From 1646b7617e22d5f7dfaba6bdad72de5f670f43d0 Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 13 Aug 2026 13:54:22 +0800
Subject: [PATCH 1/2] fix(bundle): exclude product subagents from base
The Codex and Claude Code subagent providers were production dependencies of
@deepseek-ai/dsh-base and mounted by its Cordis composition, so every install of
the base bundle carried two providers that only some products want.
Drop both from the base bundle's dependencies and composition. The examples keep
them as explicit dependencies, base's tests lock their absence, and the product
preset e2e mounts the providers it needs explicitly.
Cherry-picked from #2387 (two commits squashed into one).
---
...ludes-product-subagent-providers.i18n.yaml | 6 ++++
...dsh-excludes-product-subagent-providers.md | 25 ++++++++++++++
...-excludes-product-subagent-providers.zh.md | 25 ++++++++++++++
apps/cli/composition.md | 6 ----
apps/cli/tests/web-agent-presets.e2e.ts | 34 +++++++++++++------
packages/bundle/base/cordis.patch.yml | 9 -----
packages/bundle/base/package.json | 2 --
packages/bundle/base/tests/base.spec.ts | 10 +++---
8 files changed, 83 insertions(+), 34 deletions(-)
create mode 100644 .agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.i18n.yaml
create mode 100644 .agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.md
create mode 100644 .agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.zh.md
diff --git a/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.i18n.yaml b/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.i18n.yaml
new file mode 100644
index 0000000000..44f197e39d
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.md
+2026-08-12-production-dsh-excludes-product-subagent-providers.md: 3e3e4fbefb31932a637bfe05ff0d90916e202a79
+2026-08-12-production-dsh-excludes-product-subagent-providers.zh.md: 166964675bf7084b62f5500969e5756c9bd9f644
diff --git a/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.md b/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.md
new file mode 100644
index 0000000000..3e3e4fbefb
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.md
@@ -0,0 +1,25 @@
+# Agent Note: Production dsh excludes product subagent providers
+
+Status: implemented
+
+English | [中文](2026-08-12-production-dsh-excludes-product-subagent-providers.zh.md)
+
+## Problem
+
+`@deepseek-ai/dsh` receives the `@deepseek-ai/dsh-base` dependency closure. Including the Codex and Claude Code subagent providers there makes every production install download optional product integration code, including the Claude Agent SDK, even when neither integration is used.
+
+## Decision
+
+This decision supersedes the [shared-host placement](../architecture/2026-08-10-product-subagent-providers-in-shared-host.md): `@deepseek-ai/dsh-base` does not depend on or mount the Codex and Claude Code subagent providers. Their packages remain available for Profiles that install and mount them explicitly. Repository examples keep direct development dependencies so their explicit provider configurations continue to resolve.
+
+## Verification
+
+The base bundle test rejects both provider dependencies and configuration rows. Cordis configuration validation requires explicit examples to declare the provider packages they name.
+
+## Alternatives considered
+
+**Keep dormant providers in the base bundle.** Dormant providers start no product processes, but their packages still enter every production npm install.
+
+## Consequences
+
+Installing `@deepseek-ai/dsh` does not download either product provider through the base bundle. Using either integration requires explicit Profile configuration.
diff --git a/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.zh.md b/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.zh.md
new file mode 100644
index 0000000000..166964675b
--- /dev/null
+++ b/.agents/notes/implemented/simplification/2026-08-12-production-dsh-excludes-product-subagent-providers.zh.md
@@ -0,0 +1,25 @@
+# Agent Note: 生产 dsh 排除产品 subagent 提供方
+
+Status: implemented
+
+[English](2026-08-12-production-dsh-excludes-product-subagent-providers.md) | 中文
+
+## 问题
+
+`@deepseek-ai/dsh` 会获得 `@deepseek-ai/dsh-base` 的依赖闭包。如果 base 包含 Codex 与 Claude Code subagent 提供方，每次生产安装都会下载可选的产品集成代码，包括 Claude Agent SDK，即使用户并未使用任一集成。
+
+## 决策
+
+本决策取代[共享 host 放置决策](../architecture/2026-08-10-product-subagent-providers-in-shared-host.md)：`@deepseek-ai/dsh-base` 不依赖也不挂载 Codex 与 Claude Code subagent 提供方。需要这些集成的 Profile 仍可显式安装并挂载对应包。仓库 examples 保留直接开发依赖，使其显式提供方配置可以继续解析。
+
+## 验证
+
+base 组合包测试会拒绝这两个提供方依赖与配置行。Cordis 配置验证要求显式 examples 声明其引用的提供方包。
+
+## 考虑过的替代方案
+
+**在 base 组合包中保留休眠提供方。** 休眠提供方不会启动产品进程，但其包仍会进入每次生产 NPM 安装。
+
+## 后果
+
+安装 `@deepseek-ai/dsh` 时，不会通过 base 组合包下载任一产品提供方。使用任一集成都需要显式 Profile 配置。
diff --git a/apps/cli/composition.md b/apps/cli/composition.md
index 0d56813430..4d37b9186a 100644
--- a/apps/cli/composition.md
+++ b/apps/cli/composition.md
@@ -114,10 +114,6 @@ flowchart LR
cfg --> plugin_dsh_base_subagent_spawn_in_process
plugin_dsh_base_subagent_fork_in_process["subagent-fork-in-process
@deepseek-ai/dsh-subagent-fork-in-process"]
cfg --> plugin_dsh_base_subagent_fork_in_process
- plugin_dsh_base_subagent_codex["subagent-codex
@deepseek-ai/dsh-subagent-codex"]
- cfg --> plugin_dsh_base_subagent_codex
- plugin_dsh_base_subagent_claude_code["subagent-claude-code
@deepseek-ai/dsh-subagent-claude-code"]
- cfg --> plugin_dsh_base_subagent_claude_code
plugin_dsh_base_tool_subagent_control["tool-subagent-control
@deepseek-ai/dsh-tool-subagent-control"]
cfg --> plugin_dsh_base_tool_subagent_control
plugin_dsh_base_tool_subagent_list_agents["tool-subagent-list-agents
@deepseek-ai/dsh-tool-subagent-control/list-agents"]
@@ -225,8 +221,6 @@ flowchart LR
| `subagent` | `@deepseek-ai/dsh-subagent` |
| `subagent-spawn-in-process` | `@deepseek-ai/dsh-subagent-spawn-in-process` |
| `subagent-fork-in-process` | `@deepseek-ai/dsh-subagent-fork-in-process` |
-| `subagent-codex` | `@deepseek-ai/dsh-subagent-codex` |
-| `subagent-claude-code` | `@deepseek-ai/dsh-subagent-claude-code` |
| `tool-subagent-control` | `@deepseek-ai/dsh-tool-subagent-control` |
| `tool-subagent-list-agents` | `@deepseek-ai/dsh-tool-subagent-control/list-agents` |
| `tool-subagent` | `@deepseek-ai/dsh-tool-subagent` |
diff --git a/apps/cli/tests/web-agent-presets.e2e.ts b/apps/cli/tests/web-agent-presets.e2e.ts
index ca0f5ece78..f51b5806a4 100644
--- a/apps/cli/tests/web-agent-presets.e2e.ts
+++ b/apps/cli/tests/web-agent-presets.e2e.ts
@@ -28,6 +28,7 @@ const BASE_PATCH = join(REPO_ROOT, 'packages/bundle/base/cordis.patch.yml')
const WEB_PATCH = join(REPO_ROOT, 'packages/bundle/web-app/cordis.patch.yml')
/** The installation anchor whose dependency surface the preset module fallback mirrors. */
const INSTALL_ANCHOR = join(REPO_ROOT, 'apps/cli/package.json')
+const EXAMPLES_INSTALL_ANCHOR = join(REPO_ROOT, 'examples/package.json')
const MINIMAL_PROMPT = 'You are a helpful software engineer assistant.'
