review: client-owned default-config injection; tar the bare exe artifact

Address the three ds-review-bot warnings on #253:

- An empty DSH_CORDIS_CONFIG now counts as absent when deciding whether
  to inject the bundled default config, matching the runtime bin's
  config-discovery semantics.
- The injection moves from DeepSeekHarness into HarnessClient.start(),
  so the low-level client's default bundled launch also boots without
  callers duplicating the env setup.
- The bare single-file exe artifact ships inside a tar.gz like the
  Python bundle: upload-artifact's zip transport drops the executable
  bit.

python/sdk/tests/test_bundled_runtime.py

@@ -17,7 +17,7 @@ import pytest
 
 from deepseek_harness import DeepSeekHarness, HarnessClient, HarnessConfig
 from deepseek_harness.errors import TransportClosedError
-from deepseek_harness_runtime import bundled_default_config_path, resolve_bundled_launch_args
+from deepseek_harness_runtime import resolve_bundled_launch_args
 
 _MODES = ("exe", "node")
 
@@ -99,12 +99,16 @@ def test_bundled_runtime_surfaces_unbundled_plugin_failure(tmp_path: Path, mode:
 
 
 @pytest.mark.parametrize("mode", _MODES)
+@pytest.mark.parametrize("ambient_config", [None, ""], ids=["unset", "empty-counts-as-absent"])
 def test_zero_config_run_injects_bundled_default_cordis_config(
-    tmp_path: Path, mode: str, monkeypatch: pytest.MonkeyPatch
+    tmp_path: Path, mode: str, ambient_config: str | None, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     _launch_args(mode)  # skip early when this carrier is unavailable
     monkeypatch.setenv("DSH_RUNTIME_MODE", mode)
-    monkeypatch.delenv("DSH_CORDIS_CONFIG", raising=False)
+    if ambient_config is None:
+        monkeypatch.delenv("DSH_CORDIS_CONFIG", raising=False)
+    else:
+        monkeypatch.setenv("DSH_CORDIS_CONFIG", ambient_config)
 
     harness = DeepSeekHarness(
         model="deepseek-v4-pro",
@@ -114,7 +118,8 @@ def test_zero_config_run_injects_bundled_default_cordis_config(
         base_url="http://127.0.0.1:9",
         request_timeout_seconds=120,
     )
-    assert harness.client.config.env is not None
-    assert harness.client.config.env["DSH_CORDIS_CONFIG"] == str(bundled_default_config_path())
     with harness:
-        pass  # __enter__ boots the runtime on the injected default config; __exit__ shuts it down
+        # __enter__ boots the runtime, which exits with a usage error unless
+        # HarnessClient.start() injected the bundled default config over the
+        # unset/empty DSH_CORDIS_CONFIG; __exit__ shuts it down.
+        pass

python/sdk/tests/test_client.py

@@ -548,13 +548,23 @@ with open(os.environ["SEEN"], "w") as seen:
         json.loads(line)
 
 
-def test_client_uses_bundled_runtime_package_by_default(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+def _install_fake_bundled_runtime(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> Path:
+    """Fake the deepseek-harness-runtime-bin package on sys.path.
+
+    A stub exe that dumps DSH_CORDIS_CONFIG to $ENV_DUMP before serving
+    initialize/shutdown, plus a module exposing the resolution surface the
+    client consumes. Returns the fake bundled default config path.
+    """
     runtime = tmp_path / "dsh-jsonrpc-agent"
     runtime.write_text(
         """#!/usr/bin/env python3
 import json
+import os
 import sys
 
+json.dump({"DSH_CORDIS_CONFIG": os.environ.get("DSH_CORDIS_CONFIG")}, open(os.environ["ENV_DUMP"], "w"))
 for line in sys.stdin:
     msg = json.loads(line)
     if msg.get("method") == "initialize":
@@ -566,22 +576,56 @@ for line in sys.stdin:
     )
     runtime.chmod(0o755)
 
+    default_config = tmp_path / "default-cordis.yml"
     module_dir = tmp_path / "deepseek_harness_runtime"
     module_dir.mkdir()
     (module_dir / "__init__.py").write_text(
         f"""
 def resolve_bundled_launch_args(mode=None):
     return ({str(runtime)!r},)
+
+
+def bundled_default_config_path():
+    return {str(default_config)!r}
 """.strip()
     )
 
     monkeypatch.syspath_prepend(str(tmp_path))
     monkeypatch.delitem(sys.modules, "deepseek_harness_runtime", raising=False)
+    return default_config
 
-    with HarnessClient() as client:
+
+@pytest.mark.parametrize("ambient_config", [None, ""], ids=["unset", "empty-counts-as-absent"])
+def test_client_default_launch_uses_bundled_runtime_and_injects_default_config(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, ambient_config: str | None
+) -> None:
+    env_dump = tmp_path / "env.json"
+    default_config = _install_fake_bundled_runtime(tmp_path, monkeypatch)
+    if ambient_config is None:
+        monkeypatch.delenv("DSH_CORDIS_CONFIG", raising=False)
+    else:
+        monkeypatch.setenv("DSH_CORDIS_CONFIG", ambient_config)
+
+    with HarnessClient(HarnessConfig(env={"ENV_DUMP": str(env_dump)})) as client:
         init = client.initialize(cwd="/workspace", model="deepseek-v4-pro")
 
     assert init.serverInfo.name == "bundled-runtime"
+    assert json.loads(env_dump.read_text())["DSH_CORDIS_CONFIG"] == str(default_config)
+
+
+def test_client_respects_explicit_config_over_bundled_default(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    env_dump = tmp_path / "env.json"
+    _install_fake_bundled_runtime(tmp_path, monkeypatch)
+    monkeypatch.delenv("DSH_CORDIS_CONFIG", raising=False)
+
+    with HarnessClient(
+        HarnessConfig(env={"ENV_DUMP": str(env_dump), "DSH_CORDIS_CONFIG": "./explicit.yml"})
+    ) as client:
+        client.initialize(cwd="/workspace", model="deepseek-v4-pro")
+
+    assert json.loads(env_dump.read_text())["DSH_CORDIS_CONFIG"] == "./explicit.yml"
 
 
 def test_client_reports_missing_bundled_runtime_dependency(monkeypatch: pytest.MonkeyPatch) -> None: