dsh-remote 0.8.23 → 0.8.24

package/lib/client.js

@@ -139,8 +139,10 @@ window.__ModuleLoader__.load({
         'settings.updateFail': '检查更新失败',
         'settings.updateAvailable': '发现新版本 v{version}',
         'settings.updateLatest': '已是最新版本（v{version}）',
-        'settings.updateConfirm': '将更新 dsh-remote 到 v{version}，替换本机插件文件。更新后需重启 Harness 生效。继续？',
-        'settings.updateApplied': '✅ 已更新到 v{to}（{from} → {to}）。重启 Harness 生效。',
+        'settings.updateConfirm': '将更新 dsh-remote 到 v{version}，替换本机插件文件并在线热切换宿主半（不重启 Harness）。继续？',
+        'settings.updateApplied': '✅ 已更新到 v{to}（{from} → {to}），宿主半已在线热切换。',
+'settings.updateAppliedNoReload': '✅ 已更新到 v{to}（{from} → {to}）。重启 Harness 生效。',
+'settings.updatePendingReload': '⚠️ 磁盘已是 v{disk}，运行中的仍是 v{loaded}；点「立即更新」或重启 Harness 完成切换。',
         'settings.updateFailed': '更新失败',
         'settings.updateFailedMsg': '更新失败: {msg}',
         'settings.registryUnreachable': '无法连接 npm registry',
@@ -363,8 +365,10 @@ window.__ModuleLoader__.load({
         'settings.updateFail': 'Failed to check for updates',
         'settings.updateAvailable': 'New version found: v{version}',
         'settings.updateLatest': 'Already up to date (v{version})',
-        'settings.updateConfirm': 'Update dsh-remote to v{version}? This replaces the local plugin files and requires a Harness restart to take effect. Continue?',
-        'settings.updateApplied': '✅ Updated to v{to} ({from} → {to}). Restart Harness to apply.',
+        'settings.updateConfirm': 'Update dsh-remote to v{version}? This replaces the local plugin files and hot-swaps the host half in place (no Harness restart). Continue?',
+        'settings.updateApplied': '✅ Updated to v{to} ({from} → {to}); the host half hot-swapped in place.',
+'settings.updateAppliedNoReload': '✅ Updated to v{to} ({from} → {to}). Restart Harness to apply.',
+'settings.updatePendingReload': '⚠️ v{disk} is on disk but v{loaded} is still running; update again or restart Harness to switch.',
         'settings.updateFailed': 'Update failed',
         'settings.updateFailedMsg': 'Update failed: {msg}',
         'settings.registryUnreachable': 'Cannot reach the npm registry',
@@ -836,9 +840,13 @@ window.__ModuleLoader__.load({
         setUpdBusy(true); setUpdMsg('')
         api('POST', '/dsh-remote/update-apply', { version: upd.latest })
           .then((r) => {
-            if (r && r.ok) setUpdMsg(tr('settings.updateApplied', { to: r.to, from: (r.from || '') }))
+            if (r && r.ok) setUpdMsg(tr(r.reloadScheduled ? 'settings.updateApplied' : 'settings.updateAppliedNoReload', { to: r.to, from: (r.from || '') }))
             else setUpdMsg((r && r.error) || tr('settings.updateFailed'))
-            checkUpdate(true)
+            // The host half swaps itself ~300ms after answering, so the panel
+            // must not re-check immediately: it would still be talking to the
+            // outgoing fiber and report the pre-swap version, i.e. "update
+            // available" right after a successful update.
+            window.setTimeout(() => checkUpdate(true), 2000)
           })
           .catch((e) => setUpdMsg(tr('settings.updateFailedMsg', { msg: String((e && e.message) || e) })))
           .finally(() => setUpdBusy(false))
@@ -1127,6 +1135,10 @@ window.__ModuleLoader__.load({
               }, m === 'manual' ? tr('settings.modeManual') : m === 'auto' ? tr('settings.modeAuto') : tr('settings.modeOff')),
             ),
           ),
+          upd && upd.pendingReload
+            ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: T.warn } },
+                tr('settings.updatePendingReload', { disk: upd.disk, loaded: upd.loaded }))
+            : null,
           updMsg ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: updMsg.startsWith('✅') ? T.ok : 'inherit', opacity: 0.9 } }, updMsg) : null,
         ),
         React.createElement('div', { style: { display: 'flex', gap: 12, alignItems: 'center', flexWrap: 'wrap', fontSize: 11, opacity: 0.65, borderTop: '1px solid ' + T.border, paddingTop: 10, marginTop: 4 } },

