dsh-plugin-update-checker 0.0.0-stage → 0.1.4

package/lib/client.js

@@ -0,0 +1,429 @@
+/**
+ * dsh-plugin-update-checker — Browser half.
+ *
+ * Registers a "Check updates" tab into the Built-in plugins settings section
+ * (`settings.plugins.tab`), sitting beside the read-only inventory. The tab
+ * shows the running DSH runtime version, a prominent "Check updates" button,
+ * and — after the check — one row per installed plugin bundle reporting both:
+ *
+ *   - compatibility with the current DSH runtime (peer-dependency verdict), and
+ *   - update availability (published registry version vs the installed one).
+ *
+ * It calls only the host route this package ships (`/api/plugin-update-checker/
+ * scan`); it renders no local transport. A failed per-bundle lookup is shown as
+ * a row-level warning rather than blanking the report.
+ *
+ * Bundle id MUST equal package.json `name` (the dsh-client-modules Loader row
+ * resolver matches the registered module id to the package name).
+ */
+window.__ModuleLoader__.load({
+	id: "dsh-plugin-update-checker",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		let react = require("react");
+		let react_jsx_runtime = require("react/jsx-runtime");
+
+		//#region dictionaries
+		const NS = "pluginUpdateChecker";
+		const zh = {
+			"tab": "检查更新",
+			"title": "插件更新与兼容性检查",
+			"intro": "一键检查所有已安装插件的最新版本，以及它们与当前 DSH 运行时的兼容性。",
+			"dshVersion": "当前 DSH 版本",
+			"check": "检查更新",
+			"checking": "检查中…",
+			"lastChecked": "上次检查",
+			"never": "尚未检查",
+			"error": "检查失败",
+			"retry": "重试",
+			"noPlugins": "没有检测到任何已安装的插件包。",
+			"col.plugin": "插件",
+			"col.installed": "已安装版本",
+			"col.latest": "最新版本",
+			"col.compat": "兼容性",
+			"col.update": "更新",
+			"compat.compatible": "兼容",
+			"compat.incompatible": "不兼容",
+			"compat.unknown": "未知",
+			"update.upToDate": "已是最新",
+			"update.updateAvailable": "有更新",
+			"update.unknown": "未知",
+			"update.unsupported": "不受支持",
+			"update.partOfRuntime": "运行时的一部分",
+			"update.error": "无法检查",
+			"compat.peers": "不兼容的 peer 依赖",
+			"exempted": "已豁免",
+			"updateBtn": "更新",
+			"updating": "更新中…",
+			"updated": "已更新",
+			"updateFailed": "更新失败",
+			"linked": "源码链接（请从源码更新）",
+			"linkedHint": "该插件以源码软链方式安装，无法一键更新；请到源码目录拉取最新代码后重启 DSH。",
+			"sourceLink": "前往源码仓库",
+			"runtimeName": "DSH 运行时",
+			"runtimeUpdateAvailable": "有可用更新（通过 DSH 自带更新器升级）",
+			"runtimeUpdateHint": "DSH 运行时由应用自带的更新器管理，无法在此一键更新。请在菜单中检查更新，或重新启动应用以应用更新。",
+			"sourcePath": "源码路径",
+			"restartRequired": "已更新，需重启 DSH 生效",
+			"manualRestart": "请手动重启：先停止 3080 端口上的 DSH 进程，再运行 `dsh restart` 或重新启动 DSH（也可在终端执行 `dsh stop && dsh restart`）。重启后更新才会生效。",
+			"summary": "共 {total} 个插件：{incompatible} 个不兼容，{available} 个有可用更新。"
+		};
+		const en = {
+			"tab": "Check updates",
+			"title": "Plugin update & compatibility check",
+			"intro": "Check every installed plugin for the latest published version and its compatibility with the running DSH runtime in one click.",
+			"dshVersion": "Running DSH version",
+			"check": "Check updates",
+			"checking": "Checking…",
+			"lastChecked": "Last checked",
+			"never": "Not checked yet",
+			"error": "Check failed",
+			"retry": "Retry",
+			"noPlugins": "No installed plugin bundles detected.",
+			"col.plugin": "Plugin",
+			"col.installed": "Installed",
+			"col.latest": "Latest",
+			"col.compat": "Compatibility",
+			"col.update": "Update",
+			"compat.compatible": "Compatible",
+			"compat.incompatible": "Incompatible",
+			"compat.unknown": "Unknown",
+			"update.upToDate": "Up to date",
+			"update.updateAvailable": "Update available",
+			"update.unknown": "Unknown",
+			"update.unsupported": "Unsupported",
