dsh-multi-router 0.3.8 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 本项目遵循 [语义化版本](https://semver.org/lang/zh-CN/)。版本号从 `0.1` 起以功能迭代为主，接口在 `1.0` 前可能变化。
 
+## 0.4.0
+
+- 首次启用自动获取并保存 WorkBuddy / Trae 本机登录，首页明确显示检测与保存结果，增加一键重试和下一步引导。
+- 内置所有已安装插件的更新面板：npm 版本 / 频道、GitHub 分支提交检查，支持其它插件、停用插件、搜索筛选与批量更新。
+- 通过 DSH 官方安装服务执行更新和新插件安装，保留启用状态，提供取消、失败提示、npm 来源选择及重启引导。
+- 同时存在 npm / pnpm 锁文件时读取最近更新的锁文件；固定 Git 提交不解除，npm 安装完成后核验实际版本。
+
+
 ## 0.3.8
 
 - 恢复 WorkBuddy / Trae 本机登录自动获取：启动、每分钟检测，以及手动刷新均会扫描；沿用原插件的 WorkBuddy 多路径和加密格式读取器，Trae 自动识别 CN / Global / SOLO。

package/README.md

@@ -6,7 +6,7 @@
 
 一个插件内置 WorkBuddy、Trae、Qoder 的认证、模型发现和聊天传输，提供三家的多账号池及集中路由。运行不依赖原来三个 DSH 插件；三家代码随安装包一起打包。基于 MIT 上游，固定版本见 `upstream-lock.json`，许可见 `THIRD_PARTY_NOTICES.md`。
 
-版本：0.3.8。适配 DSH Desktop / Web 0.2.0-rc.2，Node.js ^22.19.0 或 >=24。
+版本：0.4.0。适配 DSH Desktop / Web 0.2.0-rc.2，Node.js ^22.19.0 或 >=24。
 
 ## 在 DSH 里管理
 
@@ -89,9 +89,59 @@ Qoder 的 `dfmodel` 在真实目录里显示为 DeepSeek-Flash，未声明具体
 
 账号获取采用官方客户端已有登录文件的只读解析，不修改客户端登录、不复制参考项目代码、不自动签到。手动凭证支持 WorkBuddy / Trae 字段表单、三家凭证 JSON 和 Qoder PAT；凭证格式、区域、Trae 设备身份会校验。已有账号可在详情中「补充 / 更新凭证」，旧副本保留。Qoder 普通网页 Cookie 无法替代 PAT；官方 PAT 指引见 https://docs.qoder.com/cli/authentication 。
 
+## 首次使用与账号自动获取
+
+第一次启用插件时会执行 WorkBuddy / WorkBuddy AI 与 Trae CN / Global / SOLO 的本机登录检测，将找到的有效登录保存为独立账号副本。首页会展示「本机账号自动获取」结果，区分已保存、未登录和无法读取，并提供「一键获取并保存」及手动添加入口；无需先逐个点击添加账号。之后每分钟检测新增登录，重复检测不重复添加，已停用和已删除的账号保持用户选择。Qoder 仍需添加 PAT。
+
+## 所有已安装插件的更新与安装
+
+在本插件配置面板打开 **插件更新**，管理当前 DSH 配置中的全部已安装插件，包括其它插件和已停用插件。首次打开自动检查，后续超过 24 小时重新打开时再检查，也可随时点击「检查全部更新」。
+
+- **npm 来源**：比较 SemVer，保留 `latest` / `next` 等频道；固定版本和版本范围在用户确认更新后升级到最新正式版本。查询沿用 DSH 的 registry、网络、认证与镜像回退设置。
+- **GitHub 来源**：比较原分支 / 标签的 Git 提交，版本号未变化也能发现更新。支持 `github:用户/仓库`、GitHub HTTPS / SSH 地址及锁文件中的提交；固定 Git 提交不自动解除。GitHub 查询需要能够访问仓库公开元数据，私有仓库或限流会显示原因，不会猜测最新提交。
+- 可按名称、来源和可更新状态筛选；支持单个更新、勾选批量更新、取消以及失败后重试。更新前显示目标，并保留每个插件原有启用 / 停用状态。
+- 可直接输入 npm 包名 / 指定版本，或 `github:用户/仓库` 安装新插件。实际安装由 DSH 官方插件管理服务执行兼容检查、镜像重试、配置锁及失败回滚；依赖构建脚本仍在 DSH 原安装页授权，不自动绕过。
+- 结果显示实际安装是否成功及是否需要重启。npm 镜像尚未同步、网络超时、版本不兼容会明确提示。GitHub 下载不会由 npm 镜像代替。
+- DSH 自带组件也在清单中展示，标记为随 DSH 应用升级；本地文件 / 开发链接标记为原方式更新。不同 DSH 配置之间相互独立，只操作当前配置。
+
 ## 安装
 
