@exagone313/dsh-podman 0.2.0-rc.3 → 0.2.0

package/README.md

@@ -9,6 +9,7 @@ SPDX-License-Identifier: MIT
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![npm version](https://img.shields.io/npm/v/@exagone313/dsh-podman)](https://www.npmjs.com/package/@exagone313/dsh-podman)
 [![GitHub release](https://img.shields.io/github/v/release/Exagone313/dsh-podman)](https://github.com/Exagone313/dsh-podman/releases)
+[![dsh](https://img.shields.io/badge/dsh-GHCR-blue)](https://github.com/Exagone313/dsh-podman/pkgs/container/dsh-podman%2Fdsh)
 [![orchestrator](https://img.shields.io/badge/orchestrator-GHCR-blue)](https://github.com/Exagone313/dsh-podman/pkgs/container/dsh-podman%2Forchestrator)
 [![guest-agent](https://img.shields.io/badge/guest--agent-GHCR-blue)](https://github.com/Exagone313/dsh-podman/pkgs/container/dsh-podman%2Fguest-agent)
 
@@ -20,21 +21,32 @@ English | [中文](README.zh.md)
 dsh-podman routes all shell execution and file access through disposable and
 per-project Podman containers.
 
+## Features
+
+- Disposable, per-project containers
+- Additional containers per workspace
+- Create container images based on Arch Linux, Ubuntu and Alpine Linux
+- Approval-aware escalation
+- Run processes in containers (daemons)
+- Run a terminal in containers
+
 ## Documentation
 
 - **[Install DeepSeek Harness & dsh-podman with rootless Podman](docs/install-dsh-and-dsh-podman.md)**
+- [Update](docs/update.md)
 - [Architecture](docs/architecture.md)
 - [Configuration](docs/configuration.md)
 - [Usage](docs/usage.md)
 - [Development](docs/development.md)
+- [Uninstall](docs/uninstall.md)
 
 ## AI-usage disclosure
 
 This repository was written in major parts using AI models:
 
+- DeepSeek Flash
 - early commits using OpenAI GPT-5.6 Luna
-- DeepSeek V4 Flash
-- source code weakness fixes by Anthropic Claude Opus 5
+- a few fixes using Anthropic Claude Opus 5
 
 ## License
 

package/README.zh.md

@@ -9,6 +9,7 @@ SPDX-License-Identifier: MIT
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![npm version](https://img.shields.io/npm/v/@exagone313/dsh-podman)](https://www.npmjs.com/package/@exagone313/dsh-podman)
 [![GitHub release](https://img.shields.io/github/v/release/Exagone313/dsh-podman)](https://github.com/Exagone313/dsh-podman/releases)
+[![dsh](https://img.shields.io/badge/dsh-GHCR-blue)](https://github.com/Exagone313/dsh-podman/pkgs/container/dsh-podman%2Fdsh)
 [![orchestrator](https://img.shields.io/badge/orchestrator-GHCR-blue)](https://github.com/Exagone313/dsh-podman/pkgs/container/dsh-podman%2Forchestrator)
 [![guest-agent](https://img.shields.io/badge/guest--agent-GHCR-blue)](https://github.com/Exagone313/dsh-podman/pkgs/container/dsh-podman%2Fguest-agent)
 
@@ -20,21 +21,32 @@ SPDX-License-Identifier: MIT
 dsh-podman 将所有的 shell 执行与文件访问都路由到一次性、按项目隔离的 Podman
 容器中。
 
+## 特性
+
+- 一次性、按项目隔离的容器
+- 每个工作区可添加额外的容器
+- 创建基于 Arch Linux、Ubuntu 和 Alpine Linux 的容器镜像
+- 感知审批的权限提升
+- 在容器中运行进程（守护进程）
+- 在容器中运行终端
+
 ## 文档
 
 - **[使用 rootless Podman 安装 DeepSeek Harness 与 dsh-podman](docs/install-dsh-and-dsh-podman.zh.md)**
+- [更新](docs/update.zh.md)
 - [架构](docs/architecture.zh.md)
 - [配置](docs/configuration.zh.md)
 - [使用](docs/usage.zh.md)
 - [开发](docs/development.zh.md)
+- [卸载](docs/uninstall.zh.md)
 
