dsh-plugin-updater

A plugin updater for DSH. It finds the plugins in your profile that were
installed from GitHub, compares each one's installed version with the
version in package.json on the latest commit of its repository's main
branch, and updates them — one at a time or all at once.

Everything lives inside dsh's own Plugins page (the sidebar's Plugins
panel), in its existing Installed plugins section. There is no extra tab.

• Under the "Installed plugins" heading:
• Check for updates re-runs the check; the time of the last check is
  shown beside it.
• Update all (N) updates every plugin with an update available, one
  after another. A failure doesn't stop the others.
• Lines for a check error, the restart notice, and the empty or
  unsupported state.
• After an update (single or Update all), a snackbar at the bottom of the
  window reports how many were updated and how many failed, then hides after
  a few seconds.
• On each GitHub plugin's card that has something to say:
• an Update available · x.y.z tag (or updating, update failed,
  update check failed) and pinned to … when installed with #ref;
• an Update button just before its on/off switch;
• the reason under the card when a check or an update failed.

Up-to-date and non-GitHub cards are left exactly as dsh draws them.
- On an outdated plugin's own page: an Update available · x.y.z badge
beside its title and an Update button among its head actions.
- At startup a check runs once in the background. When it finds updates,
a toast says how many; View opens the Plugins page and scrolls to
Installed plugins. The toast hides by itself after 3 seconds; a thin bar
along its bottom shrinks from right to left as the time runs out.

How it works

• Which plugins. Bundles whose install source is a GitHub repository:
  github:owner/repo, git+https://github.com/owner/repo(.git),
  https://github.com/owner/repo, git+ssh://git@github.com/… or
  git@github.com:owner/repo, each with or without #ref. Registry, local
  (link: / file:), tarball and other git hosts are ignored.
• Which version. It asks api.github.com for the head commit of main,
  then reads package.json at that exact commit from
  raw.githubusercontent.com. Versions are compared with SemVer precedence;
  only a strictly greater main version counts as an update.
• Updating. dsh's plugin manager has no update action, so the updater
  does what its UI does: remove the bundle, then install
  github:owner/repo#main with the same enabled/disabled state. If the
  install fails, the previous commit (from pnpm-lock.yaml) is reinstalled.
  When dsh says the change needs a restart, a notice under the Installed plugins heading says so.
• Pinned plugins. A plugin installed with #tag, #branch or #commit
  is still compared with main. Updating it asks first, because it then
  tracks main. The question is an in-app dialog built from dsh's own
  Modal and Button (@deepseek-ai/dsh-client-ui-primitives), with
  Cancel and Update; only a dsh that does not share those falls back
  to the browser's confirm.
• Updating the updater itself. When the updater is installed from GitHub
  and main is newer, its card and its page show Update Plugin Updater:
  an outline button with a refresh icon, unlike the solid Update of other
  plugins. It always asks first, pinned or not, and Update all never
  includes it.
• It never uninstalls itself (removing a bundle stops it first). It runs
  pnpm add github:owner/repo#main in place through dsh's
  runPluginCommand, under the same profile lock as the plugin manager.
• If that fails, package.json and pnpm-lock.yaml are put back and the
  current version keeps running.
• On success it writes /storages/plugin-updater/self-update.json
  and asks dsh to load the new version live. When dsh can't, the Installed
  plugins heading says to restart dsh.
• The new version shows Plugin Updater updated to x.y.z once.

Configuration

cordis.patch.yml takes one optional key:

- insert:
- id: plugin-updater
name: 'dsh-plugin-updater'
config:
githubToken: !!js process.env.GITHUB_TOKEN

Install

Needs dsh 0.2 or later (the pluginManager service and the native
Plugins page). Tested with 0.2.1-rc.2.

The desktop profile is managed by the Electron app: add the plugin from the
app's plugin manager as a local folder (a link: dependency, like the other
@local/* bundles). For a web profile:

dsh plugin --profile web add link:../dsh-plugin-updater

Caveats

• Public GitHub repos and main only. Private repos, repositories whose
  branch is not main (e.g. master) and subfolder installs (#path:)
  show as unknown.
• Rate limit. Without a token, GitHub allows 60 API requests per hour.
  When it is hit, the updater falls back to raw…/main/package.json (which
  the CDN can serve a few minutes stale) and shows no SHA.
• Blocked build scripts. pnpm 10+ blocks a git dependency's prepare
  script until it is allowed in pnpm-workspace.yaml (allowBuilds). Such
  an update fails with the plugin manager's message; the updater never
  approves builds for you.
• Version-based. New commits that don't bump version aren't reported.
• Self-update relies on dsh internals. It loads runPluginCommand from
  @deepseek-ai/dsh-plugin-manager/operations out of dsh's installation
  (profileContext.installAnchor). On a dsh without it, the updater's card
  keeps the "uninstall and reinstall it" hint instead of the button.
• Fragile Installed-section hook. The Installed plugins section and its
  cards have no extension seat. A shell.overlay entry watches the page and
  mounts its controls next to section[data-plugin-group="bundles"] and
  li[data-plugin-package] (selectors in SEL in client.js). A harness
  update that changes that markup may need a matching tweak; until then the
  card controls just don't appear, and the detail-page badge and button
  (official seats) keep working.

Structure

• index.js — the Host half. It provides the pluginupdater service with
  status, check, update, updateAll and selfUpdate, runs the startup
  check, announces a finished self-update, and serializes updates (one at a
  time).
• client.js — the Client module: the Installed-section hook and the startup
  toast (both shell.overlay), the plugins.detail.badge and
  plugins.detail.actions entries, and the plugin-updater locale namespace
  (en / es).
• cordis.patch.yml — inserts the plugin-updater plugin row.
• locale/ — the en / zh metadata strings.
• icon.svg — the plugin icon.
• test/ — node --test suites (npm test).

License

Copyright 2026 gorkaseto. Licensed under the
Apache License, Version 2.0; see NOTICE.