@exagone313/dsh-podman 0.2.0-rc.3 → 0.2.0

package/dist/locales.test.js

@@ -0,0 +1,34 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+// Importing the client dictionary here also typechecks it under the host
+// program, which has no DOM lib: it must stay environment-free data.
+import { en, zh } from "./client/locales.js";
+// A confirmation that acts on one object must name it. Each call site passes the
+// placeholder listed here, so dropping a subject from either language fails.
+const SUBJECTS = [
+    ["confirmRemovePod", "workspace"],
+    ["confirmRemoveContainer", "workspace"],
+    ["confirmRemoveContainer", "container"],
+    ["confirmRecreate", "workspace"],
+    ["confirmRecreate", "container"],
+    ["confirmDetachSecret", "env"],
+    ["confirmDetachSecret", "secret"],
+    ["confirmRebuildImage", "image"],
+    ["confirmRemoveImage", "image"],
+    ["confirmRemoveVolume", "volume"],
+    ["confirmSetSecret", "secret"],
+    ["confirmRemoveSecret", "secret"],
+    ["confirmRemountReadOnly", "mount"],
+    ["confirmRemountReadWrite", "mount"],
+    ["confirmRemoveMount", "mount"],
+];
+test("every object-naming confirmation interpolates its subject", () => {
+    for (const [key, placeholder] of SUBJECTS) {
+        for (const [language, dictionary] of [["en", en], ["zh", zh]]) {
+            assert.ok(dictionary[key].includes(`{${placeholder}}`), `${language} ${key} must name {${placeholder}}`);
+        }
+    }
+});

