zen-gitsync 2.16.41 → 2.16.43

package/src/ui/server/routes/fileOpen.js

@@ -15,6 +15,7 @@
 import fs from 'fs/promises';
 import { asyncRoute, HttpError } from '../utils/asyncRoute.js';
 import path from 'path';
+import os from 'os';
 import open from 'open';
 import { spawn, spawnSync } from 'child_process';
 
@@ -44,6 +45,61 @@ function commandExists(command, platform = process.platform) {
   return result.status === 0;
 }
 
+/**
+ * 从 `--version` 的输出里提取 semver 版本号。
+ * 各工具输出格式五花八门:
+ *   dsh     → "0.1.1-rc.2"
+ *   claude  → "1.0.60 (Claude Code)"
+ *   code    → "1.92.0 abc123def (commit ...)"
+ *   opencode → "opencode 0.1.30"
+ * 策略:取第一个 semver 模式(含 prerelease 0.1.1-rc.2 / build 1.0.0+build.1)。
+ * 提不出来返回 null(调用方按"未知版本"处理,不影响安装判定)。
+ */
+export function parseVersionOutput(text) {
+  if (!text) return null;
+  const match = String(text).match(/\d+\.\d+\.\d+(?:[-+][\w.-]+)?/);
+  return match ? match[0] : null;
+}
+
+// ── npm registry 最新版本查询(右键更新菜单的「当前 → 最新」提示用)──────────
+// 为什么走 HTTP 而不是 `npm view <pkg> version`:spawnSync('npm.cmd', ...) 在
+// server 子进程里不稳(prefix -g 曾返回 "…npm:3" 废地址,见 findDshExecutable
+// 的修复记录),HTTP 直查又快又可控。
+// registry 优先级:~/.npmrc 的 registry 字段(用户可能配了镜像)→ npmmirror 默认。
+
+let cachedRegistryBase = null;
+
+export function getRegistryBase(readFile = fs.readFile) {
+  if (cachedRegistryBase) return cachedRegistryBase;
+  return readFile(path.join(os.homedir(), '.npmrc'), 'utf8').then((npmrc) => {
+    const match = String(npmrc).match(/^\s*registry\s*=\s*(\S+)/m);
+    cachedRegistryBase = match
+      ? match[1].replace(/\/+$/, '')
+      : 'https://registry.npmmirror.com';
+    return cachedRegistryBase;
+  }).catch(() => (cachedRegistryBase = 'https://registry.npmmirror.com'));
+}
+
+export async function fetchLatestVersion(packageName, { timeoutMs = 8000, fetchImpl = fetch } = {}) {
+  if (!packageName || !/^[\w@/.-]+$/.test(packageName)) return null;
+  const base = await getRegistryBase();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const resp = await fetchImpl(`${base}/${packageName}/latest`, {
+      signal: controller.signal,
+      headers: { accept: 'application/json' },
+    });
+    if (!resp.ok) return null;
+    const data = await resp.json();
+    return typeof data?.version === 'string' ? data.version : null;
+  } catch {
+    return null; // 网络失败/超时:菜单显示原文案,不影响任何功能
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * 返回当前平台可展示、可执行的安装方案。
  * executable/args 只在服务端使用；前端只能提交固定 tool id，不能提交命令。
@@ -64,6 +120,12 @@ export function getToolInstallers(platform = process.platform, hasCommand = comm
         : '未检测到 npm，请先安装 Node.js/npm，或按照官方文档手动安装。',
       executable: npmExecutable,
       args: ['install', '-g', packageName],
+      // 升级变体:@latest 强制同步到最新版。已是最新时 npm 自然跳过。
+      updateCommand: `npm install -g ${packageName}@latest`,
+      updatePackageManager: 'npm',
+      updateNote: '将在新终端中执行 `npm install -g <pkg>@latest`。已是最新时 npm 会跳过。',
+      updateExecutable: npmExecutable,
+      updateArgs: ['install', '-g', `${packageName}@latest`],
     };
   }
 
