@elinpf/dsh-ops-access-prometheus 0.2.0

package/README.i18n.yaml

@@ -0,0 +1,4 @@
+title: "@elinpf/dsh-ops-access-prometheus"
+description:
+  zh: "运维模式 Prometheus 凭证 provider — 校验 prometheus 注册表条目(服务器 URL + 可选 bearer token)并展开 token 路径"
+  en: "Prometheus credential provider for ops mode — validates prometheus registry entries (server URL + optional bearer token) and expands the token path"

package/README.md

@@ -0,0 +1,32 @@
+# @elinpf/dsh-ops-access-prometheus
+
+The Prometheus credential provider for DeepSeek Harness ops mode — validates `prometheus` registry entries (server URL + optional bearer token) and expands the token path.
+
+## What it does
+
+One provider per credential kind, per the ops-access three-role split: core owns the registry and the `ctx.opsAccess` service; this package supplies only the prometheus kind — a zod entry schema plus field processing.
+
+- **Entry schema**: `{ url, token? }` — `url` is the Prometheus server's base URL (http(s) only). `token` is optional bearer-token CONTENT: the admin UI / `register_access` accept the pasted token, core writes it to a managed file under `~/.dsh-ops/credentials/` and stores the path — the token never sits in the registry.
+- **process**: strips trailing slashes from the URL and expands a leading `~` in the token path.
+- **validateContent**: save-time paste guard — a token must be a single line (it is sent verbatim in the `Authorization` header; an interior newline would fail at request time). Structural only, no connectivity checks.
+- **No capability probe**: the Prometheus HTTP API is read-only by nature (`query`/`query_range`), so there is no ro/rw distinction to verify. `knownLimits` says so and points at pairing with the same cluster's k8s profile.
+
+## Installation
+
+Provider row of the ops preset's `agent.cordis.yml`:
+
+```yaml
+- id: ops-access-prometheus
+  name: '@elinpf/dsh-ops-access-prometheus'
+```
+
+Registration goes through `registerAccessProvider` (deferred `ctx.inject` + effect lifecycle, so HMR unloads it) — never a static `inject` on `opsAccess`, which deadlocks the loader.
+
+## Testing
+
+```sh
+npm run build      # tsc → lib/
+npx vitest run     # schema, process, paste guard, registration/HMR disposal
+```
+
+No server needed: all tests run against the pure provider object and a mock mount.

package/README.zh.md

@@ -0,0 +1,32 @@
+# @elinpf/dsh-ops-access-prometheus
+
+运维模式 Prometheus 凭证 provider — 校验 `prometheus` 注册表条目(服务器 URL + 可选 bearer token)并展开 token 路径。
+
+## 功能
+
+按 ops-access 三角色拆分,一种凭证一个 provider:core 拥有注册表和 `ctx.opsAccess` 服务;本包只提供 prometheus 这一种 — 一个 zod 条目 schema 加字段处理。
+
+- **条目 schema**:`{ url, token? }` — `url` 是 Prometheus 服务器的 base URL(仅 http(s))。`token` 是可选的 bearer-token 内容:管理 UI / `register_access` 接受粘贴的 token,core 将其写入 `~/.dsh-ops/credentials/` 下的受管文件并存路径 — token 本身不进注册表。
+- **process**:剥掉 URL 末尾的斜杠,展开 token 路径开头的 `~`。
+- **validateContent**:保存时的粘贴防护 — token 必须是单行(它会原样进 `Authorization` 头,内部换行会在请求时失败)。只查结构,不做连通性检查。
+- **无能力探测**:Prometheus HTTP API 天然只读(`query`/`query_range`),没有 ro/rw 之分可核验。`knownLimits` 写明这一点,并提示与同集群的 k8s 档案配对使用。
+
+## 安装
+
+ops preset 的 `agent.cordis.yml` 中的 provider 行:
+
+```yaml
+- id: ops-access-prometheus
+  name: '@elinpf/dsh-ops-access-prometheus'
+```
+
+注册走 `registerAccessProvider`(延迟 `ctx.inject` + effect 生命周期,HMR 可卸载)— 绝不静态 `inject` `opsAccess`,那会死锁加载器。
+
+## 测试
+
+```sh
+npm run build      # tsc → lib/
+npx vitest run     # schema、process、粘贴防护、注册/HMR 卸载
+```
+
+无需服务器:全部测试只打纯 provider 对象和 mock 挂载。