-### 方式一：GitHub 链接安装（首选）
+### 方式一：npm 安装（首选）
+
+在 DSH 的 **插件页 → 安装插件** 输入包名：
+
+```text
+dsh-multi-router
+```
+
+CLI 安装最新正式版：
+
+```bash
+# Desktop profile
+dsh plugin --profile desktop add dsh-multi-router
+
+# Web profile
+dsh plugin --profile web add dsh-multi-router
+```
+
+包地址：[dsh-multi-router · npm](https://www.npmjs.com/package/dsh-multi-router)。正式版本由 GitHub Release 自动测试、打包并发布到 npm `latest`，包中已包含编译产物，用户无需自行构建。需要固定版本时可安装 `dsh-multi-router@0.4.0`。
+
+已使用 npm 来源的用户更新：
+
+```bash
+dsh plugin --profile desktop update dsh-multi-router
+```
+
+原先通过 GitHub 或本地 `.tgz` 安装的用户，运行下面命令切换到 npm 正式版本：
+
+```bash
+dsh plugin --profile desktop add dsh-multi-router
+```
+
+这是同名插件的来源切换；账号、路由和用量保存在包目录之外，会保留。更新完成后**完全退出并重新打开 DeepSeek Harness**；关闭窗口或点击「刷新面板」不会重载后台。插件面板检测到前后台版本不一致时会显示重启步骤。
+
+### 方式二：GitHub 链接安装
+
 
 在 DSH 的 **插件页 → 安装插件** 输入 GitHub 仓库地址：
 
@@ -123,7 +173,7 @@ Desktop 若提示 CLI 仅安装依赖、未自动启用 bundle：完全退出 De
 
 > 首次安装请先在 DSH 中**关闭**原 WorkBuddy / Trae / Qoder 三个独立连接器（仅关闭，不必卸载，不影响其凭证），避免同名 provider 冲突。
 
-### 方式二：本地构建 / 离线包
+### 方式三：本地构建 / 离线包
 
 ```bash
 git clone https://github.com/AndroidSix/dsh-multi-router.git
@@ -131,12 +181,12 @@ cd dsh-multi-router
 npm ci
 npm run check
 npm run pack:release
-dsh plugin --profile desktop add ./dsh-multi-router-0.3.8.tgz
+dsh plugin --profile desktop add ./dsh-multi-router-0.4.0.tgz
 ```
 
