@exagone313/dsh-podman 0.2.0-rc.2

package/dist/settings-workspaces.test.js

@@ -0,0 +1,265 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import { test } from "node:test";
+import { strict as assert } from "node:assert";
+import { baseValue, fakeContext, fakeScope } from "./card-test-support.js";
+import { installCardCommandDriver } from "./card-test-support.js";
+import { WORKSPACE_ID } from "./test-support.js";
+test("refresh on install publishes containers, images and workspaces", async () => {
+    const scope = fakeScope(baseValue());
+    const calls = [];
+    const resolver = {
+        getConfig: () => ({
+            defaultImage: "archlinux",
+            socketsRoot: "/run/dsh-podman",
+            projectsRoot: "/projects",
+        }),
+        setConfig: () => { },
+        async control(method, request) {
+            calls.push([method, request]);
+            if (method === "listContainers") {
+                return { containers: [{ containerName: "c1", workspaceSlug: "w1" }] };
+            }
+            if (method === "listImages") {
+                return { images: [{ imageId: "img1" }] };
+            }
+            if (method === "listWorkspaces") {
+                return { workspaces: [{ workspaceSlug: "w1", mounts: [{ projectName: "team/app" }] }] };
+            }
+            if (method === "listVolumes") {
+                return { volumes: [{ name: "data" }, { name: "cache" }] };
+            }
+            if (method === "listSecrets") {
+                return { secrets: [{ name: "db-pass" }, { name: "api-key" }] };
+            }
+            return {};
+        },
+    };
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({}); // settle the queued async refresh
+    assert.deepEqual(calls.map(([method]) => method), ["listContainers", "listImages", "listWorkspaces", "listVolumes", "listSecrets", "listCaches"]);
+    assert.equal(scope.value.containers.length, 1);
+    assert.equal(scope.value.images.length, 1);
+    const workspaces = scope.value.workspaces;
+    assert.equal(workspaces.length, 1);
+    assert.equal(workspaces[0].workspaceSlug, "w1");
+    assert.equal(workspaces[0].projectName, "team/app");
+    assert.deepEqual(scope.value.volumes, [{ name: "data" }, { name: "cache" }]);
+    assert.deepEqual(scope.value.secrets, [{ name: "db-pass" }, { name: "api-key" }]);
+});
+test("handle never writes projectsRoot into setConfig", async () => {
+    const scope = fakeScope(baseValue());
+    const setConfigCalls = [];
+    const resolver = {
+        getConfig: () => ({}),
+        setConfig: (patch) => setConfigCalls.push(patch),
+        async control(method) {
+            if (method === "listContainers")
+                return { containers: [] };
+            if (method === "listImages")
+                return { images: [] };
+            if (method === "listWorkspaces")
+                return { workspaces: [] };
+            return {};
+        },
+    };
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({});
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.ok(setConfigCalls.length > 0, "handle must write resolver config");
+    for (const patch of setConfigCalls) {
+        assert.ok(!Object.prototype.hasOwnProperty.call(patch, "projectsRoot"), "projectsRoot must not be written via setConfig");
+    }
+});
+test("settings seed the image and sockets root from the resolver config", async () => {
+    let registeredBase;
+    const scope = fakeScope(baseValue());
+    const context = {
+        inject(deps, callback) {
+            assert.deepEqual(deps, ["settings"]);
+            callback({
+                settings: {
+                    register(_namespace, _schema, options) {
+                        registeredBase = options?.base ?? {};
+                        return scope;
+                    },
+                },
+            });
+        },
+    };
+    const resolver = {
+        getConfig: () => ({
+            defaultImage: "archlinux",
+            socketsRoot: "/run/dsh-podman",
+            projectsRoot: "/projects",
+        }),
+        setConfig: () => { },
+        async control() {
+            return {};
+        },
+    };
+    await installCardCommandDriver(context, resolver);
+    assert.equal(registeredBase?.defaultImage, "archlinux");
+    assert.equal(registeredBase?.socketsRoot, "/run/dsh-podman");
+});
+test("create command drives createWorkspace with env", async () => {
+    const scope = fakeScope(baseValue());
+    const calls = [];
+    const resolver = {
+        getConfig: () => ({}),
+        setConfig: () => { },
+        async control(method, request) {
+            calls.push([method, request]);
+            if (method === "listContainers")
+                return { containers: [] };
+            if (method === "listImages")
+                return { images: [] };
+            if (method === "listWorkspaces")
+                return { workspaces: [] };
+            return {};
+        },
+    };
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({
+        command: {
+            op: "create",
