The core philosophy of DSH is “everything is a plugin.” As developers enrich functionality using third-party plugins, managing updates for these plugins becomes part of daily maintenance. In the past, checking plugin updates required visiting GitHub repositories one by one or relying on management tools. The dsh-update-checker plugin automates this process by providing a “Plugin Updates” entry in the DSH settings page. It directly compares locally installed third-party plugins with upstream versions and displays release notes.

Plugin Overview

dsh-update-checker is a DSH plugin maintained by daha1216 and licensed under the MIT License. Its core function is to check with one click from the settings page whether locally installed third-party plugins have upstream updates, and to display the update content (changelog).

Core Features

The plugin mainly addresses the question of “how to quickly track version changes in third-party plugins,” with the following capabilities:

  1. Multi-source checks: Supports classifying and checking three installation sources
    • npm version numbers: Queries dist-tags.latest from the npm registry (preferring npmmirror, falling back to npmjs on failure).
    • GitHub references: Parses the github:owner/repo#tag format and queries the latest Release for the corresponding repository.
    • Local installs: Marks file:... paths as local development installs; if the package declares a GitHub repository, it also displays the latest upstream version for reference.
  2. Check-only, no install: The plugin only compares version differences and displays changelogs; it does not perform actual installation or update operations.
  3. Update content display: Displays update content from GitHub Releases, with Markdown rendering support (including headings, lists, code blocks, etc.), though each release body has a 64K character limit.
  4. UI interaction: The settings page UI supports status filtering (All / Updates available / Up to date / Local / Needs attention), sorting (default by status, switchable to name), and expanding/collapsing release notes.

Installation

Install the plugin using the official command. The --profile parameter specifies the target profile, with web as the default.

dsh plugin --profile web add github:daha1216/dsh-update-checker

How It Works and Performance

The plugin communicates with the host through a Connection RPC channel. The host mounts routes on webServer and replicates the official /api transport protocol. To avoid request backlog and resource waste, the plugin refactored the network layer in v0.3.0 and adopts the following strategies:

Unified Outbound Layer

All registry, CDN, and GitHub requests are handled through lib/http.js, providing the following mechanisms:

  1. Concurrency limiting: Limits concurrent connections to 6 to prevent too many connections from being opened simultaneously.
  2. Single-flight merging: For concurrent requests to the same URL, only one network call is made and the result is shared.
  3. TTL cache and ETag: Responses are served directly from the in-memory cache within 5 minutes. Expired entries with an ETag send conditional requests; a GitHub 304 response does not consume the anonymous quota (60 requests/hour/IP).
  4. Host circuit breaking: When a GitHub 403 or 429 (rate limit) error is encountered, the host is short-circuited based on the x-ratelimit-reset response header (default 60 seconds); subsequent requests directly fall back to jsDelivr to avoid ineffective retries.

Check Logic

  • Fast path: For npm packages, the lightweight dist-tags endpoint is preferred to determine whether a version is up to date, and full packuments are fetched only for expired entries.
  • Prerelease handling: Both the GitHub prerelease flag and tag shape (such as -rc and -beta) are checked to avoid misidentifying prerelease versions as stable releases.
  • Timeout and offline handling: Single-request timeout is 8 seconds, and the worst-case offline path takes about 40 seconds.

Development and Compatibility

Runtime Environment

  • Node.js version: Requires Node.js >= 22 (depends on fetch, AbortSignal.any, and timeout).
  • pnpm warnings: You may see warnings such as missing peer @deepseek-ai/cordis in the profile. This is expected behavior because the host provides these packages at runtime and does not install them into the profile’s node_modules.

Cleanup Mechanism

To prevent leftover routes from causing errors during plugin uninstallation or hot updates (such as webserver: duplicate prefix route), cleanup logic must be registered through ctx.effect. The returned disposer must execute when the fiber unmounts, ensuring that webServer routes are removed correctly.

Development Structure

  • index.js: Host-side Cordis plugin logic.
  • lib/http.js: Unified outbound layer.
  • lib/checker.js: Check logic.
  • client/client.js: Settings page UI (hand-written React elements).
  • npm test: Runs the offline test suite (including unit tests, integration tests, and Markdown rendering tests).

Conclusion

dsh-update-checker significantly reduces GitHub API call costs through caching strategies and request merging, making it suitable for long-running use. It provides DSH plugin developers and administrators with a standardized entry point for update checks, and, combined with Markdown-rendered release notes, can effectively improve maintenance efficiency.

GitHub Repository