package/cordis.patch.yml

@@ -0,0 +1 @@
+[]

package/lib/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Ops access provider for Prometheus.
+ *
+ * Validates `prometheus` registry entries (`{ url, token? }`). The URL is
+ * plain connection metadata and may surface in tool output; `token` is a
+ * fileField — the admin UI / register_access accept token CONTENT, core
+ * writes it to a managed file under ~/.dsh-ops/credentials/ and stores the
+ * path, so the token itself never sits in the registry, logs, or model
+ * context. The provider expands ~ in the token path for the tool's read.
+ *
+ * No capability probe: the Prometheus HTTP API is read-only by nature
+ * (query/query_range), so there is no ro/rw distinction to verify — both
+ * tiers serve the same connection parameters.
+ *
+ * @module @elinpf/dsh-ops-access-prometheus
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { z as zod } from 'zod';
+import type { AccessProvider } from '@elinpf/dsh-ops-access';
+export type { PrometheusEntry } from './types.js';
+export declare const name = "ops-access-prometheus";
+export declare const inject: string[];
+export declare const Config: z<Schemastery.ObjectS<{}>, Schemastery.ObjectT<{}>>;
+/** Zod schema for one prometheus registry entry (excluding name and envelope fields). */
+export declare const entrySchema: zod.ZodObject<{
+    url: zod.ZodURL;
+    token: zod.ZodOptional<zod.ZodString>;
+}, zod.core.$strip>;
+export declare const provider: AccessProvider;
+export declare function apply(ctx: Context): void;

package/lib/index.js

@@ -0,0 +1,61 @@
+/**
+ * Ops access provider for Prometheus.
+ *
+ * Validates `prometheus` registry entries (`{ url, token? }`). The URL is
+ * plain connection metadata and may surface in tool output; `token` is a
+ * fileField — the admin UI / register_access accept token CONTENT, core
+ * writes it to a managed file under ~/.dsh-ops/credentials/ and stores the
+ * path, so the token itself never sits in the registry, logs, or model
+ * context. The provider expands ~ in the token path for the tool's read.
+ *
+ * No capability probe: the Prometheus HTTP API is read-only by nature
+ * (query/query_range), so there is no ro/rw distinction to verify — both
+ * tiers serve the same connection parameters.
+ *
+ * @module @elinpf/dsh-ops-access-prometheus
+ */
+import z from '@deepseek-ai/schemastery';
+import { z as zod } from 'zod';
+import { expandHome, registerAccessProvider } from '@elinpf/dsh-ops-access';
+// ── Plugin identity ───────────────────────────────────────────────────────────
+export const name = 'ops-access-prometheus';
+export const inject = [];
+export const Config = z.object({});
+// ── Provider ─────────────────────────────────────────────────────────────────
+/** Zod schema for one prometheus registry entry (excluding name and envelope fields). */
+export const entrySchema = zod.object({
+    url: zod.url({ protocol: /^https?$/, error: 'url must be a valid http(s) URL (e.g. http://prometheus.monitoring:9090)' }),
+    token: zod.string().optional(),
+});
+export const provider = {
+    kind: 'prometheus',
+    schema: entrySchema,
+    fieldsDoc: 'url: base URL of the Prometheus server (http(s)); token: optional bearer-token content (paste the token — it is stored as a managed file, the registry keeps only the path)',
+    fileFields: ['token'],
+    knownLimits: 'Prometheus HTTP API is read-only by nature (query/query_range); this profile carries no k8s permissions — pair it with the k8s profile of the same cluster',
+    process(entry) {
+        const { url, token } = entry;
+        // Strip trailing slashes so the tool can append /api/v1/... cleanly.
+        const fields = { url: url.replace(/\/+$/, '') };
+        if (token !== undefined)
+            fields.token = expandHome(token);
+        return fields;
+    },
+    // A pasted token must be a single line: it lands in an Authorization
+    // header, where an interior newline is an invalid-character failure at
+    // request time. Same discipline as the ssh password field.
+    normalizeTrailingNewline: true,
+    validateContent(field, content) {
+        if (field !== 'token')
+            return null;
+        const body = content.endsWith('\n') ? content.slice(0, -1) : content;
+        if (body.includes('\n') || body.includes('\r')) {
+            return 'a bearer token must be a single line — it is sent verbatim in the Authorization header';
+        }
+        return null;
+    },
+};
+// ── Plugin apply ─────────────────────────────────────────────────────────────
+export function apply(ctx) {
+    registerAccessProvider(ctx, provider);
+}

