pi-web-ui 0.50.0 → 0.51.0

package/README.md

@@ -84,7 +84,7 @@ theme switching, and a full settings panel — tuned for daily development.
 
 ### 🎛️ Models & settings
 
-- Theme switching — pick a theme in the top bar; each theme is a full standalone stylesheet (default dark + a bundled light). See [Themes](#themes) for how to add your own or contribute one.
+- Theme switching — pick a theme in the top bar; themes are pure `:root` palette overrides on top of the single layout stylesheet (default dark + bundled light/dark palettes). See [Themes](#themes) for how to add your own or contribute one.
 - Model management — edit `models.json` in the UI and set per-provider API keys (keys/headers never leave the server).
 - Thinking level per model (only the levels the model actually supports are shown).
 - First-run setup wizard.
@@ -303,7 +303,7 @@ pi-web-ui uninstall <id>      # remove a plugin
 
 ## Themes
 
-Each theme is a **complete standalone stylesheet** — a full copy of the bundled dark `web/src/styles.css` with a different palette (no CSS-variable extraction, no base file to include). Picking a theme swaps the whole file, so any theme works with every build.
+Each theme is a **pure `:root` palette override** — a small CSS file that only sets CSS variables (see the `:root` block in `web/src/styles.css` for the full variable list: base colors `--bg/--accent/--term-*` plus derived colors like `--tooltip-bg/--code-bg/--notice-*`). The layout lives ONLY in the bundled `web/src/styles.css`; picking a theme overrides the variables, so every theme works with every build and layout changes never touch themes. Built-in themes are generated by `node make-light-theme.mjs`.
 
 Built-in themes ship in the npm package (`themes/`, e.g. the bundled light theme). The theme picker lives in the top bar (🌞 icon); the current choice is stored per browser in `localStorage`.
 
