dsh-plugin-updater

English | 简体中文

Package-level plugin manager with update detection for DeepSeek Harness (DSH).

It adds a Settings → 插件包 page to the DSH web UI that lists every plugin package installed in the current profile, shows the installed version and the latest available one, and can install, update, and remove packages — dsh plugin (a thin pnpm forwarder) with a browser UI.

This is a community plugin, not an official DeepSeek package. It manages the install state of a profile (npm packages and the dsh.profile.bundles layer list); for runtime enable/disable of loader entries see dsh-plugin-manager — the two are complementary.

Features

• Lists every dependency of the current profile with its installed version, source (npm / Git / local / built-in), and whether it is an active bundle layer (dsh.profile.bundles).
• Update detection per source:
  • npm — installed version vs pnpm view <name> dist-tags (runs inside the profile directory, so the configured registry and credentials apply).
  • Git (github:owner/repo, git+…, …#ref) — the installed commit (from the profile lockfile) vs git ls-remote <url> <ref>; the newest semver tag is displayed as the latest version when the repo has tags.
  • Local (link: / file:) — the checkout's local HEAD vs git ls-remote origin HEAD, so "the repo moved on" is visible without reinstalling.
  • Built-in @deepseek-ai/* bundles — version shown, updated together with the dsh installation.
• One-click install (any pnpm spec), update (<name>@latest for npm, re-fetch of the recorded spec for Git), and remove, each running pnpm add/remove in the profile directory followed by the same bundle reconciliation dsh plugin performs (a dependency resolving to a package that declares dsh.bundle.patch joins the layer list; a removed one leaves).
• 插件市场 (marketplace) — searches GitHub for repositories carrying the dsh-plugin topic (forks excluded), sortable by relevance / stars / last push, with pagination, and installs any result directly as a github:owner/repo dependency. Repos already present in the profile are badged 已安装. Results are cached ~5 min; set DSH_GITHUB_TOKEN (or GITHUB_TOKEN / GH_TOKEN) to raise GitHub's unauthenticated search quota.
• Live operation log and an explicit "restart dsh to apply" banner — profile layers are composed at boot, so changes take effect after a restart.
• Check results are cached (~10 min) in ~/.dsh/plugin-updater.json; no background polling of registries.

Install

dsh plugin --profile web add github:hyqhyq3/dsh-plugin-updater
dsh --profile web   # restart, then open Settings → 插件包

Or from a local checkout:

dsh plugin --profile web add link:/path/to/dsh-plugin-updater

How it works

• Host half lib/index.js — discovers the profile it is installed in (the profile whose node_modules/dsh-plugin-updater realpaths to its own package directory; override with DSH_PLUGIN_UPDATER_PROFILE), reads the install state (package.json, node_modules/*/package.json, pnpm-lock.yaml), runs update checks (pnpm view, git ls-remote), and exposes a same-origin JSON API at /plugin-updater/api/* on the GUI webserver. Mutations spawn pnpm in the profile directory and re-apply the bundle reconciliation.
• Client half lib/client.js — a hand-written module factory registering the Settings section; polls /api/state every 3 s. UI strings are Simplified Chinese.

HTTP API:

Method	Path	Purpose
GET	/plugin-updater/api/ping	liveness + discovered profile
GET	/plugin-updater/api/state	plugins, versions, check results, op status
GET	/plugin-updater/api/search	GitHub marketplace (?q=&sort=best|stars|updated&page=&per_page=)
POST	/plugin-updater/api/check	re-check updates ({name?})
POST	/plugin-updater/api/install	pnpm add <spec> + reconcile
POST	/plugin-updater/api/update	pnpm add <name>@latest / re-add spec
POST	/plugin-updater/api/remove	pnpm remove <name> + reconcile

Plain ESM JavaScript, zero dependencies (Node built-ins only; Node ^22.19 || >=24, pnpm on PATH, git for Git update checks). No build step — lib/*.js ships exactly as written.

Limitations

• Changes require a dsh restart to take effect (this page shows the banner); the running process is never reloaded implicitly.
• The manager refuses to remove itself from the page — use dsh plugin --profile <name> remove dsh-plugin-updater.
• Update detection for Git packages pins to the spec's ref (#ref or the default branch HEAD); a moved tag is not treated as an update.
• A link: install without a .git target is listed but not checked.
• Marketplace search uses GitHub's public search API: without a token it is limited to 10 requests/min (results are cached ~5 min to stretch that); DSH_GITHUB_TOKEN raises the quota.
• Only dependencies of the profile manifest are managed; runtime loader rows (enable/disable) are out of scope.

Model Experience

None. This plugin adds no model-facing surfaces: it registers no tools and injects no prompt context; it only serves the Settings page and its JSON API.

License

MIT