dsh-packycode-api 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.0.4
+
+- Settings can check for and install a newer npm release. **Update plugin** installs the exact published version into the owning profile with the host's bundled pnpm, then reads `package.json` back before reporting success. A `link:` checkout is left alone. The desktop app still needs a full restart afterwards.
+- The update runs with `minimumReleaseAge=0`, so neither a fresh release of this plugin nor a fresh release of a sibling plugin already in the profile lockfile blocks it. The README FAQ explains the `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` that a Plugins-page install can still hit.
+
 ## 1.0.3
 
 - The Claude CLI timeout test holds the event loop open. The runner unrefs its timer and the test stub is not a real process, so Node 22's test runner cancelled the still-pending test and stopped the publish workflow. Plugin behavior is unchanged. `1.0.2` was tagged but not published.

package/README.en.md

@@ -42,7 +42,7 @@ Open the desktop application's **Plugins** page, click **Add plugin**, and enter
 dsh-packycode-api
 ```
 
-Choose the **official** install source, then click **Install**. To pin a version, enter `dsh-packycode-api@1.0.3`.
+Choose the **official** install source, then click **Install**. To pin a version, enter `dsh-packycode-api@1.0.4`.
 
 Then **manually restart the desktop application**. Refreshing the page does not reload the plugin inside the Host process.
 
@@ -61,7 +61,7 @@ Choose a model from the `PackyCode` group. `deepseek-flash` and `gpt-6.1-sol` wo
 
 The **Plugins** page shows the installed state and version, and is also where you enable, disable, or uninstall.
 
-**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.0.3`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
+**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.0.4`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
 
 A local checkout can be linked with `dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`.
 
@@ -117,7 +117,7 @@ A model in the list does not mean the current token group allows it. When changi
 
 ## Update and uninstall
 
-**Update:** on the desktop **Plugins** page, install `dsh-packycode-api` again (or `dsh-packycode-api@version`), then quit and reopen the desktop application. A page refresh does not reload the Host.
+**Update:** open **Settings → PackyCode** and, when a newer version is listed, click **Update plugin**. It installs that exact version into the owning profile with DSH's bundled pnpm and reads `package.json` back before reporting success. A local `link:` checkout does not get the button. Then quit and reopen the desktop application. A page refresh does not reload the Host. Reinstalling `dsh-packycode-api` from the **Plugins** page does the same job.
 
 **Uninstall:** remove this plugin on the **Plugins** page, then restart the desktop application. Uninstalling does not remove other plugins, the profile, or the token in the PackyCode console.
 
@@ -129,6 +129,8 @@ A model in the list does not mean the current token group allows it. When changi
 
 **A rate limit disabled the key?** It should not. HTTP 429 does not rotate. Exhausted quota or HTTP 401 does; after a top-up, click **Re-enable**.
 
+**Installing from the Plugins page fails with `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`?** pnpm refuses packages published less than 24 hours ago and checks the whole profile lockfile. The package it names is often another plugin that was just updated, not this one. Retry once it is 24 hours old, or add the reported `name@version` under `minimumReleaseAgeExclude` in the profile's `pnpm-workspace.yaml`. Once this plugin is installed, **Update plugin** in Settings is not subject to that check.
+
 **The CLI is installed, but Claude still fails?** A host launched from Finder or the Start menu usually has a shorter `PATH` than a terminal. The plugin also checks the official install location, common package-manager directories, and `npm prefix -g`. If it still cannot find the binary, set `claudeCliPath` or click **Check again**. After a Host change or a reinstall, quit and reopen the desktop application.
 
 ## Security and scope

package/README.md

@@ -42,7 +42,7 @@
 dsh-packycode-api
 ```
 
-在**安装源**中选择**官方源**，然后点击**安装**。需要固定版本时填入 `dsh-packycode-api@1.0.3`。
+在**安装源**中选择**官方源**，然后点击**安装**。需要固定版本时填入 `dsh-packycode-api@1.0.4`。
 
 完成后**手动重启桌面应用**。仅刷新页面不会重新加载 Host 里的插件。
 
@@ -61,7 +61,7 @@ dsh-packycode-api
 
 桌面应用的**插件**页可以看到已安装状态与版本，也可以在那里启用、停用或卸载。
 
-**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.0.3`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
+**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.0.4`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
 
