Merge origin/master into feature/shared-cli-config-foundation

apps/cli/src/headless.ts

@@ -75,8 +75,8 @@ async function consumeUntilTurnEnd(frames: AsyncIterable<RpcRequest<MuxFrame>>,
 export async function runHeadless(task: string): Promise<void> {
   // A missing DEEPSEEK_API_KEY throws here (plugin load is fail-loud, uncaught by design).
   const entry = new AppCLIEntry({
-    configPath: fileURLToPath(new URL('../base.cordis.yml', import.meta.url)),
-    overlayPath: fileURLToPath(new URL('../web.cordis.yml', import.meta.url)),
+    configPath: fileURLToPath(new URL('../config/base.cordis.yml', import.meta.url)),
+    overlayPath: fileURLToPath(new URL('../config/web.cordis.yml', import.meta.url)),
     dev: false,
     port: 0,
   })

apps/cli/src/tui.ts

@@ -50,8 +50,8 @@ const NAME = 'dsh'
 // The shared core every `dsh` surface mounts, and the TUI's own overlay over
 // it. Both the source tree (apps/cli/src) and the bundled bin (apps/cli/lib)
 // sit one directory under apps/cli, so each resolves with the same hop.
-const BASE_CONFIG = fileURLToPath(new URL('../base.cordis.yml', import.meta.url))
-const TUI_OVERLAY = fileURLToPath(new URL('../tui.cordis.yml', import.meta.url))
+const BASE_CONFIG = fileURLToPath(new URL('../config/base.cordis.yml', import.meta.url))
+const TUI_OVERLAY = fileURLToPath(new URL('../config/tui.cordis.yml', import.meta.url))
 
 // The `agents` entry in tui.cordis.yml the TUI drives; the launcher binds its
 // session identity by this config id.

apps/cli/src/web.ts

@@ -11,8 +11,8 @@ import { resolveConfigPath } from '@deepseek-ai/dsh-app-boot'
 import { AppCLIEntry } from './app-cli-entry.ts'
 
 // The shared core every `dsh` surface mounts, plus this surface's overlay over it.
-const BASE_CONFIG = fileURLToPath(new URL('../base.cordis.yml', import.meta.url))
-const WEB_OVERLAY = fileURLToPath(new URL('../web.cordis.yml', import.meta.url))
+const BASE_CONFIG = fileURLToPath(new URL('../config/base.cordis.yml', import.meta.url))
+const WEB_OVERLAY = fileURLToPath(new URL('../config/web.cordis.yml', import.meta.url))
 
 // Display-only mirror of the webserver schema's loopback host: the address the
 // local URL always prints. Not a source of truth — the schema is.