dsh-plugin-shop 0.4.3 → 0.4.5

package/lib/types/client/ShopTab.d.ts

@@ -5,7 +5,7 @@
  * §11.3.4): no render path here may ever use dangerouslySetInnerHTML. */
 import { type ReactNode } from 'react';
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
-import type { InstallArgs, ShopCatalogResult, ShopInstalledEntry, ShopInstallResult, ShopInstallStatusResult, ShopRestartResult, ShopSetEnabledResult, ShopUninstallResult } from '../host/index.ts';
+import type { InstallArgs, ShopCatalogResult, ShopInstalledEntry, ShopInstallResult, ShopInstallStatusResult, ShopRestartResult, ShopSetEnabledResult, ShopUninstallResult, ShopUpdateResult, ShopVersionResult } from '../host/index.ts';
 /** The tab's Remote face: the Host result types, already unwrapped from the
  * wire envelope by `index.ts`; `catalog` throws on a wire error so the tab's
  * error state renders. */
@@ -26,6 +26,10 @@ export interface ShopTabInjected {
         name: string;
     }) => Promise<ShopUninstallResult>;
     restart: () => Promise<ShopRestartResult>;
+    version: () => Promise<ShopVersionResult>;
+    updateStart: (args: {
+        version: string;
+    }) => Promise<ShopUpdateResult>;
 }
 /** Full component props assembled by the Settings slot renderer. */
 export type ShopTabProps = PropsRuntime<'settings.plugins.tab'> & PropsLocale<'settings.shop'> & InjectFace<ShopTabInjected>;

package/lib/types/client/locales.d.ts

@@ -59,7 +59,10 @@ export declare const zh: {
     restartBody: string;
     restartConfirm: string;
     restarting: string;
+    restartFailedNotice: string;
     restartTransportFailed: string;
+    updateFailed: string;
+    updateTransportFailed: string;
     enabledSwitch: string;
     toggleFailed: string;
     hotApplyNote: string;
@@ -126,7 +129,10 @@ export declare const en: {
     restartBody: string;
     restartConfirm: string;
     restarting: string;
+    restartFailedNotice: string;
     restartTransportFailed: string;
+    updateFailed: string;
+    updateTransportFailed: string;
     enabledSwitch: string;
     toggleFailed: string;
     hotApplyNote: string;

package/lib/types/client/present.d.ts

@@ -58,6 +58,13 @@ export type InstallEvent = {
 };
 /** §7.2 once-per-second poll cadence, as a named constant. */
 export declare const INSTALL_POLL_MS = 1000;
+/** §8 restart handoff: the client polls the origin only after this grace
+ * period (the host's exit delay plus margin), so an origin that answers is
+ * the NEW server, never the dying old one. */
+export declare const RESTART_GRACE_MS = 3000;
+/** §8 restart handoff: how long the client waits for the new server to
+ * answer before reporting the manual restart command. */
+export declare const RESTART_WAIT_MS = 30000;
 /** How many shelf cards mount at a time. The shelf holds ~1900 entries; one
  * commit of the whole grid is ~28k DOM nodes, so the list renders in batches
  * behind a sentinel (§A1) and grows on scroll. 48 is ~3-4 rows. */

package/lib/types/client/useUpdateSelf.d.ts

@@ -0,0 +1,20 @@
+/** Self-update driving hook for the shop itself: start, poll to terminal.
+ * Shares the install view machine and poll loop; the start mapping is the
+ * uninstall one — a business refusal (a non-semver version) lands in the
+ * `failed` view with the host's detail, never in the install `rejected`
+ * codes. */
+import type { ShopInstallStatusResult, ShopUpdateResult } from '../host/index.ts';
+import type { InstallView } from './present.ts';
+export interface UseUpdateSelfResult {
+    view: InstallView;
+    start: (args: {
+        version: string;
+    }) => Promise<void>;
+}
+/** Drive one self-update: the host's business union, the shared polling
+ * loop, and terminal states. The `rejected` install state never occurs. */
+export declare function useUpdateSelf(updateStart: (args: {
+    version: string;
+}) => Promise<ShopUpdateResult>, installStatus: (args: {
+    installId: string;
+}) => Promise<ShopInstallStatusResult>): UseUpdateSelfResult;