const MINIMAL_BASH_DESCRIPTION = `Run commands in a bash shell
* When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.
@@ -43,7 +44,11 @@ const MINIMAL_BASH_DESCRIPTION = `Run commands in a bash shell
* touch the network, or write outside the test. Everything that decides an
* agent's capabilities is the real thing, including both shipped presets.
*/
-async function bootWeb(settingsFile: string, extra: PatchOptions[] = []): Promise {
+async function bootWeb(
+ settingsFile: string,
+ extra: PatchOptions[] = [],
+ extraInstallAnchor?: string,
+): Promise {
const storageRoot = join(dirname(settingsFile), 'storages')
const patches: PatchOptions[] = [
...loadOverlayPatches('dsh-test', BASE_PATCH),
@@ -110,6 +115,7 @@ async function bootWeb(settingsFile: string, extra: PatchOptions[] = []): Promis
// them resolvable — the same mechanism, not a test-only shim.
const home = dirname(settingsFile)
healProfilesModuleFallback(INSTALL_ANCHOR, home)
+ if (extraInstallAnchor !== undefined) healProfilesModuleFallback(extraInstallAnchor, home)
const profileDir = join(home, 'profiles', 'spec')
await mkdir(profileDir, { recursive: true })
const rootConfig = join(profileDir, 'cordis.yml')
@@ -440,17 +446,23 @@ describe('product subagent rows in user presets', () => {
await mkdir(directory, { recursive: true })
await writeFile(join(directory, 'agent.cordis.yml'), composition)
}
- productCtx = await bootWeb(settingsFile, [{
- id: 'agent-presets',
- config: {
- default: 'standard',
- roots: [
- { path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' },
- { path: userRoot, trust: 'user' },
- ],
- includeUserRoot: false,
+ productCtx = await bootWeb(settingsFile, [
+ { insert: [
+ { id: 'subagent-codex', name: '@deepseek-ai/dsh-subagent-codex' },
+ { id: 'subagent-claude-code', name: '@deepseek-ai/dsh-subagent-claude-code' },
+ ] },
+ {
+ id: 'agent-presets',
+ config: {
+ default: 'standard',
+ roots: [
+ { path: join(CONFIG_DIR, 'agent-presets'), trust: 'system' },
+ { path: userRoot, trust: 'user' },
+ ],
+ includeUserRoot: false,
+ },
},
- }])
+ ], EXAMPLES_INSTALL_ANCHOR)
}, 120_000)
afterAll(async () => {
diff --git a/packages/bundle/base/cordis.patch.yml b/packages/bundle/base/cordis.patch.yml
index e7a29430fb..e9567d9206 100644
--- a/packages/bundle/base/cordis.patch.yml
+++ b/packages/bundle/base/cordis.patch.yml
@@ -302,15 +302,6 @@
config:
providerName: fork
- # Product providers stay on the host plane because the registry is a
- # process singleton. Agent presets decide whether their own model sees the
- # matching delegation tools; loading either provider starts no product.
- - id: subagent-codex
- name: '@deepseek-ai/dsh-subagent-codex'
-
- - id: subagent-claude-code
- name: '@deepseek-ai/dsh-subagent-claude-code'
-
# Continuable background children are selected per delegation tool. The
# separately loaded follow-up tool registers the one global `send_message`.
- id: tool-subagent-control
diff --git a/packages/bundle/base/package.json b/packages/bundle/base/package.json
index 164380c7ed..8ae83abdbb 100644
--- a/packages/bundle/base/package.json
+++ b/packages/bundle/base/package.json
@@ -85,8 +85,6 @@
"@deepseek-ai/dsh-spill-local": "workspace:^",
"@deepseek-ai/dsh-spill-policy": "workspace:^",
"@deepseek-ai/dsh-subagent": "workspace:^",
- "@deepseek-ai/dsh-subagent-claude-code": "workspace:^",
- "@deepseek-ai/dsh-subagent-codex": "workspace:^",
"@deepseek-ai/dsh-subagent-fork-in-process": "workspace:^",
"@deepseek-ai/dsh-subagent-spawn-in-process": "workspace:^",
"@deepseek-ai/dsh-subprocess-local": "workspace:^",
diff --git a/packages/bundle/base/tests/base.spec.ts b/packages/bundle/base/tests/base.spec.ts
index 8f904ac60b..e70bc0ff74 100644
--- a/packages/bundle/base/tests/base.spec.ts
+++ b/packages/bundle/base/tests/base.spec.ts
@@ -35,12 +35,10 @@ describe('dsh-base bundle', () => {
expect(rows.find(row => row.id === 'session-telemetry-otel')?.config?.['mode']).toEqual({
__jsExpr: "process.env.DSH_TELEMETRY_MODE || 'DISABLED'",
})
- expect(rows.filter(row => row.id === 'subagent-codex')).toHaveLength(1)
- expect(rows.filter(row => row.id === 'subagent-claude-code')).toHaveLength(1)
- expect(manifest.dependencies).toMatchObject({
- '@deepseek-ai/dsh-subagent-codex': 'workspace:^',
- '@deepseek-ai/dsh-subagent-claude-code': 'workspace:^',
- })
+ expect(rows.filter(row => row.id === 'subagent-codex')).toHaveLength(0)
+ expect(rows.filter(row => row.id === 'subagent-claude-code')).toHaveLength(0)
+ expect(manifest.dependencies).not.toHaveProperty('@deepseek-ai/dsh-subagent-codex')
+ expect(manifest.dependencies).not.toHaveProperty('@deepseek-ai/dsh-subagent-claude-code')
})
it('gates each shell stack by platform with a symmetric disabled expression', () => {
From a213befd0fd828eec81bf52d4454fc0f5db6ad29 Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Thu, 13 Aug 2026 13:55:05 +0800
Subject: [PATCH 2/2] build(release): publish the vendored framework and the
native packages publicly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The three release sequences shipped with publishConfig.access: restricted, so
nothing in the @deepseek-ai scope was installable from outside the organization.
