npm 12 silently skips install scripts, dsh web dies with "Failed to load native module: pty.node"

[tobenot]

I ran into this right after the release and spent a while on it, so posting the full story in case it saves someone the same detour. If you're here because dsh web fails with Failed to load native module: pty.node and your npm is 12.x, read on.

$ npm install @deepseek-ai/dsh
# installs fine, no errors at all

$ dsh web
Error: dsh: plugin tree failed to load: failed to apply loader entry include (cordis:include):
failed to import loader entry subprocess (@deepseek-ai/dsh-subprocess-local):
Failed to load native module: pty.node, checked: build/Release, build/Debug,
prebuilds/linux-x64: Error: Cannot find module './prebuilds/linux-x64//pty.node'

The install succeeds, and the failure only shows up at first launch. That's the confusing part. What happened: npm 12 no longer runs install scripts of dependencies unless they're explicitly approved. trustedDependencies is dead in npm 12; the replacement is an allowlist that gets written into package.json as allowScripts. DSH pulls in several packages that need their scripts to do real work:

• node-pty (1.1.0) - its install script compiles the native module. The published tarball only ships prebuilds for darwin and win32, no linux-x64 (covered in dsh web fails on Linux: node-pty native module pty.node missing (no linux-x64 prebuild, no build fallback) #605), so on Linux the script has to build from source. Script skipped -> no pty.node -> the error above.
• koffi (3.1.4) - install script grabs its native binary.
• @deepseek-ai/dsh-subprocess-local - postinstall generates a spawn helper.
• @google/genai - prepare script does SDK setup.
• protobufjs (7.6.5) - postinstall generates serialization code.

The fix is to approve those scripts, then rebuild:

npm install-scripts approve node-pty koffi @deepseek-ai/dsh-subprocess-local @google/genai protobufjs
npm rebuild

Approve first, then rebuild, because rebuild runs lifecycle scripts too. After that dsh web comes up fine (HTTP 200 here). Older npm (<=11) never hits this, since scripts run by default.

A note on the npx route: if you're using npx @deepseek-ai/dsh web, the install lands in a throwaway cache (~/.npm/_npx/<hash>/), and approvals from your own package.json won't apply there. Either install globally (npm i -g @deepseek-ai/dsh) and run the approve/rebuild inside the global install dir, or patch the cache directly with cd ~/.npm/_npx/<hash>/node_modules/node-pty && node-gyp rebuild, which is what worked for people in #605.

One more thing for Linux users on flaky connections: even with scripts approved, building node-pty downloads Node headers from nodejs.org, and that step can fail on a bad network. A maintainer's own log in #605 shows exactly that: "gyp ERR! Request was cancelled." If the build dies there, retry with a proxy or a headers mirror.

Related: #605, #49, #177, #835, #136, #293.