dsh --dump-config and dsh web --dump-config compose the shipped base,
the surface overlay, and the --config or personal overlay — exactly the
layers that surface boots — and print the entry list as YAML without
booting; --dump-default-config stops at the surface overlay so the two
outputs diff to precisely the user layer's effect.
The dump shares the mounting code: the vendored include exports its
patch algorithm as applyEntryPatches() and its !!js dialect as
entryListSchema (logged in vendor/README.md), dsh-app-boot's
renderConfigDump() composes and renders through both (and now imports
the dialect instead of duplicating it), and the CLI adds a thin
dump-config mode. !!js expressions print verbatim; unmatched patches
warn on stderr; boot-only flags are rejected alongside the dump flags.
(cherry picked from commit 1fdbebfa8a5dc7df840d53666320064a7e3dae59)
The row moves from web.cordis.yml to base.cordis.yml, so the TUI reports
too (its exit paths already drain: disposeRootAndExit on normal exit, root
dispose before the /resume execve). The TUI launcher applies the same
resolveTelemetryPatch opt-out, judged against the tree actually booting via
configHasTelemetryRow so a --config-replace tree without the row is not
failed by a switch with nothing to disable. The TUI keyless smoke disables
telemetry in its child env; README (en/zh) and the Agent Note pair updated
to the every-surface stance.
- resolveTelemetryPatch: extracted pure switch resolution (unit-tested);
fails loud when DSH_TELEMETRY_DISABLED is set but the row is absent, and
documents that ANY non-empty value (including '0'/'false') disables.
- runHeadless: SIGINT/SIGTERM now dispose the tree before exit so the
telemetry tail and shutdown marker drain (Node's default signal exit
skips disposal).
- web.cordis.yml: explicit maxQueueSize beside maxExportBatchSize (the
single-batch drain invariant no longer leans on an SDK default), comment
covers exportTimeoutMillis's role and links the Agent Note.
- apps/web scaffold: disable telemetry-otel — fixture sessions must never
leave the process.
- apps/cli README (en/zh + pairing): document the default endpoint, both
env seams, and the no-redaction disclosure.
Mount the existing telemetry seam + OTel logs backend in the web/headless
config tree so every session-log event streams to an OTLP/HTTP collector:
- telemetry-otel row: url defaults to the standard local OTLP endpoint,
DSH_TELEMETRY_OTLP_URL overrides; 10s batch cadence; exporter/processor
values bound the shutdown drain to ~1s against an unreachable collector
(timeoutMillis doubles as the retry deadline, single-batch drain).
- DSH_TELEMETRY_DISABLED opt-out: AppCLIEntry patches the row disabled
before boot (config alone cannot disable a row, and exporter.url
validation is load-time fail-loud).
The shipped surfaces loaded the harness home's .env into the process
environment before cordis booted. credentials-local then saw every stored
key as an ambient launch override: describe reported source 'env' with
writable false, and set/unset rejected as shadowed — so a key the web page
or TUI stored was unrotatable and undeletable from the next run onward,
and the adapter kept using the value captured at launch.
The home's .env is now the credential provider's own store, read by that
provider alone and hot-reloaded by it. The genuine launch environment and
the invoking directory's .env (loaded by the bin) remain the read-only
ambient layer, so a plain composition without the provider still resolves
keys exactly as before.
Proven by a real restart in the loader composition: store a key through
the seam, dispose the tree, re-boot over the same harness home, and the
entry is still file-sourced and writable — rotating it lands on the very
next request.
Conflict resolutions:
- `session.list`: master's projection columns fold into the PR's cancellable,
batched `listVisibleSessionSummaries`, which `session.search` shares as its
visibility baseline; master's goal helpers stay beside it.
- Client sessions face: master narrowed `ctx.sessions` to `ISessions`, so the
search verb and its protocol-constant bound are declared there and the
test-runtime double implements them (recorded, empty page unless a scenario
stubs hits).
- `WorkspaceBrowser`: master's per-row Rename wiring rides the PR's search
results view; the tree keeps the PR's query-free derivations.
- `dsh web` bin: the PR's shutdown-handlers-before-readiness order with
master's boot-time LAN address snapshot.
- `session-query-sqlite`: master's `SCHEMA_VERSION` 7 stands; the PR's bump
carried no schema change.
- Specs: master wraps assistant/steering message payloads and requires an
`application/json` carrier request, so the search fixtures and tests follow.
- Web aria goldens keep master's recording plus the PR's search placeholder;
the navigation-panes inventory keeps master's terminal-card golden next to
the PR's search-results golden.
Huanqi Cao
Tianyi Cui
Ziya
ZiyaZhang
Turtle
NI0317
imccyu
imccyu
Yichen Jiang
Hypatia May