dsh-remote-bridge 2.3.1 → 2.3.4

package/README.en.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.1-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.4-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -73,10 +73,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # 2. tarball from the GitHub release
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.1/dsh-remote-bridge-v2.3.1.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.4/dsh-remote-bridge-v2.3.4.tgz
 
 # 3. tarball from the Gitee release (faster from mainland China)
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.1/dsh-remote-bridge-v2.3.1.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.4/dsh-remote-bridge-v2.3.4.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -93,7 +93,7 @@ Restart DSH after installation, then open settings — The section is titled **
 To install a downloaded release archive:
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.3.1.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.3.4.tgz
 ```
 
 ## First connection
@@ -327,11 +327,11 @@ pnpm pack
 
 `npm pack` produces roughly a **0.25 MB** archive: 2.2.0 dropped the standalone page and its editor dependencies and turned source maps off, down from 1.72 MB.
 
-v2.3.1 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
+v2.3.4 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
 
 ## Project
 
-- Version: `v2.3.1`
+- Version: `v2.3.4`
 - Author: upstream [Hakunm](https://github.com/Hakunm); this fork maintained by [westanke](https://github.com/westanke)
 - Repository: [GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm: [`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge) ([mainland-China mirror](https://registry.npmmirror.com/dsh-remote-bridge))

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.1-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.4-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -70,10 +70,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # ② GitHub Release 的 tarball
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.1/dsh-remote-bridge-v2.3.1.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.4/dsh-remote-bridge-v2.3.4.tgz
 
 # ③ Gitee Release 的 tarball（国内访问更快）
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.1/dsh-remote-bridge-v2.3.1.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.4/dsh-remote-bridge-v2.3.4.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -89,7 +89,7 @@ npx @deepseek-ai/dsh web
 从 GitHub Release 下载离线安装包时，可直接安装 tarball：
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.3.1.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.3.4.tgz
 ```
 
 ## 第一次使用
@@ -319,11 +319,11 @@ pnpm pack
 
 `npm pack` 的产物约 **0.25 MB**：2.2.0 删除独立页及其编辑器依赖、并关闭 source map 之后，从 1.72 MB 降下来。
 
-v2.3.1 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
+v2.3.4 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
 
 ## 项目信息
 
-- 当前版本：`v2.3.1`
+- 当前版本：`v2.3.4`
 - 作者：上游 [Hakunm](https://github.com/Hakunm)，本 fork 维护 [westanke](https://github.com/westanke)
 - 仓库：[GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm：[`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge)（[国内镜像](https://registry.npmmirror.com/dsh-remote-bridge)）

package/docs/api/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.0.0
 info:
   title: DeepSeek Harness Mobile Events
-  version: 2.3.1
+  version: 2.3.4
   description: |
     Live file and authorized DSH chat events. Reconnect clients must refresh
     REST state; unbounded replay is not provided.