package/dist/misc.test.js

@@ -3,8 +3,8 @@
 // SPDX-License-Identifier: MIT
 import test from "node:test";
 import assert from "node:assert/strict";
-import { fakeToolContext, guestExecRecorder, guestFileRecorder } from "./test-support.js";
-import { HARNESS_SOURCE_SECTION, TOOLS, toolCallView, toolHandlers, toolResultView, withoutHarnessSourceSection, } from "./index.js";
+import { fakeToolContext, guestExecRecorder, guestFileRecorder, } from "./test-support.js";
+import { HARNESS_SOURCE_SECTION, toolCallView, toolHandlers, toolResultView, TOOLS, withoutHarnessSourceSection, } from "./index.js";
 test("every tool parameters is a valid JSON-Schema object", () => {
     for (const tool of TOOLS) {
         assert.equal(tool.parameters.type, "object", `${tool.name} type`);
@@ -27,11 +27,20 @@ test("file tools resolve relative paths against the session cwd", async () => {
     assert.deepEqual(absolute.reads, ["/etc/hosts"], "absolute paths pass through");
     const write = guestFileRecorder();
     await toolHandlers.container_write(write.resolver, { container: "default", file_path: "out.txt", content: "x" }, exec, fakeToolContext(write.resolver));
-    assert.deepEqual(write.writes.map((entry) => entry.path), ["/projects/team/out.txt"]);
+    assert.deepEqual(write.writes.map((entry) => entry.path), [
+        "/projects/team/out.txt",
+    ]);
     const edit = guestFileRecorder("hello");
-    await toolHandlers.container_edit(edit.resolver, { container: "default", file_path: "a.txt", old_string: "hello", new_string: "bye" }, exec, fakeToolContext(edit.resolver));
+    await toolHandlers.container_edit(edit.resolver, {
+        container: "default",
+        file_path: "a.txt",
+        old_string: "hello",
+        new_string: "bye",
+    }, exec, fakeToolContext(edit.resolver));
     assert.deepEqual(edit.reads, ["/projects/team/a.txt"]);
-    assert.deepEqual(edit.writes.map((entry) => entry.path), ["/projects/team/a.txt"]);
+    assert.deepEqual(edit.writes.map((entry) => entry.path), [
+        "/projects/team/a.txt",
+    ]);
 });
 test("file tools refuse traversal before reaching the guest", async () => {
     const exec = { agent: { session: { header: { cwd: "/projects/team" } } } };
@@ -47,8 +56,14 @@ test("tool presenters label every tool and render terminal commands", () => {
     for (const tool of TOOLS) {
         assert.notEqual(toolCallView(tool.name, {}), undefined, `${tool.name} has a call view`);
     }
-    assert.deepEqual(toolCallView("container_bash", { command: "ls", description: "List files" }), { card: "terminal", title: "ls", description: "List files" });
-    assert.deepEqual(toolCallView("container_exec", { argv: ["ls", "-la"], description: "List all" }), { card: "terminal", title: "ls -la", description: "List all" });
+    assert.deepEqual(toolCallView("container_bash", {
+        command: "ls",
+        description: "List files",
+    }), { card: "terminal", title: "ls", description: "List files" });
+    assert.deepEqual(toolCallView("container_exec", {
+        argv: ["ls", "-la"],
+        description: "List all",
+    }), { card: "terminal", title: "ls -la", description: "List all" });
     assert.deepEqual(toolCallView("image_list", {}), { card: "generic", title: "List images", kind: "search" });
     assert.deepEqual(toolCallView("container_read", {}), { card: "generic", title: "Container read", kind: "read" });
     assert.deepEqual(toolCallView("container_write", {}), { card: "generic", title: "Container write", kind: "edit" });
@@ -63,7 +78,10 @@ test("tool presenters render command results as terminal output", () => {
     });
     assert.deepEqual(toolResultView("container_bash", {}, result({ exitCode: 0, signal: null, stdout: "hi\n", stderr: "" })), { card: "terminal", output: "hi\n", exitCode: 0 });
     assert.deepEqual(toolResultView("container_bash", {}, result({ exitCode: 0, signal: "SIGTERM", stdout: "", stderr: "" })), { card: "terminal", output: "", signal: "SIGTERM" });
-    assert.equal(toolResultView("container_bash", {}, { content: [{ type: "text", text: "boom" }], isError: true }), undefined);
+    assert.equal(toolResultView("container_bash", {}, {
+        content: [{ type: "text", text: "boom" }],
+        isError: true,
+    }), undefined);
     assert.equal(toolResultView("image_list", {}, result({})), undefined);
 });
 test("command tools resolve a relative working directory", async () => {
@@ -89,9 +107,19 @@ test("command tools pass an optional uid, gid, and groups", async () => {
     await toolHandlers.container_bash(bash.resolver, { container: "default", command: "id", uid: 1000 }, exec);
     // The managed environment is asserted separately; this pins the identity.
     const { env: _bashEnv, ...bashStart } = bash.starts[0];
-    assert.deepEqual(bashStart, { argv: ["bash", "-c", "id"], cwd: "/projects/team", uid: 1000 });
+    assert.deepEqual(bashStart, {
+        argv: ["bash", "-c", "id"],
+        cwd: "/projects/team",
+        uid: 1000,
+    });
     const run = guestExecRecorder("/projects/team");
-    await toolHandlers.container_exec(run.resolver, { container: "default", argv: ["id"], uid: 1000, gid: 2000, groups: [3000, 4000] }, exec);
+    await toolHandlers.container_exec(run.resolver, {
+        container: "default",
+        argv: ["id"],
+        uid: 1000,
+        gid: 2000,
+        groups: [3000, 4000],
+    }, exec);
     const { env: _runEnv, ...runStart } = run.starts[0];
     assert.deepEqual(runStart, {
         argv: ["id"],

package/dist/mount-enums.js

@@ -56,7 +56,8 @@ export function forcedMountMode(kind) {
     return undefined;
 }
 export function mountModeToProto(mode) {
-    const proto = mode !== undefined && Object.prototype.hasOwnProperty.call(MOUNT_MODES, mode)
+    const proto = mode !== undefined &&
+        Object.prototype.hasOwnProperty.call(MOUNT_MODES, mode)
         ? MOUNT_MODES[mode]
         : undefined;
     if (proto === undefined)