A restricted dependency is what actually blocks a public consumer: every harness
package declares the vendored framework as a peerDependency, and
dsh-sandbox-local declares the Landlock entry as a dependency. Those two
sequences therefore go public first — the nine vendor/* packages and the three
native/landlock-run packages — while the dsh family stays restricted until its
own sequence is opened deliberately. No public package requires a restricted one
in this arrangement.
Access is now per sequence, so no publish path can pass --access: one flag
cannot express two levels and would override the manifest that owns the fact.
publish.ts stops passing it, matching the native workflow, and
check-workspace-constraints holds each manifest to its own sequence's level,
which is what stops the scope from drifting one package at a time.
Harness consumers reference the Landlock entry as workspace:^ instead of
workspace:*, so a published harness package accepts the entry's patch and minor
releases. The entry keeps workspace:* for its platform packages, where the
binary must match the entry version exactly.
Two rationales that named a private registry no longer describe the vendored
sequence; they now state the durable reason, which is that the verification must
not depend on the registry already carrying matching versions.
---
...6-in-repository-landlock-release.i18n.yaml | 4 +-
...26-08-06-in-repository-landlock-release.md | 2 +-
...08-06-in-repository-landlock-release.zh.md | 2 +-
...2026-08-10-npm-release-sequences.i18n.yaml | 4 +-
.../2026-08-10-npm-release-sequences.md | 6 +--
.../2026-08-10-npm-release-sequences.zh.md | 6 +--
...blic-vendor-and-native-sequences.i18n.yaml | 6 +++
...8-13-public-vendor-and-native-sequences.md | 45 +++++++++++++++++++
...3-public-vendor-and-native-sequences.zh.md | 45 +++++++++++++++++++
.github/workflows/release.yml | 6 ++-
.../landlock-run/packages/entry/package.json | 2 +-
.../packages/linux-arm64/package.json | 2 +-
.../packages/linux-x64/package.json | 2 +-
.../examples/agent-spine-demo/package.json | 2 +-
packages/sandbox/sandbox-local/package.json | 2 +-
packages/shell/bash-sandbox/package.json | 2 +-
pnpm-lock.yaml | 12 ++---
scripts/check-workspace-constraints.ts | 20 ++++++---
scripts/release/publish.ts | 9 ++--
scripts/release/verify-packed-install.ts | 5 ++-
vendor/cordis/package.json | 2 +-
vendor/cosmokit/package.json | 2 +-
vendor/group/package.json | 2 +-
vendor/hmr/package.json | 2 +-
vendor/include/package.json | 2 +-
vendor/loader/package.json | 2 +-
vendor/logger-console/package.json | 2 +-
vendor/schemastery/package.json | 2 +-
vendor/timer/package.json | 2 +-
29 files changed, 152 insertions(+), 50 deletions(-)
create mode 100644 .agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.i18n.yaml
create mode 100644 .agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.md
create mode 100644 .agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.zh.md
diff --git a/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.i18n.yaml b/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.i18n.yaml
index 91ddfe4f6c..2c58cd8d43 100644
--- a/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.i18n.yaml
@@ -2,5 +2,5 @@
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.md
-2026-08-06-in-repository-landlock-release.md: 1540cebbf5a3dffa20003c70ffcec426aeca104b
-2026-08-06-in-repository-landlock-release.zh.md: 5defa5f3ca83e5a420d0c11857ad4cf46555450b
+2026-08-06-in-repository-landlock-release.md: 82b21cc0c30338ad11583797f011794b8dbcc90c
+2026-08-06-in-repository-landlock-release.zh.md: 7ebd69f505c3b071216eb23f5eed35c392e6f844
diff --git a/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.md b/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.md
index 1540cebbf5..82b21cc0c3 100644
--- a/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.md
+++ b/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.md
@@ -18,7 +18,7 @@ The consolidation must preserve platform selection. The public distribution is d
`native/landlock-run` and `native/landlock-run/packages/*` belong to the repository's root pnpm workspace and use the root `pnpm-lock.yaml`. Harness consumers declare `@deepseek-ai/node-addon-landlock-run` with `workspace:*`, so development, type checking, builds, and pull-request tests resolve the entry package from the same checkout. The root TypeScript project graph builds that entry package before consumers, and the repository cleaner owns its direct `lib/` output.
-The public npm boundary is three organization-owned packages with one launcher-family version: `@deepseek-ai/node-addon-landlock-run`, `@deepseek-ai/node-addon-landlock-run-linux-x64`, and `@deepseek-ai/node-addon-landlock-run-linux-arm64`. The entry package retains both platform packages as `optionalDependencies`; their `os` and `cpu` manifest fields let npm install only the compatible package. Repository constraints allow public publication only for those three names, require `publishConfig.access: public`, and require their versions to match the private launcher workspace root. The former unscoped names are not release targets of this repository; other repository workspaces remain private under the existing constraint.
