dsh-eda-mcp 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.1.2 — 2026-10-21
+
+### 扩展包改为**从服务器下载**（发布包不再自带 zip）
+
+按你的要求，本地不再保留副本，下载一律走服务器，同时保住"发出去的一定是对的那一版"：
+
+- `build.mjs` 现在生成 `lib/extension-digest.json`（version / file / bytes / sha256），发布包 `files` **移除** `dsh-eda-bridge-extension-*.zip`（实测 tarball 只剩 170 B 的清单，49 个文件，不再有 zip）。
+- `GET /api/dsh-eda-mcp/extension.zip`：从下载服务器取回 → 与清单 sha256 比对 → **一致才发**；不一致返回 502 并说明"拒绝发送不同版本"；429 报"限流，不是文件坏了"；服务器不可达报 502 带地址。响应头带 `x-extension-source: server`、`x-extension-version`、`x-extension-sha256`。
+- 设置卡片：按钮文案带版本（「下载 JLCEDA 扩展包 v0.4.9」），下面显示 `本地 v0.4.9 · 9827 字节 · sha256 …`（来自新增的本地路由 `/extension/info`，不联网）；「校验服务器副本」按钮保留。
+- `eda_extension_package` 也改为以清单为准：不再需要本地 zip，`download:true` 校验清单后落盘；机器上若恰好有 zip 会额外报告它。
+- 第 11 套单测重写：真实本地 HTTP 服务模拟**一致 / 不同版本 / 429** 三种响应，断言一致才发出、不一致 502 且**不发任何字节**、429 如实上报；并覆盖 `/extension/info` 不联网。
+
+代价（明确记录）：**离线安装不再可能**，且服务器那份 zip 一旦与 `lib/extension-digest.json` 不同步，下载会被拒绝——这时必须重新上传构建产物。
+
+
 ## 1.1.1 — 2026-10-21
 
 ### 设置卡片：下载仍是本地那份，但**能校验服务器副本**

package/README.md

@@ -36,10 +36,11 @@ pnpm add dsh-eda-mcp            # or use the plugin manager in the Web GUI
 # restart DSH
 ```
 
-The published package already contains `lib/` and `dsh-eda-bridge-extension-<version>.zip`, so no build
-toolchain is needed. The extension still has to be imported into JLCEDA Pro by hand — the zip
-sits at `node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<version>.zip` (or download it from the
-settings card).
+The published package ships `lib/` and `lib/extension-digest.json` (no zip), so no build toolchain
+is needed. The extension zip is **downloaded, not bundled**: the settings card (or the link below)
+fetches it from the download server and the plugin verifies the sha256 against its own manifest
+before the file is handed to you — a served copy that does not match is refused instead of being
+installed as a different wire version. Import it into JLCEDA Pro by hand.
 
 Direct links (no package install needed):
 

package/README.zh.md

@@ -47,8 +47,7 @@ pnpm add dsh-eda-mcp            # 或用 Web GUI 的插件管理器安装
 # 重启 DSH
 ```
 
-发布包里已包含 `lib/` 与 `dsh-eda-bridge-extension-<线协议版本>.zip`，**不需要构建工具链**。扩展仍需手动导入
-嘉立创EDA：zip 位于 `node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<线协议版本>.zip`（也可从设置卡片下载，下载到的文件名自带版本号）。
+发布包里已包含 `lib/` 与 `lib/extension-digest.json`（**不含 zip**），**不需要构建工具链**。扩展 zip 改成**下载获取**：设置卡片（或下面的直链）从下载服务器取回，插件在把文件交给你之前用自带清单校验 sha256 —— 对不上就拒绝发送，不会让你误装成另一个线协议版本。扩展仍需手动导入嘉立创EDA。
 
 直链（不用装包也能下）：
 

package/docs/schematic-workflow.md

@@ -293,5 +293,5 @@ C. 只做 PCB：
 - 版本纪律：扩展线协议**只递增最小位**（`0.4.1 → 0.4.2`），每次改动必须同时改 `jlc-extension/extension.json` 的 `version` 与桥接的 `VERSION`；不一致时 `eda_status.versionMismatch` 为 true。
 - 新会话开工顺序：`eda_status`（连没连、版本对不对）→ 本技能（怎么干）→ 再动手；不要先假设环境就绪。
 | 需要扩展 zip（换机器/给别人） | 不清楚该给哪一份 | `eda_extension_package` 报路径+sha256；`download:true` 从服务器取回并逐字节比对（`verified`），一致才落盘 |
-- 扩展 zip 位置：`node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<版本>.zip`，或设置卡片下载（文件名自带版本号）。
+- 扩展 zip 位置：**发布包不再自带 zip**（只有 `lib/extension-digest.json`）。用设置卡片的下载按钮或 `eda_extension_package({download:true})` 从下载服务器取回，插件会用清单 sha256 校验后才落盘；服务器那份对不上时会被拒绝，需要先重新上传。
 - 排查顺序：`eda_status` → `/api/dsh-eda-mcp/diagnostics`（`clientStartupError` / `skills` / `bridgeHealth`）→ `eda_list_api_methods`（白名单）→ 应用侧 DRC 面板。

package/lib/bridge.mjs

@@ -3019,37 +3019,24 @@ async function executeTool(name, rawArgs, timeoutMs) {
         mirror: args.mirror === void 0 ? void 0 : Boolean(args.mirror)
       }], timeoutMs);
     case "eda_extension_package": {
-      const manifestCandidates = [
-        join(packageRoot(), "jlc-extension", "extension.json"),
-        join(packageRoot(), "dsh-eda-bridge-extension.zip")
-      ];
-      let version = VERSION;
+      const manifestPath = join(packageRoot(), "lib", "extension-digest.json");
+      let expected = {};
       try {
-        const manifest = JSON.parse(await readFile(manifestCandidates[0], "utf8"));
-        if (typeof manifest.version === "string" && manifest.version !== "") version = manifest.version;
+        expected = JSON.parse(await readFile(manifestPath, "utf8"));
       } catch {
+        expected = {};
       }
-      const localCandidates = [
-        join(packageRoot(), extensionZipName(version)),
-        join(packageRoot(), "dsh-eda-bridge-extension.zip")
-      ];
-      let localPath = "";
-      for (const candidate of localCandidates) {
-        if (existsSync(candidate)) {
-          localPath = candidate;
-          break;
-        }
-      }
-      if (localPath === "") {
-        throw new Error("eda_extension_package: no extension zip next to the plugin (looked for " + localCandidates.join(", ") + ")");
-      }
-      const localBytes = await readFile(localPath);
-      const localSha256 = sha256Of(localBytes);
+      const version = typeof expected.version === "string" && expected.version !== "" ? expected.version : VERSION;
+      const expectedSha256 = typeof expected.sha256 === "string" ? expected.sha256 : "";
+      const localPath = join(packageRoot(), extensionZipName(version));
+      const localSource = existsSync(localPath) ? localPath : null;
+      const localBytes = localSource === null ? null : await readFile(localSource);
       const base = typeof args.base === "string" && args.base !== "" ? args.base : process.env.DSH_EDA_EXTENSION_BASE ?? "http://159.75.130.207/eda/";
       const url = extensionDownloadUrl(base, version);
       const report = {
         version,
-        local: { path: localPath, bytes: localBytes.byteLength, sha256: localSha256 },
+        expected: { bytes: Number(expected.bytes ?? 0), sha256: expectedSha256, manifest: manifestPath },
+        localZip: localSource === null ? null : { path: localSource, bytes: localBytes.byteLength, sha256: sha256Of(localBytes) },
         url
       };
       if (args.download !== true) return report;
@@ -3065,10 +3052,10 @@ async function executeTool(name, rawArgs, timeoutMs) {
       }
       const remoteBytes = new Uint8Array(await response.arrayBuffer());
       const remoteSha256 = sha256Of(remoteBytes);
-      const verdict = compareDigest(localSha256, remoteSha256);
+      const verdict = compareDigest(expectedSha256, remoteSha256);
       const result2 = {
         ...report,
-        remote: { url, bytes: remoteBytes.byteLength, sha256: remoteSha256 },
+        served: { url, bytes: remoteBytes.byteLength, sha256: remoteSha256 },
         verified: verdict
       };
       if (verdict === "match") {
@@ -3078,8 +3065,10 @@ async function executeTool(name, rawArgs, timeoutMs) {
         await writeFile(savedPath, remoteBytes);
         result2.savedPath = savedPath;
         result2.next = "In JLCEDA Pro: \u6269\u5C55 \u2192 \u5BFC\u5165\u6269\u5C55 \u2192 select this zip \u2192 restart the application (not a reload).";
+      } else if (verdict === "mismatch") {
+        result2.next = "The served copy differs from the digest this plugin was built with (wire version " + version + "). Do not import it: re-upload " + extensionZipName(version) + " from the build output to the download server.";
       } else {
-        result2.next = "The served copy differs from the one this plugin ships. Do not import it: re-upload " + extensionZipName(version) + " from the plugin directory to the download server.";
+        result2.next = "No expected digest in " + manifestPath + "; rebuild the plugin so it records one.";
       }
       return result2;
     }