package/lib/types/host/index.d.ts

@@ -36,6 +36,13 @@ export interface ShopGatewayOptions {
     /** Test-only injection: the exit the restart calls after the response is
      * delivered. Production uses `process.exit`. */
     exit?: (code?: number) => void;
+    /** The pid the restart helper waits on before exec'ing the new dsh;
+     * defaults to this process. Tests point it at a dead pid so the fixture
+     * runs immediately instead of waiting for the vitest worker to exit. */
+    restartParentPid?: number;
+    /** Test-only injection: the shop's latest-version lookup; production
+     * fetches the npm packument. */
+    fetchLatestVersion?: () => Promise<string | null>;
     /** How long the gateway waits after a successful restart response before
      * exiting the old process; test-only shortening, production uses 2s. */
     restartExitDelayMs?: number;
@@ -72,6 +79,24 @@ export type ShopUninstallResult = {
 /** `shop/restart` result (§7.3): the restarted server's URL, or a typed
  * failure — on failure the old process is still serving. */
 export type ShopRestartResult = RestartOutcome;
+/** `shop/version` result (§7.3): the RUNNING shop version (from the shipped
+ * package.json, not the manifest's range), the npm latest when the check
+ * could answer (`null` = no answer — advisory, never an error), and the
+ * comparison verdict. */
+export interface ShopVersionResult {
+    installed: string;
+    latest: string | null;
+    outdated: boolean;
+}
+/** `shop/updateStart` result (§7.3): the self-update spawn, or a typed
+ * refusal (a version that is not plain semver). */
+export type ShopUpdateResult = {
+    ok: true;
+    installId: string;
+} | {
+    ok: false;
+    detail: string;
+};
 /** `shop/installed` entry (§7.3): one installed catalog plugin. `installed`
  * is the profile manifest's dependency spec verbatim (a range, a tag, or
  * `workspace:*`); `outdated` is the Host's verdict that the installed version
@@ -111,6 +136,8 @@ export declare class ShopGateway extends TypertRemoteService {
      * production, a spy in tests. */
     private readonly exit;
     private readonly restartExitDelayMs;
+    private readonly restartParentPid;
+    private readonly latestVersion;
     /** The install gate runs against the last loaded snapshot, never a fresh
      * fetch per request (§7.2: the Host's cached snapshot is the truth). */
     /** Finished install records retained, so a poll sees the true terminal
@@ -184,11 +211,22 @@ export declare class ShopGateway extends TypertRemoteService {
         name: string;
     }): Promise<ShopUninstallResult>;
     /** Restart the dsh process the shop runs in (§8 amendment, 2026-08-27):
-     * re-spawn this process's own command line, return the new server's URL
-     * once it announces itself, and only then exit. A failed restart returns a
-     * typed failure and the old process keeps serving — the restart is
-     * all-or-nothing. The response must reach the browser before the exit, so
-     * the exit is delayed past the RPC round-trip. */
+     * commit a two-phase handoff — a detached helper waits for this pid to
+     * exit, then re-runs this process's own command line — and exit once the
+     * response is out. The browser monitors the origin and refreshes when the
+     * new server answers. Refusals are issued before anything is torn down. */
     restart(): Promise<ShopRestartResult>;
+    /** The shop's own version and whether npm has a newer one (§7.3). The
+     * check is advisory: a registry that cannot answer leaves `latest` null
+     * and the client shows the version alone. `installed` is the RUNNING
+     * version (own-version.ts), not the manifest's range spec. */
+    version(): Promise<ShopVersionResult>;
+    /** Update the shop itself to a published version (§7.3): the explicit pin
+     * is the only install form that bypasses pnpm's release cooldown. The
+     * version is re-validated as plain semver at the boundary — the spec
+     * `dsh-plugin-shop@<version>` is built here, never from the wire. */
+    updateStart(args: {
+        version: string;
+    }): Promise<ShopUpdateResult>;
 }
 export default ShopGateway;

