Yichen Jiang
8c2970e70e
Review found five real defects in the configuration-source work, all confirmed against the code rather than argued: 1. The note claimed --config outranks settings.yaml. It does not: the settings seam registers a plugin's cordis entry config as the `base` layer and the user section layers over it, and the seam cannot tell a shipped value from a --config one. The note now states shipped reality and names --config-replace as the lever for a deployment that must win. Separately, a literal `apiKey` in settings outranked both the environment and .credentials.yaml — the field is removed, so configuration carries a reference and nothing else. 2. DEEPSEEK_SEARCH_BASE_URL was functionally deleted: the shipped inline went away without the provider learning to read it. It now resolves from the environment snapshot, as the README always claimed. 3. The bootstrap deny list missed the interpreter start-up hooks. BASH_ENV is the sharpest: `bash -c` sources it on every bash tool call, so a project .env could run a file of its choosing before every command. The list now covers BASH_ENV and its per-language siblings, the Git hook commands, and the remaining preload and CA variables, organised by what a variable does rather than which runtime owns it. 4. YAML parse errors quoted the offending source line — which in a credentials document is the secret — into boot stderr and the watcher's logger. Only the error code and position are reported now, in credentials-local and settings-local alike, pinned by a test that asserts the secret is absent. 5. 0600 governed only files the harness wrote. A hand-created 0644 document was read normally. POSIX now checks the mode before reading contents, at boot and on every reload; Windows has no mode to inspect and is skipped rather than faked. The project a session is launched in is trusted by default, with no prompt and no stored trust record: it may supply its own endpoint, ordinary variables, and a key ranked below the managed store. Trust stops at the harness itself — a discovered file still cannot set DSH_PERMISSION_MODE, PATH, BASH_ENV, or the rest, because those take effect with no user action, before any turn, outside the permission policy and the sandbox.
web/ - web capability family
English | 中文
The web access capability seam: an abstract web interface, search/fetch provider implementations, and the model-facing web tools. All product packages.
| Package | Role | ctx key |
|---|---|---|
web/ |
Abstract web seam (search/fetch provider registries + selection + vocabulary + WebError) |
ctx.web |
web-search-exa/ |
Exa-backed WebSearchProvider |
(registers on ctx.web) |
web-search-perplexity/ |
Perplexity-backed WebSearchProvider |
(registers on ctx.web) |
web-search-deepseek/ |
DeepSeek-backed WebSearchProvider using native web_search through the Anthropic-compatible API |
(registers on ctx.web) |
web-fetch-local/ |
Anonymous public HTTP(S) WebFetchProvider |
(registers on ctx.web) |
tool-web/ |
Model-facing web_search/web_fetch tool schemas |
(registers on ctx.tools) |
The interface lives at web/web/. Unlike bash/fs, the seam spans two capabilities (search and fetch) with potentially multiple providers each: ctx.web is one web-access middle layer with one provider-selection policy, one abort/error vocabulary, and one product-facing "how this harness reaches the web" config surface. Providers register capabilities, not tools; tool-web is the only owner of model-facing names, schemas, prompt guidance, and presentation. A search provider swap does not change how the model asks for a query, and a fetch implementation swap does not change how the model asks for a URL.
See the web capability seam Agent Note for the design rationale, including why search and fetch are deliberately one seam and why web_fetch's SSRF protection is deferred.