@@ -79,6 +141,18 @@ export function getToolInstallers(platform = process.platform, hasCommand = comm
         : '未检测到 winget，请使用 VS Code 官方安装程序。',
       executable: 'winget',
       args: ['install', '--id', 'Microsoft.VisualStudioCode', '-e', '--accept-package-agreements', '--accept-source-agreements'],
+      // winget 的升级动词是 upgrade(不是 install)
+      updateCommand: wingetAvailable
+        ? 'winget upgrade --id Microsoft.VisualStudioCode -e --accept-package-agreements --accept-source-agreements'
+        : undefined,
+      updatePackageManager: 'winget',
+      updateNote: wingetAvailable
+        ? '将在新终端中通过 winget upgrade 升级 VS Code。'
+        : '未检测到 winget，请使用 VS Code 官方安装包。',
+      updateExecutable: wingetAvailable ? 'winget' : undefined,
+      updateArgs: wingetAvailable
+        ? ['upgrade', '--id', 'Microsoft.VisualStudioCode', '-e', '--accept-package-agreements', '--accept-source-agreements']
+        : undefined,
     };
   } else if (platform === 'darwin') {
     const brewAvailable = hasCommand('brew', platform);
@@ -92,6 +166,11 @@ export function getToolInstallers(platform = process.platform, hasCommand = comm
         : '未检测到 Homebrew，请使用 VS Code 官方安装程序。',
       executable: 'brew',
       args: ['install', '--cask', 'visual-studio-code'],
+      updateCommand: brewAvailable ? 'brew upgrade --cask visual-studio-code' : undefined,
+      updatePackageManager: 'Homebrew',
+      updateNote: brewAvailable ? '将在新终端中通过 brew upgrade 升级 VS Code。' : '未检测到 brew。',
+      updateExecutable: brewAvailable ? 'brew' : undefined,
+      updateArgs: brewAvailable ? ['upgrade', '--cask', 'visual-studio-code'] : undefined,
     };
   } else {
     const snapAvailable = hasCommand('snap', platform);
@@ -105,6 +184,12 @@ export function getToolInstallers(platform = process.platform, hasCommand = comm
         : '当前 Linux 环境未检测到 snap，请按照发行版对应的官方说明安装。',
       executable: 'sudo',
       args: ['snap', 'install', 'code', '--classic'],
+      // snap 的升级动词是 refresh
+      updateCommand: snapAvailable ? 'sudo snap refresh code' : undefined,
+      updatePackageManager: 'snap',
+      updateNote: snapAvailable ? '将在新终端中通过 snap refresh 升级 VS Code。' : '未检测到 snap。',
+      updateExecutable: snapAvailable ? 'sudo' : undefined,
+      updateArgs: snapAvailable ? ['snap', 'refresh', 'code'] : undefined,
     };
   }
 
@@ -130,6 +215,26 @@ export function getToolInstallers(platform = process.platform, hasCommand = comm
           'Invoke-RestMethod https://code.kimi.com/kimi-code/install.ps1 | Invoke-Expression',
         ].join('; ')
       : undefined,
+    // 升级:kimi 官方脚本幂等,已安装时执行会自动升级到最新版,直接复用同一脚本
+    updateCommand: platform === 'win32'
+      ? 'irm https://code.kimi.com/kimi-code/install.ps1 | iex'
+      : 'curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash',
+    updatePackageManager: 'Kimi Code 官方安装脚本',
+    updateNote: '官方安装脚本幂等，已安装时执行会自动升级到最新版本。',
+    updateKind: 'script',
+    updateExecutionCommand: platform === 'win32'
+      ? [
+          "if (-not (Get-Command Get-FileHash -ErrorAction SilentlyContinue)) {",
+          "function global:Get-FileHash { param([string]$Path, [string]$Algorithm = 'SHA256')",
+          "$stream = [System.IO.File]::OpenRead($Path)",
+          "try { $sha = [System.Security.Cryptography.SHA256]::Create(); try { $bytes = $sha.ComputeHash($stream) } finally { $sha.Dispose() } } finally { $stream.Dispose() }",
+          "$hash = ([System.BitConverter]::ToString($bytes)).Replace('-', '')",
+          "New-Object PSObject -Property @{ Algorithm = 'SHA256'; Hash = $hash; Path = $Path }",
+          "}",
+          "}",
+          'Invoke-RestMethod https://code.kimi.com/kimi-code/install.ps1 | Invoke-Expression',
+        ].join('; ')
+      : undefined,
   };
   installers.zcode = {
     supported: false,
@@ -137,6 +242,10 @@ export function getToolInstallers(platform = process.platform, hasCommand = comm
     packageManager: 'ZCode 官方安装包',
     docsUrl: TOOL_DOCS_URLS.zcode,
     note: 'ZCode 是桌面应用，官方提供 Windows、macOS 和 Linux 安装包，没有官方 npm CLI。',
+    // ZCode 是桌面应用、没有 CLI 更新通道;/api/update-tool 会对它返回 400
+    updateCommand: undefined,
+    updatePackageManager: 'ZCode 官方安装包',
+    updateNote: 'ZCode 是桌面应用，升级请到官网下载新版安装包覆盖安装。',
   };
   return installers;
 }
@@ -283,17 +392,34 @@ async function launchDsh(dirPath) {
   return launchInTerminal(dirPath, executable, ['web']);
 }
 