package/lib/client.js

@@ -1137,6 +1137,7 @@ function EdaMcpSettingsCard(props) {
   const [notice, setNotice] = (0, import_react.useState)();
   const [verifyingExtension, setVerifyingExtension] = (0, import_react.useState)(false);
   const [extensionVerdict, setExtensionVerdict] = (0, import_react.useState)();
+  const [extensionInfo, setExtensionInfo] = (0, import_react.useState)();
   const verifyExtension = async () => {
     if (verifyingExtension) return;
     setVerifyingExtension(true);
@@ -1316,29 +1317,37 @@ function EdaMcpSettingsCard(props) {
         }
       ),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { ...hintStyle, margin: "8px 0 0" }, children: t("settings.portLabel") }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Field, { label: t("settings.downloadExtension"), hint: t("settings.installHint"), children: [
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "a",
-          {
-            href: "/api/dsh-eda-mcp/extension.zip",
-            style: { ...secondaryButtonStyle, textDecoration: "none", display: "inline-flex", width: "fit-content" },
-            children: t("settings.downloadExtension")
-          }
-        ),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-          "button",
-          {
-            type: "button",
-            onClick: () => {
-              void verifyExtension();
-            },
-            disabled: verifyingExtension,
-            style: verifyingExtension ? { ...secondaryButtonStyle, ...disabledButtonStyle, marginLeft: 8 } : { ...secondaryButtonStyle, marginLeft: 8 },
-            children: verifyingExtension ? t("settings.verifyBusy") : t("settings.verifyExtension")
-          }
-        ),
-        extensionVerdict !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", style: { ...hintStyle, margin: "6px 0 0", color: extensionVerdict.kind === "ok" ? void 0 : "#c0392b" }, children: extensionVerdict.text }) : null
-      ] })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
+        Field,
+        {
+          label: extensionInfo === void 0 ? t("settings.downloadExtension") : t("settings.downloadExtensionVersioned").replace("{version}", extensionInfo.version),
+          hint: t("settings.installHint"),
+          children: [
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+              "a",
+              {
+                href: "/api/dsh-eda-mcp/extension.zip",
+                style: { ...secondaryButtonStyle, textDecoration: "none", display: "inline-flex", width: "fit-content" },
+                children: extensionInfo === void 0 ? t("settings.downloadExtension") : t("settings.downloadExtensionVersioned").replace("{version}", extensionInfo.version)
+              }
+            ),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+              "button",
+              {
+                type: "button",
+                onClick: () => {
+                  void verifyExtension();
+                },
+                disabled: verifyingExtension,
+                style: verifyingExtension ? { ...secondaryButtonStyle, ...disabledButtonStyle, marginLeft: 8 } : { ...secondaryButtonStyle, marginLeft: 8 },
+                children: verifyingExtension ? t("settings.verifyBusy") : t("settings.verifyExtension")
+              }
+            ),
+            extensionInfo !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { ...hintStyle, margin: "6px 0 0" }, children: t("settings.extensionInfo").replace("{version}", extensionInfo.version).replace("{bytes}", String(extensionInfo.bytes)).replace("{hash}", extensionInfo.sha256.slice(0, 16) + "\u2026") }) : null,
+            extensionVerdict !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", style: { ...hintStyle, margin: "6px 0 0", color: extensionVerdict.kind === "ok" ? void 0 : "#c0392b" }, children: extensionVerdict.text }) : null
+          ]
+        }
+      )
     ] }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("footer", { style: footerStyle, children: [
       notice !== void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: noticeStyle, role: "status", children: notice.text }) : null,
@@ -1517,12 +1526,15 @@ var zh = {
   "settings.reconnectFailed": "\u91CD\u8FDE\u5931\u8D25",
   "settings.portLabel": "\u6865\u63A5 WebSocket \u7AEF\u53E3\uFF1A39009\uFF08\u56FA\u5B9A\uFF09",
   "settings.downloadExtension": "\u4E0B\u8F7D JLCEDA \u6269\u5C55\u5305",
+  "settings.downloadExtensionVersioned": "\u4E0B\u8F7D JLCEDA \u6269\u5C55\u5305 v{version}",
+  "settings.extensionInfo": "\u672C\u5730 v{version} \xB7 {bytes} \u5B57\u8282 \xB7 sha256 {hash}",
+  "settings.extensionInfoUnknown": "\u6269\u5C55\u5305\u4FE1\u606F\u4E0D\u53EF\u7528",
   "settings.verifyExtension": "\u6821\u9A8C\u670D\u52A1\u5668\u526F\u672C",
   "settings.verifyBusy": "\u6821\u9A8C\u4E2D\u2026",
   "settings.verifyMatch": "\u4E00\u81F4\uFF1A\u670D\u52A1\u5668\u4E0A\u7684 zip \u4E0E\u672C\u5730\u8FD9\u4EFD\u9010\u5B57\u8282\u76F8\u540C\uFF08sha256 {hash}\uFF09",
   "settings.verifyMismatch": "\u4E0D\u4E00\u81F4\uFF1A\u670D\u52A1\u5668\u90A3\u4EFD\u4E0E\u672C\u5730\u4E0D\u540C\uFF0C\u8BF7\u91CD\u65B0\u4E0A\u4F20 {hash}",
   "settings.verifyUnverified": "\u65E0\u6CD5\u6821\u9A8C\uFF1A{reason}",
-  "settings.installHint": "\u5728\u5609\u7ACB\u521BEDA\u4E13\u4E1A\u7248\u4E2D\uFF1A\u6269\u5C55 \u2192 \u5BFC\u5165 \u2192 \u9009\u62E9\u4E0B\u8F7D\u7684 zip \u2192 \u5728\u6269\u5C55\u5217\u8868\u5F00\u542F\u672C\u6269\u5C55\u7684\u300C\u5141\u8BB8\u5916\u90E8\u4EA4\u4E92\u300D\u3002"
+  "settings.installHint": "\u70B9\u4E0B\u8F7D\u4F1A\u4ECE\u4E0B\u8F7D\u670D\u52A1\u5668\u53D6\u56DE\u4E0E\u672C\u63D2\u4EF6\u7EBF\u534F\u8BAE\u4E00\u81F4\u7684 zip\uFF08\u53D1\u9001\u524D\u6821\u9A8C sha256\uFF0C\u4E0D\u4E00\u81F4\u5219\u62D2\u7EDD\u53D1\u9001\uFF09\uFF1B\u5728\u5609\u7ACB\u521BEDA\u4E13\u4E1A\u7248\u4E2D\uFF1A\u6269\u5C55 \u2192 \u5BFC\u5165 \u2192 \u9009\u62E9\u8BE5 zip \u2192 \u5728\u6269\u5C55\u5217\u8868\u5F00\u542F\u672C\u6269\u5C55\u7684\u300C\u5141\u8BB8\u5916\u90E8\u4EA4\u4E92\u300D\u3002"
 };
 var en = {
   "settings.title": "JLCEDA MCP",
@@ -1554,12 +1566,15 @@ var en = {
   "settings.reconnectFailed": "Reconnect failed",
   "settings.portLabel": "Bridge WebSocket port: 39009 (fixed)",
   "settings.downloadExtension": "Download JLCEDA extension zip",
+  "settings.downloadExtensionVersioned": "Download JLCEDA extension zip v{version}",
+  "settings.extensionInfo": "Bundled v{version} \xB7 {bytes} bytes \xB7 sha256 {hash}",
+  "settings.extensionInfoUnknown": "Extension package info unavailable",
   "settings.verifyExtension": "Verify server copy",
   "settings.verifyBusy": "Verifying\u2026",
   "settings.verifyMatch": "Match: the served zip is byte-identical to the local one (sha256 {hash})",
   "settings.verifyMismatch": "Mismatch: the served zip differs \u2014 re-upload {hash}",
   "settings.verifyUnverified": "Could not verify: {reason}",
-  "settings.installHint": 'In JLCEDA Pro: Extensions \u2192 Import \u2192 select the downloaded zip \u2192 enable "Allow external interactions" for this extension.'
+  "settings.installHint": 'Download fetches the zip whose wire version matches this plugin from the download server (sha256 is verified before the file is sent; a mismatch is refused). Then in JLCEDA Pro: Extensions \u2192 Import \u2192 select that zip \u2192 enable "Allow external interactions".'
 };
 