package/docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: DeepSeek Harness Mobile API
-  version: 2.3.1
+  version: 2.3.4
   description: Versioned file and chat BFF for mobile and third-party DSH clients. HTTP and HTTPS are both supported.
 servers:
   - url: http://127.0.0.1:3090/api/v1
@@ -24,7 +24,7 @@ paths:
                 properties:
                   ok: { type: boolean, const: true }
                   version: { type: string, const: v1 }
-                  pluginVersion: { type: string, const: 2.3.1 }
+                  pluginVersion: { type: string, const: 2.3.4 }
   /pairings/exchange:
     post:
       security: []
@@ -334,6 +334,56 @@ paths:
               schema: { $ref: '#/components/schemas/ProviderSettings' }
         '400': { $ref: '#/components/responses/Error' }
         '409': { $ref: '#/components/responses/Error' }
+  /settings/plugins:
+    get:
+      operationId: listPlugins
+      description: Lists every package the active profile declares or loads, with its resolved state.
+      parameters:
+        - name: checkUpdates
+          in: query
+          required: false
+          schema: { type: string, enum: ['1'] }
+          description: 'When `1`, also queries the npm registry for each installed third-party package. Adds seconds to the response, so it is opt-in.'
+      responses:
+        '200':
+          description: 'Plugin inventory. `available: false` plus a `reason` means the profile could not be resolved or read; the endpoint does not fail for that.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/PluginInventory' }
+    patch:
+      operationId: setPluginLoaded
+      description: |
+        Enables or disables a plugin by adding or removing its name in `dsh.profile.bundles`.
+        Dependency declarations are left alone (the package stays on disk and can be re-enabled
+        without downloading), and no package install runs. A backup of the profile manifest is
+        written before any change. **Bundles are read only at startup**, so the running DSH keeps
+        the previous set until it restarts.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [name, loaded]
+              properties:
+                name: { type: string, examples: [dsh-ffmpeg] }
+                loaded: { type: boolean, description: 'true to enable, false to disable.' }
+      responses:
+        '200':
+          description: 'Applied. The response carries `restartRequired: true`.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/PluginToggleResult' }
+        '400':
+          description: 'Bad request, official package, or package not installed. Error codes: REQUEST_INVALID, PLUGIN_NAME_INVALID, PLUGIN_OFFICIAL_IMMUTABLE, PLUGIN_NOT_INSTALLED.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/Error' }
+        '503':
+          description: 'The profile could not be resolved or its manifest could not be read. Error codes: PROFILE_UNKNOWN, MANIFEST_UNREADABLE.'
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/Error' }
   /settings/models:
     get:
       operationId: listModelCatalog
@@ -837,6 +887,64 @@ components:
         application/json:
           schema: { $ref: '#/components/schemas/ErrorEnvelope' }
   schemas:
+    PluginEntry:
+      type: object
+      description: One package the active profile declares or loads. Contents are limited to these fields; the package manifest itself is never forwarded.
+      required: [name, declared, installed, loaded, official, state, description, homepage, updateAvailable, latestVersion, toggleable]
+      properties:
+        name: { type: string, examples: [dsh-ffmpeg, '@liustack/modlens'] }
+        declared:
+          type: [string, 'null']
+          description: Version range declared in `dependencies`, e.g. `^0.4.5`.
+        installed:
+          type: [string, 'null']
+          description: Version actually present in the profile's node_modules.
+        loaded:
+          type: boolean
+          description: Whether the name appears in `dsh.profile.bundles` (the load list; its order is the load order).
+        official: { type: boolean, description: 'True for `@deepseek-ai/` packages, which ship with the runtime.' }
+        state:
+          type: string
+          enum: [loaded, runtime-provided, installed-not-loaded, declared-missing]
+          description: '`runtime-provided` is normal, not a problem: those packages ship with DSH and are not installed under the profile.'
+        description: { type: [string, 'null'] }
+        homepage: { type: [string, 'null'], description: 'Normalized http(s) URL; git+ prefixes and .git suffixes are stripped.' }
+        updateAvailable:
+          type: [boolean, 'null']
+          description: 'Tri-state on purpose: null means not checked, which differs from false ("already latest").'
+        latestVersion: { type: [string, 'null'] }
+        toggleable:
+          type: boolean
+          description: 'False for official packages and for packages not installed in the profile.'
+    PluginInventory:
+      type: object
+      required: [profile, profilePath, available, reason, loadedCount, problemCount, items]
+      properties:
+        profile: { type: [string, 'null'], description: 'Resolved from DSH_PROFILE, `--profile`, or the `dsh <name>` subcommand shorthand.' }
+        profilePath: { type: [string, 'null'] }
+        available: { type: boolean }
+        reason:
+          type: [string, 'null']
+          enum: [PROFILE_UNKNOWN, MANIFEST_UNREADABLE, null]
+        loadedCount: { type: integer }
+        problemCount: { type: integer, description: 'Counts installed-not-loaded and declared-missing; runtime-provided is not counted.' }
+        items:
+          type: array
+          items: { $ref: '#/components/schemas/PluginEntry' }
+    PluginToggleResult:
+      type: object
+      description: Result of enabling or disabling a plugin. Only `dsh.profile.bundles` is rewritten; dependency declarations are never touched and no package install runs.
+      required: [name, loaded, backupName, bundleCount, restartRequired]
+      properties:
+        name: { type: string }
+        loaded: { type: boolean }
+        backupName:
+          type: string
+          description: 'Name of the backup written before the change (empty for a no-op). A broken profile manifest means DSH will not boot, so a backup is mandatory.'
+        bundleCount: { type: integer, description: 'New length of the bundles array.' }
+        restartRequired:
+          type: boolean
+          description: 'Always true: bundles are read only at startup, so the running process keeps the old set until DSH restarts.'
     WirePath:
       type: string
       description: POSIX-style relative path. Absolute paths, backslashes, empty segments, dot segments, drive letters, UNC and null bytes are rejected.

