server copy',
+  'settings.verifyBusy': 'Verifying…',
+  'settings.verifyMatch': 'Match: the served zip is byte-identical to the local one (sha256 {hash})',
+  'settings.verifyMismatch': 'Mismatch: the served zip differs — re-upload {hash}',
+  'settings.verifyUnverified': 'Could not verify: {reason}',
   'settings.installHint': 'In JLCEDA Pro: Extensions → Import → select the downloaded zip → enable "Allow external interactions" for this extension.',
 } as const
 

package/src/index.ts

@@ -157,6 +157,15 @@ const BRIDGE_URL = new URL('../lib/bridge.mjs', import.meta.url)
  * that manifest instead of hard-coding a file name; older layouts without a
  * versioned file keep working through the plain-name fallback.
  */
+function resolveExtensionVersion(): string {
+  try {
+    const manifest = JSON.parse(readFileSync(fileURLToPath(new URL('../jlc-extension/extension.json', import.meta.url)), 'utf8')) as { version?: string }
+    return typeof manifest.version === 'string' ? manifest.version : ''
+  } catch {
+    return ''
+  }
+}
+
 function resolveExtensionZipPath(): string {
   const plain = fileURLToPath(new URL('../dsh-eda-bridge-extension.zip', import.meta.url))
   try {
@@ -292,6 +301,8 @@ let current: () => EdaMcpConfig = () => unwrapConfig(config ?? {})
     const disposers = makeEdaMcpRoutes({
       getConfig: () => current(),
       extensionZipPath: resolveExtensionZipPath(),
+      extensionVersion: resolveExtensionVersion(),
+      extensionDownloadBase: process.env.DSH_EDA_EXTENSION_BASE ?? 'http://159.75.130.207/eda/',
       reconnect: remountClient,
       bridgeLaunch: describeBridgeLaunch,
       // Surface the skill registration so "did it register?" is answerable from

package/src/routes.ts

@@ -1,4 +1,4 @@
-import { createReadStream } from 'node:fs'
+import { readFile } from 'node:fs/promises'
 import { basename } from 'node:path'
 import type { ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
@@ -27,11 +27,13 @@ export interface SettingsBridge {
 }
 import type { EdaMcpConfig } from './index.ts'
 import { isLoopbackRequest } from './loopback.ts'
+import { compareDigest, extensionDownloadUrl, sha256Of } from './bridge/extension-package.ts'
 
 export const EDA_MCP_API = {
   test: '/api/dsh-eda-mcp/test',
   reconnect: '/api/dsh-eda-mcp/reconnect',
   extensionZip: '/api/dsh-eda-mcp/extension.zip',
+  extensionVerify: '/api/dsh-eda-mcp/extension/verify',
   diagnostics: '/api/dsh-eda-mcp/diagnostics',
   selfTest: '/api/dsh-eda-mcp/self-test',
   settingsDescribe: '/api/dsh-eda-mcp/settings/describe',
@@ -87,6 +89,10 @@ function toView(descriptor: SettingsBridgeView): unknown {
 export interface EdaMcpRouteDeps {
   getConfig: () => EdaMcpConfig
   extensionZipPath: string
+  /** Wire version of the bundled extension zip (from jlc-extension/extension.json). */
+  extensionVersion: string
+  /** Base URL of the download server; override with DSH_EDA_EXTENSION_BASE. */
+  extensionDownloadBase: string
   /** Dispose and recreate the MCP bridge child, then return immediately. */
   reconnect: () => void
   /** Which executable and script the bridge child is started with (diagnostics). */
@@ -179,25 +185,82 @@ export function makeEdaMcpRoutes(deps: EdaMcpRouteDeps): WebRoute[] {
     },
   }
 