 // src/client/index.ts

package/lib/extension-digest.json

@@ -0,0 +1,6 @@
+{
+  "version": "0.4.9",
+  "file": "dsh-eda-bridge-extension-0.4.9.zip",
+  "bytes": 9827,
+  "sha256": "518fef209574171dda8672dbeb830603bca58acdf3ed576b5c45c14e08929167"
+}

package/lib/index.js

@@ -2,7 +2,7 @@
 import * as mcpClient from "@deepseek-ai/dsh-mcp-client";
 import z from "@deepseek-ai/schemastery";
 import { fileURLToPath } from "node:url";
-import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 
 // src/guidance.ts
@@ -326,7 +326,7 @@ var SKILL_PLAYBOOK_LINES = [
   "- \u7248\u672C\u7EAA\u5F8B\uFF1A\u6269\u5C55\u7EBF\u534F\u8BAE**\u53EA\u9012\u589E\u6700\u5C0F\u4F4D**\uFF08`0.4.1 \u2192 0.4.2`\uFF09\uFF0C\u6BCF\u6B21\u6539\u52A8\u5FC5\u987B\u540C\u65F6\u6539 `jlc-extension/extension.json` \u7684 `version` \u4E0E\u6865\u63A5\u7684 `VERSION`\uFF1B\u4E0D\u4E00\u81F4\u65F6 `eda_status.versionMismatch` \u4E3A true\u3002",
   "- \u65B0\u4F1A\u8BDD\u5F00\u5DE5\u987A\u5E8F\uFF1A`eda_status`\uFF08\u8FDE\u6CA1\u8FDE\u3001\u7248\u672C\u5BF9\u4E0D\u5BF9\uFF09\u2192 \u672C\u6280\u80FD\uFF08\u600E\u4E48\u5E72\uFF09\u2192 \u518D\u52A8\u624B\uFF1B\u4E0D\u8981\u5148\u5047\u8BBE\u73AF\u5883\u5C31\u7EEA\u3002",
   "| \u9700\u8981\u6269\u5C55 zip\uFF08\u6362\u673A\u5668/\u7ED9\u522B\u4EBA\uFF09 | \u4E0D\u6E05\u695A\u8BE5\u7ED9\u54EA\u4E00\u4EFD | `eda_extension_package` \u62A5\u8DEF\u5F84+sha256\uFF1B`download:true` \u4ECE\u670D\u52A1\u5668\u53D6\u56DE\u5E76\u9010\u5B57\u8282\u6BD4\u5BF9\uFF08`verified`\uFF09\uFF0C\u4E00\u81F4\u624D\u843D\u76D8 |",
-  "- \u6269\u5C55 zip \u4F4D\u7F6E\uFF1A`node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<\u7248\u672C>.zip`\uFF0C\u6216\u8BBE\u7F6E\u5361\u7247\u4E0B\u8F7D\uFF08\u6587\u4EF6\u540D\u81EA\u5E26\u7248\u672C\u53F7\uFF09\u3002",
+  "- \u6269\u5C55 zip \u4F4D\u7F6E\uFF1A**\u53D1\u5E03\u5305\u4E0D\u518D\u81EA\u5E26 zip**\uFF08\u53EA\u6709 `lib/extension-digest.json`\uFF09\u3002\u7528\u8BBE\u7F6E\u5361\u7247\u7684\u4E0B\u8F7D\u6309\u94AE\u6216 `eda_extension_package({download:true})` \u4ECE\u4E0B\u8F7D\u670D\u52A1\u5668\u53D6\u56DE\uFF0C\u63D2\u4EF6\u4F1A\u7528\u6E05\u5355 sha256 \u6821\u9A8C\u540E\u624D\u843D\u76D8\uFF1B\u670D\u52A1\u5668\u90A3\u4EFD\u5BF9\u4E0D\u4E0A\u65F6\u4F1A\u88AB\u62D2\u7EDD\uFF0C\u9700\u8981\u5148\u91CD\u65B0\u4E0A\u4F20\u3002",
   "- \u6392\u67E5\u987A\u5E8F\uFF1A`eda_status` \u2192 `/api/dsh-eda-mcp/diagnostics`\uFF08`clientStartupError` / `skills` / `bridgeHealth`\uFF09\u2192 `eda_list_api_methods`\uFF08\u767D\u540D\u5355\uFF09\u2192 \u5E94\u7528\u4FA7 DRC \u9762\u677F\u3002"
 ];
 var SKILL_SECTIONS = SKILL_PLAYBOOK_LINES.filter((line) => line.startsWith("## "));
@@ -435,7 +435,6 @@ function createEdaSkillProvider() {
 
 // src/routes.ts
 import { readFile } from "node:fs/promises";
-import { basename } from "node:path";
 import { SettingsConflictError } from "@deepseek-ai/dsh-settings";
 