 本地开发可以用绝对路径：`dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`。
 
@@ -117,7 +117,7 @@ dsh-packycode-api
 
 ## 更新与卸载
 
-**更新：** 在桌面应用的**插件**页重新安装 `dsh-packycode-api`（或 `dsh-packycode-api@版本`），然后完全退出并重新打开桌面应用。只刷新页面不会重载 Host。
+**更新：** 打开 **设置 → PackyCode**，有新版本时点「更新插件」。它会在当前 profile 目录里用 DSH 自带的 pnpm 安装精确版本，并读回 `package.json` 确认版本落地。本地 `link:` 开发安装不会出现这个按钮。完成后完全退出并重新打开桌面应用。只刷新页面不会重载 Host。也可以在**插件**页重新安装 `dsh-packycode-api`。
 
 **卸载：** 在**插件**页卸载本插件，然后重启桌面应用。卸载不会删除其它插件、整个 profile，也不会撤销 PackyCode 控制台里的令牌。
 
@@ -129,6 +129,8 @@ dsh-packycode-api
 
 **限速之后 Key 被停用了？** 不该发生。429 不会切换 Key。额度用尽或 401 才会停用；充值后点「重新启用」。
 
+**插件页安装报 `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`？** pnpm 默认拒绝发布不满 24 小时的包，并且会检查 profile 里的整个 lockfile。报错里点名的往往是另一个刚更新过的插件，不是本插件。等它发布满 24 小时再重试，或把报错里的 `包名@版本` 加到 profile 目录 `pnpm-workspace.yaml` 的 `minimumReleaseAgeExclude` 下。已安装本插件后，设置页的「更新插件」不受这个限制。
+
 **装了 CLI 还是不能用 Claude？** 从 Finder 或开始菜单启动时，`PATH` 往往比终端短。插件会再查官方安装位置、常见包管理器目录和 `npm prefix -g`。仍找不到就在设置里填 `claudeCliPath`，或点「重新检测」。改的是 Host 或重新安装了插件时，要完全退出并重启桌面应用。
 
