v0.4.0 — post-upgrade duplicate detection and known-good rollback

Verified against dsh 0.1.2-rc.1.

The bug this release exists for

duplicate-modules was blind to the state a dsh upgrade creates. The check only failed on profile-local copies whose version matched the global install, so once the global tree moved to a new release, every stale @deepseek-ai/* copy landed in the by-design bucket. On a real machine the web profile held 15 of them — @deepseek-ai/cordis included — and the scan printed No problems found. for exactly the module-identity split the tool exists to catch.

scanProfile now separates a diverged harness copy from an ordinary library whose version differs, and relinks the former onto the global version (naming each version move; restore reverses it). A copy from another release line is reported but not offered as fixable — that one needs the profile reinstalled.

doctor repairs

The doctor action is now an alias for fix, not status. dsh doctor is what you reach for when dsh is broken, so it has to leave it working rather than print a diagnosis. status remains the read-only default. This is a breaking CLI change — health checks should name status explicitly.

Roll back to the last configuration that worked

Three of the five checks are report-only because the tool cannot know what a damaged config was meant to say. It can know what it used to be: a repair run that ends healthy records settings.yaml and the profile's cordis.patch.yml, and dsh doctor rollback puts the most recent snapshot back. That recovers a settings.yaml that no longer parses, a default model naming a model that does not exist, or a hand-edited cordis.patch.yml.

~/.dsh/.credentials.yaml is never snapshotted. This tool reads credential key names and never their values, and copying a plaintext key store around to enable a rollback would trade that discipline for a small convenience — so a provider with a missing API key stays report-only.

Settings page

Two theme bugs, both invisible until you looked for them:

• --dsw-alias-state-warning-primary is not a host token (it is state-warn-primary). The invalid variable resolved to nothing, so the warning dot and the card's accent border rendered invisible in both themes — and both agent-default-model and api-key report at warning severity.
• Text on a brand fill was a literal #fff. --dsw-alias-brand-primary is near-black in light mode and near-white in dark mode, so the selected detection-mode chip's label was white on white and disappeared.

The page is now fully bilingual through the host locale service, and it can undo: restore and rollback are Remote endpoints and action-bar buttons.

Also

• peerDependencies accept the whole @deepseek-ai/dsh-typert-protocol 0.1.x line instead of pinning a release no dsh ships; the devDependency and lockfile move to 0.1.2-rc.1.
• Running-process detection matches the dsh executable rather than any command line containing dsh, so the restart note no longer names the shell running the repair.

149 tests, tsc --strict clean, end-to-end against a booted dsh web.

Full notes: CHANGELOG.md