AI Agent Hub
Back to plugins
⚙️

dsh-lockstep

Workflow Updated 2026.08.24

Run the following command in DeepSeek Harness:

dsh plugin install da-beda/dsh-lockstep

Paste the following prompt into your AI chat to install this plugin:

Run dsh plugin install da-beda/dsh-lockstep in your terminal to install this plugin; the full source code is available at https://github.com/da-beda/dsh-lockstep .

About this plugin

dsh ships a floating pnpm update by default, and most community updaters drift plugins to the latest release. While dsh is still in RC and plugins run with full process privileges, silently chasing the newest version on every machine is not a safe default.

dsh-lockstep does not float. It compares a reviewed lockfile against the npm registry and GitHub, proposes pin bumps only (promoting a tag to a SHA, or following HEAD when a SHA pin moves), then stops and waits for you to commit. Every machine re-runs the installer to stay in lockstep. It never executes package install scripts; writing a lockfile is not installing code.

Built for teams that need N machines on identical reviewed plugin pins, or solo users who do not want silent upgrades during an RC cycle. You review and commit the lockfile; it tells you when the world has moved.

Use Cases

  • Keeping N machines on identical reviewed plugin pins so no one is accidentally on a newer release
  • Avoiding silent plugin upgrades during the dsh RC cycle where unreviewed code would gain process privileges
  • Periodically diffing a committed lockfile against npm and GitHub, reviewing drift, then bumping pins deliberately

Best For

  • Engineering teams that require consistent plugin versions across a fleet of machines
  • Security-conscious individuals who reject silent plugin upgrades
  • Operators or DevOps staff maintaining dsh plugin stacks in shared environments