dsh-plugin-admin 0.1.0 → 0.2.0

package/README.md

@@ -5,7 +5,9 @@ dsh web UI 插件：在浏览器设置弹窗（侧边栏底部“设置”）中
 - **🔌 插件管理**：
   - 顶部输入框支持 npm 包名（如 `dsh-xxx`）或本地绝对路径安装插件（回车或点击提交）；
   - 列表展示当前 profile 下的全部 bundle 层（名称、版本，以及**内置 / 包安装 / 本地安装**标记；本地安装的插件额外显示其源路径，依据 profile 依赖清单中的 `link:` / `file:` / 绝对路径 spec 判定）；
+  - **名称模糊搜索**：列表上方搜索框支持按插件名 / 版本号 / 本地路径模糊过滤（大小写不敏感子串匹配），可叠加「全部 / 扩展插件 / 系统内置」筛选胶囊，无结果时给出专属空状态提示；
   - 支持扩展插件一键卸载（带有优雅的行内二次确认）；
+  - **远程更新检测（自动）**：打开「插件管理」Tab 即自动按 profile 实际使用的 npm registry（`npm_config_registry` → 项目/用户 `.npmrc` → 官方源）查询每个 **registry 安装**的插件（跳过内置与本地路径安装）的 `latest` 版本，与本地版本比对——有新版时卡片显示琥珀色「⬆ 有新版本 vX.Y.Z」徽标并出现一键「⬆ 更新」按钮（`npm install <name>@latest`）；工具栏「⬆ 检查更新」可强制手动刷新；查询带超时与 5 分钟缓存（host 侧缓存，重启 dsh 后首次打开自动重查），网络失败按条目提示而非报错；
   - 安装/卸载在 host 侧编排 profile 目录下的 pnpm 并自动同步 `package.json` 的 `dsh.profile.bundles` 清单（变更在重启 dsh 后生效）。
 - **💬 会话管理**：
   - **标题与内容摘要**：自动解析会话标题（`session/title` 或首条用户提问）并渲染首条消息的文本摘要气泡预览（带折行省略与多行保护）；
@@ -25,7 +27,7 @@ dsh web UI 插件：在浏览器设置弹窗（侧边栏底部“设置”）中
 - **Host 端（`lib/index.js`，零 dsh 依赖）**：
   - 注入 `['typert', 'workspaceRegistry', 'sessionPersistence']`；
   - 提供并注册四个 RPC 命名空间：
-    - `pluginAdmin`（`list` / `install` / `remove`）：异步 `spawn` pnpm（Windows 走 shell 解析 .cmd shim，5 分钟超时且**进程树强杀**（`taskkill /T /F`，避免超时后残留 pnpm/node 子进程继续写盘），Promise 尾链串行化防并发），镜像 CLI `reconcileBundles` 同步清单，清单写回为**原子写**（临时文件 + rename，崩溃不截断 profile 的 package.json）；安装/卸载参数经**字符白名单**校验（`assertPnpmOperand`），从根上排除 `&` `|` `>` `<` `%` 引号等 cmd 元字符注入向量；`install` / `remove` 返回真实 pnpm 输出尾部（`output` 字段），前端作为提示气泡的悬浮诊断信息展示；
+    - `pluginAdmin`（`list` / `install` / `remove` / `checkUpdates`）：异步 `spawn` pnpm（Windows 走 shell 解析 .cmd shim，5 分钟超时且**进程树强杀**（`taskkill /T /F`，避免超时后残留 pnpm/node 子进程继续写盘），Promise 尾链串行化防并发），镜像 CLI `reconcileBundles` 同步清单，清单写回为**原子写**（临时文件 + rename，崩溃不截断 profile 的 package.json）；安装/卸载参数经**字符白名单**校验（`assertPnpmOperand`），从根上排除 `&` `|` `>` `<` `%` 引号等 cmd 元字符注入向量；`install` / `remove` 返回真实 pnpm 输出尾部（`output` 字段），前端作为提示气泡的悬浮诊断信息展示；`checkUpdates` 对 registry 安装的 bundle 并发查询 npm registry 的 `latest`（registry 解析：`npm_config_registry` env → 项目/用户 `.npmrc` → 官方源；有界并发 4 路、8s 超时、5 分钟缓存），返回 `updateAvailable` / `latest` / `error`，本地路径与内置插件跳过；
     - `sessionAdmin` (`list` / `archive` / `unarchive` / `deleteSession` / `closeSession`)：直接对接 `workspaceRegistry` 与 `sessionPersistence`，提供安全幂等的持久化日志清理与归档状态流转；`list` 采用**修订号驱动的摘要缓存**（`listSnapshots` 的 revision token，未变化会话不重读事件日志）与**有界并发**（最多 4 路并行 inspect），并设单会话事件扫描上限兜底；`archive` 校验会话真实存在，拒绝向归档集写入垃圾 id；对 registry 软私有写路径（`requireState` / `setState` / `enqueueOperation`）在 `apply()` 挂载时即做**兼容性探测**，dsh 版本变更会明确报出缺失成员，而不是首次归档时才静默失败。`closeSession` 使**在线会话免重启删除**成为可能：`installAgentHandleCapture` 在挂载时透明包装公开的 `ctx.agents.create` / `resume`（原样调用并返回，仅把返回的 `AgentHandle` 按 session id 存入插件私有 Map），删除在线会话时先 `handle.dispose()` 走 dsh 官方 teardown 链（停止 loop → 等待静止 → 注销 agent → 从 SessionStore 移除 → 触发 `session/disposed` → 持久化层 `retire()` flush 缓冲事件并释放写路径），再删日志——日志不会被下次 flush 复活；未被捕获 handle 的在线会话（如插件挂载前已创建）会明确报错并引导重启，绝不误删。
     - `fsAdmin` (`reveal`)：跨平台在系统文件管理器中定位一个绝对路径（Windows `explorer /select`、macOS `open -R`、Linux `xdg-open`），供工作区右键菜单「在资源管理器打开」使用；
     - `mcpAdmin` (`list` / `upsert` / `remove` / `test`)：管理 profile 的 `cordis.patch.yml` 中的 MCP 客户端实例（`@deepseek-ai/dsh-mcp-client`）。基于行级 YAML 块编辑（零依赖）：识别顶层 `- id:` 块并仅改动 `name` 为 MCP 客户端插件的条目，`upsert` 按 id 原位替换或追加，`remove` 整块删除，写回走**原子写**；校验 id / serverName / transport / command / url，拒绝畸形输入；文件变更与插件安装共用同一**串行操作队列**（读-改-写不交错）。`test` 按条目 id 发起**连通性探测**：stdio 子进程（newline JSON-RPC，`initialize` → `initialized` → `tools/list`，超时 `taskkill /T /F` 强杀进程树，捕获 stderr 尾部）或 streamable-http（`fetch` POST `initialize`，兼容 SSE 与纯 JSON，超时 AbortController），返回服务器标识 / 工具数量 / 耗时，或失败原因（命令不存在、连接拒绝、超时等），全程不抛异常。

