dsh-oc-desktop 0.3.6 → 0.3.8

package/bin/dsh-desktop.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 // dsh-desktop: boot the desktop shell (Electron launcher).
-const { spawn } = require('node:child_process');
+const { spawn, execFileSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 
@@ -37,6 +37,10 @@ function main() {
     console.error('dsh-oc-desktop: launcher/main.js missing, reinstall the package.');
     process.exit(1);
   }
+  // electron.exe brand icon may be lost after `npm install` (electron re-downloads its
+  // exe). Re-inject before the shell starts — electron is not running yet, so the exe
+  // is writable. Taskbar/TaskManager icons come from the exe, so this keeps them right.
+  ensureInjected(electron);
   const child = spawn(electron, [mainPath, ...args], { stdio: 'inherit', windowsHide: true });
   child.on('error', (err) => { console.error(`dsh-oc-desktop: failed to start electron: ${err.message}`); process.exit(1); });
   child.on('exit', (code, signal) => {
@@ -48,5 +52,23 @@ function main() {
   });
 }
 
+// Re-inject the brand icon (and DSH Desktop version info) into electron.exe if it was
+// re-downloaded. Probe ProductName first (fast); inject when it is not 'DSH Desktop'.
+const injectScript = path.join(__dirname, '..', 'scripts', 'set-exe-icon.ps1');
+function ensureInjected(electron) {
+  if (!fs.existsSync(injectScript)) return; // package missing the script — skip silently
+  try {
+    const probe = execFileSync('powershell', ['-NoProfile', '-Command', `(Get-Item '${electron}').VersionInfo.ProductName`], { encoding: 'utf8', windowsHide: true });
+    if (String(probe).trim() === 'DSH Desktop') return;
+  } catch { /* probe failed; try injecting anyway */ }
+  console.log('dsh-oc-desktop: electron brand icon missing, injecting ...');
+  try {
+    execFileSync('powershell', ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', injectScript], { stdio: 'inherit', windowsHide: true });
+    console.log('dsh-oc-desktop: brand icon injected.');
+  } catch (e) {
+    console.warn(`dsh-oc-desktop: icon injection failed: ${e && e.message ? e.message : e}`);
+  }
+}
+
 if (require.main === module) main();
 module.exports = { resolveElectron };

package/launcher/dialog-preload.js

@@ -0,0 +1,8 @@
+'use strict';
+// dialog-preload.js - 更新弹窗的 preload:把「执行更新」动作桥到主进程 IPC。
+// 弹窗 sandbox:true,只暴露最小表面(dshUpdate.run),无 Node 能力。
+const { contextBridge, ipcRenderer } = require('electron');
+
+contextBridge.exposeInMainWorld('dshUpdate', {
+  run: (action) => ipcRenderer.invoke('dialog-update', action),
+});

package/launcher/main.js

@@ -9,7 +9,7 @@ const path = require('node:path');
 const os = require('node:os');
 const { connectEvents } = require('./events');
 const { applyUpdate } = require('./apply-update');
-const { checkForUpdates, fetchJson, diffLocal, downloadUpdate } = require('./updater');
+const { checkNpmUpdates, npmPackageInfo, npmPackageVersions, checkEngineCompat } = require('./updater');
 const { parseCurrentSession, SESSION_ID_RE } = require('./session-window');
 
 // ---------- 路径常量 ----------
@@ -18,11 +18,12 @@ const { parseCurrentSession, SESSION_ID_RE } = require('./session-window');
 const PACKAGE_ROOT = path.join(__dirname, '..'); // plugins/dsh-desktop(包根,自带 assets)
 
 app.setName('dsh-desktop');
-// Windows 原生通知需要 AppUserModelID。
-// 注意:设置后 Windows 会把任务栏按钮图标解析为 exe 图标而非窗口图标 —— 这没问题,
-// 因为 electron.exe 图标已通过 scripts/set-exe-icon.ps1 注入为圆角白底黑鲸
-// (任务栏 + 任务管理器进程图标同源)。若重装 electron(npm install)需重跑注入脚本。
-app.setAppUserModelId('dev.dsh.desktop');
+// 不设置 AppUserModelID:设置后 Windows 任务栏按钮图标走 AppID 关联解析,
+// 无匹配快捷方式时显示空白默认图标(实测"无图标");移除后任务栏回退 exe 图标
+// (已由 scripts/set-exe-icon.ps1 注入圆角白底黑鲸,任务管理器进程图标同源)。
+// 通知:未打包场景下 Electron Notification 仍可弹出;若后续打包需恢复此调用并配套
+// 同 AppID 的快捷方式(否则任务栏图标空白)。
+// app.setAppUserModelId('dev.dsh.desktop');
 
 // ---------- 更新应用模式 ----------
 // 主进程以 --dsh-apply-update 重启:本进程只负责把 staging 文件树替换到位,
@@ -65,7 +66,8 @@ const DEFAULT_SETTINGS = {
   shortcut: 'Control+Alt+D',    // 全局显示/隐藏快捷键
   startupTimeoutMs: 90000,      // 引擎启动超时
   dataHome: null,               // 独立数据根(null = %APPDATA%\dsh-desktop\home,即独立的 DSH_HOME)
-  updateUrl: null,              // 更新服务器根地址(version.json 所在目录);null = 未配置,托盘「检查更新」会提示
+  updateUrl: null,              // (遗留)文件树更新服务器根地址;不再使用(发布改 npm 包)
+  updateRegistry: null,         // npm registry 源;null = 官方 https://registry.npmjs.org,托盘「检查更新」查询 latest 对比
 };
 function loadJson(file, fallback) {
   try { return { ...fallback, ...JSON.parse(fs.readFileSync(file, 'utf8')) }; }
@@ -163,7 +165,7 @@ async function ensureDataHome() {
 }
 
 // ---------- 状态 ----------
-let mainWin = null, splash = null, tray = null;
+let mainWin = null, splash = null, tray = null, dialogWin = null;
 let child = null, harnessUrl = null, quitting = false;
 let restartTimer = null, startTimer = null, stateTimer = null;
 let stdoutBuf = '', restartCount = 0;
@@ -579,6 +581,130 @@ function showError(msg) {
   mainWin.loadURL('data:text/html;charset=utf-8,' + encodeURIComponent(errorHtml(msg)));
 }
 