package/lib/types/host/restart.d.ts

@@ -1,35 +1,38 @@
-/** Restart executor: re-spawn the Host's own command line and hand the
- * browser the new server's URL. The child is detached (its own process
- * group), so it survives both the parent's exit and the launching
- * terminal's. The parent exits only AFTER the child printed its
- * `dsh web: <url>` line — a restart that fails to come up leaves the old
- * process running untouched. */
-/** `shop/restart` outcome: the new server's URL, or a typed failure with an
- * author-readable detail. A failure means the OLD process is still serving —
- * the restart is all-or-nothing. */
+/** Restart executor: hand the port to a new dsh instance, two-phase.
+ *
+ * The old process cannot wait for the new one: the new one must bind the
+ * port the old one still holds, and two live processes cannot bind it at
+ * once — the first implementation spawned the child and waited for its URL,
+ * and the child crashed in boot with EADDRINUSE every time. The handoff is
+ * therefore inverted: the parent commits and exits FIRST, and a detached
+ * helper waits for the parent's pid to disappear before exec'ing the same
+ * dsh command line. The browser monitors the origin and refreshes once the
+ * new server answers; a boot that fails is diagnosed from the log file,
+ * since nobody is attached to the child's pipes. */
+/** `shop/restart` result: committed, or a typed refusal issued BEFORE
+ * anything is torn down. Once `ok` is returned the old process WILL exit —
+ * the client monitors the new server and reports a failed boot with the
+ * manual command. */
 export type RestartOutcome = {
     ok: true;
-    url: string;
 } | {
     ok: false;
     detail: string;
 };
-/** Spawn the restarted server and wait for it to announce its URL.
- *
- * The child runs the same `dsh` with the same argv the current process was
- * launched with (`process.argv.slice(2)` — node and the CLI script path
- * stripped), so the profile, port and flags reproduce the user's launch
- * verbatim. `--port 0` therefore yields a NEW port, and the returned URL is
- * how the browser finds it.
+/** Spawn the two-phase handoff. The helper is a POSIX shell wrapper that
+ * polls the parent pid until it is gone, then replaces itself with the dsh
+ * command — `exec "$@"` keeps the argv verbatim, so no argument quoting is
+ * involved. The child's stdout/stderr go to `logFile`, opened here in
+ * append mode; opening throws on failure, and the caller treats a throw as
+ * a refusal (the restart is never committed without its log).
  *
- * On success the caller exits the old process — but only after delivering
- * the RPC response carrying `url`, which is the caller's sequencing duty,
- * not this module's. On failure (child exits before announcing, spawn
- * error, or the timeout) the child is killed if still running and the old
- * process is untouched. */
+ * The pid-poll has the usual tiny reuse race — if the parent's pid is
+ * recycled within the 0.2s polling gap the helper waits for the unrelated
+ * process too. Harmless: it only delays the boot. */
 export declare function startRestart(options: {
     dshBin: string;
     argv: string[];
+    parentPid: number;
+    logFile: string;
     env?: NodeJS.ProcessEnv;
-    timeoutMs?: number;
-}): Promise<RestartOutcome>;
+}): void;

package/lib/types/host/self-update.d.ts

@@ -0,0 +1,9 @@
+/** Self-update version check: the shop's latest published version, from the
+ * npm packument. Advisory by design — like the stars sidecar, a failed
+ * check degrades to `null` and never throws, never blocks a publish. The
+ * catalog cannot serve here: the shop is bootstrap-installed and is not
+ * harvested into its own catalog. */
+/** Fetch the shop's `latest` dist-tag, or `null` when the registry cannot
+ * answer (network failure, unexpected payload — anything). The caller
+ * renders `null` as "no update check", never as a failure. */
+export declare function fetchLatestVersion(fetchFn?: typeof fetch): Promise<string | null>;

package/lib/types/own-version.d.ts

@@ -0,0 +1,7 @@
+/** The shop's own published version, read from the package.json that ships
+ * next to this package — the RUNNING version, not the manifest's range
+ * spec. This lives at the package root (not under src/host) on purpose:
+ * both the source tree (tests) and the bundled `lib/index.js` sit exactly
+ * one level below the package root, so the same relative URL resolves in
+ * both. */
+export declare function ownVersion(): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "repository": {
     "type": "git",