{"record":{"id":"07d0081a6ef3c97f","repo":"deepseek-ai/deepseek-harness","slug":"credentials-local-ref-is-supplied-read-only","errorCode":null,"errorMessage":"credentials-local: \"${ref}\" is supplied read-only by the launching environment, so ${verb} would be shadowed; unset it in the shell you start dsh from instead","messagePattern":"credentials-local: \"(.+?)\" is supplied read-only by the launching environment, so (.+?) would be shadowed; unset it in the shell you start dsh from instead","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/credentials/credentials-local/src/index.ts","lineNumber":796,"sourceCode":"        await writeFileAtomic(this.spec.filename, nextText, { mode: 0o600, dirMode: 0o700 })\n        this.text = nextText\n        if (value === undefined) this.values.delete(ref)\n        else this.values.set(ref, value)\n        // After the commit: a broken observer must never make the durable\n        // write look failed (an INVARIANT failure still rethrows).\n        this.notifyUpdated(ref)\n      }, { waitMs: DOCUMENT_LOCK_WAIT_MS })\n    })\n  }\n\n  /**\n   * Reject a write the inherited environment would shadow into apparent\n   * no-effect. Only that layer can shadow a write: everything else this\n   * provider resolves ranks below the document being written.\n   */\n  private assertUnshadowed(ref: CredentialRef, verb: 'set' | 'unset'): void {\n    if (this.inherited(ref) !== undefined) {\n      throw new Error(\n        `credentials-local: \"${ref}\" is supplied read-only by the launching environment, so ${verb} would be`\n        + ' shadowed; unset it in the shell you start dsh from instead',\n      )\n    }\n  }\n\n  /**\n   * Boot read: an absent file is an empty store; an invalid one fails the\n   * plugin's activation, because a credentials document that exists but\n   * cannot be trusted must never be treated as \"no credentials stored\". The\n   * one exception is the recognized pre-release flat layout, which is\n   * upgraded in place first — a key stored by an earlier build must survive\n   * the layout change without a hand edit.\n   */\n  private async loadInitial(): Promise<void> {\n    await assertOwnerOnly(this.spec.filename)\n    let text: string\n    try {","sourceCodeStart":778,"sourceCodeEnd":814,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/credentials/credentials-local/src/index.ts#L778-L814","documentation":"Error \"credentials-local: \"${ref}\" is supplied read-only by the launching environment, so ${verb} would be shadowed; unset it in the shell you start dsh from instead\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/credentials/credentials-local/src/index.ts:796 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}