 ## 安全边界

package/lib/client.js

@@ -163,7 +163,26 @@ window.__ModuleLoader__.load({
 			cliNetwork: "下载失败，请检查网络或 npm 镜像设置后重试。",
 			cliTimeout: "安装超时，请检查网络后重试。",
 			cliNotFoundAfterInstall: "npm 显示安装完成，但仍找不到 claude 命令。请在终端执行 claude --version 确认，然后点「重新检测」。",
-			cliWindowsNote: "Windows 上 Claude Code 还需要 Git for Windows（https://git-scm.com/downloads/win）。"
+			cliWindowsNote: "Windows 上 Claude Code 还需要 Git for Windows（https://git-scm.com/downloads/win）。",
+			versionTitle: "插件版本",
+			versionCurrent: "当前版本",
+			versionLatest: "最新版本",
+			versionCheck: "检查更新",
+			versionChecking: "正在检查更新…",
+			versionFailed: "无法检查最新版本。",
+			versionUpToDate: "已是最新版本。",
+			versionAvailable: "发现新版本 v{version}。",
+			versionLinked: "当前是本地开发安装，请在插件仓库拉取代码并重新构建。",
+			versionManual: "无法在这里更新。请在桌面应用的插件页重新安装 dsh-packycode-api。",
+			versionUpdate: "更新插件",
+			versionUpdating: "正在更新…",
+			versionUpdateFailed: "更新失败，请重试，或在插件页重新安装。",
+			versionUpdated: "已更新到 v{version}。",
+			versionUpdatedHint: "新版本需要完全退出并重新打开桌面应用才会生效；只刷新页面不会重载 Host 里的插件。",
+			versionRestart: "如何重启",
+			versionRestartHint: "插件无法安全地重启桌面应用。请完全退出 DSH，再重新打开。",
+			versionRefresh: "刷新界面",
+			versionLater: "稍后"
 		};
 		const en = {
 			nav: "PackyCode",
@@ -234,7 +253,26 @@ window.__ModuleLoader__.load({
 			cliNetwork: "The download failed. Check your network or npm registry settings and retry.",
 			cliTimeout: "The install timed out. Check your network and retry.",
 			cliNotFoundAfterInstall: "npm reported success, but the claude command still cannot be found. Run claude --version in a terminal, then click Check again.",
-			cliWindowsNote: "On Windows, Claude Code also needs Git for Windows (https://git-scm.com/downloads/win)."
+			cliWindowsNote: "On Windows, Claude Code also needs Git for Windows (https://git-scm.com/downloads/win).",
+			versionTitle: "Plugin version",
+			versionCurrent: "Current version",
+			versionLatest: "Latest version",
+			versionCheck: "Check for updates",
+			versionChecking: "Checking for updates…",
+			versionFailed: "Could not check the latest version.",
+			versionUpToDate: "You are on the latest version.",
+			versionAvailable: "A new version v{version} is available.",
+			versionLinked: "Installed from a local checkout. Pull and rebuild the plugin repository instead.",
+			versionManual: "This install cannot be updated here. Reinstall dsh-packycode-api from the desktop Plugins page.",
+			versionUpdate: "Update plugin",
+			versionUpdating: "Updating…",
+			versionUpdateFailed: "The update failed. Try again, or reinstall from the Plugins page.",
+			versionUpdated: "Updated to v{version}.",
+			versionUpdatedHint: "Quit and reopen the desktop application. Refreshing the page does not reload the plugin inside the Host.",
+			versionRestart: "How to restart",
+			versionRestartHint: "The plugin cannot safely restart the desktop application. Quit DSH completely, then open it again.",
+			versionRefresh: "Refresh page",
+			versionLater: "Later"
 		};
 		const STYLE = `
 .packyCodeSection{display:flex;flex-direction:column;gap:16px;font-size:13px;line-height:20px}
@@ -269,6 +307,9 @@ window.__ModuleLoader__.load({
 .packyCodeWarning{color:var(--dsw-alias-state-warning-primary,#c27c0e);font-weight:500}
 .packyCodeDetail{margin:0;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform);color:var(--dsw-alias-label-secondary);font-size:12px;line-height:18px;white-space:pre-wrap;word-break:break-all;max-height:160px;overflow:auto}
 .packyCodeMono{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;word-break:break-all}
+.packyCodeVersionRows{display:flex;flex-direction:column;gap:6px}
+.packyCodeVersionRow{display:flex;justify-content:space-between;gap:12px}
+.packyCodeVersionValue{font-variant-numeric:tabular-nums;font-weight:600}
 .packyCodeComposer{display:inline-flex;align-items:center;flex:0 0 auto;height:28px;box-sizing:border-box;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:20px;font-weight:500;font-variant-numeric:tabular-nums;white-space:nowrap;user-select:none}
 @media(max-width:640px){.packyCodeRow{align-items:flex-start;flex-direction:column}.packyCodeActions{width:100%}}
 `;
@@ -451,6 +492,156 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		function VersionCard({ call, t }) {
+			const [info, setInfo] = react.useState();
+			const [loading, setLoading] = react.useState(true);
+			const [error, setError] = react.useState(false);
+			const [updating, setUpdating] = react.useState(false);
+			const [updateFailed, setUpdateFailed] = react.useState(false);
+			const [updated, setUpdated] = react.useState();
+			const [restartHint, setRestartHint] = react.useState(false);
+			const generation = react.useRef(0);
+			const load = (force) => {
+				const current = ++generation.current;
+				setLoading(true);
+				setError(false);
+				call("plugin/version", { force }).then((value) => {
+					if (generation.current === current) setInfo(value);
+				}).catch(() => {
