dsh-type-meta is missing from npm, blocking pnpm installs for community plugin development

[haoku123]

Summary

Following the official guide for publishing a community plugin (bundle package with dsh.bundle in package.json), I created a standalone repo and tried to install the ecosystem packages with pnpm:

pnpm add -D @deepseek-ai/dsh-llm@0.0.1-rc.1 @deepseek-ai/dsh-tools@0.0.1-rc.1

pnpm install fails with:

ERR_PNPM_FETCH_404  GET https://registry.npmjs.org/@deepseek-ai%2Fdsh-type-meta: Not Found - 404

Findings

• @deepseek-ai/dsh-type-meta does not exist on the npm registry.
• It is pulled in transitively from @deepseek-ai/dsh-llm@0.0.1-rc.1 (likely via one of its many peer dependencies such as dsh-agent).
• npm install works around it (loose resolution), but pnpm with strict peer resolution fails. pnpm is the package manager used by the dsh monorepo itself, so many community plugin authors will hit this.
• Disabling auto-install-peers does not help, because the package is referenced in the resolved dependency graph.

Impact

Anyone building a standalone plugin repo (the officially recommended distribution format) cannot install the SDK packages with pnpm. This blocks community plugin development and publishing.

Suggestion

1. Publish @deepseek-ai/dsh-type-meta to npm (or remove/replace the reference in the rc packages), or
2. Document the recommended way to set up a standalone plugin repo (e.g. which packages to install and with which package manager).

Thanks!

[guntur-d]

Confirming the same blocker from our side: pnpm install of any plugin that depends on @deepseek-ai/dsh-tools fails with ERR_PNPM_FETCH_404 for @deepseek-ai/dsh-type-meta (pulled through dsh-tools' peer chain). This blocks the from-npm plugin path CONTRIBUTING.md points community contributors to.

Working workaround while it's unpublished: install the plugin from a local checkout — dsh plugin --profile <name> add . — the profile resolves the @deepseek-ai/* packages through the harness installation's fallback node_modules, so the missing peer never needs fetching. Hoping the publish chain gets repaired (and ideally audited for other unpublished packages) soon.

[guntur-d]

我方确认同样的阻塞：任何依赖 @deepseek-ai/dsh-tools 的插件执行 pnpm install 都会因 @deepseek-ai/dsh-type-meta 而报 ERR_PNPM_FETCH_404（经由 dsh-tools 的 peer 链拉取）。这堵住了 CONTRIBUTING.md 引导社区贡献者走的从 npm 安装插件路径。

在未发布期间可用的变通方案：从本地 checkout 安装插件——dsh plugin --profile <name> add .——profile 通过 harness 安装的回退 node_modules 解析 @deepseek-ai/* 包，因此无需拉取缺失的 peer。希望发布链尽快修复（并最好审计其他未发布的包）。

[ylwl1997]

这个坑我们实测踩过： 这个包确实没发到 npm（404），dsh-find-plugin 等依赖它的插件会装不上。

这是上游依赖没发布的问题，客户端无解——插件作者得先把依赖发到 npm。排查时看 pnpm 报错里是哪个包 404，就能定位。

这类安装/依赖坑（ERR_PNPM_FETCH_404、dsh-type-meta missing、ERR_REQUIRE_ESM 等）都整理在排错页：https://dshbase.com/troubleshooting/

[zoahdev]

Additional verified data point (2026-08-15): the npm latest dist-tag for @deepseek-ai/dsh-tools still resolves to 0.0.1-rc.1 (the broken train), so pnpm add @deepseek-ai/dsh-tools without a version hits this exact 404. The current working release train is 0.1.0-rc.6, matching @deepseek-ai/dsh 0.1.0-rc.6.