+            workspace: "w1",
+            projectName: "w1",
+            image: "img1",
+            at: 13,
+            mounts: [],
+            env: { A: "1", B: "2" },
+            container: "",
+            secretEnvMap: {},
+            mount: null,
+        },
+    });
+    await new Promise((resolve) => setImmediate(resolve));
+    const createCall = calls.find(([method]) => method === "createWorkspace");
+    assert.deepEqual(createCall?.[1], {
+        workspaceSlug: "w1",
+        projectName: "w1",
+        imageId: "img1",
+        env: { A: "1", B: "2" },
+    });
+    assert.equal(scope.value.command, null);
+});
+test("create command drives createWorkspace without env when empty", async () => {
+    const scope = fakeScope(baseValue());
+    const calls = [];
+    const resolver = {
+        getConfig: () => ({}),
+        setConfig: () => { },
+        async control(method, request) {
+            calls.push([method, request]);
+            if (method === "listContainers")
+                return { containers: [] };
+            if (method === "listImages")
+                return { images: [] };
+            if (method === "listWorkspaces")
+                return { workspaces: [] };
+            return {};
+        },
+    };
+    await installCardCommandDriver(fakeContext(scope), resolver);
+    await scope.update({
+        command: {
+            op: "create",
+            workspace: "w1",
+            projectName: "w1",
+            image: "img1",
+            at: 14,
+            mounts: [],
+            env: {},
+            container: "",
+            secretEnvMap: {},
+            mount: null,
+        },
+    });
+    await new Promise((resolve) => setImmediate(resolve));
+    const createCall = calls.find(([method]) => method === "createWorkspace");
+    assert.deepEqual(createCall?.[1], {
+        workspaceSlug: "w1",
+        projectName: "w1",
+        imageId: "img1",
+    });
+    assert.equal(scope.value.command, null);
+});
+test("workspace list comes from the dsh registry even without orchestrator state", async () => {
+    const scope = fakeScope(baseValue());
+    const registry = {
+        list: () => [
+            { id: WORKSPACE_ID, path: "/projects/team/app", title: "app", createdAt: "2026-01-01T00:00:00Z" },
+        ],
+    };
+    const resolver = {
+        getConfig: () => ({
+            defaultImage: "archlinux",
+            socketsRoot: "/run/dsh-podman",
+            projectsRoot: "/projects",
+        }),
+        setConfig: () => { },
+        async control(method) {
+            if (method === "listContainers")
+                return { containers: [] };
+            if (method === "listImages")
+                return { images: [] };
+            if (method === "listWorkspaces")
+                return { workspaces: [] };
+            return {};
+        },
+    };
+    await installCardCommandDriver(fakeContext(scope), resolver, registry);
+    await scope.update({});
+    const workspaces = scope.value.workspaces;
+    assert.equal(workspaces.length, 1);
+    assert.equal(workspaces[0].projectName, "team/app");
+    assert.equal(workspaces[0].containerName, "");
+    assert.deepEqual(workspaces[0].mounts, [
+        { projectName: "team/app", mode: "MOUNT_MODE_READ_WRITE" },
+    ]);
+    assert.ok(workspaces[0].workspaceSlug.length > 0);
+});
+test("dsh workspace layers orchestrator container info", async () => {
+    const scope = fakeScope(baseValue());
+    const registry = {
+        list: () => [
+            { id: WORKSPACE_ID, path: "/projects/team/app", title: "app", createdAt: "2026-01-01T00:00:00Z" },
+        ],
+    };
+    const resolver = {
+        getConfig: () => ({
+            defaultImage: "archlinux",
+            socketsRoot: "/run/dsh-podman",
+            projectsRoot: "/projects",
+        }),
+        setConfig: () => { },
+        async control(method) {
+            if (method === "listContainers")
+                return { containers: [] };
+            if (method === "listImages")
+                return { images: [] };
+            if (method === "listWorkspaces") {
+                return {
+                    workspaces: [{
+                            workspaceSlug: WORKSPACE_ID,
+                            containerName: `dsh-podman-${WORKSPACE_ID}-default`,
+                            imageId: "arch",
+                            status: "running",
+                            mounts: [{ projectName: "team/app", mode: "MOUNT_MODE_READ_WRITE" }],
+                        }],
+                };
+            }
+            return {};
+        },
+    };
+    await installCardCommandDriver(fakeContext(scope), resolver, registry);
+    await scope.update({});
+    const workspaces = scope.value.workspaces;
+    assert.equal(workspaces.length, 1);
+    assert.equal(workspaces[0].projectName, "team/app");
+    assert.equal(workspaces[0].containerName, `dsh-podman-${WORKSPACE_ID}-default`);
+    assert.equal(workspaces[0].status, "running");
+    assert.equal(workspaces[0].imageId, "arch");
+});

