mirror of
https://github.com/deepseek-ai/deepseek-harness.git
synced 2026-09-14 04:01:35 +00:00
Yichen Jiang
933d1f2ab2
Internal builds before the versioned layout wrote .credentials.yaml as a flat mapping; refusing it outright would strand every key stored through the Models page and fail the next model request. Boot now recognizes exactly that layout - addressable names over non-empty string scalars, no directives - and rewrites it under the writer lock, nesting the original lines verbatim under refs: with the values byte for byte unchanged. Everything the recognizer declines keeps the loud by-name refusal, a live reload still never migrates, and the parser continues to read exactly one layout. The migration step retires with the pre-release stance at the first tagged release.
credentials/ — credentials and authorization
English | 中文
The credential capability family separates reference resolution from its provider, and separates both from obtaining a credential that has to be asked for:
| Package | Role | ctx key |
|---|---|---|
credentials/ |
Credential-reference and credential-record seam | ctx.credentials |
credentials-local/ |
Environment and local-file provider | registers ctx.credentials |
authorization/ |
Plugin-owned flows that obtain a credential by asking a human | ctx.authorization |
Configuration carries references, not secret values. Consumers resolve those references at their operation boundary; the child READMEs own mutation, precedence, and storage semantics. An authorization flow writes a credential record and is keyed by it, so the two seams meet at the record and nowhere else.
The subsystem reference — CredentialRef, per-operation resolution, UI-safe CredentialInfo, provider layers — is docs/subsystems/credentials.md.