+					if (generation.current === current) setError(true);
+				}).finally(() => {
+					if (generation.current === current) setLoading(false);
+				});
+			};
+			react.useEffect(() => {
+				load(false);
+				return () => {
+					generation.current += 1;
+				};
+			}, []);
+			const update = () => {
+				setUpdating(true);
+				setUpdateFailed(false);
+				call("plugin/update").then((value) => {
+					setUpdated(value);
+					setRestartHint(false);
+				}).catch(() => setUpdateFailed(true)).finally(() => setUpdating(false));
+			};
+			const installKind = info?.install?.kind;
+			const showStatus = info !== void 0 && updated === void 0;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: "packyCodeCard",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("header", {
+						className: "packyCodeCardHeader",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "packyCodeCardTitle",
+							children: t("versionTitle")
+						}), updated === void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "packyCodeButton",
+							disabled: loading || updating,
+							onClick: () => load(true),
+							children: loading ? t("versionChecking") : t("versionCheck")
+						})]
+					}),
+					loading && info === void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "packyCodeNote",
+						role: "status",
+						children: t("versionChecking")
+					}),
+					error && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "packyCodeError",
+						role: "alert",
+						children: t("versionFailed")
+					}),
+					info !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "packyCodeVersionRows",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "packyCodeVersionRow",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("versionCurrent") }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "packyCodeVersionValue",
+								children: ["v", info.current]
+							})]
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "packyCodeVersionRow",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("versionLatest") }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "packyCodeVersionValue",
+								children: ["v", info.latest]
+							})]
+						})]
+					}),
+					showStatus && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "packyCodeNote",
+						role: "status",
+						children: info.updateAvailable ? t("versionAvailable").replace("{version}", info.latest) : t("versionUpToDate")
+					}),
+					showStatus && info.updateAvailable && installKind === "npm" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "packyCodeActions",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "packyCodeButton packyCodeButtonPrimary",
+							disabled: updating,
+							onClick: update,
+							children: updating ? t("versionUpdating") : t("versionUpdate")
+						})
+					}),
+					showStatus && installKind === "link" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "packyCodeNote",
+						children: t("versionLinked")
+					}),
+					showStatus && info.updateAvailable && installKind === "unknown" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "packyCodeNote",
+						children: t("versionManual")
+					}),
+					updateFailed && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: "packyCodeError",
+						role: "alert",
+						children: t("versionUpdateFailed")
+					}),
+					updated !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						role: "status",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "packyCodeNote",
+								children: t("versionUpdated").replace("{version}", updated.version)
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "packyCodeNote",
+								children: t("versionUpdatedHint")
+							}),
+							restartHint && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "packyCodeNote",
+								children: t("versionRestartHint")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "packyCodeActions",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "packyCodeButton",
+										onClick: () => setRestartHint(true),
+										children: t("versionRestart")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "packyCodeButton packyCodeButtonPrimary",
+										onClick: () => window.location.reload(),
+										children: t("versionRefresh")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										className: "packyCodeButton",
+										onClick: () => setUpdated(void 0),
+										children: t("versionLater")
+									})
+								]
+							})
+						]
+					})
+				]
+			});
+		}
 		function PackyCodeSection({ rpc, t }) {
 			const call = react.useMemo(() => (endpoint, payload = {}) => rpc.call(CHANNEL, endpoint, payload).then(unwrap), [rpc]);
 			const [status, setStatus] = react.useState();
@@ -555,6 +746,10 @@ window.__ModuleLoader__.load({
 						className: "packyCodeIntro",
 						children: t("intro")
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(VersionCard, {
+						call,
+						t
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ClaudeCliCard, {
 						call,
 						t