+// ---------- 更新信息弹窗 ----------
+// oc 组件包名 → 中文显示名(检查更新表格用)
+const OC_DISPLAY = {
+  'dsh-oc-desktop': '桌面壳',
+  'dsh-oc-session-window': '会话新窗口',
+  'dsh-oc-change-review': '修改审查',
+  'dsh-oc-sidebar': '右侧工作台',
+  'dsh-oc-deeplink': '深链',
+  '@deepseek-ai/dsh': '引擎',
+};
+function updateHtml(title, rows, footer) {
+  const esc = escapeHtml;
+  const showAll = rows.some((r) => r.hasUpdate);
+  const cards = rows.map((r) => {
+    const st = r.error ? '检查失败' : r.hasUpdate ? '可更新' : '已最新';
+    const stCls = r.error ? 'err' : r.hasUpdate ? 'upd' : 'ok';
+    const compat = r.compatible == null ? '' : r.compatible
+      ? `<span class="compat ok" title="该插件声明的依赖范围兼容最新引擎">兼容新引擎</span>`
+      : `<span class="compat err" title="该插件声明的依赖范围不满足最新引擎,将保留当前版本">不兼容·保留</span>`;
+    const desc = r.description ? `<div class="desc" title="${esc(r.description)}">${esc(r.description)}</div>` : '';
+    const ver = r.error
+      ? ''
+      : `<div class="ver"><span class="lbl">当前</span> <b>${esc(r.current)}</b> <span class="arrow ${r.hasUpdate ? 'upd' : ''}">→</span> <span class="lbl">最新</span> <b>${esc(r.latest)}</b></div>`;
+    return `<div class="card">
+      <div class="top"><span class="pkg">${esc(r.display || r.name)}</span><span class="nm">${esc(r.name)}</span>${compat}<span class="st ${stCls}">${st}</span></div>
+      ${desc}${ver}
+    </div>`;
+  }).join('');
+  const foot = footer ? `<div class="footnote">${esc(footer)}</div>` : '';
+  const allBtn = showAll ? `<button class="all-btn" onclick="doUpdate(this)">一键更新</button>` : '';
+  return `<!doctype html><html><head><meta charset="utf-8"><style>
+    body{margin:0;height:100vh;display:flex;flex-direction:column;background:#101216;color:#e5e7eb;font-family:'Segoe UI',system-ui,sans-serif}
+    .head{padding:13px 18px;font-size:14px;font-weight:600;border-bottom:1px solid #23272f}
+    .body{flex:1;overflow:auto;padding:6px 18px}
+    .body::-webkit-scrollbar{width:8px}
+    .body::-webkit-scrollbar-track{background:transparent}
+    .body::-webkit-scrollbar-thumb{background:#2a2f3a;border-radius:4px}
+    .body::-webkit-scrollbar-thumb:hover{background:#3a4150}
+    .card{padding:10px 2px;border-bottom:1px solid #1d2129}
+    .card:last-child{border-bottom:none}
+    .top{display:flex;align-items:center;gap:8px;min-width:0}
+    .pkg{color:#e5e7eb;font-weight:600;font-size:13px}
+    .nm{color:#6b7280;font-size:11px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+    .st{margin-left:auto;flex-shrink:0;font-size:11px;padding:2px 10px;border-radius:10px}
+    .ok{color:#34d399;background:#12251d}
+    .upd{color:#fbbf24;background:#2a2013}
+    .err{color:#f87171;background:#2a1414}
+    .compat{flex-shrink:0;font-size:11px;padding:2px 8px;border-radius:10px}
+    .compat.ok{color:#34d399;border:1px solid #1d3a2e}
+    .compat.err{color:#f87171;border:1px solid #3a2020}
+    .desc{color:#6b7280;font-size:11px;margin:3px 0;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:100%}
+    .ver{font-size:12px;color:#9aa4b2;margin-top:2px}
+    .ver b{color:#e5e7eb;font-weight:600;font-size:13px}
+    .lbl{color:#6b7280;font-size:11px}
+    .arrow{color:#6b7280;margin:0 2px}
+    .arrow.upd{color:#fbbf24}
+    .all-btn{background:#4d6bfe;border:none;color:#fff;font-size:13px;padding:7px 22px;border-radius:8px;cursor:pointer;margin-right:8px}
+    .all-btn:hover{background:#3b5bfe}
+    .all-btn:disabled{background:#3a4150;cursor:default}
+    .footnote{margin-top:12px;font-size:12px;line-height:1.7;color:#9aa4b2;white-space:pre-wrap}
+    .res{font-size:16px;font-weight:600;margin-top:40px;text-align:center}
+    .res.ok{color:#34d399}
+    .res.err{color:#f87171}
+    .res-msg{margin-top:12px;font-size:13px;line-height:1.7;color:#c8cdd6;text-align:center;word-break:break-word}
+    .foot{padding:11px 18px;border-top:1px solid #23272f;display:flex;justify-content:flex-end}
+    button{background:#4d6bfe;border:none;color:#fff;font-size:13px;padding:7px 22px;border-radius:8px;cursor:pointer}
+    button:hover{background:#3b5bfe}</style></head><body>
+    <div class="head">${esc(title)}</div>
+    <div class="body">${cards}${foot}</div>
+    <div class="foot">${allBtn}<button onclick="window.close()">确定</button></div>
+    <script>
+    async function doUpdate(btn) {
+      btn.disabled = true;
+      btn.textContent = '更新中…';
+      let r;
+      try { r = await window.dshUpdate.run({ kind: 'all' }); }
+      catch (e) { r = { ok: false, message: String(e && e.message || e) }; }
+      const body = document.querySelector('.body');
+      body.textContent = '';
+      const d = document.createElement('div');
+      d.className = 'res ' + (r && r.ok ? 'ok' : 'err');
+      d.textContent = (r && r.ok) ? '✓ 更新完成' : '✗ 更新失败';
+      const m = document.createElement('div');
+      m.className = 'res-msg';
+      m.textContent = (r && r.message) || '';
+      body.appendChild(d);
+      body.appendChild(m);
+    }
+    </script>
+    </body></html>`;
+}
+// ---------- 更新弹窗窗口管理 ----------
+function createDialogWindow() {
+  dialogWin = new BrowserWindow({
+    width: 680, height: 520, show: false, title: '检查更新',
+    icon: appIcon(), backgroundColor: '#101216',
+    autoHideMenuBar: true, resizable: false, maximizable: false,
+    webPreferences: { sandbox: true, contextIsolation: true, preload: path.join(__dirname, 'dialog-preload.js') },
+  });
+  dialogWin.once('ready-to-show', () => { dialogWin.show(); dialogWin.focus(); });
+  dialogWin.on('closed', () => { dialogWin = null; });
+}
+function loadDialog(html) {
+  if (!dialogWin || dialogWin.isDestroyed()) createDialogWindow();
+  dialogWin.loadURL('data:text/html;charset=utf-8,' + encodeURIComponent(html));
+  dialogWin.focus();
+}
+// 检查前的加载动画页(先弹窗,给用户即时反馈,避免误以为没点到/卡住)
+function loadingHtml() {
+  return `<!doctype html><html><head><meta charset="utf-8"><style>
+    body{margin:0;height:100vh;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:16px;background:#101216;color:#e5e7eb;font-family:'Segoe UI',system-ui,sans-serif}
+    .spinner{width:36px;height:36px;border:3px solid #2a2f3a;border-top-color:#4d6bfe;border-radius:50%;animation:spin .8s linear infinite}
+    @keyframes spin{to{transform:rotate(360deg)}}
+    .t{font-size:13px;color:#9aa4b2}</style></head><body>
+    <div class="spinner"></div><div class="t">正在检查更新…</div>
+    </body></html>`;
+}
+function showUpdateLoading() {
+  loadDialog(loadingHtml());
+}
+function showUpdateDialog(title, rows, footer) {
+  loadDialog(updateHtml(title, rows, footer));
+}
+
 // ---------- 通知 / 托盘 / 快捷键 / 自启 ----------
 function notify(title, body) {
   if (!Notification.isSupported()) return;
@@ -618,6 +744,7 @@ function refreshTrayMenu() {
     { type: 'separator' },
     { label: '当前会话在新窗口打开', click: () => { openSessionWindowFrom(null); } },
     { label: '检查更新…', click: () => { runCheckUpdates(); } },
+    { label: '回滚引擎更新', click: () => { rollbackEngine(); } },
     { label: '开发者工具', click: () => { if (mainWin && !mainWin.isDestroyed()) mainWin.webContents.toggleDevTools(); } },
     { label: '退出', click: quitApp },
   ]));
@@ -722,52 +849,158 @@ ipcMain.on('set-window-bg', (_e, color) => {
   try { win.setBackgroundColor(color); } catch (e) { log('warn', `setBackgroundColor failed: ${e.message}`); }
 });
 
