AI 開發工具
DeepSeek Harness rc.2’s Split npm Tags: The Main Package Is Current, but Plugin Development May Pull in 0.0.x
The `latest` tag for DeepSeek Harness’s main package points to 0.1.1-rc.2, but several underlying packages still mark early versions as the latest. Installing the plugin API directly may trigger peer dependency conflicts or silently create a mismatched dependency tree.
DeepSeek Harness released 0.1.1-rc.2 on August 21, and the npm `latest` tag for its official launcher, `@deepseek-ai/dsh`, has also been updated. The problem lies with the granular packages imported directly by plugin authors. After checking the registry on August 23, the community found that although packages including `dsh-agent`, `dsh-tools`, `dsh-llm`, `dsh-scope`, and `dsh-session` had published rc.2 releases, their `latest` tags still pointed to either 0.1.0-rc.6 or 0.0.1-rc.1. Other package pages showed the same pattern: newer versions were tagged only as `next`, while older versions continued to occupy `latest`.
This is not merely a display issue. According to a [reproducible report](https://github.com/deepseek-ai/deepseek-harness/discussions/4222), installing `dsh-agent` first and then `dsh-tools` causes npm to abort with `ERESOLVE`, because the older tools package requires agent version `^0.0.1-rc.1`. Installing both at once may instead override peer dependency warnings. The most dangerous path is installing tools by itself: the command can complete without warnings while pulling in 0.0.1-rc.1 and an even older agent version, leaving developers to build plugins against type definitions and lifecycle interfaces that have since moved.
The current workaround is to pin every directly imported Harness package explicitly to the same version, such as 0.1.1-rc.2, and commit the lockfile. Before installation, developers should also run `npm view <package> dist-tags versions peerDependencies` to inspect the package metadata instead of masking mismatches with `--legacy-peer-deps`. The [npm registry](https://www.npmjs.com/package/%40deepseek-ai/dsh-llm-deepseek?activeTab=versions) shows that rc.2 packages do exist, so the available evidence points to unsynchronized release tags rather than missing artifacts. The official root launcher may not be affected in the same way, but plugin projects using Harness as an SDK need to take extra precautions. The maintainers have not yet responded to the discussion, and the tags could be corrected at any time.