package/lib/client.js

@@ -21,7 +21,7 @@ var useEffect = React.useEffect
 var CSS_TEXT = [
   '@keyframes dsh-admin-spin { to { transform: rotate(360deg); } }',
   '@keyframes dsh-admin-pulse { 0%, 100% { opacity: 1; transform: scale(1); } 50% { opacity: 0.35; transform: scale(0.85); } }',
-  '[data-dsh-admin-section] { display: flex; flex-direction: column; width: 100%; gap: 14px; padding: 2px; font-size: 13px; line-height: 1.5; color: var(--dsw-alias-label-primary, #0f1115); }',
+  '[data-dsh-admin-section] { display: flex; flex-direction: column; width: 100%; gap: 14px; padding: 2px; font-size: 13px; line-height: 1.5; color: var(--dsw-alias-label-primary, #0f1115); max-height: calc(100vh - 140px); overflow: hidden; }',
   '[data-dsh-admin-section] * { box-sizing: border-box; }',
   '[data-dsh-admin-section] .tabs { display: flex; padding: 3px; background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.04)); border-radius: 9px; border: 1px solid var(--dsw-alias-border-subtle, rgba(0,0,0,0.08)); gap: 3px; }',
   '[data-dsh-admin-section] .tab { flex: 1; border: 0; background: transparent; border-radius: 7px; padding: 7px 14px; cursor: pointer; display: flex; align-items: center; justify-content: center; gap: 7px; font-size: 12px; font-weight: 500; color: var(--dsw-alias-label-secondary, #666); transition: all 0.15s ease; font-family: inherit; }',
@@ -35,6 +35,9 @@ var CSS_TEXT = [
   '[data-dsh-admin-section] .input:hover { border-color: var(--dsw-alias-label-tertiary, rgba(0,0,0,0.28)); }',
   '[data-dsh-admin-section] .input:focus { border-color: var(--dsw-alias-button-primary-fill, #1677ff); box-shadow: 0 0 0 3px rgba(22, 119, 255, 0.14); }',
   '[data-dsh-admin-section] .filter-bar { display: flex; gap: 6px; align-items: center; flex-wrap: wrap; }',
+  '[data-dsh-admin-section] .search-bar { display: flex; align-items: center; gap: 8px; padding: 8px 10px; border: 1px solid var(--dsw-alias-border-subtle, rgba(0,0,0,0.08)); border-radius: 10px; background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.02)); flex: none; }',
+  '[data-dsh-admin-section] .search-icon { font-size: 12px; opacity: 0.7; flex: none; }',
+  '[data-dsh-admin-section] .search-bar .input { padding: 6px 10px; }',
   '[data-dsh-admin-section] .pill { font-size: 11px; padding: 2px 8px; border-radius: 6px; border: 1px solid var(--dsw-alias-border-subtle, rgba(0,0,0,0.1)); background: transparent; cursor: pointer; color: var(--dsw-alias-label-secondary, #666); transition: all 0.12s; font-family: inherit; }',
   '[data-dsh-admin-section] .pill:hover { background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.04)); }',
   '[data-dsh-admin-section] .pill.active { background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.06)); color: var(--dsw-alias-button-primary-fill, #1677ff); font-weight: 600; border-color: currentColor; }',
@@ -51,7 +54,7 @@ var CSS_TEXT = [
   '[data-dsh-admin-section] .btn.danger-solid:hover:not(:disabled) { opacity: 0.9; }',
   '[data-dsh-admin-section] .btn.sm { padding: 3px 8px; font-size: 11px; border-radius: 6px; }',
   '[data-dsh-admin-section] .spinner { width: 12px; height: 12px; border: 2px solid transparent; border-top-color: currentColor; border-radius: 50%; animation: dsh-admin-spin 0.7s linear infinite; display: inline-block; flex: none; }',
-  '[data-dsh-admin-section] .list { display: flex; flex-direction: column; gap: 10px; max-height: 560px; overflow-y: auto; padding: 2px 4px 2px 2px; scrollbar-width: thin; scrollbar-color: var(--dsw-alias-border-subtle, rgba(0,0,0,0.2)) transparent; }',
+  '[data-dsh-admin-section] .list { display: flex; flex-direction: column; gap: 10px; flex: 1 1 auto; min-height: 0; max-height: 560px; overflow-y: auto; padding: 2px 4px 2px 2px; scrollbar-width: thin; scrollbar-color: var(--dsw-alias-border-subtle, rgba(0,0,0,0.2)) transparent; }',