 ## AI 使用声明
 
 本仓库的大部分代码由 AI 模型编写：
 
+- DeepSeek Flash
 - 早期提交使用 OpenAI GPT-5.6 Luna
-- DeepSeek V4 Flash
-- 源代码弱点修复由 Anthropic Claude Opus 5 完成
+- 少量修复由 Anthropic Claude Opus 5 完成
 
 ## 许可证
 

package/cordis.patch.yml

@@ -12,6 +12,64 @@
   disabled: true
 - id: spill-local
   disabled: true
+# disable built-in terminal.
+- id: ui-sidebar-terminal
+  disabled: true
 - insert:
     - id: podman
       name: '@exagone313/dsh-podman'
+    # The "Podman operator mode" agent preset, declared as a row so the
+    # preset registry serves it. Its id is the approval policy's preset key
+    # (PODMAN_OPS_PRESET in src/approval.ts), and the composition below is the
+    # agent's plugin set.
+    - id: preset-podman-ops
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: podman-ops
+        name: Podman operator mode
+        description: >-
+          Podman-focused container operations — manage images, containers,
+          volumes, mounts, secrets, and daemons. Inspections and lifecycle run
+          directly; commands, container file edits, daemon starts, and secret
+          changes ask for approval; supports web research.
+        order: 2
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              suffix: Your working directory is {{cwd}}.
+              prefix: >-
+                You are a Podman container-operations agent powered by the {{model}} model.
+
+                You manage container infrastructure through the dsh-podman tools: images
+                (image_list, image_get, image_build, image_rebuild, image_rebuild_all,
+                image_remove), containers (container_list, container_start,
+                container_recreate, container_remove), mounts (container_mount_list,
+                container_mount_add, container_mount_remove, container_mount_update),
+                PATH additions (container_path_set, container_path_add,
+                container_path_remove), volumes (volume_list,
+                volume_create, volume_remove), secrets (secret_list, secret_create,
+                secret_remove, container_secret_add, container_secret_remove), daemons
+                (daemon_list, daemon_start, daemon_stop, daemon_restart, daemon_logs),
+                and container inspection (container_read, container_glob,
+                container_grep).
+
+                Inspection and lifecycle operations run directly. Running commands inside
+                a container (container_bash, container_exec), editing container files
+                (container_write, container_edit), starting daemons (daemon_start),
+                exposing or removing secret environment variables (container_secret_add,
+                container_secret_remove), removing secrets (secret_remove), and
+                rebuilding all images (image_rebuild_all) require the user's approval.
+                Use web_search to research images and documentation. Use
+                ask_user_question for user decisions and todo_write to track work.
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: true
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: false
+              searchTimeoutMs: 60000

package/dist/approval-reasons.d.ts

@@ -24,6 +24,7 @@ export type ReasonFact = {
     image?: string;
     mounts?: readonly MountFact[];
     env?: readonly string[];
+    secretEnv?: readonly string[];
     paths?: readonly string[];
 } | {
     kind: "container_remove";
@@ -119,11 +120,9 @@ export type DenialFact = {
     source?: string;
     mirror?: string;
 };
-export interface SettingsReader {
-    get(ns: string): unknown;
-}
-export declare function resolveReasonLocale(settings: SettingsReader | undefined): ReasonLocale;
+export declare function resolveReasonLocale(value: unknown): ReasonLocale;
 export declare function reasonLocale(value: unknown): ReasonLocale;
 export declare function renderReason(locale: ReasonLocale, fact: ReasonFact): string;
 export declare function renderCacheCleanNotice(locale: ReasonLocale, files: number): string;
+export declare function renderDefaultEnvSyncNotice(locale: ReasonLocale, applied: number, skipped: number): string;
 export declare function renderDenial(locale: ReasonLocale, fact: DenialFact): string;

