dsh-update · Plugin Ecosystem Version Check & Update Notifier for DeepSeek Harness (DSH)
English | 中文
Plugin Ecosystem Version Check & Update Notifier for DeepSeek Harness (DSH)
Sidebar Footer Trigger · npm Auto-Detection · Release Notes Integration · Verified Update Pipeline
In-GUI auto-update extension for the DeepSeek Harness (DSH) family: a download trigger alongside the settings button in the sidebar footer that checks npm for newer @linxin666/dsh-web-* versions and runs a verified pnpm update --latest inside the active profile.
This package is an external plugin for DeepSeek Harness (DSH), structured as a cordis bundle: the host half mounts the /api/update route family while the browser half renders the sidebar trigger and update modal.
The feature is deliberately structured as an independent plugin row (row id update, aggregate row web-ui-update) rather than sharing a seat with dsh-remote-web-ui: disabling remote access must never remove the update path.
What it does
- Sidebar trigger: a download control in the official
sidebar.footer.action seat beside the settings trigger. It marks the button
with a text badge when a newer release exists, checks the registry on open, and
lets the user confirm the update from the result view.
- Web pages only: the trigger mounts on pages a web transport delivered —
the loopback GUI in a browser, a LAN or tunnel deployment. The official DSH
Desktop shell serves its page from
dsh-app://app/ and owns its own updater,
so the seat is not mounted there at all; that page's seat keeps the
phone-remote trigger alone.
- Verified install: the run endpoint executes
pnpm update --latest in the
profile the web GUI was booted from, then re-reads the installed versions. The
pnpm 11 minimumReleaseAge gate can silently keep same-day releases, so a
green exit alone is not reported as success.
- Release notes: the panel fetches the matching GitHub release notes and lists
the component versions it moved.
- Restart hint: a successful update asks the user to restart
dsh web, which
is when the new package versions load.
Requirements
- DSH
>= 0.2.0-rc.2.
- The profile must own the family packages through npm: the aggregate
@linxin666/dsh-web-all, or the family packages installed directly. A profile
whose family is installed with local link: specs is reported as local
development mode and the update is refused (sync the checkout instead).
Install
# Recommended: install directly from npm
dsh plugin --profile <profile> add @linxin666/dsh-update
# Or from a checkout (development loop)
dsh plugin --profile <profile> add link:<repo>/packages/dsh-update
In the family aggregate the row is already present; disable it per row in the
plugin manager if a profile should not offer self-update.
Configuration
The plugin ships no settings namespace of its own: a profile either mounts the
row or not, and the plugin manager's per-row switch is the only control. The
host surface is fixed — the two loopback routes below — and the sidebar trigger
always registers into the official sidebar.footer.action seat.
Use
- Open the dsh web GUI and look at the sidebar foot: the download trigger sits
beside the settings trigger (a 36px circle in the collapsed rail, a pill in the
wide column).
- Click it. The panel probes the registry and shows either "up to date" or the
newer release with its notes.
- Confirm with Update now. The panel shows the pnpm run, then the outcome and
the component versions.
- Restart
dsh web for the new packages to load.
Routes
Both routes are exact matches on the host web server and answer only to the local
machine:
| Route | Method | Meaning |
|---|
/api/update/status | GET | Registry probe: install mode, owning profile, per-package current/latest, release notes |
/api/update/run | POST | Runs the verified pnpm update --latest in the owning profile |
A paired remote desktop reaches them through the dsh-remote-web-ui gated
/remote/api channel, which is why that plugin's channel rules keep
/api/update/ on the paired path.
Security model
- The run endpoint executes a real install on this machine. It is fenced to
the loopback authority and refuses cross-site browser markers, so a LAN or
tunnel origin can never trigger it directly.
- The update target is the host process's own module graph. The anchor
manifest is resolved from the running host (
@linxin666/dsh-web-all first,
falling back to this package), so the update always writes the profile that
serves the page — never a path supplied by the client.
- Local links are refused, not rewritten: a
link: spec cannot be updated
from the registry, and silently replacing it would detach the user's checkout.
- The panel prints the captured pnpm output, which can contain local paths. No
credentials are read from or written to the profile by this plugin.
Known limitations
- The desktop shell (
dsh-app:// pages) has no update seat by design: use the
desktop application's own updater there, or open the GUI in a browser to drive
the family update.
- A profile whose family packages are installed with local
link: specs reports
local development mode and cannot self-update; sync the checkout instead.
pnpm must be resolvable on the host (pnpm, corepack, or npx); the panel
names the candidate that failed when none works.- pnpm 11's
minimumReleaseAge gate can hold back same-day releases. When the
installed versions did not move, the panel explains the
minimumReleaseAgeExclude / minimumReleaseAge: 0 remedy.
- The captured pnpm output is shown verbatim and can contain local paths.
- The wide sidebar row that puts the footer actions beside the settings trigger
is declared by
dsh-remote-web-ui. With that plugin disabled the update trigger
falls back to the shell's own stacked foot: it still renders and works, only
the shared-row layout is lost.
Development
pnpm --filter @linxin666/dsh-update typecheck
pnpm --filter @linxin666/dsh-update test
pnpm --filter @linxin666/dsh-update build
Checks
Focused gates: pnpm --filter @linxin666/dsh-update test, pnpm typecheck,
pnpm test:standards, and pnpm libs:check after the aggregate is rebuilt.
Telemetry
One anonymous install heartbeat per browser per UTC day (package name only, silent
failure), following docs/telemetry.md. No session content, paths, or update
results are reported.
Dependency rationale
@deepseek-ai/* entries are the official SDK used for types and host faces;
react/react-dom are the GUI's own platform modules. The
@deepseek-ai/dsh-client-ui-primitives icons ride the platform module table.
