dsh-plugin-update-checker 0.0.0-stage → 0.1.4

package/lib/host/profile.js

@@ -0,0 +1,261 @@
+/**
+ * dsh-plugin-update-checker — host/profile.js
+ *
+ * 由 lib/host/update-checker.js 按下述职责拆出（函数体逐字保留）：
+ *   profileDirFromArgv, activeProfileDir, readManifest, readManifestSync, findBundleDir, KNOWN_REPOS, resolveSourceLink, gitWebUrl, describeBundle, listBundles
+ */
+import { readFile, readdir } from 'node:fs/promises'
+import { readFileSync, realpathSync, existsSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
+import { homedir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { createRequire } from 'node:module'
+
+const require = createRequire(import.meta.url)
+
+function profileDirFromArgv() {
+  for (const arg of process.argv.slice(2)) {
+    if (!arg.startsWith('/') || arg.startsWith('-')) continue
+    if (!existsSync(join(arg, 'package.json'))) continue
+    // The parent directory must be named `profiles`: that is the only shape
+    // DSH itself creates (~/.dsh/profiles/<name> or $DSH_HOME/profiles/<name>).
+    if (basename(dirname(arg)) !== 'profiles') continue
+    return arg
+  }
+  return undefined
+}
+
+/** Resolve the active profile directory: argv first, then env, then home+name. */
+export function activeProfileDir() {
+  const fromArgv = profileDirFromArgv()
+  if (fromArgv) return fromArgv
+
+  // DSH_PROFILE_DIR is an absolute path already; some hosts export it instead
+  // of (or alongside) DSH_PROFILE. Trust it when it really is a profile.
+  const fromEnvDir = process.env.DSH_PROFILE_DIR?.trim()
+  if (fromEnvDir && existsSync(join(fromEnvDir, 'package.json'))) return fromEnvDir
+
+  const home = (process.env.DSH_HOME && process.env.DSH_HOME.trim() !== '') ? process.env.DSH_HOME : join(homedir(), '.dsh')
+  // A DSH_PROFILE that names a real directory always wins; only when it is
+  // absent (or names something that does not exist) do we fall back. Note we
+  // no longer default to 'web' silently: if DSH_PROFILE is set but wrong we
+  // still prefer it, so an explicit operator choice is never overridden.
+  if (process.env.DSH_PROFILE) return join(home, 'profiles', process.env.DSH_PROFILE)
+  return join(home, 'profiles', 'web')
+}
+
+/** Read + parse a package.json; returns undefined on any read/parse failure. */
+export async function readManifest(manifestPath) {
+  try {
+    return JSON.parse(await readFile(manifestPath, 'utf8'))
+  } catch {
+    return undefined
+  }
+}
+
+/** Locate a bundle's installed directory: profile node_modules, then shared tree. */
+function readManifestSync(manifestPath) {
+  try {
+    return JSON.parse(readFileSync(manifestPath, 'utf8'))
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Build a single bundle descriptor for a name known to be a bundle.
+ *
+ * Resolves the installed directory via findBundleDir (which follows symlinks,
+ * so link:-installed plugins resolve correctly), and pulls version + registry
+ * from the manifest. This never enumerates dependency directories (semver, zod,
+ * ...) because the names come exclusively from the profile's dsh.profile.bundles
+ * (the launcher's authoritative bundle list).
+ *
+ * The resolved directory and parsed manifest travel with the descriptor so
+ * scanBundle does not resolve and re-read the same package.json a second time
+ * (it used to: one findBundleDir + one readManifestSync here, then another of
+ * each there, for every bundle).
+ */
+export function findBundleDir(name, profileDir) {
+  const home = (process.env.DSH_HOME && process.env.DSH_HOME.trim() !== '') ? process.env.DSH_HOME : join(homedir(), '.dsh')
+  // Two trees hold a bundle: the profile's own node_modules, then the shared
+  // profiles/node_modules. For an unscoped name the package directory IS the
+  // entry, so the old "scoped ? scopeDir : leaf" second candidate was a
+  // duplicate of the first (two wasted stat calls per bundle); for a scoped
+  // name it pointed at the bare scope directory (@local), which is not a
+  // package and could shadow the real one if it ever held a package.json.