@@ -325,10 +325,10 @@ Any CSS file dropped into your **data-dir themes folder** shows up in the theme
     └── my-theme.css          # appears in the menu as "my-theme"
 ```
 
-Easiest way to write one: copy `themes/light.css` (or the bundled dark `web/src/styles.css` from the source repo) and change the `:root` colors plus any hardcoded values — the file must be **self-contained**. Notes:
+Easiest way to write one: copy a built-in palette (e.g. `themes/white.css` from the source repo) and change the `:root` colors — list every variable you want to override; unlisted ones fall back to the dark defaults in `styles.css`. Notes:
 
-- The **terminal follows the theme** — set the `--term-*` variables (terminal ANSI palette + `--term-bg`) in your `:root` and both the xterm canvas and its padded container adapt automatically (see the defaults in `styles.css` and the light values in `themes/light.css`).
-- Syntax-highlight colors (`highlight.js`'s `github-dark.css` is bundled) must be overridden in your theme file or code will be unreadable — see the `.hljs` overrides at the bottom of `themes/light.css` for the pattern.
+- The **terminal follows the theme** — set the `--term-*` variables (terminal ANSI palette + `--term-bg`) in your `:root` and both the xterm canvas and its padded container adapt automatically (see the defaults in `styles.css`).
+- Syntax-highlight colors (`highlight.js`'s `github-dark.css` is bundled) must be overridden in your theme file or code will be unreadable on light themes — see the `.hljs` overrides at the bottom of `themes/white.css` for the pattern (dark themes can skip it).
 - Theme ids must match `^[A-Za-z0-9_-]+$` (no dots/slashes — path-traversal guard on the server).
 
 ### Contributing a theme to the repository (GitHub)
@@ -336,12 +336,12 @@ Easiest way to write one: copy `themes/light.css` (or the bundled dark `web/src/
 Want your theme shipped to everyone? Open a pull request at [github.com/xing-shuyin/pi-web-ui](https://github.com/xing-shuyin/pi-web-ui):
 
 1. Fork the repo and clone it.
-2. Create your theme as `themes/<id>.css` — a **self-contained** stylesheet. Copy `themes/light.css` as the starting template (it's the generator output for a full standalone theme).
+2. Create your theme as `themes/<id>.css` — a pure `:root` palette. Copy `themes/white.css` (or `themes/cyberpunk.css` for a dark palette) as the starting template.
 3. Verify locally: run `npm run dev`, then use the top bar theme picker — your theme must be listed and render correctly (chat cards, code blocks, tool-call cards, git/terminal panels).
-4. If you only changed colors in `styles.css` and want the bundled light theme updated too, regenerate it with `node make-light-theme.mjs`.
+4. Regenerate all built-in themes with `node make-light-theme.mjs` when you changed the variable list in `styles.css`.
 5. Commit (`git add themes/<id>.css`) and open the PR. The `themes/` folder is already in the npm package `files` whitelist, so once merged and released, `npm i -g pi-web-ui` will ship your theme to everyone.
 
