dsh-updater

One-click updates for DeepSeek Harness (DSH)
Community plugin · incremental npm tarballs · backup & rollback · like Codex

Install · How it works · Screenshots · Config · Security · Français

dsh-updater adds a Settings → Updates panel and a sidebar button to DeepSeek Harness (@deepseek-ai/dsh). It checks npm next / latest, copies your current engine, downloads only packages that changed, swaps the running engine, then restarts — or tells you to quit DSH on a laptop.

It is not official DeepSeek software. It does not fork DSH, does not git pull the source, and never runs sudo or curl | bash.

Why this exists

A full npm install @deepseek-ai/dsh rebuilds a 200-package monorepo in memory and can OOM (we hit a 1 GB heap in Docker). Claude Code / Codex-style tools do not re-resolve the universe on every bump.

This plugin:

1. Reuses the engine already on disk (node_modules, native addons).
2. Fetches changed @deepseek-ai/* tarballs from the npm registry.
3. Keeps third-party deps (commander, koffi, …) when the version matches.
4. Backs up to $DSH_HOME/engine-bak and rolls back on failure.
5. Works everywhere the process is writable: Docker volume, npm -g, nvm, Windows %APPDATA%\npm, pnpm/yarn global, local node_modules, npx cache.

Install

Never dsh plugin add github:… (unpinned). Clone this repo, then add the absolute path:

git clone https://github.com/Takinggg/dsh-updater.git
dsh plugin --profile web add /absolute/path/to/dsh-updater

Windows:

dsh plugin --profile web add C:\absolute\path\to\dsh-updater

Open Settings → Updates, or the Updates control next to Settings.

Screenshots

Confirm & fetch	Success

How it works

1. Resolves @deepseek-ai/dsh by walking up from process.argv[1] (DSH_ENGINE_DIR override).
2. Reads npm dist-tags next and latest. Offers a target only if it is newer than the running engine (no accidental downgrade).
3. Backup → $DSH_HOME/engine-bak.
4. Stage on $DSH_HOME/update-stage (never Docker /tmp tmpfs).
5. Incremental tarballs into $DSH_HOME/update-cache. Registry Accept: application/json (avoids npm 406 on version URLs). npm view / npm pack fallbacks for odd registries.
6. Overlay, optional npm rebuild for native addons that actually changed.
7. Restores the dsh PATH shim when the install is a classic npm global prefix.
8. Docker / PID 1 / DSH_ENGINE_PERSIST=1: process exits 0 so Compose restarts it. A success popup is shown after reload.
9. Laptop: you quit DSH and start it again. The UI does not kill your session.

incremental-tarballs @deepseek-ai/dsh@<version> --reuse-engine --stage $DSH_HOME/update-stage

Config

Honors npm_config_registry, scoped npm_config_@deepseek-ai:registry, NPM_TOKEN / NODE_AUTH_TOKEN for private registries.

Security

• Host RPC requires { confirm: true } before install.
• Target must be a published next or latest dist-tag.
• No sudo, no live npm -g into a Docker engine volume (that can empty the prefix).
• Tarball paths are checked against traversal.
• Auto-rollback from engine-bak if verify fails.

Development

npm test
npm run demo

Node 20+. Zero runtime dependencies.

Disclaimer

Community plugin — not official DeepSeek software. DeepSeek and DeepSeek Harness are marks of their owners. This repo only installs versions already published on npm as @deepseek-ai/dsh.

License

MIT