 ### 配置账号
 
-安装后直接在配置面板「账号与登录」添加；也可先用 CLI：
+安装并启动插件后，已登录的 WorkBuddy / Trae 账号会自动进入账号池；Qoder PAT、多账号凭证和其它设备配置可在面板中添加或导入。也可用 CLI：
 
 ```bash
 node lib/cli.js add --id wb1 --provider workbuddy --source '/path/workbuddy-desktop.info'

package/lib/{chunk-WIDXMBQ2.js → chunk-UQS7DNOQ.js}

@@ -34,12 +34,12 @@ import {
 import { createHash, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 
 // package.json
-var version = "0.3.8";
+var version = "0.4.0";
 
 // src/manager.mjs
-import { readFile, mkdir as mkdir2, mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
+import { readFile as readFile2, mkdir as mkdir2, mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
 import { watch } from "node:fs";
-import { dirname as dirname3, join as join3, relative as relative2, resolve } from "node:path";
+import { dirname as dirname3, join as join4, relative as relative2, resolve } from "node:path";
 import { withFileLock } from "@deepseek-ai/dsh-atomic-write";
 
 // upstream/qoder/src/status-paths.ts
@@ -233,6 +233,334 @@ async function prepareMigration(manager, raw, portable, mode) {
   }
 }
 
+// src/plugin-updates.mjs
+import { readFile, stat } from "node:fs/promises";
+import { join as join3 } from "node:path";
+import { randomUUID } from "node:crypto";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import { parse as parseYaml } from "yaml";
+
+// upstream/workbuddy/src/update.ts
+var WORKBUDDY_REPOSITORY_URL = "https://github.com/corrinehu/dsh-workbuddy-connect";
+var WORKBUDDY_UPDATE_PACKAGE_NAME = "dsh-workbuddy-connect";
+var WORKBUDDY_UPDATE_NPM_METADATA_URL = `https://registry.npmjs.org/-/package/${WORKBUDDY_UPDATE_PACKAGE_NAME}/dist-tags`;
+var WORKBUDDY_UPDATE_RELEASES_API_URL = `${WORKBUDDY_REPOSITORY_URL.replace("https://github.com", "https://api.github.com/repos")}/releases?per_page=100`;
+var WORKBUDDY_RELEASE_PAGE_BASE = `${WORKBUDDY_REPOSITORY_URL}/releases/tag/`;
+var WORKBUDDY_UPDATE_MAX_METADATA_BYTES = 64 * 1024;
+var WORKBUDDY_UPDATE_MAX_RELEASES_BYTES = 1024 * 1024;
+function parseWorkBuddyVersion(raw) {
+  if (typeof raw !== "string") return void 0;
+  const normalized = raw.startsWith("v") ? raw.slice(1) : raw;
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(normalized);
+  if (match === null) return void 0;
+  const rawPrerelease = match[4] === void 0 ? [] : match[4].split(".");
+  if (rawPrerelease.some((identifier) => /^\d+$/u.test(identifier) && !/^(0|[1-9]\d*)$/u.test(identifier))) return void 0;
+  const prerelease = rawPrerelease.map((identifier) => /^(0|[1-9]\d*)$/u.test(identifier) ? Number(identifier) : identifier);
+  if (prerelease.some((identifier) => typeof identifier === "number" && !Number.isSafeInteger(identifier))) return void 0;
+  const parsed = {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease
+  };
+  return [parsed.major, parsed.minor, parsed.patch].every(Number.isSafeInteger) ? parsed : void 0;
+}
+function compareIdentifiers(left, right) {
+  if (typeof left === "number" && typeof right === "number") return left < right ? -1 : left > right ? 1 : 0;
+  if (typeof left === "number") return -1;
+  if (typeof right === "number") return 1;
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function compareWorkBuddyVersions(left, right) {
+  const a = parseWorkBuddyVersion(left);
+  const b = parseWorkBuddyVersion(right);
+  if (a === void 0 || b === void 0) throw new TypeError("invalid WorkBuddy Connect version");
+  for (const [aPart, bPart] of [[a.major, b.major], [a.minor, b.minor], [a.patch, b.patch]]) {
+    if (aPart !== bPart) return aPart < bPart ? -1 : 1;
+  }
+  if (a.prerelease.length === 0 && b.prerelease.length !== 0) return 1;
+  if (a.prerelease.length !== 0 && b.prerelease.length === 0) return -1;
+  for (let index = 0; index < Math.max(a.prerelease.length, b.prerelease.length); index += 1) {
+    const aPart = a.prerelease[index];
+    const bPart = b.prerelease[index];
+    if (aPart === void 0) return -1;
+    if (bPart === void 0) return 1;
+    const comparison = compareIdentifiers(aPart, bPart);
+    if (comparison !== 0) return comparison;
+  }
+  return 0;
+}
+
+// src/plugin-updates.mjs
+var packageName = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i;
+var safeRef = /^[a-zA-Z0-9._/-]{1,200}$/;
+function parsePluginSource(name, spec) {
+  if (!packageName.test(name) || typeof spec !== "string" || spec.length > 600 || spec.startsWith("-") || spec.trim() !== spec || /[\x00-\x1f]/.test(spec)) return { kind: "unsupported" };
+  const git = /^(?:github:|git\+https:\/\/github\.com\/|https:\/\/github\.com\/|git\+ssh:\/\/git@github\.com\/|git@github\.com:)?([\w.-]+)\/([\w.-]+?)(?:\.git)?(?:#(.+))?$/.exec(spec);
+  if (git && !spec.startsWith("@") && !spec.startsWith("file:") && !spec.startsWith("link:")) {
+    const [, owner, repo, ref] = git;
+    if (owner === "." || owner === ".." || repo === "." || repo === ".." || ref && (!safeRef.test(ref) || ref.includes(".."))) return { kind: "unsupported" };
+    return { kind: "github", owner, repo, ref, source: `github:${owner}/${repo}${ref ? "#" + ref : ""}` };
+  }
+  if (/^(?:file:|link:|workspace:|https?:|git|\/|\.)/.test(spec)) return { kind: "unsupported" };
+  const alias = /^npm:((?:@[^/]+\/)?[^@]+)(?:@(.+))?$/.exec(spec);
+  const actual = alias?.[1] ?? name, range = alias?.[2] ?? spec;
