Crashes after 70 startups

[DanIsaksson]

I encountered an issue with the app crashing automatically after reaching 70 restars.

time: 2026-11-06T18:11:33.478Z
source: host
phase: startup
app: @deepseek-ai/dsh-desktop 0.2.1-rc.5
platform: win32 x64
electron: 44.7.0
node: 24.21.0
locale: en
shell pid: 12480

--- error ---
Error: desktop welcome: Web authentication failed
at connectDesktopWelcome (file:///,,,/DeepSeek%20Harness/resources/app.asar/lib/main.js:8886:31)
at async Object.start (file:///,,,/DeepSeek%20Harness/resources/app.asar/lib/main.js:12195:22)
at async file:///,,,/DeepSeek%20Harness/resources/app.asar/lib/main.js:7162:5
at async file:///.../DeepSeek%20Harness/resources/app.asar/lib/main.js:12313:4

--- renderer console (error level, oldest first) ---
(no error-level renderer console output was captured)

--- DETAILS BY CLAUDE ---

Desktop fails at startup with "desktop welcome: Web authentication failed" (HTTP 431 from accumulated dsh-auth-* cookies)

Version: @deepseek-ai/dsh-desktop 0.2.1-rc.5, Windows 10 x64 (Electron 44.7.0)

Symptom: After a few weeks of normal use the desktop app started failing on every launch with:

Error: desktop welcome: Web authentication failed
    at connectDesktopWelcome (app.asar/lib/main.js:8886:31)

Resetting the profile (cordis.patch.yml, bundles) did not help.

Cause: Each launch, the Desktop Host listens on a new random port and sets a cookie named dsh-auth-<sha256 of "127.0.0.1:<port>">. Cookies are scoped by host, not port, so every earlier cookie is still sent to 127.0.0.1 on later launches, and each stays valid for its max-age. After about 70 launches the Cookie header reached ~16 KB, which exceeds Node's default maxHeaderSize. The Host then answers the /?token=… request with 431 Request Header Fields Too Large, and connectDesktopWelcome reports that as an auth failure.

Confirmed with --log-net-log: the token request carried 71 dsh-auth-* cookies (16,094-byte Cookie header) and got HTTP/1.1 431.

Workaround: Close the app and delete the stale cookies from %APPDATA%\@deepseek-ai\dsh-desktop\Network\Cookies (SQLite):

DELETE FROM cookies WHERE host_key = '127.0.0.1' AND name LIKE 'dsh-auth-%';

(Deleting the whole Cookies file also works but drops any other cookies.) The app starts normally afterwards.

Possible fixes:

• Use a fixed cookie name (or a stable/persisted port) so each launch overwrites the previous cookie instead of adding one.
• Or clear old dsh-auth-* cookies for the loopback host before authenticating.
• Report a 431 from the Host as what it is rather than "Web authentication failed".

---

[klaus-2]

I had the same problem, my agent managed to create a temporary cleanup fix for the deployment routine