package/dist/approval-reasons.js

@@ -1,20 +1,11 @@
 // SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
 //
 // SPDX-License-Identifier: MIT
-import { CONTAINER_NS } from "./settings-schema.js";
-// Settings namespace owned by the browser locale plugin; only read here.
-const LOCALE_NS = "locale";
-const LOCALE_PREFERENCE_FIELD = "preference";
-// The locale to render approval text in: the client-observed active locale
-// first (it also captures the browser default), then the durable user
-// preference, then English.
-export function resolveReasonLocale(settings) {
-    if (settings === undefined)
-        return "en";
-    const observed = field(settings.get(CONTAINER_NS), "uiLocale");
-    if (typeof observed === "string" && observed !== "")
-        return reasonLocale(observed);
-    return reasonLocale(field(settings.get(LOCALE_NS), LOCALE_PREFERENCE_FIELD));
+// The locale to render approval text in, from the plugin's own volatile
+// `uiLocale` preference (the browser client writes it); an unset value renders
+// in English.
+export function resolveReasonLocale(value) {
+    return reasonLocale(value);
 }
 // Normalize a BCP 47-style locale id to a shipped language; `zh-Hans`, `zh_CN`
 // and friends all map to `zh`, everything else to English.
@@ -24,11 +15,6 @@ export function reasonLocale(value) {
     const primary = value.toLowerCase().split(/[-_]/, 1)[0];
     return primary === "zh" ? "zh" : "en";
 }
-function field(value, key) {
-    return typeof value === "object" && value !== null
-        ? value[key]
-        : undefined;
-}
 // Pick the locale's variant of one string.
 function pick(locale, en, zh) {
     return locale === "zh" ? zh : en;
@@ -68,9 +54,7 @@ function mountLabel(locale, mount) {
 // undefined when it has none. The caller supplies the surrounding punctuation,
 // since the locales wrap it differently.
 function mountDestinationText(locale, mount) {
-    return mount.destination === undefined
-        ? undefined
-        : pick(locale, `at ${quoted(locale, mount.destination)}`, `挂载到 ${quoted(locale, mount.destination)}`);
+    return mount.destination === undefined ? undefined : pick(locale, `at ${quoted(locale, mount.destination)}`, `挂载到 ${quoted(locale, mount.destination)}`);
 }
 // Render a mount's source and destination: `volume "data" at "/data"`.
 function mountSourceText(locale, mount) {
@@ -94,7 +78,9 @@ function mountModeName(locale, mount) {
 // Render one mount as `volume "data" at "/data" (read-only)`.
 function mountText(locale, mount) {
     const mode = mountModeName(locale, mount);
-    const suffix = mode === undefined ? "" : pick(locale, ` (${mode})`, `（${mode}）`);
+    const suffix = mode === undefined
+        ? ""
+        : pick(locale, ` (${mode})`, `（${mode}）`);
     return `${mountSourceText(locale, mount)}${suffix}`;
 }
 // Render a command word list, capped at 8 words with an ellipsis tail.
@@ -114,26 +100,25 @@ function identityText(locale, fact) {
     if (fact.groups !== undefined && fact.groups.length > 0) {
         ids.push(`groups ${joinList(locale, fact.groups.map((group) => String(group)))}`);
     }
-    return ids.length === 0 ? "" : pick(locale, ` (${ids.join(", ")})`, `（${ids.join("、")}）`);
+    return ids.length === 0
+        ? ""
+        : pick(locale, ` (${ids.join(", ")})`, `（${ids.join("、")}）`);
 }
 // Start/recreate share one shape; only the verb differs.
 function containerRun(locale, fact) {
-    const image = fact.image === undefined
-        ? ""
-        : pick(locale, ` from image ${quoted(locale, fact.image)}`, `（镜像 ${quoted(locale, fact.image)}）`);
+    const image = fact.image === undefined ? "" : pick(locale, ` from image ${quoted(locale, fact.image)}`, `（镜像 ${quoted(locale, fact.image)}）`);
     const mounts = fact.mounts === undefined || fact.mounts.length === 0
         ? ""
         : pick(locale, ` with mounts: ${joinList(locale, fact.mounts.map((mount) => mountText(locale, mount)))}`, `，挂载：${joinList(locale, fact.mounts.map((mount) => mountText(locale, mount)))}`);
