README.md 5.9 KB
description: "An immutable snapshot of this run's environment that remembers which layer supplied each value, for packages that must resolve user-facing values without trusting a flattened process.env."
kind: "package-library"
@deepseek-ai/dsh-launch-environment
English | 中文
Summary
Use @deepseek-ai/dsh-launch-environment to resolve launch-time environment values without trusting the flattened process.env. It freezes inherited process values, the invocation directory's .env, and the Harness home's .env, then returns the winning value and its source in a fixed trust order. Callers can exclude layers for sensitive lookups; an omitted layer stays unreachable regardless of later ordering changes. The snapshot is immutable, but every layer is still copied into process.env, so it does not isolate subprocesses. Import it as a library; it cannot be mounted from cordis.yml.
Table of Contents
- Use this package
- Understand the implementation
- Further Exploration
- Known Limitations and Deferred Work
- Dev Note
Use this package
Resolve user-facing values through the snapshot instead of process.env whenever the layers are not equally trusted — for example a credential override a caller must never take from a project directory.
Resolving a value
import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment'
declare const ctx: import('@deepseek-ai/cordis').Context
const endpoint = launchEnvironmentOf(ctx).get('DEEPSEEK_BASE_URL')?.value
get(name) searches every layer, most trusted first. getFrom(name, sources) searches only the named layers without changing that trust order — a caller that must never accept a layer leaves it out of the list, so no future reordering can let it back in.
launchedThroughSsh(snapshot) returns true only for a non-empty SSH_CONNECTION or SSH_TTY in the inherited process layer. Web browser handoff, the adaptive directory picker, and Open In share this predicate; project and user .env values never establish an SSH session.
How layers rank
| Layer | What it is |
|---|---|
| Inherited process environment | What the launching shell, CI job, or container passed in — this run's explicit intent |
<invocation cwd>/.env |
The project the harness was launched in, which the product trusts to configure its own agent |
$DSH_HOME/.env |
The user's own machine-level defaults |
Names match the way the platform matches them: exactly on POSIX, case-insensitively on Windows. A case-sensitive lookup on Windows would rank the wrong layer — a shell's deepseek_api_key and a project .env's DEEPSEEK_API_KEY are one variable to the OS.
When no launcher booted the tree
launchEnvironmentOf(ctx) returns the launcher's snapshot when the product CLI booted the tree, and otherwise the inherited environment as the only layer. The fallback does not weaken the rules: an SDK host or a bare cordis.yml discovered no files, so everything it has is the environment it was launched with.
Understand the implementation
Implementation internals — click to expand
The snapshot is built on one separation: the launcher owns which files exist, and the snapshot owns how values rank. ### Source map | File | Role | |---|---| | [`src/index.ts`](src/index.ts) | `createLaunchEnvironmentSnapshot`, `launchEnvironmentOf`, and the `ctx.launchEnvironment` slot | | — | No runtime invariant companion is published; the snapshot is frozen before any fiber starts and this package owns no event stream or mutable runtime data; its lookup and rejection rules are enforced by unit tests. | ### How the snapshot stays frozen `createLaunchEnvironmentSnapshot` copies every layer's values at construction, so a later mutation of the source object cannot change the snapshot. Lookups walk a canonical trust order regardless of construction order; on Windows, names are folded to uppercase before storage so case variants cannot split precedence. ### What omission means `getFrom` filters by the canonical order, never by the caller's list order. Omitting a layer is a refusal: the value is unreachable through that call, which is the mechanism a caller uses when a layer must never influence a specific decision.Further Exploration
Read these pages when you need the launcher that builds the snapshot or the consumers that resolve through it.
- Boot package — the launcher that fills
ctx.launchEnvironmentbefore any config entry mounts. - Credentials store — resolves stored credentials against the snapshot's layers.
- DeepSeek provider — reads provider configuration through the launch environment.
Known Limitations and Deferred Work
These limits define when the snapshot is not a security boundary. They are current package constraints, not a task backlog.
- The snapshot is not a subprocess boundary — every layer is also materialized into
process.env, so ordinary project variables reach child processes underdsh-subprocess's scrub; the product launcher's.envcontract rejects bootstrap variables before materialization. - No per-workspace layer — the project layer is the invoking directory, fixed at launch; a workspace selected later in the Web UI contributes nothing, deliberately, because following it would let a model's own workspace change the harness environment mid-session.