dsh-mcp-connector 0.2.23 → 0.2.25

package/CHANGELOG.md

@@ -4,6 +4,35 @@
 
 ## [Unreleased]
 
+## [0.2.25] - 2026-08-27
+
+### Added
+
+- 新增 Update Provider 适配层，将版本发现与安装执行解耦；UI 通过统一能力调用更新检查、任务、回滚和重启，为 DSH 原生或其他插件市场预留适配边界。
+- 首个 DSH Market API v1 Provider 适配器：能力探测通过后可一键更新插件，并轮询展示安装进度、稳定失败码、兼容回滚结果及按 Web/Desktop 宿主能力提供的刷新或重启操作。
+
+### Compatibility
+
+- Provider 未安装、协议不兼容、广告跨源/无效端点或版本检查不一致时不调用私有更新路由，继续使用现有“前往插件市场”/npm 页面降级路径。
+
+### Verification
+
+- 125 项自动测试、lint、npm 发布包白名单/敏感内容扫描通过；已在 web profile 的 dshmarket 1.33.0 上验证 `/dsh-market/api/v1/capabilities` 与 Connector 版本检查响应。
+
+## [0.2.24] - 2026-08-27
+
+### Added
+
+- MCP连接器标题显示当前插件版本，并由服务端缓存检查 npm `latest` 与 GitHub Release；发现新版本时引导用户前往 DSH 插件市场安全更新。
+
+### Changed
+
+- 市场页原“刷新”按钮改为“刷新连接器目录”，明确该操作仅更新 Registry 卡片，不会升级插件本身。
+
+### Verification
+
+- 123 项自动测试、lint、npm 发布包白名单/敏感内容扫描和 npm/GitHub 真实版本源验收通过。
+
 ## [0.2.23] - 2026-08-26
 
 ### Fixed
@@ -385,7 +414,9 @@
 - 外部 URL 与导入 Header 执行安全校验。
 - iframe 消息校验同源和消息来源。
 
-[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.23...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.25...HEAD
+[0.2.25]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.24...v0.2.25
+[0.2.24]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.23...v0.2.24
 [0.2.23]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.22...v0.2.23
 [0.2.22]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.21...v0.2.22
 [0.2.21]: https://github.com/duhu2000/dsh-mcp-connector/compare/v0.2.20...v0.2.21

package/README.en.md

@@ -28,6 +28,7 @@ Browse and install MCP connectors from different providers in DeepSeek Harness D
 - Persistent connection lifecycle management: restore on restart, enable/disable, disconnect, retry transient OAuth refresh failures with bounded backoff, and revoke authorization. Cards declaring issuer-level sharing reuse one grant; DCR client secrets remain local to that grant.
 - Built-in, remote, and local catalogs with `published` and `featured` controls.
 - A standalone remote Registry, allowing new marketplace cards to appear after refresh without publishing a new npm version.
+- Plugin version and one-click updates: version discovery is independent of the installation source, while an Update Provider adapter layer negotiates safe mutation capabilities. DSH Market API v1 is the first adapter and supports progress, normalized failures, rollback, and capability-gated restart/refresh actions; without a compatible provider, the UI falls back to the current plugin marketplace or npm.
 - Explicit, non-destructive migration from the two earlier Qichacha OAuth plugins, plus active-plugin conflict detection that blocks duplicate server management and credential overwrites.
 
 <!-- catalog-stats:start -->
@@ -111,7 +112,7 @@ npm run dev:ui
 
 Every Registry merge regenerates `catalog-stats.json`; an hourly workflow in this repository synchronizes the Chinese and English product copy plus a local stats snapshot. The static npm README updates with package releases, while the live badges above read the Registry directly and therefore stay current without another npm release.
 
-The current public version is [`dsh-mcp-connector@0.2.22`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.22](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.22).
+The current public version is [`dsh-mcp-connector@0.2.24`](https://www.npmjs.com/package/dsh-mcp-connector), with [GitHub Release v0.2.24](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.24).
 
 See [CHANGELOG.md](CHANGELOG.md) for version history and [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md) for the Desktop release checklist.
 

package/README.md

@@ -28,6 +28,7 @@
 - 生命周期管理：连接持久化、重启恢复、启停、断开、OAuth 自动刷新/退避恢复与撤销；同 issuer 卡片可共享一次授权，DCR 返回的客户端密钥与 Token 一同只保存在本机。
 - 目录运营：内置目录、远程 registry、本地覆盖，支持 `published` 上下架与 `featured` 精选。
 - 独立远程 Registry：新市场卡片合并后客户端刷新即可见，无需重新发布 npm；远程不可用时自动回退内置目录。
+- 插件版本与一键更新：版本发现独立于安装来源；页面通过 Update Provider 适配层探测安全更新能力。DSH Market API v1 是首个适配器，支持进度、稳定失败码、回滚及按宿主能力提供的重启/刷新操作；无可用 Provider 时回退到当前插件市场或 npm。
 - Registry 工具链：Schema/唯一性/密钥审计、MCP/OAuth 无凭据探针、每周健康巡检。
 - 平滑迁移：显式扫描并复制两个旧企查查 OAuth 插件授权；检测到旧插件仍启用并管理同名 Server 时阻断重复连接，避免凭据相互覆盖。
 - 对话工具：`mcp_connector_catalog`、`connect`、`configure`、`import_json`、`install_from_url`、`status`、`health_check`、`set_enabled`、`disconnect`、`refresh_catalog`、`publish`、`tools_list`。
@@ -106,7 +107,7 @@ npm run dev:ui
 
 公共 Registry 每次合并后会生成 `catalog-stats.json`；本仓库的定时工作流每小时同步中英文介绍和统计快照。npm 页面中的静态正文随版本发布更新，上方动态统计徽标则直接读取 Registry，可在不发布新 npm 版本时保持实时数量一致。
 
-当前公开版本为 [`dsh-mcp-connector@0.2.22`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.22](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.22)。
+当前公开版本为 [`dsh-mcp-connector@0.2.24`](https://www.npmjs.com/package/dsh-mcp-connector)，对应 [GitHub Release v0.2.24](https://github.com/duhu2000/dsh-mcp-connector/releases/tag/v0.2.24)。
 