   '[data-dsh-admin-section] .list::-webkit-scrollbar { width: 6px; }',
   '[data-dsh-admin-section] .list::-webkit-scrollbar-thumb { border-radius: 99px; background: var(--dsw-alias-border-subtle, rgba(0,0,0,0.2)); }',
   '[data-dsh-admin-section] .session-group { display: flex; flex-direction: column; gap: 6px; }',
@@ -74,6 +77,8 @@ var CSS_TEXT = [
   '[data-dsh-admin-section] .tag { font-size: 10px; font-weight: 500; padding: 1px 6px; border-radius: 4px; flex: none; display: inline-flex; align-items: center; gap: 4px; background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.04)); color: var(--dsw-alias-label-secondary, #666); }',
   '[data-dsh-admin-section] .tag.plugin { background: rgba(16, 185, 129, 0.12); color: var(--dsw-alias-state-success-primary, #10b981); }',
   '[data-dsh-admin-section] .tag.local { background: rgba(59, 130, 246, 0.1); color: var(--dsw-alias-button-primary-fill, #1677ff); }',
+  '[data-dsh-admin-section] .tag.update { background: rgba(245, 158, 11, 0.14); color: #d97706; font-weight: 600; border: 1px solid rgba(217, 119, 6, 0.25); }',
+  '[data-dsh-admin-section] .tag.update-error { background: rgba(239, 68, 68, 0.1); color: var(--dsw-alias-state-error-primary, #ef4444); }',
   '[data-dsh-admin-section] .plugin-path { font-family: monospace; font-size: 11px; line-height: 1.4; color: var(--dsw-alias-label-secondary, #666); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; padding: 4px 9px; border-radius: 6px; background: var(--dsw-alias-interactive-bg-hover, rgba(0,0,0,0.025)); }',
   '[data-dsh-admin-section] .tag.version { font-family: monospace; }',
   '[data-dsh-admin-section] .tag.live { background: rgba(16, 185, 129, 0.12); color: var(--dsw-alias-state-success-primary, #10b981); font-weight: 600; }',
@@ -88,7 +93,7 @@ var CSS_TEXT = [
   '[data-dsh-admin-section] .busy-banner { display: flex; align-items: center; gap: 8px; padding: 7px 11px; border-radius: 7px; background: rgba(22, 119, 255, 0.08); color: var(--dsw-alias-button-primary-fill, #1677ff); font-size: 11px; }',
   '[data-dsh-admin-section] .empty { display: flex; flex-direction: column; align-items: center; justify-content: center; padding: 28px 12px; color: var(--dsw-alias-label-tertiary, #999); gap: 4px; font-size: 12px; text-align: center; }',
   '[data-dsh-admin-section] .error { padding: 7px 11px; border-radius: 7px; color: var(--dsw-alias-state-error-primary, #ef4444); background: var(--dsw-alias-interactive-bg-hover-danger, rgba(239,68,68,0.08)); font-size: 12px; white-space: pre-wrap; max-height: 100px; overflow-y: auto; }',
-  '[data-dsh-admin-section] .footer { display: flex; justify-content: space-between; align-items: center; padding-top: 4px; font-size: 11px; color: var(--dsw-alias-label-tertiary, #888); border-top: 1px solid var(--dsw-alias-border-subtle, rgba(0,0,0,0.06)); }',
+  '[data-dsh-admin-section] .footer { display: flex; justify-content: space-between; align-items: center; padding-top: 4px; font-size: 11px; color: var(--dsw-alias-label-tertiary, #888); border-top: 1px solid var(--dsw-alias-border-subtle, rgba(0,0,0,0.06)); flex: none; }',
   '[data-dsh-admin-section] .footer .path { max-width: 60%; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }',
   '[data-dsh-admin-section] .footer .hint { font-style: normal; }',
   '[data-dsh-admin-section] .session-id-badge { font-family: monospace; font-size: 10px; opacity: 0.75; }',
@@ -485,6 +490,9 @@ function PluginsSection(props) {
     note: '',
     output: '',
     filter: 'all',
+    needle: '',
+    checkingUpdates: false,
+    updates: {}, // name -> { latest, updateAvailable, error? }
   })
   var pView = pairPlugins[0]
   var setPView = pairPlugins[1]
@@ -523,6 +531,69 @@ function PluginsSection(props) {
     })
   }
 
