dsh-wechat-remote 1.7.1 → 1.7.2

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 martinbear1
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 martinbear1
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,15 +1,17 @@
-# Agent远程管理助手 · DSH 插件安装器
+# Agent远程管理助手 · DSH 插件安装器
+
+首次安装和升级旧插件使用同一个命令：
+
+```sh
+npx -y dsh-wechat-remote@latest
+```
+
+需已安装 DSH，使用 Node.js 22.13 或更高版本。安装工具由包依赖自动提供，无需另装 pnpm 或 Git。
+
+安装器仅选择适配当前 DSH 和主机的正式插件，保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。
+
+支持已验证的 DSH `0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.5-rc.1`，Windows / macOS Intel / Linux x64。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务可自动恢复；无法确认启动方式时不自动停止主机。
 
-首次安装和升级旧插件使用同一个命令：
-
-```sh
-npx -y dsh-wechat-remote@latest
-```
-
-需已安装 DSH，使用 Node.js 22.13 或更高版本。安装工具由包依赖自动提供，无需另装 pnpm 或 Git。
-
-安装器仅选择适配当前 DSH 和主机的正式插件，保留原配置、配对和会话，不会升级 DSH 本体。请先结束运行中的任务；安装完成后自动重启原 DSH 并尝试打开 WebUI。
-
-支持已验证的 DSH `0.1.1-rc.2`、`0.1.2-rc.1`，Windows / macOS Intel / Linux x64。普通 Node 启动、独立的 macOS launchd 和 Linux 用户级 systemd 服务可自动恢复；无法确认启动方式时不自动停止主机。
-
-使用其他配置时附加 `--profile 配置名称`。安装损坏需要重装时附加 `--repair`；不会自动降级。
+旧插件 1.7.1 在 DSH 0.1.5 上无法一键更新时，可用本安装命令过渡一次。从插件 1.7.2 起，后续已验证的兼容更新不再受旧的 DSH 版本列表限制；不需要因此降低 DSH 版本或删除节点。
+
+使用其他配置时附加 `--profile 配置名称`。安装损坏需要重装时附加 `--repair`；不会自动降级。

package/assets/release.json

@@ -1,17 +1,18 @@
 {
-  "version": "1.7.1",
+  "version": "1.7.2",
   "catalog": {
     "schemaVersion": 1,
-    "revision": "installer-1.7.1",
-    "issuedAt": 1788979000679,
-    "expiresAt": 1791398200679,
+    "revision": "installer-1.7.2",
+    "issuedAt": 1789134534877,
+    "expiresAt": 1791553734877,
     "releases": [
       {
-        "version": "1.7.1",
+        "version": "1.7.2",
         "channel": "stable",
         "dsh": [
           "0.1.1-rc.2",
-          "0.1.2-rc.1"
+          "0.1.2-rc.1",
+          "0.1.5-rc.1"
         ],
         "platforms": [
           "windows",
@@ -22,9 +23,9 @@
           "x64"
         ],
         "asset": {
-          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.1/harness-remote-dsh-wechat-remote-1.7.1.tgz",
-          "sha256": "5274a6d5beb513124a6d1a916ddd6df7d3e236a7a970e48515d902fa4d8c94d0",
-          "bytes": 9526754
+          "url": "https://github.com/martinbear1/dsh-wechat-remote/releases/download/v1.7.2/harness-remote-dsh-wechat-remote-1.7.2.tgz",
+          "sha256": "0eb296a3a0c84f080148280f9b9419516a9dc640c9e13aa8cf014120aea591ee",
+          "bytes": 9539789
         }
       }
     ],

package/bin/native-control.mjs

@@ -1,70 +1,70 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import { parseDocument, isSeq, isMap } from 'yaml'
-import { createHash, randomBytes } from 'node:crypto'
-import { pathToFileURL } from 'node:url'
-
-const digest = value => createHash('sha256').update(value).digest('hex')
-function writePatch(filename, text) {
-  const temporary = filename + '.wechat-' + randomBytes(8).toString('hex')
-  const mode = fs.existsSync(filename) ? fs.statSync(filename).mode : 0o600
-  try {
-    fs.writeFileSync(temporary, text, { mode, flag: 'wx' })
-    fs.renameSync(temporary, filename)
-  } finally {
-    try { fs.unlinkSync(temporary) } catch (error) { if (error.code !== 'ENOENT') throw error }
-  }
-}
-function document(text) {
-  const doc = parseDocument(text, { customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: value => value }] })
-  if (doc.errors.length || !isSeq(doc.contents)) throw new Error('DSH 配置不是有效的原生插件列表，未修改配置。')
-  return doc
-}
-/** Native user-patch insertion; remove only our entry and retain concurrent edits. */
-export function attachControl(profile, helper, config) {
-  const filename = path.join(profile, 'cordis.patch.yml')
-  const original = fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8') : '[]\n'
-  const doc = document(original), id = 'wechat-installer-' + path.basename(config.directory)
-  doc.contents.flow = false
-  doc.contents.add(doc.createNode({ insert: [{ id, name: pathToFileURL(helper).href, config }] }))
-  const patched = String(doc)
-  fs.writeFileSync(path.join(config.directory, 'user-patch-before.yml'), original, { mode: 0o600, flag: 'wx' })
-  writePatch(filename, patched)
-  return () => {
-    const current = fs.readFileSync(filename, 'utf8')
-    if (digest(current) === digest(patched)) { writePatch(filename, original); return }
-    const latest = document(current)
-    latest.contents.items = latest.contents.items.filter(item => {
-      if (!isMap(item)) return true
-      const entries = item.get('insert', true)
-      if (!isSeq(entries)) return true
-      entries.items = entries.items.filter(entry => !isMap(entry) || entry.get('id') !== id)
-      return entries.items.length > 0 || item.items.length !== 1
-    })
-    writePatch(filename, String(latest))
-  }
-}
-
-export async function waitForJson(filename, accept, timeout = 20000) {
-  const until = Date.now() + timeout
-  while (Date.now() < until) {
-    try { const value = JSON.parse(fs.readFileSync(filename, 'utf8')); if (accept(value)) return value } catch {}
-    await new Promise(resolve => setTimeout(resolve, 100))
-  }
-  throw new Error('DSH 没有完成安装握手；原插件未替换。请确认 DSH WebUI 正在运行且允许原生插件热加载。')
-}
-
-/** One bounded native handshake, including a possible offline host start.