package/dist/spill-store.d.ts

@@ -0,0 +1,17 @@
+import type { WorkspaceResolver } from "./workspace-binding.js";
+export interface SpillRequest {
+    owner: {
+        sessionId: string;
+    };
+    source: unknown;
+    suggestedName: string;
+    content: string;
+}
+export interface SpillRef {
+    locator: string;
+    bytes: number;
+    retrievalHint: string;
+}
+export declare function createSpillStore(ctx: any, resolver: WorkspaceResolver): {
+    saveText(input: SpillRequest): Promise<SpillRef>;
+};

package/dist/spill-store.js

@@ -0,0 +1,54 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import { randomUUID } from "node:crypto";
+import { unaryGuest, writeGuestFile } from "./guest-rpc.js";
+import { SPILL_ROOT } from "./output-reader.js";
+// Tool-result spills live in a subdirectory of the guest's scratch root so they
+// never collide with the command-output spills the guest writes directly there.
+const TOOL_SPILL_ROOT = `${SPILL_ROOT}/spill`;
+// spillName turns a caller-suggested base name into one safe, collision-free
+// path segment. The suggestion is a hint, never a path.
+function spillName(suggestedName) {
+    const safe = String(suggestedName ?? "")
+        .replace(/[^A-Za-z0-9._-]/g, "_")
+        .replace(/\.{2,}/g, "_")
+        .replace(/^[.-]+/, "")
+        .slice(0, 64);
+    return `${randomUUID().replace(/-/g, "")}-${safe === "" ? "spill.txt" : safe}`;
+}
+// sessionSegment is the per-session directory name: session ids are UUIDs, but
+// a backend must never trust a caller-supplied segment in a path.
+function sessionSegment(sessionId) {
+    return sessionId.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+// createSpillStore backs `ctx.spillStore` with the session's container:
+// oversized tool results are written inside the guest, and the locator is the
+// container path, so the agent reads them back with `container_read` /
+// `container_grep` (the host filesystem is not reachable from a container).
+export function createSpillStore(ctx, resolver) {
+    return {
+        async saveText(input) {
+            const sessionId = String(input?.owner?.sessionId ?? "");
+            const session = ctx.get("sessions")?.get?.(sessionId);
+            const cwd = session?.header?.cwd;
+            if (typeof cwd !== "string" || cwd === "") {
+                throw new Error(`cannot spill a result for session "${sessionId}": no session working directory`);
+            }
+            const binding = await resolver.resolve(cwd);
+            const directory = `${TOOL_SPILL_ROOT}/${sessionSegment(sessionId)}`;
+            await unaryGuest({ targetKey: directory, displayPath: directory, binding }, "mkdir", { path: directory, parents: true });
+            const path = `${directory}/${spillName(input.suggestedName)}`;
+            const content = String(input.content ?? "");
+            await writeGuestFile(binding, path, content, {
+                create: true,
+                truncate: true,
+            });
+            return {
+                locator: path,
+                bytes: Buffer.byteLength(content, "utf8"),
+                retrievalHint: "Use container_read with offset/limit, or container_grep this path to search within it.",
+            };
+        },
+    };
+}

