CLI rc.6 fails to boot when ~/.dsh/.credentials.yaml is in DSH Desktop format (structured version/refs/records)

[jackeyunjie]

Summary

When DSH Desktop has written ~/.dsh/.credentials.yaml in its structured format (version / refs / records), the CLI (@deepseek-ai/dsh@0.1.0-rc.6) aborts boot entirely: credentials-local expects a flat mapping of credential ref → non-empty string and rejects the Desktop-written file wholesale.

Environment

• @deepseek-ai/dsh 0.1.0-rc.6 (npm global install, Node v22, macOS, Apple Silicon)
• DSH Desktop (macOS) installed and signed in — it owns and rewrites ~/.dsh/.credentials.yaml

Repro

1. Let DSH Desktop create/update ~/.dsh/.credentials.yaml. Its top-level shape is:

   version: 1
   refs:
     DEEPSEEK_API_KEY: sk-...
     KIMI_API_KEY: sk-...
   records:
     client-connection/browser-session:
       kind: ...
       payload: { version: 1, secret: ... }

2. Boot any CLI profile, e.g. dsh --profile web.

Actual behavior

Boot dies at the credentials loader entry and the entire plugin tree fails to load:

Error: dsh: plugin tree failed to load: failed to apply loader entry include (cordis:include):
  failed to apply loader entry credentials (@deepseek-ai/dsh-credentials-local):
  credentials-local: the value for "version" in /Users/<me>/.dsh/.credentials.yaml must be a string

After manually quoting version as a string, boot then fails identically on refs (a mapping, not a string). Root cause: parseCredentialsDocument in dsh-credentials-local treats every top-level key as a credential ref with a non-empty string value, so any Desktop-written envelope is rejected.

Expected behavior

One of:

• CLI tolerates the structured envelope — reads refs, ignores version / records; or
• CLI and Desktop converge on a versioned credentials schema (the version field suggests this was planned); or
• Desktop writes to a file other than the CLI's default ~/.dsh/.credentials.yaml.

Workaround (confirmed working on rc.6)

Repoint the credentials plugin per-profile to a CLI-only flat file, leaving Desktop's file untouched — profiles/<name>/cordis.patch.yml:

- id: credentials
  config:
    path: "/Users/<me>/.dsh/.credentials-cli.yaml"   # flat ref→string mapping, chmod 600

Downside: keys rotated in Desktop must be re-synced into the CLI file manually.

Happy to test any fix. Thanks for the great tool — the plugin architecture has been a pleasure to build on.

[argszero]

The document is the shape this line requires — the failing half is the CLI build's reader

Thanks for the precise reproduction; the boot path and the error text are accurate. One correction on the direction of the contract, because it decides the remedy.

At the current upstream head (86a40220), credentials-local requires the versioned, sectioned document and rejects the flat one — the opposite of a reader that expects a flat mapping of ref → non-empty string:

• packages/credentials/credentials-local/src/index.ts:192 — parseCredentialsDocument reads version / refs / records. A document with no version key is refused with "uses the pre-release flat layout. Add version: 1 and nest the existing entries under refs:" (:212-217); a version other than DOCUMENT_VERSION = 1 (:167) is refused by name (:219-223).
• The Desktop-written file you pasted (version: 1 + refs + records) is therefore exactly what this build reads, and client-connection/browser-session matches the records key grammar — <scope>/<id>, parseCredentialKey (:296).
• The build that reads a flat mapping is the older one inside @deepseek-ai/dsh@0.1.0-rc.6. That build is the out-of-date half, not the document.

Version boundary, from this repository's own history rather than from memory: the sectioned document with records arrived in 86a9f8c862 ("feat(credentials): store durable credential records beside references") and the boot-time upgrade of a pre-release flat document arrived in 933d1f2ab2 ("feat(credentials): upgrade the pre-release flat document at boot") — both first tagged dsh-v0.1.1-rc.1. So a CLI build on the 0.1.1 line or later reads what Desktop 0.2.0-rc.2 writes, and additionally rewrites an existing flat file in place at boot (loadInitial, :795; the rewrite runs under the document's writer lock and re-reads first, so a concurrent boot cannot lose it).

Two details worth having before editing the file by hand:

• Quoting is the wrong repair. version must be the number 1, compared with !== against DOCUMENT_VERSION; version: "1" is refused exactly as version: 1 is accepted. Your first workaround converts one rejection into another on a current build.
• Foreign top-level keys do not stop boot. Anything outside version/refs/records is collected into ignoredKeys and reported as a warning (:228, warnIgnoredKeys) — which the module's own doc comment states as the intent: "so a foreign entry another tool wrote does not stop boot". The refusal is about the root shape, not about Desktop having written entries this reader does not recognise.

One more property of the diagnostics that is easy to trip over: errors here never quote a value, only the key name and the position (:194-200), because in this document the offending line is a secret.

I read this repository, not the registry, so I have not verified which published CLI versions carry the sectioned reader — choose the CLI build by its own version rather than by my claim about it.