dsh-plugin-prompt-guard

A dsh web plugin (desktop + mobile) that keeps pending permission/approval and multiselect prompts visible and reachable.

Install

From GitHub

dsh plugin --profile web add github:davidgereb/dsh-plugin-prompt-guard

Then add the loader row to the profile patch file ($DSH_HOME/profiles/web/cordis.patch.yml):

- insert:
    - id: ui-prompt-guard
      name: dsh-plugin-prompt-guard
      config:
        ntfyTopic: your-ntfy-topic     # see Configuration below
        ntfyToken: ""
        cooldownSec: 5

Root-cause patch. The plugin's main fix rewrites the served dsh-client-runtime bundle so Session#resync() no longer clears pending waits. That patch is applied to the installed runtime copies by scripts/patch-client-runtime.mjs — run it after installing (and after any dsh upgrade that re-serves the runtime bundle):

node scripts/patch-client-runtime.mjs        # idempotent; --revert to undo

From a local checkout

node scripts/build-client.js
node scripts/patch-client-runtime.mjs        # idempotent; --revert to undo
dsh plugin --profile web link /path/to/dsh-plugin-prompt-guard
# + register the loader row in cordis.patch.yml (see above)

Host-half changes need a dsh server restart; browser-bundle changes (client.js and the runtime patch) reach the GUI on a page refresh.

The problem

Permission requests (allow/deny), ask_user_question answers, and plan reviews render from the session's pending waits. On every connection reset (mobile networks, browser backgrounding, flaky desktop connections) the app's Session#resync() cleared the pending-wait list and relied on a host replay over the mux to re-mint the cards — which does not always happen. Result: a prompt you never answered silently disappeared.

What it does

Three layers, from root cause outward:

1. Root-cause fix (patched dsh-client-runtime). The served dsh-client-runtime bundle no longer clears this.pending in . Pending waits now survive reconnects, so the card . The host baseline replay re-mints the same rpcIds and is a keyed by , so the replay is a duplicate-free no-op; when the replay is missing the card simply stays. Applied by to both installed copies (byte-exact, reversible).