+  // The card serves the LOCAL copy on purpose: it works offline and cannot be throttled.
+  // The digest travels with it, and a separate verify route compares it with the served copy
+  // so "is this the same artifact?" has an answer without downloading twice by hand.
   const extensionZip: WebRoute = {
     kind: 'exact',
     path: EDA_MCP_API.extensionZip,
     handler: async (req, res): Promise<void> => {
       if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
       if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: 'forbidden' })
+      let bytes: Buffer
+      try {
+        bytes = await readFile(deps.extensionZipPath)
+      } catch {
+        return json(res, 404, { ok: false, error: 'extension zip missing next to the plugin' })
+      }
       res.writeHead(200, {
         'content-type': 'application/zip',
         // Keep the versioned file name the browser saves it as.
         'content-disposition': 'attachment; filename="' + basename(deps.extensionZipPath) + '"',
         'cache-control': 'no-store',
+        'x-extension-version': deps.extensionVersion,
+        'x-extension-sha256': sha256Of(bytes),
+        'content-length': String(bytes.byteLength),
+      })
+      res.end(bytes)
+    },
+  }
+
+  const extensionVerify: WebRoute = {
+    kind: 'exact',
+    path: EDA_MCP_API.extensionVerify,
+    handler: async (req, res): Promise<void> => {
+      if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+      if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: 'forbidden' })
+      let localBytes: Buffer
+      try {
+        localBytes = await readFile(deps.extensionZipPath)
+      } catch {
+        return json(res, 404, { ok: false, error: 'extension zip missing next to the plugin' })
+      }
+      const localSha256 = sha256Of(localBytes)
+      const url = extensionDownloadUrl(deps.extensionDownloadBase, deps.extensionVersion)
+      const report: Record<string, unknown> = {
+        version: deps.extensionVersion,
+        file: basename(deps.extensionZipPath),
+        local: { bytes: localBytes.byteLength, sha256: localSha256 },
+        url,
+      }
+      let response: Response
+      try {
+        response = await fetch(url, { signal: AbortSignal.timeout(20000) })
+      } catch (error) {
+        return json(res, 200, { ...report, verified: 'unverified', error: 'download failed: ' + (error instanceof Error ? error.message : String(error)) })
+      }
+      if (!response.ok) {
+        // 429 = the server throttles an IP to 5 downloads/min; that is not a checksum problem.
+        return json(res, 200, {
+          ...report,
+          verified: 'unverified',
+          httpStatus: response.status,
+          error: response.status === 429
+            ? 'the download server throttled this IP (HTTP 429, 5 downloads/min). Wait about a minute and verify again.'
+            : 'download failed: HTTP ' + response.status,
+        })
+      }
+      const remoteBytes = new Uint8Array(await response.arrayBuffer())
+      const remoteSha256 = sha256Of(remoteBytes)
+      return json(res, 200, {
+        ...report,
+        remote: { bytes: remoteBytes.byteLength, sha256: remoteSha256 },
+        verified: compareDigest(localSha256, remoteSha256),
       })
-      const stream = createReadStream(deps.extensionZipPath)
-      stream.on('error', () => { res.destroy() })
-      stream.pipe(res)
     },
   }
 
-  return [test, reconnect, extensionZip, diagnostics, selfTest]
+  return [test, reconnect, extensionZip, extensionVerify, diagnostics, selfTest]
 }
 
 export function makeEdaMcpSettingsRoutes(settings: SettingsBridge): WebRoute[] {

package/src/skills-content.ts

@@ -299,6 +299,7 @@ export const SKILL_PLAYBOOK_LINES: readonly string[] = [
   "- **插件代码改动对当前会话完全不生效**：宿主在启动时把 `lib/index.js` 载入内存，之后改文件、重新 build 都不会热更新。",
   "- 版本纪律：扩展线协议**只递增最小位**（`0.4.1 → 0.4.2`），每次改动必须同时改 `jlc-extension/extension.json` 的 `version` 与桥接的 `VERSION`；不一致时 `eda_status.versionMismatch` 为 true。",
   "- 新会话开工顺序：`eda_status`（连没连、版本对不对）→ 本技能（怎么干）→ 再动手；不要先假设环境就绪。",
+  "| 需要扩展 zip（换机器/给别人） | 不清楚该给哪一份 | `eda_extension_package` 报路径+sha256；`download:true` 从服务器取回并逐字节比对（`verified`），一致才落盘 |",
   "- 扩展 zip 位置：`node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<版本>.zip`，或设置卡片下载（文件名自带版本号）。",
   "- 排查顺序：`eda_status` → `/api/dsh-eda-mcp/diagnostics`（`clientStartupError` / `skills` / `bridgeHealth`）→ `eda_list_api_methods`（白名单）→ 应用侧 DRC 面板。",
 ]

package/test/extension-package.test.ts

@@ -0,0 +1,27 @@
+import { strict as assert } from 'node:assert'
+import { compareDigest, extensionDownloadUrl, extensionZipName, sha256Of } from '../src/bridge/extension-package.ts'
+
+const bytes = new TextEncoder().encode('PK\x03\x04fake-zip-body')
+assert.equal(sha256Of(bytes), sha256Of(bytes), 'hash is stable')
+assert.equal(sha256Of(bytes).length, 64, 'sha256 hex length')
+assert.notEqual(sha256Of(bytes), sha256Of(new TextEncoder().encode('other')), 'different bytes differ')
+
+assert.equal(extensionZipName('0.4.9'), 'dsh-eda-bridge-extension-0.4.9.zip')
+assert.equal(
+  extensionDownloadUrl('http://159.75.130.207/eda', '0.4.9'),
+  'http://159.75.130.207/eda/dsh-eda-bridge-extension-0.4.9.zip',
+  'base without a trailing slash gets one',
+)
+assert.equal(
+  extensionDownloadUrl('https://example.test/dl/', '1.2.3'),
+  'https://example.test/dl/dsh-eda-bridge-extension-1.2.3.zip',
+  'trailing slash is not doubled',
+)
+
+assert.equal(compareDigest('ABC', 'abc'), 'match', 'case-insensitive')
+assert.equal(compareDigest('aa', 'bb'), 'mismatch')
+assert.equal(compareDigest(null, 'bb'), 'unverified', 'missing expected is not a pass')
+assert.equal(compareDigest('aa', undefined), 'unverified')
+assert.equal(compareDigest('', ''), 'unverified')
+
+console.log('ALL PASS extension-package')

