@exagone313/dsh-podman 0.2.0-rc.3 → 0.2.0

package/dist/approval.test.js

@@ -3,11 +3,13 @@
 // SPDX-License-Identifier: MIT
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { readFileSync } from "node:fs";
 import { presetExec, sessionExec, testReadSession } from "./test-support.js";
-import { PODMAN_OPS_AGENT_CORDIS_YML, PODMAN_OPS_PRESET_YML, READ_ONLY_TOOLS, SANDBOX_ESCALATION_REASON_PREFIX, TOOLS, approvalDecision, ensurePodmanOpsPreset, isSandboxEscalation, preExecutePolicy, summarizeArgs, } from "./index.js";
+import { approvalDecision, isSandboxEscalation, preExecutePolicy, READ_ONLY_TOOLS, SANDBOX_ESCALATION_REASON_PREFIX, summarizeArgs, TOOLS, } from "./index.js";
+// The bundle patch that declares the Podman operator preset.
+function podmanOpsPatch() {
+    return readFileSync(new URL("../cordis.patch.yml", import.meta.url), "utf8");
+}
 test("isSandboxEscalation claims only the harness's sandbox escalation", () => {
     assert.equal(SANDBOX_ESCALATION_REASON_PREFIX, "escalate sandbox to ");
     assert.equal(isSandboxEscalation({
@@ -130,7 +132,19 @@ test("summarizeArgs renders the approval reason for each gated tool", () => {
     assert.equal(summarizeArgs("image_build", {
         imageId: "dev",
         parent: "archlinux",
-        packages: ["git", "curl", "tmux", "vim", "zsh", "openssh", "jq", "ripgrep", "make", "cc", "go"],
+        packages: [
+            "git",
+            "curl",
+            "tmux",
+            "vim",
+            "zsh",
+            "openssh",
+            "jq",
+            "ripgrep",
+            "make",
+            "cc",
+            "go",
+        ],
     }), 'Build image "dev" from "archlinux" with packages: git, curl, tmux, vim, zsh, openssh, jq, ripgrep, +3 more.');
     assert.equal(summarizeArgs("image_rebuild", { imageId: "valkey" }), 'Rebuild image "valkey".');
     assert.equal(summarizeArgs("image_rebuild_all", {}), "Rebuild all images.");
@@ -247,7 +261,12 @@ test("read-only permission allows get/list tools and denies the rest", async ()
         assert.equal(delegated, true, `${name} must be allowed under read-only`);
         assert.equal(result.kind, "allow");
     }
-    for (const name of ["image_build", "container_start", "container_remove", "volume_remove"]) {
+    for (const name of [
+        "image_build",
+        "container_start",
+        "container_remove",
+        "volume_remove",
+    ]) {
         const result = (await preExecutePolicy(sessionExec(name), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
         assert.equal(result.kind, "deny", `${name} must be denied under read-only`);
         assert.ok(result.reason.includes("read-only"), `${name} deny reason`);
@@ -270,7 +289,9 @@ test("read-only denies the built-in file and shell tools", async () => {
     }
 });
 test("workspace-write and full access delegate the built-in file and shell tools", async () => {
-    for (const facts of [{ mode: "workspace-write", policy: "ask" }, { policy: "never" }]) {
+    for (const facts of [{ mode: "workspace-write", policy: "ask" }, {
+            policy: "never",
+        }]) {
         for (const name of ["write", "edit", "bash", "pwsh"]) {
             let delegated = false;
             const result = (await preExecutePolicy(sessionExec(name, facts), () => {
@@ -322,10 +343,18 @@ test("read-only wins over a never approval policy", async () => {
 });
 test("podman-ops preset asks for its approval-gated tools only", async () => {
     const workspaceWrite = { mode: "workspace-write", policy: "ask" };
-    const asked = (await preExecutePolicy(presetExec("container_bash", "podman-ops", { container: "valkey-ctr", command: "valkey-cli ping" }, workspaceWrite), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
+    const asked = (await preExecutePolicy(presetExec("container_bash", "podman-ops", {
+        container: "valkey-ctr",
+        command: "valkey-cli ping",
+    }, workspaceWrite), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
     assert.equal(asked.kind, "ask");
     assert.equal(asked.reason, 'Run a shell command in container "valkey-ctr": valkey-cli ping');
-    const daemon = (await preExecutePolicy(presetExec("daemon_start", "podman-ops", { container: "valkey-ctr", name: "v1", argv: ["valkey-server"], uid: 1001 }, workspaceWrite), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
+    const daemon = (await preExecutePolicy(presetExec("daemon_start", "podman-ops", {
+        container: "valkey-ctr",
+        name: "v1",
+        argv: ["valkey-server"],
+        uid: 1001,
+    }, workspaceWrite), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
     assert.equal(daemon.kind, "ask");
     assert.equal(daemon.reason, 'Start daemon "v1" in container "valkey-ctr": valkey-server (uid 1001)');
 });
@@ -350,10 +379,17 @@ test("podman-ops keeps open tools ungated and respects permissions", async () =>