-async function findDshExecutable() {
+// 在 Windows 上找 dsh 可执行文件。
+// 优先用 where.exe dsh(覆盖 nvm4w 的 C:\nvm4w\nodejs\、默认的 %APPDATA%\npm、
+// pnpm/yarn 自定义 prefix、以及用户手摆到 PATH 里的任意位置),
+//再兜底 APPDATA\npm + npm prefix -g 两个写死路径(为 where.exe 漏检的边缘情况,
+//比如 PATH 里只有 junction/symlink 时)。
+export async function findDshExecutable() {
   if (process.platform !== 'win32') return commandExists('dsh') ? 'dsh' : null;
 
-  const candidates = [path.join(process.env.APPDATA || '', 'npm', 'dsh.cmd')];
+  const where = spawnSync('where.exe', ['dsh'], { encoding: 'utf8', windowsHide: true });
+  if (where.status === 0 && where.stdout) {
+    for (const line of where.stdout.split(/\r?\n/).map((s) => s.trim()).filter(Boolean)) {
+      // 偶尔会输出 "PATH=..." 这种变量行,跳过
+      if (/^[A-Z_]+=/i.test(line)) continue;
+      try {
+        const stat = await fs.stat(line);
+        if (stat.isFile()) return line;
+      } catch {}
+    }
+  }
+
+  const fallback = [path.join(process.env.APPDATA || '', 'npm', 'dsh.cmd')];
   const npmPrefix = spawnSync('npm.cmd', ['prefix', '-g'], {
     encoding: 'utf8',
     windowsHide: true,
   }).stdout?.trim();
-  if (npmPrefix) candidates.push(path.join(npmPrefix, 'dsh.cmd'));
+  if (npmPrefix) fallback.push(path.join(npmPrefix, 'dsh.cmd'));
 
-  for (const candidate of candidates.filter(Boolean)) {
+  for (const candidate of fallback.filter(Boolean)) {
     try {
       const stat = await fs.stat(candidate);
       if (stat.isFile()) return candidate;
@@ -390,27 +516,35 @@ async function findZCodeExecutable() {
   return null;
 }
 
-async function launchToolInstaller(installer, dirPath = process.cwd()) {
-  if (installer.kind === 'script') {
+async function launchToolInstaller(installer, dirPath = process.cwd(), { update = false } = {}) {
+  // update=true 时改用 updateXxx 字段(升级命令与安装命令动词不同:
+  // npm @latest / winget upgrade / brew upgrade / snap refresh / kimi 脚本幂等重跑)
+  const kindField = update ? 'updateKind' : 'kind';
+  const execCmdField = update ? 'updateExecutionCommand' : 'executionCommand';
+  const cmdField = update ? 'updateCommand' : 'command';
+  const executableField = update ? 'updateExecutable' : 'executable';
+  const argsField = update ? 'updateArgs' : 'args';
+
+  if (installer[kindField] === 'script') {
     if (process.platform === 'win32') {
       // 显式创建新控制台；编码脚本可避免 cmd.exe 截获 PowerShell 管道符。
-      const encoded = Buffer.from(installer.executionCommand || installer.command, 'utf16le').toString('base64');
+      const encoded = Buffer.from(installer[execCmdField] || installer[cmdField], 'utf16le').toString('base64');
       return spawnDetached('cmd.exe', [
         '/c', 'start', '""', 'powershell.exe', '-NoLogo', '-NoExit',
         '-ExecutionPolicy', 'Bypass', '-EncodedCommand', encoded,
       ], { cwd: dirPath });
     }
-    return launchInTerminal(dirPath, 'bash', ['-lc', installer.command]);
+    return launchInTerminal(dirPath, 'bash', ['-lc', installer[cmdField]]);
   }
   if (process.platform === 'win32') {
-    // 安装命令完全来自服务端白名单。使用可见 cmd 窗口，让用户看到进度和错误。
-    const commandLine = [installer.executable, ...installer.args].join(' ');
+    // 安装/更新命令完全来自服务端白名单。使用可见 cmd 窗口，让用户看到进度和错误。
+    const commandLine = [installer[executableField], ...installer[argsField]].join(' ');
     return spawnDetached('cmd.exe', ['/c', 'start', '', 'cmd.exe', '/k', commandLine], {
       cwd: dirPath,
     });
   }
 
-  return launchInTerminal(dirPath, installer.executable, installer.args);
+  return launchInTerminal(dirPath, installer[executableField], installer[argsField]);
 }
 
 export function registerFileOpenRoutes({
@@ -752,30 +886,113 @@ export function registerFileOpenRoutes({
       });
     }));
 
