The Harness-home exemption matched every name case-insensitively, so a
home `.env` line such as `deepseek_base_url=...` passed the check and
landed in `process.env` under that spelling. The launch snapshot looks
names up exactly on POSIX, so llm-deepseek, web-search-deepseek, and
web-deepseek-api never saw it: the launch succeeded with the official
endpoint, where it used to fail. Proxy names keep matching in any letter
case because proxy clients read both spellings; the two endpoint names
now match only as `DEEPSEEK_BASE_URL` and `DEEPSEEK_SEARCH_BASE_URL`, and
another spelling fails the launch with the exact name to use.
The home-layer refusal case now covers `SSL_CERT_FILE`,
`NODE_TLS_REJECT_UNAUTHORIZED`, and `DSH_HOME`. The web-deepseek-api
README states where `DEEPSEEK_BASE_URL` may come from; the
launch-environment README, the development guide, and the configuration
source Agent Note no longer overstate which file is refused, which
Vitest configurations load the root `.env`, or what a checkout may carry.
Refs #8138
Yichen Jiang
9b6e551054