@deepseek-ai/dsh-credentials-local 0.0.1-rc.1 → 0.0.1-rc.3

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/credentials/credentials-local/README.md
-README.md: 462618b990f8d07e9b855248db1e149b3c673964
-README.zh.md: 050216bb4b4d22ef53ab0823eef09c1aaf7d1170
+README.md: 63895d34fe8396d55c1d6ef29b3e3d9a9dc17264
+README.zh.md: 3c60fb7bbf06a0ae9ec905f36a5c543c2fb6af1b

package/README.md

@@ -15,7 +15,7 @@ The launching environment wins because a per-run override (`DEEPSEEK_API_KEY=…
 
 Everything below it loses to the managed store, so a key written by the Models page takes effect immediately even when an older key sits in a `.env`. Those two layers still resolve when nothing is stored, and `describe()` names them `project-env` or `user-env` with `writable: true` — storing a key replaces them as the effective source.
 
-Under the product CLI, resolution reads the launcher's frozen [environment snapshot](../../util/environment/README.md) rather than `process.env`: only the snapshot can say whether a value came from the launching shell or from a file. A composition the product CLI did not boot has the inherited environment as its only layer, which keeps embedders on the semantics they already had.
+Under the product CLI, resolution reads the launcher's frozen [environment snapshot](../../util/launch-environment/README.md) rather than `process.env`: only the snapshot can say whether a value came from the launching shell or from a file. A composition the product CLI did not boot has the inherited environment as its only layer, which keeps embedders on the semantics they already had.
 
 ## Config
 

package/README.zh.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 中文
 
-文件型[凭据](../credentials/README.md)提供方：四层来源，一条诚实的优先级。
+文件型[凭据](../credentials/README.md)提供方：四层来源，一套明确的优先级。
 
 | 层 | 来源 id | 可写 | 优先 |
 |---|---|---|---|
@@ -13,9 +13,9 @@
 
 启动环境优先，因为按次覆盖（`DEEPSEEK_API_KEY=… dsh`、CI 机密、容器 `-e`）代表本次运行的操作者意图——而它无法从进程内部修改，就必须*可见地*只读：`describe()` 报告 `source: 'env', writable: false`，`set`/`unset` 直接拒绝，而不是写下一个读取方永远看不到的变更。
 
-它之下的一切都输给受管存储，因此 Models 页写入的密钥会立即生效，即使某个 `.env` 里还留着更旧的密钥。没有存储任何东西时这两层仍会解析，`describe()` 会把来源报告为 `project-env` 或 `user-env` 且 `writable: true`——存入一个密钥就会取代它们成为生效来源。
+它之下的所有来源优先级都低于受管存储，因此 Models 页写入的密钥会立即生效，即使某个 `.env` 里还留着更旧的密钥。没有存储任何东西时这两层仍会参与解析，`describe()` 会把来源报告为 `project-env` 或 `user-env` 且 `writable: true`——存入一个密钥就会取代它们成为生效来源。
 
-在产品 CLI（命令行界面）下，解析读取的是启动器冻结的[环境快照](../../util/environment/README.md)而不是 `process.env`：只有快照才说得清某个值来自启动 shell 还是来自某个文件。并非由产品 CLI 启动的组合只有继承环境这一层，这让嵌入方保持它们原有的语义。
+在产品 CLI（命令行界面）下，解析读取的是启动器冻结的[环境快照](../../util/launch-environment/README.md)而不是 `process.env`：只有快照才说得清某个值来自启动 shell 还是来自某个文件。并非由产品 CLI 启动的组合只有继承环境这一层，这让嵌入方保持它们原有的语义。
 
 ## 配置
 
@@ -55,7 +55,7 @@ OPENAI_API_KEY: sk-…
 
 文档在 `0700` 目录下以 `0600` 权限存放，这挡得住其他 OS 用户，**挡不住**模型。工具进程（bash、文件系统工具）以同一用户身份运行，而已交付的 `workspace-write` 文件策略限制的是修改而非读取，因此它们读这个文件与读该用户拥有的任何其他文件毫无二致；也没有任何沙箱模式会把它单独挑出来。harness 真正守住的更窄：它绝不把该文档的解析后路径交给模型，也绝不把它载入进程环境——这与用户的普通环境层 `$DSH_HOME/.env` 不同（见 [app-boot 的 Harness home 各层](../../boot/app-boot/README.md#profiles)）——因此要拿到这个值，需要刻意去读一条并未交给 agent（智能体）的路径。
 
-这是审慎，不是边界。必须让提供方密钥远离自身 agent 的部署无法靠文件权限做到；OS 钥匙串提供方——一个模型的进程根本读不到的存储——才是延后的答案，它应当作为平级包与本提供方并列。
+这是审慎，不是边界。必须让提供方密钥远离自身 agent 的部署无法靠文件权限做到；OS 钥匙串提供方——一种模型运行所在进程根本无法读取的存储——才是延后的答案，它应当作为平级包与本提供方并列。
 
