dsh-update-plugin 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+All notable changes to `dsh-update-plugin` are documented in this file.
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+### Added
+
+- **Send test reminder / 测试更新提醒** button in the settings page: opens the
+  sidebar tab, sends a browser notification (permission required) and shows the
+  update badge for 10 seconds, so the reminder can be verified without a real
+  release.
+
+## [0.1.0] - 2026-09-12
+
+### Added
+
+- **Settings → General** row titled **Check for Updates... / 检查更新**, registered
+  through the public `settings.general.item` slot.
+- Full **Settings → Check for Updates...** section page with status, update
+  channel, minimum release age, profile details, backup list and rollback.
+- Native DSH right-sidebar tab (`sidebarRightTabs` / `sidebarRight`) with a live
+  badge when an update is available and a compact check/update panel.
+- Built-in update logic (no Homebrew or separate shell script needed):
+  all npm dist-tags, channel selection (`auto` / `stable` / `next` / `alpha`),
+  `$DSH_HOME/profiles/*` discovery, npm/pnpm CLI detection, per-profile
+  `dsh plugin --profile <name> update --latest` with a `pnpm update` fallback.
+- Automatic backups under `~/.dsh/update-backups/` plus one-click rollback of
+  profile manifests, lockfiles, dependencies and the previous CLI version.
+- Host endpoints under `/api/dsh-update-plugin/`: `status`, `update`, `config`,
+  `backups`, `rollback`; all mutating endpoints are loopback and same-origin
+  only.
+- Two documented fallbacks: the plugin can always be upgraded from the terminal
+  (`dsh plugin --profile web add dsh-update-plugin@latest`), and a broken plugin
+  cannot break DSH itself.
+
+### Changed
+
+- Installation documentation insists on `dsh plugin add` (not plain `pnpm add`)
+  so the package joins `dsh.profile.bundles`, and documents the pnpm
+  `minimumReleaseAge` workaround (`--config.minimum-release-age=0`).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-update-all contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,151 @@
+# dsh-update-plugin
+
+English | [中文](README.zh-CN.md)
+
+A DSH Web plugin that adds **Check for Updates...** (「检查更新」in Chinese) to
+**Settings → General**, right next to Permission, Language, Appearance and Font
+Size.
+
+From one row you can check for a newer DeepSeek Harness release and update:
+
+- the global `@deepseek-ai/dsh` CLI and every bundled `@deepseek-ai/dsh-*` package;
+- every profile's plugins under `~/.dsh/profiles/*`.
+
+The update logic is built into the plugin. It does **not** require Homebrew or a
+separately installed `dsh-update-all` script.
+
+![Check for Updates... in Settings → General](assets/screenshots/general-en.webp)
+
+## Install
+
+```bash
+# from npm (once published)
+dsh plugin --profile web add dsh-update-plugin
+
+# from a local checkout / this repository
+dsh plugin --profile web add /path/to/dsh-update-all/plugin
+```
+
+If pnpm refuses the install because its `minimumReleaseAge` policy rejects an
+already-updated lockfile entry (for example right after you used
+`dsh-update-all --min-age 0`), rerun the command with the policy relaxed for
+that single install:
+
+```bash
+dsh plugin --profile web add /path/to/dsh-update-all/plugin --config.minimum-release-age=0
+```
+
+> **Always mount with `dsh plugin add`, not plain `pnpm add`.** The official
+> command also appends the package to `dsh.profile.bundles`; a bare `pnpm add`
+> only installs the dependency, so the Settings row never appears. If you
+already used `pnpm add`, run the `dsh plugin ... add` command again — it is
+idempotent and performs the bundle reconciliation.
+
+Then restart DSH Web, open **Settings → General**, and look for the
+**Check for Updates...** row.
+
+## Usage
+
+- **Settings → General** shows a quick **Check for Updates...** row.
+- **Settings → Check for Updates...** (left navigation) is the full page: status,
+  update channel, minimum release age, profiles, backups and rollback.
+- A native **right-sidebar tab** shows a badge when an update is available; click
+  it to check or update without leaving the conversation.
+- The status card has a **Send test reminder** button: it opens the sidebar tab,
+  sends a browser notification (permission required), and shows the update badge
+  for 10 seconds so you can verify the reminder without a real release.
+- The row shows the current and newest versions plus the number of profiles.
+- **Check for updates** refreshes the status (it also refreshes after
+  reconnecting).
+- **Update now** updates the CLI and then every profile with dependencies.
+  The host creates a backup under `~/.dsh/update-backups/` before changing
+  anything.
+- The full page lets you choose the update channel (`auto`, `stable`, `next`,
+  `alpha`), set a `minimumReleaseAge` (minutes), list profiles, and roll back to
+  any backup.
+- After a successful update or rollback, restart DSH Web to load the new code.
+
+The update only runs when the page is loopback and same-origin; a remote DSH Web
+session can read the version but cannot start an update.