 // src/loopback.ts
@@ -501,6 +500,7 @@ var EDA_MCP_API = {
   reconnect: "/api/dsh-eda-mcp/reconnect",
   extensionZip: "/api/dsh-eda-mcp/extension.zip",
   extensionVerify: "/api/dsh-eda-mcp/extension/verify",
+  extensionInfo: "/api/dsh-eda-mcp/extension/info",
   diagnostics: "/api/dsh-eda-mcp/diagnostics",
   selfTest: "/api/dsh-eda-mcp/self-test",
   settingsDescribe: "/api/dsh-eda-mcp/settings/describe",
@@ -622,53 +622,104 @@ function makeEdaMcpRoutes(deps) {
       }
     }
   };
+  const readExtensionDigest = async () => {
+    try {
+      const parsed = JSON.parse(await readFile(deps.extensionDigestPath, "utf8"));
+      if (typeof parsed.version !== "string" || typeof parsed.sha256 !== "string" || typeof parsed.file !== "string") return null;
+      return { version: parsed.version, file: parsed.file, bytes: Number(parsed.bytes ?? 0), sha256: parsed.sha256 };
+    } catch {
+      return null;
+    }
+  };
   const extensionZip = {
     kind: "exact",
     path: EDA_MCP_API.extensionZip,
     handler: async (req, res) => {
       if (req.method !== "GET") return json(res, 405, { ok: false, error: "method-not-allowed" });
       if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: "forbidden" });
-      let bytes;
+      const digest = await readExtensionDigest();
+      if (digest === null) {
+        return json(res, 503, { ok: false, error: "lib/extension-digest.json is missing; run the build before installing the plugin" });
+      }
+      const requested = new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("source");
+      const url = extensionDownloadUrl(deps.extensionDownloadBase, digest.version);
+      let response;
       try {
-        bytes = await readFile(deps.extensionZipPath);
-      } catch {
-        return json(res, 404, { ok: false, error: "extension zip missing next to the plugin" });
+        response = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+      } catch (error) {
+        return json(res, 502, {
+          ok: false,
+          error: "could not reach the download server: " + (error instanceof Error ? error.message : String(error)),
+          url
+        });
+      }
+      if (!response.ok) {
+        const throttled = response.status === 429;
+        return json(res, throttled ? 429 : 502, {
+          ok: false,
+          httpStatus: response.status,
+          url,
+          error: throttled ? "the download server throttled this IP (5 downloads/min per IP). Wait about a minute and click download again." : "the download server answered HTTP " + response.status
+        });
+      }
+      const bytes = Buffer.from(new Uint8Array(await response.arrayBuffer()));
+      const servedSha256 = sha256Of(bytes);
+      const verdict = compareDigest(digest.sha256, servedSha256);
+      if (verdict !== "match") {
+        return json(res, 502, {
+          ok: false,
+          url,
+          verified: verdict,
+          expected: { version: digest.version, sha256: digest.sha256, bytes: digest.bytes },
+          served: { sha256: servedSha256, bytes: bytes.byteLength },
+          error: "the served zip is not the build this plugin ships (wire version " + digest.version + "); refusing to hand out a different version. Re-upload " + digest.file + " to the download server."
+        });
       }
       res.writeHead(200, {
         "content-type": "application/zip",
-        // Keep the versioned file name the browser saves it as.
-        "content-disposition": 'attachment; filename="' + basename(deps.extensionZipPath) + '"',
+        "content-disposition": 'attachment; filename="' + digest.file + '"',
         "cache-control": "no-store",
-        "x-extension-version": deps.extensionVersion,
-        "x-extension-sha256": sha256Of(bytes),
-        "content-length": String(bytes.byteLength)
+        "content-length": String(bytes.byteLength),
+        "x-extension-source": "server",
+        "x-extension-version": digest.version,
+        "x-extension-sha256": servedSha256,
+        ...requested === "local" ? { "x-extension-note": "source=local requested; the served copy was verified and used" } : {}
       });
       res.end(bytes);
     }
   };
+  const extensionInfo = {
+    kind: "exact",
+    path: EDA_MCP_API.extensionInfo,
+    handler: async (req, res) => {
+      if (req.method !== "GET") return json(res, 405, { ok: false, error: "method-not-allowed" });
+      if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: "forbidden" });
+      const digest = await readExtensionDigest();
+      if (digest === null) return json(res, 503, { ok: false, error: "lib/extension-digest.json is missing" });
+      json(res, 200, {
+        version: digest.version,
+        file: digest.file,
+        bytes: digest.bytes,
+        sha256: digest.sha256,
+        downloadPath: EDA_MCP_API.extensionZip,
+        serverUrl: extensionDownloadUrl(deps.extensionDownloadBase, digest.version),
+        source: "server"
+      });
+    }
+  };
   const extensionVerify = {
     kind: "exact",
     path: EDA_MCP_API.extensionVerify,
     handler: async (req, res) => {
       if (req.method !== "GET") return json(res, 405, { ok: false, error: "method-not-allowed" });
       if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: "forbidden" });
-      let localBytes;
-      try {
-        localBytes = await readFile(deps.extensionZipPath);
-      } catch {
-        return json(res, 404, { ok: false, error: "extension zip missing next to the plugin" });
-      }
-      const localSha256 = sha256Of(localBytes);
-      const url = extensionDownloadUrl(deps.extensionDownloadBase, deps.extensionVersion);
-      const report = {
-        version: deps.extensionVersion,
-        file: basename(deps.extensionZipPath),
-        local: { bytes: localBytes.byteLength, sha256: localSha256 },
-        url
-      };
+      const digest = await readExtensionDigest();
+      if (digest === null) return json(res, 503, { ok: false, error: "lib/extension-digest.json is missing" });
+      const url = extensionDownloadUrl(deps.extensionDownloadBase, digest.version);
+      const report = { version: digest.version, file: digest.file, expected: { bytes: digest.bytes, sha256: digest.sha256 }, url };
       let response;
       try {
-        response = await fetch(url, { signal: AbortSignal.timeout(2e4) });
+        response = await fetch(url, { signal: AbortSignal.timeout(3e4) });
       } catch (error) {
         return json(res, 200, { ...report, verified: "unverified", error: "download failed: " + (error instanceof Error ? error.message : String(error)) });
       }
@@ -680,16 +731,16 @@ function makeEdaMcpRoutes(deps) {
           error: response.status === 429 ? "the download server throttled this IP (HTTP 429, 5 downloads/min). Wait about a minute and verify again." : "download failed: HTTP " + response.status
         });
       }
-      const remoteBytes = new Uint8Array(await response.arrayBuffer());
-      const remoteSha256 = sha256Of(remoteBytes);
+      const servedBytes = new Uint8Array(await response.arrayBuffer());
+      const servedSha256 = sha256Of(servedBytes);
       return json(res, 200, {
         ...report,
-        remote: { bytes: remoteBytes.byteLength, sha256: remoteSha256 },
-        verified: compareDigest(localSha256, remoteSha256)
+        served: { bytes: servedBytes.byteLength, sha256: servedSha256 },
+        verified: compareDigest(digest.sha256, servedSha256)
       });
     }
   };
-  return [test, reconnect, extensionZip, extensionVerify, diagnostics, selfTest];
+  return [test, reconnect, extensionZip, extensionInfo, extensionVerify, diagnostics, selfTest];
 }
 function makeEdaMcpSettingsRoutes(settings) {
   const ns = "eda-mcp";
@@ -1028,19 +1079,6 @@ function resolveExtensionVersion() {
     return "";
   }
 }
-function resolveExtensionZipPath() {
-  const plain = fileURLToPath(new URL("../dsh-eda-bridge-extension.zip", import.meta.url));
-  try {
-    const manifest = JSON.parse(readFileSync(fileURLToPath(new URL("../jlc-extension/extension.json", import.meta.url)), "utf8"));
-    const version = typeof manifest.version === "string" ? manifest.version : "";
-    if (version !== "") {
-      const versioned = fileURLToPath(new URL("../dsh-eda-bridge-extension-" + version + ".zip", import.meta.url));
-      if (existsSync2(versioned)) return versioned;
-    }
-  } catch {
-  }
-  return plain;
-}
 var BRIDGE_PATH = fileURLToPath(BRIDGE_URL);
 function bridgeLaunchFor(active) {
   const runtime = resolveBridgeRuntime();
@@ -1130,7 +1168,7 @@ function apply(ctx, config) {
   ctx.effect(() => {
     const disposers = makeEdaMcpRoutes({
       getConfig: () => current(),
-      extensionZipPath: resolveExtensionZipPath(),
+      extensionDigestPath: fileURLToPath(new URL("../lib/extension-digest.json", import.meta.url)),
       extensionVersion: resolveExtensionVersion(),
       extensionDownloadBase: process.env.DSH_EDA_EXTENSION_BASE ?? "http://159.75.130.207/eda/",
       reconnect: remountClient,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-eda-mcp",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "DeepSeek Harness (DSH) plugin — connects DSH to JLCEDA Pro (EasyEDA Pro) via a local MCP bridge and draws schematics through the JLCEDA extension API.",
   "license": "Apache-2.0",
   "author": {
@@ -49,7 +49,6 @@
     "test",
     "docs",
     "jlc-extension",
-    "dsh-eda-bridge-extension-*.zip",
     "cordis.patch.yml",
     "CHANGELOG.md",
     "CONTRIBUTING.md",