package/dist/mount-input.d.ts

@@ -11,4 +11,6 @@ export declare function projectMountDestinationReason(projectsRoot: string | und
     project?: unknown;
     destination?: unknown;
 }, locale?: ReasonLocale): string | undefined;
+export declare function validateMountInput(mount: any, projectsRoot: string | undefined): void;
+export declare function mountInputToProto(mount: any, projectsRoot: string | undefined): Record<string, unknown>;
 export declare function mountsFromInput(mounts: unknown, projectsRoot: string | undefined): Record<string, unknown>[] | undefined;

package/dist/mount-input.js

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
 //
 // SPDX-License-Identifier: MIT
-import { defaultMountMode, mountKindToProto, mountModeToProto } from "./mount-enums.js";
+import { defaultMountMode, mountKindToProto, mountModeToProto, } from "./mount-enums.js";
 import { renderDenial } from "./approval-reasons.js";
 // The mount kind for a call: an explicit non-empty `kind` wins, otherwise it is
 // inferred from the source field the caller supplied (`secret`/`volume`), since
@@ -26,8 +26,9 @@ export function projectMountMirror(projectsRoot, project) {
 export function projectMountDestinationReason(projectsRoot, args, locale = "en") {
     if (inferMountKind(args) !== "project")
         return undefined;
-    if (args.destination === undefined || args.destination === "")
+    if (args.destination === undefined || args.destination === "") {
         return undefined;
+    }
     const project = typeof args.project === "string" ? args.project : "";
     const mirror = projectsRoot === undefined
         ? ""
@@ -38,27 +39,42 @@ export function projectMountDestinationReason(projectsRoot, args, locale = "en")
         ...(mirror === "" ? {} : { mirror }),
     });
 }
+// validateMountInput applies the rules a mount must satisfy before it reaches
+// the control plane: a project mount never takes a destination, and a secret
+// mount is read-only. Both the model tools and the settings card call this, so
+// the same rule cannot hold on one path and not the other.
+export function validateMountInput(mount, projectsRoot) {
+    const destinationReason = projectMountDestinationReason(projectsRoot, mount);
+    if (destinationReason !== undefined)
+        throw new Error(destinationReason);
+    if (inferMountKind(mount) === "secret" && mount?.mode === "read_write") {
+        throw new Error("secret mounts are read-only; omit mode or use read_only");
+    }
+}
+// mountInputToProto validates one mount and encodes it for the control plane.
+// It is the single encoder both entry points use.
+export function mountInputToProto(mount, projectsRoot) {
+    validateMountInput(mount, projectsRoot);
+    const inferredKind = inferMountKind(mount);
+    const kind = mountKindToProto(inferredKind);
+    // `||`, not `??`: the card sends an empty string for an unset mode.
+    const mode = mountModeToProto(mount?.mode || defaultMountMode(inferredKind));
+    const result = {
+        projectName: mount?.project ?? "",
+        kind,
+        mode,
+    };
+    if (inferredKind !== "project" && mount?.destination) {
+        result.destination = mount.destination;
+    }
+    if (mount?.volume)
+        result.volume = mount.volume;
+    if (mount?.secret)
+        result.secret = mount.secret;
+    return result;
+}
 export function mountsFromInput(mounts, projectsRoot) {
     if (!Array.isArray(mounts) || mounts.length === 0)
         return undefined;
-    return mounts.map((mount) => {
-        const inferredKind = inferMountKind(mount);
-        const destinationReason = projectMountDestinationReason(projectsRoot, mount);
-        if (destinationReason !== undefined)
-            throw new Error(destinationReason);
-        if (inferredKind === "secret" && mount.mode === "read_write") {
-            throw new Error("secret mounts are read-only; omit mode or use read_only");
-        }
-        const kind = mountKindToProto(inferredKind);
-        const mode = mountModeToProto(mount.mode ?? defaultMountMode(inferredKind));
-        const result = { projectName: mount.project ?? "", kind, mode };
-        if (inferredKind !== "project" && mount.destination) {
-            result.destination = mount.destination;
-        }
-        if (mount.volume)
-            result.volume = mount.volume;
-        if (mount.secret)
-            result.secret = mount.secret;
-        return result;
-    });
+    return mounts.map((mount) => mountInputToProto(mount, projectsRoot));
 }

