dsh-plugin-update-checker
一个 DeepSeek Harness 插件，可在插件设置部分添加“检查更新”按钮：扫描每个已安装的插件包以查找已发布的更新，并评估其对正在运行的 DSH 运行时的对等依赖兼容性。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:windrover/dsh-plugin-update-checker#2534f2bb09b3c04a75b8b8833db85d735382bfa5Plugin Update Checker 以 dsh-plugin-update-checker 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A DeepSeek Harness plugin that adds a Check updates button to the Built-in plugins settings section. Click it and the plugin scans every installed plugin bundle for (1) the latest published version on the npm registry and (2) its compatibility with the running DSH runtime — then shows one row per bundle.
It lives beside the read-only inventory tab, itself contributing no configuration: it only reports. Updating or toggling a bundle is still done in the sidebar Plugins page or via dsh plugin.
| Check | Source | Notes |
|---|---|---|
| Update availability | npm registry (latest dist-tag vs the installed version) | Registry-only. Bundles installed from a tarball / git / path publish nothing, so they are reported as Unsupported rather than falsely Up to date. |
| Compatibility | the bundle's @deepseek-ai/dsh* peerDependencies vs the running DSH version | Reuses @deepseek-ai/dsh-app-boot's evaluatePluginCompatibility, the same helper the launcher applies on boot. An exact-version exemption granted in compatibility.json shows as Compatible (exempted). |
Compatibility and update availability are computed independently — a slow or unreachable registry can never hide an incompatible peer range, and a local-only bundle still gets a compatibility verdict.
Open Settings → Built-in plugins. The section now has two tabs:
The check is on demand: click the button, the host scans, and the table fills in. One broken manifest or an unreachable registry is isolated to its own row — it never blanks the whole report.
Open the sidebar Plugins page → Add plugin.
In the source field, enter one of these install specs (the launcher resolves them through installBundle, the same primitive the GUI uses):
github:windrover/dsh-plugin-update-checker
# or the full URL:
https://github.com/windrover/dsh-plugin-update-checker
Restart to load the new bundle:
dsh check # iron rule #1: preflight before restart
dsh restart # reloads the web profile; the new bundle loads
Open Settings → Built-in plugins → Check updates → Check updates.
The Check button's fetch('/api/plugin-update-checker/scan') runs inside the
authenticated browser session, so it needs no manual token.
This repository is public, so installing directly from GitHub works without any extra authentication. On networks where
registry.npmjs.orgis unreachable, the launcher usesregistry.npmmirror.comautomatically.
Clone the package where your profile can link it:
# e.g. inside your DSH workspace
git clone https://github.com/windrover/dsh-plugin-update-checker dsh-plugin-update-checker
Link it into your profile. Add a link: dependency + a bundles entry to the profile manifest:
// ~/.dsh/profiles/web/package.json
{
"dependencies": {
"dsh-plugin-update-checker": "link:/abs/path/to/dsh-plugin-update-checker"
},
"dsh": { "profile": { "bundles": [ "…", "dsh-plugin-update-checker" ] } }
}
Then install. npm install rejects the link: protocol in this profile — use pnpm (the profile is a pnpm workspace), which is what dsh wires under the hood:
cd ~/.dsh/profiles/web
pnpm install --registry=https://registry.npmmirror.com # link: deps don't hit the network
dsh's wire_link_plugin_deps auto-symlinks any @deepseek-ai/* the plugin
imports into its own node_modules, but it does not handle plain npm packages —
so pre-link the one real dependency yourself (the documented link-plugin gotcha:
a link: plugin can't resolve packages that aren't hoisted into its tree):
mkdir -p dsh-plugin-update-checker/node_modules
ln -sfn ~/.npm/_npx/<active-dsh-hash>/node_modules/semver \
dsh-plugin-update-checker/node_modules/semver
Restart and open it (dsh check && dsh restart, then the same Settings path as Option A).
One bundle, two halves:
lib/index.js → lib/host/update-checker.js) registers POST /api/plugin-update-checker/scan, which walks the profile's bundles (via ctx.remote.pluginManager.listBundles(), falling back to scanning node_modules), reads each manifest, evaluates peer compatibility, and probes the registry. cordis.patch.yml adds the Loader row.lib/client.js) registers a tab into the settings.plugins.tab slot of the Built-in-plugins section and renders the result with react (require("react")) and the design tokens DSH already exposes. The bundle id equals the package name — the contract dsh-client-modules enforces.node test/client-contract.test.mjs
Pins the browser-half contract (id == package name, one settings.plugins.tab registration, renderable body). The host scan was exercised against the live profile during development and returns { ok, dshVersion, checkedAt, plugins: [...] }.