-Rules for merged themes: the file must be a single self-contained CSS file, be a full standalone theme (no imports of the base `styles.css`), set the `--term-*` variables for a readable terminal, and override `.hljs` syntax colors for readable code.
+Rules for merged themes: the file must be a single CSS file, set the `--term-*` variables for a readable terminal, and override `.hljs` syntax colors for readable code on light themes.
 
 
 ## Security
@@ -436,7 +436,7 @@ pi-web-ui is a small open-source project — **your contributions are what make
 | Way to contribute | How to get started |
 | --- | --- |
 | 🧩 **Write a plugin** | Build your own UI tab + agent tools. Copy `dev/plugins/demo-mailbox` as the minimal template (it doubles as the test fixture), develop locally, then either open a PR to ship it in the [catalog](#plugin-catalog) or [publish it standalone](https://github.com/xing-shuyin/pi-web-ui/tree/main/dev/plugins). |
-| 🎨 **Contribute a theme** | Copy `themes/light.css` as a self-contained template, tweak the `:root` palette + `--term-*` + `.hljs`, verify with `npm run dev`, then open a PR — full walkthrough in [Contributing a theme](#contributing-a-theme-to-the-repository-github). |
+| 🎨 **Contribute a theme** | Copy `themes/white.css` (light) or `themes/cyberpunk.css` (dark) as a pure-palette template, tweak the `:root` palette + `--term-*` + `.hljs`, verify with `npm run dev`, then open a PR — full walkthrough in [Contributing a theme](#contributing-a-theme-to-the-repository-github). |
 | 💻 **Fix a bug / add a feature** | Look for [open issues](https://github.com/xing-shuyin/pi-web-ui/issues) or propose something new. Fork → branch → PR. Keep the code conventions in `AGENTS.md` (tabs, i18n keys in both languages, protocol changes in `server/protocol.ts`). |
 | 📖 **Docs & translations** | Improve the READMEs, write plugin docs, fix typos, or help translate the UI / docs into more languages. |
 | 💡 **Ideas & feedback** | Open an [issue](https://github.com/xing-shuyin/pi-web-ui/issues) or start a [discussion](https://github.com/xing-shuyin/pi-web-ui/discussions) — feature requests, bug reports, UI polish ideas, deployment experience reports. |

package/README.zh-CN.md

@@ -51,7 +51,7 @@
 **模型与设置**
 
 - 模型管理 —— UI 里编辑 models.json、按 provider 设置 API key（密钥/headers 永不下发浏览器）。
-- 主题切换 —— 顶栏选择主题；每个主题是完整独立的样式表（默认深色 + 内置亮色）。如何添加自定义主题或向仓库贡献主题，见 [主题](#主题)。
+- 主题切换 —— 顶栏选择主题；主题是纯 `:root` 调色板覆盖（布局唯一在 styles.css）。如何添加自定义主题或向仓库贡献主题，见 [主题](#主题)。
 - 思考强度（thinking level）按模型切换（只显示该模型实际支持的档位）。
 - 首次配置引导（PiSetupModal）。
 - 设置面板 —— 系统提示词（追加或整体替换）、技能/插件一键开关（即时生效）、设置预设保存/应用/删除、视觉桥模型与开关。
@@ -241,7 +241,7 @@ pi-web-ui uninstall <id>      # 卸载插件
 
 ## 主题
 
-每个主题是**一份完整独立的样式表** —— 即内置深色 `web/src/styles.css` 的整份副本，只是配色不同（不做 CSS 变量抽取、不需要引入基础文件）。切换主题就是整文件替换，因此任何主题都能在所有版本上工作。
+每个主题是**一份纯 `:root` 调色板覆盖** —— 只写 CSS 变量的声明文件（变量全集见 `web/src/styles.css` 的 `:root`：`--bg/--accent/--term-*` 基础色，加 `--tooltip-bg/--code-bg/--notice-*` 等派生色）。布局只存在于打包的 `web/src/styles.css` 里，选主题只是覆盖变量，因此任何主题都能在所有版本上工作，改布局也不需要碰主题文件。内置主题由 `node make-light-theme.mjs` 生成。
 
 内置主题随 npm 包分发（`themes/`，例如自带的亮色主题）。主题选择器在顶栏（🌞 图标），当前选择按浏览器存在 `localStorage`。
 
@@ -263,10 +263,10 @@ pi-web-ui uninstall <id>      # 卸载插件
     └── my-theme.css          # 菜单里显示为 "my-theme"
 ```
 
