@lucagiftzek/dsh-plugin-updates

dsh plugin --profile web add @lucagiftzek/dsh-plugin-updates

dsh-plugin-updates


An update checker that only offers plugin releases your running DSH core can actually load.

dsh plugin --profile web add dsh-better-sidebar   # the tab host, skip if installed
dsh plugin --profile web add @lucagiftzek/dsh-plugin-updates
# or from GitHub: dsh plugin --profile web add github:lucagiftzek/dsh-plugin-updates
# restart dsh web, then open the Updates tab

_{Screenshot from a demo DSH instance with sample data.}

A DeepSeek Harness (DSH) web-profile plugin that tells you which of your installed plugins have a newer release that your running DSH can actually take. It only notifies. It never installs, never edits your profile, never runs a child process.

npm name. The bare name dsh-plugin-updates is already taken on npm by an unrelated data package. This repository keeps the folder and package name dsh-plugin-updates for local use. If it is published, it will be published as @jobopportunitiesapi/dsh-plugin-updates. The loader row id stays plugin-updates either way.

Why

Updating DSH plugins blind is risky. Two things go wrong in practice:

1. Name collisions. Many local plugins are link: folders or GitHub installs whose names also exist on npm as unrelated projects. A checker that looks packages up by name reports false "updates" and, if you approve, installs somebody else's package. This plugin classifies every dependency by its specifier (^1.2.0, link:, github:, a release tarball URL), never by its bare name.

2. Wrong-core builds. The newest release of a plugin often needs a newer DSH core than the one you run. Installing it can blank the whole web UI. This plugin applies the same compatibility rule as the DSH 0.2.1 loader against the running core version, so a 0.2.x-only build is never offered to a 0.1.5 host.

It also keeps a list of holds (versions you know to avoid), per package notes, and gives you a memory-capped apply command to copy, because a bare pnpm add on a busy machine can exhaust memory.

What you get

• An Updates tab in the sidebar (needs dsh-better-sidebar, optional) with a live count badge, grouped results, links (npm, releases, changelog, compare), Check now, Ignore this version, Snooze and Copy command.
• A Settings section for the options below.
• A read-only agent tool plugin_updates (and plugin_updates_doctor).
• GET /dsh-plugin-updates/api/doctor and a bundled doctor skill.
• Zero configuration: defaults work as installed.

Install (DSH web profile)

Install from npm: dsh plugin --profile web add @lucagiftzek/dsh-plugin-updates, or from GitHub: dsh plugin --profile web add github:lucagiftzek/dsh-plugin-updates.

dsh plugin --profile web add @lucagiftzek/dsh-plugin-updates
# or from GitHub: dsh plugin --profile web add github:lucagiftzek/dsh-plugin-updates
# then restart dsh web: the server half loads at start only

The package declares dsh.bundle, so dsh plugin add lists it in dsh.profile.bundles. A local checkout works too: clone it, run npm install --omit=dev in it, then dsh plugin --profile web add link:/absolute/path/to/dsh-plugin-updates. Requires Node 22.5 or newer and DSH 0.1.5-rc.1 up to (not including) 0.3.0. The browser half hot-reloads; only the server half needs the restart.

Kill switch without uninstalling: add - id: plugin-updates with disabled: true to the profile cordis.patch.yml, or set DSH_PLUGIN_UPDATES_DISABLE=1.

Settings

Settings live in the dsh-plugin-updates namespace on DSH 0.1.5 (Settings page, stored in settings.yaml) and in the plugin-updates row of the profile cordis.patch.yml on DSH 0.2.x (settings forms). The plugin imports an old settings.yaml section once.

Key · Default · Meaning

enabled · true · Master switch.

intervalHours · 12 · Hours between automatic checks (minimum 1).

initialDelaySeconds · 60 · Delay of the first check after start. After a restart the next check respects the last one, so restarts do not cause extra requests.

registry · https://registry.npmjs.org · Registry base URL. Must be on the host allowlist.

allowHosts · [] · Extra hosts, explicit opt-in only.

githubTokenEnv · "" · The name of an environment variable that holds a GitHub token. Never the token. It is sent only to api.github.com and never stored or logged.

channels · ["latest"] · Extra dist-tags to show (for example next). Never counted in the badge.

holds · seeded · Package name to a semver range to avoid. A value may end in when dsh <range> to apply only on some cores, for example ">=0.3.2 when dsh <0.2.0-0".

upstream · seeded · Local plugin (folder or package name) to owner/repo, or owner/repo@<base> to record the base version. Used for link: and file: plugins that are forks or clones.

notes · seeded · Per package notes shown next to the result. A note ending in when dsh <range> (the hold syntax) is shown only while the running DSH matches that range.

afterInstall · {} · Per package reminder printed with the apply command (for example a patch script to re-run).

checkOwnRemotes · false · Compare plain local plugins with their github.com origin.

snoozeDays · 7 · Default snooze length.

badge · true · Show the count badge.

badgeCountsIncompatible · false · Also count updates that need a newer core.

chatNotice · false · Post one short notice per new finding set, at most once a day. Best effort; it never starts a model turn.

runningDshVersion · "" · Test override of the detected DSH version. Leave empty.

Seeded holds and upstream come from a manual audit of re

…(truncated)