package/kotlin-sdk/build.gradle.kts

@@ -4,7 +4,7 @@ plugins {
 }
 
 group = "ai.deepseek.dsh"
-version = "2.3.1"
+version = "2.3.4"
 
 repositories { mavenCentral() }
 

package/lib/index.js

@@ -3239,24 +3239,105 @@ function defaultDisplayName() {
 //#endregion
 //#region src/host/plugin-inventory.ts
 /**
+* 把 profile 标识归一化成 profile 名。
+*
+* 内核接受**两种**写法，两者都合法：
+*
+* - `--profile web` —— profile 名；
+* - `--profile /home/u/.dsh/profiles/web` —— profile 的绝对目录。内核启动器文档里
+*   写的正是 `--profile ${basename(profileDir)}`，**内核自己会取 basename**。
+*
+* 本插件此前只认第一种，于是把第二种的**整条路径**当成了 profile 名。而 `path.join`
+* 并不会因为后面一段是绝对路径就重置（那是 `path.resolve` 的行为），于是拼出：
+*
+*   /home/u/.dsh/profiles/home/u/.dsh/profiles/desktop
+*
+* —— 必然 ENOENT。**官方 Electron 桌面版恰好用第二种启动内核**，所以在桌面版里，
+* 手机上只会看到「服务器读不出插件清单：package.json 可能损坏、缺失或没有读取权限」，
+* 而磁盘上的 package.json 完好无损、权限也对。web 版（`dsh web` / `--profile web`）
+* 走的是名字形式，不受影响 —— 这就是这个 bug 能潜伏到桌面版才暴露的原因。
+*
+* 归一化只做一件事：**含路径分隔符时取最后一段**；不含则原样返回。于是
+* 「名字」「绝对目录」「相对目录」「Windows 反斜杠路径」「末尾带斜杠」五者同归一条规则。
+*/
+function normalizeProfileName(value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return null;
+	if (!/[/\\]/.test(trimmed)) return trimmed;
+	const withoutTrailing = trimmed.replace(/[/\\]+$/, "");
+	if (withoutTrailing === "") return null;
+	const cut = Math.max(withoutTrailing.lastIndexOf("/"), withoutTrailing.lastIndexOf("\\"));
+	const base = withoutTrailing.slice(cut + 1);
+	return base === "" ? null : base;
+}
+/**
 * 解析当前 profile 名。
 *
-* 依次尝试：`DSH_PROFILE` 环境变量 → `--profile=<name>` → `--profile <name>`。
+* 依次尝试：`DSH_PROFILE` 环境变量 → `--profile=<name>` → `--profile <name>`
+* → **子命令简写**（`dsh web` 等价于 `dsh --profile web`）。
 * 都拿不到时返回 null（调用方不要猜，猜错会读到另一个 profile 的清单）。
+*
+* **四个取值来源一律过 `normalizeProfileName`**：它们都可能装着一个 profile 目录
+* 而不是名字（官方 Electron 桌面版就是），见该函数的说明。
+*
+* 最后那条简写路径是补上的一个真 bug：内核的启动器文档写得很清楚 ——
+*
+* > `dsh <name>` abbreviates `dsh --profile <name>`；`dsh web` boots the web
+* > profile (same as: `dsh --profile web`)
+*
+* 而此前这里只认 `--profile` 两种写法。于是**用 `dsh web` 启动的用户会看到
+* 「服务器判定不出当前使用的插件档案」** —— 明明 profile 就在那儿、插件也正常
+* 加载着，只有这个页面读不出来。这不是「用户没带参数」，是插件漏了一条启动形式。
 */
 function resolveProfileName(input = {}) {
 	const env = input.env ?? process.env;
 	const argv = input.argv ?? process.argv;
 	const fromEnv = env.DSH_PROFILE?.trim();
-	if (fromEnv) return fromEnv;
+	if (fromEnv) return normalizeProfileName(fromEnv);
 	for (const arg of argv) if (arg.startsWith("--profile=")) {
 		const value = arg.slice(10).trim();
-		if (value) return value;
+		if (value) return normalizeProfileName(value);
 	}
 	const index = argv.indexOf("--profile");
 	if (index >= 0) {
 		const value = argv[index + 1]?.trim();
-		if (value && !value.startsWith("-")) return value;
+		if (value && !value.startsWith("-")) return normalizeProfileName(value);
+		return null;
+	}
+	return profileFromSubcommand(argv);
+}
+/**
+* 从子命令简写里取 profile 名（`dsh web` → `web`）。
+*
+* 判据照抄内核启动器的解析规则：**跳过所有选项，第一个非选项 token 就是子命令**。
+* 需要绕开两类 token：
+*
+* - 选项本身（以 `-` 开头）—— 例如 `dsh --port 3080 web` 里要先跳过 `--port`；
+* - **选项的取值** —— 上面那个 `3080` 不是选项也不是子命令，只是 `--port` 的值。
+*   不跳它的话会把 `3080` 当成 profile 名。内核的选项都是「一个旗标接一个值」的
+*   单值形式（`--port 3080` / `--patch a.yml`），所以看到选项就把它的下一个 token
+*   一起跳过，是安全的。
+*
+* `plugin` 单独排除：`dsh plugin add xxx` 是管理插件依赖的命令，
+* 它**不启动任何 profile**，把它当 profile 名会去读一个不存在的目录。
+*
+* 取到的 token 同样过 `normalizeProfileName`：桌面版可能把这个位置填成 profile
