Merge remote-tracking branch 'origin/master' into claude/unified-environment-credentials-c8841a

# Conflicts:
#	apps/cli/src/profile-boot.ts
#	apps/cli/src/web.ts

apps/cli/src/profile-boot.ts

@@ -96,6 +96,9 @@ export function prepareProfile(name: string, userLayer = true): Profile {
   return profile
 }
 
+/** Read-only row index of a profile composition before launcher flag patches. */
+export type ProfileRows = ReadonlyMap<string, { name?: string; config?: unknown }>
+
 /** One profile's patch layers (application order) and the row index of its pre-flag composition. */
 interface ComposedProfile {
   profile: Profile
@@ -110,7 +113,7 @@ interface ComposedProfile {
    * for flag merges and row checks. Flag patches must not insert rows the
    * launcher consults here (they only override values and insert dev glue).
    */
-  rows: Map<string, { name?: string; config?: unknown }>
+  rows: ProfileRows
 }
 
 /** The full patch stack of one composed profile, in application order. */
@@ -156,11 +159,11 @@ export interface RunProfileOptions {
   /** `--patch` overlay paths, in argv order. */
   patchFiles: readonly string[]
   /** Launcher hook turning the pre-flag composed rows into flag patches (the web alias's flag family). */
-  deriveFlagPatches?: (rows: ComposedProfile['rows']) => PatchOptions[]
+  deriveFlagPatches?: (rows: ProfileRows) => PatchOptions[]
   /** One-shot task text; requires the composition to mount the headless runner row. */
   task?: string
   /** Surface setup registered after Loader installation and before any config-tree entry mounts. */
-  prepare?: (ctx: Context) => Promise<void> | void
+  prepare?: (ctx: Context, rows: ProfileRows) => Promise<void> | void
   /** This run's frozen environment snapshot, provided to the tree before any entry mounts. */
   environment: EnvironmentSnapshot
 }
@@ -237,7 +240,7 @@ export async function runProfile(options: RunProfileOptions): Promise<{ ctx: Con
       }
       hostCtx.provide('headlessIo', io)
     }
-    await options.prepare?.(hostCtx)
+    await options.prepare?.(hostCtx, composed.rows)
   })
   app.current = ctx
   // A surface can dispose the whole tree while startup was still in flight

apps/cli/src/web.ts

@@ -14,7 +14,7 @@ import type { Context } from 'cordis'
 import type { PatchOptions } from '@cordisjs/plugin-include'
 import { addHarnessSourceSection } from '@deepseek-ai/dsh-app-boot'
 import type { EnvironmentSnapshot } from '@deepseek-ai/dsh-environment'
-import { runProfile } from './profile-boot.ts'
+import { runProfile, type ProfileRows } from './profile-boot.ts'
 
 const SOURCE_ROOT = fileURLToPath(new URL('../../..', import.meta.url))
 
@@ -72,7 +72,7 @@ export interface WebFlags {
  * @returns the flag patch list, in application order.
  */
 function deriveWebFlagPatches(
-  rows: Map<string, { name?: string; config?: unknown }>,
+  rows: ProfileRows,
   flags: WebFlags,
 ): PatchOptions[] {
   const overrides = new Map<string, Record<string, unknown>>()
@@ -106,6 +106,18 @@ function deriveWebFlagPatches(
   return patches
 }
 
+/**
+ * Whether the composed Web runtime keeps its model- and shell-visible surface
+ * context. The bundle schema defaults the field to true, so only an explicit
+ * false suppresses both the bundle contributions and the launcher-owned
+ * source-checkout section.
+ * @param rows - the composed Web profile rows before launcher flag patches.
+ * @returns true unless the web-runtime row explicitly disables surface context.
+ */
+export function webSurfaceContextEnabled(rows: ProfileRows): boolean {
+  return (rows.get('web-runtime')?.config as { surfaceContext?: boolean } | undefined)?.surfaceContext !== false
+}
+
 /**
  * Serve the browser UI from the web profile. Host/port/workspace-root flags
  * are passed through only when given (absent, the composed profile values
@@ -121,7 +133,8 @@ export async function runWeb(flags: WebFlags, environment: EnvironmentSnapshot):
     profile: 'web',
     patchFiles: flags.patches,
     deriveFlagPatches: rows => deriveWebFlagPatches(rows, flags),
-    prepare: (ctx: Context) => {
+    prepare: (ctx: Context, rows: ProfileRows) => {
+      if (!webSurfaceContextEnabled(rows)) return
       ctx.inject(['systemPrompt'], (promptCtx) => {
         addHarnessSourceSection(promptCtx, SOURCE_ROOT)
       })