Bug: dsh plugin add 会静默安装 host peer 范围无法满足的插件(dsh-win32 实测,零 warning)

[ciceroyang]

TL;DR (English)

dsh plugin add installs a plugin whose declared @deepseek-ai/* peer range cannot be satisfied, and prints no warning. Verified with dsh-win32@0.17.8: it declares @deepseek-ai/dsh-subprocess-local: ">=0.1.0-rc.5 <0.1.0-rc.7", while the host layer provides 0.1.5-rc.2.

环境

• dsh 0.1.5-rc.1(npm-global)、pnpm 11.21.0、macOS、Node v26.4.0
• 被装插件:dsh-win32@0.17.8(npm 元数据里的 peerDependencies 如下)

复现(隔离 DSH_HOME,不动真实环境)

DSH_HOME=/tmp/dsh-demo dsh plugin --profile web add dsh-win32

host 层由 CLI 自带安装提供(<DSH_HOME>/profiles/node_modules/@deepseek-ai/…),实际版本:

host 包	已装版本
@deepseek-ai/cordis	4.0.2
@deepseek-ai/dsh-fs-local	0.1.5-rc.2
@deepseek-ai/dsh-fs-sandbox	0.1.5-rc.2
@deepseek-ai/dsh-subprocess-local	0.1.5-rc.2

dsh-win32@0.17.8 声明:

{
  "@deepseek-ai/cordis": ">=4.0.0 <5",
  "@deepseek-ai/dsh-fs-local": ">=0.1.0-rc.5 <0.2.0",
  "@deepseek-ai/dsh-fs-sandbox": ">=0.1.0-rc.5 <0.2.0",
  "@deepseek-ai/dsh-subprocess-local": ">=0.1.0-rc.5 <0.1.0-rc.7"
}

第四条与已装 0.1.5-rc.2 明确冲突(0.1.5-rc.2 > 0.1.0-rc.7,严格 semver 同样排除)。安装输出没有任何 warning:

dependencies:
+ dsh-win32 ^0.17.8
Packages: +3
Done in 265ms using pnpm v11.21.0

同样现象用一个人造插件也能复现:peer 写 >=99.0.0、link: 安装进去,零警告。

机制:为什么 pnpm 没有报警

装完后 profile 里没有 @deepseek-ai/*(ls <profile>/node_modules 只有 dsh-win32 / iconv-lite / safer-buffer)。profile 的 pnpm 配置是:

# <profile>/pnpm-workspace.yaml
packages: ['.']
nodeLinker: hoisted
autoInstallPeers: false

host 包是由 CLI 的共享根层提供的,不是 profile 的依赖。于是:

1. autoInstallPeers: false → pnpm 不安装这些 peer;
2. 它们也不在 profile 的依赖图里 → pnpm 没有可解析的目标,自然不会报 unmet peer(pnpm ls --depth 0 只列出 dsh-win32@0.17.8,无 peer 警告)。

再叠加 host 包目前不发布 engines(#2259),npm/pnpm 两层都没有机会报警。

影响

安装时用户拿不到任何「这个插件与当前 harness 不兼容」的信号;冲突要么在运行时以更难懂的方式暴露,要么无人发现。对由宿主提供的 @deepseek-ai/* peer 来说,声明目前实际上是装饰性的。

建议(任选,均不要求改 npm 生态)

1. dsh plugin add 在写 profile 之前读取插件声明的 @deepseek-ai/* peer 范围,与 host 层实际解析到的版本比对,不满足就打印 warning(不建议直接阻断:生态里大量插件声明 *,硬拦会挡住正常安装);
2. 或让 profile 的 pnpm 解析能看到 host 层(例如把根层 @deepseek-ai/* 作为 profile 的 peer 解析目标),交给 pnpm 自己报;
3. 若短期不做,社区离线检查可作过渡:我把它做进了 dsh-doctor 0.6.1 的 ciceroyang/peer_range,同一台机器上对 dsh-win32 的输出是:

✗ 已装插件 1(profile 1 个),host 声明 4 条:兼容 3 / 未知 0 / 不兼容 1
  — dsh-win32 需要 @deepseek-ai/dsh-subprocess-local >=0.1.0-rc.5 <0.1.0-rc.7,已装 0.1.5-rc.2

相关讨论:#4792(插件 × harness 兼容性标准化)。

[ciceroyang]

补一个一键复现脚本(下面的输出是本机刚跑出来的,不是推测)。它把 DSH_HOME 指到临时目录,不碰真实环境,结束时打印清理命令:

