@elinpf/dsh-ops-access-ceph 0.1.0

package/README.i18n.yaml

@@ -0,0 +1,4 @@
+title: "@elinpf/dsh-ops-access-ceph"
+description:
+  zh: "运维模式 Ceph 凭证 provider — 校验 ceph.conf/keyring 条目并在保存时探测 ro/rw tier"
+  en: "Ceph credential provider for ops mode — validates ceph.conf/keyring entries and probes ro/rw tiers at save time"

package/README.md

@@ -0,0 +1,45 @@
+# @elinpf/dsh-ops-access-ceph
+
+The Ceph credential provider for DeepSeek Harness ops mode — validates `ceph` registry entries (ceph.conf + keyring), expands their paths, and probes claimed ro/rw tiers against the cluster's real cephx caps at save time.
+
+## What it does
+
+One provider per credential kind, per the ops-access three-role split: core owns the registry and the `ctx.opsAccess` service; this package supplies only the ceph kind — a zod entry schema plus field processing.
+
+- **Entry schema**: `{ conf, keyring, name? }` — the admin UI accepts ceph.conf and keyring CONTENT; core writes them to managed files under `~/.dsh-ops/credentials/` and stores the paths. `name` is the cephx entity (defaults to `client.admin`).
+- **process**: expands a leading `~` in both paths for the tool's `--conf`/`--keyring` flags.
+- **validateContent**: save-time paste guard — `[global]` + `mon_host` required in the conf; an indented strict-base64 `key =` line under a `[client.x]` section in the keyring. Structural only, no connectivity checks.
+- **Capability probe** (ticket 10): at save time re-reads the entity's caps via `ceph auth get` and compares with the claimed tier. ro verifies only when no cap grants write (permission bundles like `rwx`/`wx` count; the `allow` keyword never does; pool qualifiers are inert). Failures degrade to `unverifiable` — a tight ro entity that cannot self-read its caps is normal, not an error.
+- **derivationDoc**: the ro self-registration recipe (`client.<id>-ro` with `allow r` on mon/osd/mds/mgr), surfaced through `list_access` help.
+
+## Design notes
+
+- Structural validation lives in the provider, connectivity in the probe: a garbled paste fails at save time instead of surfacing as "cannot parse buffer: Malformed input" at connection time.
+- Trailing-newline normalization is core's job (`normalizeTrailingNewline: true` opts in) — the provider no longer rejects a missing trailing newline.
+- Probe stderr is classified by substring and never surfaced: ceph error messages can carry file paths.
+
+## Configuration
+
+Schemastery `Config`, one field:
+
+- `probeTimeoutMs` (number, default `10000`) — timeout for the save-time `ceph auth get` call. Slow clusters may need more.
+
+## Installation
+
+Provider row of the ops preset's `agent.cordis.yml`:
+
+```yaml
+- id: ops-access-ceph
+  name: '@elinpf/dsh-ops-access-ceph'
+```
+
+Registration goes through `registerAccessProvider` (deferred `ctx.inject` + effect lifecycle, so HMR unloads it) — never a static `inject` on `opsAccess`, which deadlocks the loader.
+
+## Testing
+
+```sh
+npm run build      # tsc → lib/
+npx vitest run     # schema, process, paste guard, probe classification, registration/HMR disposal
+```
+
+No cluster needed: the live-probe test points at nonexistent paths and asserts the result degrades to `unverifiable` without leaking paths.