 版本能力与变更记录见 [CHANGELOG.md](CHANGELOG.md)。
 Desktop 发版回归见 [docs/DESKTOP-E2E.md](docs/DESKTOP-E2E.md)。

package/docs/PLUGIN-UPDATE.md

@@ -0,0 +1,34 @@
+# MCP连接器插件更新协议
+
+MCP连接器把“刷新连接器目录”和“升级插件代码”视为两个独立动作：前者只重新拉取 Registry 卡片，后者必须由当前 DSH 宿主中可用的安全 Update Provider 执行。
+
+## 分层与 Provider 适配
+
+版本发现与更新执行彻底分离：
+
+- MCP连接器自己的 Host 检查 npm `latest` 与 GitHub Release，所有安装方式都可显示已安装版本和新版本提示。
+- 客户端通过 `UPDATE_PROVIDER_ADAPTERS` 按顺序探测 Provider。UI 只调用统一的 `probe` / `check` / `start` / `operation` / `rollback` / `restart` 能力，不持有市场私有路由。
+- DSH Market API v1 是首个 Provider 适配器。后续可在不改动更新 UI 状态机的前提下增加 DSH 原生能力或其他插件市场的版本化协议适配器。
+
+## 能力协商
+
+每个 Provider 适配器只硬编码自己的 capabilities 入口，其余更新、任务、回滚和重启端点均从能力响应中读取。客户端只接受当前 DSH 页面的相对同源端点，拒绝跨域 URL、协议不匹配、缺少必要端点或未声明 `features.update` 的 Provider。
+
+DSH Market 适配器从 `GET /dsh-market/api/v1/capabilities` 开始，要求 `schema: dsh-market/update-api/v1` 与 `apiVersion: 1`。未安装任何可用 Provider、接口返回 404、协议不兼容或检查失败时，页面不会尝试私有更新路由，而是回退到“前往插件市场”；设置入口不可用时再打开 npm 包页面。
+
+## 更新流程
+
+1. 插件自己的服务端缓存检查 npm `latest` 与 GitHub Release，只在 npm 已有可安装新版本时提示升级。
+2. 选中的 Provider 再检查本 profile 中 `dsh-mcp-connector` 的实际安装版本和目标版本。
+3. 用户点击“一键更新”后，Provider 立即返回 `operationId`；页面通过适配器轮询任务状态，展示排队、解析、下载和安装进度。
+4. 成功后按 Provider 返回的激活结论展示“刷新生效”或重启提示。Web 且 Provider 明确允许进程重启时才展示“立即重启”；Desktop 等由外壳管理生命周期的宿主只提示用户重启，不自行杀进程。
+5. Provider 保留恢复点时展示“回滚”。回滚仍由 Provider 执行，MCP连接器不直接修改 profile、lockfile 或 `node_modules`。
+
+失败结果使用稳定代码区分正在运行的 Agent、其他安装任务占用、镜像同步、版本未变化、超时和权限拒绝。可重试失败保留重试操作；Registry 刚发布但镜像仍未同步时，用户可在看到明确提示后选择强制重试。
+
+## 安全边界
+
+- 所有变更请求均为浏览器同源 POST，并继续接受 Provider 自身的 Origin、环回地址和运行中任务保护。
+- MCP连接器不执行 `npm`/`pnpm`、不保存回滚 Token，也不复制任何 Provider 的安装算法。
+- 重启按钮完全服从能力响应；接口未声明支持时不得构造其他进程控制路径。
+- 更新任务属于当前 Host 进程。Host 已更换后，旧页面的任务编号自然失效，避免把旧进度误认为新进程状态。

package/docs/USER-GUIDE.md

@@ -42,7 +42,8 @@ dsh web
 - **已安装**：查看已经保存到本机的连接，页签徽标显示连接数。
 - **搜索**：按名称、服务商、简介和标签查找。
 - **添加连接**：导入 JSON、手动配置 HTTP/stdio，或从市场描述 URL 安装。
-- **刷新**：重新拉取目录，并更新连接健康状态。
+- **版本与更新提示**：标题旁显示当前插件版本，版本检查不依赖安装所用的插件市场。检测到 npm 有新版本且当前宿主存在兼容 Update Provider 时，可在当前页面一键更新并查看进度、失败原因和可用回滚。DSH Market API v1 是当前首个 Provider；无可用 Provider 时自动回退为“前往插件市场”或 npm 页面。
+- **刷新连接器目录**：重新拉取 Registry 卡片，并更新连接健康状态；该操作不会升级 MCP连接器插件本身。
 
 ## 3. 浏览市场与分类
 
@@ -64,7 +65,7 @@ dsh web
 | `配置` | 需要 Bearer Token 或 API Key | 录入服务商签发的凭据并验证 |
 | `需重新授权` | OAuth 授权过期、被撤销或不可用 | 点击后重新完成 OAuth 授权 |
 | `自动重试中` | OAuth Token 刷新遇到网络或服务端暂时故障 | 无需重新授权；保持 DSH 运行，插件会按退避策略自动恢复 |
-| `已配置` | 本机已有配置，尚未完成本轮健康确认 | 点击“刷新”或进入详情检查 |
+| `已配置` | 本机已有配置，尚未完成本轮健康确认 | 点击“刷新连接器目录”或进入详情检查 |
 | `已连接` | 最近一次健康检查通过 | 可直接在会话中使用对应 MCP 工具 |
 | `部分异常` / `连接异常` | 一个或多个 Server 未通过检查 | 打开详情查看提示，核对网络、权限和服务状态 |
 
@@ -140,7 +141,7 @@ stdio 进程由 `@deepseek-ai/dsh-mcp-client` 管理，插件透传 `command`、
 - 执行健康检查；
 - 断开连接并删除该连接的本机配置。
 
-OAuth 断开时，插件会尽力调用服务商的撤销端点；无撤销端点时仍会删除 DSH 本机授权记录。连接状态发生变化后，可点击“刷新”重新检查。
+OAuth 断开时，插件会尽力调用服务商的撤销端点；无撤销端点时仍会删除 DSH 本机授权记录。连接状态发生变化后，可点击“刷新连接器目录”重新检查。
 
 ## 8. 安全边界
 
@@ -160,7 +161,7 @@ OAuth 断开时，插件会尽力调用服务商的撤销端点；无撤销端
 
 ### 市场里没有最新卡片
 
-点击“刷新”。如果远程 Registry 暂时不可用，页面会继续显示缓存或内置目录；稍后恢复网络再刷新即可。
+点击“刷新连接器目录”。如果远程 Registry 暂时不可用，页面会继续显示缓存或内置目录；稍后恢复网络再刷新即可。
 
