[Bug] profiles/node_modules 直接 npm install 会清空依赖树；多实例 EADDRINUSE；npm 11 allow-scripts 文档缺失

[Airmetro]

环境：Windows 11, Node.js v24.19.0（便携版，npmmirror 源）, dsh @deepseek-ai/dsh 0.1.0-rc.6（开发者预览版） 日期：2026-08-15 ~ 08-16

1. 在 $DSH_HOME/profiles/node_modules 执行 npm install 会清空整个运行时依赖树，且服务不自愈
   一句话说明：在无 package.json/lockfile 的 profiles 依赖树里执行 npm install ，npm 会把全部运行时依赖视为 extraneous 并删除（实测 510+ 包），服务重启报 ERR_MODULE_NOT_FOUND 且不自愈。

复现、预期与验收

复现步骤：

正常部署 dsh（npm 全局安装 + dsh web 启动一次，使 $DSH_HOME/profiles/node_modules 具备完整运行时依赖：express、koffi、node-pty 等）；
在 $DSH_HOME/profiles/node_modules 目录直接执行 npm install @some/plugin（该目录无 package.json / package-lock.json）；
观察 npm 输出：把整棵依赖树视为 extraneous 并 prune；
重新执行 dsh web。
实际结果：

profiles/node_modules 下 510+ 个运行时包被删除（express、koffi、node-pty、dsh-update-checker 等）；
启动失败：Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'dsh-update-checker' imported from C:\Users\Administrator.dsh\profiles\web\；
服务不会自动从部署侧重新同步缺失包，只能手动 robocopy 恢复。
预期结果：

提供官方安全安装入口（如 dsh plugin add ），内部以安全方式安装，不触碰既有依赖；
或启动时检测 profile 依赖树不完整，自动从部署侧（/node_modules）恢复；
或至少在文档中明确警告：禁止在 $DSH_HOME/profiles/node_modules 直接执行 npm install。
验收条件：在无 package.json 的 profiles 目录执行安装命令不会删除既有包；或服务能自动恢复。

2. 多实例无保护：已有实例时再次 dsh web 抛裸 Node 堆栈 一句话说明：服务已运行时再次执行 dsh web，直接抛 EADDRINUSE Node 堆栈，而非友好提示。

复现、预期与验收

复现步骤：

启动 dsh web（HTTP 200，监听 127.0.0.1:3080）；
不退出，再次执行 dsh web。
实际结果：进程崩溃，输出裸 Node 堆栈：

复制
Error: ... listen EADDRINUSE: address already in use 127.0.0.1:3080
预期结果：检测到端口被本程序占用时输出友好提示（如 "dsh 已在运行，访问 http://127.0.0.1:3080"）并正常退出；或支持单实例锁（pid/lock 文件），第二次启动自动打开已有实例界面。

验收条件：重复启动不抛裸堆栈，给出可读提示；或自动复用已有实例。

3. npm 11 的 allow-scripts 默认拦截原生依赖安装脚本 一句话说明：npm install -g @deepseek-ai/dsh 在 npm 11.x 下默认禁止安装脚本，koffi/node-pty 等原生组件未构建导致运行异常，文档未说明。

复现、预期与验收

复现步骤：

使用 npm 11.x；
执行官方安装命令 npm install -g @deepseek-ai/dsh；
启动 dsh web。
实际结果：koffi / node-pty / dsh-subprocess-local 的原生组件未构建（npm 11 默认 allow-scripts=false），运行异常；必须显式补装：

sh
复制
npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty,@google/genai,protobufjs @deepseek-ai/dsh
预期结果：官方 README/安装文档补充 npm 11 的 allow-scripts 说明；或发布包配置 trustedDependencies 减少手工步骤。

验收条件：按官方命令安装后可直接运行；或文档明确给出 npm 11 的完整安装命令。

4.（附带）bun 无法运行 dsh：需 Node ≥ 22.6 但无版本检测提示 一句话说明：用 bun 执行 bun x @deepseek-ai/dsh web 报 node:module 无 stripTypeScriptTypes 导出，启动无 Node 版本检测提示。

复现、预期与验收

复现步骤：在仅有 bun（1.3.x）的环境执行 bun x @deepseek-ai/dsh web。

实际结果：Export named 'stripTypeScriptTypes' not found in module 'node:module'——dsh 依赖 Node.js ≥ 22.6 的 node:module.stripTypeScriptTypes，bun 不兼容。

预期结果：启动时检测 Node 版本，明确提示需要 Node ≥ 22.6（而不是裸的模块导出报错）。

验收条件：不支持的运行时下给出可读版本提示。

[zoahdev]