package/dist/mounts.test.js

@@ -3,9 +3,37 @@
 // SPDX-License-Identifier: MIT
 import test from "node:test";
 import assert from "node:assert/strict";
-import { MOUNT_EXEC, MOUNT_TOOLS, guestExecRecorder, mountRequestRecorder, testReadSession, WORKSPACE_ID, } from "./test-support.js";
-import { TOOLS, approvalDecision, preExecutePolicy, summarizeArgs, toolHandlers } from "./index.js";
+import { guestExecRecorder, MOUNT_EXEC, MOUNT_TOOLS, mountRequestRecorder, testReadSession, WORKSPACE_ID, } from "./test-support.js";
+import { approvalDecision, preExecutePolicy, summarizeArgs, toolHandlers, TOOLS, } from "./index.js";
 import { forcedMountMode } from "./mount-enums.js";
+import { mountInputToProto, mountsFromInput, validateMountInput, } from "./mount-input.js";
+test("mount validation is shared between the tools and the card", () => {
+    // A secret mount is read-only on every entry point.
+    assert.throws(() => validateMountInput({ kind: "secret", secret: "s", mode: "read_write" }, "/projects"), /read-only/);
+    assert.throws(() => mountInputToProto({ kind: "secret", secret: "s", mode: "read_write" }, "/projects"), /read-only/);
+    // A project mount never takes a destination.
+    assert.throws(() => mountInputToProto({ kind: "project", project: "p", destination: "/x" }, "/projects"), /destination/);
+    assert.deepEqual(mountInputToProto({ kind: "project", project: "team" }, "/projects"), {
+        projectName: "team",
+        kind: "MOUNT_KIND_PROJECT",
+        mode: "MOUNT_MODE_READ_ONLY",
+    });
+    assert.deepEqual(mountInputToProto({ kind: "secret", secret: "s", destination: "/run/s" }, "/projects"), {
+        projectName: "",
+        kind: "MOUNT_KIND_SECRET",
+        mode: "MOUNT_MODE_READ_ONLY",
+        destination: "/run/s",
+        secret: "s",
+    });
+    assert.deepEqual(mountsFromInput([{ kind: "tmpfs", destination: "/data" }], "/projects"), [
+        {
+            projectName: "",
+            kind: "MOUNT_KIND_TMPFS",
+            mode: "MOUNT_MODE_READ_WRITE",
+            destination: "/data",
+        },
+    ]);
+});
 test("container_start approval depends on mounts being passed", () => {
     const tool = TOOLS.find((entry) => entry.name === "container_start");
     assert.ok(tool, "container_start registered");
@@ -38,7 +66,11 @@ test("summarizeArgs infers the mount target when kind is omitted", () => {
 test("preExecutePolicy denies project mounts that carry a destination", async () => {
     const deny = (await preExecutePolicy({
         name: "container_mount_add",
-        arguments: { kind: "project", project: "team/src", destination: "/custom" },
+        arguments: {
+            kind: "project",
+            project: "team/src",
+            destination: "/custom",
+        },
     }, () => Promise.resolve({ kind: "allow" }), () => "/projects"));
     assert.equal(deny.kind, "deny", "must deny instead of asking");
     assert.equal(deny.reason, 'Project mounts cannot set a destination; "team/src" always mounts at "/projects/team/src".');
@@ -140,8 +172,18 @@ test("an omitted mount kind is inferred from the source field", async () => {
 });
 test("container_mount_update maps the selector and mode", async () => {
     const { requests, resolver } = mountRequestRecorder();
-    await toolHandlers.container_mount_update(resolver, { container: "valkey-ctr", kind: "project", project: "team/src", mode: "read_only" }, MOUNT_EXEC);
-    await toolHandlers.container_mount_update(resolver, { container: "valkey-ctr", volume: "valkey-data", destination: "/data", mode: "read_write" }, MOUNT_EXEC);
+    await toolHandlers.container_mount_update(resolver, {
+        container: "valkey-ctr",
+        kind: "project",
+        project: "team/src",
+        mode: "read_only",
+    }, MOUNT_EXEC);
+    await toolHandlers.container_mount_update(resolver, {
+        container: "valkey-ctr",
+        volume: "valkey-data",
+        destination: "/data",
+        mode: "read_write",
+    }, MOUNT_EXEC);
     assert.deepEqual(requests[0], [
         "updateContainerMount",
         {
@@ -166,7 +208,12 @@ test("container_mount_update maps the selector and mode", async () => {
 });
 test("container_mount_update rejects kinds without a mode", async () => {
     const { requests, resolver } = mountRequestRecorder();