package/src/bridge/index.ts

@@ -2376,46 +2376,36 @@ async function executeTool(name, rawArgs, timeoutMs) {
       }], timeoutMs)
 
     case 'eda_extension_package': {
-      // Two copies of the same artifact exist: the zip inside this npm package and the one
-      // on the download server. Nobody could tell whether they match, so this tool reports
-      // the local digest and, with download:true, fetches the served copy and compares the
-      // two byte for byte. A mismatch is never written to disk.
-      const manifestCandidates = [
-        join(packageRoot(), 'jlc-extension', 'extension.json'),
-        join(packageRoot(), 'dsh-eda-bridge-extension.zip'),
-      ]
-      let version = VERSION
+      // The package ships only lib/extension-digest.json (no zip): the artifact itself lives on
+      // the download server. The expected digest comes from that manifest, so a served copy can
+      // be verified even on a machine that has never had a local zip.
+      const manifestPath = join(packageRoot(), 'lib', 'extension-digest.json')
+      let expected: { version?: string; file?: string; bytes?: number; sha256?: string } = {}
       try {
-        const manifest = JSON.parse(await readFile(manifestCandidates[0], 'utf8')) as { version?: string }
-        if (typeof manifest.version === 'string' && manifest.version !== '') version = manifest.version
-      } catch { /* keep the bridge VERSION */ }
-      const localCandidates = [
-        join(packageRoot(), extensionZipName(version)),
-        join(packageRoot(), 'dsh-eda-bridge-extension.zip'),
-      ]
-      let localPath = ''
-      for (const candidate of localCandidates) {
-        if (existsSync(candidate)) { localPath = candidate; break }
-      }
-      if (localPath === '') {
-        throw new Error('eda_extension_package: no extension zip next to the plugin (looked for ' + localCandidates.join(', ') + ')')
-      }
-      const localBytes = await readFile(localPath)
-      const localSha256 = sha256Of(localBytes)
+        expected = JSON.parse(await readFile(manifestPath, 'utf8')) as typeof expected
+      } catch {
+        expected = {}
+      }
+      const version = typeof expected.version === 'string' && expected.version !== '' ? expected.version : VERSION
+      const expectedSha256 = typeof expected.sha256 === 'string' ? expected.sha256 : ''
+      const localPath = join(packageRoot(), extensionZipName(version))
+      const localSource = existsSync(localPath) ? localPath : null
+      const localBytes = localSource === null ? null : await readFile(localSource)
       const base = typeof args.base === 'string' && args.base !== ''
         ? args.base
         : (process.env.DSH_EDA_EXTENSION_BASE ?? 'http://159.75.130.207/eda/')
       const url = extensionDownloadUrl(base, version)
       const report = {
         version,
-        local: { path: localPath, bytes: localBytes.byteLength, sha256: localSha256 },
+        expected: { bytes: Number(expected.bytes ?? 0), sha256: expectedSha256, manifest: manifestPath },
+        localZip: localSource === null
+          ? null
+          : { path: localSource, bytes: localBytes!.byteLength, sha256: sha256Of(localBytes!) },
         url,
       }
       if (args.download !== true) return report
       const response = await fetch(url, { signal: AbortSignal.timeout(30000) })
       if (!response.ok) {
-        // 429 is the download server's rate limit (5 req/min per IP), not a broken artifact:
-        // say so, otherwise the caller retries in a loop and never succeeds.
         const throttled = response.status === 429
         return {
           ...report,
@@ -2428,10 +2418,10 @@ async function executeTool(name, rawArgs, timeoutMs) {
       }
       const remoteBytes = new Uint8Array(await response.arrayBuffer())
       const remoteSha256 = sha256Of(remoteBytes)
-      const verdict = compareDigest(localSha256, remoteSha256)
+      const verdict = compareDigest(expectedSha256, remoteSha256)
       const result: Record<string, unknown> = {
         ...report,
-        remote: { url, bytes: remoteBytes.byteLength, sha256: remoteSha256 },
+        served: { url, bytes: remoteBytes.byteLength, sha256: remoteSha256 },
         verified: verdict,
       }
       if (verdict === 'match') {
@@ -2441,9 +2431,11 @@ async function executeTool(name, rawArgs, timeoutMs) {
         await writeFile(savedPath, remoteBytes)
         result.savedPath = savedPath
         result.next = 'In JLCEDA Pro: 扩展 → 导入扩展 → select this zip → restart the application (not a reload).'
+      } else if (verdict === 'mismatch') {
+        result.next = 'The served copy differs from the digest this plugin was built with (wire version ' + version +
+          '). Do not import it: re-upload ' + extensionZipName(version) + ' from the build output to the download server.'
       } else {
-        result.next = 'The served copy differs from the one this plugin ships. Do not import it: re-upload ' +
-          extensionZipName(version) + ' from the plugin directory to the download server.'
+        result.next = 'No expected digest in ' + manifestPath + '; rebuild the plugin so it records one.'
       }
       return result
     }

package/src/client/EdaMcpSettingsCard.tsx

@@ -329,6 +329,8 @@ export function EdaMcpSettingsCard(props: EdaMcpSettingsCardProps) {
   const [notice, setNotice] = useState<{ kind: 'ok' | 'error'; text: string } | undefined>()
   const [verifyingExtension, setVerifyingExtension] = useState(false)
   const [extensionVerdict, setExtensionVerdict] = useState<{ kind: 'ok' | 'error'; text: string } | undefined>()
+  const [extensionInfo, setExtensionInfo] = useState<{ version: string; bytes: number; sha256: string } | undefined>()
+
 
   const verifyExtension = async (): Promise<void> => {
     if (verifyingExtension) return
@@ -491,14 +493,21 @@ export function EdaMcpSettingsCard(props: EdaMcpSettingsCardProps) {
 
         <p style={{ ...hintStyle, margin: '8px 0 0' }}>{t('settings.portLabel')}</p>
 
-        <Field label={t('settings.downloadExtension')} hint={t('settings.installHint')}>
+        <Field
+          label={extensionInfo === undefined
+            ? t('settings.downloadExtension')
+            : t('settings.downloadExtensionVersioned').replace('{version}', extensionInfo.version)}
+          hint={t('settings.installHint')}
+        >
           <a
             href="/api/dsh-eda-mcp/extension.zip"
             // No download name: the server sends the versioned file name, so the
             // saved copy always states which build it is.
             style={{ ...secondaryButtonStyle, textDecoration: 'none', display: 'inline-flex', width: 'fit-content' }}
           >
-            {t('settings.downloadExtension')}
+            {extensionInfo === undefined
+              ? t('settings.downloadExtension')
+              : t('settings.downloadExtensionVersioned').replace('{version}', extensionInfo.version)}
           </a>
           <button
             type="button"
@@ -508,6 +517,12 @@ export function EdaMcpSettingsCard(props: EdaMcpSettingsCardProps) {
           >
             {verifyingExtension ? t('settings.verifyBusy') : t('settings.verifyExtension')}
           </button>
+          {extensionInfo !== undefined
+            ? <p style={{ ...hintStyle, margin: '6px 0 0' }}>{t('settings.extensionInfo')
+                .replace('{version}', extensionInfo.version)
+                .replace('{bytes}', String(extensionInfo.bytes))
+                .replace('{hash}', extensionInfo.sha256.slice(0, 16) + '…')}</p>
+            : null}
           {extensionVerdict !== undefined
             ? <p role="status" style={{ ...hintStyle, margin: '6px 0 0', color: extensionVerdict.kind === 'ok' ? undefined : '#c0392b' }}>{extensionVerdict.text}</p>
             : null}