+  const candidates = [
+    join(profileDir, 'node_modules', name),
+    join(home, 'profiles', 'node_modules', name),
+  ]
+  for (const dir of candidates) {
+    if (existsSync(join(dir, 'package.json'))) return dir
+  }
+  try {
+    return dirname(require.resolve(`${name}/package.json`))
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Known source repos for link:-installed bundles, keyed by package name.
+ *
+ * A link:-installed bundle publishes nothing to a registry and may not carry a
+ * `repository` field or live in a git checkout, so the scanner cannot always
+ * discover its source URL. Declare them here (or via the plugin config's
+ * `repositories` map) as bare URLs like "https://github.com/<org>/<repo>"; the
+ * scanner appends "/tree/<ref>/<subpath>" when the local path is inside the repo.
+ */
+export const KNOWN_REPOS = {
+  "dsh-minimal-ui-panels": "https://github.com/windrover/dsh-minimal-UI-panels",
+}
+
+/**
+ * Resolve a link:-installed bundle's real source directory and its git origin.
+ *
+ * A link:-installed bundle is a symlink into the developer's source tree, so it
+ * publishes nothing to a registry and installBundle must never replace it. We
+ * therefore skip the registry and instead point the user at the source: the real
+ * path (git worktree) and the origin remote (for a one-click GitHub link). When
+ * the local checkout has no git origin and no declared repo, `repoUrl` stays null
+ * and the UI falls back to showing just the local path.
+ *
+ * @returns {{ dir: string, repoUrl: string|null, ref: string, subpath: string|null }}
+ *   repoUrl is the origin's web URL (GitHub/GitLab/Codeberg) when resolvable,
+ *   subpath is the path inside the repo the bundle lives at (for monorepos),
+ *   ref is the current branch/HEAD (used as the tree ref in the link).
+ */
+export function resolveSourceLink(dir, declaredRepo) {
+  let real = dir
+  try { real = realpathSync(dir) } catch { /* keep dir */ }
+  let repo = real
+  for (;;) {
+    if (existsSync(join(repo, '.git'))) break
+    const parent = dirname(repo)
+    if (parent === repo) { repo = null; break }
+    repo = parent
+  }
+  let repoUrl = declaredRepo ? gitWebUrl(declaredRepo) : null
+  let ref = 'main'
+  if (repo) {
+    try {
+      const out = execFileSync('git', ['remote', 'get-url', 'origin'], { cwd: repo, encoding: 'utf8' }).trim()
+      if (out) repoUrl = repoUrl ?? gitWebUrl(out)
+    } catch { /* no origin */ }
+    try {
+      const head = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: repo, encoding: 'utf8' }).trim()
+      if (head && head !== 'HEAD') ref = head
+    } catch { /* detached */ }
+  }
+  let subpath = null
+  if (repo && real.startsWith(repo + '/')) subpath = real.slice(repo.length + 1)
+  return { dir: real, repoUrl, ref, subpath }
+}
+
+/** Turn a git remote URL (ssh/https) into a web URL (best-effort for common hosts). */
+function gitWebUrl(remote) {
+  let url = (remote ?? '').trim()
+  if (!url) return null
+  if (url.startsWith('git@')) url = 'https://' + url.slice(4).replace(/:/, '/')
+  if (url.endsWith('.git')) url = url.slice(0, -4)
+  if (/^https?:\/\//.test(url)) return url
+  return null
+}
+
+/**
+ * Registries to probe, best first.
+ *
+ * The host half declares only `webServer`, and this cordis version throws on any
+ * service access outside `inject` ("cannot get property ... without inject"), so
+ * the browser-side plugin manager is not reachable from here. Read whatever
+ * configuration the host can see for itself.
+ *
+ * Precedence is first-found-wins, and what counts as safe to race depends on
+ * what was found:
+ *
+ *  - Nothing configured → race the mirror the launcher also falls back to
+ *    against the public registry. Both are public, so trying both costs only a
+ *    request, and on a mirror-served host it saves the public registry's latency
+ *    (measured here: ~0.2 s against the mirror versus ~11 s against npmjs).
+ *  - The *public default* configured (npm writes this into ~/.npmrc itself) →
+ *    keep it first and add the mirror behind it. Racing two public registries
+ *    leaks nothing, and it is what the launcher already documents.
+ *  - Anything else configured → it alone. A corporate or internal registry was
+ *    named deliberately; racing it would send internal package names to third
+ *    parties, and the public registries cannot answer for its packages anyway.