+			"update.partOfRuntime": "Part of the runtime",
+			"update.error": "Cannot check",
+			"compat.peers": "Incompatible peer dependencies",
+			"exempted": "Exempted",
+			"updateBtn": "Update",
+			"updating": "Updating…",
+			"updated": "Updated",
+			"updateFailed": "Update failed",
+			"linked": "Source-linked (update from source)",
+			"linkedHint": "This plugin is installed as a source symlink and cannot be updated in one click. Pull the latest from its source repo, then restart DSH.",
+			"sourceLink": "Open source repository",
+			"runtimeName": "DSH runtime",
+			"runtimeUpdateAvailable": "Update available (upgrade via the app's own updater)",
+			"runtimeUpdateHint": "The DSH runtime is managed by the app's built-in updater and cannot be updated here. Check for updates from the menu, or restart the app to apply an update.",
+			"sourcePath": "Source path",
+			"restartRequired": "Updated — restart DSH to apply",
+			"manualRestart": "Restart DSH manually: stop the DSH process on port 3080, then run `dsh restart` (or `dsh stop && dsh restart`) from a terminal. The update takes effect only after the restart.",
+			"summary": "{total} plugins: {incompatible} incompatible, {available} with an update available."
+		};
+		//#endregion
+
+		const COLORS = {
+			primary: "var(--dsw-alias-state-business-primary)",
+			error: "var(--dsw-alias-state-error-primary)",
+			warning: "var(--dsw-alias-state-warning-primary, #c9851f)",
+			ok: "var(--dsw-alias-state-success-primary, #1f9d55)",
+			label: "var(--dsw-alias-label-primary)",
+			tertiary: "var(--dsw-alias-label-tertiary)",
+			border: "var(--dsw-alias-border-l4)",
+			bg: "var(--dsw-alias-bg-layer-1)",
+			// Referenced by the source-repository link. It used to be missing, so
+			// the literal fallback fired on every render and the link ignored the
+			// theme; declare the token so the link follows the palette.
+			link: "var(--dsw-alias-label-primary-bluish, #3b82f6)"
+		};
+
+		function badge(text, color) {
+			return react_jsx_runtime.jsx("span", {
+				style: {
+					display: "inline-flex",
+					alignItems: "center",
+					height: 18,
+					padding: "0 7px",
+					fontSize: 10,
+					fontWeight: 600,
+					lineHeight: 1,
+					borderRadius: "var(--dsw-radius-sm)",
+					color: color,
+					background: "color-mix(in srgb, " + color + " 14%, transparent)",
+					whiteSpace: "nowrap"
+				},
+				children: text
+			});
+		}
+
+		function compatBadge(compat, t) {
+			if (compat.status === "incompatible") {
+				return badge(compat.exempted ? t("compat.incompatible") + " · " + t("exempted") : t("compat.incompatible"), COLORS.error);
+			}
+			if (compat.status === "unknown") return badge(t("compat.unknown"), COLORS.tertiary);
+			return badge(t("compat.compatible"), COLORS.ok);
+		}
+
+		function updateBadge(update, t) {
+			switch (update.status) {
+				case "update-available":
+					return badge(t("update.updateAvailable"), COLORS.warning);
+				case "up-to-date":
+					return badge(t("update.upToDate"), COLORS.ok);
+				case "part-of-runtime":
+					return badge(t("update.partOfRuntime"), COLORS.tertiary);
+				case "unsupported":
+					return badge(t("update.unsupported"), COLORS.tertiary);
+				case "unknown":
+				default:
+					return update.error ? badge(t("update.error"), COLORS.tertiary) : badge(t("update.unknown"), COLORS.tertiary);
+			}
+		}
+
+		function UpdateCheckerTab(props) {
+			const { t, scan } = props;
+			const [loading, setLoading] = react.useState(false);
+			const [error, setError] = react.useState(null);
+			const [result, setResult] = react.useState(null);
+			// Per-plugin update state keyed by bundle name.