+  if (!packageName.test(actual) || !/^[a-zA-Z0-9.*^~<>=|+ -]{1,160}$/.test(range)) return { kind: "unsupported" };
+  const channel = /^[a-zA-Z][\w.-]*$/.test(range);
+  return { kind: "npm", package: actual, alias: !!alias, channel, tag: channel ? range : "latest", source: spec };
+}
+function githubCommit(value) {
+  if (typeof value !== "string") return void 0;
+  return /(?:\/tar\.gz\/|\/tarball\/|#)([a-f0-9]{40})(?:\b|\()/i.exec(value)?.[1]?.toLowerCase();
+}
+async function jsonFile(file) {
+  try {
+    return JSON.parse(await readFile(file, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function locks(dir) {
+  let pnpm;
+  try {
+    pnpm = parseYaml(await readFile(join3(dir, "pnpm-lock.yaml"), "utf8"), { maxAliasCount: 20 });
+  } catch {
+  }
+  const npm = await jsonFile(join3(dir, "package-lock.json"));
+  const times = await Promise.all(["pnpm-lock.yaml", "package-lock.json"].map((name) => stat(join3(dir, name)).then((s) => s.mtimeMs).catch(() => 0)));
+  return { pnpm, npm, preferNpm: times[1] > times[0] };
+}
+async function publicJson(url, fetchImpl, signal) {
+  const res = await fetchImpl(url, {
+    signal: AbortSignal.any([signal, AbortSignal.timeout(12e3)]),
+    headers: { Accept: "application/json", "User-Agent": "dsh-multi-router-plugin-updates" },
+    redirect: "error"
+  });
+  if (!res.ok) throw Error(res.status === 403 || res.status === 429 ? "\u8FDC\u7AEF\u9650\u6D41\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5" : res.status === 404 ? "\u4ED3\u5E93 / \u7248\u672C\u4E0D\u5B58\u5728\uFF0C\u6216\u9700\u8981\u79C1\u6709\u4ED3\u5E93\u6388\u6743" : `\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25\uFF08HTTP ${res.status}\uFF09`);
+  let size = 0, chunks = [];
+  for await (const chunk of res.body) {
+    size += chunk.byteLength;
+    if (size > 256 * 1024) throw Error("\u66F4\u65B0\u5143\u6570\u636E\u8FC7\u5927");
+    chunks.push(Buffer.from(chunk));
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+var short = (sha) => sha?.slice(0, 8);
+async function registryVersion(service, profile, spec, signal) {
+  const require2 = createRequire(profile.installAnchor);
+  const { viewProfilePackage } = await import(pathToFileURL(require2.resolve("@deepseek-ai/dsh-plugin-manager/operations")).href);
+  const { registryPlan } = await import(pathToFileURL(require2.resolve("@deepseek-ai/dsh-plugin-manager/registry")).href);
+  for (const registry of registryPlan(void 0, await service.registries())) {
+    const answer = await viewProfilePackage(profile.dir, spec, { ...profile.packageManager, registry, timeoutMs: 12e3, signal });
+    if (signal.aborted) throw Error("\u68C0\u67E5\u5DF2\u53D6\u6D88");
+    if (answer.exitCode !== 0) continue;
+    const parsed = JSON.parse(answer.stdout), metadata = Array.isArray(parsed) ? parsed.at(-1) : parsed;
+    if (metadata?.version) return metadata;
+  }
+  throw Error("npm \u67E5\u8BE2\u5931\u8D25\uFF1B\u8BF7\u68C0\u67E5 DSH \u7F51\u7EDC\u3001registry \u8BBE\u7F6E\u6216\u5305\u7684\u8BBF\u95EE\u6743\u9650");
+}
+var PluginUpdates = class {
+  constructor({ service = () => void 0, profile = () => void 0, fetchImpl = (...args) => fetch(...args), lookup = registryVersion } = {}) {
+    this.service = service;
+    this.profile = profile;
+    this.fetchImpl = fetchImpl;
+    this.rows = [];
+    this.abort = new AbortController();
+    this.lookup = lookup;
+  }
+  state() {
+    return {
+      available: !!this.service()?.listBundles && !!this.profile()?.dir,
+      checkedAt: this.checkedAt,
+      rows: this.rows.map(({ spec, ...row }) => ({ ...row, source: row.source.kind === "unsupported" ? { kind: "unsupported" } : row.source })),
+      job: this.job,
+      error: this.error
+    };
+  }
+  async list() {
+    const service = this.service(), profile = this.profile();
+    if (!service?.listBundles || !profile?.dir) {
+      this.rows = [];
+      return;
+    }
+    const [manifest, bundles, lock] = await Promise.all([jsonFile(join3(profile.dir, "package.json")), service.listBundles(), locks(profile.dir)]);
+    if (!manifest) throw Error("\u5F53\u524D DSH \u914D\u7F6E\u7684\u63D2\u4EF6\u6E05\u5355\u65E0\u6CD5\u8BFB\u53D6");
+    this.rows = bundles.filter((b) => b.installed || b.version).map((b) => {
+      const spec = manifest.dependencies?.[b.name];
+      const source = !spec || b.removable === false && !b.readOnlyReason ? { kind: "builtin" } : parsePluginSource(b.name, spec);
+      const npm = lock.npm?.packages?.[`node_modules/${b.name}`]?.resolved;
+      const pnpm = lock.pnpm?.importers?.["."]?.dependencies?.[b.name]?.version;
+      const installed = lock.preferNpm ? npm ?? pnpm : pnpm ?? npm;
+      const previous = this.rows.find((r) => r.name === b.name && r.spec === spec && r.version === b.version && r.commit === githubCommit(installed));
+      return {
+        ...previous,
+        name: b.name,
+        version: b.version,
+        enabled: b.enabled,
+        spec,
+        source,
+        commit: githubCommit(installed),
+        status: previous?.status ?? (source.kind === "builtin" ? "builtin" : source.kind === "unsupported" ? "unsupported" : "unchecked"),
+        ...source.kind === "builtin" ? { message: "DSH \u81EA\u5E26 / \u53D7\u4FDD\u62A4\u7EC4\u4EF6\uFF0C\u8BF7\u901A\u8FC7\u66F4\u65B0 DeepSeek Harness \u5347\u7EA7" } : {},
