$DSH_HOME/.env carried two incompatible jobs. As credentials-local's writable
secret store it could not be hoisted into process.env — hoisting makes every
stored key read as a read-only launch override and blocks rotation from the
TUI and the web page. But its name and dotenv format promise an environment
file, so a DEEPSEEK_BASE_URL sitting beside a working DEEPSEEK_API_KEY in the
same file was silently ignored: only the credential provider read the
document, and it addresses credential references alone.
Split the two jobs into two files.
.credentials.yaml is the provider-managed store: a strict YAML mapping of
CredentialRef to non-empty string, no version field, no wrapper level. Because
it holds credentials and nothing else, a non-mapping root, a non-identifier
key, a non-string value, an empty string, a duplicate key, and malformed YAML
are all rejections rather than skipped entries — loud at boot and at a write,
warn-and-keep-last-good on a live reload. The dotenv physical-line editor
gives way to a patch of the parsed document, so comments and untouched entries
keep their formatting and any string value round-trips, multi-line included.
Writer lock, read-modify-write, atomic 0600 write under a 0700 directory,
watcher, self-write suppression, and quiescent disposal are unchanged.
$DSH_HOME/.env becomes the user's ordinary environment layer. app-boot's new
loadLayeredEnv loads the invoking directory's .env then the Harness home's,
giving user < project < inherited; the home resolves from the inherited
environment first, so a project .env cannot redirect it.
Credential precedence is unchanged: the live environment still wins read-only
over the file, and shadowed writes still reject. Whether a provider-managed
store should instead win over the environment is a separate decision.
No migration: a key already in $DSH_HOME/.env keeps resolving through the new
environment layer, as a read-only env source that shadows the stored one.
master's new disclosure test pins the literal the abort backport retired;
the seeded cancel fixture now carries 'Error: tool call aborted', so the
test literals and the ARIA golden follow (replay-verified on Linux).
The boundary marker row is a 0-height hairline except at the table tail;
the marker button is absolutely positioned and visible anywhere, so the
terminal-marker e2e waits on the button. Also refresh the
cordis-inspect-jsdoc fixture to the typed error reason (LlmFailure).
The scenario arrived with master and recorded its trigger while the Host
still synthesized an unlisted current model. This branch stopped doing that,
so the trigger reads `Select model` until the user picks an advertised one.
Making `.sources` a scroll container turned its `padding-left` from spacing
into a correctness constraint. A scroll container clips inline-start overflow
with no way to scroll it back, and `::marker` is right-aligned to the content
edge, so past nine sources the markers rendered as `0.` and `1.` where `10.`
and `11.` belonged.
`searchMaxResults` is an unbounded positive integer, so size the padding in
`em` against the list's own font to hold a three-digit marker. The browser e2e
measures a `999. ` marker in that inherited font and requires the computed
padding to be at least that wide, pinning the room against the widest marker
rather than one fixture's source count.
- gen-cordis-catalog / gen-persistence-catalog / gen-doc-graphs after the
error-reason and steering/message changes (line anchors and event
producer/consumer graph drifted).
- verify-translation-pairing --write --all: every bilingual pair touched
by the PR (agent notes, session/core docs, READMEs) plus the merge.
- queue-actions preserved golden re-recorded against the rebuilt client
(branch disabled on non-completed-turn tails is back in effect).
PR #1003 re-recorded this golden from a base that predated PR #1150, which
disables the branch control on any message that is not a completed turn's
tail. Both landed on master, whose CI skips the snapshot lane, so the
conflict only surfaces on PRs. The first message's control is now disabled
with its explanatory text.
jsdom resolves no CSS Modules layout and reports scrollHeight === clientHeight
for every element, so the unit test cannot witness the scroll the .sources
max-height produces. Drive it in the real browser instead.
The web-search-round search double now returns 12 provider results with a
title, snippet, and date each. That pins the seam's cap end to end for the
first time in a real composition — searchMaxResults keeps 8, the model-visible
text carries the kept titles and none of the dropped URLs, meta.truncated is
true — and 8 such rows overflow the 320px container. A case after the aria
golden expands the row and asserts 8 <li>, no button, the truncation
indicator, and computed max-height/overflow-y with scrollHeight > clientHeight.
The recorded stream and the aria golden are unchanged: replay is a positional
cursor over the fixture's chunks and the search double is a separate local
endpoint, while the card is collapsed at capture time.