+ *
+ * @param {string} profileDir - the active profile directory.
+ * @returns {string[]} registry bases, deduplicated, best first.
+ */
+function describeBundle(name, profileDir) {
+  const dir = findBundleDir(name, profileDir)
+  const manifest = dir ? readManifestSync(join(dir, 'package.json')) : undefined
+  return {
+    name,
+    version: manifest?.version ?? null,
+    // A name listed in dsh.profile.bundles is not proof that it is installed:
+    // the list is hand-maintained and can keep entries whose package was never
+    // installed (or was removed). findBundleDir returns undefined then, and
+    // reporting installed:true made the panel show a phantom row with a null
+    // version. `installed` now reflects whether the directory actually
+    // resolved, which is what the browser half renders.
+    installed: Boolean(dir),
+    optional: false,
+    registry: manifest?.publishConfig?.registry ?? '',
+    dir,
+    manifest,
+  }
+}
+
+/**
+ * Enumerate the bundles to scan.
+ *
+ * Primary source: the profile's dsh.profile.bundles list (authoritative; it
+ * excludes bare dependencies like semver/zod and includes every link:-installed
+ * plugin). Each name is turned into a descriptor by describeBundle.
+ *
+ * Fallback (no bundle list in the profile): a best-effort directory walk over
+ * profile/node_modules that treats symlinks as bundles too. This last-resort
+ * path can include dependency directories, so it is only used when the
+ * canonical list is unavailable.
+ */
+export async function listBundles(profileDir) {
+  let names = []
+  try {
+    const pj = JSON.parse(readFileSync(join(profileDir, 'package.json'), 'utf8'))
+    const b = pj?.dsh?.profile?.bundles
+    if (Array.isArray(b)) names = b
+  } catch { /* ignore */ }
+  if (names.length > 0) return names.map((name) => describeBundle(name, profileDir))
+
+  const nm = join(profileDir, 'node_modules')
+  const out = []
+  const readEntries = async (base) =>
+    (await readdir(base, { withFileTypes: true })).catch(() => [])
+  const collect = async (dir) => {
+    const manifest = await readManifest(join(dir, 'package.json'))
+    if (manifest?.name) out.push({ name: manifest.name, version: manifest.version, installed: true, optional: false })
+  }
+  for (const entry of await readEntries(nm)) {
+    const dir = join(nm, entry.name)
+    if (entry.isDirectory()) {
+      if (entry.name.startsWith('@')) {
+        for (const inner of await readEntries(dir)) await collect(join(dir, inner.name))
+      } else {
+        await collect(dir)
+      }
+    } else if (entry.isSymbolicLink()) {
+      await collect(dir)
+    }
+  }
+  return out
+}
+
+/**
+ * Plugin entry point: register the scan route.
+ * @param {object} ctx - host context (needs webServer).
+ * @param {object} _config - plugin config; supports `repositories` keyed by
+ *   package name -> source repo URL (e.g. "https://github.com/<org>/<repo>"),
+ *   used to render a clickable link for link:-installed bundles.
+ */

package/lib/host/registry.js

@@ -0,0 +1,195 @@
+/**
+ * dsh-plugin-update-checker — host/registry.js
+ *
+ * 由 lib/host/update-checker.js 按下述职责拆出（函数体逐字保留）：
+ *   resolveRegistries, firstConfiguredRegistry, normalizeRegistry, isPublicDefault, readRegistryFromNpmrc, probeAnyRegistry, probeRegistry, classifyUpdate
+ */
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { default as semver } from 'semver'
+
+export function resolveRegistries(profileDir) {
+  const MIRROR = 'https://registry.npmmirror.com'
+  const PUBLIC = 'https://registry.npmjs.org'
+
+  const configured = firstConfiguredRegistry(profileDir)
+  if (configured === undefined) return [MIRROR, PUBLIC]
+  if (isPublicDefault(configured)) return [configured, MIRROR]
+  return [configured]
+}
+
+/** The first registry named by the environment or an .npmrc, most specific first. */
+function firstConfiguredRegistry(profileDir) {
+  const sources = [
+    process.env.npm_config_registry,
+    process.env.NPM_CONFIG_REGISTRY,
+    readRegistryFromNpmrc(join(profileDir, '.npmrc')),
+    readRegistryFromNpmrc(join(homedir(), '.npmrc')),
+  ]
+  for (const value of sources) {
+    const base = normalizeRegistry(value)
+    if (base !== undefined) return base
+  }
+  return undefined
+}
+
+/** Trim a registry into a bare base URL, or undefined when it names nothing. */
+export function normalizeRegistry(value) {
+  if (typeof value !== 'string') return undefined
+  const trimmed = value.trim().replace(/\/+$/, '')
+  if (trimmed === '') return undefined
+  return /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`
+}
+
+/** Whether a registry is npm's own public default. */
+function isPublicDefault(base) {
+  try {
+    return new URL(base).hostname.toLowerCase() === 'registry.npmjs.org'
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Read the default `registry=` out of an .npmrc.