+			const [updating, setUpdating] = react.useState({});
+			const [outcome, setOutcome] = react.useState({});
+
+			const run = react.useCallback(async () => {
+				setLoading(true);
+				setError(null);
+				try {
+					// Use the `scan` handed in by the tab registration instead of a
+					// second fetch here: one transport, one place to change it.
+					const data = await scan();
+					if (!data || data.ok !== true) throw new Error(data?.error || "scan failed");
+					setResult(data);
+					setOutcome({});
+				} catch (err) {
+					setError(String(err?.message ?? err));
+				} finally {
+					setLoading(false);
+				}
+			}, [scan]);
+
+			const doUpdate = react.useCallback(async (name, latest, registry) => {
+				// The runtime ('dsh-runtime') is not installed via pnpm and must not
+				// be updated with installBundle; its upgrade is delivered by the app's
+				// own updater. The compute below already hides the button for any
+				// non-"update-available" row, but guard anyway so a future change
+				// cannot route a runtime upgrade into installBundle.
+				if (name === "dsh-runtime") return;
+				setUpdating((s) => ({ ...s, [name]: true }));
+				setOutcome((s) => { const n = { ...s }; delete n[name]; return n; });
+				try {
+					const pm = props.remote?.pluginManager;
+					if (!pm?.installBundle) throw new Error("plugin manager service unavailable in this client");
+					// installBundle defaults to registry.npmjs.org, which is often
+					// unreachable here; probe the reachable registry first (mirrors
+					// the GUI's own fast-registry selection) and pass it explicitly.
+					// fastest() answers a Remote envelope { ok, value } — unwrap it;
+					// passing the envelope itself fails wire validation (registry
+					// must be null | string).
+					let reg = typeof registry === "string" && registry !== "" ? registry : "";
+					if (!reg) {
+						try {
+							const probe = await props.remote?.pluginRegistryProbe?.fastest();
+							if (probe?.ok && typeof probe.value === "string" && probe.value !== "") reg = probe.value;
+						} catch { /* keep empty */ }
+					}
+					// Pin to the exact latest version. A bare `name` spec leaves a
+					// profile that already pins the exact version (e.g. "0.6.5")
+					// unchanged, so installBundle reports a false "restart-required"
+					// without actually upgrading — leaving the old version after
+					// restart. `name@latest` forces pnpm to swap the version, exactly
+					// like the GUI's "Add plugin" dialog (which passes the resolved
+					// latest version as the spec).
+					const spec = typeof latest === "string" && latest !== "" ? `${name}@${latest}` : name;
+					const result = await pm.installBundle(spec, {
+						enabled: true,
+						requestId: `update-checker:${name}:${Date.now()}`,
+						...(reg ? { registry: reg } : {}),
+					});
+					if (!result?.ok) throw new Error(result?.error?.message || result?.error?.code || "install failed");
+					const value = result.value ?? {};
+					const application = value.application ?? "applied";
+					// `changed` is set by the host when the profile was actually
+					// modified (pnpm really swapped the version). installBundle may
+					// still report ok without changing anything (e.g. a bare spec
+					// against an already-pinned version), so surface that.
+					const changed = value.changed === true;
+					if (!changed) throw new Error("registry returned no newer version; profile unchanged");
+					setOutcome((s) => ({ ...s, [name]: { ok: true, restartRequired: application === "restart-required", application } }));
+					// When the change is live immediately, re-scan so the row flips
+					// to "up to date" instead of still showing "update available".