-// ---------- 检查更新 / 自动更新(托盘入口) ----------
-// 流程:对比版本 → 拉取 files.json → 本地差异 → 下载(逐文件 sha256 校验)
-//       → 重启自身进入 apply 模式 → .dsh-apply.cmd 收尾(exe 替换 + 清理 + 再启动)。
-async function runCheckUpdates() {
-  const res = await checkForUpdates(settings.updateUrl, app.getVersion());
-  if (!res.ok) {
-    log('warn', `check update: ${res.error}`);
-    notify('检查更新', res.error);
-    return res;
+// ---------- 弹窗一键更新执行(全部) ----------
+// 弹窗「一键更新」经 dialog-preload → ipcMain.handle('dialog-update') → 这里执行。
+// 无单独更新:引擎有新版时兼容插件随引擎一起更新,不兼容插件保留;更新前备份旧引擎,可回滚。
+function runCommand(cmd, args) {
+  return new Promise((resolve, reject) => {
+    const p = spawn(cmd, args, { windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    let out = '';
+    p.stdout.on('data', (d) => { out += d; });
+    p.stderr.on('data', (d) => { out += d; });
+    p.on('error', (e) => reject(e));
+    p.on('close', (code) => (code === 0 ? resolve(out) : reject(new Error(out.trim() || `命令退出码 ${code}`))));
+  });
+}
+// 收集本地已装组件(壳 + oc 插件 + 引擎),检查与一键更新复用
+function collectInstalled() {
+  let shellVersion = app.getVersion();
+  try { shellVersion = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8')).version; } catch { /* fallback */ }
+  const list = [{ name: 'dsh-oc-desktop', current: String(shellVersion) }];
+  const nmRoot = path.join(dataHome, 'profiles', 'web', 'node_modules');
+  for (const name of ['dsh-oc-session-window', 'dsh-oc-change-review', 'dsh-oc-sidebar', 'dsh-oc-deeplink']) {
+    try { const v = JSON.parse(fs.readFileSync(path.join(nmRoot, name, 'package.json'), 'utf8')).version; list.push({ name, current: String(v) }); } catch { /* not installed */ }
   }
-  log('info', `check update: current=${res.current} latest=${res.latest} hasUpdate=${res.hasUpdate}`);
-  if (!res.hasUpdate) {
-    notify('检查更新', `已是最新版本 v${res.current}`);
-    return res;
+  try {
+    const v = JSON.parse(fs.readFileSync(path.join(dataHome, 'profiles', 'node_modules', '@deepseek-ai', 'dsh', 'package.json'), 'utf8')).version;
+    list.push({ name: '@deepseek-ai/dsh', current: String(v) });
+  } catch { /* engine missing */ }
+  return list;
+}
+async function executeUpdate(action) {
+  log('info', `update action: ${JSON.stringify(action)}`);
+  if (!action || action.kind !== 'all') return { ok: false, message: '已取消单独更新,仅支持一键更新' };
+  const registry = (settings.updateRegistry || 'https://registry.npmjs.org').replace(/\/+$/, '');
+  const engineBin = path.join(dataHome, 'profiles', 'node_modules', '@deepseek-ai', 'dsh', 'lib', 'bin.js');
+  try {
+    const results = await checkNpmUpdates(collectInstalled(), registry);
+    const updates = results.filter((r) => r.hasUpdate);
+    if (updates.length === 0) return { ok: true, message: '所有组件已是最新,无需更新' };
+    const engineUpd = results.find((r) => r.name === '@deepseek-ai/dsh' && r.hasUpdate);
+    if (!engineUpd) {
+      // 引擎无更新:聚合器一键更新全部 oc 组件
+      await runCommand('npx', ['--yes', 'dsh-oc', 'install']);
+      return { ok: true, message: '全部 oc 组件已更新到最新。重启应用后生效。' };
+    }
+    // 引擎有新版:检测各插件兼容性,兼容且有更新的随引擎一起更新,不兼容保留
+    const engineInfo = await npmPackageInfo('@deepseek-ai/dsh', registry);
+    const compatToUpdate = [];
+    const kept = [];
+    for (const r of results) {
+      if (r.name === '@deepseek-ai/dsh' || r.error) continue;
+      const ok = await checkEngineCompat(r.peerDependencies, engineInfo.dependencies, async (pkg) => npmPackageVersions(pkg, registry));
+      if (ok) { if (r.hasUpdate) compatToUpdate.push(r.name); }
+      else kept.push(r.name);
+    }
+    // 备份旧引擎
+    const dshDir = path.join(dataHome, 'profiles', 'node_modules', '@deepseek-ai', 'dsh');
+    if (!fs.existsSync(dshDir)) return { ok: false, message: '共享数据根内未找到 dsh 引擎' };
+    const backup = path.join(dataHome, 'profiles', 'node_modules', '@deepseek-ai', `.dsh-backup-${Date.now()}`);
+    fs.cpSync(dshDir, backup, { recursive: true });
+    log('info', `engine update: backup to ${backup}`);
+    // 更新兼容插件(引擎删除前,用当前引擎 CLI)
+    for (const name of compatToUpdate) {
+      try { await runCommand(process.execPath, [engineBin, 'plugin', '--profile', 'web', 'add', name]); log('info', `plugin updated: ${name}`); }
+      catch (e) { log('warn', `plugin ${name} update skipped: ${e.message}`); }
+    }
+    // 停引擎 + 删 dsh + 重启壳(autoBootstrap 重装最新引擎)
+    killHarness();
+    killWebEngine();
+    fs.rmSync(dshDir, { recursive: true, force: true });
+    app.relaunch();
+    app.exit(0);
+    return {
+      ok: true,
+      message: '引擎已重置,应用重启后将自动重装最新版。'
+        + (compatToUpdate.length ? `\n随引擎更新的插件:${compatToUpdate.join('、')}。` : '')
+        + (kept.length ? `\n因不兼容保留当前版本:${kept.join('、')}。` : '')
+        + '\n如更新后异常,可在托盘「回滚引擎更新」恢复。',
+    };
+  } catch (e) {
+    const msg = e && e.message ? e.message : String(e);
+    log('error', `update action failed: ${msg}`);
+    return { ok: false, message: `更新失败: ${msg}` };
   }
-  notify('检查更新', `发现新版本 v${res.latest}(当前 v${res.current}),开始下载…`);