-最容易的写法：复制 `themes/light.css`（或源码仓库里内置的深色 `web/src/styles.css`），改 `:root` 颜色和必要的硬编码值即可 —— 文件必须**自包含**。注意：
+最容易的写法：复制一个内置调色板（如源码仓库里的 `themes/white.css`），改 `:root` 颜色即可 —— 想覆盖哪些变量就列哪些，没列的会落到 `styles.css` 的深色默认值。注意：
 
-- **终端跟随主题** —— 在你的 `:root` 里设置 `--term-*` 变量（终端 ANSI 配色 + `--term-bg`），xterm 画布和它的内边距容器都会自动适配（默认值见 `styles.css`，亮色值见 `themes/light.css`）。
-- 代码高亮色（打包自带 `highlight.js` 的 `github-dark.css`）必须在你的主题文件里覆盖，否则代码会看不清 —— 参照 `themes/light.css` 末尾的 `.hljs` 覆盖写法。
+- **终端跟随主题** —— 在你的 `:root` 里设置 `--term-*` 变量（终端 ANSI 配色 + `--term-bg`），xterm 画布和它的内边距容器都会自动适配（默认值见 `styles.css`）。
+- 代码高亮色（打包自带 `highlight.js` 的 `github-dark.css`）在浅色主题下必须覆盖，否则代码会看不清 —— 参照 `themes/white.css` 末尾的 `.hljs` 覆盖写法（深色主题可跳过）。
 - 主题 id 必须匹配 `^[A-Za-z0-9_-]+$`（不能有点和斜杠 —— 服务端有路径穿越防护）。
 
 ### 向仓库贡献主题（GitHub）
@@ -274,12 +274,12 @@ pi-web-ui uninstall <id>      # 卸载插件
 想让你的主题随包分发给所有人？在 [github.com/xing-shuyin/pi-web-ui](https://github.com/xing-shuyin/pi-web-ui) 开一个 Pull Request：
 
 1. Fork 并 clone 仓库。
-2. 创建 `themes/<id>.css` —— 一份**自包含**的样式表。以 `themes/light.css` 为模板（它是生成器产出的完整独立主题）。
+2. 创建 `themes/<id>.css` —— 一份纯 `:root` 调色板。以 `themes/white.css`（浅色）或 `themes/cyberpunk.css`（深色）为模板。
 3. 本地验证：运行 `npm run dev`，用顶栏主题选择器确认你的主题能被列出、渲染正确（对话卡片、代码块、工具调用卡片、Git/终端面板）。
-4. 如果你只改了 `styles.css` 里的颜色、想让内置亮色主题同步更新，用 `node make-light-theme.mjs` 重新生成。
+4. 如果你改了 `styles.css` 的变量清单，用 `node make-light-theme.mjs` 重新生成全部内置主题。
 5. 提交（`git add themes/<id>.css`）并开 PR。`themes/` 已在 npm 包 `files` 白名单里，合并发布后 `npm i -g pi-web-ui` 即可把你的主题带给所有人。
 