+The public npm boundary is three organization-owned packages with one launcher-family version: `@deepseek-ai/node-addon-landlock-run`, `@deepseek-ai/node-addon-landlock-run-linux-x64`, and `@deepseek-ai/node-addon-landlock-run-linux-arm64`. The entry package retains both platform packages as `optionalDependencies`; their `os` and `cpu` manifest fields let npm install only the compatible package. Repository constraints require `publishConfig.access: public` for those three names and require their versions to match the private launcher workspace root. The former unscoped names are not release targets of this repository. These three are no longer the only public packages: the [per-sequence access decision](2026-08-13-public-vendor-and-native-sequences.md) publishes the nine vendored framework packages publicly as well, while the dsh family stays restricted.
The main repository owns both native CI and publication. `Landlock Run` runs for relevant pull requests and `master` pushes and builds each platform on its matching native runner. The manually dispatched `Landlock Run Release` workflow builds both platform binaries, transfers them as workflow artifacts, assembles and verifies the complete package family, packs immutable npm tarballs, installs and exercises those tarballs, and only then permits the protected publish job. Platform tarballs publish before the entry tarball that optionally depends on them. Publication uses `landlock-run-vX.Y.Z` tags so launcher releases cannot collide with other release families in the monorepo; prereleases use the npm `next` dist-tag.
diff --git a/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.zh.md b/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.zh.md
index 5defa5f3ca..7ebd69f505 100644
--- a/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.zh.md
+++ b/.agents/notes/implemented/process/2026-08-06-in-repository-landlock-release.zh.md
@@ -18,7 +18,7 @@ Status: implemented
`native/landlock-run` 和 `native/landlock-run/packages/*` 属于仓库根 pnpm workspace，并使用根 `pnpm-lock.yaml`。Harness 消费方将 `@deepseek-ai/node-addon-landlock-run` 声明为 `workspace:*`，因此开发、类型检查、构建和 PR 测试都会从同一个 checkout 解析入口包。根 TypeScript 项目图会先构建该入口包，再构建消费方；仓库清理器负责清理其直接生成的 `lib/` 输出目录。
-公开 npm 分发边界由 3 个归组织所有的包组成，它们共用一个启动器包家族版本：`@deepseek-ai/node-addon-landlock-run`、`@deepseek-ai/node-addon-landlock-run-linux-x64` 和 `@deepseek-ai/node-addon-landlock-run-linux-arm64`。入口包继续通过 `optionalDependencies` 声明两个平台包；它们在 manifest（元数据清单）中的 `os` 和 `cpu` 字段让 npm 只安装兼容的包。仓库约束只允许公开发布这 3 个包名，要求设置 `publishConfig.access: public`，并要求其版本与私有启动器 workspace 根包一致。原先的非 scoped 包名不属于本仓库的发布目标；仓库中的其他 workspace 仍受现有约束保护，保持私有状态。
+公开 npm 分发边界由 3 个归组织所有的包组成，它们共用一个启动器包家族版本：`@deepseek-ai/node-addon-landlock-run`、`@deepseek-ai/node-addon-landlock-run-linux-x64` 和 `@deepseek-ai/node-addon-landlock-run-linux-arm64`。入口包继续通过 `optionalDependencies` 声明两个平台包；它们在 manifest（元数据清单）中的 `os` 和 `cpu` 字段让 npm 只安装兼容的包。仓库约束要求这 3 个包名设置 `publishConfig.access: public`，并要求其版本与私有启动器 workspace 根包一致。原先的非 scoped 包名不属于本仓库的发布目标。这 3 个已不再是唯一的公开包：[按序列区分 access 的决策](2026-08-13-public-vendor-and-native-sequences.md)让 vendored 框架九包也公开发布，而 dsh 族保持受限。
主仓库同时负责原生 CI 和发布。`Landlock Run` 会为相关 PR 和 `master` 推送运行，并在各自匹配的原生 runner 上构建每个平台包。手动触发的 `Landlock Run Release` 工作流会构建两个平台的二进制文件，将其作为工作流产物传递，组装并验证完整的包家族，打包出内容不可变的 npm tarball，安装并实际运行这些 tarball，之后才允许受保护的发布作业执行。发布顺序是平台 tarball 在前，最后发布将它们列为可选依赖的入口 tarball。发布使用 `landlock-run-vX.Y.Z` tag，避免启动器版本与 monorepo 中其他发布家族发生冲突；预发布版本使用 npm 的 `next` dist-tag。
diff --git a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.i18n.yaml b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.i18n.yaml
index 9f147f34bb..5ba0aef406 100644
--- a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.i18n.yaml
+++ b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.i18n.yaml
@@ -2,5 +2,5 @@
# side as of the last confirmed-consistent state. Both languages carry equal authority;
# after editing either side, bring the other along and re-record with:
# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-10-npm-release-sequences.md
-2026-08-10-npm-release-sequences.md: 13f343911b6d684ec8738b2245ceae8d848e2f0c
-2026-08-10-npm-release-sequences.zh.md: 4116b74b54e84d33df29fd0ab9169f8d38d5514d
+2026-08-10-npm-release-sequences.md: e8138aef923e201cc0883232f48ce6921452ca00
+2026-08-10-npm-release-sequences.zh.md: 7ce9fa01dbe10cbdae5585f64392d0ca6a9fb868
diff --git a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md
index 13f343911b..e8138aef92 100644
--- a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md
+++ b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md
@@ -26,7 +26,7 @@ Two hard blockers sat in the way. All 217 workspace manifests set `private: true
| vendored framework | the nine `vendor/*` packages | each package on its own version line | `vendor--v` (one per package) | `release-vendor.yml` |
| native | `native/landlock-run/packages/*` | its own `0.0.x` | `landlock-run-v` | `landlock-run-release.yml` |
-All three publish privately to the `@deepseek-ai` scope on npmjs.com. `publishConfig.access` in each manifest is `restricted` and no workflow passes `--access`, because a command-line flag overrides the manifest.
+All three publish to the `@deepseek-ai` scope on npmjs.com, and access is per sequence rather than per scope: the vendored framework and the native packages are `public`, the dsh family is `restricted` ([rationale](2026-08-13-public-vendor-and-native-sequences.md)). No publish path passes `--access`, because one flag cannot serve sequences that disagree and would override the manifest that owns the level.