-    const env = fact.env === undefined || fact.env.length === 0
-        ? ""
-        : pick(locale, ` with env: ${joinList(locale, fact.env)}`, `，环境变量：${joinList(locale, fact.env)}`);
-    const paths = fact.paths === undefined || fact.paths.length === 0
+    const env = fact.env === undefined || fact.env.length === 0 ? "" : pick(locale, ` with env: ${joinList(locale, fact.env)}`, `，环境变量：${joinList(locale, fact.env)}`);
+    const secretEnv = fact.secretEnv === undefined || fact.secretEnv.length === 0
         ? ""
-        : pick(locale, ` with PATH additions: ${joinList(locale, fact.paths.map((path) => quoted(locale, path)))}`, `，PATH 附加项：${joinList(locale, fact.paths.map((path) => quoted(locale, path)))}`);
+        : pick(locale, ` with secret env: ${joinList(locale, fact.secretEnv)}`, `，机密环境变量：${joinList(locale, fact.secretEnv)}`);
+    const paths = fact.paths === undefined || fact.paths.length === 0 ? "" : pick(locale, ` with PATH additions: ${joinList(locale, fact.paths.map((path) => quoted(locale, path)))}`, `，PATH 附加项：${joinList(locale, fact.paths.map((path) => quoted(locale, path)))}`);
     const verb = fact.kind === "container_start"
         ? pick(locale, "Start", "启动")
         : pick(locale, "Recreate", "重建");
-    return pick(locale, `${verb} container ${quoted(locale, fact.container)}${image}${mounts}${env}${paths}.`, `${verb}容器 ${quoted(locale, fact.container)}${image}${mounts}${env}${paths}。`);
+    return pick(locale, `${verb} container ${quoted(locale, fact.container)}${image}${mounts}${env}${secretEnv}${paths}.`, `${verb}容器 ${quoted(locale, fact.container)}${image}${mounts}${env}${secretEnv}${paths}。`);
 }
 // Render one reason as the single-line headline shown in the approval prompt.
 // Reasons that end in a raw command keep no trailing period, so the command
@@ -141,12 +126,8 @@ function containerRun(locale, fact) {
 export function renderReason(locale, fact) {
     switch (fact.kind) {
         case "image_build": {
-            const parent = fact.parent === undefined
-                ? ""
-                : pick(locale, ` from ${quoted(locale, fact.parent)}`, `（基于 ${quoted(locale, fact.parent)}）`);
-            const packages = fact.packages === undefined
-                ? ""
-                : pick(locale, ` with packages: ${joinList(locale, fact.packages)}`, `，软件包：${joinList(locale, fact.packages)}`);
+            const parent = fact.parent === undefined ? "" : pick(locale, ` from ${quoted(locale, fact.parent)}`, `（基于 ${quoted(locale, fact.parent)}）`);
+            const packages = fact.packages === undefined ? "" : pick(locale, ` with packages: ${joinList(locale, fact.packages)}`, `，软件包：${joinList(locale, fact.packages)}`);
             return pick(locale, `Build image ${quoted(locale, fact.image)}${parent}${packages}.`, `构建镜像 ${quoted(locale, fact.image)}${parent}${packages}。`);
         }
         case "image_rebuild":
@@ -188,9 +169,7 @@ export function renderReason(locale, fact) {
             const remount = fact.remount
                 .map((mount) => `- ${mountText(locale, mount)}`)
                 .join("\n");
-            const keep = fact.keep.length === 0
-                ? ""
-                : pick(locale, `\n\nKept as-is: ${joinList(locale, fact.keep.map((mount) => mountText(locale, mount)))}.`, `\n\n保持不变：${joinList(locale, fact.keep.map((mount) => mountText(locale, mount)))}。`);
+            const keep = fact.keep.length === 0 ? "" : pick(locale, `\n\nKept as-is: ${joinList(locale, fact.keep.map((mount) => mountText(locale, mount)))}.`, `\n\n保持不变：${joinList(locale, fact.keep.map((mount) => mountText(locale, mount)))}。`);
             return pick(locale, `Read-only mode blocks ${quoted(locale, fact.tool)} while a mount is read-write. Remount these mounts read-only to run it:\n\n${remount}${keep}`, `只读模式在存在读写挂载时会阻止 ${quoted(locale, fact.tool)}。将这些挂载重新挂载为只读即可运行：\n\n${remount}${keep}`);