package/dist/spill-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/spill-store.test.js

@@ -0,0 +1,59 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createSpillStore } from "./spill-store.js";
+import { guestFileRecorder } from "./test-support.js";
+const SESSION_ID = "2c573001-4171-4900-904b-12a5cc02737a";
+function fakeCtx(sessions) {
+    return {
+        get: (name) => name === "sessions"
+            ? { get: (id) => sessions[id] }
+            : undefined,
+    };
+}
+function withSession() {
+    return fakeCtx({ [SESSION_ID]: { header: { cwd: "/projects/team" } } });
+}
+test("saveText writes a tool-result spill inside the session container", async () => {
+    const { writes, mkdirs, resolver } = guestFileRecorder();
+    const store = createSpillStore(withSession(), resolver);
+    const content = "x".repeat(60000);
+    const ref = await store.saveText({
+        owner: { sessionId: SESSION_ID },
+        source: { kind: "tool", toolName: "web_fetch", callId: "c1", label: "result" },
+        suggestedName: "web_fetch.txt",
+        content,
+    });
+    assert.equal(mkdirs[0], `/tmp/dsh-podman/spill/${SESSION_ID}`);
+    assert.equal(writes.length, 1);
+    assert.match(writes[0].path, new RegExp(`^/tmp/dsh-podman/spill/${SESSION_ID}/[0-9a-f]{32}-web_fetch\\.txt$`));
+    assert.equal(ref.locator, writes[0].path);
+    assert.equal(ref.bytes, content.length);
+    assert.equal(writes[0].content, content, "the full text is persisted verbatim");
+    assert.match(ref.retrievalHint, /container_read/);
+});
+test("saveText never lets the suggested name escape the spill directory", async () => {
+    const { writes, resolver } = guestFileRecorder();
+    const store = createSpillStore(withSession(), resolver);
+    const ref = await store.saveText({
+        owner: { sessionId: SESSION_ID },
+        source: {},
+        suggestedName: "../../etc/passwd",
+        content: "x",
+    });
+    assert.ok(ref.locator.startsWith(`/tmp/dsh-podman/spill/${SESSION_ID}/`));
+    assert.ok(!ref.locator.includes(".."));
+    assert.equal(writes.length, 1);
+});
+test("saveText rejects when the session has no working directory", async () => {
+    const { resolver } = guestFileRecorder();
+    const store = createSpillStore(fakeCtx({}), resolver);
+    await assert.rejects(() => store.saveText({
+        owner: { sessionId: SESSION_ID },
+        source: {},
+        suggestedName: "a.txt",
+        content: "x",
+    }), /no session working directory/);
+});

package/dist/subprocess.d.ts

@@ -0,0 +1,9 @@
+import { type WorkspaceResolver } from "./workspace-binding.js";
+export interface SubprocessProvider {
+    resolveExecutable(command: string): Promise<string>;
+    spawn(spec: any): any;
+    spawnTerminal(spec: any): Promise<any>;
+    dispose(): void;
+}
+export declare function createSubprocessProvider(resolver: WorkspaceResolver): SubprocessProvider;
+export { OutputReader, outputReader } from "./output-reader.js";