package/lib/index.js

@@ -8,6 +8,8 @@ import { homedir, tmpdir } from "node:os";
 import { spawn } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { credentialKey } from "@deepseek-ai/dsh-credentials";
+import { readFile, readdir, realpath } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
 import { createProvider } from "@earendil-works/pi-ai";
 import { anthropicMessagesApi } from "@earendil-works/pi-ai/api/anthropic-messages.lazy";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -67,7 +69,7 @@ const DEFAULT_REASONING_LEVEL = "high";
 * @module dsh-packycode-api/balance
 */
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-const clone = (value) => structuredClone(value);
+const clone$1 = (value) => structuredClone(value);
 function number(value) {
 	if (typeof value === "number" && Number.isFinite(value)) return value;
 	if (typeof value === "string" && value.trim() !== "") {
@@ -274,7 +276,7 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 	return Object.freeze({
 		async read({ force = false, signal } = {}) {
 			signal?.throwIfAborted();
-			if (!force && cached !== void 0 && now() - cached.fetchedAt < ttlMs) return clone(cached);
+			if (!force && cached !== void 0 && now() - cached.fetchedAt < ttlMs) return clone$1(cached);
 			const createPending = (requestSignal) => {
 				const observedGeneration = generation;
 				return load(requestSignal).then((value) => {
@@ -282,7 +284,7 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 					return value;
 				});
 			};
-			if (force) return clone(await createPending(signal));
+			if (force) return clone$1(await createPending(signal));
 			const pending = inFlight ?? createPending();
 			if (inFlight === void 0) {
 				inFlight = pending;
@@ -291,7 +293,7 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = fetch, now = Date
 				};
 				pending.then(clear, clear);
 			}
-			return clone(await pending);
+			return clone$1(await pending);
 		},
 		invalidate() {
 			generation += 1;
@@ -1960,6 +1962,383 @@ function capClaudeMode(requested, ceiling) {
 	return RANK[requested] > RANK[ceiling] ? ceiling : requested;
 }
 //#endregion
+//#region src/plugin-version.js
+/**
+* Version self-knowledge for the settings panel.
+*
+* The running version comes from this package. The latest version comes from
+* the npm registry. An in-place update is only offered for a registry install,
+* and it installs that exact version with the host's own pnpm — never through
+* `dsh plugin --profile desktop`, which the desktop app refuses. Registry
+* bodies and package-manager output stay host-side.
+*
+* @module dsh-packycode-api/plugin-version
+*/
+const PACKAGE_NAME = "dsh-packycode-api";
+const NPM_REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
+const DEFAULT_VERSION_TTL_MS = 5 * 6e4;
+const DEFAULT_VERSION_TIMEOUT_MS = 1e4;
+const DEFAULT_UPDATE_TIMEOUT_MS = 18e4;
+const clone = (value) => structuredClone(value);
+/**
+* Resolve fetch at call time. A sibling plugin may wrap `globalThis.fetch`
+* and later dismantle that wrapper; a binding captured during `apply()` would
+* keep the dead wrapper for the process lifetime.
+*/
+function ambientFetch(input, init) {
+	const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+	if (!headers.has("accept-encoding")) headers.set("accept-encoding", "identity");
+	return globalThis.fetch(input, {
+		...init,
+		headers
+	});
+}
+/** One caller's cancellation must not abort the shared registry read. */
+function waitForSharedRequest(promise, signal) {
+	if (signal === void 0) return promise;
+	signal.throwIfAborted();
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(signal.reason);
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
+/** Parse a strict `x.y.z[-pre][+build]` version; anything else is undefined. */
+function parseSemver(value) {
+	if (typeof value !== "string") return void 0;
+	const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u.exec(value.trim());
+	if (match === null) return void 0;
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3]),
+		pre: match[4]
+	};
+}
+/** Compare two versions: -1/0/1, or undefined when either side is not semver. */
+function compareSemver(a, b) {
+	const left = parseSemver(a);
+	const right = parseSemver(b);
