a213befd0f
The three release sequences shipped with publishConfig.access: restricted, so nothing in the @deepseek-ai scope was installable from outside the organization. A restricted dependency is what actually blocks a public consumer: every harness package declares the vendored framework as a peerDependency, and dsh-sandbox-local declares the Landlock entry as a dependency. Those two sequences therefore go public first — the nine vendor/* packages and the three native/landlock-run packages — while the dsh family stays restricted until its own sequence is opened deliberately. No public package requires a restricted one in this arrangement. Access is now per sequence, so no publish path can pass --access: one flag cannot express two levels and would override the manifest that owns the fact. publish.ts stops passing it, matching the native workflow, and check-workspace-constraints holds each manifest to its own sequence's level, which is what stops the scope from drifting one package at a time. Harness consumers reference the Landlock entry as workspace:^ instead of workspace:*, so a published harness package accepts the entry's patch and minor releases. The entry keeps workspace:* for its platform packages, where the binary must match the entry version exactly. Two rationales that named a private registry no longer describe the vendored sequence; they now state the durable reason, which is that the verification must not depend on the registry already carrying matching versions.
examples/ — ready-to-run demo bundles
English | 中文
Pre-composed plugin bundles a thin leaf cordis.yml loads instead of assembling the spine and an entry point by hand. These are demo / reference packages — the -demo npm suffix marks each one as non-product surface, readable straight off the package name. The runnable leaves under the repo-root examples/ and the Python SDK runtime are the consumers; each is just its swappable backends plus one bundle entry.
| Package | npm name | Role |
|---|---|---|
agent-spine-demo/ |
@deepseek-ai/dsh-agent-spine-demo |
Reusable agent-spine bundle |
acp-demo/ |
@deepseek-ai/dsh-acp-demo |
ACP automation application bundle |
jsonrpc-demo/ |
@deepseek-ai/dsh-sdk-jsonrpc-demo |
External-config JSON-RPC runtime |
agent-spine-demo is the shared bundle; acp-demo adds its automation entry point, while jsonrpc-demo boots a deployment-owned plugin tree. Product one-shot execution belongs to dsh --profile headless; no package in this directory provides it.
These packages are not product API. Product seams and entry points remain in their owning groups; demo bundles select concrete compositions.
Do not confuse this group with the repo-root examples/: that directory holds the runnable cordis.yml leaves; this group holds the bundles those leaves load.