+
+## Fallbacks
+
+Two fallbacks are built in on purpose:
+
+1. **The plugin can always be upgraded from the terminal**, even when the
+   Settings row is broken or hidden:
+   ```bash
+   dsh plugin --profile web add dsh-update-plugin@latest
+   ```
+2. **A broken plugin never breaks DSH itself.** If the Settings slot or the
+   browser bundle contract changes, the row disappears or shows an error; the
+   rest of DSH keeps working. The manual commands shown in the row are always:
+   ```bash
+   dsh plugin --profile web update --latest
+   dsh plugin --profile web add dsh-update-plugin@latest
+   ```
+
+## Troubleshooting
+
+- **The Settings row/page is missing, or Save/backups return `HTTP 404`.**
+  The browser half can hot-reload, but the host half (`lib/index.js`) is loaded
+  when DSH starts. Fully restart DSH (stop and start `dsh web`, or restart DSH
+  Desktop), then hard-refresh the browser.
+- **The right-sidebar tab is not in the `+` menu.** It is registered through the
+  native `sidebarRightTabs` API, which requires DSH 0.1.5-rc.1 or newer.
+- **The install command is rejected by pnpm `minimumReleaseAge`.** Add
+  `--config.minimum-release-age=0` to that single `dsh plugin add` command.
+
+## Compatibility
+
+| DSH version | Status |
+| --- | --- |
+| `0.1.0-rc.8` | expected to work |
+| `0.1.1-rc.2` | expected to work |
+| `0.1.2-rc.1` | expected to work |
+| `0.1.5-rc.1` | expected to work |
+| `0.1.5-rc.2` | tested |
+
+DSH is pre-1.0, so a major release may rename a client slot or change a public
+service. When that happens this plugin needs a small compatibility release; the
+fallback commands above keep users unblocked meanwhile.
+
+## How it works
+
+- **Client half** (`lib/client.js`) registers into the public
+  `settings.general.item` slot used by the native General rows, and talks to two
+  loopback endpoints.
+- **Host half** (`lib/index.js`, `lib/update-core.js`) resolves the newest
+  version across all npm dist-tags (or a chosen channel), discovers profiles,
+  backs them up, updates the CLI with npm or pnpm, and updates each profile
+  through `dsh plugin --profile <name> update --latest` (with a `pnpm update`
+  fallback).
+- Host endpoints: `/status`, `/update`, `/config`, `/backups` and `/rollback`
+  under `/api/dsh-update-plugin/`.
+- Only Node built-ins are used, so there is no extra dependency to trust.
+
+## Release
+
+1. Bump `version` in `plugin/package.json` and add the release notes.
+2. Commit, then tag and push:
+   ```bash
+   git tag plugin-vX.Y.Z
+   git push origin plugin-vX.Y.Z
+   ```
+3. The **Publish plugin** workflow publishes the package to npm. It needs a
+   repository secret named `NPM_TOKEN` with publish rights for
+   `dsh-update-plugin`.
+
+## Development
+
+```bash
+cd plugin
+npm test                # node --test test/*.test.mjs
+node --check lib/index.js
+node --check lib/client.js
+node --check lib/update-core.js
+```
+
+## License
+
+[MIT](LICENSE)

package/README.zh-CN.md

@@ -0,0 +1,134 @@
+# dsh-update-plugin
+
+[English](README.md) | 中文
+
+一个 DSH Web 插件，在 **设置 → 通用设置** 里加入一行「检查更新」，和权限、语言、
+外观、字号大小同级。
+
+在这一行里可以检查并更新：
+
+- 全局 `@deepseek-ai/dsh` CLI 以及随包的 `@deepseek-ai/dsh-*`；
+- `~/.dsh/profiles/*` 下每个 profile 的插件。
+
+更新逻辑完整内置在插件里，**不依赖 Homebrew，也不依赖单独安装的
+`dsh-update-all` 脚本**。
+
+![设置 → 通用设置里的「检查更新」](assets/screenshots/general-zh.webp)
+
+## 安装
+
+```bash