-  const base = String(settings.updateUrl).replace(/\/+$/, '');
-  const appRoot = PACKAGE_ROOT;
-  const staging = path.join(appRoot, '.dsh-update-staging');
+}
+// 回滚引擎更新:恢复最新备份并重启
+function rollbackEngine() {
+  const dir = path.join(dataHome, 'profiles', 'node_modules', '@deepseek-ai');
+  let backups = [];
+  try { backups = fs.readdirSync(dir).filter((n) => n.startsWith('.dsh-backup-')).sort(); } catch { /* none */ }
+  const latest = backups[backups.length - 1];
+  if (!latest) { notify('回滚引擎', '没有可回滚的引擎备份'); return; }
+  log('info', `engine rollback: restore ${latest}`);
+  killHarness();
+  killWebEngine();
+  fs.rmSync(path.join(dir, 'dsh'), { recursive: true, force: true });
+  try { fs.renameSync(path.join(dir, latest), path.join(dir, 'dsh')); }
+  catch (e) { log('error', `rollback failed: ${e.message}`); notify('回滚引擎', `回滚失败: ${e.message}`); return; }
+  app.relaunch();
+  app.exit(0);
+}
+ipcMain.handle('dialog-update', (event, action) => executeUpdate(action || {}));
+
+// ---------- 检查更新(托盘入口, npm registry 模式) ----------
+// 桌面壳与 oc 插件均为 npm 包:查询 registry 的 latest 与本地版本对比,只提示不自动下载,
+// 更新动作由用户执行 `npx dsh-oc install`。
+async function runCheckUpdates() {
+  showUpdateLoading(); // 先弹窗给加载反馈,检查完成后替换为结果
+  const registry = (settings.updateRegistry || 'https://registry.npmjs.org').replace(/\/+$/, '');
+  const installed = collectInstalled();
+  log('info', `check update: ${installed.length} components, registry=${registry}`);
+  // 2. 查询 npm latest 并对比
   try {
-    const filesManifest = await fetchJson(base + '/files.json');
-    if (!Array.isArray(filesManifest.files)) throw new Error('files.json 缺少 files 数组');
-    fs.rmSync(staging, { recursive: true, force: true });
-    const need = await diffLocal(appRoot, filesManifest.files);
-    if (need.length === 0) {
-      notify('检查更新', '文件已是最新,无需下载');
-      return res;
+    const results = await checkNpmUpdates(installed, registry);
+    const updates = results.filter((r) => r.hasUpdate);
+    const failed = results.filter((r) => r.error);
+    if (failed.length) log('warn', 'check update: failed: ' + failed.map((f) => `${f.name}: ${f.error}`).join('; '));
+    // 引擎有新版时,检测各 oc 插件对新引擎的兼容性(一键更新的保留/更新决策)
+    const engineResult = results.find((r) => r.name === '@deepseek-ai/dsh');
+    let engineDeps = null;
+    if (engineResult && engineResult.hasUpdate && !engineResult.error) {
+      try { engineDeps = (await npmPackageInfo('@deepseek-ai/dsh', registry)).dependencies; } catch { /* 兼容检测跳过 */ }
     }
-    log('info', `update: ${need.length} files to download (${(need.reduce((s, f) => s + f.size, 0) / 1048576).toFixed(1)} MB)`);
-    await downloadUpdate(base, need, staging, (done, total) => {
-      if (done === total || done % 100 === 0) log('info', `update download: ${done}/${total}`);
-    });
-    notify('检查更新', `更新已就绪(v${res.latest}),正在重启应用…`);
-    // 重启自身进入 apply 模式;本进程随后退出,由新进程替换文件树
-    try {
-      spawn(process.execPath, ['--dsh-apply-update'], { detached: true, stdio: 'ignore', windowsHide: true }).unref();
-    } catch (e) {
-      log('error', `spawn apply-update failed: ${e.message}`);
+    const rows = [];
+    for (const r of results) {
+      let compatible = null; // null=引擎无更新无需判定;true/false=是否兼容新引擎
+      if (engineDeps && r.name !== '@deepseek-ai/dsh' && !r.error) {
+        compatible = await checkEngineCompat(r.peerDependencies, engineDeps, async (pkg) => npmPackageVersions(pkg, registry));
+      }
+      rows.push({ name: r.name, display: OC_DISPLAY[r.name] || r.name, current: r.current,
+        latest: r.latest, hasUpdate: r.hasUpdate, error: r.error, description: r.description, compatible });
+    }
+    let footer = '';
+    if (updates.length === 0) {
+      footer = `所有组件已是最新(共 ${results.length} 个)`;
+      log('info', 'check update: all up to date');
+    } else {
+      const ocUpd = updates.some((u) => u.name !== '@deepseek-ai/dsh');
+      const engineUpd = updates.some((u) => u.name === '@deepseek-ai/dsh');
+      if (ocUpd) footer += '一键更新将升级全部 oc 组件';
+      if (engineUpd) {
+        const kept = rows.filter((r) => r.compatible === false);
+        footer += (footer ? '\n' : '') + '引擎有新版:兼容插件随引擎一起更新'
+          + (kept.length ? `;不兼容插件保留(${kept.map((k) => k.display).join('、')})` : '');
+        footer += '\n引擎更新后若异常,可在托盘「回滚引擎更新」恢复';
+      }
+      log('info', 'check update: ' + updates.map((u) => `${u.name} ${u.current}→${u.latest}`).join(', '));
     }
-    quitApp();
-    return { ...res, downloading: true };
+    showUpdateDialog('检查更新', rows, footer);
+    return { ok: true, results, rows };
   } catch (e) {
-    fs.rmSync(staging, { recursive: true, force: true });
     const msg = e && e.message ? e.message : String(e);
-    log('error', `update failed: ${msg}`);
-    notify('检查更新', `更新失败: ${msg}`);
+    log('error', `check update: ${msg}`);
+    showUpdateDialog('检查更新', [{ display: '检查失败', name: '', current: '—', latest: '—', error: msg, description: msg }], '');
     return { ok: false, error: msg };
   }
 }