+  /**
+   * Query the npm registry for newer versions of registry-installed bundles
+   * and stash per-plugin results. Runs concurrently with the list so the
+   * panel stays responsive; failures are per-plugin, never fatal.
+   */
+  function checkUpdates() {
+    if (pView.checkingUpdates) return
+    patchPlugin({ checkingUpdates: true, note: '' })
+    callRemote('pluginAdmin/checkUpdates', {}).then(function (result) {
+      if (!alive.current) return
+      patchPlugin({ checkingUpdates: false })
+      if (!result.ok) {
+        patchPlugin({ error: '检查更新失败：' + messageOf(result.error) })
+        return
+      }
+      var list = (result.value && result.value.updates) || []
+      var map = {}
+      var updateCount = 0
+      for (var i = 0; i < list.length; i++) {
+        var u = list[i]
+        map[u.name] = { latest: u.latest, updateAvailable: u.updateAvailable === true, error: u.error || '' }
+        if (u.updateAvailable === true) updateCount++
+      }
+      var updated = map
+      patchPlugin({
+        updates: updated,
+        note: updateCount > 0
+          ? '发现 ' + updateCount + ' 个插件有新版本'
+          : (list.length > 0 ? '已检查 ' + list.length + ' 个插件，均为最新版本' : ''),
+      })
+    }, function (failure) {
+      if (!alive.current) return
+      patchPlugin({ checkingUpdates: false, error: '检查更新调用失败：' + messageOf(failure) })
+    })
+  }
+
+  /** Upgrade one plugin to its latest version (registry install by name). */
+  function upgradePlugin(name) {
+    if (pView.busy) return
+    var spec = name + '@latest'
+    patchPlugin({ busy: true, error: '', confirming: null, note: '' })
+    callRemote('pluginAdmin/install', { spec: spec }).then(function (result) {
+      if (!alive.current) return
+      if (result.ok) {
+        patchPlugin({
+          busy: false,
+          note: '已更新 ' + name + '。更改在重启 dsh 后生效',
+          output: (result.value && result.value.output) || '',
+          profileDir: (result.value && result.value.profileDir) || '',
+          plugins: (result.value && result.value.plugins) || [],
+        })
+        // Refresh the update map so the upgraded entry stops flagging.
+        checkUpdates()
+        return
+      }
+      patchPlugin({ busy: false, error: '更新失败：' + messageOf(result.error) })
+      reloadPlugins()
+    }, function (failure) {
+      if (!alive.current) return
+      patchPlugin({ busy: false, error: '调用失败：' + messageOf(failure) })
+    })
+  }
+
   function installPlugin() {
     if (pView.busy || pView.spec.trim() === '') return
     var spec = pView.spec.trim()
@@ -573,11 +644,17 @@ function PluginsSection(props) {
   useEffect(function () {
     alive.current = true
     reloadPlugins()
+    // Auto-check for remote updates on mount (the panel loads lazily when
+    // the 插件管理 tab is opened, so this runs once per open). The host
+    // caches registry answers for 5 minutes, so re-opening the tab shortly
+    // after does not re-hit the registry. The manual ⬆ 检查更新 button stays
+    // for forcing a fresh check.
+    checkUpdates()
     return function () { alive.current = false }
   }, [])
 