+        ...source.kind === "unsupported" ? { message: "\u672C\u5730\u6587\u4EF6 / \u94FE\u63A5\u6765\u6E90\uFF0C\u8BF7\u901A\u8FC7\u539F\u5B89\u88C5\u65B9\u5F0F\u66F4\u65B0" } : {}
+      };
+    });
+  }
+  async checkRow(row) {
+    try {
+      if (row.source.kind === "npm") {
+        const spec = `${row.source.package}@${row.source.tag}`;
+        const found = await this.lookup(this.service(), this.profile(), spec, this.abort.signal);
+        if (!found.version || found.problem && found.problem !== "already-installed") throw Error(found.problem === "not-found" ? "npm \u4E2D\u672A\u627E\u5230\u8BE5\u5305\u6216\u9891\u9053" : "npm \u67E5\u8BE2\u5931\u8D25\uFF1B\u8BF7\u68C0\u67E5 DSH \u7684\u7F51\u7EDC\u4E0E registry \u8BBE\u7F6E");
+        if (!parseWorkBuddyVersion(found.version) || row.version && !parseWorkBuddyVersion(row.version)) throw Error("\u65E0\u6CD5\u6BD4\u8F83\u7248\u672C\u53F7");
+        row.latestVersion = found.version;
+        row.target = `${row.name}@${row.source.alias ? `npm:${row.source.package}@` : ""}${row.source.channel ? row.source.tag : found.version}`;
+        row.status = !row.version || compareWorkBuddyVersions(found.version, row.version) > 0 ? "available" : "current";
+        row.message = !row.version ? "\u5B89\u88C5\u6587\u4EF6\u4E0D\u53EF\u8BFB\uFF0C\u53EF\u91CD\u65B0\u5B89\u88C5\u8BE5\u6765\u6E90\u4FEE\u590D" : row.status === "current" ? "\u5F53\u524D\u7248\u672C\u5DF2\u662F\u8BE5\u9891\u9053\u6700\u65B0\uFF0C\u6216\u9AD8\u4E8E\u8BE5\u9891\u9053" : void 0;
+      } else if (row.source.kind === "github") {
+        const { owner, repo, ref } = row.source;
+        const url = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/commits/${encodeURIComponent(ref ?? "HEAD")}`;
+        const found = await publicJson(url, this.fetchImpl, this.abort.signal);
+        if (!/^[a-f0-9]{40}$/i.test(found.sha)) throw Error("GitHub \u8FD4\u56DE\u65E0\u6548\u63D0\u4EA4\u4FE1\u606F");
+        row.latestCommit = found.sha.toLowerCase();
+        row.target = `${row.name}@${row.spec}`;
+        row.status = row.commit === row.latestCommit ? "current" : "available";
+        row.message = row.commit ? row.status === "available" ? `\u63D0\u4EA4 ${short(row.commit)} \u2192 ${short(row.latestCommit)}` : "\u8BE5\u5206\u652F / \u6807\u7B7E\u7684\u63D0\u4EA4\u5DF2\u540C\u6B65" : "\u65E0\u6CD5\u8BFB\u53D6\u672C\u5730 Git \u63D0\u4EA4\uFF0C\u53EF\u91CD\u65B0\u5B89\u88C5\u5DF2\u68C0\u67E5\u7684\u6765\u6E90";
+        if (ref && /^[a-f0-9]{7,40}$/i.test(ref)) {
+          row.status = "pinned";
+          row.message = "\u5B89\u88C5\u6765\u6E90\u56FA\u5B9A\u5728 Git \u63D0\u4EA4\uFF1B\u4FDD\u7559\u6B64\u63D0\u4EA4\uFF0C\u4E0D\u81EA\u52A8\u5207\u6362\u5206\u652F";
+        }
+      }
+      row.checkedAt = Date.now();
+      row.checkedEnabled = row.enabled;
+    } catch (error) {
+      row.status = "failed";
+      row.message = error.message;
+      delete row.target;
+    }
+  }
+  start(kind, task) {
+    if (this.flight) throw Error("\u5DF2\u6709\u63D2\u4EF6\u64CD\u4F5C\u6B63\u5728\u6267\u884C\uFF0C\u8BF7\u7B49\u5F85\u5B8C\u6210");
+    this.job = { id: randomUUID(), kind, state: "running", startedAt: Date.now(), results: [], total: 0 };
+    this.error = void 0;
+    this.flight = Promise.resolve().then(() => task(this.job)).then(() => {
+      this.job.state = this.job.cancelRequested ? "cancelled" : "done";
+    }, (e) => {
+      this.job.state = this.job.cancelRequested ? "cancelled" : "failed";
+      this.job.message = e.message;
+    }).finally(() => {
+      this.job.finishedAt = Date.now();
+      this.flight = void 0;
+    });
+  }
+  check() {
+    this.start("check", async (job) => {
+      await this.list();
+      const rows = this.rows.filter((r) => ["npm", "github"].includes(r.source.kind));
+      job.total = rows.length;
+      let next = 0;
+      await Promise.all(Array.from({ length: Math.min(3, rows.length) }, async () => {
+        while (next < rows.length && !job.cancelRequested) {
+          const row = rows[next++];
+          await this.checkRow(row);
+          job.results.push({ name: row.name, status: row.status, message: row.message });
+        }
+      }));
+      this.checkedAt = Date.now();
+    });
+  }
+  async installRow(row, registry) {
+    const original = await jsonFile(join3(this.profile().dir, "package.json"));
+    if (original?.dependencies?.[row.name] !== row.spec) throw Error("\u5B89\u88C5\u6765\u6E90\u5DF2\u6539\u53D8\uFF0C\u8BF7\u91CD\u65B0\u68C0\u67E5");
+    const current = (await this.service().listBundles()).find((b) => b.name === row.name);
+    if (!current || current.enabled !== row.checkedEnabled || current.version !== row.version) throw Error("\u63D2\u4EF6\u7248\u672C\u6216\u542F\u7528\u72B6\u6001\u5DF2\u6539\u53D8\uFF0C\u8BF7\u91CD\u65B0\u68C0\u67E5");
+    const result = await this.service().installBundle(row.target, {
+      enabled: row.enabled,
+      requestId: this.job.id,
+      ...registry ? { registry } : {}
+    });
+    if (result.packageResult && result.packageResult.exitCode !== 0 || ["failed", "cancelled"].includes(result.application) || result.error) {
+      return {
+        name: row.name,
+        status: "failed",
+        application: result.application,