-  // 检测本地工具是否已安装(供前端根据结果决定是否显示对应按钮)
-  // 检测方式: spawn 'tool --version',exit 0 即视为已安装
+  // 更新本地工具:与 install-tool 同一套白名单,只是换用 updateXxx 命令变体
+  // (npm @latest / winget upgrade / brew upgrade / snap refresh / kimi 脚本重跑)。
+  // 没有 updateCommand 的工具(如 zcode 桌面应用)返回 400。
+  app.post('/api/update-tool', asyncRoute(async (req, res) => {
+      const { tool } = req.body || {};
+      const installers = getToolInstallers();
+      const installer = installers[tool];
+
+      if (!installer) {
+        throw new HttpError(400, '不支持的工具');
+      }
+      if (!installer.updateCommand) {
+        throw new HttpError(400, installer.updateNote || '当前工具不支持一键更新，请按官方文档手动升级');
+      }
+
+      await launchToolInstaller(installer, process.cwd(), { update: true });
+      res.json({
+        success: true,
+        message: '更新命令已在新终端中启动',
+      });
+    }));
+
+  // 查询 npm registry 上的最新版本,供前端更新菜单显示「当前 v1 → 最新 v2」。
+  // 只支持 TOOL_INSTALL_PACKAGES 里的 npm 工具;网络失败的工具返回 null(前端降级为原文案)。
+  // body 可选 { tools: ['claude', ...] } —— 缺省查全部 npm 工具。
+  app.post('/api/latest-tool-versions', asyncRoute(async (req, res) => {
+      const { tools } = req.body || {};
+      let requested;
+      if (tools === undefined) {
+        requested = Object.keys(TOOL_INSTALL_PACKAGES);
+      } else {
+        if (!Array.isArray(tools) || tools.some((t) => typeof t !== 'string')) {
+          throw new HttpError(400, 'tools 必须是字符串数组');
+        }
+        const unknown = tools.filter((t) => !TOOL_INSTALL_PACKAGES[t]);
+        if (unknown.length) {
+          throw new HttpError(400, `不支持的工具: ${unknown.join(', ')}`);
+        }
+        requested = tools;
+      }
+
+      const entries = await Promise.all(
+        requested.map(async (tool) => [tool, await fetchLatestVersion(TOOL_INSTALL_PACKAGES[tool])]),
+      );
+      res.json({
+        success: true,
+        latest: Object.fromEntries(entries),
+      });
+    }));
+
+  // 检测本地工具是否已安装 + 采集版本号(供前端决定按钮行为、tooltip 显示版本)
+  // 检测方式: spawn 'tool --version',exit 0 即视为已安装;stdout/stderr 里提取 semver。
   // 超时 15s:Claude CLI / opencode 等 Node 包装的工具首次冷启动
   // 在 Windows 上经常 5-7s(磁盘 cache + Defender 扫描),3s 永远命中超时。
   app.get('/api/check-tools', asyncRoute(async (req, res) => {
       const checkCmd = (cmd) => new Promise((resolve) => {
         const child = spawn(cmd, ['--version'], {
-          stdio: 'ignore',
+          // 要捕获输出来解析版本号,不能再用 'ignore'
+          stdio: ['ignore', 'pipe', 'pipe'],
           shell: process.platform === 'win32',
           windowsHide: true,
         });
+        let output = '';
         let done = false;
         const finish = (ok) => {
           if (done) return;
           done = true;
           try { child.kill('SIGKILL'); } catch {}
-          resolve(ok);
+          resolve({ installed: ok, version: parseVersionOutput(output) });
         };
+        // 有些 CLI 把版本号打到 stderr(如部分 Node 包装工具),两边都收
+        child.stdout.on('data', (chunk) => { output += chunk; });
+        child.stderr.on('data', (chunk) => { output += chunk; });
         child.on('error', () => finish(false));
         child.on('exit', (code) => finish(code === 0));
         setTimeout(() => finish(false), 15000);
       });
 
-      const [vscode, claude, codex, opencode, kimiExecutable, zcodeExecutable, dshExecutable] = await Promise.all([
+      // dsh / kimi 走 find*Executable 拿到完整路径,再补一次 --version 采版本。
+      // zcode 是纯 GUI 桌面应用,ZCode.exe --version 行为未知(可能弹窗),不采集。
+      const versionOfExecutable = (executable) => {
+        if (!executable) return Promise.resolve(null);
+        return new Promise((resolve) => {
+          const child = spawn(executable, ['--version'], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            shell: process.platform === 'win32',
+            windowsHide: true,
+          });
+          let output = '';
+          let done = false;
+          const finish = () => {
+            if (done) return;
+            done = true;
+            try { child.kill('SIGKILL'); } catch {}
+            resolve(parseVersionOutput(output));
+          };
+          child.stdout.on('data', (chunk) => { output += chunk; });
+          child.stderr.on('data', (chunk) => { output += chunk; });
+          child.on('error', () => finish());
+          child.on('exit', () => finish());
+          setTimeout(() => finish(), 15000);
+        });
+      };
+
+      // dsh / kimi 的版本采集依赖 find 结果,用 then 链接保持全并行
+      // (find 会跑两次——一次拿路径一次链版本——都是纯 fs/注册表查询,开销可忽略)
+      const [vscodeRes, claudeRes, codexRes, opencodeRes, kimiExecutable, zcodeExecutable, dshExecutable, kimiVersion, dshVersion] = await Promise.all([
         checkCmd('code'),
         checkCmd('claude'),
         checkCmd('codex'),
@@ -783,6 +1000,8 @@ export function registerFileOpenRoutes({
         findKimiExecutable(),
         findZCodeExecutable(),
         findDshExecutable(),
+        findKimiExecutable().then(versionOfExecutable),
+        findDshExecutable().then(versionOfExecutable),
       ]);
 