   return createElement('div', { 'data-dsh-admin-section': '' },
-    renderPluginsView(pView, patchPlugin, reloadPlugins, installPlugin, removePlugin))
+    renderPluginsView(pView, patchPlugin, reloadPlugins, installPlugin, removePlugin, checkUpdates, upgradePlugin))
 }
 
 /**
@@ -921,7 +998,7 @@ function AdminCenterSection(props) {
 /*                           Render Plugins View                              */
 /* ========================================================================== */
 
-function renderPluginsView(view, patch, reload, install, remove) {
+function renderPluginsView(view, patch, reload, install, remove, checkUpdates, upgrade) {
   var elements = []
 
   // Toolbar
@@ -946,6 +1023,16 @@ function renderPluginsView(view, patch, reload, install, remove) {
       view.busy ? createElement('span', { className: 'spinner', key: 'spin' }) : null,
       '安装'
     ),
+    createElement('button', {
+      type: 'button',
+      key: 'btn-check-updates',
+      className: 'btn',
+      disabled: view.busy || view.checkingUpdates,
+      onClick: checkUpdates,
+    },
+      view.checkingUpdates ? createElement('span', { className: 'spinner', key: 'spin' }) : null,
+      view.checkingUpdates ? '检查中...' : '⬆ 检查更新'
+    ),
     createElement('button', {
       type: 'button',
       key: 'btn-refresh',
@@ -955,6 +1042,25 @@ function renderPluginsView(view, patch, reload, install, remove) {
     }, '刷新')
   ))
 
+  // Search bar: fuzzy filter by plugin name / version / local path.
+  elements.push(createElement('div', { className: 'search-bar', key: 'search' },
+    createElement('span', { className: 'search-icon', key: 'icon' }, '🔍'),
+    createElement('input', {
+      className: 'input',
+      key: 'search-input',
+      placeholder: '按名称/版本/路径模糊搜索插件...',
+      value: view.needle,
+      onChange: function (e) { patch({ needle: e.target.value }) },
+    }),
+    view.needle !== '' ? createElement('button', {
+      type: 'button',
+      key: 'btn-clear-search',
+      className: 'btn sm',
+      title: '清空搜索',
+      onClick: function () { patch({ needle: '' }) },
+    }, '✕') : null
+  ))
+
   // Filter Pills
   var totalPlugins = view.plugins.length
   var thirdPartyCount = 0
@@ -997,17 +1103,17 @@ function renderPluginsView(view, patch, reload, install, remove) {
   }
 