+ *
+ * Only the unscoped default is taken: a scoped `@scope:registry=` sends one
+ * scope elsewhere, which is a per-package decision belonging with that package's
+ * manifest rather than with the default this resolves.
+ *
+ * @param {string} file - path to an .npmrc.
+ * @returns {string|undefined} the configured registry, if any.
+ */
+function readRegistryFromNpmrc(file) {
+  let text
+  try {
+    text = readFileSync(file, 'utf8')
+  } catch {
+    return undefined
+  }
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim()
+    if (line === '' || line.startsWith('#') || line.startsWith(';')) continue
+    // A scoped entry (`@scope:registry=`) is per-scope, not the default.
+    if (line.startsWith('@')) continue
+    const match = /^registry\s*=\s*(.+)$/.exec(line)
+    if (match) {
+      const value = match[1].trim().replace(/^["']|["']$/g, '')
+      if (value !== '') return value
+    }
+  }
+  return undefined
+}
+
+/**
+ * Probe the registries concurrently and take the first *successful* answer.
+ *
+ * A per-registry failure (or a slow one) never blocks the others: the mirror
+ * wins even when the public registry was asked first, which is the whole point
+ * on a mirror-served host. The winner's base is returned so a caller that needs
+ * to install from the same place can pass it along.
+ *
+ * @param {string} name - package name.
+ * @param {string[]} registries - candidate bases, best first.
+ * @param {AbortSignal} signal - request deadline.
+ * @returns {Promise<{ result: object, registry: string }>} the winning answer.
+ */
+export async function probeAnyRegistry(name, registries, signal) {
+  // Start every candidate at once and settle on the first *successful* answer,
+  // in completion order rather than list order. Awaiting in list order would let
+  // a slow first registry delay an already-finished mirror — exactly the case
+  // this exists to fix.
+  if (registries.length === 0) return { result: { error: 'no registry configured' }, registry: undefined }
+  return await new Promise((resolve) => {
+    let failures = 0
+    let lastFailure = null
+    let settled = false
+    for (const registry of registries) {
+      probeRegistry(name, registry, signal).then((result) => {
+        if (settled) return
+        if (result.error === undefined) {
+          settled = true
+          resolve({ result, registry })
+          return
+        }
+        lastFailure = { result, registry }
+        failures += 1
+        if (failures === registries.length) {
+          settled = true
+          resolve(lastFailure)
+        }
+      }, (err) => {
+        if (settled) return
+        lastFailure = { result: { error: `registry unreachable: ${String(err?.message ?? err)}` }, registry }
+        failures += 1
+        if (failures === registries.length) {
+          settled = true
+          resolve(lastFailure)
+        }
+      })
+    }
+  })
+}
+
+/** Probe one npm registry for a package's published versions. */
+async function probeRegistry(name, registry, signal) {
+  const base = registry && registry.trim() !== '' ? registry.replace(/\/+$/, '') : 'https://registry.npmjs.org'
+  const url = `${base}/${encodeURIComponent(name).replace('%40', '@')}`
+  try {
+    const res = await fetch(url, { method: 'GET', headers: { accept: 'application/json' }, signal })
+    if (!res.ok) return { error: `registry responded ${res.status}` }
+    const data = await res.json()
+    const distTags = data?.['dist-tags']
+    const versions = Array.isArray(data?.versions) ? data.versions : Object.keys(data?.versions ?? {})
+    if (distTags?.latest === undefined && versions.length === 0) return { error: 'package not found on registry' }
+    return { latest: distTags?.latest, versions }
+  } catch (err) {
+    if (err?.name === 'AbortError') return { error: 'request aborted' }
+    return { error: `registry unreachable: ${String(err?.message ?? err)}` }
+  }
+}
+
+/** Compare installed vs latest into an update verdict. */
+export function classifyUpdate(installedVersion, remote) {
+  if (remote.error !== undefined) return { status: 'unknown', error: remote.error }
+  const latest = remote.latest
+  if (latest === undefined) return { status: 'unknown', error: 'no published version' }
+  let newer = false
+  try {
+    newer = semver.gt(latest, installedVersion ?? '0.0.0')
+  } catch {
+    newer = String(latest) !== String(installedVersion)
+  }
+  return newer ? { status: 'update-available', latest } : { status: 'up-to-date', latest }
+}
+
+/**
+ * Check the running DSH *runtime* itself for a newer release.