+        message: result.pendingBuilds?.length ? "\u4F9D\u8D56\u6784\u5EFA\u811A\u672C\u9700\u8981\u6388\u6743\uFF0C\u8BF7\u5230 DSH \u63D2\u4EF6\u5B89\u88C5\u9875\u5141\u8BB8\u8FD9\u4E9B\u811A\u672C\u540E\u91CD\u8BD5" : result.error?.code === "incompatible-version" ? "\u63D2\u4EF6\u4E0E\u5F53\u524D DSH \u4E0D\u517C\u5BB9\uFF0C\u8BF7\u5148\u5347\u7EA7 DSH \u6216\u9009\u62E9\u517C\u5BB9\u7248\u672C" : `\u5B89\u88C5\u672A\u5B8C\u6210\uFF08${result.error?.code ?? result.packageResult?.kind ?? "unknown"}\uFF09\uFF1B\u8BF7\u5230 DSH \u63D2\u4EF6\u9875\u67E5\u770B\u5B89\u88C5\u65E5\u5FD7`,
+        pendingBuilds: result.pendingBuilds ?? [],
+        logPath: result.packageResult?.logPath
+      };
+    }
+    const installed = (await this.service().listBundles()).find((b) => b.name === row.name);
+    if (row.source.kind === "npm" && installed?.version !== row.latestVersion) return {
+      name: row.name,
+      status: "failed",
+      message: `\u5B9E\u9645\u5B89\u88C5\u7248\u672C ${installed?.version ?? "\u672A\u77E5"} \u4E0E\u68C0\u67E5\u7248\u672C ${row.latestVersion} \u4E0D\u540C\uFF1B\u8BF7\u7A0D\u540E\u91CD\u65B0\u68C0\u67E5\uFF0C\u53EF\u80FD\u662F\u955C\u50CF\u5C1A\u672A\u540C\u6B65\u6216\u53D1\u884C\u65F6\u95F4\u9650\u5236`
+    };
+    return { name: row.name, status: "installed", application: result.application, message: result.application === "restart-required" ? "\u5DF2\u5B89\u88C5\uFF0C\u5B8C\u5168\u9000\u51FA\u5E76\u91CD\u65B0\u6253\u5F00 DSH \u540E\u751F\u6548" : "\u5B89\u88C5\u5B8C\u6210", restartRequired: result.application === "restart-required" };
+  }
+  update(names, registry) {
+    if (!Array.isArray(names) || !names.length || names.length > 200 || names.some((n) => typeof n !== "string") || new Set(names).size !== names.length) throw Error("\u8BF7\u9009\u62E9\u8981\u66F4\u65B0\u7684\u63D2\u4EF6");
+    const selected = names.map((name) => this.rows.find((r) => r.name === name));
+    if (selected.some((r) => !r || !["available", "failed"].includes(r.status) || !r.target || Date.now() - r.checkedAt > 6e5)) throw Error("\u8BF7\u5148\u68C0\u67E5\u66F4\u65B0\uFF0C\u518D\u9009\u62E9\u53EF\u66F4\u65B0\u7684\u63D2\u4EF6\uFF08\u68C0\u67E5\u7ED3\u679C\u6709\u6548\u671F 10 \u5206\u949F\uFF09");
+    selected.sort((a, b) => Number(a.name === "dsh-multi-router") - Number(b.name === "dsh-multi-router"));
+    this.start("update", async (job) => {
+      job.total = selected.length;
+      for (const row of selected) {
+        if (job.cancelRequested) break;
+        job.current = row.name;
+        let result;
+        try {
+          result = await this.installRow(row, registry);
+        } catch (e) {
+          result = { name: row.name, status: "failed", message: e.message };
+        }
+        job.results.push(result);
+        row.status = result.status;
+        row.message = result.message;
+      }
+      delete job.current;
+      await this.list();
+    });
+  }
+  install(spec, registry) {
+    if (typeof spec !== "string" || spec.length > 600 || spec.startsWith("-") || /[\s\x00-\x1f]/.test(spec)) throw Error("\u8BF7\u8F93\u5165\u4E00\u4E2A npm \u5305\u540D\u6216 GitHub \u5B89\u88C5\u5730\u5740");
+    const named = /^((?:@[^/]+\/)?[^@]+)(?:@(.+))?$/.exec(spec);
+    const github = parsePluginSource("placeholder", spec);
+    const npm = named && parsePluginSource(named[1], named[2] || "latest");
+    if (github.kind !== "github" && npm?.kind !== "npm") throw Error("\u4EC5\u652F\u6301 npm \u5305\u540D / \u7248\u672C\u6216 github:\u7528\u6237/\u4ED3\u5E93");
+    this.start("install", async (job) => {
+      job.total = 1;
+      job.current = spec;
+      const result = await this.service().installBundle(spec, { requestId: job.id, ...registry ? { registry } : {} });
+      job.results.push({
+        name: result.bundle ?? spec,
+        status: result.error || ["failed", "cancelled"].includes(result.application) || result.packageResult && result.packageResult.exitCode !== 0 ? "failed" : "installed",
+        message: result.error ? `\u5B89\u88C5\u672A\u5B8C\u6210\uFF08${result.error.code}\uFF09\uFF0C\u8BF7\u67E5\u770B DSH \u63D2\u4EF6\u5B89\u88C5\u65E5\u5FD7` : result.application === "restart-required" ? "\u5DF2\u5B89\u88C5\uFF0C\u8BF7\u5B8C\u5168\u9000\u51FA\u5E76\u91CD\u542F DSH" : "\u5B89\u88C5\u5B8C\u6210",
+        application: result.application,
+        pendingBuilds: result.pendingBuilds ?? [],
+        restartRequired: result.application === "restart-required"
+      });
+      delete job.current;
+      await this.list();
+    });
+  }
+  async action(input) {
+    if (!this.state().available) throw Error("\u5F53\u524D DSH \u672A\u63D0\u4F9B\u63D2\u4EF6\u7BA1\u7406\u63A5\u53E3\uFF0C\u8BF7\u5347\u7EA7 DSH \u540E\u91CD\u8BD5");
+    if (input.registry && !["https://registry.npmjs.org/", "https://registry.npmmirror.com/"].includes(input.registry)) throw Error("\u65E0\u6548\u7684 npm \u6765\u6E90");
+    if (input.action === "plugins.list") {
+      if (!this.flight) await this.list();
+    } else if (input.action === "plugins.check") this.check();
+    else if (input.action === "plugins.update") this.update(input.names, input.registry);
+    else if (input.action === "plugins.install") this.install(input.spec, input.registry);
+    else if (input.action === "plugins.cancel") {
+      if (this.job?.state === "running") {
+        this.job.cancelRequested = true;