-    await assert.rejects(() => toolHandlers.container_mount_update(resolver, { container: "web", kind: "tmpfs", destination: "/mnt", mode: "read_only" }, MOUNT_EXEC), /only project and volume mounts carry a mode; tmpfs mounts cannot be remounted/);
+    await assert.rejects(() => toolHandlers.container_mount_update(resolver, {
+        container: "web",
+        kind: "tmpfs",
+        destination: "/mnt",
+        mode: "read_only",
+    }, MOUNT_EXEC), /only project and volume mounts carry a mode; tmpfs mounts cannot be remounted/);
     await assert.rejects(() => toolHandlers.container_mount_update(resolver, { container: "web", project: "team", mode: "rw" }, MOUNT_EXEC), /unknown mount mode: rw/);
     assert.deepEqual(requests, [], "a rejected update must not reach the orchestrator");
 });
@@ -192,7 +239,12 @@ test("container_mount_add rejects unknown mount kinds and modes", async () => {
 });
 test("container_mount_add rejects a destination on a project mount", async () => {
     const { requests, resolver } = mountRequestRecorder();
-    await assert.rejects(() => toolHandlers.container_mount_add(resolver, { container: "web", kind: "project", project: "team/src", destination: "/custom" }, MOUNT_EXEC), /Project mounts cannot set a destination; "team\/src" always mounts at "\/projects\/team\/src"/);
+    await assert.rejects(() => toolHandlers.container_mount_add(resolver, {
+        container: "web",
+        kind: "project",
+        project: "team/src",
+        destination: "/custom",
+    }, MOUNT_EXEC), /Project mounts cannot set a destination; "team\/src" always mounts at "\/projects\/team\/src"/);
     await assert.rejects(() => toolHandlers.container_mount_add(resolver, { container: "web", project: "team", destination: "/custom" }, MOUNT_EXEC), /Project mounts cannot set a destination/);
     assert.deepEqual(requests, [], "a rejected mount must not reach the orchestrator");
     await toolHandlers.container_mount_add(resolver, { container: "web", kind: "volume", volume: "data", destination: "/data" }, MOUNT_EXEC);
@@ -277,7 +329,11 @@ test("container start maps valid mounts and defaults the mode to read_only", asy
             { project: "team/src", mode: "read_only" },
             { project: "team", mode: "read_write" },
             { kind: "volume", volume: "valkey-data", destination: "/data" },
-            { kind: "secret", secret: "valkey-tls", destination: "/run/secrets/tls" },
+            {
+                kind: "secret",
+                secret: "valkey-tls",
+                destination: "/run/secrets/tls",
+            },
             { kind: "tmpfs", destination: "/scratch" },
         ],
     }, MOUNT_EXEC);
@@ -358,8 +414,17 @@ test("container_mount_list returns mount objects", async () => {
                     workspaceSlug: WORKSPACE_ID,
                     containerName: "default",
                     mounts: [
-                        { projectName: "team", mode: "MOUNT_MODE_READ_WRITE", kind: "MOUNT_KIND_PROJECT" },
-                        { volume: "myvol", destination: "/data", mode: "MOUNT_MODE_READ_ONLY", kind: "MOUNT_KIND_VOLUME" },
+                        {
+                            projectName: "team",
+                            mode: "MOUNT_MODE_READ_WRITE",
+                            kind: "MOUNT_KIND_PROJECT",
+                        },
+                        {
+                            volume: "myvol",
+                            destination: "/data",
+                            mode: "MOUNT_MODE_READ_ONLY",
+                            kind: "MOUNT_KIND_VOLUME",
+                        },
                     ],
                 },
             ],
@@ -369,7 +434,12 @@ test("container_mount_list returns mount objects", async () => {
     const out = await toolHandlers.container_mount_list(resolver, { container: "default" }, exec);
     assert.deepEqual(out, [
         { projectName: "team", mode: "read_write", kind: "project" },
-        { volume: "myvol", destination: "/data", mode: "read_only", kind: "volume" },
+        {
+            volume: "myvol",
+            destination: "/data",
+            mode: "read_only",
+            kind: "volume",
+        },
     ]);
 });
 test("command tools default to the session directory when mounted", async () => {

package/dist/naming.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/naming.test.js

@@ -0,0 +1,28 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { TOOLS } from "./index.js";
+// Tool parameters are camelCase. The only snake_case names allowed are the ones
+// that intentionally mirror the harness's built-in read/write/edit tools. Proto
+// field names are lower_snake_case and never reach a tool schema: proto-loader
+// projects them to camelCase (`secret_env` -> `secretEnv`, `image_id` ->
+// `imageId`), so an exposed snake_case proto name is a bug.
+const BUILTIN_MIRRORED = new Set([
+    "file_path",
+    "old_string",
+    "new_string",
+    "replace_all",
+]);
+test("tool parameters never expose a proto-style snake_case name", () => {
+    for (const tool of TOOLS) {
+        for (const name of Object.keys(tool.parameters.properties)) {
+            if (name.includes("_")) {
+                assert.ok(BUILTIN_MIRRORED.has(name), `${tool.name}.${name} is snake_case but does not mirror a built-in tool`);
+            }
+            assert.notEqual(name, "secret_env", `${tool.name} must expose secretEnv, not secret_env`);
+            assert.notEqual(name, "image_id", `${tool.name} must expose imageId, not image_id`);
+        }
+    }
+});

package/dist/output-reader.js

@@ -13,20 +13,52 @@ export function outputReader(mode, spill) {
     if (!Number.isFinite(maxBytes) || maxBytes < 0)
         return undefined;
     let total = 0;
-    let retained = Buffer.alloc(0);
+    // Retained chunks, trimmed from the front down to the cap. Appending copies
+    // only the incoming chunk instead of re-concatenating the whole window on
+    // every append, which was quadratic over a long stream. `head` is the first
+    // live index; the prefix is compacted away periodically so dropped buffers do
+    // not stay referenced.
+    const chunks = [];
+    let head = 0;
+    let retained = 0;
     let spillValid = spill !== undefined;
     return {
         append(data) {
             total += data.length;
-            retained = Buffer.concat([retained, data]).subarray(-maxBytes);
+            // A zero cap keeps nothing: `subarray(-0)` is the whole buffer.
+            if (maxBytes === 0 || data.length === 0)
+                return;
+            chunks.push(data);
+            retained += data.length;
+            let excess = retained - maxBytes;
+            while (excess > 0 && head < chunks.length) {
+                const first = chunks[head];
+                if (first.length <= excess) {
+                    head++;
+                    retained -= first.length;
+                    excess -= first.length;
+                }
+                else {
+                    chunks[head] = first.subarray(excess);
+                    retained -= excess;
+                    excess = 0;
+                }
+            }
+            if (head > 32 && head * 2 >= chunks.length) {
+                chunks.splice(0, head);
+                head = 0;
+            }
         },
         readFrom(offset) {
-            const start = Math.max(0, total - retained.length);
+            const start = Math.max(0, total - retained);
             const requested = Math.max(0, Number.isFinite(offset) ? offset : 0);
             const local = Math.max(0, requested - start);
             const lossy = requested < start;
+            const window = head >= chunks.length
+                ? Buffer.alloc(0)
+                : Buffer.concat(chunks.slice(head), retained);
             return {
-                text: retained.subarray(local).toString("utf8"),
+                text: window.subarray(local).toString("utf8"),
                 nextOffset: total,
                 lossy,
                 // Advertise the full-stream file only while it can still hold the

