kevin/deepseek-harness
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8c2970e70ef7aa3bcf923648e5bb06447efd74b8
deepseek-harness/package.json
T
Yichen Jiang 0512b12714 feat(config)!: one ordering for configuration sources, and a bootstrap deny rule 
$DSH_HOME/.env had just become an ordinary environment layer, which left the
harness resolving user-facing values from a flattened process.env that could
no longer say where a value came from. A key stored through the web page
stayed shadowed by an older key in the user's own .env. An endpoint could be
redirected by the project: the invoking directory's .env is materialized like
every other layer, and a base URL decides where a resolved API key is sent, so
a DEEPSEEK_BASE_URL written into a model-editable workspace would send the
user's credential — and the prompts carrying their code — to whatever host
that file named.

Give every user-facing value one ordering, with four kinds of source:

  explicit for this run     per-operation override, CLI argument
  > authored by deployment  --config / --config-replace
  > this launch's shell     inherited process environment
  > product-managed store   settings.yaml, .credentials.yaml
  > discovered file         $DSH_HOME/.env
  > defaults                schema default, shipped base, public default

The domains differ only in which tiers exist. The earlier split — credentials
ranking the environment over the managed file while settings ranked over the
environment — was inconsistent: the distinguishing fact is who authored the
source, not the domain.

packages/util/environment owns an immutable snapshot with per-layer
provenance. getFrom(name, sources) searches only the layers a caller names,
and omitting one is a refusal rather than a demotion: the adapters ask for
['process', 'user-env'], so no reordering can let a project file back into a
decision it was excluded from.

isBootstrapOnly rejects, before anything is materialized, any .env setting a
variable that governs how a process launches (PATH, SHELL, NODE_OPTIONS,
LD_PRELOAD), where code or model-visible instructions load from (the whole
DSH_* namespace, HOME, XDG_*), or how the network is reached (proxy and CA
variables). The namespace is denied wholesale so a switch added later cannot
become settable by being forgotten, and there is no opt-out.

verify-config-source-ownership keeps both rules: no unregistered process.env
read under packages/*/*/src (26 allowlisted with reasons), and no apiKey,
baseURL, or headers inlined from the environment in shipped Cordis config —
removing those inlines is what makes the deployment tier meaningful.
2026-08-04 16:17:32 +08:00