All four are accurate, and #1 is the most damaging because it's silently destructive. Mapping each to the concrete fix surface:

1. npm install inside profiles/node_modules prunes the runtime tree (no self-heal)

You're right about the mechanism: with no package.json/lockfile, npm treats every installed package as extraneous and prunes it, and healProfilesModuleFallback only re-links the fallback symlinks — it does not re-populate a pruned runtime tree. The durable fixes, in order:

1. Make dsh plugin add the only supported install path and reject/harden against a bare npm install in the profile dir (document the prohibition loudly).
2. On boot, detect an incomplete profile tree (a known runtime package such as dsh-update-checker missing) and re-sync from the deployment anchor instead of failing with ERR_MODULE_NOT_FOUND.

I can ship a profile-deps tripwire in dsh-plugin-doctor (detect "pruned tree" before boot) and a docs warning immediately; the boot self-heal is an upstream patch I can prepare.

2. EADDRINUSE raw stack

Correct — the listen error is not special-cased. Clean upstream patch: catch EADDRINUSE, print dsh is already running on http://127.0.0.1:3080 and exit 0 (or open the existing URL). Low-risk, CLI boot only.

3. npm 11 allow-scripts blocks native builds

Accurate: npm 11 defaults allow-scripts=false, so koffi/node-pty/dsh-subprocess-local never build. Two fixes: document the full --allow-scripts= install command (I maintain a community install/troubleshooting doc and can add it today), and/or publish trustedDependencies in the npm manifests. A dsh-plugin-doctor "native modules built" check (probe koffi/node-pty load) catches this after install.

4. bun / old Node fails with a bare module error

Correct — node:module.stripTypeScriptTypes needs Node >= 22.6. A startup version gate that prints "DeepSeek Harness requires Node.js >= 22.6 (running )" is a small, clean patch.

Net: I'll take #2 and #4 as cherry-pick-ready branches (CLI boot, low risk), add the #1/#3 tripwires to dsh-plugin-doctor, and put the npm-11 install command in the community docs. If you'd rather see a specific one first, say which.

[zoahdev]

Delivered the tooling + docs half; the two CLI patches are next.

Now available:

• dsh-plugin-doctor v1.14.0 adds two --profile tripwires:
  • profile-deps — flags a pruned runtime @deepseek-ai scope (issue 1) before the next boot.
  • native-modules — flags missing koffi/node-pty (issue 3, npm 11 allow-scripts=false).
  • Release tarball: https://github.com/zoahdev/dsh-plugin-doctor/releases/tag/v1.14.0
• Community troubleshooting doc covers all four: profile-prune recovery, the exact --allow-scripts= install command, the Node >= 22.19 floor (bun unsupported), and the EADDRINUSE workaround:
  https://github.com/zoahdev/dsh-docs/blob/main/docs/troubleshooting.md

Still on my list: the two upstream CLI patches — a friendly single-instance message on EADDRINUSE (issue 2) and a startup Node-version gate (issue 4). Both are boot-path changes I'll prepare as cherry-pick-ready branches against 47f943859b; I'll drop links here when they land.

[zoahdev]

One of the two CLI patches is down:

• Node/bun gate (issue 4) — zoahdev/deepseek-harness@fix/node-version-startup-gate, cherry-pick-ready against 47f943859b. Unsupported runtimes now print dsh: DeepSeek Harness requires Node.js ^22.19.0 || >=24.0.0 (running <ver>)... instead of the bare stripTypeScriptTypes export error. apps/cli runtime-check + args specs green.

Remaining: the friendly EADDRINUSE single-instance message (issue 2). I'll prepare that branch next.

[zoahdev]

Both CLI patches are now down. All four issues have a concrete answer:

• #1 profile prune: dsh-plugin-doctor v1.14.0 profile-deps tripwire + recovery steps in the community troubleshooting doc.
• #2 EADDRINUSE: zoahdev/deepseek-harness@fix/webserver-eaddrinuse-message (cherry-pick-ready against 47f9438): now prints dsh web is already running: <host>:<port> is in use... instead of a bare stack.
• #3 npm 11 allow-scripts: full --allow-scripts= install command documented; dsh-plugin-doctor v1.14.0 native-modules tripwire flags missing koffi/node-pty.
• #4 Node/bun floor: zoahdev/deepseek-harness@fix/node-version-startup-gate: readable requires Node.js ^22.19.0 || >=24.0.0 message before boot.

Thanks for the thorough report - the repro detail (especially the prune mechanics and the exact npm-11 behavior) made the fixes land clean.