 ### Token/API Key 一直验证失败
 

package/lib/client.js

@@ -19,6 +19,20 @@ window.__ModuleLoader__.load({
 		];
 		const PROMPT_REQUEST_TYPE = "mcp-connector:start-session";
 		const PROMPT_RESULT_TYPE = "mcp-connector:start-session-result";
+		const VERSION_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1e3;
+		const VERSION_CHECK_RETRY_MS = 5 * 60 * 1e3;
+		const NPM_PACKAGE_URL = "https://www.npmjs.com/package/dsh-mcp-connector";
+		const PLUGIN_PACKAGE_NAME = "dsh-mcp-connector";
+		const UPDATE_PROVIDER_OPERATION_POLL_MS = 1e3;
+		const UPDATE_PROVIDER_ADAPTERS = Object.freeze([
+			createHttpUpdateProviderAdapter({
+				id: "dsh-market-v1",
+				label: "DSH Market",
+				schema: "dsh-market/update-api/v1",
+				apiVersion: 1,
+				capabilitiesUrl: "/dsh-market/api/v1/capabilities"
+			})
+		]);
 
 		/**
 		 * Desktop 内置的社区插件市场也注册在 sidebar.footer.action。
@@ -86,6 +100,62 @@ window.__ModuleLoader__.load({
 .mcpConnectorMarketPanel { background: #ffffff; color: #111827; }
 .mcpConnectorMarketHeader { border-color: #e5e7eb; }
 .mcpConnectorMarketTitle { color: #111827; }
+.mcpConnectorVersion {
+	color: #6b7280;
+	background: #f3f4f6;
+	border-radius: 999px;
+	padding: 2px 8px;
+	font-size: 12px;
+	font-weight: 600;
+}
+.mcpConnectorUpdateButton {
+	color: #4338ca;
+	background: #eef2ff;
+	border: 1px solid #c7d2fe;
+	border-radius: 8px;
+	padding: 5px 9px;
+	font: inherit;
+	font-size: 12px;
+	font-weight: 600;
+	cursor: pointer;
+}
+.mcpConnectorUpdateButton:hover,
+.mcpConnectorUpdateButton:focus-visible {
+	background: #e0e7ff;
+	outline: 2px solid #6366f1;
+	outline-offset: 1px;
+}
+.mcpConnectorUpdateButton:disabled {
+	opacity: 0.65;
+	cursor: wait;
+}
+.mcpConnectorUpdateControls {
+	display: flex;
+	align-items: center;
+	gap: 6px;
+	min-width: 0;
+}
+.mcpConnectorUpdateStatus {
+	max-width: 240px;
+	overflow: hidden;
+	text-overflow: ellipsis;
+	white-space: nowrap;
+	color: #166534;
+	background: #f0fdf4;
+	border-radius: 999px;
+	padding: 3px 8px;
+	font-size: 12px;
+	font-weight: 600;
+}
+.mcpConnectorUpdateStatus[data-tone="error"] {
+	color: #b91c1c;
+	background: #fef2f2;
+}
+.mcpConnectorUpdateSecondary {
+	color: #4b5563;
+	background: transparent;
+	border-color: #d1d5db;
+}
 .mcpConnectorMarketClose { color: #6b7280; }
 .mcpConnectorMarketClose:hover,
 .mcpConnectorMarketClose:focus-visible {
@@ -99,6 +169,13 @@ window.__ModuleLoader__.load({
 	.mcpConnectorMarketPanel { background: #1b1e25; color: #f3f4f6; }
 	.mcpConnectorMarketHeader { border-color: #30343d; }
 	.mcpConnectorMarketTitle { color: #f3f4f6; }
+	.mcpConnectorVersion { color: #d1d5db; background: #30343d; }
+	.mcpConnectorUpdateButton { color: #c7d2fe; background: #312e81; border-color: #4f46e5; }
+	.mcpConnectorUpdateButton:hover,
+	.mcpConnectorUpdateButton:focus-visible { background: #3730a3; }
+	.mcpConnectorUpdateStatus { color: #bbf7d0; background: #14532d; }
+	.mcpConnectorUpdateStatus[data-tone="error"] { color: #fecaca; background: #7f1d1d; }
+	.mcpConnectorUpdateSecondary { color: #d1d5db; background: transparent; border-color: #4b5563; }
 	.mcpConnectorMarketClose { color: #c4c8d0; }
 	.mcpConnectorMarketClose:hover,
 	.mcpConnectorMarketClose:focus-visible { background: #30343d !important; color: #ffffff; }
@@ -135,6 +212,195 @@ window.__ModuleLoader__.load({
 			return mount;
 		}
 