package/README.zh.md

@@ -0,0 +1,45 @@
+# @elinpf/dsh-ops-access-ceph
+
+运维模式 Ceph 凭证 provider — 校验 `ceph` 注册表条目(ceph.conf + keyring)、展开路径,并在保存时用集群真实 cephx caps 探测声称的 ro/rw tier。
+
+## 功能
+
+按 ops-access 三角色拆分,一种凭证一个 provider:core 拥有注册表和 `ctx.opsAccess` 服务;本包只提供 ceph 这一种 — 一个 zod 条目 schema 加字段处理。
+
+- **条目 schema**:`{ conf, keyring, name? }` — 管理 UI 接受 ceph.conf 和 keyring 的内容;core 将其写入 `~/.dsh-ops/credentials/` 下的受管文件并存路径。`name` 是 cephx 实体(缺省 `client.admin`)。
+- **process**:展开两个路径开头的 `~`,供工具的 `--conf`/`--keyring` 参数使用。
+- **validateContent**:保存时的粘贴防护 — conf 必须有 `[global]` 和 `mon_host`;keyring 必须在 `[client.x]` 段下有缩进的严格 base64 `key =` 行。只查结构,不做连通性检查。
+- **能力探测**(ticket 10):保存时通过 `ceph auth get` 重读实体的 caps,与声称的 tier 对比。ro 只有在没有任何 cap 授予写权限时才通过(`rwx`/`wx` 这类权限束算写,`allow` 关键字本身不算,pool 限定符不影响判定)。失败降级为 `unverifiable` — 收紧的 ro 实体无法自读 caps 是正常现象,不是错误。
+- **derivationDoc**:ro 自助注册配方(`client.<id>-ro`,mon/osd/mds/mgr 均 `allow r`),通过 `list_access` 的 help 暴露。
+
+## 设计要点
+
+- 结构校验在 provider,连通性在探测:粘贴损坏在保存时就报错,而不是到连接时才冒出 "cannot parse buffer: Malformed input"。
+- 末尾换行归一化是 core 的职责(`normalizeTrailingNewline: true` 选择加入)— provider 不再因缺末尾换行而拒绝。
+- 探测的 stderr 只按子串分类、从不外泄:ceph 错误信息可能携带文件路径。
+
+## 配置
+
+Schemastery `Config`,一个字段:
+
+- `probeTimeoutMs`(数字,默认 `10000`)— 保存时 `ceph auth get` 调用的超时。慢集群可能需要调大。
+
+## 安装
+
+ops preset 的 `agent.cordis.yml` 中的 provider 行:
+
+```yaml
+- id: ops-access-ceph
+  name: '@elinpf/dsh-ops-access-ceph'
+```
+
+注册走 `registerAccessProvider`(延迟 `ctx.inject` + effect 生命周期,HMR 可卸载)— 绝不静态 `inject` `opsAccess`,那会死锁加载器。
+
+## 测试
+
+```sh
+npm run build      # tsc → lib/
+npx vitest run     # schema、process、粘贴防护、探测分类、注册/HMR 卸载
+```
+
+无需集群:活体探测测试指向不存在的路径,断言结果降级为 `unverifiable` 且不泄露路径。

package/cordis.patch.yml

@@ -0,0 +1 @@
+[]

package/lib/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Ops access provider for Ceph.
+ *
+ * Validates `ceph` registry entries (`{ conf, keyring, name? }`). The admin
+ * UI accepts ceph.conf and keyring CONTENT; core writes it to managed files
+ * under ~/.dsh-ops/credentials/ and stores the path in the registry. The
+ * provider expands ~ in the path for the tool's --conf/--keyring flags.
+ *
+ * @module @elinpf/dsh-ops-access-ceph
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { z as zod } from 'zod';
+import type { AccessProvider } from '@elinpf/dsh-ops-access';
+import type { CapAssessment, ProbeFailure } from './types.js';
+export type { CapAssessment, ProbeFailure, ProbeOutcome } from './types.js';
+export declare const name = "ops-access-ceph";
+export declare const inject: string[];
+export declare const Config: z<Schemastery.ObjectS<{
+    /** Save-time probe: timeout for the `ceph auth get` call (ms). Slow clusters may need more. */
+    probeTimeoutMs: z<number, number>;
+}>, Schemastery.ObjectT<{
+    /** Save-time probe: timeout for the `ceph auth get` call (ms). Slow clusters may need more. */
+    probeTimeoutMs: z<number, number>;
+}>>;
+/** Zod schema for one ceph registry entry (excluding name and envelope fields). */
+export declare const entrySchema: zod.ZodObject<{
+    conf: zod.ZodString;
+    keyring: zod.ZodString;
+    name: zod.ZodOptional<zod.ZodString>;
+}, zod.core.$strip>;
+export declare const provider: AccessProvider;
+/** Parse `caps <daemon> = "<value>"` lines from `ceph auth get` output. */
+export declare function parseCaps(output: string): Record<string, string>;
+/**
+ * Pure caps-vs-tier assessment (unit-tested directly). ro verifies when
+ * every daemon cap is read-only ('allow r', optionally with class-read —
+ * librbd object-class reads, ticket 14); rw verifies when at least one cap
+ * grants write.
+ */
+export declare function assessCephCaps(caps: Record<string, string>, tier: 'ro' | 'rw'): CapAssessment;
+/**
+ * Classify an auth-get failure (unit-tested directly). stderr is classified
+ * by substring, never surfaced: ceph error messages can carry file paths.
+ * A tight ro entity CANNOT self-read the auth database (EACCES) — that is
+ * normal, and safe: an over-privileged credential sitting in the ro slot
+ * would have enough privilege for auth get and would have been caught by
+ * the caps comparison.
+ */
+export declare function cephProbeFailure(tier: 'ro' | 'rw', errText: string): ProbeFailure;
+export declare function apply(ctx: Context, config: {
+    probeTimeoutMs: number;
+}): void;

