[Bug] koffi pinned to exactly 3.1.1, which has no Android prebuild — every session resume fails on Android since 0.2

[zexadev]

What happens

Seven packages pin koffi to the exact version 3.1.1:

packages/fs/fs-local                      "koffi": "3.1.1"
packages/host/directory-picker-native     "koffi": "3.1.1"
packages/sandbox/sandbox-windows-acl      "koffi": "3.1.1"
packages/session/session-persistence-jsonl "koffi": "3.1.1"
packages/subprocess/subprocess-local      "koffi": "3.1.1"
packages/subprocess/win32-process         "koffi": "3.1.1"
apps/desktop                              "koffi": "3.1.1"

koffi ships its native code as per-platform optional packages, and @koromix/koffi-android-arm64 exists only from 3.2.1 onward (koffi changelog, 3.2.1, 2026-09-04: "Add Android ARM64 prebuild"). koffi 3.1.1's optionalDependencies list linux / freebsd / openbsd / win32 / darwin and no android at all.

So npm install @deepseek-ai/dsh --os=android --cpu=arm64 produces a tree with koffi present but no loadable binding, and anything that touches koffi fails at runtime:

resume failed for session "session-…": Error: Cannot find the native Koffi module; did you bundle it correctly?

In practice that means every session resume fails, so not a single message can be sent.

Why it only showed up recently

dsh 0.1.5-rc.2 declared koffi: ^3.1.0, which resolves to 3.3.x — android prebuild included, everything works. 0.2.0-rc.2 switched to the exact 3.1.1, and the android binding disappeared from the tree. Nothing in the install or build output says anything; the failure only appears at runtime on the first session resume.

Suggested fix

Move the pin to a range that includes an android prebuild, e.g. ^3.2.1 or ^3.3.0. Everything between 3.1.1 and 3.3.0 is additive or a bugfix per the koffi changelog — 3.2.0 (errno/GetLastError in async callbacks, shared bytecode for callbacks, ARM32 ABIs restored), 3.2.1 (android prebuilds), 3.3.0 (ppc64 ELFv2, OpenBSD arm64 prebuild, endianness fix for typed arrays) — no breaking change in that window.

If the exact pin is deliberate, @koromix/koffi-android-arm64 could instead be added to the platform matrix you resolve against, so an android install at least fails loudly at install time rather than silently producing a tree that cannot lock a session.

Measured

Redmi 23113RKC6C, Android 16, arm64. With dsh 0.2.0-rc.2 and koffi 3.1.1 the tree has no @koromix/koffi-*-android-* package and every resume fails with the message above. Overriding koffi to 3.3.0 — the same version 0.1.5-rc.2 resolved to on its own — brings @koromix/koffi-android-arm64/android_arm64/koffi.node into the tree, and sessions resume, messages send, and attachments ingest normally. No other change.