dsh-update-copilot

An update copilot for DeepSeek Harness: tracks the dsh core, shipped bundles, and every installed plugin — merged package-centric across all profiles, with one-click updates. The update command is identical for every profile, so the radar never makes you pick one.

English | 中文

Why this exists

DSH moves fast, and so does its plugin ecosystem. Every profile installs plugins through pnpm specs — npm versions, GitHub commit pins, local link: checkouts — and each channel drifts out of date in its own way. Checking them by hand means walking every repo; auto-updating everything blindly means trusting third-party code with your environment.

This plugin takes the middle path: detect everything, summarize what changed, update only what you trigger. Updates are one click — no confirmation ceremony between you and the button — and the click explicitly names what it runs (and in which profiles, which is all of them by default). The DSH core is deliberately report-only — upgrading the harness restarts every session, so that decision stays with a human.

Features

Install

# from npm (recommended)
dsh plugin --profile web add dsh-update-copilot

# or straight from the GitHub repo
dsh plugin --profile web add github:hezhongtang/dsh-update-copilot

Restart dsh web, then open Settings → Update Copilot. Works the same in any other profile (--profile <name>).

Usage

Ask your agent

"check for updates"

The agent runs update_copilot_scan, then builds a brief for each outdated item and presents the risk before doing anything. Updates run only after you say yes — the update tool rejects calls without confirm: true.

Or use the popup / panel

The sidebar button beside Settings opens the compact radar popup (ESC or backdrop click closes; ?duc=1 in the URL opens it once — handy for screenshots and tests). With Auto-update on button click enabled in Settings → Update Copilot, that same click also kicks off "Update all" the moment outdated plugins show up, with progress streaming right inside the popup. Settings → Update Copilot is the full page: core status (with a copyable upgrade command — never executed), every installed plugin merged across profiles into one row per package (each profile's current → latest listed inline), inline update highlights, and a one-click Update button per row that updates the package in every profile that has it — the update command is identical for all profiles, so the radar never asks which one. A toolbar Update all button runs every outdated package in sequence. Live SSE progress drives a per-row progress bar. After an update, a plugin in the running profile is hot-reloaded in place when its entry and bundle patch are unchanged; the restart banner is only shown for updates outside the phase-1 hot-reload scope (bundle-patch changes, non-current profiles, self-update, etc.).

Agent tool reference

How it works

Every dependency spec is classified into a channel, and each channel has its own comparison. Scans merge the profiles' plugin lists package-centric: the same package installed in web, headless, and desktop appears once, carrying each profile's channel and versions. Because the update command — dsh plugin --profile <p> add <target> — is identical for every profile, an update never needs to pick one: the copilot runs it in every profile that has the package.

What counts as a plugin row: the packages a profile's manifest declares under dsh.profile.bundles (the list the host actually loads), plus every link: / file: checkout, which stays visible even before it is activated. Other plain dependencies in the manifest — a CLI or server runtime someone added for convenience — are not dsh plugins and don't render as one; that used to put a ghost update button beside the real plugin sharing the same GitHub repo. A manifest without a bundle list falls back to showing every dependency.

The npm channel deliberately ignores the latest dist-tag: monorepo sub-packages often leave that tag stale, which false-flags installs that are actually newer than the tag. Versions are compared with full semver precedence (prereleases included), so 0.1.0-rc.6 > 0.1.0-rc.5 and 1.0.0 > 1.0.0-rc.1 both hold.

Updates execute through two vetted paths, never a raw shell string: npm/github specs run dsh plugin --profile <p> add <target> — the same path a human would type — with the target string validated against an allowlist; link: checkouts run git directly in their directory (git stash push for local changes → git pull → git stash pop to restore them). Transient failures are retried automatically: up to 3 total attempts, spaced by full-jitter exponential backoff (1s base, 8s cap) so a batch of updates doesn't re-hammer the registry in lockstep; deterministic failures — missing package/version (E404, ETARGET), refused auth (E401/403), git refusing outright (bad credentials, dubious ownership) — skip the remaining attempts and fail fast. Stalled git pulls abort themselves (http.lowSpeedLimit/http.lowSpeedTime) instead of hanging until the hard timeout. Merge conflicts or failed restores are never auto-resolved — the result reports attempts, a stash summary, and the last output. The one-click Update / Update all actions just run that command in every profile that has the package, in sequence.

A link: checkout can also be switched to a remote source: the copilot replaces the dependency spec with the newest published npm version (npm registry first), or with github:owner/repo#<origin HEAD> when the package has no npm release. The local link breaks and future updates follow the normal npm/github channel. Switching is destructive, so it always requires explicit confirmation and is never part of the default pull path.

Security

• The only mutating route is POST /dsh-update-copilot/update: same-origin enforced, confirm: true required.
• Official @deepseek-ai/* packages and the dsh core are never auto-updated; the core's upgrade command is displayed, not run.
• All upstream queries are read-only (registry.npmjs.org, api.github.com, git ls-remote) with hard timeouts; a failed check degrades that one item instead of failing the scan.

Limitations

• Plugin hot reload is phase-1 scoped: it covers updates whose running profile entry still exists and whose new version keeps the same dsh.bundle.patch and dsh.client declaration (this includes link: checkouts — node_modules points at the checkout through a symlink, so the pull takes effect on the same files the reloader reads). Bundle-patch changes, non-current profiles, and copilot self-update still ask for a dsh restart.
• link: updates require the checkout to have an upstream branch configured; uncommitted changes are auto-stashed and restored after the pull, and a failed restore (stash pop conflict) needs manual git stash list / git stash pop.
• Switching a link: to a remote source breaks the local link and there is no automatic switch back (the spec must be edited by hand). The npm-first strategy installs the registry version, which may differ from your local development checkout.
• Unauthenticated GitHub API is rate-limited (60 req/h) — briefs degrade gracefully to version lists.
• Raw git+https:// specs are reported as-is without a comparison channel.

Contributing

Issues and PRs welcome at hezhongtang/dsh-update-copilot. The codebase is intentionally small and dependency-free — plain ESM on the host, a hand-authored CJS bundle in the browser, no build step to set up.

License

MIT © 2026 hezhongtang