Preface

In plugin-based workspaces like DeepSeek Harness (DSH), maintainers often have to handle multiple types of dependencies simultaneously: the dsh core itself, bundles shipped with DSH, and third-party plugins installed in various profiles. Plugin sources can come from npm versions, git commit pins, or local link: checkouts; different profiles and sources create drift separately. Manually checking each repository is costly, while blindly auto-updating might bring unreviewed third-party code into the current environment.

The dsh-update-copilot introduced below takes the middle path: first scan all update targets, then aggregate version distance and change material, and finally only execute updates on targets you explicitly trigger. It is maintained by hezhongtang, licensed under MIT; the version number in package.json is 0.7.0.

What is it

dsh-update-copilot is a DSH plugin, positioned as an Update Copilot. One scan covers:

  • dsh core;
  • shipped bundles: dsh-base, dsh-web-app;
  • plugin dependencies for each profile.

Scan results are merged across packages per profile, allowing the status of the same package in multiple profiles to be viewed on a single line. Updates only target eligible, independently owned installations, and only apply to the eligible profiles displayed for that package; for the dsh core, it only reports and does not auto-upgrade. The README explains this decision because upgrading the harness restarts every session, so this decision is left to manual intervention.

Scanning Capabilities

For each item, the plugin provides:

  • semver distance;
  • risk level: major corresponds to high, minor to medium, patch to low;
  • changelog material;
  • external links: npm version page, commit, release, compare view, repository address.

Source determination works via two channels:

npm registry:
  full semver compare
  prerelease-aware logic

git upstream:
  pinned-commit vs HEAD
  link: checkouts:
    read-only ls-remote

Update Execution & Guardrails

Update actions are restricted to clearly allowed targets. npm and GitHub specs are only executed via the official dsh plugin CLI; link: checkouts perform git updates within their own directory: auto-stash → pull → restore; conflicts are handed back to manual processing. file: installs and official @deepseek-ai/* packages remain refused.

Guardrails include:

same-origin POST + explicit confirm
strict target allowlist
single-flight lock
5-minute timeout

The update process writes live progress to the corresponding progress bar via SSE, so updates don’t happen silently.

Agent Tools

The plugin exposes three agent tools:

update_copilot_scan
update_copilot_brief
update_copilot_update

Typical usage is to ask the agent directly:

check for updates

The agent will first run update_copilot_scan, then generate a brief for outdated items, and present risks before executing any updates. The update tool will reject calls without confirm: true, so it only proceeds after you confirm.

Web Interface

The plugin provides several entry points:

  • Sidebar trigger next to Settings, opening a compact popup;
  • Settings → Update Copilot, opening a full page;
  • Update all quick action, for sequentially executing eligible outdated packages.

There is also an opt-in switch in the full page:

Settings → Update Copilot
Refresh every 30 minutes
off by default

The plugin provides a bilingual UI for user-facing strings.

Installation & Enablement

First, install the plugin:

dsh plugin --profile web add dsh-update-copilot

You can also install directly from the GitHub repository:

dsh plugin --profile web add github:hezhongtang/dsh-update-copilot

After installation, restart dsh web, then open:

Settings → Update Copilot

It is the same for other profiles, replacing --profile web with the corresponding profile:

dsh plugin --profile <name> add dsh-update-copilot

Typical Usage

After the above installation and enablement steps, you can start using it from the agent or the interface.

  1. Use the agent: Ask for “check for updates”, letting the agent scan, generate a summary, and display risks.

  2. Use the interface: Click the sidebar button next to Settings to open the compact popup; for the full page, open Settings → Update Copilot.

  3. When DSH itself cannot start, run:

node …/dsh-update-copilot/lib/cli.js

This command does not boot the profile, so it can be used to check issues when you cannot enter a normal DSH session.

  1. Host export check: The plugin scans for @deepseek-ai/* named imports in third-party plugins and compares them against the current DSH host packages. If issues are found, it provides a copyable cordis.patch.yml disable snippet and a dsh plugin remove command.

Applicable Scenarios and Notes

The suitable scenario is: maintaining multiple DSH profiles, plugin sources simultaneously containing npm, git commit pins, and local link: checkouts, and wanting to see version distance, change material, and risks first, then deciding whether to update.

Points to note:

  • The plugin runs with the current dsh process permissions; you should check the source code, license, and dependencies before installing;
  • Upgrading the dsh core affects the current DSH session, so the plugin only reports;
  • The update tool relies on explicit confirmation; update calls without confirm: true will be rejected;
  • file: installs and official @deepseek-ai/* packages will not be automatically updated by this plugin;
  • Peer dependencies are:
{
  "@deepseek-ai/cordis": ">=4.0.0-rc.7 <5.0.0",
  "@deepseek-ai/dsh-tools": ">=0.0.1-rc.1"
}

Among them, @deepseek-ai/dsh-tools is optional.

Links

GitHub:

https://github.com/hezhongtang/dsh-update-copilot

Directory page (address comes from plugin clues, not directly confirmed in the scraped README or package.json):

https://www.skillhub.cn/plugins/hezhongtang/dsh-update-copilot

The DSH Community Directory is an independent site and should not be interpreted as the official app store.