hezhongtang/dsh-update-copilot

dsh-update-copilot

An update copilot for DeepSeek Harness: tracks the dsh core, shipped bundles, and every installed profile plugin — then helps you decide, and only then updates.

Why this exists

DSH moves fast, and so does its plugin ecosystem. Every profile installs plugins through pnpm specs — npm versions, GitHub commit pins, local link: checkouts — and each channel drifts out of date in its own way. Checking them by hand means walking every repo; auto-updating everything blindly means trusting third-party code with your environment.

This plugin takes the middle path: detect everything, summarize what changed, update only what you confirmed. The DSH core is deliberately report-only — upgrading the harness restarts every session, so that decision stays with a human.

Features

Install

# from npm (recommended)
dsh plugin --profile web add dsh-update-copilot

# or straight from the GitHub repo
dsh plugin --profile web add github:hezhongtang/dsh-update-copilot

Restart dsh web, then open Settings → Update Copilot. Works the same in any other profile (--profile <name>).

Usage

Ask your agent

“check for updates”

The agent runs update_copilot_scan, then builds a brief for each outdated item and presents the risk before doing anything. Updates run only after you say yes — the update tool rejects calls without confirm: true.

Or use the popup / panel

The sidebar button beside Settings opens the compact radar popup (ESC or backdrop click closes; ?duc=1 in the URL opens it once — handy for screenshots and tests). Settings → Update Copilot is the full page: core status (with a copyable upgrade command — never executed), every profile’s plugins with current → latest versions, inline update highlights, and a two-step confirm button per update. After an update, a plugin in the running profile is hot-reloaded in place when its entry and bundle patch are unchanged; the restart banner is only shown for updates outside the phase-1 hot-reload scope (bundle-patch changes, non-current profiles, self-update, etc.).

Agent tool reference

How it works

Each dependency spec is classified into a channel, and each channel has its own comparison:

The npm channel deliberately ignores the latest dist-tag: monorepo sub-packages often leave that tag stale, which false-flags installs that are actually newer than the tag. Versions are compared with full semver precedence (prereleases included), so 0.1.0-rc.6 > 0.1.0-rc.5 and 1.0.0 > 1.0.0-rc.1 both hold.

Updates execute through two vetted paths, never a raw shell string: npm/github specs run dsh plugin --profile <p> add <target> — the same path a human would type — with the target string validated against an allowlist; link: checkouts run git directly in their directory (git stash push for local changes → git pull → git stash pop to restore them). Failed or timed-out pulls are retried automatically: 3 total attempts by default, with 1s/3s backoff; merge conflicts or failed restores are never auto-resolved — the result reports attempts, a stash summary, and the last output.

A link: checkout can also be switched to a remote source: the copilot replaces the dependency spec with the newest published npm version (npm registry first), or with github:owner/repo#<origin HEAD> when the package has no npm release. The local link breaks and future updates follow the normal npm/github channel. Switching is destructive, so it always requires explicit confirmation and is never part of the default pull path.

Security

• The only mutating route is POST /dsh-update-copilot/update: same-origin enforced, confirm: true required.
• Official @deepseek-ai/* packages and the dsh core are never auto-updated; the core’s upgrade command is displayed, not run.
• All upstream queries are read-only (registry.npmjs.org, api.github.com, git ls-remote) with hard timeouts; a failed check degrades that one item instead of failing the scan.

Limitations

• Plugin hot reload is phase-1 scoped: it covers updates whose running profile entry still exists and whose new version keeps the same dsh.bundle.patch and dsh.client declaration (this includes link: checkouts — node_modules points at the checkout through a symlink, so the pull takes effect on the same files the reloader reads). Bundle-patch changes, non-current profiles, and copilot self-update still ask for a dsh restart.
• link: updates require the checkout to have an upstream branch configured; uncommitted changes are auto-stashed and restored after the pull, and a failed restore (stash pop conflict) needs manual git stash list / git stash pop.
• Switching a link: to a remote source breaks the local link and there is no automatic switch back (the spec must be edited by hand). The npm-first strategy installs the registry version, which may differ from your local development checkout.
• Unauthenticated GitHub API is rate-limited (60 req/h) — briefs degrade gracefully to version lists.
• Raw git+https:// specs are reported as-is without a comparison channel.

Contributing

Issues and PRs welcome at hezhongtang/dsh-update-copilot. The codebase is intentionally small and dependency-free — plain ESM on the host, a hand-authored CJS bundle in the browser, no build step to set up.

License

MIT © 2026 hezhongtang