+	if (left === void 0 || right === void 0) return void 0;
+	for (const key of [
+		"major",
+		"minor",
+		"patch"
+	]) if (left[key] !== right[key]) return left[key] < right[key] ? -1 : 1;
+	if (left.pre === right.pre) return 0;
+	if (left.pre === void 0) return 1;
+	if (right.pre === void 0) return -1;
+	return left.pre < right.pre ? -1 : 1;
+}
+/**
+* Classify how the running package reached the profile. Only registry specs
+* may be updated in place; local checkouts belong to the owner's iteration.
+*/
+function classifySpec(spec) {
+	if (typeof spec !== "string" || spec === "") return "unknown";
+	if (/^(?:link|file):/u.test(spec)) return "link";
+	if (/^(?:\d|[~^*])/u.test(spec)) return "npm";
+	return "unknown";
+}
+const readManifest = async (path) => {
+	try {
+		const parsed = JSON.parse(await readFile(path, "utf8"));
+		return parsed !== null && typeof parsed === "object" ? parsed : void 0;
+	} catch {
+		return;
+	}
+};
+/**
+* A zero exit only proves the command ran. pnpm can skip a too-new version
+* and still exit zero, so the landed manifest is what makes the answer true.
+*/
+async function confirmInstalled({ profileDir, expected, settleDelayMs, attempts = 3 }) {
+	for (let attempt = 1; attempt <= attempts; attempt += 1) {
+		if ((await readManifest(join(profileDir, "node_modules", "dsh-packycode-api", "package.json")))?.version === expected) return;
+		if (attempt < attempts) await new Promise((resolve) => {
+			setTimeout(resolve, settleDelayMs);
+		});
+	}
+	throw new Error("PackyCode plugin update did not install the requested version");
+}
+/**
+* Find the profile that owns this running installation. pnpm symlinks resolve
+* to the same realpath on both sides. When no realpath matches, fall back to
+* the only profile that declares the dependency at all.
+*/
+async function findInstall({ dshHome, ownPackageJsonUrl }) {
+	let ownReal;
+	try {
+		ownReal = await realpath(fileURLToPath(ownPackageJsonUrl));
+	} catch {
+		ownReal = void 0;
+	}
+	let entries = [];
+	try {
+		entries = await readdir(join(dshHome, "profiles"), { withFileTypes: true });
+	} catch {
+		entries = [];
+	}
+	const declared = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		const profileDir = join(dshHome, "profiles", entry.name);
+		const spec = (await readManifest(join(profileDir, "package.json")))?.dependencies?.[PACKAGE_NAME];
+		if (typeof spec !== "string") continue;
+		declared.push({
+			profile: entry.name,
+			spec
+		});
+		if (ownReal === void 0) continue;
+		try {
+			if (await realpath(join(profileDir, "node_modules", "dsh-packycode-api", "package.json")) === ownReal) return {
+				kind: classifySpec(spec),
+				profile: entry.name
+			};
+		} catch {}
+	}
+	if (declared.length === 1) return {
+		kind: classifySpec(declared[0].spec),
+		profile: declared[0].profile
+	};
+	return { kind: "unknown" };
+}
+const isExistingPath = (value) => typeof value === "string" && value !== "" && existsSync(value);
+/** Anchored to the file name so a directory that merely contains the word cannot match. */
+const PNPM_SCRIPT = /[\\/]pnpm\.(?:mjs|cjs|js)$/u;
+const dshRuntimeRoot = (value) => isExistingPath(value) && existsSync(join(value, "node_modules", "@deepseek-ai", "dsh", "package.json")) ? value : void 0;
+/**
+* Locate the package manager that owns this profile.
+*
+* `dsh plugin --profile desktop` is refused by the desktop app, so the update
+* installs with pnpm directly. The desktop host puts the bundled pnpm in its
+* own arguments; nothing is guessed from the entry script.
+*/
+function resolvePnpm({ argv } = {}) {
+	const entries = Array.isArray(argv) ? argv : [];
+	for (const entry of entries) if (isExistingPath(entry) && PNPM_SCRIPT.test(entry)) return entry;
+	for (const entry of entries) {
+		const root = dshRuntimeRoot(entry);
+		if (root === void 0) continue;
+		const script = join(root, "..", "pnpm", "bin", "pnpm.mjs");
+		if (existsSync(script)) return script;
+	}
+}
+function resolveLauncher({ argv, execPath }) {
+	const pnpm = resolvePnpm({ argv });
+	if (pnpm === void 0) return {
+		command: "pnpm",
+		prefix: []
+	};
+	return {
+		command: execPath,
+		prefix: [pnpm]
+	};
+}
+/** Run pnpm host-side. Its output is never returned to the browser. */
