Merge remote-tracking branch 'origin/master' into worktree/web-multimodal-image-input

python/sdk-runtime/package.json

@@ -26,6 +26,7 @@
     "@deepseek-ai/dsh-compact-basic": "workspace:^",
     "@deepseek-ai/dsh-compact-tool-result-prune": "workspace:^",
     "@deepseek-ai/dsh-credentials": "workspace:^",
+    "@deepseek-ai/dsh-environment": "workspace:^",
     "@deepseek-ai/dsh-fs": "workspace:^",
     "@deepseek-ai/dsh-fs-local": "workspace:^",
     "@deepseek-ai/dsh-fs-policy": "workspace:^",

python/sdk-runtime/src/deepseek_harness_runtime/runtime/cordis.yml

@@ -13,13 +13,12 @@
     workspaceContext:
       maxBytes: 65536
 
-# Stock DeepSeek adapters. Loading requires an API key; initialize and shutdown
-# may use a dummy key because they do not call the model.
+# Stock DeepSeek adapters. The adapter resolves DEEPSEEK_API_KEY through the
+# credential seam and, with no provider mounted here, from the launching
+# environment; DEEPSEEK_BASE_URL follows the same environment ladder. Neither
+# is inlined, so this file names no secret and no route.
 - id: llm-deepseek
   name: '@deepseek-ai/dsh-llm-deepseek'
-  config:
-    apiKey: !!js process.env.DEEPSEEK_API_KEY
-    baseURL: !!js process.env.DEEPSEEK_BASE_URL
 
 # JSONL persistence; $DSH_SESSION_ROOT wins over ./.sessions in the process cwd.
 - id: sessions