package/lib/index.js

@@ -0,0 +1,152 @@
+/**
+ * Ops access provider for Ceph.
+ *
+ * Validates `ceph` registry entries (`{ conf, keyring, name? }`). The admin
+ * UI accepts ceph.conf and keyring CONTENT; core writes it to managed files
+ * under ~/.dsh-ops/credentials/ and stores the path in the registry. The
+ * provider expands ~ in the path for the tool's --conf/--keyring flags.
+ *
+ * @module @elinpf/dsh-ops-access-ceph
+ */
+import z from '@deepseek-ai/schemastery';
+import { z as zod } from 'zod';
+import { execFile } from 'node:child_process';
+import { expandHome, registerAccessProvider } from '@elinpf/dsh-ops-access';
+// ── Plugin identity ───────────────────────────────────────────────────────────
+export const name = 'ops-access-ceph';
+export const inject = [];
+export const Config = z.object({
+    /** Save-time probe: timeout for the `ceph auth get` call (ms). Slow clusters may need more. */
+    probeTimeoutMs: z.number().default(10000),
+});
+// ── Provider ─────────────────────────────────────────────────────────────────
+/** Zod schema for one ceph registry entry (excluding name and envelope fields). */
+export const entrySchema = zod.object({
+    conf: zod.string(),
+    keyring: zod.string(),
+    name: zod.string().optional(),
+});
+export const provider = {
+    kind: 'ceph',
+    schema: entrySchema,
+    fieldsDoc: 'conf: ceph.conf content; keyring: keyring content; name: optional cephx user (e.g. client.dsh-test) — defaults to client.admin when omitted',
+    fileFields: ['conf', 'keyring'],
+    derivationDoc: "from the rw keyring: ceph auth add client.<id>-ro mon 'allow r' osd 'allow r' mds 'allow r' mgr 'allow r' (naming convention: client.<id>-ro), export it with ceph auth get client.<id>-ro, then register via register_access with the keyring content, a copy of conf, and name set to client.<id>-ro — verify with ceph status",
+    process(entry) {
+        const { conf, keyring, name } = entry;
+        const fields = { conf: expandHome(conf), keyring: expandHome(keyring) };
+        if (name !== undefined)
+            fields.name = name;
+        return fields;
+    },
+    // A missing trailing newline used to be rejected here (ceph's buffer
+    // parser rejects it); core now normalizes it away at write time
+    // (normalizeTrailingNewline). What remains is structure: key lines
+    // indented under their [section], strict base64 — caught here instead of
+    // surfacing as "cannot parse buffer: Malformed input" at connection time.
+    // Structural only — no connectivity checks.
+    normalizeTrailingNewline: true,
+    // Ticket 10: re-read the entity's caps at save time and compare with the tier.
+    probe: probeCeph,
+    validateContent(field, content) {
+        if (field !== 'conf' && field !== 'keyring')
+            return null;
+        if (field === 'conf') {
+            if (!/^\[global\][\t ]*$/m.test(content))
+                return 'no [global] section — paste the full ceph.conf';
+            if (!/^[\t ]*mon_host[\t ]*=/m.test(content))
+                return 'no mon_host set — paste the full ceph.conf';
+            return null;
+        }
+        // keyring
+        if (!/^\[client\.[^\]]+\][\t ]*$/m.test(content))
+            return 'no [client.<name>] section — paste the full keyring';
+        const keyMatch = content.match(/^[\t ]+key[\t ]*=[\t ]*(\S+)[\t ]*$/m);
+        if (!keyMatch) {
+            return 'no indented "key = <base64>" line — ceph requires the key line to be indented under its [client.x] section';
+        }
+        // Strict base64 alphabet + decoded length >= 16 bytes (cephx AES keys
+        // are longer; this only rules out garbled pastes). Decoded length is
+        // derived from the encoded length — no Buffer dependency here.
+        if (!/^[A-Za-z0-9+/]+={0,2}$/.test(keyMatch[1]) || keyMatch[1].length < 24) {
+            return 'the key value is not valid base64 (or too short for a cephx key)';
+        }
