dsh-plugin-notify-sounds 1.6.1 → 1.6.3

package/README.md

@@ -123,6 +123,8 @@ For anyone hacking on the code (exact details live in the source comments):
 
 ## Changelog
 
+- **v1.6.3** (2026-10-11) The update-success message no longer flashes and vanishes: the Host remembers the install and repeats it with every check, so "Updated, restart DSH to load it" survives the page reload the update itself triggers (it swaps the client half's own file) and stays until the restart. The cached check is invalidated after an install too, so the row can no longer claim a newer version than the one it just wrote.
+- **v1.6.2** (2026-10-11) Fixed one-click update always failing when the mainland mirror answered the check: the mirror serves its tarballs from its CDN, and the downloader refused every redirect — so the download could never finish (found by the live drill). Redirects are now followed one hop at a time with every hop checked against the trusted hosts (the mirror's CDN is the one legitimate hop); the sha512 check is unchanged. A failure now names the stage it died at (check / download / verify / unpack / replace).
 - **v1.6.1** (2026-10-11) The README is rebuilt as a release page: a new **Consistent with DSH's own UI** section on how the UI matches DSH's own settings, copy polished throughout, and the upgrade notes corrected — the plugin updates itself, so no uninstall is needed. This release doubles as the live drill for one-click update.
 - **v1.6.0** (2026-10-11) New: **check for updates and install them in one click**. The settings section can fetch the newest npm version and install it: the download is checked against the registry's published sha512, only whitelisted files are unpacked (symlinks and path traversal are refused), the old files are kept aside, and any failure restores them. Downloaded code is never executed — the new code loads when DSH restarts. Automatic checks run at most once a day and can be turned off, with the mainland-China mirror as fallback.
 - **v1.5.0** (2026-10-08) The "finished" title mark is unread news now — set by a finish that happens while you are away, cleared when you return — instead of reappearing on every switch-away. The retrigger cooldown is per session, so two conversations deciding within 2 seconds both ring. The Host half gained tests (Config schema, focus route, title matching) that cross-check the shared constants between the halves; the sessions provider is now an explicit load prerequisite, and quiet-hours catch-up is documented.

package/README.zh.md

@@ -123,6 +123,8 @@ dsh plugin --profile <你的 profile> add ./dsh-plugin-notify-sounds
 
 ## 更新记录
 
+- **v1.6.3**（2026-10-11）更新成功的提示不再一闪而过：更新结果改由**宿主**记住、随每次检查下发——即便更新替换掉了客户端自身文件、页面热重载丢掉本地状态，「更新完成：vX → vY，重启 DSH 后生效」也会一直显示到你重启；同时更新后**作废检查缓存**，不会再出现「明明刚升完却仍显示有新版」。
+- **v1.6.2**（2026-10-11）修复一键更新在**镜像源**下必然失败：npmmirror 的 tarball 会跳转到它的 CDN，而下载器此前拒绝一切重定向，于是「只要检查由镜像应答，下载就永远到不了」（真机演练实测发现）。现在重定向改为逐跳跟随、每一跳都必须仍落在受信主机上（镜像 CDN 是唯一合法跳转），sha512 校验不变；失败提示会带上失败阶段（下载 / 校验 / 解包 / 替换），便于定位。
 - **v1.6.1**（2026-10-11）README 重排为发布页风格：补「**与 DSH 界面保持一致**」一节讲清界面取自 DSH 自身设计体系；通篇表达润色，并修正升级说明（本插件自带更新，无需卸载重装）。本版同时是「一键更新」的发布演练。
 - **v1.6.0**（2026-10-11）新增**检查更新与一键更新**：设置里可查 npm 新版本并一键安装——下载后按 registry 公布的 sha512 校验、只解包白名单文件（拒绝符号链接与路径穿越）、先备份再替换、失败自动还原；下载内容从不执行，新代码在 DSH 重启时生效。自动检查每天最多一次、可关；npm 官方源不通时自动改用国内镜像。
 - **v1.5.0**（2026-10-08）「已完成」标题标记改为未读语义——离开期间发生的完成才标记，回到页面即清除，不再每次切走都重新出现；触发冷却按会话独立，2 秒内两个会话先后需要决策时都会响。补齐宿主半测试（配置 schema、唤窗路由、标题匹配）并交叉校验两半共享常量；`dsh.client.inject` 显式声明 sessions 提供包；静音时段结束后的补发行为写入文档。

package/lib/client.js

@@ -193,7 +193,7 @@ window.__ModuleLoader__.load({
 			"update.updating": "更新中…",
 			"update.done": "更新完成",
 			"update.restart": "重启 DSH 后生效",
-			"update.applyFailed": "更新失败，已恢复原状",
+			"update.applyFailed": "更新失败（{stage}），已恢复原状",
 		};
 