-合并主题的规则：必须是单一自包含 CSS 文件、是完整独立主题（不得 import 基础 `styles.css`）、保持 xterm 区域深色、覆盖 `.hljs` 语法高亮色以保证代码可读。
+合并主题的规则：必须是单一 CSS 文件、设置 `--term-*` 变量保证终端可读、浅色主题覆盖 `.hljs` 语法高亮色以保证代码可读。
 
 ## 安全
 
@@ -361,7 +361,7 @@ pi-web-ui 是一个小型开源项目 —— **你的贡献就是它成长的力
 | 贡献方式 | 如何开始 |
 | --- | --- |
 | 🧩 **写插件** | 打造你自己的界面 tab + AI 工具。以 `dev/plugins/demo-mailbox` 为最小模板（它兼作测试夹具），本地开发后既可开 PR 收录进[插件目录](#插件目录)，也可独立发布。 |
-| 🎨 **贡献主题** | 以 `themes/light.css` 为自包含模板，调整 `:root` 配色 + `--term-*` + `.hljs`，用 `npm run dev` 验证后开 PR —— 完整步骤见[向仓库贡献主题](#向仓库贡献主题github)。 |
+| 🎨 **贡献主题** | 以 `themes/white.css`（浅色）或 `themes/cyberpunk.css`（深色）为纯调色板模板，调整 `:root` 配色 + `--term-*` + `.hljs`，用 `npm run dev` 验证后开 PR —— 完整步骤见[向仓库贡献主题](#向仓库贡献主题github)。 |
 | 💻 **修 bug / 加功能** | 在 [Issues](https://github.com/xing-shuyin/pi-web-ui/issues) 里挑一个，或提出新想法。Fork → 分支 → PR。代码约定见 `AGENTS.md`（Tab 缩进、i18n 双语 key、协议改动只动 `server/protocol.ts`）。 |
 | 📖 **文档与翻译** | 完善 README、补插件文档、改错别字，或帮忙把界面/文档翻译成更多语言。 |
 | 💡 **想法与反馈** | 在 [Issues](https://github.com/xing-shuyin/pi-web-ui/issues) 或 [Discussions](https://github.com/xing-shuyin/pi-web-ui/discussions) 里开帖 —— 功能建议、bug 报告、界面优化点子、部署经验分享都欢迎。 |

package/dist/server/agent-service.js

@@ -17,6 +17,7 @@ import { fileURLToPath } from "node:url";
 import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createBashTool, createLocalBashOperations, defineTool, getAgentDir, ModelRuntime, SessionManager, VERSION, } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { BgServerTracker } from "./bg-servers.js";
+import { checkAll as checkAllUpdates, collectTargets, compareVersions as compareSemver, } from "./update-check.js";
 import { hasPendingWaitSubscription, shouldRetainActive } from "./wait-subscription-scan.js";
 import { syncPluginToolsIntoSession } from "./plugins.js";
 import { SettingsService } from "./settings-service.js";
@@ -1475,15 +1476,7 @@ export class ClientSession {
     }
     /** Simple numeric semver compare: >0 means a newer than b. */
     static compareVersions(a, b) {
-        const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
-        const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
-        for (let i = 0; i < 3; i++) {
-            const x = pa[i] ?? 0;
-            const y = pb[i] ?? 0;
-            if (x !== y)
-                return x - y;
-        }
-        return 0;
+        return compareSemver(a, b);
     }
     /** Set by index.ts: called when /pi-web-ui:quit is invoked. */
     onQuit = undefined;
@@ -1526,6 +1519,48 @@ export class ClientSession {
             });
         }
     }
+    /** Cache window for the all-source check: 30 minutes. */
+    static UPDATE_ALL_CACHE_MS = 30 * 60_000;
+    updatesAllCache = null;
+    /**
+     * All-source update check: pi-web-ui + the pi core + direct pi extensions
+     * from the agent manifest (fallback: raw walk). Re-emits the cached list
+     * within UPDATE_ALL_CACHE_MS; pass force=true (explicit refresh) to bypass.
+     */
+    async checkUpdatesAll(force = false) {
+        if (!force &&
+            this.updatesAllCache &&
+            Date.now() - this.updatesAllCache.at <
+                ClientSession.UPDATE_ALL_CACHE_MS) {
+            this.emit({
+                type: "update_status_all",
+                items: this.updatesAllCache.items,
+            });
+            return;
+        }
+        try {
+            const targets = collectTargets(this.agentDir, ClientSession.currentAppVersion());
+            const items = await checkAllUpdates(targets);
+            this.updatesAllCache = { at: Date.now(), items };
+            this.emit({ type: "update_status_all", items });
+        }
+        catch (err) {
+            // checkAll degrades per-item; only local enumeration blowing up lands
+            // here — still report a usable (webui-only) error item.
+            const items = [
+                {
+                    name: "pi-web-ui",
+                    kind: "webui",
+                    current: ClientSession.currentAppVersion(),
+                    latest: null,
+                    latestPublishedAt: null,
+                    upToDate: false,
+                    error: `检查更新失败：${err.message}`,
+                },
+            ];
+            this.emit({ type: "update_status_all", items });
+        }
+    }
     async installPiAgent() {
         try {
             mkdirSync(this.agentDir, { recursive: true });

