Yichen Jiang
03b534de16
$DSH_HOME/.env carried two incompatible jobs. As credentials-local's writable secret store it could not be hoisted into process.env — hoisting makes every stored key read as a read-only launch override and blocks rotation from the TUI and the web page. But its name and dotenv format promise an environment file, so a DEEPSEEK_BASE_URL sitting beside a working DEEPSEEK_API_KEY in the same file was silently ignored: only the credential provider read the document, and it addresses credential references alone. Split the two jobs into two files. .credentials.yaml is the provider-managed store: a strict YAML mapping of CredentialRef to non-empty string, no version field, no wrapper level. Because it holds credentials and nothing else, a non-mapping root, a non-identifier key, a non-string value, an empty string, a duplicate key, and malformed YAML are all rejections rather than skipped entries — loud at boot and at a write, warn-and-keep-last-good on a live reload. The dotenv physical-line editor gives way to a patch of the parsed document, so comments and untouched entries keep their formatting and any string value round-trips, multi-line included. Writer lock, read-modify-write, atomic 0600 write under a 0700 directory, watcher, self-write suppression, and quiescent disposal are unchanged. $DSH_HOME/.env becomes the user's ordinary environment layer. app-boot's new loadLayeredEnv loads the invoking directory's .env then the Harness home's, giving user < project < inherited; the home resolves from the inherited environment first, so a project .env cannot redirect it. Credential precedence is unchanged: the live environment still wins read-only over the file, and shadowed writes still reject. Whether a provider-managed store should instead win over the environment is a separate decision. No migration: a key already in $DSH_HOME/.env keeps resolving through the new environment layer, as a read-only env source that shadows the stored one.
llm/ — LLM capability family
English | 中文
The LLM seam and its provider adapters. The interface package (llm) owns the abstract service, the content-block vocabulary, and the stream-chunk assembler; the adapters are concrete implementations that register on ctx.llm. All product packages.
| Package | Role | ctx key |
|---|---|---|
llm/ |
Abstract LLM service + content-block vocabulary + chunk assembler | ctx.llm |
token-meter/ |
Replay-aware request and surface token measurement | ctx.tokenMeter |
llm-retry/ |
Exact-provider normal or unbounded request retry policy | (listens to agent/request-error) |
llm-deepseek/ |
DeepSeek API adapter (direct fetch + eventsource-parser SSE) | (registers on ctx.llm) |
llm-pi-ai/ |
Multi-provider adapter via @earendil-works/pi-ai |
(registers on ctx.llm) |
The interface lives at llm/llm/; adapters, retry policy, and the reusable token meter are flat siblings under the group. Requests route by provider, while model is passed through to the selected adapter. The route-owning adapter supplies retry policy and resolves available exact-model identity, context capacity, and reasoning metadata; the retry executor and token meter remain provider-agnostic. A new provider adapter registers one or more provider routes on ctx.llm without touching the consumers. See twin LLM adapters for the two shipping implementations, the replay token meter Agent Note for measurement ownership, and the routed model context Agent Note for capacity and compaction-policy ownership.