review: client-owned default-config injection; tar the bare exe artifact

Address the three ds-review-bot warnings on #253:

- An empty DSH_CORDIS_CONFIG now counts as absent when deciding whether
  to inject the bundled default config, matching the runtime bin's
  config-discovery semantics.
- The injection moves from DeepSeekHarness into HarnessClient.start(),
  so the low-level client's default bundled launch also boots without
  callers duplicating the env setup.
- The bare single-file exe artifact ships inside a tar.gz like the
  Python bundle: upload-artifact's zip transport drops the executable
  bit.

python/sdk/src/deepseek_harness/api.py

@@ -1,6 +1,5 @@
 from __future__ import annotations
 
-import os
 import uuid
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -60,8 +59,6 @@ class DeepSeekHarness:
             env["DSH_SESSION_ROOT"] = self.config.session_root
         if self.config.cordis is not None:
             env["DSH_CORDIS_CONFIG"] = self.config.cordis
-        else:
-            self._inject_bundled_default_config(env)
         env["DSH_CWD"] = cwd
         if self.config.base_url is not None:
             env["DEEPSEEK_BASE_URL"] = self.config.base_url
@@ -109,27 +106,6 @@ class DeepSeekHarness:
         self._client.close()
         self._initialized = False
 
-    def _inject_bundled_default_config(self, env: dict[str, str]) -> None:
-        """Restore the zero-config experience over the config-mandatory bundled runtime.
-
-        The bundled runtime (single-file exe or the dev-only node closure)
-        always demands an explicit config. When the caller neither provided
-        ``cordis`` nor selected a runtime explicitly (``runtime_bin`` /
-        ``launch_args_override``), and no ambient ``DSH_CORDIS_CONFIG`` exists,
-        inject the runtime package's checked-in default cordis.yml. With an
-        explicit runtime or config channel the SDK stays out of the way.
-        """
-        uses_bundled_runtime = self.config.runtime_bin is None and self.config.launch_args_override is None
-        if not uses_bundled_runtime or "DSH_CORDIS_CONFIG" in env or "DSH_CORDIS_CONFIG" in os.environ:
-            return
-        try:
-            from deepseek_harness_runtime import bundled_default_config_path
-        except ImportError:
-            # Only the runtime package's absence reaches here; swallow it so
-            # HarnessClient.start() reports the actionable install error.
-            return
-        env["DSH_CORDIS_CONFIG"] = str(bundled_default_config_path())
-
     def start_session(self, session_id: str | None = None) -> "Session":
         self.start()
         return Session(self, session_id or f"session-{uuid.uuid4().hex}")

python/sdk/src/deepseek_harness/client.py

@@ -67,6 +67,7 @@ class HarnessClient:
         env = os.environ.copy()
         if self.config.env:
             env.update(self.config.env)
+        self._inject_bundled_default_config(env)
         self._proc = subprocess.Popen(
             args,
             stdin=subprocess.PIPE,
@@ -411,6 +412,32 @@ class HarnessClient:
             ) from exc
         return resolve_bundled_launch_args()
 
+    def _inject_bundled_default_config(self, env: dict[str, str]) -> None:
+        """Restore the zero-config experience over the config-mandatory bundled runtime.
+
+        The bundled runtime (single-file exe or the dev-only node closure)
+        always demands an explicit config. When the launch resolves to the
+        bundled runtime (no ``runtime_bin`` / ``bridge_bin`` /
+        ``launch_args_override``) and the merged subprocess environment has no
+        non-empty ``DSH_CORDIS_CONFIG`` — the runtime bin treats an empty
+        value as absent, so this does too — inject the runtime package's
+        checked-in default cordis.yml. With an explicit runtime or config
+        channel the client stays out of the way.
+        """
+        uses_bundled_runtime = (
+            self.config.launch_args_override is None
+            and self.config.runtime_bin is None
+            and self.config.bridge_bin is None
+        )
+        if not uses_bundled_runtime or env.get("DSH_CORDIS_CONFIG"):
+            return
+        # Cannot fail: _default_launch_args() already imported the runtime
+        # package on this (bundled) path, raising the actionable install
+        # error when it is absent.
+        from deepseek_harness_runtime import bundled_default_config_path
+
+        env["DSH_CORDIS_CONFIG"] = str(bundled_default_config_path())
+
     def _unsubscribe_notifications(self, subscription_id: str) -> None:
         with self._lock:
             self._notification_subscribers.pop(subscription_id, None)