       const installers = getToolInstallers();
@@ -790,13 +1009,22 @@ export function registerFileOpenRoutes({
         success: true,
         platform: process.platform,
         installers: publicInstallerInfo(installers),
-        vscode,
-        claude,
-        codex,
-        opencode,
+        vscode: vscodeRes.installed,
+        claude: claudeRes.installed,
+        codex: codexRes.installed,
+        opencode: opencodeRes.installed,
         kimi: !!kimiExecutable,
         zcode: !!zcodeExecutable,
         dsh: !!dshExecutable,
+        versions: {
+          vscode: vscodeRes.version,
+          claude: claudeRes.version,
+          codex: codexRes.version,
+          opencode: opencodeRes.version,
+          kimi: kimiExecutable ? kimiVersion : null,
+          zcode: null, // 桌面应用,无 CLI 版本通道
+          dsh: dshExecutable ? dshVersion : null,
+        },
       });
     }));
 }

package/src/ui/server/routes/fileOpen.test.js

@@ -0,0 +1,239 @@
+// Copyright 2026 xz333221
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// findDshExecutable 回归测试(2026-09-05)
+// 旧实现只查 %APPDATA%\npm + npm prefix -g,在 nvm4w 用户(全局包在
+// C:\nvm4w\nodejs\) 上"未安装"误报。改用 where.exe dsh 优先后,这里守住
+// "返回的路径必须真实存在"这条契约。
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs/promises'
+import { fetchLatestVersion, findDshExecutable, getToolInstallers, parseVersionOutput, registerFileOpenRoutes } from './fileOpen.js'
+
+// ── parseVersionOutput(版本号采集,2026-09-05 check-tools 增强)────────────
+
+test('parseVersionOutput: 各工具的 --version 输出都能提取 semver', () => {
+  assert.equal(parseVersionOutput('0.1.1-rc.2\n'), '0.1.1-rc.2')               // dsh(带 prerelease)
+  assert.equal(parseVersionOutput('1.0.60 (Claude Code)'), '1.0.60')           // claude
+  assert.equal(parseVersionOutput('1.92.0 abc123def (commit)\n'), '1.92.0')    // vscode
+  assert.equal(parseVersionOutput('opencode 0.1.30\n'), '0.1.30')              // opencode 前缀
+  assert.equal(parseVersionOutput('codex-cli 0.9.2+build.1'), '0.9.2+build.1') // build 元数据
+})
+
+test('parseVersionOutput: 边界输入返回 null', () => {
+  assert.equal(parseVersionOutput(''), null)
+  assert.equal(parseVersionOutput(null), null)
+  assert.equal(parseVersionOutput(undefined), null)
+  assert.equal(parseVersionOutput('no version here'), null)
+  // 多段数字但不是 semver(如日期 2026.09.05 会被提取——可接受,总比没有强)
+  assert.ok(parseVersionOutput('version: 2.16.42\nsomething 1.0.0').startsWith('2.16.42'))
+})
+
+test('findDshExecutable: Windows 上返回 string 或 null,且非 null 时路径必须存在', async () => {
+  const result = await findDshExecutable()
+  if (process.platform !== 'win32') {
+    // 非 win32 平台走 commandExists('dsh') 路径:要么是 'dsh'(which 命中),
+    // 要么是 null。不强求特定值,只断言类型。
+    assert.ok(result === null || typeof result === 'string')
+    return
+  }
+  if (result !== null) {
+    assert.equal(typeof result, 'string')
+    // 核心契约:返回的路径必须真实存在且是文件。
+    // 这正是这次修复要解决的:不允许再出现"返回看似合法但 fs.stat 不到的路径"
+    // (旧实现里 APPDATA/npm/dsh.cmd + npm prefix -g 拼出的废地址都是 fs.stat 不到的)。
+    const stat = await fs.stat(result)
+    assert.equal(stat.isFile(), true, `${result} 不是文件`)
+  }
+})
+
+// ── 工具升级(updateCommand)──────────────────────────────────────────
+// 2026-09-05 新增:右键工具 → 更新。install 与 update 命令动词不同
+// (npm @latest / winget upgrade / brew upgrade / snap refresh / kimi 脚本重跑)。
+
+test('getToolInstallers: npm 包工具的升级变体带 @latest', () => {
+  const installers = getToolInstallers('win32', () => true)