package/dist/server/index.js

@@ -625,6 +625,9 @@ wss.on("connection", (ws) => {
             case "check_update":
                 void cs.checkUpdate();
                 break;
+            case "check_updates_all":
+                void cs.checkUpdatesAll(msg.force === true);
+                break;
             case "dialog_response":
                 cs.resolveDialog(msg.id, msg.value);
                 break;

package/dist/server/themes.js

@@ -1,7 +1,10 @@
 /**
- * Theme management: complete standalone CSS files that replace the whole UI
- * stylesheet. Each theme is a full copy of web/src/styles.css with a different
- * palette — no variable extraction, the browser just swaps the entire file.
+ * Theme management: pure `:root` palette overrides. The whole UI layout lives
+ * in web/src/styles.css (single source); a theme is just a small CSS file that
+ * overrides the :root CSS variables (--bg/--accent/--term-* plus derived ones
+ * like --tooltip-bg/--code-bg). The frontend injects the theme file as a
+ * <link> AFTER the bundled styles.css, so its :root variables win the cascade.
+ * Builtin themes are generated by node make-light-theme.mjs.
  *
  * Theme sources (merged, user wins over builtin on id collision):
  *   - builtin: <pkgRoot>/themes/*.css   (ships with the npm package)

package/dist/server/update-check.js

@@ -0,0 +1,274 @@
+/**
+ * All-source update check: pi-web-ui itself, the installed pi core
+ * (@earendil-works/pi-coding-agent — probed via `pi --version`, with a
+ * vendored-copy fallback), plus the DIRECT pi extensions declared in
+ * <agentDir>/npm/package.json (fallback: raw node_modules walk).
+ * Pure logic lives here so it can be unit-tested with an injected fetcher
+ * (and an injected pi-core probe); ClientSession only wires it to the wire
+ * protocol.
+ */
+import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+const PI_CORE_PACKAGE = "@earendil-works/pi-coding-agent";
+const REGISTRY = "https://registry.npmjs.org";
+const FETCH_TIMEOUT_MS = 8_000;
+/** Parallel registry lookups per batch. */
+const CONCURRENCY = 5;
+/** Simple numeric semver compare: >0 means a newer than b. */
+export function compareVersions(a, b) {
+    const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+    const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+    for (let i = 0; i < 3; i++) {
+        const x = pa[i] ?? 0;
+        const y = pb[i] ?? 0;
+        if (x !== y)
+            return x - y;
+    }
+    return 0;
+}
+/**
+ * Cache a zero-arg function's value for ttlMs. Plain value memoization: the
+ * pi probe returns null on failure instead of throwing, so errors thread
+ * through as ordinary values and there is nothing to rethrow.
+ */
+export function memoizeWithTtl(fn, ttlMs) {
+    let entry = null;
+    return () => {
+        const now = Date.now();
+        if (!entry || now - entry.at >= ttlMs) {
+            entry = { at: now, value: fn() };
+        }
+        return entry.value;
+    };
+}
+/**
+ * Parse `pi --version` stdout into a version string, or null. Two-stage:
+ * prefer a line that is exactly the version (optional leading "v", optional
+ * prerelease/build suffix) so a stdout preamble like "Update available:
+ * 0.85.0" cannot forge it; otherwise fall back to the first loose
+ * semver-looking token. The exact-line match keeps the FULL version incl.
+ * prerelease (0.85.0-beta.1 stays 0.85.0-beta.1).
+ */
+export function parsePiVersionOutput(stdout) {
+    const exact = stdout.match(/^\s*v?(\d+\.\d+\.\d+(?:[-+][\w.]+)*)\s*$/m)?.[1];
+    if (exact)
+        return exact;
+    return stdout.match(/\d+\.\d+\.\d+/)?.[0] ?? null;
+}
+/**
+ * Enumerate installed pi packages for the "check all updates" list, matching
+ * what the TUI shows: the DIRECT dependencies declared in
+ * <agentDir>/npm/package.json, with each installed version resolved from
+ * node_modules/<name>/package.json (not the manifest range). Transitive deps
+ * are not listed.
+ *
+ * Fallback: when the manifest is missing/unreadable or declares no
+ * dependencies, fall back to the historical raw node_modules walk.
+ */
+export function listInstalledPackages(agentDir) {
+    const direct = readManifestDeps(agentDir);
+    if (direct)
+        return direct;
+    return walkNodeModules(agentDir);
+}
+/** Direct deps from the npm manifest with installed versions, or null. */
+function readManifestDeps(agentDir) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(agentDir, "npm", "package.json"), "utf8"));
+        // Literal `null` parses fine but explodes on property access — treat as
+        // unreadable (fallback to the raw walk), per the documented contract.
+        if (!manifest || typeof manifest !== "object")
+            return null;
+    }
+    catch {
+        return null;
+    }
+    const deps = manifest.dependencies;
+    if (!deps || typeof deps !== "object" || Object.keys(deps).length === 0) {
+        return null;
+    }
+    const root = join(agentDir, "npm", "node_modules");
+    const out = [];
+    for (const name of Object.keys(deps)) {
+        const item = readLocalPackage(join(root, ...name.split("/")));
+        // Broken/uninstalled entries are skipped (the registry never sees them).
+        if (item)
+            out.push(item);
+    }
+    // Deterministic order (manifest key order is arbitrary).
+    return out.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+/**
+ * Legacy fallback: raw walk of <agentDir>/npm/node_modules — top-level plain
+ * names plus one level inside @scope dirs. Skips .bin, dotfiles and anything
+ * without a readable package.json.
+ */
+function walkNodeModules(agentDir) {
+    const root = join(agentDir, "npm", "node_modules");
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(root);
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        if (entry.startsWith(".") || entry === ".bin")
+            continue;