- * A listening WebUI is not proof that the asynchronous profile reload finished.
- * Keep the same control entry/token while waiting; never restart a live host. */
-export async function waitForInstallControl(filename, {
-  accept, ensureRunning, onWaiting = () => {}, timeoutMs = 60000, initialWaitMs = 5000,
-}) {
-  const deadline = Date.now() + timeoutMs
-  try { return await waitForJson(filename, accept, Math.min(initialWaitMs, timeoutMs)) }
-  catch {
-    onWaiting()
-    if (Date.now() < deadline) await ensureRunning()
-    return await waitForJson(filename, accept, Math.max(0, deadline - Date.now()))
-  }
-}
+import fs from 'node:fs'
+import path from 'node:path'
+import { parseDocument, isSeq, isMap } from 'yaml'
+import { createHash, randomBytes } from 'node:crypto'
+import { pathToFileURL } from 'node:url'
+
+const digest = value => createHash('sha256').update(value).digest('hex')
+function writePatch(filename, text) {
+  const temporary = filename + '.wechat-' + randomBytes(8).toString('hex')
+  const mode = fs.existsSync(filename) ? fs.statSync(filename).mode : 0o600
+  try {
+    fs.writeFileSync(temporary, text, { mode, flag: 'wx' })
+    fs.renameSync(temporary, filename)
+  } finally {
+    try { fs.unlinkSync(temporary) } catch (error) { if (error.code !== 'ENOENT') throw error }
+  }
+}
+function document(text) {
+  const doc = parseDocument(text, { customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: value => value }] })
+  if (doc.errors.length || !isSeq(doc.contents)) throw new Error('DSH 配置不是有效的原生插件列表，未修改配置。')
+  return doc
+}
+/** Native user-patch insertion; remove only our entry and retain concurrent edits. */
+export function attachControl(profile, helper, config) {
+  const filename = path.join(profile, 'cordis.patch.yml')
+  const original = fs.existsSync(filename) ? fs.readFileSync(filename, 'utf8') : '[]\n'
+  const doc = document(original), id = 'wechat-installer-' + path.basename(config.directory)
+  doc.contents.flow = false
+  doc.contents.add(doc.createNode({ insert: [{ id, name: pathToFileURL(helper).href, config }] }))
+  const patched = String(doc)
+  fs.writeFileSync(path.join(config.directory, 'user-patch-before.yml'), original, { mode: 0o600, flag: 'wx' })
+  writePatch(filename, patched)
+  return () => {
+    const current = fs.readFileSync(filename, 'utf8')
+    if (digest(current) === digest(patched)) { writePatch(filename, original); return }
+    const latest = document(current)
+    latest.contents.items = latest.contents.items.filter(item => {
+      if (!isMap(item)) return true
+      const entries = item.get('insert', true)
+      if (!isSeq(entries)) return true
+      entries.items = entries.items.filter(entry => !isMap(entry) || entry.get('id') !== id)
+      return entries.items.length > 0 || item.items.length !== 1
+    })
+    writePatch(filename, String(latest))
+  }
+}
+
+export async function waitForJson(filename, accept, timeout = 20000) {
+  const until = Date.now() + timeout
+  while (Date.now() < until) {
+    try { const value = JSON.parse(fs.readFileSync(filename, 'utf8')); if (accept(value)) return value } catch {}
+    await new Promise(resolve => setTimeout(resolve, 100))
+  }
+  throw new Error('DSH 没有完成安装握手；原插件未替换。请确认 DSH WebUI 正在运行且允许原生插件热加载。')
+}
+
+/** One bounded native handshake, including a possible offline host start.
+ * A listening WebUI is not proof that the asynchronous profile reload finished.
