dsh-model-pin

On a machine that can only keep one local model loaded, DeepSeek Harness still lets every chat and background helper pick its own. Each stray request either fails outright or evicts the loaded model, triggering minutes of reload and wiping the prompt cache. Subagents add a subtler trap: they inherit the model locked in when their parent session was created, not the one actually in use, so they silently land on stale or wrong routes.

dsh-model-pin injects an allow-list into the internal resolution layer of dsh (the agent/request waterfall). Every request from every session is checked against the list at step boundaries: subagents, retries, session-title and compaction calls. A request that falls outside the allowed set is either redirected to a fallback or rejected with a clear, human-readable message. Providers you never configure are left entirely untouched, and persisted session data is never rewritten.

If you run a single local model via llama.cpp and want to keep it loaded, or work in headless and CI pipelines where a rogue subagent must not quietly swap models, dsh-model-pin is a config-first, restriction-focused guard. It is deliberately not a router: cross-provider redirection is out of scope for v1, and the web model picker still shows the model you clicked even when the pin silently redirects the request to the fallback.