+ *
+ * The runtime is not a plugin: it is the @deepseek-ai/dsh* tree the launcher
+ * boots, carrying one version. We report it as a single, clearly labelled row
+ * ("dsh-runtime") so the panel can answer "is my DSH itself up to date?" — the
+ * question the old panel silently left unanswered. We never call it a
+ * source-link (the @deepseek-ai/dsh* packages are symlinked from the runtime
+ * install, which would otherwise make the scanner mislabel the *entire runtime*
+ * as a user-edited source tree and say "update from the repository").
+ *
+ * Source precedence for the running-runtime comparison:
+ *   1. The desktop app's own electron updater feed (app-update.yml's `url` +
+ *      `channel`). This is the authoritative channel and the ONLY correct one
+ *      for prerelease / nightly users: npm's `latest` dist-tag lags the running
+ *      nightly build, so comparing against it would falsely report "up to date".
+ *   2. npm's @deepseek-ai/dsh-app-boot `latest` dist-tag — correct for stable
+ *      channel users, and used when no updater feed is reachable (e.g. the web
+ *      profile, which has no app-update.yml).
+ *
+ * A probe failure (offline, private registry, ...) is surfaced honestly as
+ * status 'unknown' rather than hiding the row.
+ *
+ * @param {string} dshVersion - the running runtime version.
+ * @param {string[]} registries - candidate registry bases, best first.
+ * @param {AbortSignal} signal - request deadline.
+ * @returns {Promise<object>} a row shaped like scanBundle's output, with
+ *   name 'dsh-runtime', so the browser half can render it without special-casing.
+ */

package/lib/host/runtime.js

@@ -0,0 +1,143 @@
+/**
+ * dsh-plugin-update-checker — host/runtime.js
+ *
+ * 由 lib/host/update-checker.js 按下述职责拆出（函数体逐字保留）：
+ *   APP_UPDATE_YML, readAppUpdateConfig, runtimeFeedFileNames, runtimePlatformKey, runtimeArchKey, fetchRuntimeFeedVersion, checkDshRuntime
+ */
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { default as semver } from 'semver'
+import { normalizeRegistry, probeAnyRegistry, classifyUpdate } from './registry.js'
+
+const APP_UPDATE_YML = 'app-update.yml'
+
+/**
+ * Locate and parse the desktop app's app-update.yml.
+ *
+ * The Electron host's argv carries the app path (e.g.
+ *   DeepSeek Harness --expose-internals <host.js> <app.asar/dsh>
+ *     /Users/me/.dsh/profiles/desktop <runtime> ...),
+ * so we walk up from that path to find app-update.yml (it sits in
+ * .../Contents/Resources/, the parent of app.asar). On the web profile there is
+ * no app bundle, so this returns undefined and the runtime check falls back to
+ * npm. Returns { url, channel } or undefined.
+ */
+function readAppUpdateConfig() {
+  for (const arg of process.argv.slice(2)) {
+    if (!arg.startsWith('/') || arg.startsWith('-')) continue
+    let dir = dirname(arg)
+    for (let i = 0; i < 6; i++) {
+      const candidate = join(dir, APP_UPDATE_YML)
+      if (existsSync(candidate)) {
+        try {
+          const text = readFileSync(candidate, 'utf8')
+          const get = (k) => {
+            const m = new RegExp(`^\\s*${k}\\s*:\\s*(.+)$`, 'm').exec(text)
+            return m ? m[1].trim() : undefined
+          }
+          const url = get('url')
+          if (!url) return undefined
+          return { url: normalizeRegistry(url).replace(/\/+$/, ''), channel: get('channel') || 'latest' }
+        } catch {
+          return undefined
+        }
+      }
+      const parent = dirname(dir)
+      if (parent === dir) break
+      dir = parent
+    }
+  }
+  return undefined
+}
+
+/** electron-builder's channel file name for the current platform/arch. */
+function runtimeFeedFileNames(channel, platform, arch) {
+  const base = (channel === 'latest' ? 'latest' : channel) + '-' + platform
+  // electron-builder may publish a per-arch file (latest-mac-arm64.yml) in
+  // addition to the platform-only file; try the arch-suffixed name first.