   // Filter and render rows
+  var needle = view.needle.trim().toLowerCase()
+  var filtered = filterPlugins(view.plugins, view.filter, needle)
   var rows = []
-  for (var j = 0; j < view.plugins.length; j++) {
-    var p = view.plugins[j]
-    if (view.filter === 'plugin' && !p.removable) continue
-    if (view.filter === 'builtin' && p.removable) continue
-    rows.push(renderPluginCard(p, view, remove, patch))
+  for (var j = 0; j < filtered.length; j++) {
+    var p = filtered[j]
+    rows.push(renderPluginCard(p, view, remove, patch, upgrade))
   }
 
   if (rows.length === 0) {
     rows.push(createElement('div', { className: 'empty', key: 'empty' },
-      createElement('div', null, '📦 暂无匹配的插件层')
+      createElement('div', null, needle !== '' ? '🔍 无匹配的插件（试试其他关键词）' : '📦 暂无匹配的插件层')
     ))
   }
 
@@ -1327,7 +1433,7 @@ function mergeTestState(map, id, partial) {
   for (var pk in partial) next[id][pk] = partial[pk]
   return next
 }
-function renderPluginCard(plugin, view, remove, patch) {
+function renderPluginCard(plugin, view, remove, patch, upgrade) {
   var isConfirming = view.confirming === plugin.name
 
   var titleChildren = [
@@ -1344,19 +1450,49 @@ function renderPluginCard(plugin, view, remove, patch) {
     plugin.removable ? (isLocal ? '本地安装' : '包安装') : '内置'
   ))
 
+  // Remote update badge: only for registry-installed bundles (removable and
+  // not a local path) after a check ran. `updates` is keyed by plugin name.
+  var updateInfo = view.updates && view.updates[plugin.name]
+  if (updateInfo && updateInfo.updateAvailable && updateInfo.latest) {
+    titleChildren.push(createElement('span', {
+      className: 'tag update',
+      key: 'update-badge',
+      title: '远程 registry 有新版本：v' + updateInfo.latest + '（当前 v' + plugin.version + '）',
+    }, '⬆ 有新版本 v' + updateInfo.latest))
+  } else if (updateInfo && updateInfo.error) {
+    titleChildren.push(createElement('span', {
+      className: 'tag update-error',
+      key: 'update-error',
+      title: updateInfo.error,
+    }, '⚠ 更新检查失败'))
+  }
+
   var headerChildren = [
     createElement('div', { className: 'card-title', key: 'title' }, titleChildren),
   ]
 
   if (plugin.removable && !isConfirming) {
-    headerChildren.push(createElement('div', { className: 'card-actions', key: 'actions' },
-      createElement('button', {
+    var actionChildren = []
+    // 更新 button — only when an update is available and the plugin is a
+    // registry install (not local path).
+    if (updateInfo && updateInfo.updateAvailable && updateInfo.latest && !isLocal) {
+      actionChildren.push(createElement('button', {
         type: 'button',
-        className: 'btn danger sm',
+        key: 'btn-upgrade',
+        className: 'btn sm',
         disabled: view.busy,
-        onClick: function () { patch({ confirming: plugin.name }) },
-      }, '卸载')
-    ))
+        title: '升级到 v' + updateInfo.latest + '（npm install ' + plugin.name + '@latest）',
+        onClick: function () { upgrade(plugin.name) },
+      }, '⬆ 更新'))
+    }
+    actionChildren.push(createElement('button', {
+      type: 'button',
+      key: 'btn-remove',
+      className: 'btn danger sm',
+      disabled: view.busy,
+      onClick: function () { patch({ confirming: plugin.name }) },
+    }, '卸载'))
+    headerChildren.push(createElement('div', { className: 'card-actions', key: 'actions' }, actionChildren))
   }
 
   var header = createElement('div', { className: 'card-header', key: 'header' }, headerChildren)
@@ -1435,6 +1571,25 @@ function filterSessions(sessions, filter, needle) {
 }
 
 /**
+ * Filter plugin layers by the type pill and a fuzzy name/version/path query.
+ * The needle matches case-insensitively against the package name, the
+ * installed version, and the local source path, so "tool" finds
+ * dsh-custom-tool and "0.2" finds version rows.
+ */
+function filterPlugins(plugins, filter, needle) {
+  var result = []
+  for (var i = 0; i < plugins.length; i++) {
+    var p = plugins[i]
+    if (filter === 'plugin' && !p.removable) continue
+    if (filter === 'builtin' && p.removable) continue
+    if (needle !== '') {
+      var hay = ((p.name || '') + ' ' + (p.version || '') + ' ' + (p.localPath || '')).toLowerCase()
+      if (hay.indexOf(needle) === -1) continue
+    }
+    result.push(p)
+  }
+  return result
+}/**
  * Group sessions by their accounting workspace in registry order; sessions
  * without a workspace trail under an "未分组" bucket. Empty workspaces are
  * omitted so the user only sees groups that currently hold a session.