         }
         case "volume_remove":
@@ -202,16 +181,12 @@ export function renderReason(locale, fact) {
         case "container_secret_remove":
             return pick(locale, `Detach secret env var ${quoted(locale, fact.env)} from container ${quoted(locale, fact.container)}.`, `从容器 ${quoted(locale, fact.container)} 中移除机密环境变量 ${quoted(locale, fact.env)}。`);
         case "container_bash": {
-            const cwd = fact.cwd === undefined
-                ? ""
-                : pick(locale, ` (cwd ${quoted(locale, fact.cwd)})`, `（工作目录 ${quoted(locale, fact.cwd)}）`);
+            const cwd = fact.cwd === undefined ? "" : pick(locale, ` (cwd ${quoted(locale, fact.cwd)})`, `（工作目录 ${quoted(locale, fact.cwd)}）`);
             const identity = identityText(locale, fact);
             return pick(locale, `Run a shell command in container ${quoted(locale, fact.container)}${cwd}: ${fact.command}${identity}`, `在容器 ${quoted(locale, fact.container)}${cwd} 中运行 shell 命令：${fact.command}${identity}`);
         }
         case "container_exec": {
-            const cwd = fact.cwd === undefined
-                ? ""
-                : pick(locale, ` (cwd ${quoted(locale, fact.cwd)})`, `（工作目录 ${quoted(locale, fact.cwd)}）`);
+            const cwd = fact.cwd === undefined ? "" : pick(locale, ` (cwd ${quoted(locale, fact.cwd)})`, `（工作目录 ${quoted(locale, fact.cwd)}）`);
             const identity = identityText(locale, fact);
             return pick(locale, `Run a command in container ${quoted(locale, fact.container)}${cwd}: ${argvText(fact.argv)}${identity}`, `在容器 ${quoted(locale, fact.container)}${cwd} 中运行命令：${argvText(fact.argv)}${identity}`);
         }
@@ -220,7 +195,9 @@ export function renderReason(locale, fact) {
         case "container_edit":
             return pick(locale, `Edit ${quoted(locale, fact.path)} in container ${quoted(locale, fact.container)}.`, `在容器 ${quoted(locale, fact.container)} 中编辑 ${quoted(locale, fact.path)}。`);
         case "daemon_start": {
-            const named = fact.name === undefined ? "" : ` ${quoted(locale, fact.name)}`;
+            const named = fact.name === undefined
+                ? ""
+                : ` ${quoted(locale, fact.name)}`;
             const suffix = identityText(locale, fact);
             return pick(locale, `Start daemon${named} in container ${quoted(locale, fact.container)}: ${argvText(fact.argv)}${suffix}`, `在容器 ${quoted(locale, fact.container)} 中启动守护进程${named}：${argvText(fact.argv)}${suffix}`);
         }
@@ -231,6 +208,20 @@ export function renderReason(locale, fact) {
 export function renderCacheCleanNotice(locale, files) {
     return pick(locale, `removed ${files} cached ${files === 1 ? "file" : "files"}`, `已移除 ${files} 个缓存文件`);
 }
+// Render the settings notice shown after the default environment was applied
+// to existing containers: how many were recreated, and how many stopped
+// containers were left for their next start.
+export function renderDefaultEnvSyncNotice(locale, applied, skipped) {
+    const containers = (count) => pick(locale, `${count} container${count === 1 ? "" : "s"}`, `${count} 个容器`);
+    if (applied === 0 && skipped === 0) {
+        return pick(locale, "the default environment is already applied to every running container", "默认环境已应用于所有运行中的容器");
+    }
+    if (applied === 0) {
+        return pick(locale, `no running container needed the default environment; ${containers(skipped)} stopped`, `没有运行中的容器需要默认环境；已跳过 ${containers(skipped)}`);
+    }
+    const suffix = skipped === 0 ? "" : pick(locale, `; ${containers(skipped)} stopped, to pick up on their next start`, `；已跳过 ${containers(skipped)}，将在下次启动时生效`);
+    return pick(locale, `applied the default environment to ${containers(applied)}${suffix}`, `已将默认环境应用于 ${containers(applied)}${suffix}`);
+}
 // Render one policy denial.
 export function renderDenial(locale, fact) {
     switch (fact.kind) {