package/lib/index.js

@@ -21,7 +21,7 @@
 import z from '@deepseek-ai/schemastery'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { execFile } from 'node:child_process'
-import { readFileSync, mkdirSync, writeFileSync, existsSync, readdirSync, statSync, renameSync, copyFileSync, appendFileSync, watch } from 'node:fs'
+import { readFileSync, mkdirSync, writeFileSync, existsSync, readdirSync, statSync, renameSync, copyFileSync, appendFileSync, watch, rmSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
 import iconv from 'iconv-lite'
@@ -41,7 +41,7 @@ import { searchRemote } from './search.js'
 import { resolveMirror, poolKey, lookupSessionCwd, encodeSegmentSafe, readSessionHeaderCwd, requestSessionHint } from './binding.js'
 import { TaskManager } from './tasks.js'
 import { ForwardManager } from './forwards.js'
-import { selfDir, readVersion, gtVersion, fetchLatestVersion, applyUpdate, persistUpdateMode, readUpdateMode } from './update.js'
+import { selfDir, diskVersion, LOADED_VERSION, gtVersion, fetchLatestVersion, applyUpdate, persistUpdateMode, readUpdateMode, reloadSelf, scheduleSelfReload } from './update.js'
 import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeMachine as _sanitizeMachine, applyMachine as _applyMachine, machineId as _machineId } from './registry.js'
 import { registerHttpTransports } from './http-transport.js'
 import { SshPool } from './pool.js'
@@ -130,6 +130,10 @@ export const Config = z.object({
   updateMode: z.string().default('manual'),
   /** How often (ms) auto mode checks the npm registry for a newer release. */
   updateCheckIntervalMs: z.number().step(1).min(60000).default(6 * 3600 * 1000),
+  /** Whether a landed update also hot-swaps the running host half (default
+   *  true). With `false` an update only takes effect on the next process start
+   *  and `/dsh-remote/update-check` reports `pendingReload: true` meanwhile. */
+  updateAutoReload: z.boolean().default(true),
 })
 
 // ── shell / path helpers (pure implementations in lib/paths.js) ───────────
@@ -258,6 +262,15 @@ export async function apply(ctx, config) {
 
   migrateLegacyData()
 
