[Bug] single-exe Web profile misses dsh-session-title-llm; runtime closure verification skips apps/*

[Sujz13]

Summary

At upstream commit 76fda729799fe9b3848dbe2c211d4b231032b81e (0.1.2-rc.1), the single-exe runtime manifest does not provide @deepseek-ai/dsh-session-title-llm, although the shipped base composition reaches @deepseek-ai/dsh-session-title-first-prompt-llm, which requires it as a non-optional workspace peer.

verify-runtime-closure still reports a closed graph because loadWorkspacePackages() scans packages/*/*/package.json and vendor/*/package.json, but not apps/*/package.json. The direct runtime dependency @deepseek-ai/dsh is owned by apps/cli, so traversal stops before reaching @deepseek-ai/dsh-base and its title provider.

中文摘要：当前单文件运行时遗漏了 dsh-session-title-llm。现有闭包检查没有扫描 apps/*，因此错误地报告依赖图 closed。

Environment

• Repository commit: 76fda729799fe9b3848dbe2c211d4b231032b81e
• Repository version: 0.1.2-rc.1
• Host: Ubuntu 20.04, Linux x64
• Node: v24.19.0
• pnpm: 11.7.0
• Target: node24-linux-x64

Reproduction

From a clean checkout, the authoritative runtime manifest contains @deepseek-ai/dsh but not @deepseek-ai/dsh-session-title-llm:

git show HEAD:python/sdk-runtime/package.json | rg 'dsh-session-title'
pnpm run verify-runtime-closure

Observed closure output with the clean manifest:

verify-runtime-closure: 4 agent presets and 127 workspace packages form a closed runtime dependency graph.

The dependency chain omitted from that traversal is:

dsh-python-runtime-closure
  -> @deepseek-ai/dsh                    (apps/cli)
  -> @deepseek-ai/dsh-base
  -> @deepseek-ai/dsh-session-title-first-prompt-llm
  -> @deepseek-ai/dsh-session-title-llm  (required peer)

The packaged Web profile consequently fails when that shared title-policy package is absent:

Cannot find package '@deepseek-ai/dsh-session-title-llm' imported from
.../@deepseek-ai/dsh-session-title-first-prompt-llm/lib/index.js

Expected behavior

The runtime closure gate should traverse every workspace package reachable from the deploy root, including application packages, and fail before packaging whenever a required workspace peer is not supplied.

Tested workaround

Add this direct runtime dependency and update the lockfile:

"@deepseek-ai/dsh-session-title-llm": "workspace:^"

After a frozen reinstall and complete rebuild, the title-policy import succeeds. The resulting executable proceeds to Web initialization, where the separate SEA client-module issue described in the next report becomes visible.

Suggested upstream direction

1. Add apps/*/package.json to loadWorkspacePackages() in scripts/verify-runtime-closure.ts.
2. Add @deepseek-ai/dsh-session-title-llm to python/sdk-runtime/package.json and update pnpm-lock.yaml.
3. Add a regression proving that the unmodified runtime manifest fails if this peer is removed and that the diagnostic includes the complete runtime -> dsh -> base -> provider -> peer chain.

No credentials or live API request are required to reproduce this packaging failure.