+function spawnRunCommand({ command, args, cwd }, { signal, timeoutMs }) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason instanceof Error ? signal.reason : /* @__PURE__ */ new Error("PackyCode plugin update aborted"));
+			return;
+		}
+		const controller = new AbortController();
+		const onAbort = () => controller.abort(signal.reason);
+		signal?.addEventListener("abort", onAbort, { once: true });
+		const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("PackyCode plugin update timed out")), timeoutMs);
+		let settled = false;
+		const settle = (callback, value) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", onAbort);
+			callback(value);
+		};
+		let child;
+		try {
+			child = spawn(command, args, {
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				],
+				signal: controller.signal,
+				...cwd === void 0 ? {} : { cwd }
+			});
+		} catch (error) {
+			settle(reject, error);
+			return;
+		}
+		let stdout = "";
+		let stderr = "";
+		child.stdout?.on("data", (chunk) => {
+			stdout = (stdout + chunk).slice(-8192);
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderr = (stderr + chunk).slice(-8192);
+		});
+		child.on("error", (error) => settle(reject, error));
+		child.on("close", (code) => {
+			if (controller.signal.aborted) {
+				const reason = controller.signal.reason;
+				settle(reject, reason instanceof Error ? reason : /* @__PURE__ */ new Error("PackyCode plugin update aborted"));
+				return;
+			}
+			settle(resolve, {
+				code: code ?? 1,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+/**
+* The running version, the latest registry version, which profile installed
+* this copy, and registry-spec updates against that profile.
+*/
+function createPackyCodePluginManager({ fetchImpl = ambientFetch, runCommand = spawnRunCommand, execPath = process.execPath, argv = process.argv, env = process.env, ownPackageJsonUrl = new URL("../package.json", import.meta.url), registryUrl = NPM_REGISTRY_LATEST_URL, now = Date.now, ttlMs = DEFAULT_VERSION_TTL_MS, timeoutMs = DEFAULT_VERSION_TIMEOUT_MS, updateTimeoutMs = DEFAULT_UPDATE_TIMEOUT_MS, settleDelayMs = 250 } = {}) {
+	if (typeof fetchImpl !== "function") throw new Error("PackyCode plugin manager requires fetch");
+	if (typeof runCommand !== "function") throw new Error("PackyCode plugin manager requires runCommand");
+	const dshHome = typeof env.DSH_HOME === "string" && env.DSH_HOME !== "" ? env.DSH_HOME : join(homedir(), ".dsh");
+	const launcher = resolveLauncher({
+		argv,
+		execPath
+	});
+	let cached;
+	let inFlight;
+	let generation = 0;
+	let updating = false;
+	const fetchLatest = async (signal) => {
+		const timeoutSignal = AbortSignal.timeout(timeoutMs);
+		const requestSignal = signal === void 0 ? timeoutSignal : AbortSignal.any([signal, timeoutSignal]);
+		let response;
+		try {
+			response = await fetchImpl(registryUrl, {
+				headers: { Accept: "application/json" },
+				redirect: "error",
+				signal: requestSignal
+			});
+		} catch (error) {
+			if (signal?.aborted) throw error;
+			throw new Error("PackyCode plugin version check failed");
+		}
+		if (!response.ok) throw new Error("PackyCode plugin version check failed");
+		let version;
+		try {
+			version = (await response.json())?.version;
+		} catch {
+			version = void 0;
+		}
+		if (parseSemver(version) === void 0) throw new Error("PackyCode plugin version check failed");
+		return version;
+	};
+	const readOwnVersion = async () => {
+		const version = (await readManifest(fileURLToPath(ownPackageJsonUrl)))?.version;
+		if (parseSemver(version) === void 0) throw new Error("PackyCode plugin version is unavailable");
+		return version;
+	};
+	const load = async (signal) => {
+		signal?.throwIfAborted();
+		const [current, install, latest] = await Promise.all([
+			readOwnVersion(),
+			findInstall({
+				dshHome,
+				ownPackageJsonUrl
+			}),
+			fetchLatest(signal)
+		]);
+		return {
+			current,
+			latest,
+			updateAvailable: compareSemver(latest, current) === 1,
+			install,
+			fetchedAt: now()
+		};
+	};
+	return Object.freeze({
+		async read({ force = false, signal } = {}) {
+			signal?.throwIfAborted();
+			if (!force && cached !== void 0 && now() - cached.fetchedAt < ttlMs) return clone(cached);
+			const createPending = (requestSignal) => {
+				const observedGeneration = generation;