 		/** English dictionary, checked complete against the zh key set. */
@@ -270,7 +270,7 @@ window.__ModuleLoader__.load({
 			"update.updating": "Updating…",
 			"update.done": "Updated",
 			"update.restart": "restart DSH to load it",
-			"update.applyFailed": "Update failed — the previous version is intact",
+			"update.applyFailed": "Update failed ({stage}) — the previous version is intact",
 		};
 		//#endregion
 
@@ -1583,6 +1583,14 @@ window.__ModuleLoader__.load({
 			}, []);
 			const payload = state.payload;
 			const version = (text) => (typeof text === "string" && text !== "" ? `v${text}` : "?");
+			// The Host remembers the last install and repeats it with every
+			// answer, and this row prefers that: an update swaps the client
+			// half's own file, so the page may reload and drop this row's
+			// state mid-message — the news has to survive that. The Host keeps
+			// it until DSH restarts, which is exactly as long as "restart to
+			// load it" is true.
+			const applied = payload?.applied ?? (state.phase === "updated" ? state.result : undefined);
+			const appliedDone = applied !== undefined && (applied.ok === true || typeof applied.to === "string");
 			let status = payload === undefined
 				? t("update.idle")
 				: payload.updateAvailable === true
@@ -1590,10 +1598,11 @@ window.__ModuleLoader__.load({
 					: t("update.uptodate");
 			if (state.phase === "checking") status = t("update.checking");
 			if (state.phase === "updating") status = t("update.updating");
-			if (state.phase === "applyFailed") status = t("update.applyFailed");
 			let detail = payload === undefined ? status : `${t("update.current")} ${version(payload.current)} · ${status}`;
-			if (state.phase === "updated") {
-				detail = `${t("update.done")}：${version(state.result?.from)} → ${version(state.result?.to)}，${t("update.restart")}`;
+			if (appliedDone) {
+				detail = `${t("update.done")}：${version(applied.from)} → ${version(applied.to)}，${t("update.restart")}`;
+			} else if (state.phase === "applyFailed") {
+				detail = t("update.applyFailed", { stage: String(state.result?.stage ?? "?") });
 			}
 			const busy = state.phase === "checking" || state.phase === "updating";
 			return h("div", { className: css.row }, [
@@ -1603,7 +1612,7 @@ window.__ModuleLoader__.load({
 					h("div", { className: css.hint, key: "status" }, detail),
 				]),
 				h("div", { className: css.stackControl, key: "control" }, [
-					payload?.updateAvailable === true && state.phase !== "updated" ? h(Button, {
+					payload?.updateAvailable === true && !appliedDone ? h(Button, {
 						key: "apply",
 						variant: "outline",
 						size: "sm",

package/lib/index.js

@@ -443,6 +443,21 @@ const UPDATE_PACKAGE = "dsh-plugin-notify-sounds";
  */
 const UPDATE_REGISTRIES = ["https://registry.npmjs.org", "https://registry.npmmirror.com"];
 
+/**
+ * Hosts a tarball may live on: the registries above, plus the one legitimate
+ * hop between them.
+ *
+ * The mainland mirror answers its metadata on its own host but serves the
+ * tarball from its CDN, so a download that refuses every redirect could never
+ * finish when the mirror answered (measured). The CDN is therefore trusted
+ * for tarballs only, and redirects are still followed one hop at a time with
+ * every hop checked against this list.
+ */
+const UPDATE_TARBALL_HOSTS = [...UPDATE_REGISTRIES, "https://cdn.npmmirror.com"];
+
+/** How many redirects a download may follow before giving up. */
+const UPDATE_MAX_REDIRECTS = 4;
+
 /** How long one check result is trusted before the next check may run. */
 const UPDATE_CHECK_TTL_MS = 24 * 60 * 60 * 1000;
 
@@ -453,8 +468,8 @@ const UPDATE_CHECK_SPACING_MS = 15 * 1000;
 const UPDATE_FETCH_TIMEOUT_MS = 10 * 1000;
 const UPDATE_MAX_RESPONSE_BYTES = 256 * 1024;
 
-/** Result of the last check, and when the last real request went out. */
-const updateCheck = { checkedAt: 0, requestedAt: 0, result: undefined };
+/** Result of the last check, when the last real request went out, and the last successful install. */
+const updateCheck = { checkedAt: 0, requestedAt: 0, result: undefined, applied: undefined };
 