package/launcher/updater.js

@@ -42,6 +42,86 @@ function semverCompare(a, b) {
   return pa.pre < pb.pre ? -1 : 1; // 同为预发布,字符串序(骨架够用)
 }
 
+// ---------- 简化 semver 范围匹配(零依赖) ----------
+// 覆盖实际范围:精确/^/~/>/>=/</<=/连字符区间/空格 and/|| or/x 通配。
+// prerelease:范围无预发布标记时,预发布版本不匹配(npm 语义,^base 特判)。
+function semverRangeMatch(range, version) {
+  if (range == null || range === '') return true;
+  const v = parseVersion(version);
+  if (!v) return false;
+  return String(range).trim().split(/\s*\|\|\s*/).some((alt) => {
+    alt = alt.trim();
+    if (!alt || alt === '*' || alt === 'x' || alt === 'X') return true;
+    const h = alt.match(/^(\S+)\s+-\s+(\S+)$/);
+    if (h) return semverRangeMatch(`>=${h[1]}`, version) && semverRangeMatch(`<=${h[2]}`, version);
+    return alt.split(/\s+/).every((p) => matchSingle(p, version));
+  });
+}
+function matchSingle(p, version) {
+  const m = p.match(/^(>=|<=|>|<|=|~|\^)?(.+)$/);
+  const op = m[1] || '=';
+  const rv = parseVersion(m[2]);
+  if (!rv) {
+    if (/[xX*]/.test(m[2])) return matchX(op, m[2], version);
+    return false;
+  }
+  const c = () => semverCompare(version, m[2]);
+  switch (op) {
+    case '=': return c() === 0;
+    case '>': return c() > 0;
+    case '>=': return c() >= 0;
+    case '<': return c() < 0;
+    case '<=': return c() <= 0;
+    case '~': {
+      const parts = m[2].split('.');
+      const upper = parts.length >= 2 ? `${rv.num[0]}.${rv.num[1] + 1}.0` : `${rv.num[0] + 1}.0.0`;
+      return semverCompare(version, m[2]) >= 0 && semverCompare(version, upper) < 0;
+    }
+    case '^': {
+      let upper;
+      if (rv.num[0] > 0) upper = `${rv.num[0] + 1}.0.0`;
+      else if (rv.num[1] > 0) upper = `0.${rv.num[1] + 1}.0`;
+      else upper = `0.0.${rv.num[2] + 1}`;
+      const ge = semverCompare(version, m[2]) >= 0;
+      const lt = semverCompare(version, upper) < 0;
+      if (ge && lt && !rv.pre) {
+        const vp = parseVersion(version);
+        if (vp && vp.pre && semverCompare(version, m[2]) !== 0) return false;
+      }
+      return ge && lt;
+    }
+  }
+  return false;
+}
+function matchX(op, x, version) {
+  const parts = x.replace(/[xX*]/g, '0').split('.');
+  const lower = parts.join('.');
+  const upper = parts.length === 1 ? `${Number(parts[0]) + 1}.0.0` : `${parts[0]}.${Number(parts[1]) + 1}.0`;
+  return semverCompare(version, lower) >= 0 && semverCompare(version, upper) < 0;
+}
+// 范围的下界版本(实际安装的最小版本):^0.1.1-rc.2 → 0.1.1-rc.2;>=1.0.0 → 1.0.0;* → 0.0.0
+function rangeFloor(range) {
+  const s = String(range).trim();
+  if (!s || s === '*' || s === 'x' || s === 'X') return '0.0.0';
+  let best = null;
+  for (const alt of s.split(/\s*\|\|\s*/)) {
+    let floor = null;
+    for (const p of alt.trim().split(/\s+/)) {
+      const m = p.match(/^(>=|>|=|~|\^)?(.+)$/);
+      const raw = m ? m[2] : p;
+      const v = raw.replace(/[xX*]/g, '0');
+      if (!parseVersion(v)) continue;
+      if (m && m[1] === '>') {
+        const pv = parseVersion(v);
+        if (pv) v = `${pv.num[0]}.${pv.num[1]}.${pv.num[2] + 1}`;
+      }
+      if (floor === null || semverCompare(v, floor) > 0) floor = v;
+    }
+    if (floor && (best === null || semverCompare(floor, best) > 0)) best = floor;
+  }
+  return best || '0.0.0';
+}
+
 // GET 一个 JSON(支持 http/https),带超时与体积上限。
 function fetchJson(url, timeoutMs = REQUEST_TIMEOUT_MS) {
   return new Promise((resolve, reject) => {
@@ -182,7 +262,77 @@ async function downloadUpdate(baseUrl, needList, stagingDir, onProgress) {
   return done;
 }
 
+// ---------- npm registry 检查(当前发布模式) ----------
+// 桌面壳与各 oc 插件独立发布为 npm 包,「检查更新」改为查询 npm registry 的
+// latest 版本并与本地已装版本对比,只提示不自动下载(npx dsh-oc install 负责更新)。
+
+// 查询某包在 npm registry 上的 latest 版本号。registry 默认官方源。
+async function npmLatestVersion(pkg, registry = 'https://registry.npmjs.org') {
+  const info = await npmPackageInfo(pkg, registry);
+  return info.version;
+}
+
+// 查询某包 latest 的完整信息(版本 + 描述 + 依赖声明)。
+async function npmPackageInfo(pkg, registry = 'https://registry.npmjs.org') {
+  const base = String(registry).replace(/\/+$/, '');
+  const url = base + '/' + encodeURIComponent(pkg) + '/latest';
+  const data = await fetchJson(url);
+  if (!data || !data.version) throw new Error(`npm \u672a\u8fd4\u56de ${pkg} \u7684 latest \u7248\u672c`);
+  return {
+    version: String(data.version),
+    description: (data.description || '').trim(),
+    dependencies: data.dependencies || {},
+    peerDependencies: data.peerDependencies || {},
+  };
+}
+
+// 批量检查版本。installed: [{name,current}] → [{name,current,latest,description,hasUpdate,error?}]
+// 单包查询失败不中断整体,error 字段标记。
+async function checkNpmUpdates(installed, registry = 'https://registry.npmjs.org') {
+  const out = [];
+  for (const it of installed) {
+    try {
+      const info = await npmPackageInfo(it.name, registry);
+      out.push({ name: it.name, current: it.current, latest: info.version, description: info.description, peerDependencies: info.peerDependencies, hasUpdate: semverCompare(info.version, it.current) > 0 });
+    } catch (e) {
+      out.push({ name: it.name, current: it.current, latest: null, description: '', peerDependencies: {}, hasUpdate: false, error: e && e.message ? e.message : String(e) });
+    }
+  }
+  return out;
+}
+
+// 查询某包在 npm registry 上的所有已发布版本号(数组)。
+async function npmPackageVersions(pkg, registry = 'https://registry.npmjs.org') {
+  const base = String(registry).replace(/\/+$/, '');
+  const data = await fetchJson(base + '/' + encodeURIComponent(pkg));
+  return Object.keys(data.versions || {});
+}
+
+// 判定插件(peerDependencies)是否兼容指定引擎。
+// 对插件 peerDeps 中每个 @deepseek-ai/* 包:
+//   - 引擎 deps 含该包 → 用引擎 dep 范围的下界版本测试插件范围
+//   - 引擎不含 → 通过 fetchVersions(pkg) 查 npm 该包全量版本,存在满足插件范围的版本即兼容
+//     (这些 dsh-client-* 包用 next tag 发 rc 版,latest tag 常停在早期版,不能用 /latest 判断)
+// 全部满足 → 兼容。fetchVersions: async (pkg) => [版本字符串,...]
+async function checkEngineCompat(pluginPeerDeps, engineDeps, fetchVersions) {
+  const scope = Object.keys(pluginPeerDeps || {}).filter((k) => k.startsWith('@deepseek-ai/'));
+  if (scope.length === 0) return true;
+  for (const k of scope) {
+    const needRange = pluginPeerDeps[k];
+    if (engineDeps && engineDeps[k]) {
+      if (!semverRangeMatch(needRange, rangeFloor(engineDeps[k]))) return false;
+      continue;
+    }
+    if (typeof fetchVersions !== 'function') return false;
+    let versions = [];
+    try { versions = await fetchVersions(k); } catch { return false; }
+    if (!versions.some((v) => semverRangeMatch(needRange, v))) return false;
+  }
+  return true;
+}
+
 module.exports = {
-  parseVersion, semverCompare, fetchJson, checkForUpdates, hashFile, diffLocal,
-  downloadFile, downloadUpdate,
+  parseVersion, semverCompare, semverRangeMatch, rangeFloor, fetchJson, checkForUpdates,
+  hashFile, diffLocal, downloadFile, downloadUpdate, npmLatestVersion, npmPackageInfo,
+  npmPackageVersions, checkNpmUpdates, checkEngineCompat,
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-oc-desktop",
   "productName": "DeepSeek Harness Desktop",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "DeepSeek Harness 桌面端插件(Electron 启动器):自绘标题栏/托盘/通知/快捷键/崩溃自愈",
   "main": "launcher/main.js",
   "bin": {
@@ -9,9 +9,9 @@
   },
   "scripts": {
     "start": "electron .",
-    "test": "node --check launcher/main.js && node --check launcher/preload.js && node --check launcher/events.js && node --check launcher/session-window.js && node --check launcher/updater.js && node --check launcher/apply-update.js && node --check bin/dsh-desktop.cjs && node scripts/test.mjs"
+    "test": "node --check launcher/main.js && node --check launcher/preload.js && node --check launcher/dialog-preload.js && node --check launcher/events.js && node --check launcher/session-window.js && node --check launcher/updater.js && node --check launcher/apply-update.js && node --check bin/dsh-desktop.cjs && node scripts/test.mjs && node scripts/test-updater.mjs"
   },
-  "devDependencies": {
+  "dependencies": {
     "electron": "^43.4.0"
   },
   "files": ["launcher", "bin", "assets", "scripts"],

