Desktop app bricks itself with "Web authentication failed" after ~70 launches (auth cookie accumulation vs 16 KiB header limit)

[7gzgn]

Version: 0.2.1-rc.2 (desktop app, Windows 11)
Symptom: after many app restarts the desktop window stays blank and the crash log shows:
Error: desktop welcome: Web authentication failed at connectDesktopWelcome (.../resources/app/lib/main.js:8935)

Root cause (three official behaviors combining):

1. dsh-desktop-host spawns the host with --port 0 -> a random port on every launch.
2. dsh-client-connection names the auth cookie dsh-auth- + base64url(sha256(authority)), where authority is 127.0.0.1:<port>. A new random port therefore creates a new cookie name; old cookies are never overwritten or cleaned.
3. dsh-host-webserver calls createServer(listener) without maxHeaderSize, so Node's default 16 KiB header limit applies.

Each launch adds ~228 bytes to the Cookie: header. After ~71 launches the header alone is 16,186 bytes; with Host/UA/sec-fetch headers it exceeds 16,384 -> the server answers 431 -> connectDesktopWelcome gets a non-OK response -> "Web authentication failed" -> blank window. Retrying adds another cookie, so the failure is self-reinforcing.

Evidence (measured on a live machine):

• 71 dsh-auth-* cookies in %APPDATA%\@deepseek-ai\dsh-desktop\Network\Cookies
• Cookie: header = 16,186 bytes
• 431 observed above 16,384 bytes total header size; 401 below it
• after deleting the 71 cookies and restarting, the window works again

Suggested fixes (any one is enough):

• clear stale dsh-auth-* cookies for the same host on host start, or
• bind the cookie name to host only (not host:port), or
• pass an explicit maxHeaderSize in dsh-host-webserver.

Happy to provide logs or a minimal repro (kill + launch the desktop app ~71 times).