+  for (const tool of ['claude', 'codex', 'opencode', 'dsh']) {
+    const inst = installers[tool]
+    assert.match(inst.updateCommand, /@latest$/, `${tool}.updateCommand 应带 @latest`)
+    assert.ok(inst.updateExecutable, `${tool}.updateExecutable 缺失`)
+    assert.ok(
+      inst.updateArgs.at(-1).endsWith('@latest'),
+      `${tool}.updateArgs 最后一项应带 @latest`,
+    )
+    // 安装命令不被升级字段污染
+    assert.doesNotMatch(inst.command, /@latest/, `${tool}.command 不应带 @latest`)
+  }
+})
+
+test('getToolInstallers: 各平台 vscode 升级用各自的 upgrade 动词', () => {
+  const win = getToolInstallers('win32', () => true)
+  assert.match(win.vscode.updateCommand, /^winget upgrade/)
+  assert.deepEqual(win.vscode.updateArgs.slice(0, 2), ['upgrade', '--id'])
+
+  const mac = getToolInstallers('darwin', () => true)
+  assert.match(mac.vscode.updateCommand, /^brew upgrade/)
+
+  const linux = getToolInstallers('linux', () => true)
+  assert.match(linux.vscode.updateCommand, /^sudo snap refresh/)
+})
+
+test('getToolInstallers: kimi 升级复用幂等脚本,zcode 不支持一键升级', () => {
+  const installers = getToolInstallers('win32', () => true)
+  assert.equal(installers.kimi.updateKind, 'script')
+  assert.match(installers.kimi.updateCommand, /install\.ps1/)
+  // zcode 是桌面应用,updateCommand 必须为空 → /api/update-tool 对它返回 400
+  assert.equal(installers.zcode.updateCommand, undefined)
+})
+
+test('update-tool 路由: zcode(无 updateCommand)返回 400 且不启动任何进程', async () => {
+  // zcode 的 400 在 launchToolInstaller 之前抛出,本测试不会真的打开终端窗口。
+  const routes = new Map()
+  const app = {
+    get(path, handler) { routes.set(`GET ${path}`, handler) },
+    post(path, handler) { routes.set(`POST ${path}`, handler) },
+  }
+  registerFileOpenRoutes({ app })
+  const handler = routes.get('POST /api/update-tool')
+  assert.ok(handler, 'POST /api/update-tool 路由未注册')
+
+  let statusCode = 200
+  let payload = null
+  const res = {
+    status(code) { statusCode = code; return this },
+    json(value) { payload = value; return this },
+  }
+  await handler({ method: 'POST', path: '/api/update-tool', body: { tool: 'zcode' } }, res, () => {})
+
+  assert.equal(statusCode, 400)
+  assert.equal(payload.success, false)
+  assert.match(payload.error, /不支持一键更新|桌面应用/)
+})
+
+test('update-tool 路由: 未知工具 id 返回 400', async () => {
+  const routes = new Map()
+  const app = {
+    get(path, handler) { routes.set(`GET ${path}`, handler) },
+    post(path, handler) { routes.set(`POST ${path}`, handler) },
+  }
+  registerFileOpenRoutes({ app })
+  const handler = routes.get('POST /api/update-tool')
+
+  let statusCode = 200
+  let payload = null
+  const res = {
+    status(code) { statusCode = code; return this },
+    json(value) { payload = value; return this },
+  }
+  await handler({ method: 'POST', path: '/api/update-tool', body: { tool: 'not-a-tool' } }, res, () => {})
+
+  assert.equal(statusCode, 400)
+  assert.equal(payload.success, false)
+})
+
+// ── fetchLatestVersion / latest-tool-versions(2026-09-05 更新菜单「当前→最新」)──
+
+test('fetchLatestVersion: 非法包名直接返回 null,不发请求', async () => {
+  let fetchCalls = 0
+  const fakeFetch = async () => { fetchCalls++; return { ok: true, json: async () => ({ version: '1.0.0' }) } }
+  assert.equal(await fetchLatestVersion(''), null)
+  assert.equal(await fetchLatestVersion(null), null)
+  assert.equal(await fetchLatestVersion('bad pkg name with spaces'), null)
+  assert.equal(await fetchLatestVersion('../etc/passwd'), null)