package/dist/approval-reasons.test.js

@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: MIT
 import test from "node:test";
 import assert from "node:assert/strict";
-import { reasonLocale, renderCacheCleanNotice, renderDenial, renderReason, resolveReasonLocale, } from "./approval-reasons.js";
+import { reasonLocale, renderCacheCleanNotice, renderDefaultEnvSyncNotice, renderDenial, renderReason, resolveReasonLocale, } from "./approval-reasons.js";
 import { preExecutePolicy, summarizeArgs } from "./index.js";
 import { testReadSession } from "./test-support.js";
 test("reasonLocale normalizes a locale id to a shipped language", () => {
@@ -16,16 +16,13 @@ test("reasonLocale normalizes a locale id to a shipped language", () => {
     assert.equal(reasonLocale(undefined), "en");
     assert.equal(reasonLocale(42), "en");
 });
-test("resolveReasonLocale prefers the client-observed locale over the preference", () => {
-    const settings = (container, locale) => ({
-        get: (ns) => (ns === "podman" ? container : ns === "locale" ? locale : undefined),
-    });
+test("resolveReasonLocale reads the plugin's recorded locale", () => {
     assert.equal(resolveReasonLocale(undefined), "en");
-    assert.equal(resolveReasonLocale(settings({ uiLocale: "zh" }, { preference: "en" })), "zh");
-    assert.equal(resolveReasonLocale(settings({ uiLocale: "" }, { preference: "zh" })), "zh");
-    assert.equal(resolveReasonLocale(settings({}, { preference: "zh" })), "zh");
-    assert.equal(resolveReasonLocale(settings({ uiLocale: "en" }, { preference: "zh" })), "en");
-    assert.equal(resolveReasonLocale(settings({}, {})), "en");
+    assert.equal(resolveReasonLocale(""), "en");
+    assert.equal(resolveReasonLocale("zh"), "zh");
+    assert.equal(resolveReasonLocale("zh-Hans"), "zh");
+    assert.equal(resolveReasonLocale("en"), "en");
+    assert.equal(resolveReasonLocale(42), "en");
 });
 test("summarizeArgs renders reasons in Chinese when asked", () => {
     assert.equal(summarizeArgs("container_mount_add", {
@@ -57,7 +54,12 @@ test("renderDenial renders both languages", () => {
 test("renderReason covers the remaining reason kinds in both languages", () => {
     assert.equal(renderReason("en", { kind: "image_rebuild_all" }), "Rebuild all images.");
     assert.equal(renderReason("zh", { kind: "image_rebuild_all" }), "重建全部镜像。");
-    assert.equal(renderReason("zh", { kind: "daemon_start", container: "c", argv: ["x"], uid: 1 }), "在容器 “c” 中启动守护进程：x（uid 1）");
+    assert.equal(renderReason("zh", {
+        kind: "daemon_start",
+        container: "c",
+        argv: ["x"],
+        uid: 1,
+    }), "在容器 “c” 中启动守护进程：x（uid 1）");
     assert.equal(renderReason("zh", {
         kind: "container_bash",
         container: "c",
@@ -65,11 +67,21 @@ test("renderReason covers the remaining reason kinds in both languages", () => {
         uid: 1,
         groups: [3, 4],
     }), "在容器 “c” 中运行 shell 命令：id（uid 1、groups 3、4）");
-    assert.equal(renderReason("zh", { kind: "container_secret_add", container: "c", secret: "s", env: "E" }), "将机密 “s” 作为 “E” 注入容器 “c”。");
+    assert.equal(renderReason("zh", {
+        kind: "container_secret_add",