package/dist/package-deps.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-deps.test.js

@@ -0,0 +1,49 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+// Every harness dependency must be an exact version: the set moves together
+// with the supported dsh release, and a caret quietly allowed the manifest to
+// drift a release behind the image.
+const EXACT_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const SECTIONS = ["devDependencies", "peerDependencies"];
+function manifest() {
+    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+}
+test("every @deepseek-ai specifier is an exact version", () => {
+    const pkg = manifest();
+    for (const section of SECTIONS) {
+        for (const [name, specifier] of Object.entries(pkg[section] ?? {})) {
+            if (!name.startsWith("@deepseek-ai/"))
+                continue;
+            assert.match(String(specifier), EXACT_VERSION, `${section}: "${name}": "${specifier}" must be an exact version`);
+        }
+    }
+});
+test("every peer dependency is declared optional", () => {
+    const pkg = manifest();
+    for (const name of Object.keys(pkg.peerDependencies ?? {})) {
+        assert.equal(pkg.peerDependenciesMeta?.[name]?.optional, true, `peerDependenciesMeta["${name}"].optional must be true`);
+    }
+});
+test("every @deepseek-ai/dsh-* specifier matches ARG DSH_VERSION", (context) => {
+    const containerfile = new URL("../Containerfile.dsh", import.meta.url);
+    if (!existsSync(containerfile)) {
+        context.skip("not a source checkout");
+        return;
+    }
+    const match = /^ARG\s+DSH_VERSION=(\S+)/m.exec(readFileSync(containerfile, "utf8"));
+    assert.ok(match, "Containerfile.dsh must declare ARG DSH_VERSION");
+    const dshVersion = match[1];
+    assert.match(dshVersion, EXACT_VERSION, "ARG DSH_VERSION must be exact");
+    const pkg = manifest();
+    for (const section of SECTIONS) {
+        for (const [name, specifier] of Object.entries(pkg[section] ?? {})) {
+            if (!name.startsWith("@deepseek-ai/dsh-"))
+                continue;
+            assert.equal(specifier, dshVersion, `${section}: "${name}": "${specifier}" must match ARG DSH_VERSION (${dshVersion})`);
+        }
+    }
+});

package/dist/paths.test.js

@@ -4,7 +4,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { pathRequestRecorder, WORKSPACE_ID } from "./test-support.js";
-import { TOOLS, summarizeArgs, toolHandlers } from "./index.js";
+import { summarizeArgs, toolHandlers, TOOLS } from "./index.js";
 const EXEC = { agent: { session: { header: { cwd: "/proj" } } } };
 test("the path tools are registered and approval-gated", () => {
     for (const name of [
@@ -39,7 +39,9 @@ test("container_path_set persists and applies the whole list", async () => {
     assert.deepEqual(out, { paths: ["/opt/bin", "/usr/local/bin"] });
 });
 test("container_path_add prepends and moves an existing entry to the front", async () => {
-    const { controlCalls, resolver } = pathRequestRecorder({ paths: ["/a", "/b"] });
+    const { controlCalls, resolver } = pathRequestRecorder({
+        paths: ["/a", "/b"],
+    });
     const added = await toolHandlers.container_path_add(resolver, { container: "default", path: "/c" }, EXEC);
     assert.deepEqual(added, { paths: ["/c", "/a", "/b"] });
     const moved = await toolHandlers.container_path_add(resolver, { container: "default", path: "/b" }, EXEC);

package/dist/plugin-meta.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/plugin-meta.test.js