+ * Keep the same control entry/token while waiting; never restart a live host. */
+export async function waitForInstallControl(filename, {
+  accept, ensureRunning, onWaiting = () => {}, timeoutMs = 60000, initialWaitMs = 5000,
+}) {
+  const deadline = Date.now() + timeoutMs
+  try { return await waitForJson(filename, accept, Math.min(initialWaitMs, timeoutMs)) }
+  catch {
+    onWaiting()
+    if (Date.now() < deadline) await ensureRunning()
+    return await waitForJson(filename, accept, Math.max(0, deadline - Date.now()))
+  }
+}

package/bin/setup.mjs

@@ -1,165 +1,165 @@
-#!/usr/bin/env node
-import fs from 'node:fs'
-import path from 'node:path'
-import os from 'node:os'
-import net from 'node:net'
-import { spawn } from 'node:child_process'
-import { randomBytes, createHash } from 'node:crypto'
-import { fileURLToPath } from 'node:url'
-import { attachControl, waitForJson, waitForInstallControl } from './native-control.mjs'
-import { resolveInstallRuntime, verifyInstallRuntime } from '../lib/install-runtime.js'
-import { validateCatalog, releaseMatches, compareVersions } from '../lib/update-policy.js'
-import { boundedFetch, downloadRelease, auditArchive } from '../lib/update-download.js'
-import { writePrivateJsonAtomic } from '../lib/secure-file.js'
-import { control, validateJob, releaseOwnedUpdateLock } from '../lib/update-worker.js'
-
-const root = fileURLToPath(new URL('../', import.meta.url))
-const packageName = '@harness-remote/dsh-wechat-remote'
-const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
-export function findDsh() {
-  const candidates = []
-  for (const dir of (process.env.PATH || '').split(path.delimiter).filter(Boolean)) {
-    candidates.push(path.join(dir, 'node_modules/@deepseek-ai/dsh/lib/bin.js'), path.join(dir, '../lib/node_modules/@deepseek-ai/dsh/lib/bin.js'))
-    try { candidates.push(fs.realpathSync(path.join(dir, 'dsh'))) } catch {}
-  }
-  for (const candidate of candidates) {
-    try {
-      const cli = fs.realpathSync(candidate)
-      const manifest = JSON.parse(fs.readFileSync(path.resolve(cli, '../../package.json'), 'utf8'))
-      if (manifest.name === '@deepseek-ai/dsh' && path.basename(cli) === 'bin.js') return cli
-    } catch {}
-  }
-  throw new Error('未找到已安装的 DSH。请先安装并启动 DeepSeek Harness。')
-}
-function portBusy(port) {
-  return new Promise(resolve => {
-    const socket = net.connect({ host: '127.0.0.1', port })
-    const end = busy => { socket.destroy(); resolve(busy) }
-    socket.setTimeout(500, () => end(false)); socket.once('connect', () => end(true)); socket.once('error', () => end(false))
-  })
-}
-async function selectRelease(host, assetsRoot = path.join(root, 'assets'), repair = false) {
-  const current = { agentKind: 'dsh', agentVersion: host.dshVersion, pluginVersion: host.pluginVersion,
-    platform: { win32: 'windows', darwin: 'macos', linux: 'linux' }[host.platform], arch: host.arch }
-  const pinned = JSON.parse(fs.readFileSync(path.join(assetsRoot, 'release.json'), 'utf8'))
-  const catalog = validateCatalog(pinned.catalog)
-  let releases = catalog.releases
-  try {
-    const remote = validateCatalog(JSON.parse((await boundedFetch('https://relay.xyxfood.xyz/v1/update-policy', 256 * 1024)).toString('utf8')))
-    if (remote.issuedAt <= Date.now() + 300000 && remote.expiresAt > Date.now()) {
-      releases = [...releases, ...remote.releases].filter(r => !remote.blocked.some(b => b.pluginVersion === r.version && (!b.dsh || b.dsh.includes(current.agentVersion)) && (!b.platforms || b.platforms.includes(current.platform))))
-    }
-  } catch { /* Authenticated npm package retains its explicitly tested release. */ }
-  const release = releases.filter(r => r.channel === 'stable' && releaseMatches(r, current))
-    .sort((a, b) => compareVersions(b.version, a.version))[0]
-  if (!release) throw new Error('当前 DSH 版本或系统尚无已验证的插件版本；没有修改现有安装。')
-  if (host.pluginVersion !== '0.0.0' && (compareVersions(host.pluginVersion, release.version) > 0
-    || (compareVersions(host.pluginVersion, release.version) === 0 && !repair))) return { release, archive: null }
-  let archive
-  if (release.version === pinned.version) archive = fs.readFileSync(path.join(assetsRoot, 'plugin.tgz'))
-  else archive = await downloadRelease(release)
-  auditArchive(archive, release)
-  return { release, archive }
-}
-export async function install({ profileName = 'web', cli = findDsh(), assetsRoot, open = true, repair = false } = {}) {
-  if (!/^[A-Za-z0-9_-]{1,80}$/.test(profileName)) throw new Error('无效的 profile 名称。')
-  const runtime = resolveInstallRuntime(root); await verifyInstallRuntime(runtime)
-  const home = path.resolve(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'))
-  fs.mkdirSync(home, { recursive: true, mode: 0o700 })
-  if (fs.realpathSync(home) !== home) throw new Error('DSH 数据目录是链接，暂不自动替换安装。')
-  const profile = path.join(home, 'profiles', profileName), id = randomBytes(16).toString('hex')
-  const directory = path.join(home, 'harness-remote-updates', id), token = randomBytes(24).toString('hex')
-  fs.mkdirSync(directory, { recursive: true, mode: 0o700 })
-  let remove, ref, job, locked = false, authorized = false, launched
-  const lockFile = path.join(profile, '.harness-remote-update.lock')
-  console.log('正在检查 DSH 与插件…')
-  try {
-    // Initialize missing profiles through DSH itself, never synthesize a bundle list.