package/lib/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Invariant companion for @elinpf/dsh-ops-access-prometheus.
+ *
+ * @module @elinpf/dsh-ops-access-prometheus/invariant
+ */
+/** Cordis companion plugin name. */
+declare const name = "ops-access-prometheus-invariant";
+/** Service required before the companion can reserve package ownership. */
+declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Context carrying the invariant service.
+ * @returns a promise resolving after registration.
+ */
+declare const apply: (ctx: any) => Promise<void>;
+export { apply, inject, name };

package/lib/invariant.js

@@ -0,0 +1,25 @@
+/**
+ * Invariant companion for @elinpf/dsh-ops-access-prometheus.
+ *
+ * @module @elinpf/dsh-ops-access-prometheus/invariant
+ */
+const PACKAGE_NAME = '@elinpf/dsh-ops-access-prometheus';
+/** Cordis companion plugin name. */
+const name = 'ops-access-prometheus-invariant';
+/** Service required before the companion can reserve package ownership. */
+const inject = ['invariants'];
+/**
+ * No runtime invariant: this provider owns no session events and no durable
+ * shape of its own — it only validates and processes registry fields owned
+ * by ops-access core. Content validation is a pure paste guard.
+ */
+const install = () => { };
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Context carrying the invariant service.
+ * @returns a promise resolving after registration.
+ */
+const apply = async (ctx) => {
+    ctx.invariants.register(PACKAGE_NAME, install);
+};
+export { apply, inject, name };

package/lib/types.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Type definitions for the ops-access-prometheus provider plugin.
+ *
+ * Types only — no runtime code lives here. Provider values (schema, plugin
+ * apply) stay in index.ts.
+ *
+ * @module @elinpf/dsh-ops-access-prometheus
+ */
+/** One prometheus registry entry (excluding the registry key and envelope fields). */
+export interface PrometheusEntry {
+    /** Base URL of the Prometheus server, http(s) only (e.g. https://prometheus.monitoring:9090). */
+    url: string;
+    /**
+     * Path to a file holding the bearer token (optional). Declared in
+     * fileFields: the admin UI / register_access accept token CONTENT, core
+     * writes it to a managed 0600 file and stores the path. The tool reads the
+     * file per call; the token itself never sits in the registry.
+     */
+    token?: string;
+}

package/lib/types.js

@@ -0,0 +1,9 @@
+/**
+ * Type definitions for the ops-access-prometheus provider plugin.
+ *
+ * Types only — no runtime code lives here. Provider values (schema, plugin
+ * apply) stay in index.ts.
+ *
+ * @module @elinpf/dsh-ops-access-prometheus
+ */
+export {};

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@elinpf/dsh-ops-access-prometheus",
+  "version": "0.2.0",
+  "description": "Ops access provider for Prometheus — validates prometheus registry entries (server URL + optional bearer-token file) and expands the token path.",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./types": {
+      "types": "./lib/types.d.ts",
+      "default": "./lib/types.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types.js",
+    "lib/**/*.d.ts",
+    "cordis.patch.yml"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.8",
+    "@elinpf/dsh-ops-access": "^0.2.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "typescript": "^5.4.0",
+    "vitest": "^4.1.11",
+    "@types/node": "^22.0.0",
+    "@elinpf/dsh-ops-access": "0.2.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}