+        container: "c",
+        secret: "s",
+        env: "E",
+    }), "将机密 “s” 作为 “E” 注入容器 “c”。");
     assert.equal(renderReason("zh", {
         kind: "container_mount_update",
         container: "valkey-ctr",
-        mount: { kind: "volume", source: "valkey-data", destination: "/data", readOnly: false },
+        mount: {
+            kind: "volume",
+            source: "valkey-data",
+            destination: "/data",
+            readOnly: false,
+        },
     }), "更新容器 “valkey-ctr” 中的挂载：将卷 “valkey-data”（挂载到 “/data”）重新挂载为读写。");
     assert.equal(renderReason("zh", {
         kind: "container_mount_update",
@@ -88,7 +100,12 @@ test("renderReason renders the read-only remount plan", () => {
         tool: "bash",
         remount: [
             { kind: "project", source: "team", readOnly: false },
-            { kind: "volume", source: "data", destination: "/data", readOnly: false },
+            {
+                kind: "volume",
+                source: "data",
+                destination: "/data",
+                readOnly: false,
+            },
         ],
         keep: [{ kind: "tmpfs", source: "", destination: "/scratch" }],
     }), 'Read-only mode blocks "bash" while a mount is read-write. Remount these mounts read-only to run it:\n\n- project "team" (read-write)\n- volume "data" at "/data" (read-write)\n\nKept as-is: tmpfs at "/scratch".');
@@ -103,8 +120,19 @@ test("renderDenial renders the declined remount", () => {
     assert.equal(renderDenial("en", { kind: "read_only_remount_declined", tool: "bash" }), 'Denied: read-only mode blocks "bash" and the mounts were not remounted.');
     assert.equal(renderDenial("zh", { kind: "read_only_remount_declined", tool: "bash" }), "已拒绝：只读模式阻止 “bash”，且挂载未被重新挂载。");
 });
+test("renderDefaultEnvSyncNotice renders both languages", () => {
+    assert.equal(renderDefaultEnvSyncNotice("en", 2, 0), "applied the default environment to 2 containers");
+    assert.equal(renderDefaultEnvSyncNotice("en", 1, 2), "applied the default environment to 1 container; 2 containers stopped, to pick up on their next start");
+    assert.equal(renderDefaultEnvSyncNotice("en", 0, 1), "no running container needed the default environment; 1 container stopped");
+    assert.equal(renderDefaultEnvSyncNotice("en", 0, 0), "the default environment is already applied to every running container");
+    assert.equal(renderDefaultEnvSyncNotice("zh", 2, 0), "已将默认环境应用于 2 个容器");
+    assert.equal(renderDefaultEnvSyncNotice("zh", 0, 1), "没有运行中的容器需要默认环境；已跳过 1 个容器");
+});
 test("preExecutePolicy renders a localized deny reason", async () => {
-    const denied = (await preExecutePolicy({ name: "container_start", agent: { session: { facts: { mode: "read-only" } } } }, () => Promise.resolve({ kind: "allow" }), undefined, () => "zh", testReadSession));
+    const denied = (await preExecutePolicy({
+        name: "container_start",
+        agent: { session: { facts: { mode: "read-only" } } },
+    }, () => Promise.resolve({ kind: "allow" }), undefined, () => "zh", testReadSession));
     assert.equal(denied.kind, "deny");
     assert.equal(denied.reason, "已拒绝：当前会话为只读，而 “container_start” 需要写入权限。");
 });

