dsh-model-pin
A DeepSeek Harness plugin for machines that cannot afford model roulette: keep every model request inside an allowed set per provider, redirect the rest to a fallback (or refuse them), and get a warning whenever a request would make a llama.cpp router reload models.
The problem it fixes
dsh lets every chat pick its own model, and background helpers can request yet another one. On a machine that can only keep one local model loaded, each stray request either fails or evicts the loaded model: minutes of reloading, prompt cache gone (discussion #3199). Worse, subagents inherit the model their parent session was CREATED with, not the one it currently uses, so they quietly land on stale or wrong routes (#455, #1581).
dsh-model-pin enforces an allow-list at dsh's own resolution layer (the agent/request waterfall, whose documentation calls returning a replacement "the sanctioned switch path"). Every request from every session is resolved against the list at step boundaries: subagents, retries, and, once the pinned route is logged, session-title and compaction calls too. Persisted session data is never rewritten.
Install
dsh plugin --profile web add dsh-model-pin
Then in ~/.dsh/profiles/web/cordis.patch.yml:
- id: model-pin
config:
providers:
llamacpp:
allow: [qwen3.8-q4-long, qwen3.8-fast] # a one-entry list = single-model mode
fallback: qwen3.8-q4-long # default: the first allowed entry
action: redirect # redirect (default) | reject
warnOnSwitch: true
Unconfigured providers are never touched.
What it looks like
model-pin: llamacpp session=059a680f turn 3 redirecting qwen3.8 -> qwen3.8-q4-long (not in allow)
model-pin: llamacpp model switch qwen3.8-q4-long -> qwen3.8-fast (a --models-max 1 router reloads now; the previous model's prompt cache is lost)
With action: reject, a disallowed request fails the turn with a clear message instead (model-pin: model "x" is not in the allowed set for provider "llamacpp" (allowed: ...)), and dsh's retry never loops on it.
What you should know
- The web model picker does not know about the pin: it may keep displaying the model you clicked while every request actually runs on the fallback. The redirect line in the terminal (or /logs, if dsh-logbook is installed) shows what actually ran.
- The pin has the last word over the picker because it registers at profile load, before any agent exists (first-registered waterfall listeners are outermost in cordis). Another root plugin loaded before this one could still override it.
- The switch warning is observation only; it cannot block a reload. Pair it with a one-entry allow-list if you want reloads gone entirely.
- Cross-provider redirection is out of scope for v1: requests for a provider you did not configure pass through, including a subagent stuck on a deleted provider.
- Related work: dsh-model-switch is the opposite personality: a polished per-role model router with web UI panels, deliberately without global enforcement. dsh-model-pin is config-first, headless-friendly, and about restriction, not routing.
License
MIT
