dsh-plugin-updater

In a dsh profile, third-party plugins are essentially a set of pnpm dependencies in the profile directory, layered into the cordis composition via dsh.profile.bundles. Running pnpm up --latest or clicking a marketplace one-click update can easily leave a half-installed profile after a mid-transaction failure, or leave a stale bundle layer pointing at a patch file that no longer exists after removal—crashing the next composition with no way to undo it.

dsh-plugin-updater turns this chain into a pipeline with a safety net: before any change it backs up the four files an update or removal can touch (package.json, pnpm-lock.yaml, pnpm-workspace.yaml, cordis.patch.yml); after the update it runs --dump-config to reconcile every bundle layer, then boots the real app on an ephemeral port and waits for the dsh web: URL as the pass gate. Any failure restores the backup, reinstalls from the frozen lockfile, and verifies again. Removal goes through the same pipeline: after pnpm remove it re-derives dsh.profile.bundles and asserts no orphaned layers remain before reporting success. The settings page lists each plugin with its current and available version, lock and deprecation flags; select what to update and click once to confirm, click again to execute, with live progress in the log. If something fails, pick a historical backup from the rollback section to restore. The restart button detects whether dsh runs as a systemd user service or a foreground process and relaunches it accordingly.

Built for developers managing several third-party plugins in a dsh profile who would rather not hand-type pnpm and cordis commands in the terminal. It does not upgrade dsh itself, does not touch agent presets, sessions, or credentials—it only updates the plugins you select to the versions you want, removes them safely, and rolls back when things go wrong.