### Versions land in the repository from a local command; CI only checks and uploads
@@ -107,12 +107,12 @@ The verification also packs the Landlock entry, which `dsh-sandbox-local` declar
| Item | Content |
|---|---|
-| release-set manifests | `private: true` removed; `publishConfig.access: restricted` and `repository` with each package's `directory` added |
+| release-set manifests | `private: true` removed; `publishConfig.access` per sequence and `repository` with each package's `directory` added |
| release-set boundary | every member of `packages/*/*`, `apps/*`, and `vendor/*` |
| dependency protocol | workspace-internal references are `workspace:^`, with `check-workspace-constraints.ts` and the invariant-companion rule requiring it |
| root `AGENTS.md` | the convention that vendored packages are `private: true` no longer holds |
| `vendor/README.md` | records `src` joining `cordis`'s `files` as a local modification |
-| the three native packages | `publishConfig.access: restricted`, and their workflow no longer passes `--access` |
+| the three native packages | `publishConfig.access: public`, and their workflow passes no `--access` |
### Relationship to the earlier proposal
diff --git a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.zh.md b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.zh.md
index 4116b74b54..7ce9fa01db 100644
--- a/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.zh.md
+++ b/.agents/notes/implemented/process/2026-08-10-npm-release-sequences.zh.md
@@ -26,7 +26,7 @@ Status: implemented
| vendored framework | `vendor/*` 九个包 | 每包各自一条版本线 | `vendor-<包名>-v<版本>`（每包一个） | `release-vendor.yml` |
| native | `native/landlock-run/packages/*` | 自己的 `0.0.x` | `landlock-run-v<版本>` | `landlock-run-release.yml` |
-三组一律发到 npmjs.com 的 `@deepseek-ai` scope 下的私有包。每个 manifest 的 `publishConfig.access` 都是 `restricted`，且没有任何 workflow 传 `--access`——命令行选项会覆盖 manifest。
+三组一律发到 npmjs.com 的 `@deepseek-ai` scope，且 access 按序列而非按 scope 区分：vendored 框架与 native 包是 `public`，dsh 族是 `restricted`（[理由](2026-08-13-public-vendor-and-native-sequences.md)）。没有任何发布路径传 `--access`——一个选项无法服务级别互不相同的序列，且会覆盖真正拥有该级别的 manifest。
### 版本由本地命令写进仓库，CI 只核对与上传
@@ -107,12 +107,12 @@ dsh 的验证会一并安装 vendored 族的 pack 产物。harness 的包把 ven
| 项 | 内容 |
|---|---|
-| 发布集 manifest | 去掉 `private: true`；补 `publishConfig.access: restricted` 与带各自 `directory` 的 `repository` |
+| 发布集 manifest | 去掉 `private: true`；按序列补 `publishConfig.access` 与带各自 `directory` 的 `repository` |
| 发布集边界 | `packages/*/*`、`apps/*`、`vendor/*` 的全部成员 |
| 依赖协议 | workspace 内部引用为 `workspace:^`，由 `check-workspace-constraints.ts` 与 invariant companion 规则强制 |
| 根 `AGENTS.md` | 「vendored 包是 `private: true`」这条约定不再成立 |
| `vendor/README.md` | 记录「`src` 加入 `cordis` 的 `files`」这条本地修改 |
-| native 三包 | `publishConfig.access: restricted`，且其 workflow 不再传 `--access` |
+| native 三包 | `publishConfig.access: public`，且其 workflow 不传 `--access` |
### 与先前提案的关系
diff --git a/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.i18n.yaml b/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.i18n.yaml
new file mode 100644
index 0000000000..07a3e279de
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.i18n.yaml
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+# pnpm run verify-translation-pairing --write .agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.md
+2026-08-13-public-vendor-and-native-sequences.md: ada7c3bcbe5feb288d67fe8e7ee7204dda6b4597
+2026-08-13-public-vendor-and-native-sequences.zh.md: 1f687d1134baf58c59f5cf6014e265b24a38042f
diff --git a/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.md b/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.md
new file mode 100644
index 0000000000..ada7c3bcbe
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.md
@@ -0,0 +1,45 @@
+# Agent Note: npm access per release sequence: the vendored framework and the native packages publish publicly
+
+Status: implemented
+
+English | [中文](2026-08-13-public-vendor-and-native-sequences.zh.md)
+
+## Problem
+
+The [three release sequences](2026-08-10-npm-release-sequences.md) shipped with `publishConfig.access: restricted`, so every package published to the `@deepseek-ai` scope was visible only inside the organization. Five rehearsal publications ran that way, through `dsh@0.0.1-rc.5`, `vendor *-rc.4`, and `landlock-run@0.0.1`.
+
+A restricted dependency is what actually blocks a public consumer. Every harness package declares the vendored framework as a `peerDependency`, and `dsh-sandbox-local` declares the Landlock entry as a `dependency`. A public package that requires a restricted one cannot be installed by anyone outside the organization, so those two sequences have to be public before the dsh family can be — and while the dsh family is still restricted, they are the only two whose artifacts an outside consumer would need to resolve.
+
+## Decision
+
+Access is a property of each release sequence, not of the scope:
+
+| Sequence | Members | `publishConfig.access` |
+|---|---|---|
+| vendored framework | the nine `vendor/*` packages | `public` |
+| native | the three `native/landlock-run/packages/*` packages | `public` |
+| dsh | `packages/*/*` + `apps/*` (221 members) | `restricted` |
+
+`check-workspace-constraints.ts` holds every manifest to its own sequence's level, which is what stops the scope from drifting: a new `vendor/*` package left at `restricted`, or a dsh member flipped to `public`, fails the workspace constraints.
+
+**No publish path passes `--access`.** A single flag cannot serve sequences that disagree, and a flag overrides the manifest that owns the fact — so `publish.ts` passes none, and the native workflow continues to pass none. Each packed manifest decides.
+
+Harness consumers reference the Landlock entry as `workspace:^` rather than `workspace:*`, so a published harness package accepts the entry's patch and minor releases instead of pinning one exact version. The entry keeps `workspace:*` for its two platform packages, where the binary must match the entry version exactly.
+
+Access is a property of the package, not of a version: the twelve packages already published as restricted — `landlock-run@0.0.1` and the vendored `*-rc.*` versions — become world-readable at their next publication.
+
+## Alternatives considered
+
+**Flip the whole scope public at once.** Rejected for now: it would make the next dsh release public as a side effect of a manifest change rather than a deliberate release decision. Opening the two dependency sequences first is the order that keeps every published package installable at each step, and it is the precondition for opening dsh whenever that is decided.