package/scripts/set-exe-icon.ps1

@@ -0,0 +1,275 @@
+param(
+  [string]$Exe = (Join-Path (Split-Path $PSScriptRoot -Parent) 'node_modules\electron\dist\electron.exe'),
+  [string]$Ico = (Join-Path (Split-Path $PSScriptRoot -Parent) 'assets\icon.ico')
+)
+$ErrorActionPreference = 'Stop'
+
+$cs = @"
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.InteropServices;
+
+public static class ExeIconSet {
+  [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
+  static extern IntPtr BeginUpdateResource(string pFileName, bool bDeleteExistingResources);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern bool UpdateResource(IntPtr hUpdate, IntPtr lpType, IntPtr lpName, ushort wLanguage, IntPtr lpData, uint cbData);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern bool EndUpdateResource(IntPtr hUpdate, bool fDiscard);
+  [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
+  static extern IntPtr LoadLibraryEx(string lpFileName, IntPtr hFile, uint dwFlags);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern bool FreeLibrary(IntPtr hModule);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern bool EnumResourceNames(IntPtr hModule, IntPtr lpType, EnumResNameProc lpEnumFunc, IntPtr lParam);
+  delegate bool EnumResNameProc(IntPtr hModule, IntPtr lpType, IntPtr lpName, IntPtr lParam);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern IntPtr FindResourceEx(IntPtr hModule, IntPtr lpType, IntPtr lpName, ushort wLanguage);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern IntPtr LoadResource(IntPtr hModule, IntPtr hResInfo);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern uint SizeofResource(IntPtr hModule, IntPtr hResInfo);
+  [DllImport("kernel32.dll", SetLastError=true)]
+  static extern IntPtr LockResource(IntPtr hResData);
+
+  const int RT_ICON = 3;
+  const int RT_GROUP_ICON = 14;
+  const int RT_VERSION = 16;
+  const int LOAD_LIBRARY_AS_DATAFILE = 0x00000002;
+
+  static IntPtr MakeIntResource(ushort w) { return new IntPtr(w); }
+  static bool IsInt(IntPtr p) { return ((long)p >> 16) == 0; }
+
+  static List<IntPtr> EnumType(IntPtr hMod, int type) {
+    var names = new List<IntPtr>();
+    EnumResourceNames(hMod, MakeIntResource((ushort)type),
+      (h, t, n, l) => { names.Add(n); return true; }, IntPtr.Zero);
+    return names;
+  }
+
+  public static int SetIcon(string exePath, string icoPath) {
+    var ico = File.ReadAllBytes(icoPath);
+    if (ico.Length < 6) return -1;
+    int count = BitConverter.ToUInt16(ico, 4);
+    if (count < 1 || count > 64) return -2;
+    int off = 6;
+    var entries = new List<byte[]>();
+    for (int i = 0; i < count; i++) {
+      if (off + 16 > ico.Length) return -3;
+      int dataOff = BitConverter.ToInt32(ico, off + 12);
+      int dataLen = BitConverter.ToInt32(ico, off + 8);
+      if (dataOff + dataLen > ico.Length) return -4;
+      entries.Add(ico.SubArray(dataOff, dataLen));
+      off += 16;
+    }
+    // collect existing icon resource names so we can delete them all
+    var hLib = LoadLibraryEx(exePath, IntPtr.Zero, LOAD_LIBRARY_AS_DATAFILE);
+    if (hLib == IntPtr.Zero) return -5;
+    var icons = EnumType(hLib, RT_ICON);
+    var groups = EnumType(hLib, RT_GROUP_ICON);
+    FreeLibrary(hLib);
+
+    var hUpd = BeginUpdateResource(exePath, false);
+    if (hUpd == IntPtr.Zero) return -6;
+
+    // OVERWRITE (no delete): UpdateResource replaces same-name+lang resources.
+    // The exe ships RT_ICON #1..#N and RT_GROUP_ICON #1, we reuse those ids so the
+    // group icon keeps resolving; extra frames get new ids.
+
+    // write new RT_ICON resources, ids 1..N
+    var ids = new List<int>();
+    for (int i = 0; i < entries.Count; i++) {
+      int id = i + 1;
+      ids.Add(id);
+      byte[] data = entries[i];
+      IntPtr pData = Marshal.AllocHGlobal(data.Length);
+      try {
+        Marshal.Copy(data, 0, pData, data.Length);
+        if (!UpdateResource(hUpd, MakeIntResource(RT_ICON), MakeIntResource((ushort)id), 1033, pData, (uint)data.Length))
+          return -1000 - Marshal.GetLastWin32Error();
+      } finally { Marshal.FreeHGlobal(pData); }
+    }
+
+    // build GRPICONDIR
+    var grp = new List<byte>();
+    grp.AddRange(BitConverter.GetBytes((ushort)0));      // idReserved
+    grp.AddRange(BitConverter.GetBytes((ushort)1));      // idType = icon
+    grp.AddRange(BitConverter.GetBytes((ushort)count));  // idCount
+    off = 6;
+    for (int i = 0; i < count; i++) {
+      byte w = ico[off], h = ico[off + 1];
+      byte colorCount = ico[off + 2], res = ico[off + 3];
+      ushort planes = BitConverter.ToUInt16(ico, off + 4);
+      ushort bitCount = BitConverter.ToUInt16(ico, off + 6);
+      int dataLen = BitConverter.ToInt32(ico, off + 8);
+      grp.Add(w); grp.Add(h); grp.Add(colorCount); grp.Add(res);
+      grp.AddRange(BitConverter.GetBytes(planes));
+      grp.AddRange(BitConverter.GetBytes(bitCount));
+      grp.AddRange(BitConverter.GetBytes((uint)dataLen));
+      grp.AddRange(BitConverter.GetBytes((ushort)ids[i]));
+      off += 16;
+    }
+    byte[] gdata = grp.ToArray();
+    IntPtr pGrp = Marshal.AllocHGlobal(gdata.Length);
+    try {
+      Marshal.Copy(gdata, 0, pGrp, gdata.Length);
+      if (!UpdateResource(hUpd, MakeIntResource(RT_GROUP_ICON), MakeIntResource(1), 1033, pGrp, (uint)gdata.Length))
+        return -8;
+    } finally { Marshal.FreeHGlobal(pGrp); }
+
+    if (!EndUpdateResource(hUpd, false)) return -9;
+    return 0;
+  }
+
+  // Patch ProductName / FileDescription in the RT_VERSION resource so the Task
+  // Manager shows "DSH Desktop" instead of "Electron".
+  public static int SetVersion(string exePath, string product, string desc) {
