dsh-update-copilot

LIMITATIONS

Known limitations

- Plugin hot reload is phase-1 scoped: it covers updates whose running profile entry still exists and whose new version keeps the same `dsh.bundle.patch` and `dsh.client` declaration (this includes `link:` checkouts — node_modules points at the checkout through a symlink, so the pull takes effect on the same files the reloader reads). Bundle-patch changes, non-current profiles, and copilot self-update still ask for a `dsh` restart. - `link:` updates require the checkout to have an upstream branch configured; uncommitted changes are auto-stashed and restored after the pull, and a failed restore (stash pop conflict) needs manual `git stash list` / `git stash pop`. - Switching a `link:` to a remote source breaks the local link and there is no automatic switch back (the spec must be edited by hand). The npm-first strategy installs the registry version, which may differ from your local development checkout. - Unauthenticated GitHub API is rate-limited (60 req/h) — briefs degrade gracefully to version lists. - Raw `git+https://` specs are reported as-is without a comparison channel. - The host export check is static named imports: dynamic `import()`, APIs only reached at runtime, and `import * as ns` are not flagged. Official `@deepseek-ai/*` packages are skipped. The target pass only packs `@deepseek-ai/dsh-*` at the DSH version line; a failed pack or an independently versioned package (`cordis`, `schemastery`) is skipped rather than reported as incompatible. - The peer-range check covers the common range forms (caret, tilde, intervals, unions, wildcards, exact) with node-semver's prerelease rule; exotic range syntax reads as "cannot evaluate" and stays silent. History snapshots are best-effort — an unwritable history directory means no rollback suggestion, never a blocked update.