dsh-plugin-doctor v1.13.0 - dsh env explain
dsh-plugin-doctor v1.13.0
New command: dsh env explain (secret-safe environment provenance, discussion #1953)
- Explains which layer won for one env key: launch environment > project .env > user .env.
- Empty values never mask lower layers (#981 semantics) - the skip is recorded.
- The raw value never appears anywhere: �alue is the constant [redacted]; tests assert the real value string is absent from the serialized report.
- JSON envelope per the #1953 contract: key / resolved / source / layers / value.
- States: absent / empty / selected / lower-precedence / non-regular-path / unreadable (rejected-protected reserved for harness-internal rules).
Usage:
npx dsh-plugin-doctor env explain DEEPSEEK_API_KEY
npx dsh-plugin-doctor env explain MY_KEY --json
Tests: 40/40 + dsh-doctor/v1 contract check green.