build(release): make the release set publishable under the private scope

Every package under packages/, apps/, and vendor/ drops "private": true and
declares publishConfig.access "restricted": the repository now states which
packages it publishes instead of deciding it at publish time. Each one also
declares its repository and directory, which is how a consumer of a private
package reaches its source.

The Landlock packages move to restricted with them. They have never been
published, so nothing anonymous depends on them today, and the whole
@deepseek-ai scope stays private.

The workspace constraint that required every package to be private now applies
to non-members only, and asserts the publishable trio on each release member.

packages/client/connection/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-connection",
   "description": "Wire consumer layer: HTTP-up/WebSocket-down client, ConnectionController dual streams with reconnect, and fixture api",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/connection"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/hmr/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-hmr",
   "description": "Dev-only hot-reload driver for script-loaded client entries: SSE rebuilt frames → invalidate/prefetch → fiber swap through the vendored Loader entry",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/hmr"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/locale/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-locale",
   "description": "Locale plugin: Host-backed zh/en preference, browser-derived fallback, locale snapshots, and typed namespace dictionaries",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/locale"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/modules/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-modules",
   "description": "Client module system, dual-face: node half composes the __DSH_BOOT__ entry graph (incremental dsh.client scan, bundle route, index tap, webPlugins service); browser half is the lazy-CJS module table the vendored cordis Loader consumes as its internal seam",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/modules"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/runtime/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-runtime",
   "description": "Client core services: SlotsService, SessionsService (scope tree + object layer)",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/runtime"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/schema-form/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-schema-form",
   "description": "Schema/draft model layer for settings editors: rehydrates a serialized schemastery schema, validates drafts, and edits them immutably by path",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/schema-form"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/test-runtime/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-test-runtime",
   "description": "jsdom slot test runtime: real Cordis Context + SlotsService + web-react renderer with test-owned session/workspace doubles for feature specs",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/test-runtime"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-agent-preset/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-agent-preset",
   "description": "Agent-preset surfaces: the default for later sessions, this session's seat, and the composition editor",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-agent-preset"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-command/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-command",
   "description": "Client command surface: global directory cache, '/' source, three command UI kinds, popupSelect registry",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-command"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-conversation/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-conversation",
   "description": "Conversation domain: skeleton, ordered chat flow, composer with the Host-backed busy-Enter preference, and details host",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-conversation"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-deliverables/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-deliverables",
   "description": "Produced-files turn tail: the deliverables row a finished turn ends with",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-deliverables"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-goal/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-goal",
   "description": "Session goal surface: GoalBar docked above the composer, read from the goal session projection",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-goal"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-layout/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-layout",
   "description": "Shell plugin: three-column AppFrame with drag handles, ctx.layout viewing-state service (navigation + panels)",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-layout"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-model/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-model",
   "description": "Model selection: the /model popupSelect over session.models / session.selectModel",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-model"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-models/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-models",
   "description": "Models settings and official-DeepSeek first-run routing over one live provider/settings/credential join",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-models"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-permission/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-permission",
   "description": "Permission surfaces: a new-session default in General settings and a current-session /permission popup over the permissions projection",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-permission"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-plan/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-plan",
   "description": "Plan-mode composer control: the conversation.input.plan seat over the plan projection and the /plan command channel",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-plan"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-primitives/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-primitives",
   "description": "Pure React atoms for the dsh web UI: controls, icons, markdown, and JSON inspectors (zero cordis)",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-primitives"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-question/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-question",
   "description": "Web ask_user_question feature: host tool mount plus composer-takeover question UI",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-question"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-settings-general/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-settings-general",
   "description": "Settings ownerless-copy and product onboarding plugin: the General section, shell trigger/header chrome content, settings dictionaries, and the versioned welcome notice",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-settings-general"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-settings/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-settings",
   "description": "Settings shell plugin: sidebar trigger, modal panel, feature sections, and an ordered full-page onboarding stage",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-settings"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-sidebar/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-sidebar",
   "description": "Sidebar plugin: session multi-level tree, search, grouping, state dots",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-sidebar"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-skill/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-skill",
   "description": "Web skill references and the dedicated skill tool row",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-skill"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-slash/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-slash",
   "description": "Input trigger pipeline: '/' and '@' detection, candidate menu, pick routing to registered sources",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-slash"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-slots/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-slots",
   "description": "Slot registry pure core: SlotMap declaration merging, single register composition API, four-share props types, store-seat types, renderer install seam",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-slots"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-subagent/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-subagent",
   "description": "Subagent conversation catalog, continuation routing UI, and '@' reference source",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-subagent"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-theme/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-theme",
   "description": "Theme plugin: ThemeService (light/dark/system preference, prefers-color-scheme resolution, theme/change snapshots; no DOM), --dsw-* token base stylesheets; registers the Appearance settings row",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-theme"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-tool/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-tool",
   "description": "Client Tool call-tree renderer and keyed per-tool presentation slot",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-tool"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-trajectory/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-trajectory",
   "description": "Trajectory event ledger with an interactive timing overview: pure-consumer plugin registering into the conversation ViewMap (no service)",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-trajectory"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/ui-workspace/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-ui-workspace",
   "description": "Workspace picker plugin: one WorkspacePicker registered into the sidebar and empty-state workspace slots",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/ui-workspace"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/web-react/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-web-react",
   "description": "Shell-side React glue: createSlotRenderer, SessionProvider, bindSnapshotSelector (uSES bridge), useInvoke",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/web-react"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

packages/client/web/package.json

@@ -2,7 +2,14 @@
   "name": "@deepseek-ai/dsh-client-web",
   "description": "Web shell kernel: bootWebShell (module system holding + seed table + two-stage boot + AppRoot gate + app-shell assembly entry), consumed by the apps/web vite entry",
   "version": "0.0.1",
-  "private": true,
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/client/web"
+  },
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",