Profile plugin's stale transitive dep (@deepseek-ai/dsh-client-locale@0.1.0-rc.8) shadows bundled copy and crashes 'dsh web' boot

[JohnQsk]

Summary

A stale transitive dependency of a profile-installed third-party plugin (dsh-notify-yimit) shadows dsh's own bundled @deepseek-ai/dsh-client-locale, causing dsh web to crash at boot with a misleading error: The requested module '@deepseek-ai/dsh-settings' does not provide an export named 'settingsNamespace'.

Environment

• OS: Windows 11
• Node.js: v26.4.0
• dsh: @deepseek-ai/dsh@0.1.5-rc.2 (via npx @deepseek-ai/dsh@latest web)
• Profile: ~/.dsh/profiles/web with dsh-notify-yimit@^0.1.6 installed

Steps to reproduce

1. Install the plugin into a profile: dsh plugin --profile web install with dsh-notify-yimit@0.1.6 in the profile's package.json dependencies and listed under dsh.profile.bundles.
2. dsh-notify-yimit@0.1.6 depends on @deepseek-ai/dsh-client-locale@^0.1.0-rc.6, which resolves to the stale 0.1.0-rc.8 and gets installed into ~/.dsh/profiles/web/node_modules.
3. Run dsh web.
4. During plugin-tree loading, the loader entry locale (@deepseek-ai/dsh-client-locale) resolves to the profile's stale copy (0.1.0-rc.8) instead of the bundled 0.1.5-rc.2. That old version does import { settingsNamespace } from "@deepseek-ai/dsh-settings", an export that no longer exists in the current @deepseek-ai/dsh-settings@0.1.5-rc.2, so boot crashes.

Actual behavior

Error: dsh: plugin tree failed to load: failed to apply loader entry include (cordis:include): failed to import loader entry locale (@deepseek-ai/dsh-client-locale): The requested module '@deepseek-ai/dsh-settings' does not provide an export named 'settingsNamespace'

Deleting ~/.dsh/profiles/web/node_modules and reinstalling does not help, because the plugin's dependency range (^0.1.0-rc.6) pulls the same stale version back every time.

Expected behavior

One or more of:

• Loader entries for @deepseek-ai/* core packages resolve to dsh's own bundled copies first, so a plugin's transitive dependency can never shadow them.
• dsh plugin install detects version conflicts between a plugin's transitive @deepseek-ai/* deps and the bundled versions, and warns or aligns them.
• At minimum, the boot error should name the resolved file path and version of the conflicting package, so users can tell this is a version-shadowing problem rather than a missing export.

Workaround (confirmed working)

Pin the transitive deps in the profile's pnpm-workspace.yaml to match the bundled versions:

overrides:
  '@deepseek-ai/dsh-client-locale': 0.1.5-rc.2
  '@deepseek-ai/dsh-home-paths': 0.1.5-rc.2

After dsh plugin --profile web install with these overrides, dsh web boots normally. (Note: pnpm v11 ignores overrides in package.json; they must live in pnpm-workspace.yaml.)

Additional notes

• dsh-notify-yimit@0.1.6 is the latest published version and still depends on @deepseek-ai/dsh-client-locale@^0.1.0-rc.6, so any user installing this plugin today hits the same crash. The plugin publishes no repository/homepage on npm, so it cannot be reported upstream.

[JohnQsk]

Follow-up: a second, independent bug surfaced right after fixing the boot crash above — the sidebar session list renders completely blank.

Symptom

After dsh web boots successfully, the entire left panel (session list) is empty. Server-side data is intact (~/.dsh/sessions/ and ~/.dsh/storages/session_projcache/sessions/ all healthy), and the server keeps writing session cache normally. Hard refresh and reopening with the new token URL do not help. Browser console shows:

TypeError: Cannot convert undefined or null to object
    at Object.entries (<anonymous>)
    at retainAccountKeys (client.js:218:1)
...
slot entry crashed in 'sidebar.workspaces': TypeError: Cannot convert undefined or null to object

Root cause

@deepseek-ai/dsh-client-ui-workspace/lib/client.js persists the sidebar view store under the localStorage key dsh.workspace.view.v5. The persisted JSON from an older version contains groupExpansion: null (and/or sessionOrderByAccount / sessionUpdatedAtByAccount as null), while the current code assumes they are always objects:

retainAccountKeys: (d, workspaceKeys) => {
    const retained = new Set(workspaceKeys);
    d.groupExpansion = Object.fromEntries(Object.entries(d.groupExpansion).filter(...)); // throws when null
    ...
}

Rehydration overwrites the {} defaults with the persisted null, and the first retainAccountKeys call crashes the whole sidebar.workspaces slot, leaving the panel blank.

Workaround (confirmed working)

In the browser console on the dsh origin:

localStorage.removeItem('dsh.workspace.view.v5')

then reload — the session list comes back immediately.

Suggestion

The persist layer should validate the rehydrated shape (or run a migration / fall back to defaults when a field has the wrong type) instead of trusting stored JSON blindly, so stale persisted state from older versions can never crash the UI. A null-guard in retainAccountKeys would be the minimal fix.