dsh-plugin-notify-sounds 1.6.2 → 1.6.3

package/README.md

@@ -123,6 +123,7 @@ For anyone hacking on the code (exact details live in the source comments):
 
 ## Changelog
 
+- **v1.6.3** (2026-10-11) The update-success message no longer flashes and vanishes: the Host remembers the install and repeats it with every check, so "Updated, restart DSH to load it" survives the page reload the update itself triggers (it swaps the client half's own file) and stays until the restart. The cached check is invalidated after an install too, so the row can no longer claim a newer version than the one it just wrote.
 - **v1.6.2** (2026-10-11) Fixed one-click update always failing when the mainland mirror answered the check: the mirror serves its tarballs from its CDN, and the downloader refused every redirect — so the download could never finish (found by the live drill). Redirects are now followed one hop at a time with every hop checked against the trusted hosts (the mirror's CDN is the one legitimate hop); the sha512 check is unchanged. A failure now names the stage it died at (check / download / verify / unpack / replace).
 - **v1.6.1** (2026-10-11) The README is rebuilt as a release page: a new **Consistent with DSH's own UI** section on how the UI matches DSH's own settings, copy polished throughout, and the upgrade notes corrected — the plugin updates itself, so no uninstall is needed. This release doubles as the live drill for one-click update.
 - **v1.6.0** (2026-10-11) New: **check for updates and install them in one click**. The settings section can fetch the newest npm version and install it: the download is checked against the registry's published sha512, only whitelisted files are unpacked (symlinks and path traversal are refused), the old files are kept aside, and any failure restores them. Downloaded code is never executed — the new code loads when DSH restarts. Automatic checks run at most once a day and can be turned off, with the mainland-China mirror as fallback.

package/README.zh.md

@@ -123,6 +123,7 @@ dsh plugin --profile <你的 profile> add ./dsh-plugin-notify-sounds
 
 ## 更新记录
 
+- **v1.6.3**（2026-10-11）更新成功的提示不再一闪而过：更新结果改由**宿主**记住、随每次检查下发——即便更新替换掉了客户端自身文件、页面热重载丢掉本地状态，「更新完成：vX → vY，重启 DSH 后生效」也会一直显示到你重启；同时更新后**作废检查缓存**，不会再出现「明明刚升完却仍显示有新版」。
 - **v1.6.2**（2026-10-11）修复一键更新在**镜像源**下必然失败：npmmirror 的 tarball 会跳转到它的 CDN，而下载器此前拒绝一切重定向，于是「只要检查由镜像应答，下载就永远到不了」（真机演练实测发现）。现在重定向改为逐跳跟随、每一跳都必须仍落在受信主机上（镜像 CDN 是唯一合法跳转），sha512 校验不变；失败提示会带上失败阶段（下载 / 校验 / 解包 / 替换），便于定位。
 - **v1.6.1**（2026-10-11）README 重排为发布页风格：补「**与 DSH 界面保持一致**」一节讲清界面取自 DSH 自身设计体系；通篇表达润色，并修正升级说明（本插件自带更新，无需卸载重装）。本版同时是「一键更新」的发布演练。
 - **v1.6.0**（2026-10-11）新增**检查更新与一键更新**：设置里可查 npm 新版本并一键安装——下载后按 registry 公布的 sha512 校验、只解包白名单文件（拒绝符号链接与路径穿越）、先备份再替换、失败自动还原；下载内容从不执行，新代码在 DSH 重启时生效。自动检查每天最多一次、可关；npm 官方源不通时自动改用国内镜像。