157 lines
8.3 KiB
JSON
Raw Blame History

{
"name": "@deepseek-ai/dsh-root",
"version": "0.0.1",
"private": true,
"type": "module",
"packageManager": "pnpm@11.7.0",
"engines": {
"node": "^22.19.0 || >=24.0.0"
},
"workspaces": [
"vendor/*",
"packages/*/*",
"apps/*",
"website"
],
"scripts": {
"build": "npm run build:lib && npm run build:web",
"build:lib": "tsc -b && tsdown",
"build:web": "pnpm --filter @deepseek-ai/dsh-frontend run build",
"change-scope": "tsx scripts/change-scope.ts",
"check:all": "tsx scripts/run-gates.ts check-all",
"check:ci": "tsx scripts/run-gates.ts ci-primary",
"check:ci:artifacts": "tsx scripts/run-gates.ts ci-artifacts",
"check:ci:consumers": "tsx scripts/run-gates.ts ci-consumers",
"check:ci:coverage": "tsx scripts/run-gates.ts ci-coverage",
"check:ci:lint": "tsx scripts/run-gates.ts ci-lint",
"check:ci:linux-primary": "tsx scripts/run-gates.ts ci-linux-primary",
"check:ci:snapshot": "tsx scripts/run-gates.ts ci-snapshot",
"check:ci:static": "tsx scripts/run-gates.ts ci-static",
"check:ci:windows-blocking": "tsx scripts/run-gates.ts ci-windows-blocking",
"check:ci:windows-complete": "tsx scripts/run-gates.ts ci-windows-complete",
"check:ci:windows-observational": "tsx scripts/run-gates.ts ci-windows-observational",
"check:node-compat": "tsx scripts/run-gates.ts node-compat",
"check:windows-wine": "bash scripts/wine-windows-gates.sh",
"clean": "tsx scripts/clean.ts",
"constraints": "tsx scripts/check-workspace-constraints.ts",
"demo:acp": "node --import tsx packages/examples/acp-demo/src/bin.ts --config examples/acp-agent/cordis.yml",
"demo:code-mode": "node scripts/demo-code-mode.mjs",
"demo:cordis": "node scripts/demo-cordis.mjs",
"demo:headless": "node --import tsx packages/examples/cli-demo/src/bin.ts --config examples/headless-agent/cordis.yml",
"demo:tui": "node --import tsx/esm apps/cli/src/bin.ts",
"demo:web": "npm run build && node --import tsx/esm apps/cli/src/bin.ts web",
"dev:web": "tsx scripts/dev-web.ts --poll",
"doc-sync": "tsx scripts/run-gates.ts doc-sync",
"doc-typecheck": "tsx scripts/doc-typecheck.ts",
"docs:build": "pnpm --filter @deepseek-ai/website run build",
"docs:build:mpa": "pnpm --filter @deepseek-ai/website exec vitepress build . --mpa",
"docs:check": "pnpm exec vitest run scripts/project-doc-site.spec.ts && pnpm run docs:build",
"docs:dev": "pnpm --filter @deepseek-ai/website run dev",
"docs:preview": "pnpm --filter @deepseek-ai/website run preview",
"dsh": "node --import tsx/esm apps/cli/src/bin.ts",
"duplication": "jscpd --config .jscpd.json packages scripts",
"gen-config-catalog": "tsx scripts/gen-config-catalog.ts",
"gen-cordis-api": "tsx scripts/gen-cordis-api.ts",
"gen-cordis-catalog": "tsx scripts/gen-cordis-catalog.ts",
"gen-doc-graphs": "tsx scripts/gen-doc-graphs.ts",
"gen-module-graph": "tsx scripts/gen-module-graph.ts",
"gen-persistence-catalog": "tsx scripts/gen-persistence-catalog.ts",
"gen-scoped-events": "tsx scripts/gen-scoped-events.ts",
"gen-third-party-notices": "tsx scripts/gen-third-party-notices.ts",
"gen-tool-catalog": "tsx scripts/gen-tool-catalog.ts",
"gen-translation-brief": "tsx scripts/gen-translation-brief.ts",
"hygiene": "pnpm run knip && pnpm run publint && pnpm run constraints && pnpm run verify-package-invariants && pnpm run verify-built-package-invariants && pnpm run verify-cordis-config && pnpm run verify-node-next-types && pnpm run verify-runtime-closure && pnpm run verify-vendored-links",
"knip": "knip --treat-config-hints-as-errors",
"lint": "tsx scripts/run-oxlint.ts .",
"lint:fix": "eslint --config eslint.format.config.mjs --fix . && tsx scripts/run-oxlint.ts . --fix",
"migrate:packed-session-fixtures": "tsx scripts/migrate-packed-session-fixtures.ts",
"mock:llm": "node --import tsx packages/support/llm-mock-server/src/bin.ts",
"postinstall": "node scripts/install-lefthook.mjs",
"publint": "tsx scripts/publint-all.ts",
"test": "vitest run",
"test:coverage": "vitest run --coverage",
"test:e2e": "vitest run --config vitest.e2e.config.ts",