package/test/extension-routes.test.ts

@@ -0,0 +1,95 @@
+import { strict as assert } from 'node:assert'
+import { createServer } from 'node:http'
+import { readFileSync } from 'node:fs'
+import { makeEdaMcpRoutes, EDA_MCP_API } from '../src/routes.ts'
+import { sha256Of } from '../src/bridge/extension-package.ts'
+
+const zipPath = 'dsh-eda-bridge-extension-0.4.9.zip'
+const localBytes = readFileSync(zipPath)
+const localSha = sha256Of(localBytes)
+
+// Minimal IncomingMessage/ServerResponse doubles: the handlers only use method, socket,
+// url, writeHead, end and (for errors) destroy.
+function fakeReq(method: string) {
+  return { method, url: '/', socket: { remoteAddress: '127.0.0.1' }, headers: { host: '127.0.0.1' } }
+}
+function fakeRes() {
+  const captured: { status?: number; headers?: Record<string, string>; body?: unknown; bytes?: Buffer } = {}
+  const res = {
+    writeHead(status: number, headers: Record<string, string>) { captured.status = status; captured.headers = headers; return res },
+    end(payload?: unknown) { if (Buffer.isBuffer(payload)) captured.bytes = payload; else if (typeof payload === 'string') captured.body = payload; return res },
+    destroy() { return res },
+    getHeader() { return undefined },
+    setHeader() { return res },
+  }
+  return { res, captured }
+}
+
+function deps(base: string) {
+  return {
+    getConfig: () => ({}),
+    extensionZipPath: zipPath,
+    extensionVersion: '0.4.9',
+    extensionDownloadBase: base,
+    reconnect: () => {},
+    bridgeLaunch: () => ({ command: 'node', args: [], source: 'test' }),
+    diagnostics: () => ({}),
+    launchConfig: () => ({}),
+    selfTest: async () => ({}),
+  }
+}
+
+function routeOf(routes: ReturnType<typeof makeEdaMcpRoutes>, path: string) {
+  const route = routes.find(r => r.path === path)
+  assert.ok(route, 'route ' + path + ' must exist')
+  return route
+}
+
+async function withServer(handler: Parameters<typeof createServer>[1], run: (base: string) => Promise<void>) {
+  const server = createServer(handler)
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  const port = (server.address() as { port: number }).port
+  try { await run('http://127.0.0.1:' + port + '/eda/') } finally { await new Promise<void>(resolve => server.close(() => resolve())) }
+}
+
+// 1. the zip route stamps the digest it is handing out
+{
+  const routes = makeEdaMcpRoutes(deps('http://127.0.0.1:1/eda/'))
+  const { res, captured } = fakeRes()
+  await routeOf(routes, EDA_MCP_API.extensionZip).handler(fakeReq('GET') as never, res as never)
+  assert.equal(captured.status, 200)
+  assert.equal(captured.headers?.['x-extension-sha256'], localSha, 'digest header must describe the bytes served')
+  assert.equal(captured.headers?.['content-length'], String(localBytes.byteLength))
+  assert.equal(captured.headers?.['content-disposition']?.includes(zipPath), true, 'versioned file name is kept')
+  assert.equal(sha256Of(captured.bytes as Buffer), localSha, 'served bytes are the local zip')
+}
+
+// 2. identical remote copy -> match
+await withServer((_req, res) => { res.writeHead(200, { 'content-type': 'application/zip' }); res.end(localBytes) }, async (base) => {
+  const { res, captured } = fakeRes()
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  const body = JSON.parse(String(captured.body))
+  assert.equal(body.verified, 'match', 'identical bytes verify')
+  assert.equal(body.local.sha256, localSha)
+  assert.equal(body.remote.sha256, localSha)
+})
+
+// 3. different remote copy -> mismatch (never silently equal)
+await withServer((_req, res) => { res.writeHead(200); res.end(Buffer.from('different bytes')) }, async (base) => {
+  const { res, captured } = fakeRes()
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  const body = JSON.parse(String(captured.body))
+  assert.equal(body.verified, 'mismatch')
+})
+
+// 4. throttled remote copy -> unverified + status, not a mismatch
+await withServer((_req, res) => { res.writeHead(429, { 'content-type': 'text/plain' }); res.end('slow down') }, async (base) => {
+  const { res, captured } = fakeRes()
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  const body = JSON.parse(String(captured.body))
+  assert.equal(body.verified, 'unverified', '429 is throttling, not a checksum mismatch')
+  assert.equal(body.httpStatus, 429)
+  assert.equal(String(body.error).includes('429'), true)
+})
+
+console.log('ALL PASS extension-routes')