+        if (this.job.kind !== "check") await this.service().cancelInstall?.(this.job.id);
+      }
+    } else throw Error("\u672A\u77E5\u63D2\u4EF6\u64CD\u4F5C");
+  }
+};
+
 // src/manager.mjs
 var MANAGEMENT_PATH = "/.well-known/dsh-multi-router";
 var revisionOf = (raw) => createHash("sha256").update(JSON.stringify(raw)).digest("hex");
@@ -272,28 +600,35 @@ function modelInfo(row) {
 }
 var Manager = class {
   constructor(file, router, onChange = () => {
-  }) {
+  }, pluginAccess = {}) {
     this.file = file;
     this.router = router;
     this.onChange = onChange;
-    this.catalogFile = join3(dirname3(file), "catalogs.json");
+    this.catalogFile = join4(dirname3(file), "catalogs.json");
     this.catalogs = /* @__PURE__ */ new Map();
     this.catalogErrors = /* @__PURE__ */ new Map();
     this.refreshes = /* @__PURE__ */ new Map();
     this.closed = false;
     this.monitorFlights = /* @__PURE__ */ new Map();
     this.loginInfo = /* @__PURE__ */ new Map();
-    this.telemetry = new Telemetry(join3(dirname3(file), "usage.json"));
+    this.telemetry = new Telemetry(join4(dirname3(file), "usage.json"));
+    this.plugins = new PluginUpdates(pluginAccess);
+    this.setupFile = join4(dirname3(file), "initial-setup.json");
     router.telemetry = this.telemetry;
     router.monitor = (a) => this.monitorAccount(a);
     router.prepareFree = () => this.checkFreeModels(true);
     router.freeModels = (account) => this.freeModels(account);
   }
   async load() {
-    this.raw = JSON.parse(await readFile(this.file, "utf8"));
+    this.raw = JSON.parse(await readFile2(this.file, "utf8"));
+    try {
+      this.setup = JSON.parse(await readFile2(this.setupFile, "utf8"));
+    } catch {
+      this.setup = void 0;
+    }
     this.config = validateConfig(this.raw, this.file);
     try {
-      const saved = JSON.parse(await readFile(this.catalogFile, "utf8"));
+      const saved = JSON.parse(await readFile2(this.catalogFile, "utf8"));
       for (const account of this.config.accounts) {
         const item = saved[account.id];
         if (item?.credentialFile === account.credentialFile && Array.isArray(item.models)) {
@@ -335,8 +670,9 @@ var Manager = class {
       if (this.closed || !discovered.accounts.length) return;
       await withFileLock(this.file, async () => {
         if (this.closed) return;
-        let raw = JSON.parse(await readFile(this.file, "utf8"));
+        let raw = JSON.parse(await readFile2(this.file, "utf8"));
         let changed = false;
+        const saved = /* @__PURE__ */ new Map();
         for (const item of discovered.accounts) {
           const key = localAccountKey(item.provider, item.document);
           if (!force && raw.ignoredLocalAccounts?.includes(key)) continue;
@@ -353,6 +689,11 @@ var Manager = class {
             } catch {
             }
           }
+          const id = existing?.id ?? `local_${createHash("sha256").update(key).digest("hex").slice(0, 20)}`;
+          const recordSaved = () => {
+            if (!saved.has(item.provider)) saved.set(item.provider, /* @__PURE__ */ new Set());
+            saved.get(item.provider).add(id);
+          };
           let sameDevice = true;
           if (existing && item.identityDocument) {
             try {
@@ -362,13 +703,15 @@ var Manager = class {
               sameDevice = false;
             }
           }
-          if (existing && sameDevice && current.credential.expiresAtMs >= item.document.credential.expiresAtMs) continue;
-          const id = existing?.id ?? `local_${createHash("sha256").update(key).digest("hex").slice(0, 20)}`;
-          const base = join3(dirname3(this.file), "accounts");
+          if (existing && sameDevice && current.credential.expiresAtMs >= item.document.credential.expiresAtMs) {
+            recordSaved();
+            continue;
+          }
+          const base = join4(dirname3(this.file), "accounts");
           await mkdir2(base, { recursive: true, mode: 448 });
-          const staging = await mkdtemp2(join3(base, `${id}-`));
+          const staging = await mkdtemp2(join4(base, `${id}-`));
           try {
-            const credentialFile = join3(staging, "credential.json"), identityFile = join3(staging, "identity.json");
+            const credentialFile = join4(staging, "credential.json"), identityFile = join4(staging, "identity.json");
             await importAccount({ ...item, credentialFile, identityFile });
             const paths = {
               credentialFile: relative2(dirname3(this.file), credentialFile),
@@ -387,6 +730,7 @@ var Manager = class {
             await writePrivateJson(this.file, next);
             raw = next;
             changed = true;
+            recordSaved();
             this.router.clients.delete(id);
             this.catalogs.delete(id);
             this.catalogErrors.delete(id);
@@ -401,12 +745,25 @@ var Manager = class {
           await Promise.all(this.config.accounts.map((a) => this.readLogin(a)));
           this.publish();
         }
+        this.localDiscovery = this.localDiscovery.map((s) => discovered.status.some((d) => d.provider === s.provider) ? { ...s, savedCount: saved.get(s.provider)?.size ?? 0 } : s);
       }, { waitMs: 3e4 });
     })().finally(() => {
       this.localScan = void 0;
     });