+  // The update marker means "a newer version landed on disk but is not the code
+  // running yet". Reaching apply() with a marker naming the version we just
+  // loaded means the swap already happened (or this is a plain boot into the
+  // updated files) → clear it, so the UI's "restart to finish" hint stays true.
+  try {
+    const marker = path.join(selfDir(), '.dsh-remote-updated')
+    if (existsSync(marker) && readFileSync(marker, 'utf8').trim() === LOADED_VERSION) rmSync(marker, { force: true })
+  } catch {}
+
   // ── machine registry (multi-host) ─────────────────────────────────────────
   const store = loadMachines()
   const machines = store.list
@@ -2765,17 +2778,26 @@ export async function apply(ctx, config) {
       path: '/dsh-remote/update-check',
       handler: async (req, res) => {
         if (req.method !== 'GET') return sendJson(res, 405, { ok: false, error: 'method not allowed' })
-        const current = readVersion()
-        const latest = await fetchLatestVersion()
-        if (latest === null) return sendJson(res, 200, { ok: false, current, error: '无法连接 npm registry' })
+        // `loaded` is the code actually running; `disk` may already be newer.
+        // They differ between an applied update and its hot swap (or a boot).
+        const loaded = LOADED_VERSION
+        const disk = diskVersion()
         const rawMode = readUpdateMode() || config.updateMode || 'manual'
+        const base = {
+          current: loaded,
+          loaded,
+          disk,
+          pendingReload: gtVersion(disk, loaded),
+          updateMode: ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : 'manual',
+          updatedMarker: existsSync(path.join(selfDir(), '.dsh-remote-updated')),
+        }
+        const latest = await fetchLatestVersion()
+        if (latest === null) return sendJson(res, 200, { ok: false, ...base, error: '无法连接 npm registry' })
         return sendJson(res, 200, {
           ok: true,
-          current,
+          ...base,
           latest,
-          updateAvailable: gtVersion(latest, current),
-          updateMode: ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : 'manual',
-          updatedMarker: existsSync(path.join(selfDir(), '.dsh-remote-updated')),
+          updateAvailable: gtVersion(latest, loaded),
         })
       },
     },
@@ -2785,16 +2807,45 @@ export async function apply(ctx, config) {
       handler: async (req, res) => {
         if (req.method !== 'POST') return sendJson(res, 405, { ok: false, error: 'method not allowed' })
         try {
+          // Capture the outgoing version BEFORE the swap: reading it afterwards
+          // reports the version we just installed, not the one we replaced.
+          const from = diskVersion()
+          const loaded = LOADED_VERSION
           const body = JSON.parse((await readBody(req)) || '{}')
           const target = String(body.version || '')
           if (!target) return sendJson(res, 400, { ok: false, error: 'version is required' })
           const result = await applyUpdate(target)
-          return sendJson(res, 200, { ok: true, from: readVersion(), ...result })
+          const wantReload = body.reload !== false && config.updateAutoReload !== false
+          // Answer first, then swap: the swap disposes the fiber serving this
+          // very request, so nothing may touch the plugin after it.
+          if (wantReload) scheduleSelfReload(ctx.loader, 300)
+          return sendJson(res, 200, {
+            ok: true,
+            from,
+            loadedBefore: loaded,
+            ...result,
+            reloadScheduled: wantReload,
+            // what the swap will land on, for a caller that wants to verify
+            loadedAfterReload: wantReload ? result.to : loaded,
+          })
         } catch (err) {
           return sendJson(res, 500, { ok: false, error: String((err && err.message) || err) })
         }
       },
     },
+    {
+      kind: 'exact',
+      path: '/dsh-remote/update-reload',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return sendJson(res, 405, { ok: false, error: 'method not allowed' })
+        // Hot-swap the host half to whatever is on disk now. Answers first (with
+        // what was loaded and what it is about to become), then swaps.
+        const loaded = LOADED_VERSION
+        const disk = diskVersion()
+        scheduleSelfReload(ctx.loader, 300)
+        return sendJson(res, 200, { ok: true, scheduled: true, loaded, disk, willReloadTo: disk })
+      },
+    },
     {
       kind: 'exact',
       path: '/dsh-remote/update-mode',
@@ -2821,12 +2872,24 @@ export async function apply(ctx, config) {
   const rawMode = readUpdateMode() || config.updateMode || 'manual'
   const effectiveUpdateMode = ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : 'manual'
   if (effectiveUpdateMode === 'auto') {
-    const currentVersion = readVersion()
     const checkAndApply = async () => {
       const latest = await fetchLatestVersion()
-      if (latest && gtVersion(latest, currentVersion)) {
-        try { await applyUpdate(latest) } catch {}
+      if (!latest) return
+      // The version in flight is whichever of "already on disk" / "already
+      // loaded" is newer. Pinning it once outside this closure (as v0.8.23 did)
+      // made every later interval re-download and re-apply the same tarball,
+      // because the pinned value never moves past the version it installed.
+      const disk = diskVersion()
+      const current = gtVersion(disk, LOADED_VERSION) ? disk : LOADED_VERSION
+      if (!gtVersion(latest, current)) return
+      try {
+        await applyUpdate(latest)
+      } catch {
+        return
       }
+      // Landed: swap the running host half too, otherwise the code being served
+      // and the code being run stay one version apart until the next boot.
+      if (config.updateAutoReload !== false) scheduleSelfReload(ctx.loader, 500)
     }
     void checkAndApply()
     const updateTimer = setInterval(checkAndApply, Math.max(config.updateCheckIntervalMs, 60000))