+  assert.equal(fetchCalls, 0, '非法包名不应触发任何网络请求')
+})
+
+test('fetchLatestVersion: 命中 registry 返回 version;非 200 / 抛异常 / 字段缺失都降级为 null', async () => {
+  const okFetch = async () => ({ ok: true, json: async () => ({ version: '2.3.4' }) })
+  assert.equal(await fetchLatestVersion('opencode-ai', { fetchImpl: okFetch }), '2.3.4')
+
+  const notOkFetch = async () => ({ ok: false, json: async () => ({}) })
+  assert.equal(await fetchLatestVersion('opencode-ai', { fetchImpl: notOkFetch }), null)
+
+  const throwFetch = async () => { throw new Error('network down') }
+  assert.equal(await fetchLatestVersion('opencode-ai', { fetchImpl: throwFetch }), null)
+
+  const missingFieldFetch = async () => ({ ok: true, json: async () => ({ name: 'opencode-ai' }) })
+  assert.equal(await fetchLatestVersion('opencode-ai', { fetchImpl: missingFieldFetch }), null)
+})
+
+test('latest-tool-versions 路由: tools 非数组 / 含未知工具 → 400,且不发请求', async () => {
+  const routes = new Map()
+  const app = {
+    get(path, handler) { routes.set(`GET ${path}`, handler) },
+    post(path, handler) { routes.set(`POST ${path}`, handler) },
+  }
+  registerFileOpenRoutes({ app })
+  const handler = routes.get('POST /api/latest-tool-versions')
+  assert.ok(handler, 'POST /api/latest-tool-versions 路由未注册')
+
+  const makeRes = () => {
+    let statusCode = 200
+    let payload = null
+    return {
+      res: { status(code) { statusCode = code; return this }, json(value) { payload = value; return this } },
+      get status() { return statusCode },
+      get payload() { return payload },
+    }
+  }
+
+  let ctx = makeRes()
+  await handler({ method: 'POST', body: { tools: 'claude' } }, ctx.res, () => {})
+  assert.equal(ctx.status, 400)
+
+  ctx = makeRes()
+  await handler({ method: 'POST', body: { tools: [123] } }, ctx.res, () => {})
+  assert.equal(ctx.status, 400)
+
+  ctx = makeRes()
+  await handler({ method: 'POST', body: { tools: ['claude', 'zcode'] } }, ctx.res, () => {})
+  // zcode 不在 TOOL_INSTALL_PACKAGES(npm 工具白名单)里 → 400
+  assert.equal(ctx.status, 400)
+  assert.match(ctx.payload.error, /不支持的工具/)
+})
+
+test('latest-tool-versions 路由: 正常路径调 registry 并把结果按 tool id 归还', async () => {
+  // 用全局 fetch mock 验证「路由 → fetchLatestVersion → registry URL」整条接线,
+  // 测试完必须恢复,不然会污染其它测试。
+  const requestedUrls = []
+  const originalFetch = globalThis.fetch
+  globalThis.fetch = async (url) => {
+    requestedUrls.push(String(url))
+    return { ok: true, json: async () => ({ version: '9.9.9' }) }
+  }
+  try {
+    const routes = new Map()
+    const app = {
+      get(path, handler) { routes.set(`GET ${path}`, handler) },
+      post(path, handler) { routes.set(`POST ${path}`, handler) },
+    }
+    registerFileOpenRoutes({ app })
+    const handler = routes.get('POST /api/latest-tool-versions')
+
+    let payload = null
+    const res = {
+      status() { return this },
+      json(value) { payload = value; return this },
+    }
+    await handler({ method: 'POST', body: { tools: ['claude', 'dsh'] } }, res, () => {})
+
+    assert.equal(payload.success, true)
+    assert.deepEqual(payload.latest, { claude: '9.9.9', dsh: '9.9.9' })
+    assert.equal(requestedUrls.length, 2)
+    assert.ok(requestedUrls[0].includes('/@anthropic-ai/claude-code/latest'), `URL 不对: ${requestedUrls[0]}`)
+    assert.ok(requestedUrls[1].includes('/@deepseek-ai/dsh/latest'), `URL 不对: ${requestedUrls[1]}`)
+  } finally {
+    globalThis.fetch = originalFetch
+  }
+})