     }, undefined, undefined, testReadSession));
     assert.equal(delegated, true, "image_list must stay open in podman-ops");
     assert.equal(open.kind, "allow");
-    const denied = (await preExecutePolicy(presetExec("container_bash", "podman-ops", { container: "c", command: "ls" }, { mode: "read-only" }), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
+    const denied = (await preExecutePolicy(presetExec("container_bash", "podman-ops", {
+        container: "c",
+        command: "ls",
+    }, {
+        mode: "read-only",
+    }), () => Promise.resolve({ kind: "allow" }), undefined, undefined, testReadSession));
     assert.equal(denied.kind, "deny", "read-only wins over podman-ops approval");
     let fullDelegated = false;
-    const full = (await preExecutePolicy(presetExec("daemon_start", "podman-ops", { container: "c", argv: ["x"] }, { policy: "never" }), () => {
+    const full = (await preExecutePolicy(presetExec("daemon_start", "podman-ops", { container: "c", argv: ["x"] }, {
+        policy: "never",
+    }), () => {
         fullDelegated = true;
         return Promise.resolve({ kind: "allow" });
     }, undefined, undefined, testReadSession));
@@ -361,12 +397,45 @@ test("podman-ops keeps open tools ungated and respects permissions", async () =>
     assert.equal(full.kind, "allow");
 });
 test("summarizeArgs renders reasons for the podman-ops gated tools", () => {
-    assert.equal(summarizeArgs("container_exec", { container: "c", argv: ["python", "run.py", "--x", "1", "--y", "2", "--z", "3", "--w", "4", "--v", "5"] }), 'Run a command in container "c": python run.py --x 1 --y 2 --z 3 …');
-    assert.equal(summarizeArgs("container_write", { container: "c", file_path: "/etc/valkey/valkey.conf" }), 'Write "/etc/valkey/valkey.conf" in container "c".');
-    assert.equal(summarizeArgs("container_edit", { container: "c", file_path: "/etc/valkey/valkey.conf" }), 'Edit "/etc/valkey/valkey.conf" in container "c".');
-    assert.equal(summarizeArgs("container_bash", { container: "c", command: "ping -c 1 8.8.8.8" }), 'Run a shell command in container "c": ping -c 1 8.8.8.8');
-    assert.equal(summarizeArgs("container_bash", { container: "c", command: "ls", workdir: "/srv" }), 'Run a shell command in container "c" (cwd "/srv"): ls');
-    assert.equal(summarizeArgs("container_exec", { container: "c", argv: ["ls"], workdir: "/srv" }), 'Run a command in container "c" (cwd "/srv"): ls');
+    assert.equal(summarizeArgs("container_exec", {
+        container: "c",
+        argv: [
+            "python",
+            "run.py",
+            "--x",
+            "1",
+            "--y",
+            "2",
+            "--z",
+            "3",
+            "--w",
+            "4",
+            "--v",
+            "5",
+        ],
+    }), 'Run a command in container "c": python run.py --x 1 --y 2 --z 3 …');
+    assert.equal(summarizeArgs("container_write", {
+        container: "c",
+        file_path: "/etc/valkey/valkey.conf",
+    }), 'Write "/etc/valkey/valkey.conf" in container "c".');
+    assert.equal(summarizeArgs("container_edit", {
+        container: "c",
+        file_path: "/etc/valkey/valkey.conf",
+    }), 'Edit "/etc/valkey/valkey.conf" in container "c".');
+    assert.equal(summarizeArgs("container_bash", {
+        container: "c",
+        command: "ping -c 1 8.8.8.8",
+    }), 'Run a shell command in container "c": ping -c 1 8.8.8.8');
+    assert.equal(summarizeArgs("container_bash", {
+        container: "c",
+        command: "ls",
+        workdir: "/srv",
+    }), 'Run a shell command in container "c" (cwd "/srv"): ls');
+    assert.equal(summarizeArgs("container_exec", {
+        container: "c",
+        argv: ["ls"],
+        workdir: "/srv",
+    }), 'Run a command in container "c" (cwd "/srv"): ls');
 });
 test("summarizeArgs names the process identity and groups", () => {
     assert.equal(summarizeArgs("container_bash", {
@@ -376,7 +445,11 @@ test("summarizeArgs names the process identity and groups", () => {
         gid: 1000,
         groups: [3000, 4000],
     }), 'Run a shell command in container "c": id (uid 1000, gid 1000, groups 3000, 4000)');
-    assert.equal(summarizeArgs("container_exec", { container: "c", argv: ["id"], gid: 2000 }), 'Run a command in container "c": id (gid 2000)');
+    assert.equal(summarizeArgs("container_exec", {
+        container: "c",
+        argv: ["id"],
+        gid: 2000,
+    }), 'Run a command in container "c": id (gid 2000)');
     assert.equal(summarizeArgs("daemon_start", {
         container: "c",
         name: "web",
@@ -385,9 +458,14 @@ test("summarizeArgs names the process identity and groups", () => {
         groups: [3000],
     }), 'Start daemon "web" in container "c": nginx (uid 1000, groups 3000)');
     // An empty groups list is not worth naming.
