npx first-run cost: ~25 min install on Windows even with warm cache, OOM crash on <=4 GB RAM — same tree installs in ~20 s via pnpm

[moyu-good]

What happens

A newcomer following a "quick start" that begins with npx @deepseek-ai/dsh ... hits a wall before dsh's own code ever runs:

• npx -y @deepseek-ai/dsh --version on Windows 10 x64 (Node 22.16, 16 GB RAM): 1530 s (~25 min) of silent waiting, then it prints the version.
• The same command inside WSL2 capped at 3 GB RAM: after ~323 s of silence the npm process dies with JavaScript heap out of memory (~1.8 GB heap) — a SIGABRT/core dump. The dsh binary itself never executes; it's npm the node process that OOMs mid-install.

Measurements (same machine, same tree: 197 packages, ~260 MB unpacked)

Scenario	Time	Notes
npx -y @deepseek-ai/dsh --version (cold npx cache)	1530 s	Windows, 16 GB RAM
npm install @deepseek-ai/dsh (npm cache fully warm)	1525 s	Warm cache makes no difference
pnpm install (pnpm store cold, includes all downloads)	19 s	Same tree, 197 pkgs / 249 MB
node .../dsh/lib/bin.js --version (after install)	<1 s	dsh itself is instant

What it is not

• Not the network: the warm-cache npm run takes the same ~25 min, and pnpm downloads every tarball from scratch in 19 s.
• Not a postinstall / first-run bootstrap: @deepseek-ai/dsh and @deepseek-ai/dsh-base ship no lifecycle scripts at all, and bin.js resolves --version through a lightweight commander path with all heavy modules behind dynamic imports. The entire cost is npm's serial Arborist reify + extraction, which is painful on Windows filesystems and memory-hungry enough to OOM small VMs.

Suggestions

1. Docs: recommend pnpm dlx @deepseek-ai/dsh ... (or pnpm add -g) as the primary path; if npx stays in docs, warn about the Windows wait and suggest NODE_OPTIONS=--max-old-space-size=2048 for small-RAM machines.
2. Mid-term: bundle the CLI to shrink the install-time tree. Top-level deps grew from 62 (0.1.1-rc.2) to 70 (0.1.2-rc.1), so the trend is currently the wrong way; @deepseek-ai/dsh-web-app already ships as a lean 10-file package, so the tooling clearly exists.

Happy to provide the raw timing scripts/logs if useful.

Environment: Windows 10 x64 / Node v22.16.0 / npm 11.x / pnpm 10.33.0; WSL2 (Ubuntu 24.04) / Node v22.22.2 / pnpm 11.7.0; @deepseek-ai/dsh 0.1.1-rc.2.