package/lib/client.js

@@ -1583,6 +1583,14 @@ window.__ModuleLoader__.load({
 			}, []);
 			const payload = state.payload;
 			const version = (text) => (typeof text === "string" && text !== "" ? `v${text}` : "?");
+			// The Host remembers the last install and repeats it with every
+			// answer, and this row prefers that: an update swaps the client
+			// half's own file, so the page may reload and drop this row's
+			// state mid-message — the news has to survive that. The Host keeps
+			// it until DSH restarts, which is exactly as long as "restart to
+			// load it" is true.
+			const applied = payload?.applied ?? (state.phase === "updated" ? state.result : undefined);
+			const appliedDone = applied !== undefined && (applied.ok === true || typeof applied.to === "string");
 			let status = payload === undefined
 				? t("update.idle")
 				: payload.updateAvailable === true
@@ -1590,10 +1598,11 @@ window.__ModuleLoader__.load({
 					: t("update.uptodate");
 			if (state.phase === "checking") status = t("update.checking");
 			if (state.phase === "updating") status = t("update.updating");
-			if (state.phase === "applyFailed") status = t("update.applyFailed", { stage: String(state.result?.stage ?? "?") });
 			let detail = payload === undefined ? status : `${t("update.current")} ${version(payload.current)} · ${status}`;
-			if (state.phase === "updated") {
-				detail = `${t("update.done")}：${version(state.result?.from)} → ${version(state.result?.to)}，${t("update.restart")}`;
+			if (appliedDone) {
+				detail = `${t("update.done")}：${version(applied.from)} → ${version(applied.to)}，${t("update.restart")}`;
+			} else if (state.phase === "applyFailed") {
+				detail = t("update.applyFailed", { stage: String(state.result?.stage ?? "?") });
 			}
 			const busy = state.phase === "checking" || state.phase === "updating";
 			return h("div", { className: css.row }, [
@@ -1603,7 +1612,7 @@ window.__ModuleLoader__.load({
 					h("div", { className: css.hint, key: "status" }, detail),
 				]),
 				h("div", { className: css.stackControl, key: "control" }, [
-					payload?.updateAvailable === true && state.phase !== "updated" ? h(Button, {
+					payload?.updateAvailable === true && !appliedDone ? h(Button, {
 						key: "apply",
 						variant: "outline",
 						size: "sm",

package/lib/index.js

@@ -468,8 +468,8 @@ const UPDATE_CHECK_SPACING_MS = 15 * 1000;
 const UPDATE_FETCH_TIMEOUT_MS = 10 * 1000;
 const UPDATE_MAX_RESPONSE_BYTES = 256 * 1024;
 
-/** Result of the last check, and when the last real request went out. */
-const updateCheck = { checkedAt: 0, requestedAt: 0, result: undefined };
+/** Result of the last check, when the last real request went out, and the last successful install. */
+const updateCheck = { checkedAt: 0, requestedAt: 0, result: undefined, applied: undefined };
 
 /**
  * Parse `major.minor.patch` with an optional prerelease tag.
@@ -603,7 +603,7 @@ export async function checkForUpdate(options = {}) {
 	const current = readOwnVersion(options.root);
 	const answer = await fetchRegistryAnswer();
 	if (answer === undefined) {
-		const result = { ok: false, current, error: "no registry answered" };
+		const result = { ok: false, current, error: "no registry answered", applied: updateCheck.applied };
 		updateCheck.checkedAt = now;
 		updateCheck.result = result;
 		return result;
@@ -615,6 +615,7 @@ export async function checkForUpdate(options = {}) {
 		latest: answer.version,
 		updateAvailable: Number.isFinite(ordering) && ordering < 0,
 		checkedAt: now,
+		applied: updateCheck.applied,
 	};
 	updateCheck.checkedAt = now;
 	updateCheck.result = result;
@@ -882,6 +883,16 @@ export async function applyUpdate(options = {}) {
 		const files = unpackTar(gunzipSync(bytes));
 		stage = "replace";
 		installUpdate(root, files);
+		// The answer that said "update available" is now a lie about this
+		// installation: drop the cached check so the next one re-reads the
+		// manifest this install just wrote. The outcome is remembered too —
+		// the very files that were just swapped include the client half, so
+		// the page may reload and lose its own state, and the news that an
+		// update landed must survive that. It is kept until DSH restarts,
+		// which is exactly as long as "restart to load it" is true.
+		updateCheck.checkedAt = 0;
+		updateCheck.result = undefined;
+		updateCheck.applied = { from: current, to: answer.version, at: Date.now() };
 		log(`update applied: ${current ?? "?"} -> ${answer.version}`);
 		return { ok: true, from: current, to: answer.version, requiresRestart: true };
 	} catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-notify-sounds",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "Notification sounds for DeepSeek Harness — a soft chime when the agent needs your decision or finishes a task, with a Settings section styled like DSH's own · 需要决策或任务完成时播放提示音，点击系统通知可回到窗口，设置面板可调音量与音效",
   "type": "module",
   "main": "lib/index.js",