+		async function fetchVersionStatus() {
+			const response = await window.fetch("/mcp-connector/api", {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ method: "versionStatus", params: {} })
+			});
+			const result = await response.json();
+			if (!response.ok || result.ok !== true || result.detail === void 0) {
+				throw new Error(result.message ?? `HTTP ${response.status}`);
+			}
+			return result.detail;
+		}
+
+		/**
+		 * 更新 Provider 只能广告当前 DSH 页面的同源端点。这个边界既避免
+		 * Connector 跨域传递安装指令，也使后续市场适配器可复用同一客户端。
+		 */
+		function sameOriginProviderEndpoint(value) {
+			if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return null;
+			try {
+				const url = new URL(value, window.location.origin);
+				if (url.origin !== window.location.origin || url.search !== "" || url.hash !== "") return null;
+				return url.pathname;
+			} catch {
+				return null;
+			}
+		}
+
+		/**
+		 * 把一个版本化的同源 HTTP 更新协议适配为 Connector 内部通用能力。
+		 * UI 不接触供应商路由或响应封装；新市场只需新增适配器。
+		 */
+		function createHttpUpdateProviderAdapter(options) {
+			const { id, label, schema, apiVersion, capabilitiesUrl } = options;
+			async function readResponse(response) {
+				let result;
+				try {
+					result = await response.json();
+				} catch {
+					result = null;
+				}
+				if (!response.ok) {
+					const error = new Error(result?.error ?? result?.failure?.message ?? `HTTP ${response.status}`);
+					error.code = result?.failure?.code ?? `HTTP_${response.status}`;
+					error.retryable = result?.failure?.retryable === true;
+					throw error;
+				}
+				if (result?.schema !== schema) throw new Error(`${label} 更新接口版本不兼容`);
+				return result;
+			}
+
+			async function post(path, body) {
+				return readResponse(await window.fetch(path, {
+					method: "POST",
+					headers: { accept: "application/json", "content-type": "application/json" },
+					body: JSON.stringify(body)
+				}));
+			}
+
+			return Object.freeze({
+				id,
+				label,
+				async probe() {
+					const response = await window.fetch(capabilitiesUrl, { headers: { accept: "application/json" } });
+					if (response.status === 404) return null;
+					const result = await readResponse(response);
+					if (result.apiVersion !== apiVersion || result.features?.update !== true) return null;
+					const endpoints = {
+						updates: sameOriginProviderEndpoint(result.endpoints?.updates),
+						operations: sameOriginProviderEndpoint(result.endpoints?.operations),
+						rollback: sameOriginProviderEndpoint(result.endpoints?.rollback),
+						restart: sameOriginProviderEndpoint(result.endpoints?.restart)
+					};
+					if (endpoints.updates === null || endpoints.operations === null) return null;
+					if (result.features?.rollback === true && endpoints.rollback === null) return null;
+					if (result.restart?.supported === true && endpoints.restart === null) return null;
+					return {
+						providerId: id,
+						providerLabel: label,
+						runtime: result.runtime,
+						features: result.features,
+						restart: result.restart,
+						endpoints
+					};
+				},
+				async check(capabilities, packageName, force = false) {
+					const query = new URLSearchParams({ name: packageName });
+					if (force) query.set("force", "1");
+					const result = await readResponse(await window.fetch(`${capabilities.endpoints.updates}?${query}`, {
+						headers: { accept: "application/json" }
+					}));
+					return result.package;
+				},
+				async start(capabilities, packageName, force = false) {
+					const result = await post(capabilities.endpoints.updates, {
+						packageName,
+						...(force ? { force: true } : {})
+					});
+					if (typeof result.operation?.operationId !== "string") {
+						throw new Error(`${label} 未返回更新任务编号`);
+					}
+					return result.operation;
+				},
+				async operation(capabilities, operationId) {
+					const query = new URLSearchParams({ operationId });
+					const result = await readResponse(await window.fetch(`${capabilities.endpoints.operations}?${query}`, {
+						headers: { accept: "application/json" }
+					}));
+					return result.operation;
+				},
+				async rollback(capabilities, operationId) {
+					if (capabilities.endpoints.rollback === null) throw new Error(`${label} 不支持回滚`);
+					const result = await post(capabilities.endpoints.rollback, { operationId });
+					return result.operation;
+				},
+				async restart(capabilities) {
+					if (capabilities.endpoints.restart === null) throw new Error(`${label} 不支持重启`);
+					return post(capabilities.endpoints.restart, {});
+				}
+			});
+		}
+
+		async function discoverUpdateProvider(packageName, force = false) {
+			for (const provider of UPDATE_PROVIDER_ADAPTERS) {
+				try {
+					const capabilities = await provider.probe();
+					if (capabilities === null) continue;
+					const update = await provider.check(capabilities, packageName, force);
+					return { provider, capabilities, update };
+				} catch (error) {
+					console.warn(`[mcp-connector] ${provider.id} update provider unavailable:`, error);
+				}
+			}
+			return null;
+		}
+
+		function updateProgressLabel(operation) {
+			if (operation?.state === "queued") return "更新任务排队中…";
+			const percent = operation?.progress?.percent;
+			if (typeof percent === "number") return `正在更新 ${percent}%`;
+			const phase = operation?.progress?.phase;
+			if (typeof phase === "string" && phase !== "") return `正在更新：${phase}`;
+			return "正在更新…";
+		}
+
+		function updateFailureLabel(failure) {
+			const labels = {
+				AGENTS_RUNNING: "有任务正在运行，请结束后重试",
+				OPERATION_BUSY: "插件市场正在处理其他任务",
+				RELEASE_TOO_FRESH: "新版本仍在镜像同步",
+				VERSION_UNCHANGED: "下载后版本未变化",
+				UPDATE_TIMEOUT: "更新超时",
+				UPDATE_FORBIDDEN: "更新请求被拒绝",
+				UPDATE_REJECTED: "无法执行本次更新"
+			};
+			return labels[failure?.code] ?? failure?.message ?? "更新失败";
+		}
+
+		/**
+		 * DSH 暂未公开“打开指定设置分区”服务：只依赖稳定的 sidebar.settings
+		 * slot 和可访问文本打开插件市场，不依赖构建生成的 CSS 类名。
+		 */
+		function openDshPluginMarket(actions) {
+			const settingsHost = document.querySelector('[data-slot="sidebar.settings"]');
+			const settingsTrigger = settingsHost?.querySelector?.('button[aria-haspopup="dialog"]');
+			if (settingsTrigger === null || settingsTrigger === void 0) {
+				window.open(NPM_PACKAGE_URL, "_blank", "noopener,noreferrer");
+				return;
+			}
+			actions.close();
+			window.setTimeout(() => {
+				settingsTrigger.click();
+				let attempts = 0;
+				const selectMarket = () => {
+					const marketButton = [...document.querySelectorAll('[role="dialog"] nav button')].find((button) => {
+						const label = button.textContent?.trim() ?? "";
+						return /^(\u63d2\u4ef6\u5e02\u573a|Plugin Market|Plugin Marketplace)$/i.test(label);
+					});
+					if (marketButton !== void 0) {
+						marketButton.click();
+						return;
+					}
+					attempts += 1;
+					if (attempts < 20) window.setTimeout(selectMarket, 50);
+				};
+				window.requestAnimationFrame(selectMarket);
+			}, 0);
+		}
+
 		/** 创建弹框 store（使用 DSH defineStore，与社区插件市场一致）。 */
 		function createMarketViewStore() {
 			return (0, _deepseek_ai_dsh_client_runtime_client.defineStore)({
@@ -181,6 +447,15 @@ window.__ModuleLoader__.load({
