[Idea] Long-run reliability: version pinning, stuck-tool timeouts, and power assertions while sessions are active

[nanami-0713]

Summary

We run dsh web for long unattended agent work (hours-long tasks, phone-side supervision). Three reliability gaps keep biting; we currently patch each with a community plugin or wrapper, and each feels small enough upstream to benefit every long-task user.

1. Version pinning as a first-class citizen

Today npx @deepseek-ai/dsh resolves latest before any plugin or config can intervene, so a broken release replaces a working one with no chance to intervene; in our history one update changed on-disk structures such that downgrading could no longer read what had been written. Our current defenses are unofficial: a shell wrapper that pins the version via a ~/.dsh/pinned-version file, plus a plugin that selects the launcher version for our desktop shell.

Asks:

• an official pin — e.g. dsh pin <version> writing a well-known file that the documented launch command respects, with clear upgrade/dsh unpin paths;
• data-format version markers in session/storage files, migrations on upgrade, and a warned (or refused) downgrade when formats differ.

2. Stuck-tool timeouts and session hygiene

A session can hang forever on a tool/call that never sees a matching tool/result. We run a watchdog that auto-cancels only a whitelist of should-be-fast operations and otherwise warns — the whitelist exists because there is no per-tool timeout to configure outside MCP (toolCallTimeoutMs exists for MCP servers, which is great; host and plugin tools have no equivalent).

Asks:

• a general per-tool or per-bundle timeout config with a sane default and an opt-out for long-running tools;
• dsh session list --stuck (sessions with pending unanswered tool calls older than N minutes) and dsh session cancel <id> in the CLI, so watchdogs do not need raw API access at all.

3. Power assertions while sessions are active

On macOS, closing the lid suspends dsh web mid-task; caffeinate only blocks idle sleep, not the hardware lid event. Our keep-awake plugin shells out to pmset -a disablesleep 1 — effective, but blunt: global, system-wide, and easy to forget in the on state.

Ask: an opt-in "keep awake while sessions are running" setting that holds a power assertion only while sessions are active (equivalents: Electron's powerSaveBlocker, macOS IOPMAssertion) and releases when idle. Scoped assertions beat global disable-sleep for everyone.

All three exist today as community workarounds on our side; happy to share implementation details for any of them.

Environment

macOS 15.5 arm64; dsh 0.1.x; long-running web profile with watchdog + remote supervision.

[nanami-0713]

Evidence update (2026-09-23): §1's risk model materialized at scale this week

0.1.7-alpha.1/alpha.2 shipped 2026-09-22, and the tracker is now living through exactly the failure mode this post asks to prevent — updates replacing working setups with no chance to intervene. Individually each item below is "just a bug report"; together they describe one systemic gap:

Half-published releases break the documented launch path outright. Tag dsh-v0.1.5-rc.3 exists but its release was never published; npx @deepseek-ai/dsh now fails with ETARGET on @deepseek-ai/dsh-client-ui-sidebar-documentpreview@0.1.5-rc.3 (#7465, #7500), alongside "every 0.1.5-rc.* is uninstallable" (#7448).

Broken boots take settings with them — the exact "data-format markers + migration + warned downgrade" gap from the original ask: a failed startup still consumes settings.yaml, permanently losing legacy sections (#7534); the legacy import renames the file before importing sections, so a failed import silently loses all settings (#7453); settingsScope was silently removed and third-party plugins hang with a misleading client-half failed error (#7445). The community is now directly asking for a migration tool for destructive updates (Poll: #7492).

Source-start dual-copy identity bugs — the two-module-copies-in-one-process family that a pinned, installed version sidesteps entirely: a bare Symbol(...) scheduler key makes src-plane and lib-plane copies mutually invisible, so agent-loop tool scheduling reads undefined (#7449); read-only error.stack assignment throws and breaks plugin metadata resolution across all plugins under tsx (#7476, #7528, #7533).

(Same-week clean-install failures beyond pinning, for completeness: dsh-sandbox-local unresolved on clean install, #7542; desktop shell missing bundled peer @deepseek-ai/cordis, #7506.)

Context for scale: 2026-09-22→23 added a record ~140 discussions in a single day, and the recurring theme is not any single bug but "an update I did not choose broke a working setup". An official dsh pin <version> respected by the documented launch command would have been the single most effective mitigation for a large fraction of this week's reports.

---

中文摘要:0.1.7-alpha 风暴把原帖 §1 的风险模型变成现实——半发布的 rc.3 导致 npx 直接 ETARGET(#7465/#7500/#7448);失败启动仍消费 settings.yaml 且 legacy 段永久丢失(#7534/#7453/#7445);源码启动双副本身份不一致(#7449,#7476/#7528/#7533)。官方 dsh pin + 数据格式标记 + 拒绝危险降级,是本周大多数事故的共同缓解;社区已在 Poll #7492 直接要求迁移工具。