package/src/client/locales.ts

@@ -28,12 +28,15 @@ export const zh = {
   'settings.reconnectFailed': '重连失败',
   'settings.portLabel': '桥接 WebSocket 端口：39009（固定）',
   'settings.downloadExtension': '下载 JLCEDA 扩展包',
+  'settings.downloadExtensionVersioned': '下载 JLCEDA 扩展包 v{version}',
+  'settings.extensionInfo': '本地 v{version} · {bytes} 字节 · sha256 {hash}',
+  'settings.extensionInfoUnknown': '扩展包信息不可用',
   'settings.verifyExtension': '校验服务器副本',
   'settings.verifyBusy': '校验中…',
   'settings.verifyMatch': '一致：服务器上的 zip 与本地这份逐字节相同（sha256 {hash}）',
   'settings.verifyMismatch': '不一致：服务器那份与本地不同，请重新上传 {hash}',
   'settings.verifyUnverified': '无法校验：{reason}',
-  'settings.installHint': '在嘉立创EDA专业版中：扩展 → 导入 → 选择下载的 zip → 在扩展列表开启本扩展的「允许外部交互」。',
+  'settings.installHint': '点下载会从下载服务器取回与本插件线协议一致的 zip（发送前校验 sha256，不一致则拒绝发送）；在嘉立创EDA专业版中：扩展 → 导入 → 选择该 zip → 在扩展列表开启本扩展的「允许外部交互」。',
 } as const
 
 export const en = {
@@ -66,12 +69,15 @@ export const en = {
   'settings.reconnectFailed': 'Reconnect failed',
   'settings.portLabel': 'Bridge WebSocket port: 39009 (fixed)',
   'settings.downloadExtension': 'Download JLCEDA extension zip',
+  'settings.downloadExtensionVersioned': 'Download JLCEDA extension zip v{version}',
+  'settings.extensionInfo': 'Bundled v{version} · {bytes} bytes · sha256 {hash}',
+  'settings.extensionInfoUnknown': 'Extension package info unavailable',
   'settings.verifyExtension': 'Verify server copy',
   'settings.verifyBusy': 'Verifying…',
   'settings.verifyMatch': 'Match: the served zip is byte-identical to the local one (sha256 {hash})',
   'settings.verifyMismatch': 'Mismatch: the served zip differs — re-upload {hash}',
   'settings.verifyUnverified': 'Could not verify: {reason}',
-  'settings.installHint': 'In JLCEDA Pro: Extensions → Import → select the downloaded zip → enable "Allow external interactions" for this extension.',
+  'settings.installHint': 'Download fetches the zip whose wire version matches this plugin from the download server (sha256 is verified before the file is sent; a mismatch is refused). Then in JLCEDA Pro: Extensions → Import → select that zip → enable "Allow external interactions".',
 } as const
 
 export type EdaMcpKey = keyof typeof zh

package/src/index.ts

@@ -166,21 +166,6 @@ function resolveExtensionVersion(): string {
   }
 }
 
-function resolveExtensionZipPath(): string {
-  const plain = fileURLToPath(new URL('../dsh-eda-bridge-extension.zip', import.meta.url))
-  try {
-    const manifest = JSON.parse(readFileSync(fileURLToPath(new URL('../jlc-extension/extension.json', import.meta.url)), 'utf8')) as { version?: string }
-    const version = typeof manifest.version === 'string' ? manifest.version : ''
-    if (version !== '') {
-      const versioned = fileURLToPath(new URL('../dsh-eda-bridge-extension-' + version + '.zip', import.meta.url))
-      if (existsSync(versioned)) return versioned
-    }
-  } catch {
-    // Bundle-only installs may lack the manifest; the plain name is the fallback.
-  }
-  return plain
-}
-
 /** Bridge script path, resolved once. */
 const BRIDGE_PATH = fileURLToPath(BRIDGE_URL)
 
@@ -300,7 +285,7 @@ let current: () => EdaMcpConfig = () => unwrapConfig(config ?? {})
   ctx.effect(() => {
     const disposers = makeEdaMcpRoutes({
       getConfig: () => current(),
-      extensionZipPath: resolveExtensionZipPath(),
+      extensionDigestPath: fileURLToPath(new URL('../lib/extension-digest.json', import.meta.url)),
       extensionVersion: resolveExtensionVersion(),
       extensionDownloadBase: process.env.DSH_EDA_EXTENSION_BASE ?? 'http://159.75.130.207/eda/',
       reconnect: remountClient,

package/src/routes.ts

@@ -34,6 +34,7 @@ export const EDA_MCP_API = {
   reconnect: '/api/dsh-eda-mcp/reconnect',
   extensionZip: '/api/dsh-eda-mcp/extension.zip',
   extensionVerify: '/api/dsh-eda-mcp/extension/verify',
+  extensionInfo: '/api/dsh-eda-mcp/extension/info',
   diagnostics: '/api/dsh-eda-mcp/diagnostics',
   selfTest: '/api/dsh-eda-mcp/self-test',
   settingsDescribe: '/api/dsh-eda-mcp/settings/describe',
@@ -88,7 +89,7 @@ function toView(descriptor: SettingsBridgeView): unknown {
 
 export interface EdaMcpRouteDeps {
   getConfig: () => EdaMcpConfig
-  extensionZipPath: string
+  extensionDigestPath: string
   /** Wire version of the bundled extension zip (from jlc-extension/extension.json). */
   extensionVersion: string
   /** Base URL of the download server; override with DSH_EDA_EXTENSION_BASE. */
@@ -185,62 +186,120 @@ export function makeEdaMcpRoutes(deps: EdaMcpRouteDeps): WebRoute[] {
     },
   }
 