 			const { wide, useStore, actions, startPromptSession: launchPromptSession } = props;
 			const open = useStore((state) => state.open);
 			const detailOpen = useStore((state) => state.detailOpen);
+			const [versionStatus, setVersionStatus] = (0, react.useState)(null);
+			const [updateProviderState, setUpdateProviderState] = (0, react.useState)("checking");
+			const [updateProviderSelection, setUpdateProviderSelection] = (0, react.useState)(null);
+			const [providerUpdateCheck, setProviderUpdateCheck] = (0, react.useState)(null);
+			const [updateOperation, setUpdateOperation] = (0, react.useState)(null);
+			const [updateError, setUpdateError] = (0, react.useState)(null);
+			const [updateStarting, setUpdateStarting] = (0, react.useState)(false);
+			const [rollbackRunning, setRollbackRunning] = (0, react.useState)(false);
+			const [restarting, setRestarting] = (0, react.useState)(false);
 			const frameRef = (0, react.useRef)(null);
 			const closeRef = (0, react.useRef)(null);
 			(0, react.useEffect)(() => {
@@ -219,6 +494,97 @@ window.__ModuleLoader__.load({
 				window.addEventListener("message", onMessage);
 				return () => { window.removeEventListener("message", onMessage); };
 			}, [actions, launchPromptSession]);
+			(0, react.useEffect)(() => {
+				if (!open) return void 0;
+				let disposed = false;
+				let pollTimer;
+				const schedule = (delayMs) => {
+					window.clearTimeout(pollTimer);
+					pollTimer = window.setTimeout(check, Math.max(1e3, delayMs));
+				};
+				const check = () => {
+					fetchVersionStatus().then((status) => {
+						if (disposed) return;
+						setVersionStatus(status);
+						if (status.checking) {
+							schedule(1e3);
+							return;
+						}
+						const nextCheckAt = Date.parse(status.nextCheckAt ?? "");
+						const delay = Number.isFinite(nextCheckAt)
+							? Math.min(VERSION_CHECK_INTERVAL_MS, nextCheckAt - Date.now())
+							: VERSION_CHECK_INTERVAL_MS;
+						schedule(delay);
+					}, (error) => {
+						console.warn("[mcp-connector] plugin update check failed:", error);
+						if (!disposed) schedule(VERSION_CHECK_RETRY_MS);
+					});
+				};
+				check();
+				return () => {
+					disposed = true;
+					window.clearTimeout(pollTimer);
+				};
+			}, [open]);
+			(0, react.useEffect)(() => {
+				if (!open) return void 0;
+				let disposed = false;
+				setUpdateProviderState("checking");
+				discoverUpdateProvider(PLUGIN_PACKAGE_NAME, true).then((selection) => {
+					if (disposed) return;
+					if (selection === null) {
+						setUpdateProviderSelection(null);
+						setProviderUpdateCheck(null);
+						setUpdateProviderState("unavailable");
+						return;
+					}
+					setUpdateProviderSelection(selection);
+					setProviderUpdateCheck(selection.update);
+					setUpdateProviderState("ready");
+				}).catch((error) => {
+					console.warn("[mcp-connector] update provider discovery failed:", error);
+					if (disposed) return;
+					setUpdateProviderSelection(null);
+					setProviderUpdateCheck(null);
+					setUpdateProviderState("unavailable");
+				});
+				return () => { disposed = true; };
+			}, [open]);
+			(0, react.useEffect)(() => {
+				const operationId = updateOperation?.operationId;
+				const provider = updateProviderSelection?.provider;
+				const capabilities = updateProviderSelection?.capabilities;
+				if (!open || provider === void 0 || capabilities === void 0
+					|| typeof operationId !== "string" || !["queued", "running"].includes(updateOperation.state)) {
+					return void 0;
+				}
+				let disposed = false;
+				let timer;
+				const poll = () => {
+					provider.operation(capabilities, operationId).then((operation) => {
+						if (disposed) return;
+						setUpdateError(null);
+						setUpdateOperation(operation);
+						if (["queued", "running"].includes(operation.state)) {
+							timer = window.setTimeout(poll, UPDATE_PROVIDER_OPERATION_POLL_MS);
+							return;
+						}
+						if (operation.state === "succeeded") {
+							provider.check(capabilities, PLUGIN_PACKAGE_NAME, true).then(setProviderUpdateCheck, () => {});
+						}
+					}, (error) => {
+						console.warn("[mcp-connector] update operation polling failed:", error);
+						if (disposed) return;
+						setUpdateError(error instanceof Error ? error.message : String(error));
+						timer = window.setTimeout(poll, UPDATE_PROVIDER_OPERATION_POLL_MS * 2);
+					});
+				};
+				timer = window.setTimeout(poll, UPDATE_PROVIDER_OPERATION_POLL_MS);
+				return () => {
+					disposed = true;
+					window.clearTimeout(timer);
+				};
+			}, [open, updateOperation?.operationId, updateProviderSelection?.provider?.id]);
 			(0, react.useEffect)(() => {
 				if (!open) return void 0;
 				closeRef.current?.focus?.();
@@ -227,6 +593,201 @@ window.__ModuleLoader__.load({
 				return () => { window.removeEventListener("keydown", onKeyDown); };
 			}, [open, actions]);
 			if (!open) return null;
+			const updateRunning = updateStarting || updateOperation !== null && ["queued", "running"].includes(updateOperation.state);
+			const startUpdate = (force = false) => {
+				const provider = updateProviderSelection?.provider;
+				const capabilities = updateProviderSelection?.capabilities;
+				if (updateRunning || provider === void 0 || capabilities === void 0) return;
+				setUpdateError(null);
+				setUpdateStarting(true);
+				provider.start(capabilities, PLUGIN_PACKAGE_NAME, force).then((operation) => {
+					setUpdateStarting(false);
+					setUpdateOperation(operation);
+				}, (error) => {
+					console.error("[mcp-connector] update start failed:", error);
+					setUpdateStarting(false);
+					if (error?.retryable === true) {
+						setUpdateOperation({
+							state: "failed",
+							failure: {
+								code: error.code ?? "UPDATE_FAILED",
+								message: error instanceof Error ? error.message : String(error),
+								retryable: true
+							},
+							outcome: { rollback: { available: false, state: "unavailable" } }
+						});
+					} else {
+						setUpdateError(error instanceof Error ? error.message : String(error));
+					}
+				});
+			};
+			const rollbackUpdate = () => {
+				const provider = updateProviderSelection?.provider;
+				const capabilities = updateProviderSelection?.capabilities;
+				if (rollbackRunning || provider === void 0 || capabilities === void 0
+					|| typeof updateOperation?.operationId !== "string") return;
+				setUpdateError(null);
+				setRollbackRunning(true);
+				provider.rollback(capabilities, updateOperation.operationId).then((operation) => {
+					setRollbackRunning(false);
+					setUpdateOperation(operation);
+				}, (error) => {
+					console.error("[mcp-connector] rollback failed:", error);
+					setRollbackRunning(false);
+					setUpdateError(error instanceof Error ? error.message : String(error));
+				});
+			};
+			const restartHost = () => {
+				const provider = updateProviderSelection?.provider;
+				const capabilities = updateProviderSelection?.capabilities;
+				if (restarting || provider === void 0 || capabilities === void 0) return;
+				setRestarting(true);
+				setUpdateError(null);
+				provider.restart(capabilities).catch((error) => {