#!/usr/bin/env bash
# dsh plugin add silently accepts a plugin whose @deepseek-ai/* peer range cannot be satisfied.
set -eu
ROOT="$(mktemp -d)"
export DSH_HOME="$ROOT/home"
GLOBAL="$(npm root -g)"
HOST="$GLOBAL/@deepseek-ai/dsh/node_modules/@deepseek-ai/dsh-subprocess-local/package.json"

echo '== 1. install (watch for any peer warning) =='
dsh plugin --profile web add dsh-win32
echo
echo '== 2. what the plugin declares =='
node -e "console.log(require('$ROOT/home/profiles/web/node_modules/dsh-win32/package.json').peerDependencies)"
echo
echo '== 3. what the host actually provides =='
node -e "console.log('@deepseek-ai/dsh-subprocess-local', require('$HOST').version)"
echo
echo "DSH_HOME=$DSH_HOME  (cleanup: rm -rf $ROOT)"

本机输出(关键部分):

== 1. install (watch for any peer warning) ==
dependencies:
+ dsh-win32 ^0.17.8
Packages: +3
Done in 259ms using pnpm v11.21.0          <- 全程没有任何 peer warning

== 2. what the plugin declares ==
'@deepseek-ai/dsh-subprocess-local': '>=0.1.0-rc.5 <0.1.0-rc.7'

== 3. what the host actually provides ==
@deepseek-ai/dsh-subprocess-local 0.1.5-rc.2

环境:dsh 0.1.5-rc.1、pnpm 11.21.0、macOS。同一现象在一个本地人造插件上也能复现(把 peer 写成 >=99.0.0,link: 安装进去,同样零警告),所以它不依赖某个具体插件的元数据。

[PerryLink]

核实（master c291e79）：机制成立——CLI 零 peer 校验 + 模板 autoInstallPeers: false。

• dsh plugin 是纯 pnpm 转发器：apps/cli/src/plugin.ts:120-163（spawnSync 直转 pnpm，:134-138），事后只做 reconcilePlugins（:59-91，仅核对 dsh.bundle 声明，不碰 peer）；apps/cli 全源码 grep peerDependencies 为 0。
• 模板决定安装行为：profile 模板写死 nodeLinker: hoisted + autoInstallPeers: false（packages/boot/app-boot/src/profile.ts:150-154；desktop 同款 apps/desktop/src/project-manager.ts:82）——与你的 dsh-win32"静默安装、无 warning"实测一致。
• （未验证：host 包是否发布 engines 字段，npm 元数据侧我没独立核对。）

你的建议 1 落点具体：在 runPlugin 的 spawnSync 之前（plugin.ts:131-134 之间）读 host 版本与目标包 peer 区间比对，不满足就打 warning（或加 --strict 时直接失败）。建议 2（装完全树校验）成本高、且与 pnpm 自身行为重复，短期不建议。附带建议：把 autoInstallPeers 至少改成 warn 级别也值得一起提。这个改动小而清晰，适合 PR。

[sjh9714]

Thanks @ciceroyang — replying here also to the original mention in #4792.

The subprocess peer pin is intentional, not a forgotten version bump. In dsh-win32 0.17.8, >=0.1.0-rc.5 <0.1.0-rc.7 belongs to the legacy bundle. The published manifest and dependency-contract test retain this boundary deliberately. I will not widen it merely to silence a compatibility warning.

On current DSH / native Windows, the intended path is the standalone CLI:

npx dsh-win32 setup

It checks the official Windows stack without installing the legacy bundle or replacing the current preset. dsh plugin --profile web add dsh-win32 selects the legacy integration instead; successful installation is not evidence that this integration supports a modern host. Current doctor already warns when the legacy bundle is wired and suggests removal, but never removes it automatically. Documentation PR #76 makes this distinction explicit in both READMEs and the coding-agent instructions.

The missing upstream warning is a separate issue. I independently checked npm's 0.17.8 metadata and inspected the installer source at c291e7961. I have not rerun your installer reproduction, and our component verifier does not exercise that installer or a complete Minimal session.

The peers are optional; that permits absence, not treating a conflicting present host provider as compatible. Any host-aware check should use the actual resolution context and report unresolved identity as unknown rather than infer compatibility from registry latest. Node engines eligibility and host-peer compatibility are separate checks. Neither should be “fixed” by silently upgrading peers or relaxing the profile's package-manager policy.