+
+**Keep everything restricted and grant a read-only team instead.** `npm access grant read-only ` is per-package with no scope wildcard, so covering the set means one grant per package plus a standing reconciliation job for every package added afterwards. It also only reaches organization members, which does not serve an installable public artifact.
+
+**Publish public from the publish path instead of the manifests.** Impossible for a mixed scope — one `--access` flag cannot express two levels — and it would override the manifest that the workspace constraint already checks.
+
+## Consequences
+
+- **The twelve packages are public from their next publication onward, and that is not cleanly reversible.** Returning to a restricted scope requires a paid plan plus per-package `npm access set status=private`, and anything already downloaded or mirrored stays out.
+- **`@deepseek-ai/dsh` is still not installable from outside the organization.** Its manifests stay `restricted`; what changed is that its published dependencies no longer would be, so opening it later is a version decision rather than a dependency problem.
+- **What ships from the two public sequences is now world-readable, so their payload policy carries more weight.** `vendor/cordis` publishes `src` deliberately, because its export map declares `./src/*`; the Landlock entry publishes `src/main.c` as a documented audit surface.
+- **The private-packages plan is no longer required for these two sequences.** The `402 Payment Required` failure that blocked the first native publication cannot recur for a public package.
+- **An unauthenticated `npm view` becomes a usable check for the public sequences.** While every package was restricted, a machine without credentials received `E404` for a package that existed, which is indistinguishable from an absent version.
diff --git a/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.zh.md b/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.zh.md
new file mode 100644
index 0000000000..1f687d1134
--- /dev/null
+++ b/.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.zh.md
@@ -0,0 +1,45 @@
+# Agent Note: 按发布序列区分 npm access:vendored 框架与 native 包公开发布
+
+Status: implemented
+
+[English](2026-08-13-public-vendor-and-native-sequences.md) | 中文
+
+## Problem
+
+[三条发布序列](2026-08-10-npm-release-sequences.md)交付时带的是 `publishConfig.access: restricted`,因此发到 `@deepseek-ai` scope 的每个包只在组织内可见。五次排练发布都是这样跑的:`dsh@0.0.1-rc.5`、vendor 的 `*-rc.4`、`landlock-run@0.0.1`。
+
+真正卡住公开消费者的是**受限的依赖**。每个 harness 包都把 vendored 框架声明成 `peerDependency`,`dsh-sandbox-local` 把 Landlock 入口声明成 `dependency`。一个公开包若要求一个受限包,组织外的人根本装不上;所以这两条序列必须先公开,dsh 族才可能公开 —— 而在 dsh 族仍受限期间,它们也正是外部消费者唯一需要解析到的两条。
+
+## Decision
+
+access 是每条发布序列的属性,不是整个 scope 的属性:
+
+| 序列 | 成员 | `publishConfig.access` |
+|---|---|---|
+| vendored 框架 | `vendor/*` 九包 | `public` |
+| native | `native/landlock-run/packages/*` 三包 | `public` |
+| dsh | `packages/*/*` + `apps/*`(221 个成员) | `restricted` |
+
+`check-workspace-constraints.ts` 按各自序列的级别校验每个 manifest,这是阻止 scope 漂移的那道闸:新增的 `vendor/*` 包留在 `restricted`、或某个 dsh 成员被改成 `public`,都会让 workspace 约束失败。
+
+**没有任何发布路径传 `--access`。** 一个选项无法服务级别互不相同的序列,而且选项会覆盖真正拥有这个事实的 manifest —— 所以 `publish.ts` 不传,native 的 workflow 也照旧不传,由各 packed manifest 决定。
+
+harness 消费方引用 Landlock 入口改用 `workspace:^` 而非 `workspace:*`,于是发布出去的 harness 包接受该入口的 patch 与 minor 版本,而不是钉死一个精确版本。入口对它那两个平台包仍保持 `workspace:*` —— 那里二进制必须与入口版本完全一致。
+
+access 是包的属性、不是版本的属性:已经以 restricted 发布的这十二个包(`landlock-run@0.0.1` 与 vendored 的 `*-rc.*`)会在**下一次发布**时变为全网可读。
+
+## Alternatives considered
+
+**一次性把整个 scope 改成 public。** 暂不采用:那会让下一次 dsh 发布因为一次 manifest 改动而顺带变成公开,而不是出自一个刻意的发布决定。先公开这两条依赖序列,是能让每一步的已发布包都保持可安装的顺序,也是将来决定公开 dsh 时的前置条件。
+
+**全部保持受限,改为授予一个只读 team。** `npm access grant read-only <包>` 是逐包的、没有 scope 通配,覆盖全集意味着每个包一次 grant,外加一个为后续新增包长期补齐的对账任务。它也只能覆盖组织成员,无法服务一个可安装的公开产物。
+
+**在发布路径而不是 manifest 里指定公开。** 混合 scope 下不可能 —— 一个 `--access` 选项表达不了两种级别 —— 而且它会覆盖 workspace 约束正在校验的那个 manifest。
+
+## Consequences
+
+- **这十二个包从下一次发布起就是公开的,而且不能干净地回退。** 回到受限 scope 需要付费套餐加逐包 `npm access set status=private`,且已经被下载或镜像的内容收不回来。
+- **`@deepseek-ai/dsh` 仍然装不了(组织外)。** 它的 manifest 保持 `restricted`;变化的是它已发布的依赖不再受限,所以将来公开它是一个版本决定,而不再是依赖问题。
+- **两条公开序列交付的内容成为全网可读,它们的 payload 策略分量因此变重。** `vendor/cordis` 有意发布 `src`,因为其导出映射声明了 `./src/*`;Landlock 入口按既有约定发布 `src/main.c` 作为审计面。
+- **这两条序列不再需要私有包套餐。** 阻塞过首次 native 发布的 `402 Payment Required` 失败形态对公开包不会再出现。
+- **对公开序列,无凭据的 `npm view` 成为一个可用的检查手段。** 在所有包都受限的时期,没有凭据的机器对一个确实存在的包会收到 `E404`,与「版本不存在」无法区分。
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cab178a3d2..2e20c215fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,8 +81,10 @@ jobs:
run: pnpm run release:pack --family dsh --out dist/npm
# The harness packages declare the vendored framework as a peer, and this
- # job has no credentials for the private registry, so the verification
- # installs that family's pack output too. Only dist/npm is published.