-    if (!fs.existsSync(path.join(profile, 'package.json'))) {
-      const log = fs.openSync(path.join(directory, 'startup.log'), 'a', 0o600)
-      launched = spawn(process.execPath, [cli, 'web', '--profile', profileName, '--no-open'], {
-        cwd: process.cwd(), env: process.env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
-      fs.closeSync(log); launched.on('error', () => {}); launched.unref()
-      for (let i = 0; i < 100 && !fs.existsSync(path.join(profile, 'package.json')); i++) await sleep(100)
-      if (!fs.existsSync(path.join(profile, 'package.json'))) throw new Error('DSH 未能初始化 profile；详情见本机安装记录。')
-      await sleep(2000)
-    }
-    const fd = fs.openSync(lockFile, 'wx', 0o600); fs.writeFileSync(fd, id); fs.closeSync(fd); locked = true
-    const helper = path.join(directory, 'install-control.js')
-    fs.copyFileSync(path.join(root, 'lib/install-control.js'), helper)
-    writePrivateJsonAtomic(path.join(directory, 'package.json'), { type: 'module' })
-    remove = attachControl(profile, helper, { directory, token, pnpm: runtime.cli })
-    const handshakeStarted = Date.now()
-    try {
-      ref = await waitForInstallControl(path.join(directory, 'control-ready.json'), {
-        accept: v => Number.isInteger(v.pid) && v.pid > 0 && (!launched || v.pid === launched.pid),
-        onWaiting: () => console.log('正在等待 DSH 完成安装准备，请勿重复执行命令…'),
-        ensureRunning: async () => {
-          if (launched || await portBusy(Number(process.env.DSH_PORT || 3080))) return
-          const log = fs.openSync(path.join(directory, 'startup.log'), 'a', 0o600)
-          launched = spawn(process.execPath, [cli, 'web', '--profile', profileName, '--no-open'], {
-            cwd: process.cwd(), env: process.env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
-          fs.closeSync(log); launched.on('error', () => {}); launched.unref()
-        },
-      })
-      writePrivateJsonAtomic(path.join(directory, 'handshake.json'), {
-        state: 'ready', elapsedMs: Date.now() - handshakeStarted, startedHost: Boolean(launched),
-      })
-    } catch {
-      writePrivateJsonAtomic(path.join(directory, 'handshake.json'), {
-        state: 'timeout', elapsedMs: Date.now() - handshakeStarted, startedHost: Boolean(launched),
-      })
-      throw new Error('DSH 安装准备超时，原插件未替换。本机安装记录：' + path.join(directory, 'handshake.json'))
-    }
-    job = { controlOrigin: ref.origin, statusToken: token }
-    const host = await control(job, 'describe')
-    if (host.home !== home || host.profile !== profile || host.cli !== fs.realpathSync(cli) || (launched && host.pid !== launched.pid)) throw new Error('当前 DSH 身份与安装目标不一致，未修改安装。')
-    remove(); remove = undefined
-    await sleep(600)
-    const selected = await selectRelease(host, assetsRoot, repair)
-    if (!selected.archive) { console.log(`插件 ${host.pluginVersion} 无需更新。`); return { version: host.pluginVersion, changed: false } }
-    console.log(`正在安装插件 ${selected.release.version}，保留原配对与会话…`)
-    job = { ...host, id, directory, parentPid: host.pid, pnpm: runtime.cli, targetVersion: selected.release.version,
-      previousVersion: host.pluginVersion, statusToken: token, controlOrigin: ref.origin }
-    validateJob(job)
-    fs.writeFileSync(path.join(directory, 'release.tgz'), selected.archive, { mode: 0o600, flag: 'wx' })
-    fs.copyFileSync(path.join(root, 'lib/update-worker.js'), path.join(directory, 'update-worker.js'))
-    writePrivateJsonAtomic(path.join(directory, 'job.json'), job)
-    await control(job, 'launch')
-    const ready = await waitForJson(path.join(directory, 'worker-ready.json'), v => v.id === id)
-    const scope = createHash('sha256').update(profileName).digest('hex').slice(0, 24)
-    writePrivateJsonAtomic(path.join(home, 'harness-remote-updates', `profile-${scope}.json`), { jobId: id, statusOrigin: ready.origin, statusToken: token })
-    writePrivateJsonAtomic(path.join(directory, 'authorized.json'), { id }); authorized = true
-    let previous = '', result
-    const until = Date.now() + 600000
-    while (Date.now() < until) {
-      try { result = JSON.parse(fs.readFileSync(path.join(directory, 'result.json'), 'utf8')) } catch {}
-      if (result?.phase !== previous && result?.phase) { console.log(`${result.progress}% ${result.message}`); previous = result.phase }
-      if (result?.terminal) break
-      await sleep(500)
-    }
-    if (!result?.terminal || !result.ok) throw new Error(result?.message || '安装结果待确认，请保留本机安装记录，不要重复安装。')
-    if (open) {
-      try {
-        const origin = `http://127.0.0.1:${host.webPort}`
-        const response = await fetch(`http://127.0.0.1:${host.localPort}/gate/update/resume?job=${id}`, { headers: { origin }, signal: AbortSignal.timeout(10000) })
-        const value = await response.json(), url = new URL(value.url)
-        if (!response.ok || url.origin !== origin || url.pathname !== '/' || url.hash || url.username || url.password) throw new Error('invalid resume')
-        const command = process.platform === 'win32' ? ['rundll32.exe', ['url.dll,FileProtocolHandler', url.href]] : process.platform === 'darwin' ? ['/usr/bin/open', [url.href]] : ['xdg-open', [url.href]]
-        const browser = spawn(command[0], command[1], { detached: true, windowsHide: true, stdio: 'ignore' }); browser.on('error', () => {}); browser.unref()
-      } catch { console.log('插件已更新；请返回原 DSH WebUI 查看。') }
-    }
-    return { version: selected.release.version, changed: true }
-  } finally {
-    remove?.()
-    if (ref && !authorized) { try { await control({ controlOrigin: ref.origin, statusToken: token }, 'close') } catch {} }