package/lib/index.js

@@ -23,6 +23,7 @@ import { existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync }
 import { rm } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { basename, dirname, join } from 'node:path'
+import { homedir } from 'node:os'
 import { fileURLToPath } from 'node:url'
 import { setTimeout as sleep } from 'node:timers/promises'
 
@@ -41,6 +42,16 @@ const PACKAGE = 'dsh-plugin-admin'
 const MODULE_DIR = dirname(fileURLToPath(import.meta.url))
 const PNPM_TIMEOUT_MS = 5 * 60_000
 
+// Remote update check knobs: query the npm registry (the same registry npm
+// uses — env override, .npmrc, or the official default) for the `latest`
+// dist-tag of each registry-installed bundle and compare with the local
+// version. Bounded concurrency, strict timeout, and a short-lived cache so
+// the panel never hammers the registry on every refresh.
+const UPDATE_CHECK_TIMEOUT_MS = 8_000
+const UPDATE_CHECK_CONCURRENCY = 4
+const UPDATE_CHECK_CACHE_TTL_MS = 5 * 60_000
+const NPM_REGISTRY_DEFAULT = 'https://registry.npmjs.org'
+
 // MCP connectivity probe knobs: the probe speaks the same newline-delimited
 // JSON-RPC (stdio) / Streamable HTTP protocol the dsh-mcp-client plugin uses,
 // but with a strict budget so a wedged server can never hang the panel.
@@ -147,6 +158,102 @@ function localSpecPath(spec) {
   return null
 }
 
+/**
+ * Resolve the npm registry the user actually installs from: the npm_config
+ * env override first, then a `registry=` line in the nearest .npmrc (user or
+ * profile), falling back to the official registry. Mirrors npm's own
+ * resolution well enough for update checks; a mismatch only means the check
+ * queries a different mirror, which is acceptable.
+ * @param profileDir - profile directory (checked for a local .npmrc).
+ * @returns the registry base URL (no trailing slash).
+ */
+function resolveNpmRegistry(profileDir) {
+  if (typeof process.env.npm_config_registry === 'string' && process.env.npm_config_registry.trim() !== '') {
+    return process.env.npm_config_registry.trim().replace(/\/+$/, '')
+  }
+  const candidates = [
+    join(profileDir, '.npmrc'),
+    join(homedir(), '.npmrc'),
+  ]
+  for (const file of candidates) {
+    try {
+      const text = readFileSync(file, 'utf8')
+      const match = /^\s*registry\s*=\s*(\S+)\s*$/m.exec(text)
+      if (match) return match[1].replace(/\/+$/, '')
+    } catch {
+      // file absent — try the next candidate
+    }
+  }
+  return NPM_REGISTRY_DEFAULT
+}
+
+/**
+ * Query the npm registry for the `latest` dist-tag version of one package.
+ * Strict timeout; returns null on any failure so a dead registry never
+ * breaks the panel.
+ * @param registry - registry base URL.
+ * @param name - package name (scoped names are URL-encoded).
+ * @returns the latest version string, or null when unknown/unreachable.
+ */
+async function fetchLatestVersion(registry, name) {
+  try {
+    const url = `${registry}/${name.split('/').map(encodeURIComponent).join('/')}/latest`
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), UPDATE_CHECK_TIMEOUT_MS)
+    let response
+    try {
+      response = await fetch(url, { signal: controller.signal, headers: { Accept: 'application/json' } })
+    } finally {
+      clearTimeout(timer)
+    }
+    if (!response.ok) return null
+    const data = await response.json()
+    if (data && typeof data.version === 'string') return data.version
+    return null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Remote update check for one plugin entry: only registry-installed bundles
+ * (dependency-managed and not a local path) are queried. The result never
+ * throws — network failures surface as `error` on the entry.
+ * @param registry - registry base URL.
+ * @param plugin - plugin list entry ({ name, version, dependency, localPath }).
+ * @returns { name, version, latest, updateAvailable, error? }.
+ */
+async function checkPluginUpdate(registry, plugin) {
+  if (!plugin.dependency || plugin.localPath !== null) {
+    return { name: plugin.name, version: plugin.version, latest: null, updateAvailable: false }
+  }
+  const latest = await fetchLatestVersion(registry, plugin.name)
+  if (latest === null) {
+    return { name: plugin.name, version: plugin.version, latest: null, updateAvailable: false, error: '无法查询远程版本（网络或 registry 不可达）' }
+  }
+  return {
+    name: plugin.name,
+    version: plugin.version,
+    latest,
+    updateAvailable: plugin.version !== latest,
+  }
+}
+
+/** Run bounded-concurrency async work over a list, preserving order. */
+async function mapConcurrent(items, limit, worker) {
+  const results = new Array(items.length)
+  let cursor = 0
+  const runners = new Array(Math.min(limit, items.length)).fill(0).map(async () => {
+    while (true) {
+      const index = cursor++
+      if (index >= items.length) return
+      results[index] = await worker(items[index], index)
+    }
+  })
+  await Promise.all(runners)
+  return results
+}
+
 /**
  * Write the bundle layer list back into the profile manifest.
  * @param profileDir - the profile directory.
@@ -308,8 +415,10 @@ function assertPnpmOperand(field, value) {
 