+* 目录的绝对路径（`--profile <dir>` 的等价位置参数写法）。
+*/
+function profileFromSubcommand(argv) {
+	const start = argv.findIndex((arg) => /(^|[/\\])dsh(\.js|\.cjs|\.mjs)?$/.test(arg));
+	let i = start >= 0 ? start + 1 : 0;
+	while (i < argv.length) {
+		const arg = argv[i];
+		if (arg === void 0 || arg === "") {
+			i += 1;
+			continue;
+		}
+		if (arg.startsWith("-")) {
+			i += arg.includes("=") ? 1 : 2;
+			continue;
+		}
+		return arg === "plugin" ? null : normalizeProfileName(arg);
 	}
 	return null;
 }
@@ -3302,10 +3383,13 @@ async function readPluginInventory(input = {}) {
 	const names = [.../* @__PURE__ */ new Set([...Object.keys(dependencies), ...bundles])].sort();
 	const items = [];
 	for (const name of names) {
-		const installed = await readInstalledVersion(profilePath, name);
+		const pkgManifest = await readPackageManifest(profilePath, name);
+		const installedRaw = pkgManifest?.version;
+		const installed = typeof installedRaw === "string" && installedRaw.trim() ? installedRaw : null;
 		const loaded = bundles.includes(name);
 		const declared = dependencies[name] ?? null;
 		const official = name.startsWith("@deepseek-ai/");
+		const description = typeof pkgManifest?.description === "string" && pkgManifest.description.trim() ? pkgManifest.description.trim() : null;
 		items.push({
 			name,
 			declared,
@@ -3316,7 +3400,12 @@ async function readPluginInventory(input = {}) {
 				loaded,
 				installed,
 				official
-			})
+			}),
+			description,
+			homepage: readHomepage(pkgManifest),
+			updateAvailable: null,
+			latestVersion: null,
+			toggleable: !official && installed !== null
 		});
 	}
 	return {
@@ -3330,6 +3419,68 @@ async function readPluginInventory(input = {}) {
 	};
 }
 /**
+* 查 npm registry 上的最新版本（可选功能，默认不开）。
+*
+* 为什么默认关：每个包一次 HTTP 请求，清单会从毫秒级变成好几秒，而用户点进
+* 「插件」页十次里九次只是想看看「装了啥、哪个没启用」。要查更新得显式开。
+*
+* 两个刻意的取舍：
+* - **超时短**（5 秒）：一个包查不动不该拖住整张清单，超时就当「查不到」。
+* - **失败即 null**，不重试：这是锦上添花的信息，为了它排队重试不值当。
+*   界面拿到 null 会说「未检查」，而不是谎称「已是最新」。
+*/
+async function fetchLatestVersion(packageName) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), 5e3);
+	try {
+		const response = await fetch(`https://registry.npmjs.org/${packageName.replace("/", "%2F")}/latest`, {
+			signal: controller.signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return null;
+		const body = await response.json();
+		return typeof body.version === "string" && body.version.trim() ? body.version.trim() : null;
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* 给清单里的插件补上「有没有新版本」。
+*
+* 只查**确实装在 profile 里**的第三方包：官方包随运行时发布、用户装不了（查了也没用），
+* 缺失包连本地版本都没有（无从比较）。
+*
+* 并发度限制在 6：十几个包全放出去对 registry 不礼貌，也容易触发限流 ——
+* 而限流之后拿到的 null 会被界面显示成「未检查」，白跑一趟。
+*/
+async function withUpdateCheck(inventory) {
+	const targets = inventory.items.filter((item) => !item.official && item.installed !== null);
+	const latest = /* @__PURE__ */ new Map();
+	const queue = [...targets];
+	const workers = Array.from({ length: Math.min(6, queue.length) }, async () => {
+		for (;;) {
+			const next = queue.shift();
+			if (next === void 0) return;
+			latest.set(next.name, await fetchLatestVersion(next.name));
+		}
+	});
+	await Promise.all(workers);
+	return {
+		...inventory,
+		items: inventory.items.map((item) => {
+			if (!latest.has(item.name)) return item;
+			const newest = latest.get(item.name) ?? null;
+			return {
+				...item,
+				latestVersion: newest,
+				updateAvailable: newest === null || item.installed === null ? null : newest !== item.installed
