dsh-safe-updater

DeepSeek Harness runs persistent agent workflows where a single bad upgrade can disrupt live sessions, workspace state, and external integrations. dsh-safe-updater turns version updates into an auditable, reversible pipeline: it clones the candidate into an isolated DSH_HOME, installs dependencies, validates the composed config, and spins up a temporary Web server for HTTP health probes. Only after every check passes is a switch permitted; any failure rolls back automatically without interrupting the running agent loop.

The plugin offers three escalating modes: notify records a newer release and does nothing else, stage completes a full dress-rehearsal but never restarts, and apply hands the switch to an external supervisor for production activation. Every candidate command executes as an argument array with shell disabled, credentials and runtime data are never copied into staging, and state files use atomic replacement with restricted permissions, neutralising common risks of recursive staging and supply-chain injection.

It is built for teams and power users who treat DSH as long-running infrastructure: you want a controlled update window, a clear rollback path, and zero disruption to in-flight agent tasks, without manually diffing npm version numbers before every upgrade.