@@ -0,0 +1,29 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+// The display name the Plugins page shows comes from the package's exported
+// locale metadata. Without the `exports` entry the Host cannot resolve the
+// file, and without the `files` entry a packed install has no file to resolve:
+// both fall back silently to the scoped package name, so both are asserted.
+function localeMeta(language) {
+    return JSON.parse(readFileSync(new URL(`../locale/${language}.json`, import.meta.url), "utf8"));
+}
+function manifest() {
+    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+}
+test("the locale metadata declares the plugin's display name", () => {
+    for (const language of ["en", "zh"]) {
+        const meta = localeMeta(language).meta;
+        assert.equal(meta.title, "dsh-podman", `${language}: meta.title`);
+        assert.equal(typeof meta.description, "string", `${language}: meta.description must be a string`);
+        assert.notEqual(meta.description.trim(), "", `${language}: meta.description must not be empty`);
+    }
+});
+test("the locale metadata is exported and shipped", () => {
+    const pkg = manifest();
+    assert.equal(pkg.exports["./locale/*.json"], "./locale/*.json", "package.json must export the locale metadata");
+    assert.ok(pkg.files.includes("locale/*.json"), "package.json files must ship locale/*.json");
+});

package/dist/project-path.js

@@ -17,26 +17,52 @@ export function projectNameFromHostPath(projectsRoot, path) {
 }
 // hostPathForProjectName is the inverse: the absolute directory a project path
 // names under the projects root, used to open a directory browser where the
-// field's current value lives.
+// field's current value lives. A value that climbs above the root with ".."
+// clamps to the root instead of yielding a path outside it.
 export function hostPathForProjectName(projectsRoot, project) {
     const root = stripTrailingSlash(projectsRoot);
-    const name = stripTrailingSlash(project).replace(/^\/+/, "");
-    return name === "" ? root : `${root}/${name}`;
+    const name = normalizeProjectPath(String(project ?? ""));
+    if (root === "" || name === undefined || name === "")
+        return root;
+    return `${root}/${name}`;
 }
 function stripTrailingSlash(value) {
     return String(value ?? "").replace(/\/+$/, "");
 }
+// normalizeProjectPath collapses "." and empty segments and resolves ".."
+// lexically. It returns undefined when a ".." would climb above the root, so a
+// caller can clamp rather than build an escaping path.
+function normalizeProjectPath(project) {
+    const segments = [];
+    for (const segment of project.split("/")) {
+        if (segment === "" || segment === ".")
+            continue;
+        if (segment === "..") {
+            if (segments.length === 0)
+                return undefined;
+            segments.pop();
+            continue;
+        }
+        segments.push(segment);
+    }
+    return segments.join("/");
+}
 // confineToRoot clamps a directory to the projects root subtree, so a stale or
-// hand-edited project path can never open a browser outside it.
+// hand-edited project path can never open a browser outside it. A ".." inside
+// the root is resolved; one that would escape clamps to the root.
 export function confineToRoot(root, path) {
     const normalizedRoot = stripTrailingSlash(root);
     const normalizedPath = stripTrailingSlash(path);
     if (normalizedRoot === "" || normalizedPath === normalizedRoot) {
         return normalizedRoot;
     }
-    return normalizedPath.startsWith(`${normalizedRoot}/`)
-        ? normalizedPath
-        : normalizedRoot;
+    if (!normalizedPath.startsWith(`${normalizedRoot}/`)) {
+        return normalizedRoot;
+    }
+    const name = normalizeProjectPath(normalizedPath.slice(normalizedRoot.length + 1));
+    if (name === undefined || name === "")
+        return normalizedRoot;
+    return `${normalizedRoot}/${name}`;
 }
 // parentDirectory is the directory one level above `path`, never above the
 // projects root.