+			};
+		})
+	};
+}
+/**
 * 判定条目状态。
 *
 * 顺序很重要：**先判「官方包 + 未落盘」**，否则它们会被判成 `declared-missing` ——
@@ -3341,11 +3492,37 @@ function resolveState(input) {
 	if (input.official) return "runtime-provided";
 	return "declared-missing";
 }
-/** 读 `node_modules/<name>/package.json` 的 version；包名含 scope 时要按路径展开。 */
-async function readInstalledVersion(profilePath, packageName) {
+/**
+* 读 `node_modules/<name>/package.json` 的整份内容。
+*
+* 读不到就返回 null（包没装、或装了一半）。刻意不抛：这是展示用的元数据，
+* 某个包读不出来不该让整张清单失败。
+*/
+async function readPackageManifest(profilePath, packageName) {
 	const modulePath = path.join(profilePath, "node_modules", ...packageName.split("/"));
-	const version = (await readJson$1(path.join(modulePath, "package.json")))?.version;
-	return typeof version === "string" && version.trim() ? version : null;
+	return readJson$1(path.join(modulePath, "package.json"));
+}
+/**
+* 从 package.json 里取一个人类可读的主页地址。
+*
+* 三种写法都见过：`homepage` 是字符串、`repository` 是字符串、`repository` 是
+* `{ type, url }` 对象。GitHub 那种 `git+https://…git` 前缀与 `.git` 后缀要剥掉，
+* 否则直接点开是个 git 协议地址，浏览器打不开。
+*/
+function readHomepage(manifest) {
+	if (!manifest) return null;
+	const raw = typeof manifest.homepage === "string" ? manifest.homepage : (() => {
+		const repo = manifest.repository;
+		if (typeof repo === "string") return repo;
+		if (typeof repo === "object" && repo !== null) {
+			const url = repo.url;
+			if (typeof url === "string") return url;
+		}
+		return null;
+	})();
+	if (!raw) return null;
+	const cleaned = raw.trim().replace(/^git\+/, "").replace(/\.git$/, "");
+	return cleaned.startsWith("http") ? cleaned : null;
 }
 function unavailable(profile, profilePath, reason) {
 	return {
@@ -3358,6 +3535,73 @@ function unavailable(profile, profilePath, reason) {
 		items: []
 	};
 }
+var PluginToggleError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "PluginToggleError";
+	}
+};
+/** 包名合法性白名单：npm 包名允许的字符集，外加 scope 的 `/`。 */
+const PACKAGE_NAME = /^(?:@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*$/i;
+/**
+* 启用（`enable=true`）或停用（`enable=false`）一个插件。
+*
+* @throws PluginToggleError 带着稳定的 `code`，供路由层映射成 HTTP 状态与错误码。
+*/
+async function togglePlugin(name, enable, input = {}) {
+	const trimmed = name.trim();
+	if (!PACKAGE_NAME.test(trimmed)) throw new PluginToggleError("PLUGIN_NAME_INVALID", `Not a valid package name: ${name}`);
+	if (trimmed.startsWith("@deepseek-ai/")) throw new PluginToggleError("PLUGIN_OFFICIAL_IMMUTABLE", "Official DSH packages ship with the runtime and are not managed by the profile.");
+	const profile = resolveProfileName(input);
+	if (!profile) throw new PluginToggleError("PROFILE_UNKNOWN", "Cannot determine the active profile.");
+	const profilePath = path.join(resolveDshHome(input), "profiles", profile);
+	const manifestPath = path.join(profilePath, "package.json");
+	const raw = await readFile(manifestPath, "utf8").catch(() => null);
+	if (raw === null) throw new PluginToggleError("MANIFEST_UNREADABLE", `Cannot read ${manifestPath}`);
+	let manifest;
+	try {
+		manifest = JSON.parse(raw);
+	} catch {
+		throw new PluginToggleError("MANIFEST_UNREADABLE", "The profile manifest is not valid JSON.");
+	}
+	const dependencies = stringRecord(manifest.dependencies);
+	const dshSection = typeof manifest.dsh === "object" && manifest.dsh !== null ? manifest.dsh : {};