+					if (application !== "restart-required") { try { await run(); } catch { /* ignore */ } }
+				} catch (err) {
+					setOutcome((s) => ({ ...s, [name]: { ok: false, error: String(err?.message ?? err) } }));
+				} finally {
+					setUpdating((s) => ({ ...s, [name]: false }));
+				}
+			}, [run]);
+
+			const plugins = result?.plugins ?? [];
+			const incompatible = plugins.filter((p) => p.compatibility?.status === "incompatible").length;
+			const available = plugins.filter((p) => p.update?.status === "update-available").length;
+
+			return react_jsx_runtime.jsxs("div", {
+				style: { width: "100%", maxWidth: 760, display: "flex", flexDirection: "column", gap: 14, color: COLORS.label },
+				children: [
+					react_jsx_runtime.jsxs("div", {
+						style: { display: "flex", alignItems: "baseline", gap: 10, flexWrap: "wrap" },
+						children: [
+							react_jsx_runtime.jsx("h3", { style: { margin: 0, fontSize: 13, fontWeight: 600 }, children: t("dshVersion") }),
+							react_jsx_runtime.jsx("code", { style: { fontSize: 13, color: COLORS.tertiary }, children: result?.dshVersion ?? (loading ? "…" : "—") })
+						]
+					}),
+					react_jsx_runtime.jsxs("div", {
+						style: { display: "flex", alignItems: "center", gap: 12 },
+						children: [
+							react_jsx_runtime.jsx("button", {
+								type: "button",
+								disabled: loading,
+								onClick: () => run(),
+								style: {
+									appearance: "none",
+									cursor: loading ? "default" : "pointer",
+									border: "none",
+									borderRadius: "var(--dsw-radius-md)",
+									background: COLORS.primary,
+									color: "var(--dsw-alias-on-state-business, #fff)",
+									font: "inherit",
+									fontWeight: 600,
+									height: 36,
+									padding: "0 18px"
+								},
+								children: loading ? t("checking") : t("check")
+							}),
+							result ? react_jsx_runtime.jsx("span", { style: { fontSize: 13, color: COLORS.tertiary }, children: t("lastChecked") + ": " + new Date(result.checkedAt).toLocaleString() }) : null
+						]
+					}),
+					error ? react_jsx_runtime.jsxs("div", {
+						style: { display: "flex", alignItems: "center", gap: 10, color: COLORS.error, fontSize: 13 },
+						children: [
+							react_jsx_runtime.jsx("span", { children: t("error") + ": " + error }),
+							react_jsx_runtime.jsx("button", {
+								type: "button",
+								onClick: () => run(),
+								style: { border: "0.5px solid " + COLORS.border, borderRadius: "var(--dsw-radius-sm)", background: "transparent", color: COLORS.label, font: "inherit", cursor: "pointer", padding: "4px 10px" },
+								children: t("retry")
+							})
+						]
+					}) : null,
+					result && plugins.length > 0 ? react_jsx_runtime.jsx("p", {
+						style: { margin: 0, fontSize: 13, color: COLORS.tertiary },
+						children: t("summary", { total: plugins.length, incompatible, available })
+					}) : null,
+					!loading && result && plugins.length === 0 ? react_jsx_runtime.jsx("p", { style: { margin: 0, fontSize: 13, color: COLORS.tertiary }, children: t("noPlugins") }) : null,
+					Object.values(outcome).some((o) => o?.restartRequired === true) ? react_jsx_runtime.jsxs("div", {
+						style: { display: "flex", flexDirection: "column", gap: 6, border: "0.5px solid " + COLORS.warning, borderRadius: "var(--dsw-radius-md)", background: "color-mix(in srgb, " + COLORS.warning + " 10%, transparent)", padding: "10px 12px", fontSize: 13, color: COLORS.warning },
+						children: [
+							react_jsx_runtime.jsx("span", { style: { fontWeight: 600 }, children: t("restartRequired") }),
+							react_jsx_runtime.jsx("span", { style: { color: COLORS.label, fontSize: 12 }, children: t("manualRestart") })
+						]
+					}) : null,
+					result && plugins.length > 0 ? react_jsx_runtime.jsx("div", {
+						style: { display: "flex", flexDirection: "column", gap: 10 },
+						children: plugins.map((p) => react_jsx_runtime.jsxs("div", {
+							key: p.name,
+							style: { border: "0.5px solid " + COLORS.border, borderRadius: "var(--dsw-radius-md)", background: COLORS.bg, padding: "12px 14px", display: "flex", flexDirection: "column", gap: 8 },
+							children: [
+								react_jsx_runtime.jsxs("div", {
+									style: { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 12, flexWrap: "wrap" },
+									children: [
+										react_jsx_runtime.jsx("span", { style: { fontWeight: 600, fontSize: 13 }, children: p.name === "dsh-runtime" ? t("runtimeName") : p.name }),
+										react_jsx_runtime.jsxs("div", { style: { display: "flex", gap: 8, flexWrap: "wrap", alignItems: "center" }, children: [compatBadge(p.compatibility, t), updateBadge(p.update, t), (() => {
+											if (p.linked) return badge(t("linked"), COLORS.tertiary);
+											// The runtime is updated via the app's own updater, never
+											// installBundle; show a "check the menu" badge, not a button.