+					console.error("[mcp-connector] restart failed:", error);
+					setRestarting(false);
+					setUpdateError(error instanceof Error ? error.message : String(error));
+				});
+			};
+			const renderUpdateControls = () => {
+				if (!versionStatus?.updateAvailable && updateOperation === null && updateError === null) return null;
+				if (updateRunning) {
+					return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "mcpConnectorUpdateControls",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "mcpConnectorUpdateButton",
+								disabled: true,
+								children: updateStarting ? "正在启动更新…" : updateProgressLabel(updateOperation)
+							}),
+							updateError !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "mcpConnectorUpdateStatus",
+								"data-tone": "error",
+								title: updateError,
+								children: "暂时无法读取进度，正在重试"
+							})
+						]
+					});
+				}
+				if (updateOperation?.state === "failed") {
+					const force = ["RELEASE_TOO_FRESH", "VERSION_UNCHANGED"].includes(updateOperation.failure?.code);
+					return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "mcpConnectorUpdateControls",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "mcpConnectorUpdateStatus",
+								"data-tone": "error",
+								title: updateOperation.failure?.message ?? "更新失败",
+								children: updateFailureLabel(updateOperation.failure)
+							}),
+							updateOperation.failure?.retryable && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "mcpConnectorUpdateButton",
+								onClick: () => startUpdate(force),
+								children: force ? "强制重试" : "重试更新"
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "mcpConnectorUpdateButton mcpConnectorUpdateSecondary",
+								onClick: () => openDshPluginMarket(actions),
+								children: "打开插件市场"
+							})
+						]
+					});
+				}
+				if (["succeeded", "rolled-back"].includes(updateOperation?.state)) {
+					const rolledBack = updateOperation.state === "rolled-back";
+					const restartRequired = updateOperation.outcome?.restartRequired === true;
+					const refreshRequired = updateOperation.outcome?.refreshRequired === true;
+					const rollbackFailed = updateOperation.outcome?.rollback?.state === "failed";
+					return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "mcpConnectorUpdateControls",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "mcpConnectorUpdateStatus",
+								children: rolledBack
+									? "已回滚"
+									: `已安装 v${updateOperation.installedVersion ?? versionStatus?.latestVersion}`
+							}),
+							rollbackFailed && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "mcpConnectorUpdateStatus",
+								"data-tone": "error",
+								title: updateOperation.outcome.rollback.detail ?? "回滚失败",
+								children: "回滚失败"
+							}),
+						restartRequired && updateProviderSelection?.capabilities?.restart?.supported === true && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "mcpConnectorUpdateButton",
+								disabled: restarting,
+								onClick: restartHost,
+								children: restarting ? "正在重启…" : "立即重启"
+							}),
+						restartRequired && updateProviderSelection?.capabilities?.restart?.supported !== true && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "mcpConnectorUpdateStatus",
+							title: `重启由 ${updateProviderSelection?.capabilities?.restart?.managedBy ?? "宿主"} 管理`,
+							children: updateProviderSelection?.capabilities?.runtime === "desktop" ? "请重启 DSH Desktop" : "请重启 DSH"
+							}),
+							!restartRequired && refreshRequired && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "mcpConnectorUpdateButton",
+								onClick: () => window.location.reload(),
+								children: "刷新生效"
+							}),
+							updateOperation.outcome?.rollback?.available === true && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "mcpConnectorUpdateButton mcpConnectorUpdateSecondary",
+								disabled: rollbackRunning,
+								onClick: rollbackUpdate,
+								children: rollbackRunning ? "正在回滚…" : rollbackFailed ? "重试回滚" : "回滚"
+							})
+						]
+					});
+				}
+				if (updateError !== null) {
+					return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "mcpConnectorUpdateControls",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "mcpConnectorUpdateStatus",
+								"data-tone": "error",
+								title: updateError,
+								children: "更新服务调用失败"
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "mcpConnectorUpdateButton mcpConnectorUpdateSecondary",
+								onClick: () => openDshPluginMarket(actions),
+								children: "打开插件市场"
+							})
+						]
+					});
+				}
+				if (updateProviderState === "checking") {
+					return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: "mcpConnectorUpdateButton",
+						disabled: true,
+						children: "正在准备更新…"
+					});
+				}
+				if (updateProviderState === "ready" && providerUpdateCheck?.updateAvailable === true) {
+					return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: "mcpConnectorUpdateButton",
+						title: `由 ${updateProviderSelection?.provider?.label ?? "更新服务"} 安全更新到 v${providerUpdateCheck.latestVersion}`,
+						onClick: () => startUpdate(false),
+						children: `一键更新到 v${providerUpdateCheck.latestVersion}`
+					});
+				}
+				return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+					type: "button",
+					className: "mcpConnectorUpdateButton",
+					title: `npm 已发布 v${versionStatus?.latestVersion}`,
+					onClick: () => openDshPluginMarket(actions),
+					children: `前往插件市场更新到 v${versionStatus?.latestVersion}`
+				});
+			};
 			const src = window.location.origin + "/mcp-connector/ui/";
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				style: {
@@ -270,10 +831,21 @@ window.__ModuleLoader__.load({
 								},
 								children: [
 									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										style: { display: "flex", alignItems: "center", gap: 10 },
+									style: { display: "flex", alignItems: "center", gap: 10, flexWrap: "wrap", minWidth: 0, flex: 1 },
 										children: [
 											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { style: { fontSize: 22 }, children: "\u{1F9E9}" }),
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { id: "mcp-connector-market-title", className: "mcpConnectorMarketTitle", style: { fontSize: 18, fontWeight: 600 }, children: "MCP连接器" })
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { id: "mcp-connector-market-title", className: "mcpConnectorMarketTitle", style: { fontSize: 18, fontWeight: 600 }, children: "MCP连接器" }),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "mcpConnectorVersion",
+												title: versionStatus === null ? "正在检查插件版本" : `当前版本 v${versionStatus.installedVersion}`,
+												children: versionStatus === null ? "v…" : `v${versionStatus.installedVersion}`
+											}),
+											renderUpdateControls(),
+											versionStatus?.releasePending && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "mcpConnectorVersion",
+												title: "GitHub Release 已发布，等待 npm 同步后即可更新",
+												children: `v${versionStatus.release.version} 正在同步`
+											})
 										]
 									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {

