npm latest dist-tags look out of sync across the @deepseek-ai packages

[JoaquinDG]

Hi team, and congratulations on the launch. I have been building a plugin against the
published packages and ran into a snag in the npm metadata that I think will bite other
plugin authors, so sharing it here in case it is useful. Happy to be told I am holding it
wrong.

What I am seeing

The latest dist-tag looks like it has drifted behind what is actually published:

package	latest resolves to	newest published
@deepseek-ai/dsh-agent	0.1.0-rc.6	0.1.1-rc.2
@deepseek-ai/dsh-tools	0.0.1-rc.1	0.1.1-rc.2
@deepseek-ai/dsh-llm	0.0.1-rc.1	0.1.1-rc.2
@deepseek-ai/dsh-scope	0.0.1-rc.1	0.1.1-rc.2
@deepseek-ai/dsh-session	0.0.1-rc.1	0.1.1-rc.2

Because dsh-tools@0.0.1-rc.1 peers on @deepseek-ai/dsh-agent@^0.0.1-rc.1, the mismatch
shows up differently depending on the order you install things.

Installing the agent first, then tools, fails outright:

npm init -y
npm install @deepseek-ai/dsh-agent      # resolves 0.1.0-rc.6
npm install @deepseek-ai/dsh-tools

npm error code ERESOLVE
npm error peer @deepseek-ai/dsh-agent@"^0.0.1-rc.1" from @deepseek-ai/dsh-tools@0.0.1-rc.1

Both in one command installs, but warns four times and leaves a mismatched tree:

npm warn ERESOLVE overriding peer dependency   (x4)

Installing tools on its own is the one I would most want to flag, because it succeeds
quietly:

npm install @deepseek-ai/dsh-tools
# tools=0.0.1-rc.1  agent=0.0.1-rc.5

No error, no warning, and you are now several releases behind without any signal. That is
the case I would have shipped against without noticing.

Why I think it is worth a look

The tutorial points people at building plugins, and the dsh-plugin topic already has a
lot of repos on it. Anyone following the obvious install path lands on 0.0.x and writes
against an API that has since moved, which will surface later as confusing type errors
rather than as an install problem.

Workaround for anyone hitting this

Pinning an explicit consistent set works fine:

npm i @deepseek-ai/cordis@4.0.1 @deepseek-ai/dsh-agent@0.1.1-rc.2 \
      @deepseek-ai/dsh-llm@0.1.1-rc.2 @deepseek-ai/dsh-tools@0.1.1-rc.2

With that set my plugin typechecks clean under strict with skipLibCheck off, so the
declarations themselves are in good shape. It really does look like just the dist-tags.

I have not suggested a fix since release tagging is entirely your call, and there may be a
good reason latest is held back on a pre-1.0 project.

Environment: npm 10.9.3, node 22.20.0, macOS arm64, checked against the registry today.

Disclosure: I used Claude Code while investigating this. Every command and output above is
a real run, not recalled.