+											if (p.name === "dsh-runtime" && p.update?.status === "update-available") {
+												return react_jsx_runtime.jsx("span", { style: { fontSize: 12, color: COLORS.warning }, children: t("runtimeUpdateAvailable") });
+											}
+											if (p.update?.status !== "update-available") return null;
+											const busy = updating[p.name] === true;
+											const o = outcome[p.name];
+											if (o?.ok) return badge(o.restartRequired ? t("restartRequired") : t("updated"), COLORS.ok);
+											return react_jsx_runtime.jsx("button", {
+												type: "button",
+												disabled: busy,
+												onClick: () => doUpdate(p.name, p.update?.latest, p.update?.registry ?? p.registry),
+												style: { appearance: "none", cursor: busy ? "default" : "pointer", border: "none", borderRadius: "var(--dsw-radius-sm)", background: COLORS.warning, color: "#fff", font: "inherit", fontWeight: 600, fontSize: 12, height: 24, padding: "0 12px" },
+												children: busy ? t("updating") : t("updateBtn")
+											});
+										})()] })
+									]
+								}),
+								react_jsx_runtime.jsxs("div", {
+									style: { display: "flex", gap: 16, fontSize: 12, color: COLORS.tertiary, flexWrap: "wrap" },
+									children: [
+										react_jsx_runtime.jsxs("span", { children: [t("col.installed") + ": ", react_jsx_runtime.jsx("code", { children: p.installedVersion ?? "—" })] }),
+										react_jsx_runtime.jsxs("span", { children: [t("col.latest") + ": ", react_jsx_runtime.jsx("code", { children: p.linked ? t("linked") : (p.update?.latest ?? "—") })] })
+									]
+								}),
+								p.compatibility?.status === "incompatible" && p.compatibility.peers ? react_jsx_runtime.jsxs("div", {
+									style: { fontSize: 12, color: COLORS.error },
+									children: [
+										react_jsx_runtime.jsx("span", { children: t("compat.peers") + ": " }),
+										react_jsx_runtime.jsxs("code", { children: Object.entries(p.compatibility.peers).map((e, _i) => react_jsx_runtime.jsx("div", { children: e[0] + " " + e[1] }, e[0])) })
+									]
+								}) : null,
+								p.update?.status === "unknown" && p.update.error ? react_jsx_runtime.jsx("div", { style: { fontSize: 12, color: COLORS.tertiary }, children: p.update.error }) : null,
+								p.update?.status === "unsupported" && p.update.error ? react_jsx_runtime.jsx("div", { style: { fontSize: 12, color: COLORS.tertiary }, children: p.update.error }) : null,
+								p.linked ? react_jsx_runtime.jsxs("div", {
+									style: { display: "flex", flexDirection: "column", gap: 4, fontSize: 12, color: COLORS.tertiary },
+									children: [
+										react_jsx_runtime.jsx("span", { children: t("linkedHint") }),
+										react_jsx_runtime.jsx("span", { children: [t("sourcePath") + ": ", react_jsx_runtime.jsx("code", { children: p.source?.dir ?? "—" })] }),
+										p.source?.link ? react_jsx_runtime.jsx("a", {
+											href: p.source.link,
+											target: "_blank",
+											rel: "noreferrer",
+											style: { color: COLORS.link },
+											children: t("sourceLink")
+										}) : null
+									]
+								}) : null,
+								outcome[p.name]?.ok === false ? react_jsx_runtime.jsxs("div", { style: { fontSize: 12, color: COLORS.error }, children: [react_jsx_runtime.jsx("span", { children: t("updateFailed") + ": " }), react_jsx_runtime.jsx("span", { children: outcome[p.name].error || "unknown error" })] }) : null,
+								p.name === "dsh-runtime" && p.update?.status === "update-available" ? react_jsx_runtime.jsx("div", {
+									style: { fontSize: 12, color: COLORS.warning },
