dsh-update-copilot

DSH ships fast and its plugin ecosystem grows with it, yet every profile pulls plugins through a mix of npm versions, GitHub commit pins, and local link: checkouts that all drift out of date on their own schedules. Walking each repo by hand is tedious; blindly auto-updating everything risks loading unvetted third-party code into your environment. Most people simply stop tracking updates.

dsh-update-copilot takes the middle path. A radar scan covers the DSH core, the official shipped bundles (dsh-base, dsh-web-app), and every plugin dependency across all profiles, merged package-centrically so the same package appears once with each profile's version listed inline. Each entry carries semver distance, a risk level (major / minor / patch), changelog material, and clickable links to npm version pages, GitHub compare views, or release notes. Updates target only the explicitly eligible profiles for that package; the DSH core stays strictly report-only because upgrading it restarts every session. The Web surface offers a sidebar badge with a one-click radar popup, an "Update all" sequential pass, live SSE progress bars per row, a single-flight mutation lock, hot-reload for in-profile plugins, and optional 30-minute background refresh. Agent tools (scan, brief, update) let a model answer "any updates?" with data-backed risk summaries before you confirm.

It suits DSH users who run multiple profiles, mix npm packages with git and local checkouts, and have enough plugins that remembering each source and version is no longer practical—or anyone who wants to ask their agent a quick question instead of crawling repos after every DSH release.