+# 从 npm 安装（发布之后）
+dsh plugin --profile web add dsh-update-plugin
+
+# 从本仓库 / 本地目录安装
+dsh plugin --profile web add /path/to/dsh-update-all/plugin
+```
+
+如果 pnpm 的 `minimumReleaseAge` 策略因为 lockfile 里已有较新的条目而拒绝安装
+（例如刚用过 `dsh-update-all --min-age 0`），给这一次安装临时放开策略即可：
+
+```bash
+dsh plugin --profile web add /path/to/dsh-update-all/plugin --config.minimum-release-age=0
+```
+
+> **一定要用 `dsh plugin add` 挂载，不要只用 `pnpm add`。** 官方命令还会把包
+> 追加到 `dsh.profile.bundles`；直接 `pnpm add` 只装依赖，不写 bundle 列表，
+> 设置里就不会出现这一行。如果已经用 `pnpm add` 装过，再执行一次
+> `dsh plugin ... add` 即可，它会完成挂载（幂等）。
+
+然后重启 DSH Web，打开 **设置 → 通用设置**，就能看到「检查更新」这一行。
+
+## 使用
+
+- **设置 → 通用设置** 里有快捷的「检查更新」一行。
+- **设置 → 检查更新**（左侧导航）是完整页面：状态、更新频道、最小释出时间、
+  profiles、备份和回滚。
+- **右侧边栏**有一个原生 tab，有更新时显示角标，点击即可检查或更新，不必离开
+  当前会话。
+- 状态卡片里有 **测试更新提醒** 按钮：会打开侧边栏 tab、发送浏览器通知
+  （需要授权），并显示 10 秒的更新角标，方便验证提醒效果，不用等真实新版本。
+- 行内显示当前版本、最新版本和 profile 数量。
+- **检查更新**：刷新状态。
+- **立即更新**：先更新 CLI，再更新每个有依赖的 profile；更新前会自动把
+  `package.json` / `pnpm-lock.yaml` 备份到 `~/.dsh/update-backups/`。
+- 完整页面可以选择更新频道（`auto` / `stable` / `next` / `alpha`）、设置
+  `minimumReleaseAge`（分钟）、查看 profile 列表，并回滚到任意备份。
+- 更新或回滚成功后重启 DSH Web 加载新代码。
+
+只有 loopback 且同源的页面可以触发更新；远程访问只能查看版本状态，不能执行更新。
+
+## 两个兜底
+
+这两条是特意内置的保险：
+
+1. **插件永远可以从终端独立升级**，即使设置里的那一行坏了或不见了：
+   ```bash
+   dsh plugin --profile web add dsh-update-plugin@latest
+   ```
+2. **插件坏了不会拖垮 DSH 本体**。如果 DSH 大版本改了客户端槽或 bundle 契约，
+   这一行最多不显示或显示错误，DSH 其他部分不受影响。行内始终提供手动命令：
+   ```bash
+   dsh plugin --profile web update --latest
+   dsh plugin --profile web add dsh-update-plugin@latest
+   ```
+
+## 常见问题
+
+- **设置里没有这一行/这一页，或者 Save、备份接口报 `HTTP 404`。**
+  浏览器半边可以热加载，但宿主半边（`lib/index.js`）是 DSH 启动时加载的。
+  需要完整重启 DSH（停掉再启动 `dsh web`，或重启 DSH Desktop），然后硬刷新浏览器。
+- **右侧边栏 `+` 菜单里没有这个 tab。**
+  它使用 DSH 原生的 `sidebarRightTabs` API，需要 DSH 0.1.5-rc.1 及以上。
+- **安装时被 pnpm `minimumReleaseAge` 拦截。**
+  在那一次 `dsh plugin add` 命令后加 `--config.minimum-release-age=0`。
+
+## 兼容性
+
+| DSH 版本 | 状态 |
+| --- | --- |
+| `0.1.0-rc.8` | 预期可用 |
+| `0.1.1-rc.2` | 预期可用 |
+| `0.1.2-rc.1` | 预期可用 |
+| `0.1.5-rc.1` | 预期可用 |
+| `0.1.5-rc.2` | 已测试 |
+
+DSH 目前是 0.x，大版本可能重命名客户端槽或调整公开服务。届时插件需要发一个小的
+兼容版本；在适配完成前，上面的两个兜底命令保证用户不会被卡住。
+
+## 实现方式
+
+- **浏览器半边**（`lib/client.js`）注册到官方公开的 `settings.general.item`
+  槽，和原生的通用设置行使用同一套机制；只和两个 loopback 接口通信。
+- **宿主半边**（`lib/index.js`、`lib/update-core.js`）按频道解析 npm
+  dist-tags、动态发现 profile、备份、用 npm 或 pnpm 更新 CLI，再用
+  `dsh plugin --profile <name> update --latest` 更新每个 profile（失败时回退
+  `pnpm update`）。
+- 宿主接口：`/api/dsh-update-plugin/` 下的 `/status`、`/update`、`/config`、
+  `/backups`、`/rollback`。
+- 只使用 Node 内置模块，没有额外需要信任的依赖。
+
+## 发布
+
+1. 修改 `plugin/package.json` 里的 `version`，补充发布说明。
+2. 提交后打 tag 并推送：
+   ```bash
+   git tag plugin-vX.Y.Z
+   git push origin plugin-vX.Y.Z
+   ```
+3. **Publish plugin** workflow 会把插件发布到 npm。需要在仓库 secret 里配置
+   `NPM_TOKEN`，并确保它对 `dsh-update-plugin` 有发布权限。
+
+## 开发
+
+```bash
+cd plugin
+node --test test/
+node --check lib/index.js
+node --check lib/client.js
+node --check lib/update-core.js
+```
+
+## 许可证
+
+[MIT](LICENSE)

package/cordis.patch.yml

@@ -0,0 +1,10 @@
+# dsh-update-plugin bundle patch
+#
+# Installed with the official CLI:
+#
+#   dsh plugin --profile <name> add dsh-update-plugin
+#
+# — appends this single insert (one plugin row) to the bundle stack.
+- insert:
+    - id: dsh-update-plugin
+      name: dsh-update-plugin