+				return load(requestSignal).then((value) => {
+					if (generation === observedGeneration) cached = value;
+					return value;
+				});
+			};
+			if (force) return clone(await createPending(signal));
+			const pending = inFlight ?? createPending();
+			if (inFlight === void 0) {
+				inFlight = pending;
+				const clear = () => {
+					if (inFlight === pending) inFlight = void 0;
+				};
+				pending.then(clear, clear);
+			}
+			return clone(await waitForSharedRequest(pending, signal));
+		},
+		async update({ signal } = {}) {
+			signal?.throwIfAborted();
+			if (updating) throw new Error("PackyCode plugin update is already running");
+			updating = true;
+			try {
+				const install = await findInstall({
+					dshHome,
+					ownPackageJsonUrl
+				});
+				if (install.kind === "link") throw new Error("PackyCode plugin is installed from a local checkout");
+				if (install.kind !== "npm" || install.profile === void 0) throw new Error("PackyCode plugin update could not find the owning profile");
+				const latest = await fetchLatest(signal);
+				const profileDir = join(dshHome, "profiles", install.profile);
+				let result;
+				try {
+					result = await runCommand({
+						command: launcher.command,
+						args: [
+							...launcher.prefix,
+							"add",
+							"--save-exact",
+							`--config.minimumReleaseAge=0`,
+							`${PACKAGE_NAME}@${latest}`
+						],
+						cwd: profileDir
+					}, {
+						signal,
+						timeoutMs: updateTimeoutMs
+					});
+				} catch (error) {
+					if (signal?.aborted) throw error;
+					throw new Error("PackyCode plugin update failed");
+				}
+				if (result.code !== 0) throw new Error("PackyCode plugin update failed");
+				await confirmInstalled({
+					profileDir,
+					expected: latest,
+					settleDelayMs
+				});
+				generation += 1;
+				cached = void 0;
+				return {
+					version: latest,
+					profile: install.profile
+				};
+			} finally {
+				updating = false;
+			}
+		},
+		invalidate() {
+			generation += 1;
+			cached = void 0;
+		}
+	});
+}
+//#endregion
 //#region src/catalog.js
 /**
 * The built-in PackyCode model catalog.
@@ -2368,11 +2747,15 @@ function normalizeHost(value, fallback) {
 *   Claude Code CLI manager (optional: without it the CLI endpoints refuse).
 * @returns a handler for `connection.rpc.handle(CHANNEL, handler)`.
 */
-function createPackyCodeRpc({ ring, balance, hosts, preference, claudeCli }) {
+function createPackyCodeRpc({ ring, balance, hosts, preference, claudeCli, pluginManager }) {
 	const requireCli = () => {
 		if (claudeCli === void 0) throw new Error("PackyCode Claude Code CLI support is unavailable in this runtime");
 		return claudeCli;
 	};
+	const requireManager = () => {
+		if (pluginManager === void 0) throw new Error("PackyCode plugin version is unavailable");
+		return pluginManager;
+	};
 	const status = async () => ({
 		...await ring.list(),
 		hosts: hosts(),
@@ -2382,7 +2765,7 @@ function createPackyCodeRpc({ ring, balance, hosts, preference, claudeCli }) {
 			statusHost: DEFAULT_STATUS_HOST
 		}
 	});
-	return async (endpoint, payload) => {
+	return async (endpoint, payload, signal) => {
 		try {
 			switch (endpoint) {
 				case "status": return ok(await status());
@@ -2431,6 +2814,11 @@ function createPackyCodeRpc({ ring, balance, hosts, preference, claudeCli }) {
 					cli.install();
 					return ok(await cli.status());
 				}
+				case "plugin/version": return ok(await requireManager().read({
+					force: payload?.force === true,
+					signal
+				}));
+				case "plugin/update": return ok(await requireManager().update({ signal }));
 				default: return failed("Unknown PackyCode endpoint");
 			}
 		} catch (error) {
@@ -2721,7 +3109,8 @@ function apply(ctx, config) {
 		balance,
 		hosts,
 		preference,
-		claudeCli
+		claudeCli,
+		pluginManager: createPackyCodePluginManager()
 	});
 	/**
 	* Connection registers a channel through `owner.webServer`, read on its own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-packycode-api",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "packageManager": "pnpm@10.32.1",
   "description": "Use a PackyCode (PackyAPI) API key in DeepSeek Harness through a built-in multi-protocol model route with key rotation and balance display",
   "type": "module",