package/dist/approval.js

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: MIT
 import { approvalPath, currentCwd } from "./guest-rpc.js";
-import { inferMountKind, projectMountDestinationReason } from "./mount-input.js";
+import { inferMountKind, projectMountDestinationReason, } from "./mount-input.js";
 import { defaultMountMode } from "./mount-enums.js";
 import { TOOLS } from "./tool-schemas.js";
 import { renderDenial, renderReason, } from "./approval-reasons.js";
@@ -38,7 +38,9 @@ function mountFact(mount, readOnly) {
 // Build the locale-independent reason fact for a gated call, or undefined when
 // the arguments carry too little to describe the call.
 export function reasonFact(name, args, sessionCwd) {
-    const str = (key) => typeof args[key] === "string" && args[key] !== "" ? args[key] : undefined;
+    const str = (key) => typeof args[key] === "string" && args[key] !== ""
+        ? args[key]
+        : undefined;
     const listOf = (key) => {
         const value = args[key];
         return Array.isArray(value) && value.length > 0
@@ -62,14 +64,15 @@ export function reasonFact(name, args, sessionCwd) {
             .filter((item) => item !== undefined);
         return items.length === 0 ? undefined : items;
     };
-    const envKeys = () => {
-        const value = args.env;
+    const mapKeys = (key) => {
+        const value = args[key];
         if (typeof value !== "object" || value === null || Array.isArray(value)) {
             return undefined;
         }
         const keys = Object.keys(value);
         return keys.length === 0 ? undefined : keys;
     };
+    const envKeys = () => mapKeys("env");
     const numberListOf = (key) => {
         const value = args[key];
         return Array.isArray(value) && value.length > 0
@@ -120,6 +123,7 @@ export function reasonFact(name, args, sessionCwd) {
             const image = str("image");
             const mounts = mountItems();
             const env = envKeys();
+            const secretEnv = mapKeys("secretEnv");
             const paths = listOf("paths");
             return {
                 kind: name,
@@ -127,20 +131,27 @@ export function reasonFact(name, args, sessionCwd) {
                 ...(image === undefined ? {} : { image }),
                 ...(mounts === undefined ? {} : { mounts }),
                 ...(env === undefined ? {} : { env }),
+                ...(secretEnv === undefined ? {} : { secretEnv }),
                 ...(paths === undefined ? {} : { paths }),
             };
         }
         case "container_remove": {
             const container = str("container");
-            return container === undefined ? undefined : { kind: "container_remove", container };
+            return container === undefined
+                ? undefined
+                : { kind: "container_remove", container };
         }
         case "volume_remove": {
             const volume = str("name");
-            return volume === undefined ? undefined : { kind: "volume_remove", name: volume };
+            return volume === undefined
+                ? undefined
+                : { kind: "volume_remove", name: volume };
         }
         case "secret_remove": {
             const secret = str("name");
-            return secret === undefined ? undefined : { kind: "secret_remove", name: secret };
+            return secret === undefined
+                ? undefined
+                : { kind: "secret_remove", name: secret };
         }
         case "container_secret_add": {
             const container = str("container");
@@ -356,7 +367,9 @@ export async function preExecutePolicy(exec, next, getProjectsRoot, getLocale, r
         };
     }
     const args = exec.arguments;
-    const parsed = typeof args === "object" && args !== null ? args : undefined;
+    const parsed = typeof args === "object" && args !== null
+        ? args
+        : undefined;
     const projectsRoot = getProjectsRoot?.();
     const denyReason = mountDestinationsReason(name, parsed, projectsRoot, locale);
     if (denyReason !== undefined) {
@@ -366,7 +379,10 @@ export async function preExecutePolicy(exec, next, getProjectsRoot, getLocale, r
         return next();
     const sessionCwd = currentCwd(exec);
     if (facts.preset === PODMAN_OPS_PRESET && PODMAN_OPS_APPROVAL_TOOLS.has(name)) {
-        return { kind: "ask", ...askReason(name, parsed ?? {}, sessionCwd, locale) };
+        return {
+            kind: "ask",
+            ...askReason(name, parsed ?? {}, sessionCwd, locale),
+        };
     }
     return approvalDecision(name, parsed, sessionCwd, locale) ?? next();
 }
@@ -377,7 +393,8 @@ export async function preExecutePolicy(exec, next, getProjectsRoot, getLocale, r
 export function mountDestinationsReason(name, args, projectsRoot, locale = "en") {
     if (args === undefined)
         return undefined;
-    if (name === "container_mount_add" || name === "container_mount_remove" || name === "container_mount_update") {
+    if (name === "container_mount_add" || name === "container_mount_remove" ||
+        name === "container_mount_update") {
         return projectMountDestinationReason(projectsRoot, args, locale);
     }
     if (name === "container_start" || name === "container_recreate") {