+ # verification must not depend on the registry already carrying matching
+ # versions — one pull request may bump both families before either
+ # publishes — so it installs that family's pack output too. Only dist/npm
+ # is published.
- name: Pack the vendored framework for verification
run: pnpm run release:pack --family vendor --out dist/npm-vendor
diff --git a/native/landlock-run/packages/entry/package.json b/native/landlock-run/packages/entry/package.json
index b3384a58c0..1614df5ad2 100644
--- a/native/landlock-run/packages/entry/package.json
+++ b/native/landlock-run/packages/entry/package.json
@@ -32,7 +32,7 @@
},
"license": "BSD-3-Clause",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"optionalDependencies": {
"@deepseek-ai/node-addon-landlock-run-linux-arm64": "workspace:*",
diff --git a/native/landlock-run/packages/linux-arm64/package.json b/native/landlock-run/packages/linux-arm64/package.json
index 11d9384c87..14190e4765 100644
--- a/native/landlock-run/packages/linux-arm64/package.json
+++ b/native/landlock-run/packages/linux-arm64/package.json
@@ -26,6 +26,6 @@
},
"license": "BSD-3-Clause",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
}
}
diff --git a/native/landlock-run/packages/linux-x64/package.json b/native/landlock-run/packages/linux-x64/package.json
index 6e3ad395e6..43c092d17b 100644
--- a/native/landlock-run/packages/linux-x64/package.json
+++ b/native/landlock-run/packages/linux-x64/package.json
@@ -26,6 +26,6 @@
},
"license": "BSD-3-Clause",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
}
}
diff --git a/packages/examples/agent-spine-demo/package.json b/packages/examples/agent-spine-demo/package.json
index 5a7b1e3cb6..84f36fe690 100644
--- a/packages/examples/agent-spine-demo/package.json
+++ b/packages/examples/agent-spine-demo/package.json
@@ -91,7 +91,7 @@
"@deepseek-ai/dsh-tool-jobs": "workspace:^",
"@deepseek-ai/dsh-tools": "workspace:^",
"@deepseek-ai/dsh-agent-instructions": "workspace:^",
- "@deepseek-ai/node-addon-landlock-run": "workspace:*",
+ "@deepseek-ai/node-addon-landlock-run": "workspace:^",
"@deepseek-ai/cordis": "workspace:^"
},
"dependencies": {
diff --git a/packages/sandbox/sandbox-local/package.json b/packages/sandbox/sandbox-local/package.json
index 57918c351b..dfe13545ad 100644
--- a/packages/sandbox/sandbox-local/package.json
+++ b/packages/sandbox/sandbox-local/package.json
@@ -40,7 +40,7 @@
},
"dependencies": {
"@deepseek-ai/dsh-sandbox-windows-acl": "workspace:^",
- "@deepseek-ai/node-addon-landlock-run": "workspace:*",
+ "@deepseek-ai/node-addon-landlock-run": "workspace:^",
"@deepseek-ai/schemastery": "workspace:^"
},
"devDependencies": {
diff --git a/packages/shell/bash-sandbox/package.json b/packages/shell/bash-sandbox/package.json
index ac0c510be3..bb68dc855b 100644
--- a/packages/shell/bash-sandbox/package.json
+++ b/packages/shell/bash-sandbox/package.json
@@ -48,6 +48,6 @@
"@deepseek-ai/dsh-sandbox-local": "workspace:^",
"@deepseek-ai/dsh-sandbox-policy": "workspace:^",
"@deepseek-ai/cordis": "workspace:^",
- "@deepseek-ai/node-addon-landlock-run": "workspace:*"
+ "@deepseek-ai/node-addon-landlock-run": "workspace:^"
}
}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index bcf3621936..1490a0f9f7 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1124,12 +1124,6 @@ importers:
'@deepseek-ai/dsh-subagent':
specifier: workspace:^
version: link:../../subagent/subagent
- '@deepseek-ai/dsh-subagent-claude-code':
- specifier: workspace:^
- version: link:../../subagent/subagent-claude-code
- '@deepseek-ai/dsh-subagent-codex':
- specifier: workspace:^
- version: link:../../subagent/subagent-codex
'@deepseek-ai/dsh-subagent-fork-in-process':
specifier: workspace:^
version: link:../../subagent/subagent-fork-in-process
@@ -3922,7 +3916,7 @@ importers:
specifier: workspace:^
version: link:../../core/tools
'@deepseek-ai/node-addon-landlock-run':
- specifier: workspace:*
+ specifier: workspace:^
version: link:../../../native/landlock-run/packages/entry
packages/examples/jsonrpc-demo:
@@ -5661,7 +5655,7 @@ importers:
specifier: workspace:^
version: link:../sandbox-windows-acl
'@deepseek-ai/node-addon-landlock-run':
- specifier: workspace:*
+ specifier: workspace:^
version: link:../../../native/landlock-run/packages/entry
'@deepseek-ai/schemastery':
specifier: link:../../../vendor/schemastery
@@ -6451,7 +6445,7 @@ importers:
specifier: workspace:^
version: link:../../subprocess/subprocess-local
'@deepseek-ai/node-addon-landlock-run':
- specifier: workspace:*
+ specifier: workspace:^
version: link:../../../native/landlock-run/packages/entry
packages/shell/pwsh-local:
diff --git a/scripts/check-workspace-constraints.ts b/scripts/check-workspace-constraints.ts
index 12cb40e98e..ee30778f3e 100644
--- a/scripts/check-workspace-constraints.ts
+++ b/scripts/check-workspace-constraints.ts
@@ -231,8 +231,8 @@ function checkWorkspace({ dir, manifest }: WorkspaceManifest): string[] {
if (manifest.private === true) {
errors.push(`${label}: published Landlock package must not set "private": true`)
}
- if (manifest.publishConfig?.access !== 'restricted') {
- errors.push(`${label}: published Landlock package must set publishConfig.access to "restricted"`)
+ if (manifest.publishConfig?.access !== 'public') {
+ errors.push(`${label}: published Landlock package must set publishConfig.access to "public"`)
}
const expectedDirectory = dir
if (manifest.repository?.type !== 'git'
@@ -242,13 +242,21 @@ function checkWorkspace({ dir, manifest }: WorkspaceManifest): string[] {
}
} else if (releaseMemberDirectory.test(dir)) {
// Release members state that they are publishable: npm refuses a private
- // package, the scope is published privately, and the repository field is
- // how a consumer of a private package finds its source.
