fix: apply the review items for #755 at merge

Say that settings.yaml is shared only until the session's first settings write
(dsh saves by rename, which replaces the link), warn when a session's own DSH_HOME
does not answer and the server's home is linked instead, test
guardSessionConfigDirHome, and document the linkFromRealHome exception and what a
custom-model dsh session does not carry over.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/config/cli-registry/stock.ts

@@ -1562,7 +1562,9 @@ const DEEPSEEK: CliEntry = {
       // dsh keeps state in its home that the redirect must NOT swallow: `sessions` is the
       // session-log root (deleting it would take the user's transcripts with it on clear/
       // close), `profiles` are the installed bundles the patch composes over, and
-      // `settings.yaml` must keep applying. The generated home-level `cordis.patch.yml`
+      // `settings.yaml` must keep applying (read through the link only until the session's
+      // first settings write: dsh saves by rename, which replaces the link with a local file
+      // that goes away with the session). The generated home-level `cordis.patch.yml`
       // deliberately replaces the user's own for the session rather than linking it.
       // `sessions` and `profiles` are directories: dsh creates them itself on a first
       // turn, and a fresh/relocated $DSH_HOME that never ran one would otherwise get a

src/config/cli-registry/types.ts

@@ -893,6 +893,8 @@ export interface CliCapabilities {
          * home carries state that must survive the redirect (deepseek's `sessions` transcript
          * root and `profiles` bundles, plus `settings.yaml`, which would otherwise stop
          * applying and — for `sessions` — get deleted by `removeConfigDir` on clear/close).
+         * A CLI that saves a linked file by rename replaces the link: dsh does, so the first
+         * in-session settings write turns `settings.yaml` into a local file.
          * Never include `fileName` itself: the generated file owns that name in the isolated
          * directory, and a link there would write THROUGH into the user's real file.
          * Consumed generically by custom-model-injection-apply.ts.

src/web/routes/session-routes.ts

@@ -246,7 +246,7 @@ function landedInGroup(layout: TabLayout | undefined, sessionId: string): boolea
  * one env var, so linking falls through to the server's own environment and the unresponsive
  * path is never touched. Any other entry's lookup passes through untouched.
  */
-async function guardSessionConfigDirHome(
+export async function guardSessionConfigDirHome(
   entry: Pick<CliEntry, 'capabilities'>,
   baseLookup: (envVar: string) => string | undefined
 ): Promise<(envVar: string) => string | undefined> {
@@ -256,6 +256,7 @@ async function guardSessionConfigDirHome(
   const supplied = baseLookup(dirEnvVar)?.trim();
   if (!supplied || !isAbsolute(supplied)) return baseLookup;
   if ((await probePathKind(supplied, { pastCap: true })) === 'unknown') {
+    console.warn(`[custom-model] ${dirEnvVar} (${supplied}) did not answer; linking from the server's own home instead`);
     return (envVar: string) => (envVar === dirEnvVar ? undefined : baseLookup(envVar));
   }
   return baseLookup;