-    if (locked && !authorized) releaseOwnedUpdateLock(lockFile, id)
-  }
-}
-if (process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  const args = process.argv.slice(2), repair = args.includes('--repair')
-  if (repair) args.splice(args.indexOf('--repair'), 1)
-  if (args.includes('--help') || args.includes('-h')) console.log('安装或升级 DSH 微信连接插件：npx -y dsh-wechat-remote@latest\n可选：--profile <名称>（默认 web）；--repair（重新安装当前兼容版本，不降级）')
-  else if (args.length && !(args.length === 2 && args[0] === '--profile')) { console.error('不支持的参数。使用 --help 查看用法。'); process.exitCode = 1 }
-  else install({ profileName: args[1] || 'web', repair }).catch(error => { console.error(error.message); process.exitCode = 1 })
-}
+#!/usr/bin/env node
+import fs from 'node:fs'
+import path from 'node:path'
+import os from 'node:os'
+import net from 'node:net'
+import { spawn } from 'node:child_process'
+import { randomBytes, createHash } from 'node:crypto'
+import { fileURLToPath } from 'node:url'
+import { attachControl, waitForJson, waitForInstallControl } from './native-control.mjs'
+import { resolveInstallRuntime, verifyInstallRuntime } from '../lib/install-runtime.js'
+import { validateCatalog, releaseMatches, compareVersions } from '../lib/update-policy.js'
+import { boundedFetch, downloadRelease, auditArchive } from '../lib/update-download.js'
+import { writePrivateJsonAtomic } from '../lib/secure-file.js'
+import { control, validateJob, releaseOwnedUpdateLock } from '../lib/update-worker.js'
+
+const root = fileURLToPath(new URL('../', import.meta.url))
+const packageName = '@harness-remote/dsh-wechat-remote'
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
+export function findDsh() {
+  const candidates = []
+  for (const dir of (process.env.PATH || '').split(path.delimiter).filter(Boolean)) {
+    candidates.push(path.join(dir, 'node_modules/@deepseek-ai/dsh/lib/bin.js'), path.join(dir, '../lib/node_modules/@deepseek-ai/dsh/lib/bin.js'))
+    try { candidates.push(fs.realpathSync(path.join(dir, 'dsh'))) } catch {}
+  }
+  for (const candidate of candidates) {
+    try {
+      const cli = fs.realpathSync(candidate)
+      const manifest = JSON.parse(fs.readFileSync(path.resolve(cli, '../../package.json'), 'utf8'))
+      if (manifest.name === '@deepseek-ai/dsh' && path.basename(cli) === 'bin.js') return cli
+    } catch {}
+  }
+  throw new Error('未找到已安装的 DSH。请先安装并启动 DeepSeek Harness。')
+}
+function portBusy(port) {
+  return new Promise(resolve => {
+    const socket = net.connect({ host: '127.0.0.1', port })
+    const end = busy => { socket.destroy(); resolve(busy) }
+    socket.setTimeout(500, () => end(false)); socket.once('connect', () => end(true)); socket.once('error', () => end(false))
+  })
+}
+async function selectRelease(host, assetsRoot = path.join(root, 'assets'), repair = false) {
+  const current = { agentKind: 'dsh', agentVersion: host.dshVersion, pluginVersion: host.pluginVersion,
+    platform: { win32: 'windows', darwin: 'macos', linux: 'linux' }[host.platform], arch: host.arch }
+  const pinned = JSON.parse(fs.readFileSync(path.join(assetsRoot, 'release.json'), 'utf8'))
+  const catalog = validateCatalog(pinned.catalog)
+  let releases = catalog.releases
+  try {
+    const remote = validateCatalog(JSON.parse((await boundedFetch('https://relay.xyxfood.xyz/v1/update-policy', 256 * 1024)).toString('utf8')))
+    if (remote.issuedAt <= Date.now() + 300000 && remote.expiresAt > Date.now()) {
+      releases = [...releases, ...remote.releases].filter(r => !remote.blocked.some(b => b.pluginVersion === r.version && (!b.dsh || b.dsh.includes(current.agentVersion)) && (!b.platforms || b.platforms.includes(current.platform))))
+    }
+  } catch { /* Authenticated npm package retains its explicitly tested release. */ }
+  const release = releases.filter(r => r.channel === 'stable' && releaseMatches(r, current))
+    .sort((a, b) => compareVersions(b.version, a.version))[0]
+  if (!release) throw new Error('当前 DSH 版本或系统尚无已验证的插件版本；没有修改现有安装。')
+  if (host.pluginVersion !== '0.0.0' && (compareVersions(host.pluginVersion, release.version) > 0
+    || (compareVersions(host.pluginVersion, release.version) === 0 && !repair))) return { release, archive: null }
+  let archive
+  if (release.version === pinned.version) archive = fs.readFileSync(path.join(assetsRoot, 'plugin.tgz'))
+  else archive = await downloadRelease(release)
+  auditArchive(archive, release)
+  return { release, archive }
+}
+export async function install({ profileName = 'web', cli = findDsh(), assetsRoot, open = true, repair = false } = {}) {
+  if (!/^[A-Za-z0-9_-]{1,80}$/.test(profileName)) throw new Error('无效的 profile 名称。')
+  const runtime = resolveInstallRuntime(root); await verifyInstallRuntime(runtime)
+  const home = path.resolve(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'))
+  fs.mkdirSync(home, { recursive: true, mode: 0o700 })
+  if (fs.realpathSync(home) !== home) throw new Error('DSH 数据目录是链接，暂不自动替换安装。')
+  const profile = path.join(home, 'profiles', profileName), id = randomBytes(16).toString('hex')
+  const directory = path.join(home, 'harness-remote-updates', id), token = randomBytes(24).toString('hex')
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 })
+  let remove, ref, job, locked = false, authorized = false, launched
+  const lockFile = path.join(profile, '.harness-remote-update.lock')
+  console.log('正在检查 DSH 与插件…')
+  try {
+    // Initialize missing profiles through DSH itself, never synthesize a bundle list.