+	const profileSection = typeof dshSection.profile === "object" && dshSection.profile !== null ? dshSection.profile : {};
+	const bundles = stringArray(profileSection.bundles);
+	if (enable && dependencies[trimmed] === void 0 && !bundles.includes(trimmed)) throw new PluginToggleError("PLUGIN_NOT_INSTALLED", "This package is not installed in the profile; install it first.");
+	const next = enable ? bundles.includes(trimmed) ? bundles : [...bundles, trimmed] : bundles.filter((item) => item !== trimmed);
+	if (next.length === bundles.length) return {
+		name: trimmed,
+		loaded: enable,
+		backupName: "",
+		bundleCount: bundles.length,
+		restartRequired: true
+	};
+	const backupName = `package.json.bak-${timestamp()}`;
+	await writeFile(path.join(profilePath, backupName), raw, { mode: 384 });
+	profileSection.bundles = next;
+	dshSection.profile = profileSection;
+	manifest.dsh = dshSection;
+	const serialized = `${JSON.stringify(manifest, null, 2)}\n`;
+	const tempPath = path.join(profilePath, `.package.json.tmp-${process.pid}`);
+	await writeFile(tempPath, serialized, { mode: 384 });
+	await rename(tempPath, manifestPath);
+	return {
+		name: trimmed,
+		loaded: enable,
+		backupName,
+		bundleCount: next.length,
+		restartRequired: true
+	};
+}
+/** 备份文件名用的时间戳：`20261013-133045`，本地时区、可直接读。 */
+function timestamp() {
+	const d = /* @__PURE__ */ new Date();
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`;
+}
 //#endregion
 //#region src/host/root-resolver.ts
 /**
@@ -3435,7 +3679,7 @@ async function inspectResolvedPath(root, wirePath) {
 }
 //#endregion
 //#region src/shared/version.ts
-const PLUGIN_VERSION = "2.3.1";
+const PLUGIN_VERSION = "2.3.4";
 //#endregion
 //#region src/host/router.ts
 var ApiRouter = class {
@@ -3634,7 +3878,27 @@ var ApiRouter = class {
 		}
 		if (method === "GET" && pathname === "/api/v1/settings/plugins") {
 			this.options.auth.requireScope(principal, "settings.read");
-			sendJson(res, 200, await readPluginInventory());
+			const inventory = await readPluginInventory();
+			sendJson(res, 200, url.searchParams.get("checkUpdates") === "1" ? await withUpdateCheck(inventory) : inventory);
+			return;
+		}
+		if (method === "PATCH" && pathname === "/api/v1/settings/plugins") {
+			this.options.auth.requireScope(principal, "settings.write");
+			let payload;
+			try {
+				payload = await readJson(req, 8e3);
+			} catch {
+				throw new ApiError(400, "REQUEST_INVALID", "The request body must be valid JSON.");
+			}
+			const name = typeof payload.name === "string" ? payload.name : "";
+			const loaded = payload.loaded;
+			if (name.trim() === "" || typeof loaded !== "boolean") throw new ApiError(400, "REQUEST_INVALID", "Expected { name: string, loaded: boolean }.");
+			try {
+				sendJson(res, 200, await togglePlugin(name, loaded));
+			} catch (error) {
+				if (error instanceof PluginToggleError) throw new ApiError(error.code === "PROFILE_UNKNOWN" || error.code === "MANIFEST_UNREADABLE" ? 503 : 400, error.code, error.message);
+				throw error;
+			}
 			return;
 		}
 		const providerRoute = pathname.match(/^\/api\/v1\/settings\/providers\/([^/]+)$/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-bridge",
-  "version": "2.3.1",
+  "version": "2.3.4",
   "description": "Versioned REST bridge for DeepSeek Harness: remote access for trusted clients (chat, files, devices) plus a Phone-settings panel inside the DSH WebUI.",
   "type": "module",
   "packageManager": "pnpm@11.19.0",