+        if (entry.startsWith("@")) {
+            let scoped;
+            try {
+                scoped = readdirSync(join(root, entry));
+            }
+            catch {
+                continue;
+            }
+            for (const name of scoped) {
+                if (name.startsWith("."))
+                    continue;
+                const item = readLocalPackage(join(root, entry, name));
+                if (item)
+                    out.push(item);
+            }
+        }
+        else {
+            const item = readLocalPackage(join(root, entry));
+            if (item)
+                out.push(item);
+        }
+    }
+    // Deterministic order (readdir order is FS-dependent).
+    return out.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+function readLocalPackage(dir) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+        if (!pkg.name || !pkg.version)
+            return null;
+        return { name: pkg.name, version: pkg.version, kind: "package" };
+    }
+    catch {
+        return null;
+    }
+}
+/** Uncached pi core probe (memoized machine-wide below). */
+function rawProbePiCore() {
+    try {
+        const res = spawnSync("pi", ["--version"], {
+            timeout: 5000,
+            stdio: "pipe",
+            shell: process.platform === "win32",
+        });
+        if (res.error || res.status !== 0)
+            return null;
+        return parsePiVersionOutput(res.stdout?.toString() ?? "");
+    }
+    catch {
+        return null;
+    }
+}
+/** How long a pi probe result stays hot (mirrors ClientSession.piCliProbe). */
+const PI_PROBE_TTL_MS = 10_000;
+/**
+ * Default pi core probe: run the globally installed `pi --version`, memoized
+ * machine-wide for PI_PROBE_TTL_MS so repeated collectTargets calls never
+ * re-block the event loop on a 5s spawnSync. Null on any failure or absence.
+ * Mirrors ClientSession.isPiCliInstalled() (same spawnSync shape; Windows
+ * resolves `pi` to a pi.cmd shim that only execs through a shell).
+ */
+export const defaultProbePiCore = memoizeWithTtl(rawProbePiCore, PI_PROBE_TTL_MS);
+/**
+ * Fallback when the CLI probe yields nothing: the version of the vendored pi
+ * core copy in <agentDir>/npm/node_modules, or null if that is absent too.
+ */
+function readVendoredPiCore(agentDir) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(agentDir, "npm", "node_modules", ...PI_CORE_PACKAGE.split("/"), "package.json"), "utf8"));
+        if (pkg.name !== PI_CORE_PACKAGE || !pkg.version)
+            return null;
+        return pkg.version;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the full local target list: webui + the pi core + installed packages.
+ * The pi core version comes from the CLI probe (injectable for tests), falling
+ * back to the vendored copy under <agentDir>/npm/node_modules. Packages
+ * listing the core directly are filtered out so the pi-core row wins — never
+ * two rows for the same package.
+ */
+export function collectTargets(agentDir, webuiVersion, probePiCore = defaultProbePiCore) {
+    const targets = [
+        { name: "pi-web-ui", version: webuiVersion, kind: "webui" },
+    ];
+    const coreVersion = probePiCore() ?? readVendoredPiCore(agentDir);
+    if (coreVersion) {
+        targets.push({
+            name: PI_CORE_PACKAGE,
+            version: coreVersion,
+            kind: "pi-core",
+        });
+    }
+    targets.push(...listInstalledPackages(agentDir).filter((pkg) => pkg.name !== PI_CORE_PACKAGE));
+    return targets;
+}
+/** Default fetcher (real network). Tests inject a fake. */
+export const defaultFetcher = (url, init) => fetch(url, init);
+/** Look up one package's latest version + publish time in the npm registry. */
+export async function fetchLatest(fetcher, name) {
+    const res = await fetcher(`${REGISTRY}/${encodeURIComponent(name)}`, {
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    const data = (await res.json());
+    const latest = data["dist-tags"]?.latest ?? null;
+    return {
+        latest,
+        latestPublishedAt: latest && data.time ? (data.time[latest] ?? null) : null,
+    };
+}
+/**
+ * Check every target against the registry. One failed lookup degrades to an
+ * error item (upToDate: false) without failing the rest. Results keep the
+ * input order. Bounded concurrency (CONCURRENCY) keeps registry load polite.
+ */
+export async function checkAll(targets, fetcher = defaultFetcher) {
+    const results = new Array(targets.length);
+    let cursor = 0;
+    async function worker() {
+        while (cursor < targets.length) {
+            const i = cursor++;
+            const t = targets[i];
+            try {
+                const { latest, latestPublishedAt } = await fetchLatest(fetcher, t.name);
+                results[i] = {
+                    name: t.name,
+                    kind: t.kind,
+                    current: t.version,
+                    latest,
+                    latestPublishedAt,
+                    upToDate: latest === null || compareVersions(t.version, latest) >= 0,
+                };
+            }
+            catch (err) {
+                results[i] = {
+                    name: t.name,
+                    kind: t.kind,
+                    current: t.version,
+                    latest: null,
+                    latestPublishedAt: null,
+                    upToDate: false,
+                    error: `检查更新失败：${err.message}`,
+                };
+            }
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(CONCURRENCY, targets.length) }, worker));
+    return results;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-web-ui",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Web chat interface for the pi coding agent, powered by the pi SDK (@earendil-works/pi-coding-agent) — one-command run, Docker/systemd/launchd deployable",
   "license": "MIT",
   "author": {