 /**
  * Parse `major.minor.patch` with an optional prerelease tag.
@@ -511,15 +526,16 @@ function readOwnVersion(root) {
  * Whether a tarball URL is somewhere this plugin is willing to download from.
  *
  * The URL arrives inside a registry response, so it is untrusted input: https
- * only, and the host must be one of the registries above. A registry pointing
- * anywhere else is refused rather than followed. The download stage checks
- * this again on its own — validating it here too means a hostile answer is
- * rejected at the door, not at the moment it is about to be used.
+ * only, and the host must be one of `UPDATE_TARBALL_HOSTS`. A registry pointing
+ * anywhere else is refused rather than followed. The download stage re-checks
+ * every redirect against this same list, so a hostile answer — or a hostile
+ * redirect — is rejected at the door instead of at the moment it is about to
+ * be used.
  */
 export function isTrustedTarball(url) {
 	try {
 		const parsed = new URL(url);
-		return parsed.protocol === "https:" && UPDATE_REGISTRIES.some((registry) => parsed.origin === registry);
+		return parsed.protocol === "https:" && UPDATE_TARBALL_HOSTS.some((host) => parsed.origin === host);
 	} catch {
 		return false;
 	}
@@ -584,10 +600,10 @@ export async function checkForUpdate(options = {}) {
 		return updateCheck.result;
 	}
 	updateCheck.requestedAt = now;
-	const current = readOwnVersion();
+	const current = readOwnVersion(options.root);
 	const answer = await fetchRegistryAnswer();
 	if (answer === undefined) {
-		const result = { ok: false, current, error: "no registry answered" };
+		const result = { ok: false, current, error: "no registry answered", applied: updateCheck.applied };
 		updateCheck.checkedAt = now;
 		updateCheck.result = result;
 		return result;
@@ -599,6 +615,7 @@ export async function checkForUpdate(options = {}) {
 		latest: answer.version,
 		updateAvailable: Number.isFinite(ordering) && ordering < 0,
 		checkedAt: now,
+		applied: updateCheck.applied,
 	};
 	updateCheck.checkedAt = now;
 	updateCheck.result = result;
@@ -756,20 +773,42 @@ export function verifyIntegrity(bytes, integrity) {
 /**
  * Download the tarball a validated registry answer named.
  *
- * The URL was checked when the answer arrived and is checked again here; the
- * response is capped and time-limited like every other request, and never
- * redirected.
+ * Redirects are followed by hand rather than by the fetch layer: every hop's
+ * URL must itself be on `UPDATE_TARBALL_HOSTS`, so a redirect can never walk
+ * off the list — the mirror's CDN hop is the one legitimate case, and anything
+ * else is refused by name. The response is capped and time-limited like every
+ * other request; the sha512 check afterwards is what actually vouches for the
+ * bytes, whatever host they came from.
+ *
+ * @returns the tarball bytes.
  */
 async function downloadTarball(url) {
-	if (!isTrustedTarball(url)) throw new Error("tarball URL is not a trusted registry");
-	log(`update: downloading ${url}`);
-	const response = await fetch(url, {
-		signal: AbortSignal.timeout(60 * 1000),
-		redirect: "error",
-		headers: { accept: "application/octet-stream" },
-	});
-	if (!response.ok) throw new Error(`download failed: HTTP ${response.status}`);
-	return readCappedBytes(response, UPDATE_MAX_TARBALL_BYTES);
+	let current = url;
+	for (let hop = 0; hop <= UPDATE_MAX_REDIRECTS; hop++) {
+		if (!isTrustedTarball(current)) throw new Error(`download refused: ${current}`);
+		log(`update: downloading ${current}`);
+		let response;
+		try {
+			response = await fetch(current, {
+				signal: AbortSignal.timeout(60 * 1000),
+				redirect: "manual",
+				headers: { accept: "application/octet-stream" },
+			});
+		} catch (error) {
+			throw new Error(`download failed: ${error?.message ?? error}`);
+		}
+		if (response.status >= 300 && response.status < 400) {
+			const location = response.headers.get("location");
+			if (typeof location !== "string" || location === "") {
+				throw new Error(`download failed: HTTP ${response.status} without a redirect target`);
+			}
+			current = new URL(location, current).toString();
+			continue;
+		}
+		if (!response.ok) throw new Error(`download failed: HTTP ${response.status}`);
+		return readCappedBytes(response, UPDATE_MAX_TARBALL_BYTES);
+	}
+	throw new Error(`download refused: more than ${UPDATE_MAX_REDIRECTS} redirects`);
 }
 
 /**
@@ -844,6 +883,16 @@ export async function applyUpdate(options = {}) {
 		const files = unpackTar(gunzipSync(bytes));
 		stage = "replace";
 		installUpdate(root, files);
+		// The answer that said "update available" is now a lie about this
+		// installation: drop the cached check so the next one re-reads the
+		// manifest this install just wrote. The outcome is remembered too —
+		// the very files that were just swapped include the client half, so
+		// the page may reload and lose its own state, and the news that an
+		// update landed must survive that. It is kept until DSH restarts,
+		// which is exactly as long as "restart to load it" is true.
+		updateCheck.checkedAt = 0;
+		updateCheck.result = undefined;
+		updateCheck.applied = { from: current, to: answer.version, at: Date.now() };
 		log(`update applied: ${current ?? "?"} -> ${answer.version}`);
 		return { ok: true, from: current, to: answer.version, requiresRestart: true };
 	} catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-notify-sounds",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "Notification sounds for DeepSeek Harness — a soft chime when the agent needs your decision or finishes a task, with a Settings section styled like DSH's own · 需要决策或任务完成时播放提示音，点击系统通知可回到窗口，设置面板可调音量与音效",
   "type": "module",
   "main": "lib/index.js",