+        return null;
+    },
+};
+// ── Capability probe (ticket 10) ─────────────────────────────────────────────
+/** Parse `caps <daemon> = "<value>"` lines from `ceph auth get` output. */
+export function parseCaps(output) {
+    const caps = {};
+    for (const line of output.split('\n')) {
+        const m = line.match(/^\s*caps (\w+) = "(.*)"\s*$/);
+        if (m)
+            caps[m[1]] = m[2];
+    }
+    return caps;
+}
+/**
+ * A cap value grants write when any permission token carries the w flag.
+ * Tokens after 'allow' are permission bundles (r/w/x in any order — 'w',
+ * 'rw', 'rwx', 'wx' are ALL writable) or '*'; qualifiers like 'pool=foo'
+ * never grant write by themselves. NB: the keyword 'allow' itself
+ * contains a 'w' — match permission-bundle tokens, never the keyword
+ * (review fix: the exact-token version missed 'rwx'/'wx').
+ */
+function capIsWritable(value) {
+    return value.split(/\s+/).some((t) => t === '*' || (/^[rwx]+$/.test(t) && t.includes('w')));
+}
+/**
+ * Pure caps-vs-tier assessment (unit-tested directly). ro verifies when
+ * every daemon cap is read-only ('allow r', optionally with class-read —
+ * librbd object-class reads, ticket 14); rw verifies when at least one cap
+ * grants write.
+ */
+export function assessCephCaps(caps, tier) {
+    const summary = Object.entries(caps).map(([d, v]) => d + '="' + v + '"').join(' ');
+    if (Object.keys(caps).length === 0)
+        return { status: 'mismatch', detail: 'auth get returned no caps lines' };
+    if (tier === 'ro') {
+        const writable = Object.entries(caps).filter(([, v]) => capIsWritable(v)).map(([d]) => d);
+        if (writable.length === 0)
+            return { status: 'verified' };
+        return { status: 'mismatch', detail: 'claims ro but caps grant write on ' + writable.join('/') + ' — ' + summary };
+    }
+    if (Object.values(caps).some(capIsWritable))
+        return { status: 'verified' };
+    return { status: 'mismatch', detail: 'claims rw but no cap grants write — ' + summary };
+}
+/**
+ * Classify an auth-get failure (unit-tested directly). stderr is classified
+ * by substring, never surfaced: ceph error messages can carry file paths.
+ * A tight ro entity CANNOT self-read the auth database (EACCES) — that is
+ * normal, and safe: an over-privileged credential sitting in the ro slot
+ * would have enough privilege for auth get and would have been caught by
+ * the caps comparison.
+ */
+export function cephProbeFailure(tier, errText) {
+    if (tier === 'ro' && /EACCES|access denied/i.test(errText)) {
+        return { status: 'unverifiable', detail: 'entity cannot self-read its caps (normal for a tight ro entity — an over-privileged credential in this slot would have the privilege to auth get and would have been caught)' };
+    }
+    return { status: 'unverifiable', detail: 'ceph auth get could not run (cluster unreachable or ceph CLI missing)' };
+}
+async function probeCeph(fields, tier, timeoutMs = 10000) {
+    const name = typeof fields.name === 'string' ? fields.name : 'client.admin';
+    const conf = String(fields.conf ?? '');
+    const keyring = String(fields.keyring ?? '');
+    const result = await new Promise((resolve) => {
+        execFile('ceph', ['--conf', conf, '--keyring', keyring, '--name', name, 'auth', 'get', name], { timeout: timeoutMs }, (err, stdout, stderr) => resolve(err
+            ? { output: null, errText: String(stderr ?? '') + ' ' + String(err.message ?? '') }
+            : { output: stdout, errText: '' }));
+    });
+    if (result.output === null)
+        return cephProbeFailure(tier, result.errText);
+    return assessCephCaps(parseCaps(result.output), tier);
+}
+// ── Plugin apply ─────────────────────────────────────────────────────────────
+export function apply(ctx, config) {
+    registerAccessProvider(ctx, {
+        ...provider,
+        probe: (fields, tier) => probeCeph(fields, tier, config.probeTimeoutMs),
+    });
+}