"test:gui": "vitest run packages/client packages/host",
"test:snapshot": "vitest run --config vitest.snapshot.config.ts",
"test:snapshot:record": "DSH_SNAPSHOT=record vitest run --config vitest.snapshot.config.ts --update",
"test:snapshot:refresh": "DSH_SNAPSHOT=refresh vitest run --config vitest.snapshot.config.ts",
"test:web": "npm run build && npm run test:web:built",
"test:web:built": "vitest run --config vitest.web.config.ts",
"test:web:refresh": "npm run build && DSH_SNAPSHOT=refresh vitest run --config vitest.web.config.ts",
"typecheck": "tsc -b",
"verify-agent-note-classification": "tsx scripts/verify-agent-note-classification.ts",
"verify-agent-note-format": "tsx scripts/verify-agent-note-format.ts",
"verify-archived-agent-notes": "tsx scripts/verify-archived-agent-notes.ts",
"verify-built-package-invariants": "node scripts/verify-built-package-invariants.mjs",
"verify-client-domain-graph": "tsx scripts/verify-client-domain-graph.ts",
"verify-config-catalog": "tsx scripts/gen-config-catalog.ts --check",
"verify-config-source-ownership": "tsx scripts/verify-config-source-ownership.ts",
"verify-cordis-api": "tsx scripts/gen-cordis-api.ts --check",
"verify-cordis-catalog": "tsx scripts/gen-cordis-catalog.ts --check",
"verify-cordis-config": "tsx scripts/verify-cordis-config.ts",
"verify-doc-budgets": "tsx scripts/verify-doc-budgets.ts",
"verify-doc-graphs": "tsx scripts/gen-doc-graphs.ts --check",
"verify-doc-refs": "tsx scripts/verify-doc-refs.ts",
"verify-export-jsdoc": "tsx scripts/verify-export-jsdoc.ts",
"verify-md-links": "tsx scripts/verify-md-links.ts",
"verify-md-wrap": "tsx scripts/verify-md-wrap.ts",
"verify-mermaid": "tsx scripts/verify-mermaid.ts",
"verify-module-graph": "tsx scripts/gen-module-graph.ts --check",
"verify-node-next-types": "tsx scripts/verify-node-next-types.ts",
"verify-package-invariants": "tsx scripts/verify-package-invariants.ts",
"verify-package-paths": "tsx scripts/verify-package-paths.ts",
"verify-package-readme-limitations": "tsx scripts/verify-package-readme-limitations.ts",
"verify-package-readme-model-experience": "tsx scripts/verify-package-readme-model-experience.ts",
"verify-persistence-catalog": "tsx scripts/gen-persistence-catalog.ts --check",
"verify-runtime-closure": "tsx scripts/verify-runtime-closure.ts",
"verify-scoped-events": "tsx scripts/gen-scoped-events.ts --check",
"verify-third-party-notices": "tsx scripts/gen-third-party-notices.ts --check",
"verify-tool-catalog": "tsx scripts/gen-tool-catalog.ts --check",
"verify-translation-pairing": "tsx scripts/verify-translation-pairing.ts",
"verify-translation-prompt": "tsx scripts/verify-translation-prompt.ts",
"verify-type-equiv": "tsx scripts/verify-type-equiv.ts",
"verify-vendored-links": "tsx scripts/verify-vendored-links.ts",
"website:build": "pnpm run docs:build",
"website:dev": "pnpm run docs:dev"
},
"devDependencies": {
"@agentclientprotocol/sdk": "0.25.1",
"@deepseek-ai/dsh-tool-session-query": "workspace:^",
"@stylistic/eslint-plugin": "^5.10.0",
"@testing-library/dom": "^10.4.1",
"@testing-library/react": "^16.3.2",
"@types/js-yaml": "^4.0.9",
"@types/jsdom": "^28.0.3",
"@types/mdast": "^4.0.4",
"@types/node": "^22.20.0",
"@types/spdx-expression-parse": "^4.0.0",
"@typescript-eslint/parser": "8.61.0",
"@vitest/coverage-v8": "^4.1.8",
"@yarnpkg/cli-dist": "4.17.1",
"eslint": "10.5.0",
"eslint-plugin-sonarjs": "^4.1.0",
"execa": "^10.0.0",
"fast-check": "^4.8.0",
"js-yaml": "^4.2.0",
"jscpd": "^5.0.12",
"jsdom": "29.1.1",
"knip": "^6.16.1",
"lefthook": "^2.1.9",
"lightningcss": "^1.32.0",
"mdast-util-from-markdown": "^2.0.3",
"mdast-util-gfm": "^3.1.0",
"mermaid": "11.16.0",
"micromark-extension-gfm": "^3.0.0",
"oxlint": "1.76.0",
"oxlint-tsgolint": "7.0.2001",
"publint": "^0.3.21",
"smol-toml": "^1.7.1",
"spdx-expression-parse": "^5.0.0",
"tsdown": "^0.22.2",
"tsx": "^4.22.4",
"typescript": "^6.0.3",
"vite-tsconfig-paths": "^6.1.1",
"vitest": "^4.1.8"
}
}
Reference in New Issue View Git Blame Copy Permalink