Error on npx @deepseek-ai/dsh web directly

[JounQin]

node:internal/modules/package_json_reader:301
  throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath(base), null);
        ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@deepseek-ai/cordis-plugin-group' imported from /Users/JounQin/.npm/_npx/1e7f6d9597241db0/node_modules/@deepseek-ai/dsh-app-boot/lib/index.js
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:301:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:859:18)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:701:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:721:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:759:56)
    at #resolve (node:internal/modules/esm/loader:683:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:603:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33) {
  code: 'ERR_MODULE_NOT_FOUND'
}

Node.js v24.19.0

---

Root cause

@deepseek-ai/dsh-app-boot/lib/index.js performs a hard runtime import:

import Group from "@deepseek-ai/cordis-plugin-group";

but @deepseek-ai/cordis-plugin-group is declared only as a peerDependency of dsh-app-boot (~1.0.4), not as a regular dependency. The top-level @deepseek-ai/dsh package does not list it either — even though it does list the sibling plugins @deepseek-ai/cordis-plugin-include and @deepseek-ai/cordis-plugin-loader. So nothing in the install tree pulls it in, and the ESM import fails with ERR_MODULE_NOT_FOUND before any dsh subcommand (web or otherwise) runs.

npm 7+ would normally auto-install peer dependencies and mask this, but with legacy-peer-deps=true (set in ~/.npmrc) peer auto-install is disabled, so the package is genuinely absent. This is why both npx @deepseek-ai/dsh web and npm i -g @deepseek-ai/dsh && dsh web fail identically. This is a packaging bug in 0.2.0-rc.2; 0.2.1-alpha.1 has the same peer-dependency-only declaration, so it is affected too.

Verification (clean installs):

• legacy-peer-deps=true → @deepseek-ai/cordis-plugin-group missing → crash
• legacy-peer-deps=false → peer auto-installed → boots

Workaround (partial — see Update below)

Install the missing peer explicitly:

npm i -g @deepseek-ai/cordis-plugin-group@1.0.4
dsh web

or for a one-off npx run:

npx -y -p @deepseek-ai/dsh -p @deepseek-ai/cordis-plugin-group@1.0.4 dsh web

or re-enable peer auto-install:

npm config delete legacy-peer-deps

Update — installing the single peer is not enough

@deepseek-ai/cordis-plugin-group is only the first missing peer dependency. After adding it, dsh web gets further but still aborts:

dsh: startup failed: 1 required plugin did not activate

Failed plugins (33):
  ...
  agent-loop (required)
    Package: @deepseek-ai/dsh-agent-loop
    failed to import

The diagnostics log (~/.dsh/logs/startup-*.log) shows the underlying errors are the same class of problem, at scale:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@deepseek-ai/dsh-sandbox'
  imported from .../node_modules/@deepseek-ai/dsh-sandbox-local/lib/index.js
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@deepseek-ai/dsh-fs'
  imported from .../node_modules/@deepseek-ai/dsh-fs-local/lib/index.js

The *-local implementation plugins import their interface/service packages at runtime but declare them only as peerDependencies, and the top-level @deepseek-ai/dsh package does not list them as dependencies either. With legacy-peer-deps=true, npm installs 263 @deepseek-ai packages; with peer auto-install enabled it installs 289. The 26 that differ are exactly these interface packages (plus @deepseek-ai/cordis-plugin-group):

dsh-anonymous-user-id   dsh-attachment          dsh-bash-local
dsh-client-store        dsh-client-ui-primitives dsh-client-ui-slots
dsh-compaction          dsh-deepseek-account    dsh-fs
dsh-hook-protocol       dsh-jobs                dsh-llm-deepseek
dsh-output-retention    dsh-ptc-runtime         dsh-sandbox
dsh-sdk-protocol        dsh-session-persistence dsh-session-query
dsh-session-telemetry   dsh-session-title-llm   dsh-shell
dsh-spill               dsh-subagent-in-process-driver
dsh-util-time           dsh-util-workspace-path dsh-workflow

So a one-off -p @deepseek-ai/cordis-plugin-group cannot fix this; every missing interface package would have to be added by hand.

Correct workaround

Let npm install peer dependencies again, then reinstall:

npm config delete legacy-peer-deps       # or: npm config set legacy-peer-deps false
npm i -g @deepseek-ai/dsh
dsh web

For a one-off run without touching the global config, note that npx caches the resolved dependency tree under ~/.npm/_npx/<hash>/. If a broken tree was already cached from a legacy-peer-deps=true run, npx reuses it on the next invocation with the same package spec, so the env var appears to have no effect. The cache must be cleared first:

rm -rf ~/.npm/_npx          # or just the affected hash, e.g. ~/.npm/_npx/1e7f6d9597241db0
npm_config_legacy_peer_deps=false npx -y @deepseek-ai/dsh web

This is why npm_config_legacy_peer_deps=false npx -y @deepseek-ai/dsh web still failed against the pre-existing cache. Verified on macOS / Node 24.19.0 / npm 11.17.0: with a fresh npx cache and legacy-peer-deps=false, 289 @deepseek-ai packages install (including all of the above) and the web profile serves:

dsh web: http://127.0.0.1:63615/?token=...

Suggested fix

Because so many runtime imports depend on them, the interface/service packages (@deepseek-ai/dsh-sandbox, @deepseek-ai/dsh-fs, @deepseek-ai/dsh-jobs, …) and @deepseek-ai/cordis-plugin-group should be regular dependencies of @deepseek-ai/dsh (or of the corresponding *-local packages) instead of being left to peer auto-install. That makes the published package work under legacy-peer-deps=true, which is common in corporate and CI setups.