package/lib/update.js

@@ -8,15 +8,24 @@
 //   • checkLatestVersion() — query the npm registry for the `latest` dist-tag;
 //   • applyUpdate() — download the tarball, extract package/{lib,package.json,
 //     cordis.patch.yml} with a minimal tar reader, verify the version, then
-//     atomically copy over the installed files. A `.dsh-remote-updated` marker
-//     is written so the UI can tell the user to reload.
+//     replace the installed files atomically (temp file + rename, never a
+//     half-written lib/*.js). A `.dsh-remote-updated` marker records the version
+//     that landed; the host half removes it once that version is the code it is
+//     actually running (see LOADED_VERSION), so the marker means "restart still
+//     required" rather than "an update once happened".
+//   • reloadSelf() — swap the RUNNING host half to the code now on disk: drop
+//     Node's module caches for this package's own files, then dispose + re-init
+//     the loader entry so apply() runs again from the fresh module. Without it
+//     an update only takes effect on the next process start, which is what left
+//     the served client half newer than the loaded host half.
 //
 // Every failure aborts without touching the installed files (a bad download or
 // a version mismatch must never break the running plugin).
 
-import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const NPM_PACKAGE = 'dsh-remote'
 const REGISTRY_URL = 'https://registry.npmjs.org/' + NPM_PACKAGE + '/latest'
@@ -40,6 +49,17 @@ export function readVersion() {
   }
 }
 
+/** Version of the code this process actually loaded (snapshot at import time).
+ *  `readVersion()` reads package.json from disk, so after an update lands it
+ *  reports the NEW version while the running module is still the old one —
+ *  comparing the two is the only way to tell "applied" from "active". */
+export const LOADED_VERSION = readVersion()
+
+/** Package version currently on disk (may be newer than {@link LOADED_VERSION}). */
+export function diskVersion() {
+  return readVersion()
+}
+
 /** Compare dotted versions; returns true when a > b. */
 export function gtVersion(a, b) {
   const pa = String(a || '').split('.').map((n) => parseInt(n, 10) || 0)
@@ -96,9 +116,10 @@ function parseTar(buf) {
  * installed files untouched).
  * @param targetVersion - exact npm version to install (e.g. "0.8.0").
  */
-export async function applyUpdate(targetVersion) {
+export async function applyUpdate(targetVersion, options = {}) {
   const tarballUrl = `https://registry.npmjs.org/${NPM_PACKAGE}/-/${NPM_PACKAGE}-${targetVersion}.tgz`
-  const dir = selfDir()
+  const dir = options.dir || selfDir()
+  const doFetch = options.fetchImpl || fetch
   const tmpRoot = path.join(dir, `.dsh-remote-update-${Date.now()}`)
   const tmpPkg = path.join(tmpRoot, 'package')
   try {
@@ -106,7 +127,7 @@ export async function applyUpdate(targetVersion) {
     const timer = setTimeout(() => controller.abort(), 60000)
     let res
     try {
-      res = await fetch(tarballUrl, { signal: controller.signal })
+      res = await doFetch(tarballUrl, { signal: controller.signal })
     } finally {
       clearTimeout(timer)
     }
@@ -135,20 +156,34 @@ export async function applyUpdate(targetVersion) {
     // break the next boot — check the file size and that it is not empty).
     const newIndex = path.join(tmpPkg, 'lib', 'index.js')
     if (!existsSync(newIndex) || statSize(newIndex) < 100) throw new Error('tarball missing lib/index.js')
-    // Atomically swap: copy fresh files over the installed ones.
+    // Swap the installed files one at a time: atomic, and idempotent.
+    //
+    // Atomicity (temp file + rename) is not cosmetic here — since the browser
+    // half is hot-swapped by dsh-client-hmr, which stat-polls lib/client.js
+    // every 500 ms, a torn write would be re-hashed and served mid-copy.
+    // Skipping byte-identical files keeps a re-apply of the same version from
+    // churning mtimes (and the host half from reloading for nothing).
     const installLib = path.join(dir, 'lib')
     const tmpLib = path.join(tmpPkg, 'lib')
+    const changed = []
+    const install = (src, dest) => {
+      const bytes = readFileSync(src)
+      if (sameFileContent(dest, bytes)) return
+      try { mkdirSync(path.dirname(dest), { recursive: true }) } catch {}
+      writeFileAtomic(dest, bytes)
+      changed.push(path.relative(dir, dest).split(path.sep).join('/'))
+    }
     for (const name of readdirSafe(tmpLib)) {
       if (!name.endsWith('.js')) continue
       const src = path.join(tmpLib, name)
-      if (existsSync(src)) copyFileSync(src, path.join(installLib, name))
+      if (existsSync(src)) install(src, path.join(installLib, name))
     }
     for (const rel of ['package.json', 'cordis.patch.yml']) {
       const src = path.join(tmpPkg, rel)
-      if (existsSync(src)) copyFileSync(src, path.join(dir, rel))
+      if (existsSync(src)) install(src, path.join(dir, rel))
     }
     writeFileSync(path.join(dir, '.dsh-remote-updated'), String(targetVersion))
-    return { ok: true, to: targetVersion }
+    return { ok: true, to: targetVersion, changed }
   } catch (err) {
     throw new Error('update failed: ' + ((err && err.message) || err))
   } finally {
@@ -174,6 +209,145 @@ function readdirSafe(dir) {
   }
 }
 