     return this.localScan;
   }
+  async finishInitialSetup() {
+    if (this.setup?.completedAt) return;
+    await withFileLock(this.setupFile, async () => {
+      try {
+        this.setup = JSON.parse(await readFile2(this.setupFile, "utf8"));
+      } catch {
+      }
+      if (this.setup?.completedAt) return;
+      this.setup = { completedAt: Date.now(), dismissed: false };
+      await writePrivateJson(this.setupFile, this.setup);
+    });
+  }
   async monitorAccount(account) {
     if (this.monitorFlights.has(account.id)) return this.monitorFlights.get(account.id);
     const promise = (async () => {
@@ -597,6 +954,8 @@ var Manager = class {
       pluginVersion: version,
       revision: this.revision,
       localDiscovery: this.localDiscovery ?? [],
+      setup: this.setup,
+      pluginUpdates: this.plugins.state(),
       telemetry: this.telemetry.state(),
       accounts: this.config.accounts.map((a) => ({
         id: a.id,
@@ -631,8 +990,23 @@ var Manager = class {
   }
   async action(input) {
     if (!input || typeof input !== "object" || Array.isArray(input)) bad("\u8BF7\u6C42\u683C\u5F0F\u65E0\u6548");
+    if (typeof input.action === "string" && input.action.startsWith("plugins.")) {
+      try {
+        await this.plugins.action(input);
+      } catch (e) {
+        bad(e.message);
+      }
+      return this.state();
+    }
+    if (input.action === "setup.dismiss") {
+      await withFileLock(this.setupFile, async () => {
+        this.setup = { ...this.setup, completedAt: this.setup?.completedAt ?? Date.now(), dismissed: true };
+        await writePrivateJson(this.setupFile, this.setup);
+      });
+      return this.state();
+    }
     if (input.action === "account.export") {
-      if (input.revision !== revisionOf(JSON.parse(await readFile(this.file, "utf8")))) throw new ManagementError(409, "\u914D\u7F6E\u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5237\u65B0\u540E\u63D0\u53D6\u51ED\u8BC1");
+      if (input.revision !== revisionOf(JSON.parse(await readFile2(this.file, "utf8")))) throw new ManagementError(409, "\u914D\u7F6E\u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5237\u65B0\u540E\u63D0\u53D6\u51ED\u8BC1");
       const account = this.config.accounts.find((a) => a.id === input.id);
       if (!account) bad("\u8D26\u53F7\u4E0D\u5B58\u5728");
       let credential;
@@ -654,7 +1028,7 @@ var Manager = class {
       } };
     }
     if (input.action === "config.export") {
-      if (input.revision !== revisionOf(JSON.parse(await readFile(this.file, "utf8")))) throw new ManagementError(409, "\u914D\u7F6E\u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5237\u65B0\u540E\u5BFC\u51FA");
+      if (input.revision !== revisionOf(JSON.parse(await readFile2(this.file, "utf8")))) throw new ManagementError(409, "\u914D\u7F6E\u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5237\u65B0\u540E\u5BFC\u51FA");
       try {
         return { ...this.state(), exported: { filename: `dsh-multi-router-${input.includeCredentials ? "encrypted" : "settings"}-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.json`, document: await exportConfiguration(this, input) } };
       } catch (e) {
@@ -702,7 +1076,7 @@ var Manager = class {
       return this.state();
     }
     return withFileLock(this.file, async () => {
-      let raw = JSON.parse(await readFile(this.file, "utf8"));
+      let raw = JSON.parse(await readFile2(this.file, "utf8"));
       if (input.revision !== revisionOf(raw)) throw new ManagementError(409, "\u914D\u7F6E\u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5237\u65B0\u540E\u518D\u4FDD\u5B58");
       raw.routes ??= structuredClone(this.config.routes);
       let staging;
@@ -725,10 +1099,10 @@ var Manager = class {
           }
           if (!/^[a-zA-Z0-9_-]{1,64}$/.test(input.id ?? "") || !PROVIDERS.includes(input.provider)) bad("\u8D26\u53F7 ID \u6216\u4F9B\u5E94\u5546\u65E0\u6548");
           if (account && !replacing) bad("\u8D26\u53F7 ID \u5DF2\u5B58\u5728\uFF0C\u8BF7\u4F7F\u7528\u4E0D\u540C ID");
-          const base = join3(dirname3(this.file), "accounts");
+          const base = join4(dirname3(this.file), "accounts");
           await mkdir2(base, { recursive: true, mode: 448 });
-          staging = await mkdtemp2(join3(base, `${input.id}-`));
-          const credentialFile = join3(staging, "credential.json"), identityFile = join3(staging, "identity.json");
+          staging = await mkdtemp2(join4(base, `${input.id}-`));
+          const credentialFile = join4(staging, "credential.json"), identityFile = join4(staging, "identity.json");
           const added = {
             id: input.id,
             name: input.name || account?.name || input.id,
@@ -917,7 +1291,7 @@ var Manager = class {
       clearTimeout(timer);
       timer = setTimeout(() => {
         void withFileLock(this.file, async () => {
-          const raw = JSON.parse(await readFile(this.file, "utf8"));
+          const raw = JSON.parse(await readFile2(this.file, "utf8"));
           if (this.closed || revisionOf(raw) === this.revision) return;
           const config = validateConfig(raw, this.file);
           this.raw = raw;
@@ -984,4 +1358,4 @@ export {
   Manager,
   managementHandler
 };
-//# sourceMappingURL=chunk-WIDXMBQ2.js.map
+//# sourceMappingURL=chunk-UQS7DNOQ.js.map