package/src/ui/public/assets/AgentView-BsN9y4Kg.css

@@ -1 +0,0 @@
-.agent-view[data-v-773baa74]{background:var(--bg-container);height:100%;min-height:0;display:flex}.agent-sidebar[data-v-773baa74]{background:var(--bg-panel);border-right:1px solid var(--border-color);flex-direction:column;flex-shrink:0;display:flex;overflow:hidden}.sidebar-header[data-v-773baa74]{flex-shrink:0;padding:10px 12px}.new-session-btn[data-v-773baa74]{border:1px dashed var(--border-color);border-radius:var(--radius-md);width:100%;color:var(--text-secondary);cursor:pointer;background:0 0;justify-content:center;align-items:center;gap:6px;padding:8px 12px;font-family:inherit;font-size:13px;transition:all .15s;display:flex}.new-session-btn[data-v-773baa74]:hover{border-color:var(--color-primary);color:var(--color-primary);background:color-mix(in srgb, var(--color-primary) 6%, transparent)}.sidebar-search[data-v-773baa74]{flex-shrink:0;align-items:center;gap:6px;padding:0 12px 8px;display:flex}.sidebar-search .search-icon[data-v-773baa74]{color:var(--text-tertiary);flex-shrink:0}.sidebar-search .search-input[data-v-773baa74]{color:var(--text-primary);background:0 0;border:none;outline:none;flex:1;padding:4px 0;font-family:inherit;font-size:13px}.sidebar-search .search-input[data-v-773baa74]::placeholder{color:var(--text-tertiary)}.session-list[data-v-773baa74]{flex:1;min-height:0;padding:0 6px 8px;overflow-y:auto}.empty-state[data-v-773baa74]{text-align:center;color:var(--text-tertiary);flex-direction:column;justify-content:center;align-items:center;padding:48px 16px;display:flex}.empty-state .empty-text[data-v-773baa74]{color:var(--text-secondary);margin-top:10px;font-size:14px}.empty-state .empty-hint[data-v-773baa74]{margin-top:4px;font-size:12px}.session-item[data-v-773baa74]{border-radius:var(--radius-sm);cursor:pointer;align-items:flex-start;gap:4px;padding:8px 10px;transition:background .12s;display:flex;position:relative}.session-item[data-v-773baa74]:hover{background:var(--bg-hover)}.session-item:hover .session-item-actions[data-v-773baa74]{opacity:1}.session-item.active[data-v-773baa74]{background:color-mix(in srgb, var(--color-primary) 10%, transparent)}.session-item.active .session-item-title[data-v-773baa74]{color:var(--color-primary)}.session-item.active[data-v-773baa74]:before{content:"";background:var(--color-primary);border-radius:0 2px 2px 0;width:3px;height:20px;position:absolute;top:50%;left:0;transform:translateY(-50%)}.session-item-main[data-v-773baa74]{flex:1;min-width:0}.session-item-title[data-v-773baa74]{color:var(--text-primary);white-space:nowrap;text-overflow:ellipsis;margin-bottom:2px;font-size:13px;font-weight:500;overflow:hidden}.session-item-meta[data-v-773baa74]{color:var(--text-tertiary);align-items:center;gap:4px;font-size:11px;display:flex}.session-item-meta .meta-dot[data-v-773baa74]{opacity:.5}.session-item-meta .meta-source[data-v-773baa74]{border-radius:3px;padding:0 4px;font-size:10px;font-weight:600}.session-item-meta .meta-source.cli[data-v-773baa74]{background:color-mix(in srgb, var(--color-warning) 20%, transparent);color:var(--color-warning)}.session-item-actions[data-v-773baa74]{opacity:0;flex-shrink:0;gap:2px;transition:opacity .12s;display:flex}.item-action-btn[data-v-773baa74]{width:24px;height:24px;color:var(--text-tertiary);cursor:pointer;border-radius:var(--radius-xs);background:0 0;border:none;justify-content:center;align-items:center;padding:0;transition:all .12s;display:flex}.item-action-btn[data-v-773baa74]:hover{background:var(--bg-hover);color:var(--text-secondary)}.item-action-btn.danger[data-v-773baa74]:hover{color:var(--color-danger);background:color-mix(in srgb, var(--color-danger) 10%, transparent)}.sidebar-resizer[data-v-773baa74]{cursor:col-resize;background:0 0;flex-shrink:0;width:4px;transition:background .15s}.sidebar-resizer[data-v-773baa74]:hover,.sidebar-resizer.active[data-v-773baa74]{background:var(--color-primary);opacity:.3}.agent-chat-area[data-v-773baa74]{flex-direction:column;flex:1;min-width:0;display:flex;position:relative;overflow:hidden}.chat-loading[data-v-773baa74]{color:var(--text-tertiary);flex-direction:column;flex:1;justify-content:center;align-items:center;gap:12px;font-size:14px;display:flex}.stop-button-bar[data-v-773baa74]{z-index:10;position:absolute;bottom:80px;left:50%;transform:translate(-50%)}.stop-button[data-v-773baa74]{border:1px solid var(--color-danger);background:var(--bg-container);color:var(--color-danger);cursor:pointer;border-radius:20px;align-items:center;gap:6px;padding:6px 16px;font-family:inherit;font-size:13px;transition:all .15s;display:flex;box-shadow:0 2px 8px #0000001f}.stop-button[data-v-773baa74]:hover{background:var(--color-danger);color:#fff}.fade-enter-active[data-v-773baa74],.fade-leave-active[data-v-773baa74]{transition:opacity .2s}.fade-enter-from[data-v-773baa74],.fade-leave-to[data-v-773baa74]{opacity:0}[data-theme=dark]{background:var(--bg-panel)}