package/lib/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Invariant companion for @elinpf/dsh-ops-access-ceph.
+ *
+ * @module @elinpf/dsh-ops-access-ceph/invariant
+ */
+/** Cordis companion plugin name. */
+declare const name = "ops-access-ceph-invariant";
+/** Service required before the companion can reserve package ownership. */
+declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Context carrying the invariant service.
+ * @returns a promise resolving after registration.
+ */
+declare const apply: (ctx: any) => Promise<void>;
+export { apply, inject, name };

package/lib/invariant.js

@@ -0,0 +1,27 @@
+/**
+ * Invariant companion for @elinpf/dsh-ops-access-ceph.
+ *
+ * @module @elinpf/dsh-ops-access-ceph/invariant
+ */
+const PACKAGE_NAME = '@elinpf/dsh-ops-access-ceph';
+/** Cordis companion plugin name. */
+const name = 'ops-access-ceph-invariant';
+/** Service required before the companion can reserve package ownership. */
+const inject = ['invariants'];
+/**
+ * No runtime invariant: this provider owns no session events and no durable
+ * shape of its own — it only validates and processes registry fields owned
+ * by ops-access core. Content validation is a pure paste guard, and the
+ * capability probe is read-only: failures degrade to 'unverifiable' instead
+ * of mutating any state.
+ */
+const install = () => { };
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Context carrying the invariant service.
+ * @returns a promise resolving after registration.
+ */
+const apply = async (ctx) => {
+    ctx.invariants.register(PACKAGE_NAME, install);
+};
+export { apply, inject, name };

package/lib/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Type definitions for the ops-access-ceph provider plugin.
+ *
+ * Types only — no runtime code lives here. Provider values (schema, probe
+ * functions, plugin apply) stay in index.ts.
+ *
+ * @module @elinpf/dsh-ops-access-ceph
+ */
+/**
+ * Result of the pure caps-vs-tier assessment: the entity's real caps either
+ * verify the claimed tier or mismatch it.
+ */
+export interface CapAssessment {
+    status: 'verified' | 'mismatch';
+    detail?: string;
+}
+/**
+ * A classified probe failure: the probe itself could not run (cluster
+ * unreachable, ceph CLI missing, or a tight ro entity that cannot self-read
+ * its caps). Always 'unverifiable' — never a rejection.
+ */
+export interface ProbeFailure {
+    status: 'unverifiable';
+    detail: string;
+}
+/** Outcome of a save-time capability probe. */
+export type ProbeOutcome = CapAssessment | ProbeFailure;

package/lib/types.js

@@ -0,0 +1,9 @@
+/**
+ * Type definitions for the ops-access-ceph provider plugin.
+ *
+ * Types only — no runtime code lives here. Provider values (schema, probe
+ * functions, plugin apply) stay in index.ts.
+ *
+ * @module @elinpf/dsh-ops-access-ceph
+ */
+export {};

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@elinpf/dsh-ops-access-ceph",
+  "version": "0.1.0",
+  "description": "Ops access provider for Ceph — validates ceph registry entries and expands conf/keyring paths.",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./types": {
+      "types": "./lib/types.d.ts",
+      "default": "./lib/types.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types.js",
+    "lib/**/*.d.ts",
+    "cordis.patch.yml"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.1",
+    "@elinpf/dsh-ops-access": "^0.1.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "typescript": "^5.4.0",
+    "vitest": "^4.1.11",
+    "@types/node": "^22.0.0",
+    "@elinpf/dsh-ops-access": "0.1.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}