+    if (!fs.existsSync(path.join(profile, 'package.json'))) {
+      const log = fs.openSync(path.join(directory, 'startup.log'), 'a', 0o600)
+      launched = spawn(process.execPath, [cli, '--profile', profileName, '--no-open'], {
+        cwd: process.cwd(), env: process.env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
+      fs.closeSync(log); launched.on('error', () => {}); launched.unref()
+      for (let i = 0; i < 100 && !fs.existsSync(path.join(profile, 'package.json')); i++) await sleep(100)
+      if (!fs.existsSync(path.join(profile, 'package.json'))) throw new Error('DSH 未能初始化 profile；详情见本机安装记录。')
+      await sleep(2000)
+    }
+    const fd = fs.openSync(lockFile, 'wx', 0o600); fs.writeFileSync(fd, id); fs.closeSync(fd); locked = true
+    const helper = path.join(directory, 'install-control.js')
+    fs.copyFileSync(path.join(root, 'lib/install-control.js'), helper)
+    writePrivateJsonAtomic(path.join(directory, 'package.json'), { type: 'module' })
+    remove = attachControl(profile, helper, { directory, token, pnpm: runtime.cli })
+    const handshakeStarted = Date.now()
+    try {
+      ref = await waitForInstallControl(path.join(directory, 'control-ready.json'), {
+        accept: v => Number.isInteger(v.pid) && v.pid > 0 && (!launched || v.pid === launched.pid),
+        onWaiting: () => console.log('正在等待 DSH 完成安装准备，请勿重复执行命令…'),
+        ensureRunning: async () => {
+          if (launched || await portBusy(Number(process.env.DSH_PORT || 3080))) return
+          const log = fs.openSync(path.join(directory, 'startup.log'), 'a', 0o600)
+          launched = spawn(process.execPath, [cli, '--profile', profileName, '--no-open'], {
+            cwd: process.cwd(), env: process.env, detached: true, windowsHide: true, stdio: ['ignore', log, log] })
+          fs.closeSync(log); launched.on('error', () => {}); launched.unref()
+        },
+      })
+      writePrivateJsonAtomic(path.join(directory, 'handshake.json'), {
+        state: 'ready', elapsedMs: Date.now() - handshakeStarted, startedHost: Boolean(launched),
+      })
+    } catch {
+      writePrivateJsonAtomic(path.join(directory, 'handshake.json'), {
+        state: 'timeout', elapsedMs: Date.now() - handshakeStarted, startedHost: Boolean(launched),
+      })
+      throw new Error('DSH 安装准备超时，原插件未替换。本机安装记录：' + path.join(directory, 'handshake.json'))
+    }
+    job = { controlOrigin: ref.origin, statusToken: token }
+    const host = await control(job, 'describe')
+    if (host.home !== home || host.profile !== profile || host.cli !== fs.realpathSync(cli) || (launched && host.pid !== launched.pid)) throw new Error('当前 DSH 身份与安装目标不一致，未修改安装。')
+    remove(); remove = undefined
+    await sleep(600)
+    const selected = await selectRelease(host, assetsRoot, repair)
+    if (!selected.archive) { console.log(`插件 ${host.pluginVersion} 无需更新。`); return { version: host.pluginVersion, changed: false } }
+    console.log(`正在安装插件 ${selected.release.version}，保留原配对与会话…`)
+    job = { ...host, id, directory, parentPid: host.pid, pnpm: runtime.cli, targetVersion: selected.release.version,
+      previousVersion: host.pluginVersion, statusToken: token, controlOrigin: ref.origin }
+    validateJob(job)
+    fs.writeFileSync(path.join(directory, 'release.tgz'), selected.archive, { mode: 0o600, flag: 'wx' })
+    fs.copyFileSync(path.join(root, 'lib/update-worker.js'), path.join(directory, 'update-worker.js'))
+    writePrivateJsonAtomic(path.join(directory, 'job.json'), job)
+    await control(job, 'launch')
+    const ready = await waitForJson(path.join(directory, 'worker-ready.json'), v => v.id === id)
+    const scope = createHash('sha256').update(profileName).digest('hex').slice(0, 24)
+    writePrivateJsonAtomic(path.join(home, 'harness-remote-updates', `profile-${scope}.json`), { jobId: id, statusOrigin: ready.origin, statusToken: token })
+    writePrivateJsonAtomic(path.join(directory, 'authorized.json'), { id }); authorized = true
+    let previous = '', result
+    const until = Date.now() + 600000
+    while (Date.now() < until) {
+      try { result = JSON.parse(fs.readFileSync(path.join(directory, 'result.json'), 'utf8')) } catch {}
+      if (result?.phase !== previous && result?.phase) { console.log(`${result.progress}% ${result.message}`); previous = result.phase }
+      if (result?.terminal) break
+      await sleep(500)
+    }
+    if (!result?.terminal || !result.ok) throw new Error(result?.message || '安装结果待确认，请保留本机安装记录，不要重复安装。')
+    if (open) {
+      try {
+        const origin = `http://127.0.0.1:${host.webPort}`
+        const response = await fetch(`http://127.0.0.1:${host.localPort}/gate/update/resume?job=${id}`, { headers: { origin }, signal: AbortSignal.timeout(10000) })
+        const value = await response.json(), url = new URL(value.url)
+        if (!response.ok || url.origin !== origin || url.pathname !== '/' || url.hash || url.username || url.password) throw new Error('invalid resume')
+        const command = process.platform === 'win32' ? ['rundll32.exe', ['url.dll,FileProtocolHandler', url.href]] : process.platform === 'darwin' ? ['/usr/bin/open', [url.href]] : ['xdg-open', [url.href]]
