Implements the approved simplification Agent Note: sse.ts now pipes the
response body through TextDecoderStream and EventSourceParserStream
(eventsource-parser/stream) and keeps only the DeepSeek protocol shim —
yield each event's data, terminate on [DONE], throw
LlmError('STREAM_CLOSED') on EOF without the sentinel. The SSE
spec-conformance tests are deleted; sse.spec.ts pins only the
[DONE]/STREAM_CLOSED/EOF contract, including the new spec-strict verdict
that an unterminated trailing event is truncation (the old parser
flushed it — a robustness nicety no real provider shape needs).
eventsource-parser@^3.1.0 becomes llm-deepseek's second runtime
dependency (already in the lockfile transitively via the MCP SDK).
Docs: the Agent Note moves proposed/ → implemented/ and is rewritten per
the lifecycle contract; the rejected NIH roll-up note's inbound links
follow. The twin-adapters note, dsh-llm LlmAdapter JSDoc (and its
type-equiv fences), cookbook, group/package READMEs, root AGENTS.md
layout line, sdk-helper comments, and the regenerated config catalog
drop the "hand-rolled fetch + SSE" claim in both languages; all eight
touched pairs re-recorded.
The consolidated resolver scopes the anonymous id to $DSH_HOME rather
than the machine. Update the module contract, README, and Agent Note to
say per-harness-home explicitly instead of over-claiming a machine-global
identity, and record why DSH_HOME scoping is the intended single-root
meaning rather than a regression.
Review fixes for #462:
- resolveDshHome now treats an empty or whitespace-only $DSH_HOME as
unset, so a blank override never resolves the home to cwd via
resolve(''). Restores the guard telemetry's old resolver carried.
- The default-env telemetry test asserts only that globalConfigDir()
returns an absolute path, so a machine DSH_HOME without a .dsh suffix
cannot break it.
Delete @deepseek-ai/dsh-home and make dsh-paths the sole owner of the
single-root harness home ($DSH_HOME || ~/.dsh). Migrate tool-bash,
skill-local, and agent-spine-demo off dsh-home, and fold telemetry's
divergent globalConfigDir onto the shared resolver, dropping its second
XDG/APPDATA policy and the deepseek-harness namespace so the anonymous
id lives under the harness home. Add dshHomeDisplay() for symbolic
user-facing paths, replacing workspace-context's bespoke check.
The bearer rule matched any 8+ run of letters after the word, so
package.json prose like "uses bearer authentication" lost its
following word to the placeholder. Real bearer credentials always
carry a digit; require one in the candidate token.
buildTelemetryPayload read the two reported files independently, so a
dsh-sdk command mistakenly run in an arbitrary non-SDK directory (no
cordis.yml, e.g. any unrelated repo) still uploaded that directory's
package.json — dependency names and metadata of a project that never
opted into the SDK toolchain. Gate the manifest on cordis.yml presence:
without the config the directory is not an SDK project and its manifest
is not ours to report. Consent semantics are unchanged.
The SKILL.md contract says every stdout line is one JSON event, but
createProject wrote the Created/Next-steps templates to stdout and the
default install/build path inherited the launcher's stdio, so package-
manager child output interleaved with the event stream. Under --json,
route human progress to stderr and run install/build through a
NodeCommandRunner that redirects child stdout+stderr to stderr.
dsh-sdk's usage template predates the create command and create-sdk's
predates --config/--config-json/--json, so --help hid both surfaces the
README already documents. Pin each with a help-output assertion.
Regenerate docs/config-catalog.md for the telemetry package, unwrap the
design doc's multi-line blockquote paragraphs, and stop exporting the
create-sdk headless spec internals that have no external consumer.
Tianyi Cui
Turtle
imccyu