-  // The card serves the LOCAL copy on purpose: it works offline and cannot be throttled.
-  // The digest travels with it, and a separate verify route compares it with the served copy
-  // so "is this the same artifact?" has an answer without downloading twice by hand.
+  // The package ships no zip any more (only lib/extension-digest.json), so the card downloads
+  // from the download server. Every served copy is compared against the build-recorded digest
+  // first: a different wire version is refused rather than handed to the user, and a 429 is
+  // reported as throttling instead of looking like a broken artifact.
+  const readExtensionDigest = async (): Promise<{ version: string; file: string; bytes: number; sha256: string } | null> => {
+    try {
+      const parsed = JSON.parse(await readFile(deps.extensionDigestPath, 'utf8')) as {
+        version?: string; file?: string; bytes?: number; sha256?: string
+      }
+      if (typeof parsed.version !== 'string' || typeof parsed.sha256 !== 'string' || typeof parsed.file !== 'string') return null
+      return { version: parsed.version, file: parsed.file, bytes: Number(parsed.bytes ?? 0), sha256: parsed.sha256 }
+    } catch {
+      return null
+    }
+  }
+
   const extensionZip: WebRoute = {
     kind: 'exact',
     path: EDA_MCP_API.extensionZip,
     handler: async (req, res): Promise<void> => {
       if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
       if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: 'forbidden' })
-      let bytes: Buffer
+      const digest = await readExtensionDigest()
+      if (digest === null) {
+        return json(res, 503, { ok: false, error: 'lib/extension-digest.json is missing; run the build before installing the plugin' })
+      }
+      const requested = new URL(req.url ?? '/', 'http://127.0.0.1').searchParams.get('source')
+      const url = extensionDownloadUrl(deps.extensionDownloadBase, digest.version)
+      let response: Response
       try {
-        bytes = await readFile(deps.extensionZipPath)
-      } catch {
-        return json(res, 404, { ok: false, error: 'extension zip missing next to the plugin' })
+        response = await fetch(url, { signal: AbortSignal.timeout(30000) })
+      } catch (error) {
+        return json(res, 502, {
+          ok: false,
+          error: 'could not reach the download server: ' + (error instanceof Error ? error.message : String(error)),
+          url,
+        })
+      }
+      if (!response.ok) {
+        const throttled = response.status === 429
+        return json(res, throttled ? 429 : 502, {
+          ok: false,
+          httpStatus: response.status,
+          url,
+          error: throttled
+            ? 'the download server throttled this IP (5 downloads/min per IP). Wait about a minute and click download again.'
+            : 'the download server answered HTTP ' + response.status,
+        })
+      }
+      const bytes = Buffer.from(new Uint8Array(await response.arrayBuffer()))
+      const servedSha256 = sha256Of(bytes)
+      const verdict = compareDigest(digest.sha256, servedSha256)
+      if (verdict !== 'match') {
+        return json(res, 502, {
+          ok: false,
+          url,
+          verified: verdict,
+          expected: { version: digest.version, sha256: digest.sha256, bytes: digest.bytes },
+          served: { sha256: servedSha256, bytes: bytes.byteLength },
+          error: 'the served zip is not the build this plugin ships (wire version ' + digest.version + '); '
+            + 'refusing to hand out a different version. Re-upload ' + digest.file + ' to the download server.',
+        })
       }
       res.writeHead(200, {
         'content-type': 'application/zip',
-        // Keep the versioned file name the browser saves it as.
-        'content-disposition': 'attachment; filename="' + basename(deps.extensionZipPath) + '"',
+        'content-disposition': 'attachment; filename="' + digest.file + '"',
         'cache-control': 'no-store',
-        'x-extension-version': deps.extensionVersion,
-        'x-extension-sha256': sha256Of(bytes),
         'content-length': String(bytes.byteLength),
+        'x-extension-source': 'server',
+        'x-extension-version': digest.version,
+        'x-extension-sha256': servedSha256,
+        ...(requested === 'local' ? { 'x-extension-note': 'source=local requested; the served copy was verified and used' } : {}),
       })
       res.end(bytes)
     },
   }
 
+  const extensionInfo: WebRoute = {
+    kind: 'exact',
+    path: EDA_MCP_API.extensionInfo,
+    handler: async (req, res): Promise<void> => {
+      if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+      if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: 'forbidden' })
+      const digest = await readExtensionDigest()
+      if (digest === null) return json(res, 503, { ok: false, error: 'lib/extension-digest.json is missing' })
+      json(res, 200, {
+        version: digest.version,
+        file: digest.file,
+        bytes: digest.bytes,
+        sha256: digest.sha256,
+        downloadPath: EDA_MCP_API.extensionZip,
+        serverUrl: extensionDownloadUrl(deps.extensionDownloadBase, digest.version),
+        source: 'server',
+      })
+    },
+  }
+
   const extensionVerify: WebRoute = {
     kind: 'exact',
     path: EDA_MCP_API.extensionVerify,
     handler: async (req, res): Promise<void> => {
       if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
       if (!isLoopbackRequest(req)) return json(res, 403, { ok: false, error: 'forbidden' })
-      let localBytes: Buffer
-      try {
-        localBytes = await readFile(deps.extensionZipPath)
-      } catch {
-        return json(res, 404, { ok: false, error: 'extension zip missing next to the plugin' })
-      }
-      const localSha256 = sha256Of(localBytes)
-      const url = extensionDownloadUrl(deps.extensionDownloadBase, deps.extensionVersion)
-      const report: Record<string, unknown> = {
-        version: deps.extensionVersion,
-        file: basename(deps.extensionZipPath),
-        local: { bytes: localBytes.byteLength, sha256: localSha256 },
-        url,
-      }
+      const digest = await readExtensionDigest()
+      if (digest === null) return json(res, 503, { ok: false, error: 'lib/extension-digest.json is missing' })
+      const url = extensionDownloadUrl(deps.extensionDownloadBase, digest.version)
+      const report = { version: digest.version, file: digest.file, expected: { bytes: digest.bytes, sha256: digest.sha256 }, url }
       let response: Response
       try {
-        response = await fetch(url, { signal: AbortSignal.timeout(20000) })
+        response = await fetch(url, { signal: AbortSignal.timeout(30000) })
       } catch (error) {
         return json(res, 200, { ...report, verified: 'unverified', error: 'download failed: ' + (error instanceof Error ? error.message : String(error)) })
       }
       if (!response.ok) {
-        // 429 = the server throttles an IP to 5 downloads/min; that is not a checksum problem.
         return json(res, 200, {
           ...report,
           verified: 'unverified',
@@ -250,17 +309,16 @@ export function makeEdaMcpRoutes(deps: EdaMcpRouteDeps): WebRoute[] {
             : 'download failed: HTTP ' + response.status,
         })
       }
-      const remoteBytes = new Uint8Array(await response.arrayBuffer())
-      const remoteSha256 = sha256Of(remoteBytes)
+      const servedBytes = new Uint8Array(await response.arrayBuffer())
+      const servedSha256 = sha256Of(servedBytes)
       return json(res, 200, {
         ...report,
-        remote: { bytes: remoteBytes.byteLength, sha256: remoteSha256 },
-        verified: compareDigest(localSha256, remoteSha256),
+        served: { bytes: servedBytes.byteLength, sha256: servedSha256 },
+        verified: compareDigest(digest.sha256, servedSha256),
       })
     },
   }
-
-  return [test, reconnect, extensionZip, extensionVerify, diagnostics, selfTest]
+  return [test, reconnect, extensionZip, extensionInfo, extensionVerify, diagnostics, selfTest]
 }
 
 export function makeEdaMcpSettingsRoutes(settings: SettingsBridge): WebRoute[] {

package/src/skills-content.ts

@@ -300,7 +300,7 @@ export const SKILL_PLAYBOOK_LINES: readonly string[] = [
   "- 版本纪律：扩展线协议**只递增最小位**（`0.4.1 → 0.4.2`），每次改动必须同时改 `jlc-extension/extension.json` 的 `version` 与桥接的 `VERSION`；不一致时 `eda_status.versionMismatch` 为 true。",
   "- 新会话开工顺序：`eda_status`（连没连、版本对不对）→ 本技能（怎么干）→ 再动手；不要先假设环境就绪。",
   "| 需要扩展 zip（换机器/给别人） | 不清楚该给哪一份 | `eda_extension_package` 报路径+sha256；`download:true` 从服务器取回并逐字节比对（`verified`），一致才落盘 |",
-  "- 扩展 zip 位置：`node_modules/dsh-eda-mcp/dsh-eda-bridge-extension-<版本>.zip`，或设置卡片下载（文件名自带版本号）。",
+  "- 扩展 zip 位置：**发布包不再自带 zip**（只有 `lib/extension-digest.json`）。用设置卡片的下载按钮或 `eda_extension_package({download:true})` 从下载服务器取回，插件会用清单 sha256 校验后才落盘；服务器那份对不上时会被拒绝，需要先重新上传。",
   "- 排查顺序：`eda_status` → `/api/dsh-eda-mcp/diagnostics`（`clientStartupError` / `skills` / `bridgeHealth`）→ `eda_list_api_methods`（白名单）→ 应用侧 DRC 面板。",
 ]
 

package/test/extension-routes.test.ts

@@ -1,34 +1,40 @@
 import { strict as assert } from 'node:assert'
 import { createServer } from 'node:http'
-import { readFileSync } from 'node:fs'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { makeEdaMcpRoutes, EDA_MCP_API } from '../src/routes.ts'
 import { sha256Of } from '../src/bridge/extension-package.ts'
 
