Configuration and Data

Harness home resolution

Upstream fact

The shared home-path utility resolves one Harness data root. Precedence is an explicit configured path, then non-blank DSH_HOME, then ~/.dsh. Blank or whitespace-only DSH_HOME is treated as unset.

Loca decision

deek.service always sets DSH_HOME=/var/lib/deek. Do not rely on the transient user’s default home and do not point the service at an operator home.

Verified paths

Path	Owner and purpose	Sensitivity
$DSH_HOME/.credentials.yaml	Managed provider credential document. The Models page writes secrets and receives only redacted descriptors.	Secret
$DSH_HOME/settings.yaml	Provider/model settings and credential references; custom provider compatibility and modality fields can live here.	Sensitive configuration; references can reveal provider identity
$DSH_HOME/cordis.patch.yml	Home-wide Cordis patch layer applied after profile layers.	Trusted executable configuration
$DSH_HOME/profiles/<name>/package.json	Profile manifest, plugin dependencies, ordered Bundle list, and patch-reload lifecycle.	Trusted dependency manifest
$DSH_HOME/profiles/<name>/cordis.patch.yml	Profile-specific user patch layer.	Trusted executable configuration
$DSH_HOME/profiles/<name>/node_modules	Out-of-tree packages installed by profile plugin management.	Trusted executable code
$DSH_HOME/sessions	Root configured for JSONL session persistence in the shipped base Bundle.	User prompts, model output, tool data, paths
$DSH_HOME/storages	Root configured for the shipped JSON key/value storage domains.	Application state and derived metadata
$DSH_HOME/.env	Optional upstream launch-environment source.	Secret; disallowed for loca service provisioning
<invoking-directory>/.env	Optional upstream launch-environment source.	Secret; disallowed in the loca workspace

The shipped base uses an in-memory SQLite session-content index by default; no durable SQLite path should be invented for this deployment. Session JSONL and JSON storage are implementation-owned. Back them up as trees and do not hand-edit internal shards or domain records.

Loca path mapping

With DSH_HOME=/var/lib/deek, the verified persistent roots become:

Upstream symbolic path	Loca path
$DSH_HOME/.credentials.yaml	/var/lib/deek/.credentials.yaml
$DSH_HOME/settings.yaml	/var/lib/deek/settings.yaml
$DSH_HOME/cordis.patch.yml	/var/lib/deek/cordis.patch.yml
$DSH_HOME/profiles/web	/var/lib/deek/profiles/web
$DSH_HOME/sessions	/var/lib/deek/sessions
$DSH_HOME/storages	/var/lib/deek/storages
Dedicated workspace	/var/lib/deek/workspace

/var/lib/deek/workspace is a loca deployment path, not an upstream DSH_HOME child contract. It lives under the state directory so the transient service identity can write it, but it must remain distinct from credentials, settings, profiles, and session storage.

Configuration layers

Upstream composes a profile over an empty root in this order:

1. each Bundle patch named by the profile manifest, in manifest order;
2. the profile’s cordis.patch.yml;
3. $DSH_HOME/cordis.patch.yml;
4. each CLI --patch overlay, in argument order.

Later layers win for the rows they target. The web profile is auto-initialized from its shipped template on first use. dsh web is a hardcoded alias for --profile web.

A profile with patchReload: live watches the profile and home patch files and reapplies valid edits transactionally. Bundle membership is fixed for the running process and changes only after restart.

Provider credential sources

Upstream can resolve provider credentials from:

• inherited launch environment;
• $DSH_HOME/.credentials.yaml;
• the invoking directory’s .env;
• $DSH_HOME/.env.

The managed credential document is not materialized into process.env.

Loca policy narrows this flexibility:

• first-provider secrets are written through the authenticated Models UI;
• provider values do not belong in deek.service, /opt/deek/app, the workspace, Git, or Markdown;
• .env files are not a service secret-delivery mechanism;
• the full /var/lib/deek tree is secret-bearing and access-controlled.

State, session, and workspace behavior

• The invoking directory is upstream’s default filesystem location.
• A fresh Web UI has no selected workspace until one is added and selected.
• The loca unit pins the invoking directory and allowed working tree to /var/lib/deek/workspace.
• New base-backed sessions default to workspace-write: mutations are limited to the session workspace and platform temporary roots, but reads and network access are not confined.
• Session logs can contain prompts, outputs, tool arguments, tool results, and workspace paths.
• Telemetry is hard-disabled locally, but local session and application state still persists under DSH_HOME.

Backup and restore scope

Before every update:

1. stop deek.service;
2. back up /var/lib/deek through a root-controlled, encrypted or equivalently access-restricted mechanism;
3. do not display, diff, or copy credential contents into a transcript;
4. label the backup with the matching application revision;
5. restore state only with a compatible immutable runtime revision.

The operator source checkout and /opt/deek/app are reproducible application material. /var/lib/deek is the non-reproducible state boundary.

Related pages

• First provider and session
• Plugin model
• Service and updates
• Verified sources