+        const browser = spawn(command[0], command[1], { detached: true, windowsHide: true, stdio: 'ignore' }); browser.on('error', () => {}); browser.unref()
+      } catch { console.log('插件已更新；请返回原 DSH WebUI 查看。') }
+    }
+    return { version: selected.release.version, changed: true }
+  } finally {
+    remove?.()
+    if (ref && !authorized) { try { await control({ controlOrigin: ref.origin, statusToken: token }, 'close') } catch {} }
+    if (locked && !authorized) releaseOwnedUpdateLock(lockFile, id)
+  }
+}
+if (process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const args = process.argv.slice(2), repair = args.includes('--repair')
+  if (repair) args.splice(args.indexOf('--repair'), 1)
+  if (args.includes('--help') || args.includes('-h')) console.log('安装或升级 DSH 微信连接插件：npx -y dsh-wechat-remote@latest\n可选：--profile <名称>（默认 web）；--repair（重新安装当前兼容版本，不降级）')
+  else if (args.length && !(args.length === 2 && args[0] === '--profile')) { console.error('不支持的参数。使用 --help 查看用法。'); process.exitCode = 1 }
+  else install({ profileName: args[1] || 'web', repair }).catch(error => { console.error(error.message); process.exitCode = 1 })
+}

package/lib/install-control.js

@@ -573,7 +573,7 @@ function presentationProjection(key, raw) {
   switch (key) {
     case "sessionStats":
       name = "metrics";
-      value = numbers(v, [["turns", "turns"], ["steps", "steps"], ["toolMs", "toolMs"], ["llmMs", "modelMs"], ["ttftMs", "firstTokenMs"], ["ttftSteps", "firstTokenSamples"]]);
+      value = numbers(v, [["turns", "turns"], ["steps", "steps"], ["toolMs", "toolMs"], ["llmMs", "modelMs"], ["ttftMs", "firstTokenMs"], ["ttftSteps", "firstTokenSamples"], ["decodeMs", "decodeMs"], ["decodeTokens", "decodeTokens"]]);
       break;
     case "tokenUsage":
       name = "usage";
@@ -660,6 +660,23 @@ function planLegacyRpc(request) {
       throw new Error(`unsupported Remote endpoint: ${method}`);
     }
     const supplied = recordOf(payload.args);
+    if (namespace === "commands" && remoteMethod === "execute") {
+      const args = supplied ?? {};
+      const line = typeof args.line === "string" ? args.line.trim() : "";
+      if (/^\/permission(?:\s|$)/.test(line)) {
+        const match = /^\/permission(?:[ \t]+([a-z][a-z0-9-]*))?[ \t]*$/.exec(line);
+        if (!match || typeof args.agentId !== "string" || !args.agentId.trim() || ["images", "submittedAttachments"].some((key) => args[key] !== void 0 && (!Array.isArray(args[key]) || args[key].length))) {
+          throw Object.assign(new Error("\u6743\u9650\u547D\u4EE4\u683C\u5F0F\u65E0\u6548\uFF1B\u672A\u66F4\u6539\u6743\u9650"), { code: "adapter/invalid-permission-command" });
+        }
+        return { kind: "permission-command", sessionId: args.agentId, line, nativeReceipt: true, ...match[1] ? { preset: match[1] } : {} };
+      }
+      const images = Array.isArray(args.images) ? args.images : [];
+      return { kind: "invoke", namespace, method: remoteMethod, args: {
+        ...args,
+        images,
+        submittedAttachments: args.submittedAttachments ?? images.map((image) => ({ ...recordOf(image), type: "image" }))
+      } };
+    }
     return { kind: "invoke", namespace, method: remoteMethod, args: supplied ?? {} };
   }
   if (method === "host.describe") return { kind: "host-describe" };
@@ -798,7 +815,31 @@ function planLegacyRpc(request) {
 }
 function resolveTypertGateway(ctx) {
   const candidate = ctx.get("typertGateway");
-  return candidate && typeof candidate.invoke === "function" && typeof candidate.stream === "function" ? candidate : null;
+  if (!candidate || typeof candidate.invoke !== "function" || typeof candidate.stream !== "function") return null;
+  return {
+    wireStream: candidate.wireStream,
+    invoke: (request) => candidate.invoke(request),
+    stream: (request) => candidate.stream(request),
+    commandAttachmentField: () => {
+      const registry = ctx.get("typert");
+      const descriptor = registry?.local?.get("commands/execute");
+      if (descriptor) {
+        const fields = descriptor.parameters?.map((parameter) => parameter.wire) || [];
+        if (fields.includes("submittedAttachments") && !fields.includes("images")) return "submittedAttachments";
+        if (fields.includes("images") && !fields.includes("submittedAttachments")) return "images";
+        throw new Error("DSH \u547D\u4EE4\u9644\u4EF6\u53C2\u6570\u5DF2\u53D8\u66F4\uFF1B\u672A\u6267\u884C\u547D\u4EE4");
+      }
+      if (registry?.local?.hasSeen?.("commands/execute")) throw new Error("DSH \u547D\u4EE4\u63A5\u53E3\u6B63\u5728\u66F4\u65B0\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5");
+      return ctx.get("fileUploads") ? "submittedAttachments" : "images";
+    }
+  };
+}
+function commandArguments(gateway, args) {
+  const field = gateway.commandAttachmentField?.() || "images";
+  const { images, submittedAttachments, ...rest } = args;
+  const value = field === "submittedAttachments" ? submittedAttachments ?? (Array.isArray(images) ? images.map((image) => ({ ...recordOf(image), type: "image" })) : []) : images ?? [];
