dsh-slopo agent
844f12faa3
Every path the plugin owns is under $DSH_HOME. Only two directories in the container this runs in are persistent volumes ($DSH_HOME and the workspace root); $HOME/.local -- where 'uv tool install' puts slopo and its CPython by default -- is on the container's writable layer and dies on recreation, not merely on restart. renderSlopoConfig writes from a closed allow-list because slopo treats an unknown config key as a hard error, and quotes every scalar because a path can contain a colon or a leading dash. Verified against slopo 0.8.0 itself: it reads the generated file back with no complaint and round-trips all 19 keys. The embedding API key is deliberately absent -- slopo reads SLOPO_EMBEDDING_API_KEY from the environment ahead of the YAML value, so the secret never lands on disk.