-    assert.equal(summarizeArgs("container_exec", { container: "c", argv: ["id"], groups: [] }), 'Run a command in container "c": id');
+    assert.equal(summarizeArgs("container_exec", {
+        container: "c",
+        argv: ["id"],
+        groups: [],
+    }), 'Run a command in container "c": id');
 });
 test("Podman-ops preset content covers the recent tools", () => {
+    const patch = podmanOpsPatch();
     for (const tool of [
         "image_rebuild_all",
         "secret_list",
@@ -396,24 +474,26 @@ test("Podman-ops preset content covers the recent tools", () => {
         "container_secret_add",
         "container_secret_remove",
     ]) {
-        assert.ok(PODMAN_OPS_AGENT_CORDIS_YML.includes(tool), `podman-ops composition must mention ${tool}`);
+        assert.ok(patch.includes(tool), `podman-ops composition must mention ${tool}`);
     }
-    assert.ok(PODMAN_OPS_PRESET_YML.includes("secrets"), "podman-ops metadata must mention secrets");
+    assert.match(patch, /id: podman-ops/, "the preset row must carry the policy's preset id");
+    assert.ok(patch.includes("secrets"), "podman-ops metadata must mention secrets");
     // The persona plugin takes its prose as `prefix` (a required field); `text`
     // is not part of its schema and would make the preset fail to load.
-    assert.match(PODMAN_OPS_AGENT_CORDIS_YML, /prefix:/);
-    assert.doesNotMatch(PODMAN_OPS_AGENT_CORDIS_YML, /\btext:/);
+    assert.match(patch, /prefix:/);
+    assert.doesNotMatch(patch, /\btext:/);
 });
-test("Podman-ops preset writer overwrites existing content", () => {
-    const dir = mkdtempSync(join(tmpdir(), "dsh-podman-"));
-    ensurePodmanOpsPreset(undefined, dir);
-    const composition = join(dir, "agent.cordis.yml");
-    const metadata = join(dir, "preset.yml");
-    assert.equal(readFileSync(composition, "utf8"), PODMAN_OPS_AGENT_CORDIS_YML);
-    assert.equal(readFileSync(metadata, "utf8"), PODMAN_OPS_PRESET_YML);
-    writeFileSync(composition, "# stale user copy\n");
-    ensurePodmanOpsPreset(undefined, dir);
-    assert.equal(readFileSync(composition, "utf8"), PODMAN_OPS_AGENT_CORDIS_YML, "a second load must overwrite the stale copy");
+test("Podman-ops preset declares its composition as plugin rows", () => {
+    const patch = podmanOpsPatch();
+    for (const plugin of [
+        "@deepseek-ai/dsh-persona",
+        "@deepseek-ai/dsh-tool-ask-user",
+        "@deepseek-ai/dsh-tool-todo",
+        "@deepseek-ai/dsh-tool-web",
+    ]) {
+        assert.ok(patch.includes(plugin), `podman-ops composition must declare ${plugin}`);
+    }
+    assert.ok(patch.includes("@deepseek-ai/dsh-agent-preset"), "the preset must be declared through the agent-preset row");
 });
 test("summarizeArgs includes PATH additions for container start/recreate", () => {
     assert.equal(summarizeArgs("container_start", { container: "web", paths: ["/opt/bin"] }), 'Start container "web" with PATH additions: "/opt/bin".');
@@ -443,7 +523,18 @@ test("summarizeArgs includes env keys for container start/recreate", () => {
     }), 'Start container "web" from image "localhost/dsh-podman/nginx:latest" with mounts: project "team" (read-only) with env: A, B, C.');
     assert.equal(summarizeArgs("container_start", {
         container: "web",
-        env: { A: "1", B: "2", C: "3", D: "4", E: "5", F: "6", G: "7", H: "8", I: "9", J: "10" },
+        env: {
+            A: "1",
+            B: "2",
+            C: "3",
+            D: "4",
+            E: "5",
+            F: "6",
+            G: "7",
+            H: "8",
+            I: "9",
+            J: "10",
+        },
     }), 'Start container "web" with env: A, B, C, D, E, F, G, H, +2 more.');
     assert.equal(summarizeArgs("container_recreate", {
         container: "c",
@@ -460,3 +551,43 @@ test("approval prompts name the resolved path", () => {