+									children: t("runtimeUpdateHint")
+								}) : null
+							]
+						}, p.name))
+					}) : null
+				]
+			});
+		}
+
+		//#region plugin body
+		/** Services required by the Settings registration + the update action. */
+		const inject = [
+			"slots",
+			"locale",
+			"modules",
+			"remote",
+			"remote.pluginManager",
+			"remote.pluginRegistryProbe"
+		];
+
+		/** Register the check-updates tab into the Built-in plugins settings section. */
+		function apply(ctx) {
+			ctx.effect(() => ctx.locale.register(NS, { zh, en }), "plugin-update-checker: dictionaries");
+			const t = ctx.locale.bind(NS);
+			const scan = async () => {
+				const res = await fetch("/api/plugin-update-checker/scan", { method: "POST" });
+				return res.json();
+			};
+			ctx.slots.inject("settings.plugins.tab", () => ctx.slots.register({
+				name: "settings.plugins.tab",
+				id: "update-checker",
+				order: 20,
+				label: () => t("tab"),
+				locale: NS,
+				inject: () => ({ t, scan, remote: ctx.remote })
+			}, UpdateCheckerTab), "plugin-update-checker: tab");
+		}
+		//#endregion
+
+		exports.apply = apply;
+		exports.inject = inject;
+		return module.exports;
+	}
+});

package/lib/host/dsh.js

@@ -0,0 +1,158 @@
+/**
+ * dsh-plugin-update-checker — host/dsh.js
+ *
+ * 由 lib/host/update-checker.js 按下述职责拆出（函数体逐字保留）：
+ *   require, isRuntimePackage, getDshRuntimeVersion, evaluatePluginCompatibility, readProfileVersionExemptions
+ */
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createRequire } from 'node:module'
+import { default as semver } from 'semver'
+import { activeProfileDir } from './profile.js'
+
+const require = createRequire(import.meta.url)
+
+/**
+ * Whether a bundle name belongs to the DSH *runtime* itself (as opposed to a
+ * user-installed plugin).
+ *
+ * Every @deepseek-ai/dsh* package is part of the runtime the launcher boots
+ * (dsh-base, dsh-web-app, dsh-app-boot, ...). The launcher symlinks them (it
+ * does not copy them) into the shared profiles tree from the runtime install,
+ * so the bundle scanner must NOT treat them as user source-links or as
+ * independently updatable plugins. The runtime carries a single version, which
+ * is checked as one unit (see checkDshRuntime), not bundle by bundle.
+ */
+export function isRuntimePackage(name) {
+  return name === '@deepseek-ai/dsh' || (typeof name === 'string' && name.startsWith('@deepseek-ai/dsh-'))
+}
+
+/**
+ * Running DSH runtime version.
+ *
+ * The launcher ships "@deepseek-ai/dsh-app-boot" whose own "version" equals the
+ * running runtime. We read that JSON (never execute the module, because a
+ * link-installed plugin cannot resolve "@deepseek-ai/*" from its own tree).
+ *
+ * Resolution strategy, most to least reliable:
+ *   1. require.resolve("@deepseek-ai/dsh-app-boot/package.json") - works when the
+ *      plugin is hoisted into the profile tree (the normal link case).
+ *   2. Walk UP from this file's real path's directory ancestors for
+ *      node_modules/@deepseek-ai/dsh-app-boot/package.json. Note we must convert
+ *      import.meta.url (a file:// URL) with fileURLToPath first, otherwise the
+ *      ancestor walk starts from a "file://..." string and never matches.
+ *   3. Walk UP from the active profile's node_modules/@deepseek-ai/dsh-app-boot/
+ *      package.json. The profile's shared tree is a DSH-maintained symlink that
+ *      always points at the current runtime, so this is a reliable fallback for
+ *      link:-installed plugins whose real path lives outside the profile tree.
+ *   4. DSH_VERSION env (some launchers set it).