-const zipPath = 'dsh-eda-bridge-extension-0.4.9.zip'
-const localBytes = readFileSync(zipPath)
-const localSha = sha256Of(localBytes)
+// The package ships no zip: only lib/extension-digest.json. These cases pin the contract that
+// the download route serves the SERVER copy but only after it matches the build digest.
+const goodBytes = Buffer.from('PK\x03\x04 pretending to be the extension zip')
+const goodSha = sha256Of(goodBytes)
+const digestDir = mkdtempSync(join(tmpdir(), 'dsh-digest-'))
+const digestPath = join(digestDir, 'extension-digest.json')
+writeFileSync(digestPath, JSON.stringify({
+  version: '0.4.9',
+  file: 'dsh-eda-bridge-extension-0.4.9.zip',
+  bytes: goodBytes.byteLength,
+  sha256: goodSha,
+}))
 
-// Minimal IncomingMessage/ServerResponse doubles: the handlers only use method, socket,
-// url, writeHead, end and (for errors) destroy.
-function fakeReq(method: string) {
-  return { method, url: '/', socket: { remoteAddress: '127.0.0.1' }, headers: { host: '127.0.0.1' } }
+function fakeReq(method: string, url = '/') {
+  return { method, url, socket: { remoteAddress: '127.0.0.1' }, headers: { host: '127.0.0.1' } }
 }
 function fakeRes() {
   const captured: { status?: number; headers?: Record<string, string>; body?: unknown; bytes?: Buffer } = {}
   const res = {
     writeHead(status: number, headers: Record<string, string>) { captured.status = status; captured.headers = headers; return res },
     end(payload?: unknown) { if (Buffer.isBuffer(payload)) captured.bytes = payload; else if (typeof payload === 'string') captured.body = payload; return res },
-    destroy() { return res },
-    getHeader() { return undefined },
-    setHeader() { return res },
+    destroy() { return res }, getHeader() { return undefined }, setHeader() { return res },
   }
   return { res, captured }
 }
-
 function deps(base: string) {
   return {
     getConfig: () => ({}),
-    extensionZipPath: zipPath,
+    extensionDigestPath: digestPath,
     extensionVersion: '0.4.9',
     extensionDownloadBase: base,
     reconnect: () => {},
@@ -38,13 +44,11 @@ function deps(base: string) {
     selfTest: async () => ({}),
   }
 }
-
 function routeOf(routes: ReturnType<typeof makeEdaMcpRoutes>, path: string) {
   const route = routes.find(r => r.path === path)
   assert.ok(route, 'route ' + path + ' must exist')
   return route
 }
-
 async function withServer(handler: Parameters<typeof createServer>[1], run: (base: string) => Promise<void>) {
   const server = createServer(handler)
   await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
@@ -52,44 +56,61 @@ async function withServer(handler: Parameters<typeof createServer>[1], run: (bas
   try { await run('http://127.0.0.1:' + port + '/eda/') } finally { await new Promise<void>(resolve => server.close(() => resolve())) }
 }
 
-// 1. the zip route stamps the digest it is handing out
-{
-  const routes = makeEdaMcpRoutes(deps('http://127.0.0.1:1/eda/'))
+// 1. matching served copy -> handed out, labelled as coming from the server
+await withServer((_req, res) => { res.writeHead(200); res.end(goodBytes) }, async (base) => {
   const { res, captured } = fakeRes()
-  await routeOf(routes, EDA_MCP_API.extensionZip).handler(fakeReq('GET') as never, res as never)
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionZip).handler(fakeReq('GET') as never, res as never)
   assert.equal(captured.status, 200)
-  assert.equal(captured.headers?.['x-extension-sha256'], localSha, 'digest header must describe the bytes served')
-  assert.equal(captured.headers?.['content-length'], String(localBytes.byteLength))
-  assert.equal(captured.headers?.['content-disposition']?.includes(zipPath), true, 'versioned file name is kept')
-  assert.equal(sha256Of(captured.bytes as Buffer), localSha, 'served bytes are the local zip')
-}
+  assert.equal(captured.headers?.['x-extension-source'], 'server')
+  assert.equal(captured.headers?.['x-extension-sha256'], goodSha)
+  assert.equal(captured.headers?.['content-disposition'], 'attachment; filename="dsh-eda-bridge-extension-0.4.9.zip"')
+  assert.equal(sha256Of(captured.bytes as Buffer), goodSha, 'the bytes handed out are the served ones')
+})
 
-// 2. identical remote copy -> match
-await withServer((_req, res) => { res.writeHead(200, { 'content-type': 'application/zip' }); res.end(localBytes) }, async (base) => {
+// 2. different wire version served -> refused, nothing downloaded
+await withServer((_req, res) => { res.writeHead(200); res.end(Buffer.from('some other build')) }, async (base) => {
   const { res, captured } = fakeRes()
-  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionZip).handler(fakeReq('GET') as never, res as never)
   const body = JSON.parse(String(captured.body))
-  assert.equal(body.verified, 'match', 'identical bytes verify')
-  assert.equal(body.local.sha256, localSha)
-  assert.equal(body.remote.sha256, localSha)
+  assert.equal(captured.status, 502)
+  assert.equal(body.expected.sha256, goodSha)
+  assert.equal(String(body.error).includes('refusing'), true)
+  assert.equal(captured.bytes, undefined, 'no bytes may be handed out on mismatch')
 })
 
-// 3. different remote copy -> mismatch (never silently equal)
-await withServer((_req, res) => { res.writeHead(200); res.end(Buffer.from('different bytes')) }, async (base) => {
+// 3. throttled server -> 429 surfaced as throttling
+await withServer((_req, res) => { res.writeHead(429); res.end('slow down') }, async (base) => {
+  const { res, captured } = fakeRes()
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionZip).handler(fakeReq('GET') as never, res as never)
+  const body = JSON.parse(String(captured.body))
+  assert.equal(captured.status, 429)
+  assert.equal(body.httpStatus, 429)
+  assert.equal(String(body.error).includes('throttled'), true)
+})
+
+// 4. verify route compares against the digest without any local zip
+await withServer((_req, res) => { res.writeHead(200); res.end(goodBytes) }, async (base) => {
+  const { res, captured } = fakeRes()
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  const body = JSON.parse(String(captured.body))
+  assert.equal(body.verified, 'match')
+  assert.equal(body.expected.sha256, goodSha)
+})
+await withServer((_req, res) => { res.writeHead(200); res.end(Buffer.from('other')) }, async (base) => {
   const { res, captured } = fakeRes()
   await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
   const body = JSON.parse(String(captured.body))
   assert.equal(body.verified, 'mismatch')
 })
 
-// 4. throttled remote copy -> unverified + status, not a mismatch
-await withServer((_req, res) => { res.writeHead(429, { 'content-type': 'text/plain' }); res.end('slow down') }, async (base) => {
+// 5. info route needs no network and reports the build digest
+await withServer((_req, res) => { res.writeHead(500); res.end('must not be called') }, async (base) => {
   const { res, captured } = fakeRes()
-  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionVerify).handler(fakeReq('GET') as never, res as never)
+  await routeOf(makeEdaMcpRoutes(deps(base)), EDA_MCP_API.extensionInfo).handler(fakeReq('GET') as never, res as never)
   const body = JSON.parse(String(captured.body))
-  assert.equal(body.verified, 'unverified', '429 is throttling, not a checksum mismatch')
-  assert.equal(body.httpStatus, 429)
-  assert.equal(String(body.error).includes('429'), true)
+  assert.equal(body.version, '0.4.9')
+  assert.equal(body.sha256, goodSha)
+  assert.equal(body.source, 'server')
 })
 
 console.log('ALL PASS extension-routes')