+  return arch ? [base + '-' + arch + '.yml', base + '.yml'] : [base + '.yml']
+}
+
+/** Map node's platform/arch onto electron-builder's feed naming. */
+function runtimePlatformKey() {
+  const p = process.platform
+  if (p === 'darwin') return 'mac'
+  if (p === 'win32') return 'win'
+  if (p === 'linux') return 'linux'
+  return undefined
+}
+function runtimeArchKey() {
+  if (process.arch === 'arm64') return 'arm64'
+  if (process.arch === 'x64') return 'x64'
+  return undefined
+}
+
+/**
+ * Fetch the published runtime version from the desktop app's electron updater
+ * feed. Returns { version } on success or { error } when every candidate file
+ * is missing/unreachable, so the caller can fall back to npm.
+ */
+async function fetchRuntimeFeedVersion(feedBase, channel, signal) {
+  const platform = runtimePlatformKey()
+  if (!platform) return { error: 'unsupported platform for feed lookup' }
+  const names = runtimeFeedFileNames(channel, platform, runtimeArchKey())
+  let lastErr
+  for (const name of names) {
+    const url = feedBase + '/' + name
+    try {
+      const res = await fetch(url, { method: 'GET', signal })
+      if (!res.ok) { lastErr = `feed responded ${res.status}`; continue }
+      const text = await res.text()
+      const m = /^version\s*:\s*(\S+)/m.exec(text)
+      if (!m) { lastErr = 'feed missing version'; continue }
+      return { version: m[1].replace(/['"]/g, '') }
+    } catch (err) {
+      if (err?.name === 'AbortError') return { error: 'request aborted' }
+      lastErr = `feed unreachable: ${String(err?.message ?? err)}`
+    }
+  }
+  return { error: lastErr ?? 'feed not found' }
+}
+
+/** Scan one bundle for compatibility + update facts. */
+export async function checkDshRuntime(dshVersion, registries, signal) {
+  const row = {
+    name: 'dsh-runtime',
+    installedVersion: dshVersion,
+    installed: true,
+    linked: false,
+    description: 'DSH 运行时（@deepseek-ai/dsh*）',
+    compatibility: { status: 'compatible' },
+    update: { status: 'unknown', error: 'not scanned' },
+  }
+  try {
+    // 1) Authoritative: the desktop app's own electron updater feed.
+    const cfg = readAppUpdateConfig()
+    if (cfg) {
+      const feed = await fetchRuntimeFeedVersion(cfg.url, cfg.channel, signal)
+      if (feed.version !== undefined) {
+        let newer = false
+        try { newer = semver.gt(feed.version, dshVersion ?? '0.0.0') } catch { newer = String(feed.version) !== String(dshVersion) }
+        if (newer) {
+          row.update = { status: 'update-available', latest: feed.version, source: 'desktop-updater' }
+        } else {
+          row.update = { status: 'up-to-date', latest: feed.version }
+        }
+        return row
+      }
+      // Feed unreachable -> fall through to npm; its error is non-fatal.
+    }
+    // 2) Fallback: npm's @deepseek-ai/dsh-app-boot `latest` dist-tag.
+    const { result: remote, registry: usedRegistry } = await probeAnyRegistry('@deepseek-ai/dsh-app-boot', registries, signal)
+    row.update = classifyUpdate(dshVersion, remote)
+    if (row.update.status !== 'unknown' && usedRegistry) row.update.registry = usedRegistry
+    if (row.update.status === 'unknown' && remote.error && /not found|404/.test(remote.error)) {
+      row.update = { status: 'unsupported', error: 'runtime not published to the configured registry' }
+    }
+  } catch (err) {
+    row.update = { status: 'unknown', error: String(err?.message ?? err) }
+  }
+  return row
+}
+
+/** The electron updater's channel file lives next to the app at app-update.yml. */