[dsh-v0.1.5-alpha.1] pnpm install 缺少 transitive dep unrun，pnpm run build 失败

[lijinxiao1982]

Summary

Clean pnpm install on tag dsh-v0.1.5-alpha.1 (commit 5dda764) leaves the unrun package unresolved, so pnpm run build fails with Failed to import module "unrun".

Reproduction

git clone --branch dsh-v0.1.5-alpha.1 --depth 1 https://github.com/deepseek-ai/deepseek-harness.git
cd deepseek-harness
pnpm install
pnpm run build

Environment: Node v22.22.1, pnpm 11.7.0, Ubuntu 24.04.

Actual

ERROR  Error: Failed to import module "unrun". Please ensure it is installed.
    at importWithError (.../node_modules/.pnpm/tsdown@0.22.x_*/node_modules/tsdown/dist/general-*.mjs)
[ELIFECYCLE] Command failed.
Error: build: build:lib exited with 1

pnpm install exits 0 with no warnings. node_modules/.unrun/ is never populated, and unrun does not appear under node_modules/.pnpm/. tsdown@0.22.2+ declares unrun as a regular dependency, but pnpm strict isolation never hoists it to the workspace root.

Workaround

pnpm add -Dw unrun

After this, a second issue surfaces — see follow-up discussion for the REPOSITORY_ROOT path-depth bug. Adding unrun is the only thing needed to get past this first error.

Suggested fix

1. Add "unrun": "^0.3.1" to the root package.json devDependencies, or
2. Pin tsdown to a version that bundles its config loader differently so unrun is no longer a runtime requirement.

Option 1 is the smaller, safer change.

[TongyiDai]

The proposed root devDependency fix is correct, but one detail in the diagnosis should be adjusted: tsdown@0.22.2 declares unrun as an optional peer dependency, not a regular dependency. The lockfile confirms unrun: '*' under peerDependenciesMeta with optional: true. pnpm therefore behaves correctly by not installing it automatically.

The failure happens because this repository exercises a tsdown configuration path that imports unrun, so for this project it is no longer optional in practice. The project that uses that path must declare it directly:

pnpm add -Dw unrun@^0.3.1
pnpm install --frozen-lockfile
pnpm run build:lib

Adding it at the workspace root is appropriate because the root scripts invoke tsdown and the package is private. It also produces a deterministic lockfile entry instead of depending on hoisting.

One compatibility check: unrun@0.3.1 requires Node ^22.13.0 || >=24.0.0. The reported Node 22.22.1 satisfies that, and the repository's own engine range also permits it.

So I would implement option 1, commit both package.json and pnpm-lock.yaml, and add a clean-install build check to CI. Pinning tsdown is useful only if the project intentionally wants to avoid this config-loader feature; it otherwise postpones the missing peer requirement.

[Luminous-xh]

cxv