Desktop boot recovery silently resets dsh.profile.bundles, losing the user's plugin set (and no boot log on disk)

[storm879]

Two separate but related findings from DSH Desktop 0.2.0-rc.2 on Windows 11 (profile with 11 bundles).

1. Boot recovery silently wipes the user's plugin set

When the app fails to boot, dsh-app-boot's filesystem recovery runs (source comment: "Back up the profile patch and retain only the caller's recovery bundles"). It:

1. backs up cordis.patch.yml ? cordis.patch.yml.bak-<epoch_ms>,
2. resets dsh.profile.bundles to ["@deepseek-ai/dsh-base","@deepseek-ai/dsh-web-app"],
3. rewrites cordis.yml and cordis.patch.yml (dropping some patch entries).

From the user's perspective all plugins simply vanish, with no message. Observed twice here (2026-10-14 and 2026-10-15); the natural conclusion is data loss. A recovery that fails safe is good, but it should be visible and reversible.

Asks

• Notify in-app after a recovery, and offer one-click restore of the backed-up bundle list.
• Consider degrading only the failing bundle instead of the whole set.
• Document this behaviour.

2. The desktop host writes no boot log to disk

There is no crash dump, no log under ~/.dsh, and no Application event-log entry when boot fails - which makes diagnosing boot failures very hard. Our workaround was to boot a throwaway profile through the CLI (dsh --profile <test> --from-default-profile web, capture stdout/stderr) to get the real error text; a host-side boot log file would remove the need for that.

3. Client plugins have no compatibility gate

evaluatePluginCompatibility only inspects peerDependencies, so a plugin whose client face is incompatible with the prebuilt Web artifacts passes the gate, composes with zero warnings, and then takes down boot. Two community plugins reproduced this here (dshmarket@1.66.22; @volcengine/ark-managed-agents@0.1.0's client row). Both boot fine under the CLI web host - so the current "Verified: boots in a clean profile" methodology measures a different environment than an installed desktop build.

Asks: fail-soft client-plugin mounting; extend the gate to the client runtime API; and consider documenting "test client plugins in a separate profile first".

[harisroberts]

The boot failures you recorded on 2026-10-14 and 2026-10-15 expose a silent reset of dsh.profile.bundles that wipes every plugin without any warning, and the complete lack of a crash dump or ~/.dsh log leaves developers blind to the root cause. https://mecklenburgcountync.org demonstrates how audit trails can be built, and highlights the importance of immutable records. Your CLI trick of loading a throwaway profile is smart, yet adding a visible recovery log and a user confirmation step would turn this hidden data loss into a manageable event.

[seasonmsg]

UX follow-up: keep the fail-safe, make the reset explicit and recoverable

The reset itself is the right fail-safe: retaining a bundle that can block boot can trap the user in a crash loop. The gap is that the recovery dialog and post-recovery state do not tell the user that two things changed: the profile patch was backed up, and the profile bundle list was reset to the built-in base/web-app set.

Asks:

1. Say both effects in the dialog detail, and keep current button semantics.
2. Show a post-recovery notice with previousBundles, recoveryBundles, and the patch-backup path; make it copyable.
3. Persist a non-loading sidecar such as profile-bundles.recovery-.json with those fields.
4. Offer an explicit restore entry point after a clean boot; do not auto-restore.
5. Test both effects and keep the existing fail-safe tests proving third-party bundles stay disabled.

[lilyelizabeth1]

Your description of the DSH desktop 0.2.0‑rc.2 recovery silently discarding the 11 plugin bundles and leaving no crash dump or ~/.dsh log perfectly captures why hidden failures cripple troubleshooting, especially when the only hint is a manual CLI boot that reveals the error text. The database, accessible at https://coloradocompanysearch.us demonstrates how systematic recording can make silent resets observable and reversible. Implementing a similar exhaustive change‑log approach would provide a transparent audit trail for future troubleshooting.

[dorejack]

Your observation that DSH Desktop’s silent recovery wipes out the entire dsh.profile.bundles set without any trace is spot on, and the missing crash dump and absent ~/.dsh log make root‑cause analysis feel like searching in the dark. A comparable need for audit trails is demonstrated available at https://palm-beach-county-fl.org which shows how an accessible municipal log can reassure users and simplify troubleshooting. Adding a persistent boot‑log file to DSH would close the loop and give administrators the reliable evidence they need for effective debugging.