 ## 模型体验
 

package/lib/index.js

@@ -5,9 +5,9 @@ import { mkdir, readFile, stat } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { Document, parseDocument } from "yaml";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
-import { canonicalizeWatchPath, resolveDshHome } from "@deepseek-ai/dsh-paths";
-import { environmentOf } from "@deepseek-ai/dsh-environment";
-import { Credentials, credentialRef } from "@deepseek-ai/dsh-credentials";
+import { canonicalizeWatchPath, resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
+import { CredentialProvider, credentialRef } from "@deepseek-ai/dsh-credentials";
 //#region lib/types/index.js
 /**
 * File-backed credentials provider over `$DSH_HOME/.credentials.yaml`, layered
@@ -151,7 +151,7 @@ function renderDocument(text, ref, value) {
 	return document.toString();
 }
 /** File-backed credentials provider (`$DSH_HOME/.credentials.yaml`). */
-var CredentialsLocal = class extends Credentials {
+var LocalCredentialProvider = class extends CredentialProvider {
 	config;
 	static Config = z.object({
 		path: z.string(),
@@ -187,7 +187,7 @@ var CredentialsLocal = class extends Credentials {
 	}
 	/** The inherited-environment value for a reference, or `undefined` when empty or unset. */
 	inherited(ref) {
-		const entry = environmentOf(this.ctx).getFrom(ref, ["process"]);
+		const entry = launchEnvironmentOf(this.ctx).getFrom(ref, ["process"]);
 		return entry !== void 0 && entry.value.length > 0 ? entry.value : void 0;
 	}
 	/**
@@ -196,7 +196,7 @@ var CredentialsLocal = class extends Credentials {
 	* environment layering: the more specific location wins.
 	*/
 	dotenvFallback(ref) {
-		const entry = environmentOf(this.ctx).getFrom(ref, ["project-env", "user-env"]);
+		const entry = launchEnvironmentOf(this.ctx).getFrom(ref, ["project-env", "user-env"]);
 		return entry !== void 0 && entry.value.length > 0 ? entry : void 0;
 	}
 	async *[Service.init]() {
@@ -395,4 +395,4 @@ var CredentialsLocal = class extends Credentials {
 	}
 };
 //#endregion
-export { CREDENTIALS_FILENAME, CredentialsLocal, CredentialsLocal as default, parseCredentialsDocument, resolveSpec };
+export { CREDENTIALS_FILENAME, LocalCredentialProvider, LocalCredentialProvider as default, parseCredentialsDocument, resolveSpec };

package/lib/types/index.d.ts

@@ -36,7 +36,7 @@
  */
 import { Context, Service } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
-import { Credentials } from '@deepseek-ai/dsh-credentials';
+import { CredentialProvider } from '@deepseek-ai/dsh-credentials';
 import type { CredentialInfo, CredentialRef, ResolvedCredential } from '@deepseek-ai/dsh-credentials';
 /** Basename of the credentials document inside the harness home. */
 export declare const CREDENTIALS_FILENAME = ".credentials.yaml";
@@ -78,7 +78,7 @@ export declare function resolveSpec(config: Config): ResolvedSpec;
  */
 export declare function parseCredentialsDocument(text: string, filename: string): Map<string, string>;
 /** File-backed credentials provider (`$DSH_HOME/.credentials.yaml`). */
-export declare class CredentialsLocal extends Credentials {
+export declare class LocalCredentialProvider extends CredentialProvider {
     config: Config;
     static Config: z<Config>;
     private readonly spec;
@@ -151,5 +151,5 @@ export declare class CredentialsLocal extends Credentials {
     /** Entries whose stored value changed; the parser has already proven every key addressable. */
     private changedRefs;
 }
-export default CredentialsLocal;
+export default LocalCredentialProvider;
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-credentials-local",
   "description": "File-backed credentials provider ($DSH_HOME/.env under the live process environment) for the DeepSeek Harness",
-  "version": "0.0.1-rc.1",
+  "version": "0.0.1-rc.3",
   "publishConfig": {
     "access": "restricted"
   },
@@ -32,12 +32,12 @@
   ],
   "license": "BSD-3-Clause",
   "peerDependencies": {
-    "@deepseek-ai/dsh-atomic-write": "^0.0.1-rc.1",
-    "@deepseek-ai/dsh-credentials": "^0.0.1-rc.1",
-    "@deepseek-ai/dsh-environment": "^0.0.1-rc.1",
-    "@deepseek-ai/cordis": "^4.0.1-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.1",
-    "@deepseek-ai/dsh-paths": "^0.0.1-rc.1"
+    "@deepseek-ai/dsh-atomic-write": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-credentials": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-launch-environment": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-home-paths": "^0.0.1-rc.3",
+    "@deepseek-ai/cordis": "^4.0.1-rc.1"
   },
   "dependencies": {
     "chokidar": "^4.0.3",
@@ -45,11 +45,11 @@
     "@deepseek-ai/schemastery": "^3.18.1-rc.1"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-atomic-write": "^0.0.1-rc.1",
-    "@deepseek-ai/dsh-credentials": "^0.0.1-rc.1",
-    "@deepseek-ai/dsh-environment": "^0.0.1-rc.1",
-    "@deepseek-ai/dsh-paths": "^0.0.1-rc.1",
-    "@deepseek-ai/cordis": "^4.0.1-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.1"
+    "@deepseek-ai/dsh-atomic-write": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-credentials": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-launch-environment": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-home-paths": "^0.0.1-rc.3",
+    "@deepseek-ai/cordis": "^4.0.1-rc.1"
   }
 }