dsh-update-notifier

Persistent version badge for DeepSeek Harness (dsh).

A quiet badge in the sidebar footer always shows your installed version (e.g. v0.1.0-rc.6). Clicking it opens a modal with current → latest and last-checked time: "up to date" when current, or — when npm @deepseek-ai/dsh latest is newer — a red StateDot plus copy-the-update-command / ignore / snooze actions.

This is a community plugin, not an official DeepSeek product.

How it works

• Host half (src/index.js): resolves your installed DSH version once at startup, polls the npm registry (default: first check 10s after startup, then every 6h), and serves the cached decision on GET /dsh-update-check (with an updateHint that matches your install mode: npm exec @deepseek-ai/dsh@latest web for npx-cache installs, npm install -g @deepseek-ai/dsh@latest otherwise) via the optional webServer service. Headless compositions are unaffected.
• Browser half (client/client.js): registers a persistent sidebar.footer.action slot entry rendered with the official ui-primitives (StateDot / Button / Modal). Badge states: red dot = update available, green dot = current, amber = checking / error / unknown. "Ignore" persists in localStorage until a newer version appears; "Later" hides the red dot until the next fresh check result.

Display logic

Badge — always visible in the sidebar footer (official sidebar.footer.action slot). The shell stacks footer actions above the Settings row by design; this plugin measures the Settings row height at runtime and pulls the badge onto its right side with a compensating negative margin (re-measured on wide/rail toggles). In the collapsed rail it renders as a centered dot.

Label: v<current> normally · … while the first check is pending · — when the installed version cannot be resolved.

Modal — clicking the badge opens it; content depends on the host-reported state:

One-click update — [立即更新] → confirm → the host half executes the update for your install mode:

• npx-cache installs (npm exec @deepseek-ai/dsh web): it spawns a detached npm exec --yes @deepseek-ai/dsh@latest web (fetching the new version) and exits the current process so the new server can bind the port. The page disconnects for roughly 10–60s; refresh when it comes back.
• Global npm installs: it runs npm install -g @deepseek-ai/dsh@latest and reports the result; you still restart dsh web yourself.

A restart always ends the current process — in-flight conversations survive on disk (~/.dsh/sessions).

Check cadence — host: first check 10s after startup, then every checkIntervalMs (default 6h) against the npm registry (5s timeout); browser: polls /dsh-update-check every 5 minutes and on tab focus; [立即检查] / ?force=1 re-checks immediately (2s cooldown). "Ignore this version" is stored in localStorage and lifts only when a newer version appears; "Later" lifts when the next fresh check result arrives.

Compatibility

• Verified against dsh 0.1.0-rc.5 (monorepo dev clone, full web boot + endpoint E2E) and 0.1.0-rc.6 (npm-installed, host boots, load-level headless test clean). Last verified: 2026-08-15.
• Tracks the npm latest dist-tag of @deepseek-ai/dsh, so it stays version-agnostic; no pin to a specific dsh commit is required.

Install / Uninstall

Install (npm by name, git URL, or local dir all work):

dsh plugin --profile web add dsh-update-notifier
dsh plugin --profile web add https://github.com/arvin-yd/dsh-update-notifier.git
dsh plugin --profile web add /path/to/this/repo

Uninstall / remove:

dsh plugin --profile web rm dsh-update-notifier

The plugin activates at the next dsh web start (a restart is required after install).

Quick start

1. Install into the web profile (above) and restart: dsh --profile web --port <port>.

2. Sanity-check the host half:

   curl http://127.0.0.1:<port>/dsh-update-check
   # {"state":"up-to-date","current":"0.1.0-rc.6","latest":"0.1.0-rc.6","fetchedAt":...,"error":null,"updateHint":"..."}

3. The sidebar footer badge always shows your installed version (green dot = current). When npm latest exceeds it, the dot turns red; the modal offers copy-update-command / ignore / snooze.

Config

Defaults live in cordis.patch.yml; override in $DSH_HOME/profiles/web/cordis.patch.yml:

- id: dsh-update-notifier
  config:
    checkIntervalMs: 21600000   # host re-check interval (default 6h)
    timeoutMs: 5000             # registry fetch timeout (ms)

Permissions & data

• Reads: your dsh install location (to resolve the installed version), the npm public registry over HTTPS (registry.npmjs.org — metadata only, no credentials sent).
• Writes: nothing on disk; the browser half stores only the ignored-version string in localStorage (dsh-update-notifier.ignoredVersion).
• One-click update action: only after your explicit two-click confirmation, the host runs npm commands under your user account (see "One-click update") and — for npx installs — ends the dsh process to let the new version bind the port. No credentials are read or forwarded; the update endpoint only accepts requests while an update is actually available.
• No telemetry, no analytics, no third-party calls beyond the npm registry.

Troubleshooting

• Badge never appears — expected when you are on the latest version; verify via the endpoint above (state must be update-available).
• current is null / state unknown — run dsh through its normal entrypoint (dsh web / npm exec @deepseek-ai/dsh web); the version probe walks up from the running bin, plugin directory, and enclosing @deepseek-ai/dsh* package.
• state error — registry fetch failed (offline/blocked); check the dsh host log for [dsh-update-notifier] check failed: ...; it retries every checkIntervalMs.
• Rollback — dsh plugin --profile web rm dsh-update-notifier removes the plugin.

Development

pnpm install
pnpm test

License & security

MIT. To report a security issue privately, use GitHub's private vulnerability reporting.