[Bug] STILL BROKEN 2026-08-17: dsh-tools@latest -> dsh-session@0.0.1-rc.1 -> unpublished @deepseek-ai/dsh-type-meta (404) blocks pnpm users on the default install path

[lemonhub-io]

Status correction to the earlier thread (see discussion #984): the "404 chain closed end to end" conclusion posted there does not hold for the latest dist-tag train. Verified on the npm registry today (2026-08-17):

$ npm view @deepseek-ai/dsh-tools dist-tags
{ latest: "0.0.1-rc.1", next: "0.1.0-rc.7" }

$ npm view @deepseek-ai/dsh-tools@latest peerDependencies
{ "@deepseek-ai/cordis": "^4.0.1-rc.1",
  "@deepseek-ai/dsh-llm": "^0.0.1-rc.1",
  "@deepseek-ai/dsh-agent": "^0.0.1-rc.1",
  "@deepseek-ai/dsh-scope": "^0.0.1-rc.1",
  "@deepseek-ai/dsh-session": "^0.0.1-rc.1",
  ... }

$ npm view @deepseek-ai/dsh-session@latest peerDependencies
{ ..., "@deepseek-ai/dsh-type-meta": "^0.0.1-rc.1", ... }

$ npm view @deepseek-ai/dsh-type-meta
404 Not Found - GET https://registry.npmjs.org/@deepseek-ai%2fdsh-type-meta

The broken chain: dsh-tools@0.0.1-rc.1 (what latest resolves to) peers dsh-session@^0.0.1-rc.1, which still peers the unpublished @deepseek-ai/dsh-type-meta. npm skips it gracefully; pnpm auto-installs peers and hard-fails with ERR_PNPM_FETCH_404.

This is the default path for community plugin authors: CONTRIBUTING.md points them at installing from npm, and any plugin depending on @deepseek-ai/dsh-tools (no version) hits it. The ^0.1.0-rc.6 pinning workaround only works while next stays at 0.1.0-rc.x.

Verified workaround for plugin authors (pnpm):

# pnpm-workspace.yaml
overrides:
  "@deepseek-ai/dsh-type-meta": "npm:@deepseek-ai/dsh-invariants@0.0.1-rc.1"

Suggested upstream fix (either one closes it):

1. Point the latest dist-tag of @deepseek-ai/dsh-session (and dsh-tools) at the current 0.1.0-rc.x train, as was already done for @deepseek-ai/dsh itself; or
2. Publish @deepseek-ai/dsh-type-meta (or drop the peer).

The peer declaration chain looks accidental either way, but the latest train has now been broken for a week and the only reason community plugins install at all is manual pinning or the override above.

[tianhao8687]

刚用 npm registry 重新验证（2026-08-18），这个问题仍然存在：

• @deepseek-ai/dsh@latest 已是 0.1.0-rc.7；
• @deepseek-ai/dsh-tools@latest 和 dsh-session@latest 仍指向 0.0.1-rc.1；
• dsh-session@0.0.1-rc.1 仍 peer @deepseek-ai/dsh-type-meta@^0.0.1-rc.1；
• @deepseek-ai/dsh-type-meta 在 registry 仍是 404；
• 两个内部包的 next 均已指向 0.1.0-rc.7。

因此这不是缓存或 pnpm 特有行为，而是 dist-tag 发布列车不一致。

用户侧临时方案是显式安装 @next 或锁定 0.1.0-rc.7，并确保所有 @deepseek-ai/dsh-* 包来自同一版本列车；不要让某个直接依赖继续解析 @latest 的 0.0.1-rc.1。

维护侧更合适的修复不是重新发布已从当前架构删除的 dsh-type-meta，而是一次性把所有公开包的 latest 移到同一个 0.1.0-rc.7 集合，并 deprecate 已断链的 0.0.1-rc.1。发布 gate 应在空临时目录中逐个对 latest/next 公共包做真实安装，遍历 peer dependency，并拒绝任何 404 或跨列车解析；只验证 monorepo workspace 无法发现这种 registry 断链。