+    var hLib = LoadLibraryEx(exePath, IntPtr.Zero, LOAD_LIBRARY_AS_DATAFILE);
+    if (hLib == IntPtr.Zero) return -50;
+    IntPtr hRes = FindResourceEx(hLib, MakeIntResource(RT_VERSION), MakeIntResource(1), 1033);
+    if (hRes == IntPtr.Zero) { FreeLibrary(hLib); return -51; }
+    uint size = SizeofResource(hLib, hRes);
+    IntPtr pLocked = LockResource(LoadResource(hLib, hRes));
+    if (pLocked == IntPtr.Zero || size == 0) { FreeLibrary(hLib); return -52; }
+    byte[] data = new byte[size];
+    Marshal.Copy(pLocked, data, 0, (int)size);
+    FreeLibrary(hLib);
+
+    byte[] patched = ViPatch.Patch(data, product, desc);
+    var hUpd = BeginUpdateResource(exePath, false);
+    if (hUpd == IntPtr.Zero) return -53;
+    IntPtr p = Marshal.AllocHGlobal(patched.Length);
+    try {
+      Marshal.Copy(patched, 0, p, patched.Length);
+      if (!UpdateResource(hUpd, MakeIntResource(RT_VERSION), MakeIntResource(1), 1033, p, (uint)patched.Length))
+        return -1000 - Marshal.GetLastWin32Error();
+    } finally { Marshal.FreeHGlobal(p); }
+    if (!EndUpdateResource(hUpd, false)) return -2000 - Marshal.GetLastWin32Error();
+    return 0;
+  }
+
+  static void DeleteRes(IntPtr hUpd, int type, IntPtr name) {
+    UpdateResource(hUpd, MakeIntResource((ushort)type), name, 0, IntPtr.Zero, 0);
+  }
+}
+
+// VERSIONINFO tree parser/rebuilder (keeps every other string, replaces
+// ProductName / FileDescription). Layout per MS-VERSIONINFO.
+public static class ViPatch {
+  public class Block {
+    public ushort wValueLength;
+    public ushort wType;
+    public string szKey = "";
+    public byte[] value;
+    public List<Block> children = new List<Block>();
+  }
+
+  static int Align4(int v) { int r = v % 4; return r == 0 ? v : v + (4 - r); }
+
+  static int ReadBlock(byte[] d, int off, out Block b) {
+    b = new Block();
+    ushort wLength = BitConverter.ToUInt16(d, off);
+    b.wValueLength = BitConverter.ToUInt16(d, off + 2);
+    b.wType = BitConverter.ToUInt16(d, off + 4);
+    int p = off + 6;
+    int ks = p;
+    while (BitConverter.ToUInt16(d, p) != 0) p += 2;
+    b.szKey = System.Text.Encoding.Unicode.GetString(d, ks, p - ks);
+    p += 2;
+    while ((p - off) % 4 != 0) p++;
+    bool leaf = b.wValueLength > 0 && b.szKey != "VS_VERSION_INFO";
+    if (b.wValueLength > 0) {
+      // VS_FIXEDFILEINFO (root) stores bytes; String/Var leaves store the value
+      // up to the block end (their wValueLength counts UTF-16 units for Strings).
+      int vbytes = (b.szKey == "VS_VERSION_INFO") ? b.wValueLength : ((off + wLength) - p);
+      b.value = new byte[vbytes];
+      Array.Copy(d, p, b.value, 0, vbytes);
+      p += vbytes;
+      while ((p - off) % 4 != 0) p++;
+    }
+    // Sibling blocks are aligned to 4 bytes; the block's wLength ends at its
+    // content tail, so the next block starts at align4(off + wLength).
+    int next = Align4(off + wLength);
+    if (leaf) return next;
+    int guard = 0;
+    while (p < Align4(off + wLength) && guard++ < 256) {
+      Block c;
+      p = ReadBlock(d, p, out c);
+      b.children.Add(c);
+    }
+    return next;
+  }
+
+  static int CalcLen(Block b) {
+    int len = 6 + (b.szKey.Length + 1) * 2;
+    while (len % 4 != 0) len++;
+    if (b.value != null && b.value.Length > 0) {
+      len += b.value.Length;
+      while (len % 4 != 0) len++;
+    }
+    foreach (var c in b.children) {
+      len += CalcLen(c);
+      while (len % 4 != 0) len++; // pad each child block end to a 4-byte boundary
+    }
+    return len;
+  }
+
+  static void WriteBlock(BinaryWriter w, Block b) {
+    long start = w.BaseStream.Position;
+    w.Write((ushort)0); // wLength placeholder, patched after children are written
+    w.Write(b.wValueLength);
+    w.Write(b.wType);
+    w.Write(System.Text.Encoding.Unicode.GetBytes(b.szKey + "\0"));
+    while ((w.BaseStream.Position - start) % 4 != 0) w.Write((byte)0);
+    if (b.value != null && b.value.Length > 0) {
+      w.Write(b.value);
+      while ((w.BaseStream.Position - start) % 4 != 0) w.Write((byte)0);
+    }
+    foreach (var c in b.children) {
+      WriteBlock(w, c);
+      while ((w.BaseStream.Position - start) % 4 != 0) w.Write((byte)0);
+    }
+    long end = w.BaseStream.Position;
+    long pos = w.BaseStream.Position;
+    w.BaseStream.Position = start;
+    w.Write((ushort)(end - start));
+    w.BaseStream.Position = pos;
+  }
+
+  public static byte[] Patch(byte[] data, string product, string desc) {
+    Block root;
+    ReadBlock(data, 0, out root);
+    foreach (var sfi in root.children) {
+      if (sfi.szKey != "StringFileInfo") continue;
+      foreach (var st in sfi.children) {
+        foreach (var s in st.children) {
+          if (s.szKey == "ProductName" && product != null) { s.value = System.Text.Encoding.Unicode.GetBytes(product + "\0"); s.wValueLength = (ushort)(s.value.Length / 2); }
+          else if (s.szKey == "FileDescription" && desc != null) { s.value = System.Text.Encoding.Unicode.GetBytes(desc + "\0"); s.wValueLength = (ushort)(s.value.Length / 2); }
+        }
+      }
+    }
+    using (var ms = new MemoryStream()) {
+      var w = new BinaryWriter(ms);
+      WriteBlock(w, root);
+      w.Flush();
+      return ms.ToArray();
+    }
+  }
+}
+
+public static class Ext {
+  public static byte[] SubArray(this byte[] src, int start, int len) {
+    var d = new byte[len];
+    Array.Copy(src, start, d, 0, len);
+    return d;
+  }
+}
+"@
+
+Add-Type -TypeDefinition $cs -Language CSharp
+Write-Host "processing $Exe with $Ico"
+$code = [ExeIconSet]::SetIcon($Exe, $Ico)
+Write-Host "SetIcon exit=$code (0=ok)"
+$vcode = [ExeIconSet]::SetVersion($Exe, 'DSH Desktop', 'DSH Desktop')
+Write-Host "SetVersion exit=$vcode (0=ok)"