package/lib/index.js

@@ -33,6 +33,7 @@ import { classifyConnectionError, validateConnectionRecords } from './mcp-valida
 import { listMcpTools, McpHttpError } from './mcp-http.js';
 import { registerTools } from './tools.js';
 import { mountWebRoutes } from './web.js';
+import { createVersionStatusService } from './version-status.js';
 import { assertSafeUrl } from './util.js';
 import { readLegacyGrantCandidates, planLegacyMigration, toConnectorGrant, toConnectionRecords } from './migration.js';
 import { classifyRefreshFailure, refreshRetryDelay } from './grant-lifecycle.js';
@@ -83,6 +84,10 @@ export const Config = z.object({
 
 export async function apply(ctx, config) {
   const logger = ctx.logger('mcp-connector');
+  const versionStatusService = createVersionStatusService({
+    timeoutMs: config.requestTimeoutMs,
+    logger,
+  });
 
   const domain = await ctx.storageDomain.open(defineConnectorDomain());
   ctx.effect(() => () => {
@@ -856,6 +861,17 @@ export async function apply(ctx, config) {
   /* ───────────────────────── api 门面 ───────────────────────── */
 
   const api = {
+    async versionStatus(force = false) {
+      const detail = versionStatusService.status({ force });
+      let message = `当前版本 v${detail.installedVersion}`;
+      if (detail.checking) message += '，正在检查更新';
+      else if (detail.updateAvailable) message += `，可更新到 v${detail.latestVersion}`;
+      else if (detail.releasePending) message += '，新版本正在同步到 npm';
+      else if (detail.status === 'unavailable') message += '，暂时无法检查更新';
+      else message += '，已是 npm 最新版';
+      return { ok: true, message, detail };
+    },
+
     async catalog({ category, keyword } = {}) {
       const items = listCatalog(state.merged, { category, keyword, publishedOnly: true }).map((d) => {
         const health = connectorHealth(d.id);
@@ -1640,6 +1656,7 @@ export async function apply(ctx, config) {
   ctx.effect(() => () => {
     disposeTools();
     disposeWeb?.();
+    versionStatusService.dispose();
     for (const g of state.grants.values()) if (g.timer) clearTimeout(g.timer);
   });
 

package/lib/version-status.js

@@ -0,0 +1,216 @@
+import { readFileSync } from 'node:fs';
+
+const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+
+export const INSTALLED_PLUGIN_VERSION = packageJson.version;
+export const NPM_LATEST_URL = 'https://registry.npmjs.org/dsh-mcp-connector/latest';
+export const NPM_PACKAGE_URL = 'https://www.npmjs.com/package/dsh-mcp-connector';
+export const GITHUB_LATEST_RELEASE_URL = 'https://api.github.com/repos/duhu2000/dsh-mcp-connector/releases/latest';
+export const GITHUB_RELEASES_URL = 'https://github.com/duhu2000/dsh-mcp-connector/releases';
+export const VERSION_CHECK_TTL_MS = 6 * 60 * 60 * 1000;
+export const VERSION_CHECK_FAILURE_TTL_MS = 5 * 60 * 1000;
+
+function normalizeVersion(value) {
+  if (typeof value !== 'string') return undefined;
+  const normalized = value.trim().replace(/^v/i, '');
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(normalized)
+    ? normalized
+    : undefined;
+}
+
+function parseVersion(value) {
+  const normalized = normalizeVersion(value);
+  if (!normalized) return undefined;
+  const [withoutBuild] = normalized.split('+');
+  const [core, prerelease] = withoutBuild.split('-', 2);
+  return {
+    normalized,
+    core: core.split('.').map(Number),
+    prerelease: prerelease?.split('.') ?? [],
+  };
+}
+
+/** Compare two semantic versions. Returns a positive number when `left` is newer. */
+export function compareVersions(left, right) {
+  const a = parseVersion(left);
+  const b = parseVersion(right);
+  if (!a || !b) return 0;
+  for (let index = 0; index < 3; index += 1) {
+    if (a.core[index] !== b.core[index]) return a.core[index] - b.core[index];
+  }
+  if (a.prerelease.length === 0 && b.prerelease.length > 0) return 1;
+  if (a.prerelease.length > 0 && b.prerelease.length === 0) return -1;
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const aPart = a.prerelease[index];
+    const bPart = b.prerelease[index];
+    if (aPart === undefined) return -1;
+    if (bPart === undefined) return 1;
+    if (aPart === bPart) continue;
+    const aNumeric = /^\d+$/.test(aPart);
+    const bNumeric = /^\d+$/.test(bPart);
+    if (aNumeric && bNumeric) return Number(aPart) - Number(bPart);
+    if (aNumeric) return -1;
+    if (bNumeric) return 1;
+    return aPart.localeCompare(bPart);
+  }
+  return 0;
+}
+
+export function isVersionNewer(candidate, installed) {
+  return compareVersions(candidate, installed) > 0;
+}
+
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+async function fetchJson(fetchImpl, url, { timeoutMs, headers, activeControllers }) {
+  const controller = new AbortController();
+  activeControllers.add(controller);
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, {
+      method: 'GET',
+      headers: {
+        accept: 'application/json',
+        'user-agent': `dsh-mcp-connector/${INSTALLED_PLUGIN_VERSION}`,
+        ...headers,
+      },
+      signal: controller.signal,
+    });
+    if (!response?.ok) throw new Error(`HTTP ${response?.status ?? 'unknown'}`);
+    return await response.json();
+  } finally {
+    clearTimeout(timer);
+    activeControllers.delete(controller);
+  }
+}
+
+/**
+ * Check npm and GitHub without exposing those origins to the iframe CSP.
+ * npm `latest` is the update authority; GitHub is supplemental release metadata.
+ */
+export function createVersionStatusService({
+  installedVersion = INSTALLED_PLUGIN_VERSION,
+  fetchImpl = globalThis.fetch,
+  timeoutMs = 15_000,
+  cacheTtlMs = VERSION_CHECK_TTL_MS,
+  failureTtlMs = VERSION_CHECK_FAILURE_TTL_MS,
+  now = () => Date.now(),
+  logger,
+} = {}) {
+  let cached;
+  let expiresAt = 0;
+  let inFlight;
+  const activeControllers = new Set();
+
+  async function query() {
+    const checkedAtMs = now();
+    const [npmResult, githubResult] = await Promise.allSettled([
+      fetchJson(fetchImpl, NPM_LATEST_URL, { timeoutMs, activeControllers }),
+      fetchJson(fetchImpl, GITHUB_LATEST_RELEASE_URL, {
+        timeoutMs,
+        activeControllers,
+        headers: { accept: 'application/vnd.github+json' },
+      }),
+    ]);
+
+    const npmVersion = npmResult.status === 'fulfilled' ? normalizeVersion(npmResult.value?.version) : undefined;
+    const githubVersion = githubResult.status === 'fulfilled' ? normalizeVersion(githubResult.value?.tag_name) : undefined;
+    const npmOk = npmVersion !== undefined;
+    const githubOk = githubVersion !== undefined;
+    const errors = [];
+    if (!npmOk) errors.push(`npm: ${npmResult.status === 'rejected' ? errorMessage(npmResult.reason) : '返回了无效版本'}`);
+    if (!githubOk) errors.push(`GitHub: ${githubResult.status === 'rejected' ? errorMessage(githubResult.reason) : '返回了无效版本'}`);
+    if (errors.length > 0) logger?.warn?.(`plugin update check partial failure: ${errors.join('; ')}`);
+
+    const updateAvailable = npmOk && isVersionNewer(npmVersion, installedVersion);
+    const releasePending = githubOk && isVersionNewer(githubVersion, installedVersion)
+      && (!npmOk || isVersionNewer(githubVersion, npmVersion));
+    const status = npmOk && githubOk ? 'ok' : (npmOk || githubOk ? 'partial' : 'unavailable');
+    // npm is authoritative for an actionable update. A GitHub-only failure must not
+    // turn into a five-minute retry loop against the unauthenticated GitHub API.
+    const resultTtlMs = npmOk ? cacheTtlMs : failureTtlMs;
+    const result = {
+      installedVersion,
+      latestVersion: npmVersion ?? null,
+      updateAvailable,
+      releasePending,
+      checking: false,
+      status,
+      checkedAt: new Date(checkedAtMs).toISOString(),
+      nextCheckAt: new Date(checkedAtMs + resultTtlMs).toISOString(),
+      npmPackageUrl: NPM_PACKAGE_URL,
+      releasesUrl: GITHUB_RELEASES_URL,
+      release: githubOk ? {
+        version: githubVersion,
+        tagName: githubResult.value.tag_name,
+        url: typeof githubResult.value.html_url === 'string' ? githubResult.value.html_url : GITHUB_RELEASES_URL,
+        publishedAt: githubResult.value.published_at ?? null,
+      } : null,
+      sources: {
+        npm: npmOk ? { ok: true, version: npmVersion } : { ok: false },
+        github: githubOk ? { ok: true, version: githubVersion } : { ok: false },
+      },
+    };
+    expiresAt = checkedAtMs + resultTtlMs;
+    cached = result;
+    return result;
+  }
+
+  async function check({ force = false } = {}) {
+    if (!force && cached && now() < expiresAt) return cached;
+    if (inFlight) return inFlight;
+    if (typeof fetchImpl !== 'function') {
+      cached = {
+        installedVersion,
+        latestVersion: null,
+        updateAvailable: false,
+        releasePending: false,
+        checking: false,
+        status: 'unavailable',
+        checkedAt: new Date(now()).toISOString(),
+        nextCheckAt: new Date(now() + failureTtlMs).toISOString(),
+        npmPackageUrl: NPM_PACKAGE_URL,
+        releasesUrl: GITHUB_RELEASES_URL,
+        release: null,
+        sources: { npm: { ok: false }, github: { ok: false } },
+      };
+      expiresAt = now() + failureTtlMs;
+      return cached;
+    }
+    inFlight = query().finally(() => { inFlight = undefined; });
+    return inFlight;
+  }
+
+  function status({ force = false } = {}) {
+    const stale = !cached || now() >= expiresAt;
+    if ((force || stale) && !inFlight) {
+      void check({ force: true }).catch((error) => {
+        logger?.warn?.(`plugin update check failed: ${errorMessage(error)}`);
+      });
+    }
+    const current = cached ?? {
+      installedVersion,
+      latestVersion: null,
+      updateAvailable: false,
+      releasePending: false,
+      status: 'checking',
+      checkedAt: null,
+      nextCheckAt: null,
+      npmPackageUrl: NPM_PACKAGE_URL,
+      releasesUrl: GITHUB_RELEASES_URL,
+      release: null,
+      sources: { npm: { ok: false }, github: { ok: false } },
+    };
+    return { ...current, checking: inFlight !== undefined };
+  }
+
+  function dispose() {
+    for (const controller of activeControllers) controller.abort();
+    activeControllers.clear();
+  }
+
+  return { status, check, dispose };
+}

