pnpm install fails: dsh monolith dependency ranges cannot select published prerelease siblings (0.1.2-rc.1 / 0.1.3-alpha.2)

[backpackor]

Summary

Fresh install of @deepseek-ai/dsh@0.1.2-rc.1 (and 0.1.3-alpha.2) fails with ERR_PNPM_NO_MATCHING_VERSION because the monolith's dependency ranges use stable lower bounds that cannot select the published prerelease siblings.

Repro

mkdir /tmp/dsh-test && cd /tmp/dsh-test
echo '{"name":"t","private":true,"dependencies":{"@deepseek-ai/dsh":"0.1.2-rc.1"}}' > package.json
pnpm install

Result

ERR_PNPM_NO_MATCHING_VERSION No matching version found for @deepseek-ai/dsh-settings@>=0.1.2 <0.2.0-0
The latest release of @deepseek-ai/dsh-settings is "0.0.1-rc.1".
Other releases are:
  * alpha: 0.1.3-alpha.2
  * next: 0.1.2-rc.1

Root cause

@deepseek-ai/dsh-settings@0.1.2-rc.1 is published (dist-tag next), but semver excludes it from the range >=0.1.2 <0.2.0-0: prerelease 0.1.2-rc.1 < stable 0.1.2, and the range's lower bound >=0.1.2 requires the stable release. The only published version satisfying the range is 0.1.3-alpha.2 (since 0.1.3-alpha.2 > 0.1.2 and < 0.2.0-0), which silently pulls in a different line and produces mixed-version trees where plugins import symbols missing from older siblings (e.g. deepFreeze, snapshotJsonValue, ImageVariantId).

The same class affects the alpha line: @deepseek-ai/dsh@0.1.3-alpha.2 declares @deepseek-ai/dsh-settings@>=0.1.3 <0.2.0-0 while only 0.1.3-alpha.2 (prerelease) is published for that line.

Note: an isolated single-package resolve can appear to succeed when a newer-line prerelease (e.g. 0.1.3-alpha.2) happens to satisfy the bad range — the failure/mixing only shows on a full-tree install or at boot.

Suggested fix

For prerelease publishes, use prerelease-aware ranges, e.g. ^0.1.2-rc.1 (caret anchored on the rc base includes 0.1.2-rc.1), or publish stable releases of sibling packages alongside the rc/alpha monolith. Also worth checking dist-tag hygiene: @deepseek-ai/dsh-settings still has latest pointing at 0.0.1-rc.1 while next = 0.1.2-rc.1.

[backpackor]

Update with additional evidence (2026-09-08): the same error class reproduces with the rc.1 line, but the requester is NOT the dsh monolith. Isolated repro:

• @deepseek-ai/dsh@0.1.2-rc.1 ALONE -> fresh resolve PASSES, pure 0.1.2-rc.1 tree (dsh-settings resolves to 0.1.2-rc.1)
• • @xmanrui/dsh-im@^3.2.0 -> PASSES
• • dsh-better-sidebar@0.16.1 -> FAILS: no matching version for @deepseek-ai/dsh-settings (stable-bound range, e.g. >=0.1.2 <0.2.0-0, which npm-semver excludes from matching ANY prerelease since no comparator shares the version tuple with a prerelease tag)

So the rc.1 monolith + sibling closure is self-consistent; the failure came from a third-party plugin pinning a stable-bound dsh-settings range. Root cause class stays: prerelease-only publishes + stable-bound ranges = unsatisfiable. Suggest auditing third-party plugin ranges when publishing rc lines.