     assert.equal(summarizeArgs("container_write", { container: "c", file_path: "notes.md" }), 'Write "notes.md" in container "c".');
     assert.equal(summarizeArgs("container_write", { container: "c", file_path: "../x" }, "/projects/team"), 'Write "../x" in container "c".');
 });
+test("summarizeArgs includes secret env names for container start/recreate", () => {
+    assert.equal(summarizeArgs("container_start", {
+        container: "web",
+        secretEnv: { TOKEN: "api-token" },
+    }), 'Start container "web" with secret env: TOKEN.');
+    assert.equal(summarizeArgs("container_recreate", {
+        container: "c",
+        env: { A: "1" },
+        secretEnv: { TOKEN: "api-token" },
+    }), 'Recreate container "c" with env: A with secret env: TOKEN.');
+    // An empty map is not an attachment and is not named.
+    assert.equal(summarizeArgs("container_start", { container: "web", secretEnv: {} }), 'Start container "web".');
+});
+test("container_start asks for approval when it attaches secrets", () => {
+    // Plain env, paths, and a bare start stay prompt-free by design: the caller
+    // already knows those values, unlike a secret the container injects.
+    assert.equal(approvalDecision("container_start", { container: "web" }), undefined);
+    assert.equal(approvalDecision("container_start", {
+        container: "web",
+        paths: ["/opt/bin"],
+    }), undefined);
+    assert.equal(approvalDecision("container_start", { container: "web", env: { A: "1" } }), undefined);
+    assert.equal(approvalDecision("container_start", { container: "web", secretEnv: {} }), undefined);
+    // Mounts and secret attachments both change what the container can reach.
+    assert.equal(approvalDecision("container_start", {
+        container: "web",
+        mounts: [{ project: "team" }],
+    })?.kind, "ask");
+    const withSecret = approvalDecision("container_start", {
+        container: "web",
+        secretEnv: { TOKEN: "api-token" },
+    });
+    assert.equal(withSecret?.kind, "ask");
+    assert.match(withSecret?.reason ?? "", /secret env: TOKEN/);
+});
+test("the bundle patch disables the built-in terminal UI", () => {
+    // The Podman terminal replaces the built-in one; its client row must stay off
+    // so the guide offers a single terminal card and Ctrl+` is free.
+    assert.match(podmanOpsPatch(), /- id: ui-sidebar-terminal\n\s+disabled: true/);
+});

package/dist/card-route.d.ts

@@ -1,4 +1,5 @@
 import { type CardSnapshot } from "./client/card-protocol.js";
+import { type ReasonLocale } from "./approval-reasons.js";
 import { type WorkspaceResolver } from "./workspace-binding.js";
 /** Build the live snapshot the card renders. */
 export declare function cardSnapshot(resolver: WorkspaceResolver, workspaceRegistry: any): Promise<CardSnapshot>;
@@ -6,10 +7,10 @@ export declare function cardSnapshot(resolver: WorkspaceResolver, workspaceRegis
  * Run one card command, returning the notice to show (usually empty). `ctx` is
  * the settings-injected context, read only for the session locale.
  */
-export declare function runCommand(ctx: any, resolver: WorkspaceResolver, workspaceRegistry: any, raw: Record<string, unknown>): Promise<string>;
+export declare function runCommand(_ctx: any, resolver: WorkspaceResolver, workspaceRegistry: any, raw: Record<string, unknown>, readLocale?: () => ReasonLocale): Promise<string>;
 /**
  * Register the card's authenticated fetch route. It is served below the
  * harness API path, so the carrier applies its Host/Origin fence and browser
  * authentication before the handler runs.
  */
-export declare function registerCardRoute(ctx: any, resolver: WorkspaceResolver, workspaceRegistry?: any): void;
+export declare function registerCardRoute(ctx: any, resolver: WorkspaceResolver, workspaceRegistry?: any, readLocale?: () => ReasonLocale): void;