+  if (field === "images" && Array.isArray(submittedAttachments) && submittedAttachments.some((part) => recordOf(part)?.type !== "image")) throw new Error("\u6B64\u7248\u672C DSH \u547D\u4EE4\u4E0D\u652F\u6301\u6587\u4EF6\u9644\u4EF6");
+  return { ...rest, [field]: value };
 }
 function errorResult(error) {
   const value = recordOf(error);
@@ -926,7 +967,7 @@ async function permissionCommandValue(gateway, plan, signal, readHistory, flushP
   const command = recordOf(await gateway.invoke({
     namespace: "commands",
     method: "execute",
-    args: { agentId: plan.sessionId, line: plan.line, images: [] },
+    args: commandArguments(gateway, { agentId: plan.sessionId, line: plan.line, images: [], submittedAttachments: [] }),
     signal
   }));
   const result = recordOf(command?.result);
@@ -943,7 +984,7 @@ async function permissionCommandValue(gateway, plan, signal, readHistory, flushP
       code: "adapter/permission-not-applied"
     });
   }
-  return { accepted: true, command: true, permission: current, commandId: command?.commandId };
+  return plan.nativeReceipt ? command : { accepted: true, command: true, permission: current, commandId: command?.commandId };
 }
 async function sessionModelsValue(gateway, request, signal) {
   const sessionId = typeof request.sessionId === "string" ? request.sessionId : "";
@@ -989,7 +1030,7 @@ async function invokeLegacyRpc(gateway, request, options) {
           value = await gateway.invoke({
             namespace: plan.namespace,
             method: plan.method,
-            args: plan.args,
+            args: plan.namespace === "commands" && plan.method === "execute" ? commandArguments(gateway, plan.args) : plan.args,
             signal: options.signal
           });
           break;
@@ -1074,6 +1115,24 @@ function startUpdateWorker(manager, directory, executable) {
 
 // src/install-control.ts
 import { homedir as homedir4 } from "node:os";
+
+// src/install-capabilities.ts
+function assertNativeUpdateCapabilities(context) {
+  const ctx = context.root || context;
+  const web = ctx.get("webServer");
+  const sessions = ctx.get("sessions");
+  const missing = [];
+  for (const name of ["on", "listeners", "removeAllListeners", "removeListener"]) {
+    if (typeof web?.server?.[name] !== "function") missing.push("webServer." + name);
+  }
+  for (const name of ["get", "list", "flush"]) {
+    if (typeof sessions?.[name] !== "function") missing.push("sessions." + name);
+  }
+  if (typeof ctx.fiber?.dispose !== "function") missing.push("lifecycle.dispose");
+  if (missing.length) throw new Error("\u5F53\u524D\u5BBF\u4E3B\u7F3A\u5C11\u5B89\u5168\u66F4\u65B0\u6240\u9700\u80FD\u529B\uFF0C\u672A\u505C\u6B62\u8282\u70B9\uFF1A" + missing.join(", "));
+}
+
+// src/install-control.ts
 async function quiesceNativeHost(ctx, read, disposing) {
   const items = (await read("session.list")).items;
   if (!Array.isArray(items) || items.some((s) => s.running !== false)) throw new Error("\u8BF7\u7B49\u5F85\u8FD0\u884C\u4E2D\u7684\u4F1A\u8BDD\u7ED3\u675F\u540E\u518D\u66F4\u65B0\u3002");
@@ -1086,6 +1145,7 @@ async function quiesceNativeHost(ctx, read, disposing) {
 }
 async function createInstallControl(context, config) {
   const ctx = context.root;
+  assertNativeUpdateCapabilities(ctx);
   const home = adapterDshHome(), id = path5.basename(config.directory);
   if (!/^[a-f0-9]{32}$/.test(id) || !/^[a-f0-9]{48}$/.test(config.token) || path5.dirname(config.directory) !== path5.join(home, "harness-remote-updates") || fs2.realpathSync(config.directory) !== config.directory) throw new Error("\u5B89\u88C5\u63A7\u5236\u8BF7\u6C42\u4E0D\u5C5E\u4E8E\u5F53\u524D DSH\u3002");
   const scope = resolveAgentProfileScope("", process.argv, home), profile = path5.join(home, "profiles", scope);

package/package.json

@@ -1,15 +1,15 @@
-{
-  "name": "dsh-wechat-remote",
-  "version": "1.7.1",
-  "private": false,
-  "description": "Agent远程管理助手：DSH 微信连接插件的一键安装与升级",
-  "type": "module",
-  "license": "MIT",
-  "bin": { "dsh-wechat-remote": "bin/setup.mjs" },
-  "files": ["bin/*.mjs", "lib/*.js", "lib/package.json", "assets/plugin.tgz", "assets/release.json", "README.md", "LICENSE"],
-  "engines": { "node": ">=22.13.0" },
-  "dependencies": { "pnpm": "11.22.0", "yaml": "2.9.0" },
-  "bundleDependencies": ["pnpm", "yaml"],
-  "repository": { "type": "git", "url": "git+https://github.com/martinbear1/dsh-wechat-remote.git", "directory": "installer" },
-  "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org" }
-}
+{
+  "name": "dsh-wechat-remote",
+  "version": "1.7.2",
+  "private": false,
+  "description": "Agent远程管理助手：DSH 微信连接插件的一键安装与升级",
+  "type": "module",
+  "license": "MIT",
+  "bin": { "dsh-wechat-remote": "bin/setup.mjs" },
+  "files": ["bin/*.mjs", "lib/*.js", "lib/package.json", "assets/plugin.tgz", "assets/release.json", "README.md", "LICENSE"],
+  "engines": { "node": ">=22.13.0" },
+  "dependencies": { "pnpm": "11.22.0", "yaml": "2.9.0" },
+  "bundleDependencies": ["pnpm", "yaml"],
+  "repository": { "type": "git", "url": "git+https://github.com/martinbear1/dsh-wechat-remote.git", "directory": "installer" },
+  "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org" }
+}