+ // package, and the repository field is how a consumer finds the source of
+ // the package it installed.
+ //
+ // Access is per release sequence, not per scope: the vendored framework and
+ // the Landlock packages publish publicly because outside consumers install
+ // them, while the dsh family stays restricted until its own sequence goes
+ // public. A mixed scope is why no publish path passes `--access` — one flag
+ // cannot serve both, so each packed manifest decides
+ // ([rationale](../.agents/notes/implemented/process/2026-08-13-public-vendor-and-native-sequences.md)).
+ const expectedAccess = dir.startsWith('vendor/') ? 'public' : 'restricted'
if (manifest.private === true) {
errors.push(`${label}: release member must not set "private": true`)
}
- if (manifest.publishConfig?.access !== 'restricted') {
- errors.push(`${label}: release member must set publishConfig.access to "restricted"`)
+ if (manifest.publishConfig?.access !== expectedAccess) {
+ errors.push(`${label}: release member must set publishConfig.access to "${expectedAccess}"`)
}
if (manifest.repository?.type !== 'git'
|| manifest.repository.url !== publishedRepositoryUrl
diff --git a/scripts/release/publish.ts b/scripts/release/publish.ts
index b180ce1aba..2c68dc7f9f 100644
--- a/scripts/release/publish.ts
+++ b/scripts/release/publish.ts
@@ -20,9 +20,6 @@ import { releaseFamily } from './families.ts'
import { attempt, isEntry, run } from './process.ts'
import { packedIdentity, readPublishOrder } from './tarball.ts'
-/** npm access level for every package this repository publishes. */
-const ACCESS = 'restricted'
-
/** What the registry knows about one version. */
type RegistryState =
| { readonly kind: 'absent' }
@@ -91,7 +88,11 @@ function main(): void {
}
// A prerelease version never takes the latest dist-tag.
const tagArgs = version.includes('-') ? ['--tag', 'next'] : []
- run('npm', ['publish', tarball, '--access', ACCESS, ...tagArgs])
+ // No --access: the sequences do not share one access level, so a
+ // command-line flag could not serve both and would override the manifest
+ // that does. Each packed manifest decides, and
+ // check-workspace-constraints holds every manifest to its sequence's level.
+ run('npm', ['publish', tarball, ...tagArgs])
published += 1
}
diff --git a/scripts/release/verify-packed-install.ts b/scripts/release/verify-packed-install.ts
index 29ec7b851e..65b8ba7691 100644
--- a/scripts/release/verify-packed-install.ts
+++ b/scripts/release/verify-packed-install.ts
@@ -5,8 +5,9 @@
* Every tarball the installed tree needs comes from `--from`, so the only
* registry traffic is for external dependencies. That matters beyond hermetic
* verification: the harness packages declare the vendored framework as a peer,
- * and those packages live in another release sequence that this credential-free
- * job cannot fetch from a private registry — so a dsh verification passes the
+ * those packages live in another release sequence, and this job must not depend
+ * on the registry already carrying versions that match — one pull request may
+ * bump both families before either publishes — so a dsh verification passes the
* vendored family's pack output too, while publishing only its own
* ([rationale](../../.agents/notes/implemented/process/2026-08-10-npm-release-sequences.md)).
*
diff --git a/vendor/cordis/package.json b/vendor/cordis/package.json
index a9bbe093f4..0f67de8042 100644
--- a/vendor/cordis/package.json
+++ b/vendor/cordis/package.json
@@ -3,7 +3,7 @@
"description": "Meta-Framework for Modern JavaScript Applications",
"version": "4.0.1-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",
diff --git a/vendor/cosmokit/package.json b/vendor/cosmokit/package.json
index afeda39007..fab1cf6cbd 100644
--- a/vendor/cosmokit/package.json
+++ b/vendor/cosmokit/package.json
@@ -3,7 +3,7 @@
"description": "A collection of common utilities",
"version": "1.8.2-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",
diff --git a/vendor/group/package.json b/vendor/group/package.json
index 57aacb6a28..f2897f96ab 100644
--- a/vendor/group/package.json
+++ b/vendor/group/package.json
@@ -3,7 +3,7 @@
"description": "Nested plugin group for cordis",
"version": "1.0.1-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",
diff --git a/vendor/hmr/package.json b/vendor/hmr/package.json
index b14c286d6d..7692b36f50 100644
--- a/vendor/hmr/package.json
+++ b/vendor/hmr/package.json
@@ -3,7 +3,7 @@
"description": "Hot Module Replacement Plugin for Cordis",
"version": "1.0.16-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",
diff --git a/vendor/include/package.json b/vendor/include/package.json
index f5db70bc18..13fd1b484e 100644
--- a/vendor/include/package.json
+++ b/vendor/include/package.json
@@ -3,7 +3,7 @@
"description": "Include files in cordis configurations",
"version": "1.0.6-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",
diff --git a/vendor/loader/package.json b/vendor/loader/package.json
index e751e2019e..ce30852c72 100644
--- a/vendor/loader/package.json
+++ b/vendor/loader/package.json
@@ -3,7 +3,7 @@
"description": "Plugin loader for cordis",
"version": "1.0.2-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",
diff --git a/vendor/logger-console/package.json b/vendor/logger-console/package.json
index 0c694e9736..1524da59cf 100644
--- a/vendor/logger-console/package.json
+++ b/vendor/logger-console/package.json
@@ -3,7 +3,7 @@
"description": "Console logger exporter for cordis",
"version": "1.0.1-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",
diff --git a/vendor/schemastery/package.json b/vendor/schemastery/package.json
index 54a7435b01..5df93d825d 100644
--- a/vendor/schemastery/package.json
+++ b/vendor/schemastery/package.json
@@ -3,7 +3,7 @@
"description": "Type driven schema validator",
"version": "3.18.1-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",
diff --git a/vendor/timer/package.json b/vendor/timer/package.json
index 8785e32725..5972214208 100644
--- a/vendor/timer/package.json
+++ b/vendor/timer/package.json
@@ -3,7 +3,7 @@
"description": "Timer service for cordis",
"version": "1.1.3-rc.4",
"publishConfig": {
- "access": "restricted"
+ "access": "public"
},
"repository": {
"type": "git",