Declaring the SDK peers at ^0.1.0-rc.6 installs cleanly with pnpm — verified on Node 24 / pnpm 11 (63 packages, no missing peers). My plugin's package.json:

"peerDependencies": {
  "@deepseek-ai/cordis": "^4.0.1",
  "@deepseek-ai/dsh-tools": "^0.1.0-rc.6"
}

Suggestion: mark the 0.0.1-rc.* versions deprecated on npm (or fix the latest dist-tag) so latest stops pointing at the broken train, in addition to publishing dsh-type-meta / auditing the publish chain.

---

补充实测信息：@deepseek-ai/dsh-tools 的 npm latest 标签仍指向坏的 0.0.1-rc.1，不带版本号安装就会触发这个 404。当前可用的是与 dsh CLI 一致的 0.1.0-rc.6 release train；把 peer 声明为 ^0.1.0-rc.6 后 pnpm 安装干净通过（Node 24 / pnpm 11 实测）。建议把 0.0.1-rc.* 旧版本在 npm 上标记 deprecated（或修正 latest 标签），并尽快发布 dsh-type-meta。

[guntur-d]

Update: @deepseek-ai/dsh-tools@0.0.1-rc.1 no longer peers dsh-type-meta (fixed), but the chain is still broken via @deepseek-ai/dsh-session@0.0.1-rc.1, which still declares @deepseek-ai/dsh-type-meta as a peer dependency — the package is unpublished, so pnpm install of any plugin depending on dsh-session still fails with ERR_PNPM_FETCH_404. The workaround (install from a local checkout via dsh plugin add .) remains the reliable path until the publish chain is audited end to end.

[haoku123]

Thanks everyone for confirming and digging into this — really helpful data points. Let me consolidate where we stand:

Current state

• @deepseek-ai/dsh-tools@0.0.1-rc.1 no longer peers dsh-type-meta (fixed).
• The chain is still broken via @deepseek-ai/dsh-session@0.0.1-rc.1, which still declares the unpublished @deepseek-ai/dsh-type-meta as a peer — any plugin depending on dsh-session fails pnpm install with ERR_PNPM_FETCH_404.
• The npm latest dist-tag for @deepseek-ai/dsh-tools still resolves to 0.0.1-rc.1 (the broken train), while the working train is 0.1.0-rc.6.

Action items for the harness maintainers

1. Publish @deepseek-ai/dsh-type-meta to npm, or remove the peer declaration from dsh-session — either closes the 404 chain end-to-end.
2. Audit the full @deepseek-ai/* publish chain for other unpublished transitive packages.
3. Move the latest dist-tag to 0.1.0-rc.6 so unversioned installs don't hit the broken train.

Community workarounds until then

• Install plugins from a local checkout: dsh plugin --profile <name> add . (resolves @deepseek-ai/* through the harness's fallback node_modules).
• Pin SDK peers to the working train in plugin package.json: ^0.1.0-rc.6 (verified clean install on Node 24 / pnpm 11).

Would be great to get a maintainer's confirmation on the intended publish policy for the rc trains, so plugin authors know which versions to target.

[zoahdev]

Status update: the latest dist-tag for @deepseek-ai/dsh now points at 0.1.0-rc.6 (the broken 0.0.1-rc.1 tag is gone). Community plugins can safely pin to the current train. The ecosystem map now tracks dist-tag movement automatically and publishes per-release compatibility reports: https://github.com/zoahdev/dsh-ecosystem/blob/main/docs/release-compat/0.1.0-rc.6.md

[haoku123]

Thanks @zoahdev for tracking this down. I verified both fixes on the npm registry:

• latest dist-tag for @deepseek-ai/dsh → 0.1.0-rc.6 (broken 0.0.1-rc.1 tag is gone)
• @deepseek-ai/dsh-session 0.1.0-rc.2 / rc.3 / rc.6 all have no dsh-type-meta peer anymore — the 404 chain is closed end to end

So the remaining action item is only the (optional) publish of dsh-type-meta itself or a full publish-chain audit; installs from the current train work cleanly without it. Community plugins can now safely declare ^0.1.0-rc.6 peers.