+/**
+ * Write `data` to `dest` atomically: the bytes land in a sibling temp file and
+ * are then renamed over the target, so a concurrent reader (the client-half HMR
+ * poll, or the next boot) never observes a truncated file. Falls back to an
+ * in-place copy if the platform refuses the replace, and never leaves the temp
+ * file behind.
+ * @param dest - absolute destination path.
+ * @param data - bytes to write.
+ */
+export function writeFileAtomic(dest, data) {
+  const tmp = `${dest}.dsh-tmp-${process.pid}-${Date.now().toString(36)}`
+  writeFileSync(tmp, data)
+  try {
+    renameSync(tmp, dest)
+    return
+  } catch {
+    try {
+      copyFileSync(tmp, dest)
+    } finally {
+      try { rmSync(tmp, { force: true }) } catch {}
+    }
+  }
+}
+
+/** Whether the file at `p` already holds exactly `bytes` (missing/short → false). */
+function sameFileContent(p, bytes) {
+  try {
+    return readFileSync(p).equals(bytes)
+  } catch {
+    return false
+  }
+}
+
+// ── hot swap of the running host half ─────────────────────────────────────
+
+/** Loader entry ids this package can own. */
+const SELF_ENTRY_NAMES = ['dsh-remote']
+
+/**
+ * Find our own loader entry (by id, then by module specifier). Returns undefined
+ * when the tree does not contain us (e.g. a test loader, or a renamed row).
+ * @param loader - the cordis Loader service (`ctx.loader`).
+ */
+function findSelfEntry(loader) {
+  let entries = []
+  try {
+    entries = [...(loader?.entries?.() ?? [])]
+  } catch {
+    return undefined
+  }
+  for (const want of SELF_ENTRY_NAMES) {
+    const byId = entries.find((entry) => entry?.options?.id === want)
+    if (byId) return byId
+  }
+  for (const want of SELF_ENTRY_NAMES) {
+    const byName = entries.find((entry) => entry?.options?.name === want)
+    if (byName) return byName
+  }
+  return undefined
+}
+
+/**
+ * Drop Node's module caches for this package's own files, so the next import of
+ * the plugin actually re-reads disk instead of handing back the cached module.
+ * Both caches matter: the ESM `loadCache` (a plain Map on Node 22/23, a
+ * `LoadCache extends Map` on Node 24 — hence the explicit `Map.prototype` calls)
+ * and, for CJS modules pulled in through `import()`, `require.cache`.
+ * @param loader - the cordis Loader service.
+ * @param dir - package directory whose `lib/` to evict (defaults to this
+ *   package's own install dir; overridable so the swap can be exercised against
+ *   a fixture install).
+ * @returns how many ESM entries were dropped.
+ */
+export function clearSelfModuleCache(loader, dir = selfDir()) {
+  const libDir = path.join(dir, 'lib')
+  const loadCache = loader?.internal?.loadCache
+  const req = (() => {
+    try { return createRequire(import.meta.url) } catch { return undefined }
+  })()
+  let cleared = 0
+  for (const name of readdirSafe(libDir)) {
+    if (!name.endsWith('.js')) continue
+    const url = pathToFileURL(path.join(libDir, name)).href
