npx @deepseek-ai/dsh fails with a JavaScript heap OOM during npm dependency resolution

[mdzakyjaya]

Summary

The install path recommended in the README — npx @deepseek-ai/dsh web — reliably crashes with FATAL ERROR: ... JavaScript heap out of memory before any dsh code runs. Installing the same package with pnpm succeeds in under a minute.

Environment

OS	Windows 11 Pro 10.0.26200
Node.js	v24.19.0
npm	11.17.0
pnpm	11.24.0
System RAM	14.9 GB
Node default heap limit	2240 MB
dsh version	0.1.1-rc.2

Reproduction

The failure isolates cleanly to npm's resolver. No dsh code is executed in this repro:

mkdir repro && cd repro
echo '{"name":"t","version":"1.0.0","private":true}' > package.json
npm install @deepseek-ai/dsh --no-audit --no-fund

Result: crashes after 379 seconds with 0 packages installed.

<--- Last few GCs --->

[25308:...]   379176 ms: Mark-Compact 2027.6 (2056.2) -> 2019.2 (2072.7) MB, pooled: 0 MB, 298.20 / 0.00 ms  (average mu = 0.729, current mu = 0.811) allocation failure; scavenge might not succeed
[25308:...]   379642 ms: Mark-Compact (reduce) 2035.4 (2072.7) -> 2029.1 (2050.7) MB, pooled: 0 MB, 229.78 / 0.00 ms

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory

The documented command fails the same way, just later — the process produces no output at all (dsh never gets to run) and dies after ~523 seconds:

npx @deepseek-ai/dsh web

Likely cause

npm emits large numbers of circular peer-dependency conflicts while resolving the tree. A sample from the install log:

npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @deepseek-ai/dsh-attachment-local@0.0.1-rc.1
npm warn Found: @deepseek-ai/dsh-paths@undefined
npm warn Could not resolve dependency:
npm warn peer @deepseek-ai/dsh-paths@"^0.0.1-rc.1" from @deepseek-ai/dsh-attachment-local@0.0.1-rc.1

npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @deepseek-ai/dsh-client-runtime@0.0.1-rc.1
npm warn Found: @deepseek-ai/dsh-type-meta@undefined
npm warn peer @deepseek-ai/dsh-client-runtime@"^0.0.1-rc.1" from @deepseek-ai/dsh-client-ui-agent-preset@0.0.1-rc.1

The package graph is ~500 packages with peer dependencies referencing each other across dsh-* packages. npm's resolver appears to expand this combinatorially until it exhausts the heap.

This is consistent with the project being pnpm-native internally: the repo builds with pnpm, generated profiles contain pnpm-workspace.yaml, and dsh plugin forwards its arguments to pnpm. The npm/npx path appears not to be exercised in CI.

What I tried

Approach	Outcome
npx @deepseek-ai/dsh web	OOM after ~523s, no output
npm install @deepseek-ai/dsh (isolated)	OOM after 379s, 0 packages installed
Pinning 0.1.0-rc.6	OOM (SIGABRT, exit 134)
Pinning 0.0.1-rc.1	OOM
NODE_OPTIONS=--max-old-space-size=6144	Still unfinished after 400s; I terminated it, so this is inconclusive rather than a confirmed failure
npm install --legacy-peer-deps	Installs in 36s, but the tree is unusable (see below)
pnpm with auto-install-peers=true	Works — 504 resolved, 448 added in ~50s

--legacy-peer-deps installs quickly but produces a broken tree, because the peer dependencies are genuinely required at runtime:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@deepseek-ai/cordis-plugin-group'
imported from .../node_modules/@deepseek-ai/dsh-app-boot/lib/index.js

Working install

mkdir dsh-run && cd dsh-run
pnpm init
PNPM_CONFIG_AUTO_INSTALL_PEERS=true pnpm add @deepseek-ai/dsh
node node_modules/@deepseek-ai/dsh/lib/bin.js web

Boots correctly:

dsh web: http://127.0.0.1:3080

Note that auto-install-peers is required — without it, @deepseek-ai/cordis-plugin-group is missing and boot fails with the same ERR_MODULE_NOT_FOUND as the --legacy-peer-deps npm tree. Note also that in pnpm 11, pnpm config set auto-install-peers true is rejected for the global config and must be supplied via pnpm-workspace.yaml or the environment variable.

Suggested fixes

1. Flatten the peer-dependency graph between the internal dsh-* packages, or convert the circular peers to regular dependencies, so npm can resolve the tree.
2. Add an npm install to CI so this path stays exercised.
3. Update the README in the meantime — either document pnpm as the supported install path, or note the auto-install-peers requirement and the npm limitation, so users are not sent to a command that cannot complete.

[denial123789]

I extended the English npx install-boundary runbook with this latest report: https://sandbaseai.github.io/deepseek-harness-handbook/npx-install-prompt-hangs.html

The pnpm success is useful as a package-manager control, but the guide keeps the claim bounded: it narrows the failure to npm resolution and does not prove the published dependency graph is correct. It also requires a disposable follow-up dsh --version and Web smoke test.

[PerryLink]

?????? 34 ??????????:? pnpm ????npx ??? OOM ?? npm ?????(arborist ??),? dsh ????;pnpm ???????????? GB ??????????:

1. pnpm dlx @deepseek-ai/dsh web ????? pnpm install && pnpm dsh web;
2. ??????--dsh plugin --profile web add <pkg> ???? pnpm,??????(???? 34 ??)??? pnpm + allowBuilds ???

??????????,????????????

[Kang-Zhaoyuan]

Thanks for the detailed report. I independently reproduced a very similar failure on Windows, but with a slightly different environment and a simpler pnpm workaround.

My environment:

• Node.js v24.16.0
• npm 12.0.2
• Corepack 0.35.0
• pnpm 11.25.0
• @deepseek-ai/dsh@0.1.1-rc.2

I initially did not have pnpm installed.

Running:

npx @deepseek-ai/dsh --help

stalled during dependency resolution.

I also retried against the official npm registry:

npx --registry=https://registry.npmjs.org/ @deepseek-ai/dsh --help

and the behavior was unchanged, so switching away from my default npm mirror did not solve the issue in my environment.

Using:

npx --yes --legacy-peer-deps --registry=https://registry.npmjs.org/ @deepseek-ai/dsh@0.1.1-rc.2 --help

allowed npm to proceed, but then failed at runtime with the same error:

ERR_MODULE_NOT_FOUND
Cannot find package '@deepseek-ai/cordis-plugin-group'

I then enabled pnpm through Corepack and tested:

pnpm dlx @deepseek-ai/dsh@0.1.1-rc.2 web --no-open

This worked directly for me, without creating a project directory or explicitly setting PNPM_CONFIG_AUTO_INSTALL_PEERS=true.

I also verified the result beyond the startup message:

• 127.0.0.1:3080 was listening
• curl.exe -I http://127.0.0.1:3080 returned HTTP/1.1 200 OK
• the Web UI loaded successfully
• HTML and static assets returned HTTP 200
• no ERR_MODULE_NOT_FOUND or startup crash occurred

So, at least in my environment with pnpm 11.25.0, pnpm dlx appears to be a particularly simple workaround.