 /* Exported for host-check.mjs: the shell-allowlist validator and the local
  * source-path classifier are pure functions, so the self-check drives them
- * directly without touching pnpm or the real profile manifest. */
-export { localSpecPath, assertPnpmOperand }
+ * directly without touching pnpm or the real profile manifest. The update
+ * checker is exported too — its registry fetch is injected, so the host-check
+ * can drive it against a local HTTP stub without touching the real npm. */
+export { localSpecPath, assertPnpmOperand, resolveNpmRegistry, fetchLatestVersion, checkPluginUpdate }
 
 /* ========================================================================== */
 /*                           MCP Connectivity Probe                            */
@@ -1002,11 +1111,48 @@ export function apply(ctx) {
   }
 
   /* ---------------------- Plugin Admin Remote Service ---------------------- */
+  // Remote-update cache: name -> { at, latest } so repeated panel refreshes
+  // within the TTL do not re-hit the registry.
+  const updateCache = new Map()
+
   const pluginService = {
     async list() {
       return listLayers()
     },
 
+    /**
+     * Check every registry-installed bundle for a newer version on the npm
+     * registry (same registry npm/pnpm use). In-box bundles and local-path
+     * installs are skipped. Never throws: each entry reports its own
+     * `updateAvailable`/`latest`/`error`. Results are cached briefly.
+     * @returns { updates, checkedAt } where updates is per-plugin status.
+     */
+    async checkUpdates() {
+      const now = Date.now()
+      const { plugins } = listLayers()
+      const registry = resolveNpmRegistry(profileDir)
+      const cached = []
+      const todo = []
+      for (const plugin of plugins) {
+        if (!plugin.dependency || plugin.localPath !== null) continue
+        const hit = updateCache.get(plugin.name)
+        if (hit !== undefined && now - hit.at < UPDATE_CHECK_CACHE_TTL_MS) {
+          cached.push({ ...hit.result })
+        } else {
+          todo.push(plugin)
+        }
+      }
+      const fresh = await mapConcurrent(todo, UPDATE_CHECK_CONCURRENCY, async (plugin) => {
+        const result = await checkPluginUpdate(registry, plugin)
+        if (result.latest !== null) {
+          updateCache.set(plugin.name, { at: now, result: { name: result.name, latest: result.latest } })
+        }
+        return result
+      })
+      const updates = [...cached, ...fresh]
+      return { updates, checkedAt: now }
+    },
+
     async install(spec) {
       if (typeof spec !== 'string' || spec.trim() === '') {
         throw new Error('plugin-admin: install requires a spec string')
@@ -1875,6 +2021,15 @@ export function apply(ctx) {
         parameters: nameParam,
         result: { mode: 'src-json' },
       },
+      {
+        id: `${PACKAGE}/checkUpdates`,
+        service: PLUGIN_SERVICE_KEY,
+        namespace: PLUGIN_NAMESPACE,
+        method: 'checkUpdates',
+        invocation: { kind: 'direct' },
+        parameters: [],
+        result: { mode: 'src-json' },
+      },
       // sessionAdmin
       {
         id: `${PACKAGE}/session/list`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-admin",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "dsh web UI plugin: unified administration panel — plugin and session management with modern tabbed Web UI (host remote + browser panel)",
   "main": "lib/index.js",