+    try {
+      if (loadCache && Map.prototype.has.call(loadCache, url)) {
+        Map.prototype.delete.call(loadCache, url)
+        cleared += 1
+      }
+    } catch {}
+    try {
+      const file = fileURLToPath(url)
+      if (req?.cache && req.cache[file]) delete req.cache[file]
+    } catch {}
+  }
+  return cleared
+}
+
+/**
+ * Swap the RUNNING host half to the code now on disk: clear the module caches
+ * for our own files, dispose our loader entry (tools, JSON routes, SSH pools and
+ * every `ctx.effect` disposer go with the fiber), then re-init it so `apply()`
+ * runs again from the freshly imported module.
+ *
+ * Callers must not depend on this plugin after a successful reload — the fiber
+ * that served the current request is gone. Schedule it (see
+ * {@link scheduleSelfReload}) rather than awaiting it from a request handler.
+ * @param loader - the cordis Loader service (`ctx.loader`).
+ * @returns a small result object; never throws.
+ */
+export async function reloadSelf(loader) {
+  const entry = findSelfEntry(loader)
+  if (!entry) return { ok: false, reason: 'own loader entry not found' }
+  try {
+    const cleared = clearSelfModuleCache(loader)
+    if (typeof entry._dispose === 'function') await entry._dispose()
+    else if (typeof entry.dispose === 'function') await entry.dispose()
+    else return { ok: false, reason: 'entry exposes no dispose hook' }
+    await entry.init()
+    return { ok: true, cleared }
+  } catch (err) {
+    return { ok: false, reason: String((err && err.message) || err) }
+  }
+}
+
+/**
+ * Fire-and-forget {@link reloadSelf} after a short delay, so the caller can
+ * finish answering an HTTP request (or an update check) before its own module is
+ * torn down. Failures are swallowed: a failed swap leaves the running code in
+ * place, which is the pre-hot-update behaviour, not a crash.
+ * @param loader - the cordis Loader service.
+ * @param delayMs - grace period before the swap (default 300 ms).
+ * @returns true when the swap was scheduled.
+ */
+export function scheduleSelfReload(loader, delayMs = 300) {
+  const timer = setTimeout(() => { void reloadSelf(loader).catch(() => {}) }, Math.max(0, delayMs))
+  if (typeof timer.unref === 'function') timer.unref()
+  return true
+}
+
 /** Write the persisted update-mode override (settings UI). */
 export function persistUpdateMode(mode) {
   if (!['manual', 'auto', 'off'].includes(mode)) return false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote",
-  "version": "0.8.23",
+  "version": "0.8.24",
   "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive/proxy jump), pick a remote workspace, operate on it with 20 rw_* tools (incl. rw_edit/rw_stat/rw_mkdir/rw_remove/rw_move/rw_forward), conflict-aware mirror sync, port forwarding, optional side-bar remote file editing, audit log, keychain passwords.",
   "license": "MIT",
   "author": "flymysql <flyphp@outlook.com>",