package/lib/web.js

@@ -17,6 +17,7 @@ const UI_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'ui');
 
 /** GET /mcp-connector/api 允许调度的方法 → api 门面（白名单，杜绝任意反射调用）。 */
 const API_WHITELIST = new Map([
+  ['versionStatus', (api, p) => api.versionStatus(p?.force === true)],
   ['catalog', (api, p) => api.catalog(p ?? {})],
   ['status', (api) => api.status()],
   ['healthCheck', (api, p) => api.healthCheck(p?.connectorId)],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mcp-connector",
-  "version": "0.2.23",
+  "version": "0.2.25",
   "description": "General-purpose MCP connector, connection manager, plugin extension, and integration marketplace for DeepSeek Harness, initiated and maintained by Qichacha/QCC.",
   "type": "module",
   "main": "lib/index.js",
@@ -19,6 +19,7 @@
     "registry",
     "docs/DESKTOP-E2E.md",
     "docs/MARKET-REGISTRATION.md",
+    "docs/PLUGIN-UPDATE.md",
     "docs/STDIO-SUPPORT.md",
     "docs/USER-GUIDE.md",
     "cordis.patch.yml",
@@ -33,7 +34,7 @@
   ],
   "scripts": {
     "test": "node --test",
-    "lint": "node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/sync-registry-stats.mjs",
+    "lint": "node --check lib/index.js && node --check lib/web.js && node --check lib/client.js && node --check lib/version-status.js && node --check lib/schema.js && node --check lib/catalog.js && node --check lib/prompts.js && node --check lib/probe.js && node --check lib/mcp-validation.js && node --check lib/mcp-http.js && node --check lib/migration.js && node --check lib/stores.js && node --check lib/oauth.js && node --check lib/grant-lifecycle.js && node --check lib/callback-server.js && node --check lib/mcp-provision.js && node --check lib/util.js && node --check lib/constants.js && node --check lib/tools.js && node --check lib/connectors/oauth-connector.js && node --check lib/connectors/manual-connector.js && node --check lib/connectors/json-connector.js && node --check scripts/probe-connector.mjs && node --check scripts/build-registry.mjs && node --check scripts/ui-harness.mjs && node --check scripts/check-market-registration.mjs && node --check scripts/sync-registry-stats.mjs",
     "registry:build": "node scripts/build-registry.mjs",
     "registry:validate": "node scripts/probe-connector.mjs catalog/catalog.json --validate-only",
     "dev:ui": "node scripts/ui-harness.mjs",

package/ui/index.html

@@ -400,7 +400,7 @@
       <input id="search" type="text" placeholder="搜索连接器…" />
     </div>
     <button class="icon-btn primary" id="add-connection" type="button">＋ 添加连接</button>
-    <button class="icon-btn" id="refresh">刷新</button>
+    <button class="icon-btn" id="refresh" title="刷新连接器目录">刷新连接器目录</button>
     <div class="market-nav" id="market-nav" aria-label="市场分类导航"></div>
   </header>
   <main id="main"></main>