+ */
+export function getDshRuntimeVersion() {
+  try {
+    return JSON.parse(readFileSync(require.resolve('@deepseek-ai/dsh-app-boot/package.json'), 'utf8')).version
+  } catch { /* fall through */ }
+
+  const anchors = [
+    dirname(fileURLToPath(import.meta.url)),
+    activeProfileDir(),
+  ]
+  for (const start of anchors) {
+    let dir = start
+    for (;;) {
+      const candidate = join(dir, 'node_modules', '@deepseek-ai', 'dsh-app-boot', 'package.json')
+      if (existsSync(candidate)) {
+        try { return JSON.parse(readFileSync(candidate, 'utf8')).version } catch { /* keep walking */ }
+      }
+      const parent = dirname(dir)
+      if (parent === dir) break
+      dir = parent
+    }
+  }
+  return process.env.DSH_VERSION || '0.0.0'
+}
+
+/**
+ * Reimplementation of @deepseek-ai/dsh-app-boot's evaluatePluginCompatibility
+ * (read-only, no shared-state side effects). Returns undefined when compatible,
+ * otherwise the { name, version, runtimeVersion, peers, exempted } shape the
+ * browser half renders.
+ */
+export function evaluatePluginCompatibility(manifest, exemptions, runtimeVersion) {
+  if (!manifest) return undefined
+
+  // engines.dsh decides ALONE: when it is present the launcher ignores
+  // peerDependencies entirely (dsh-app-boot's unmetRequirements returns the
+  // engines verdict and never reaches the peer loop). Mirroring only the peer
+  // branch made this checker disagree with the launcher for any plugin that
+  // moved its requirement onto engines.dsh - it reported "compatible" for a
+  // bundle the launcher would skip.
+  const engines = manifest.engines
+  if (engines !== null && typeof engines === 'object'
+    && Object.prototype.hasOwnProperty.call(engines, 'dsh')) {
+    const range = engines.dsh
+    if (typeof range !== 'string') throw new Error('engines.dsh must be a string')
+    const met = range.trim() !== ''
+      && semver.satisfies(runtimeVersion, range, { includePrerelease: true })
+    if (met) return undefined
+    return {
+      name: manifest.name,
+      version: manifest.version,
+      runtimeVersion,
+      peers: { 'engines.dsh': range },
+      exempted: false,
+    }
+  }
+
+  if (!Object.prototype.hasOwnProperty.call(manifest, 'peerDependencies')) return undefined
+  const dependencies = manifest.peerDependencies
+  const peers = {}
+  for (const [name, range] of Object.entries(dependencies)) {
+    if (typeof range !== 'string') throw new Error(`peerDependencies[${JSON.stringify(name)}] must be a string`)
+    if (name !== '@deepseek-ai/dsh' && !name.startsWith('@deepseek-ai/dsh-')) continue
+    const requirement = ['workspace:^', 'workspace:~', 'workspace:*'].includes(range) ? runtimeVersion : range
+    if (requirement.trim() === '' || !semver.satisfies(runtimeVersion, requirement, { includePrerelease: true })) {
+      peers[name] = range
+    }
+  }
+  if (Object.keys(peers).length === 0) return undefined
+  const name = manifest.name
+  const version = manifest.version
+  const key = `${name}@${version}`
+  return {
+    name,
+    version,
+    runtimeVersion,
+    peers,
+    exempted: (Object.prototype.hasOwnProperty.call(exemptions, key) ? exemptions[key] : undefined)?.includes(runtimeVersion) === true,
+  }
+}
+
+/** Read the profile's version-exemption map from compatibility.json. */
+export function readProfileVersionExemptions(profileDir) {
+  try {
+    const raw = JSON.parse(readFileSync(join(profileDir, 'compatibility.json'), 'utf8'))
+    return raw?.exemptions ?? {}
+  } catch {
+    return {}
+  }
+}
+
+/**
+ * The profile directory the launcher passed on the command line, when we can
+ * recognize it.
+ *
+ * The Electron desktop host does NOT export DSH_PROFILE into the host process
+ * (only DSH_CLIENT_VERSION), so the old `process.env.DSH_PROFILE || 'web'`
+ * fell back to 'web' and the scan silently reported the *web* profile's
+ * plugins while the app was actually running *desktop*. The launcher does pass
+ * the profile as an absolute path in argv (e.g.
+ *   DeepSeek Harness --expose-internals <host.js> <app.asar/dsh>
+ *     /Users/me/.dsh/profiles/desktop <runtime> ...),
+ * so argv is the authoritative source: it is the same value the launcher used
+ * to boot the runtime, not a guess.
+ *
+ * We only accept a candidate that (a) is absolute, (b) is not a flag, and
+ * (c) sits directly under a `profiles` directory — so runtime, app.asar and
+ * host.js paths never match. Returns undefined when nothing matches.
+ */