package/scripts/test-updater.mjs

@@ -0,0 +1,100 @@
+// updater npm-registry checks: local http server mocking the npm /pkg/latest endpoint.
+import assert from "node:assert";
+import http from "node:http";
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+const { npmLatestVersion, npmPackageVersions, checkNpmUpdates, checkEngineCompat, semverRangeMatch, rangeFloor, semverCompare, parseVersion } = require("../launcher/updater.js");
+
+// 1. pure version compare logic
+assert.strictEqual(parseVersion("0.3.6").num.join("."), "0.3.6");
+assert.strictEqual(semverCompare("0.3.7", "0.3.6"), 1);
+assert.strictEqual(semverCompare("0.3.6", "0.3.6"), 0);
+assert.strictEqual(semverCompare("0.3.6", "0.4.0"), -1);
+assert.strictEqual(semverCompare("0.3.7-rc.1", "0.3.7"), -1); // prerelease < release
+
+// 2. semver range matching (the compat checks rely on it)
+assert.strictEqual(semverRangeMatch("^4.0.1", "4.0.1"), true);
+assert.strictEqual(semverRangeMatch("^4.0.1", "4.2.0"), true);
+assert.strictEqual(semverRangeMatch("^4.0.1", "5.0.0"), false);
+assert.strictEqual(semverRangeMatch("^0.1.0-rc.6", "0.1.1-rc.2"), true); // caret w/ prerelease
+assert.strictEqual(semverRangeMatch("^0.1.0-rc.6", "0.1.0-rc.6"), true);
+assert.strictEqual(semverRangeMatch("^0.1.0-rc.6", "0.2.0"), false);
+assert.strictEqual(semverRangeMatch("^1.0.0", "1.0.0-rc.1"), false); // release range vs prerelease
+assert.strictEqual(semverRangeMatch(">=0.1.0", "0.1.5"), true);
+assert.strictEqual(semverRangeMatch("1.2.x", "1.2.5"), true);
+assert.strictEqual(semverRangeMatch("1.2.x", "1.3.0"), false);
+assert.strictEqual(semverRangeMatch("*", "9.9.9"), true);
+assert.strictEqual(rangeFloor("^0.1.1-rc.2"), "0.1.1-rc.2");
+assert.strictEqual(rangeFloor(">=1.0.0"), "1.0.0");
+
+// 3. local registry mock: /pkg/latest for metadata, /pkg for the full version list
+const registry = http.createServer((req, res) => {
+  const url = req.url || "";
+  if (url.endsWith("/latest")) {
+    const m = url.match(/^\/([^/]+)\/latest$/);
+    if (!m) { res.writeHead(404); return res.end(); }
+    const pkg = decodeURIComponent(m[1]);
+    const meta = {
+      "dsh-oc-desktop": { v: "0.3.7", d: "mock desktop pkg", peer: { "@deepseek-ai/cordis": "^4.0.1" } },
+      "dsh-oc-sidebar": { v: "0.15.0", d: "mock sidebar pkg", peer: { "@deepseek-ai/cordis": "^4.0.1" } },
+      "@deepseek-ai/dsh": { v: "0.1.2", d: "mock engine" },
+      "@deepseek-ai/cordis": { v: "4.2.0", d: "cordis" },
+      "@deepseek-ai/dsh-client-locale": { v: "0.0.1-rc.1", d: "locale", peer: {} },
+    };
+    if (!meta[pkg]) { res.writeHead(404); return res.end("not found"); }
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ name: pkg, version: meta[pkg].v, description: meta[pkg].d, peerDependencies: meta[pkg].peer || {} }));
+    return;
+  }
+  // full package doc: { versions: { "1.0.0": {...}, ... } }
+  const m = url.match(/^\/([^/]+)$/);
+  if (!m) { res.writeHead(404); return res.end(); }
+  const pkg = decodeURIComponent(m[1]);
+  const all = {
+    "@deepseek-ai/cordis": ["4.0.1", "4.2.0"],
+    "@deepseek-ai/dsh-client-locale": ["0.0.1-rc.1", "0.1.0-rc.6", "0.1.1-rc.2"],
+    "@deepseek-ai/missing-pkg": null,
+  };
+  if (!all[pkg]) { res.writeHead(404); return res.end("not found"); }
+  const versions = {};
+  for (const v of all[pkg]) versions[v] = { version: v };
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ versions }));
+});
+await new Promise((r) => registry.listen(0, "127.0.0.1", r));
+const base = `http://127.0.0.1:${registry.address().port}`;
+
+// npmLatestVersion resolves the latest tag
+assert.strictEqual(await npmLatestVersion("dsh-oc-desktop", base), "0.3.7");
+// scoped package name is URL-encoded (encodeURIComponent keeps @ and / escaped)
+assert.strictEqual(await npmLatestVersion("@deepseek-ai/dsh", base), "0.1.2");
+// unknown package -> throws
+await assert.rejects(npmLatestVersion("missing-pkg", base));
+
+// checkNpmUpdates: marks hasUpdate, tolerates per-package errors
+const results = await checkNpmUpdates(
+  [{ name: "dsh-oc-desktop", current: "0.3.6" }, { name: "dsh-oc-sidebar", current: "0.15.0" }, { name: "missing-pkg", current: "1.0.0" }],
+  base
+);
+const byName = Object.fromEntries(results.map((r) => [r.name, r]));
+assert.strictEqual(byName["dsh-oc-desktop"].hasUpdate, true);
+assert.strictEqual(byName["dsh-oc-desktop"].latest, "0.3.7");
+assert.strictEqual(byName["dsh-oc-desktop"].description, "mock desktop pkg");
+assert.strictEqual(byName["dsh-oc-sidebar"].hasUpdate, false);
+assert.strictEqual(byName["missing-pkg"].error, "更新服务器返回 HTTP 404");
+assert.strictEqual(byName["missing-pkg"].hasUpdate, false);
+
+// 4. engine compat: plugin peerDeps vs engine deps (or full npm version list)
+const fetchVersions = async (p) => (await npmPackageVersions(p, base));
+const engineDeps = { "@deepseek-ai/cordis": "^4.0.1" };
+assert.strictEqual(await checkEngineCompat({ "@deepseek-ai/cordis": "^4.0.1" }, engineDeps, fetchVersions), true);
+assert.strictEqual(await checkEngineCompat({ "@deepseek-ai/cordis": "^3.0.0" }, engineDeps, fetchVersions), false);
+// latest tag is 0.0.1-rc.1 but the full version list has 0.1.0-rc.6 (next tag) — compatible
+assert.strictEqual(await checkEngineCompat({ "@deepseek-ai/cordis": "^4.0.1", "@deepseek-ai/dsh-client-locale": "^0.1.0-rc.6" }, engineDeps, fetchVersions), true);
+// engine-independent package with no satisfying version -> incompatible
+assert.strictEqual(await checkEngineCompat({ "@deepseek-ai/cordis": "^4.0.1", "@deepseek-ai/missing-pkg": "^1.0.0" }, engineDeps, fetchVersions), false);
+// package not in engine deps but its versions satisfy the plugin range
+assert.strictEqual(await checkEngineCompat({ "@deepseek-ai/cordis": "^4.0.1" }, {}, fetchVersions), true);
+
+registry.close();
+console.log("updater tests passed");