@exagone313/dsh-podman 0.3.0 → 0.4.0

package/dist/card-route.d.ts

@@ -2,7 +2,7 @@ import { type CardSnapshot } from "./client/card-protocol.js";
 import { type ReasonLocale } from "./approval-reasons.js";
 import { type WorkspaceResolver } from "./workspace-binding.js";
 /** Build the live snapshot the card renders. */
-export declare function cardSnapshot(resolver: WorkspaceResolver, workspaceRegistry: any): Promise<CardSnapshot>;
+export declare function cardSnapshot(resolver: WorkspaceResolver, workspaceRegistry: any, harnessVersion?: string): Promise<CardSnapshot>;
 /**
  * Run one card command, returning the notice to show (usually empty). `ctx` is
  * the settings-injected context, read only for the session locale.
@@ -13,4 +13,4 @@ export declare function runCommand(_ctx: any, resolver: WorkspaceResolver, works
  * harness API path, so the carrier applies its Host/Origin fence and browser
  * authentication before the handler runs.
  */
-export declare function registerCardRoute(ctx: any, resolver: WorkspaceResolver, workspaceRegistry?: any, readLocale?: () => ReasonLocale): void;
+export declare function registerCardRoute(ctx: any, resolver: WorkspaceResolver, workspaceRegistry?: any, readLocale?: () => ReasonLocale, harnessVersion?: string): void;

package/dist/card-route.js

@@ -131,7 +131,7 @@ function dshWorkspaceCwd(registry, slug) {
     throw new Error(`unknown workspace ${JSON.stringify(slug)}`);
 }
 /** Build the live snapshot the card renders. */
-export async function cardSnapshot(resolver, workspaceRegistry) {
+export async function cardSnapshot(resolver, workspaceRegistry, harnessVersion = dshVersion()) {
     // The handshake RPC is exempt from the orchestrator's version check, so it
     // succeeds even when the rest is refused; an older orchestrator that has no
     // GetVersion yet leaves the version unknown.
@@ -156,7 +156,7 @@ export async function cardSnapshot(resolver, workspaceRegistry) {
         return {
             version: VERSION,
             commit: GIT_COMMIT,
-            dshVersion: dshVersion(),
+            dshVersion: harnessVersion,
             orchestratorVersion,
             versionState: "major-mismatch",
             projectsRoot: resolver.getConfig().projectsRoot,
@@ -172,7 +172,7 @@ export async function cardSnapshot(resolver, workspaceRegistry) {
     return {
         version: VERSION,
         commit: GIT_COMMIT,
-        dshVersion: dshVersion(),
+        dshVersion: harnessVersion,
         orchestratorVersion,
         versionState: pluginVersionState(VERSION, orchestratorVersion),
         projectsRoot: resolver.getConfig().projectsRoot,
@@ -537,10 +537,10 @@ function normalizeCommand(raw) {
         mount: mountField(raw.mount),
     };
 }
-async function handleCardRequest(request, ctx, resolver, workspaceRegistry, readLocale) {
+async function handleCardRequest(request, ctx, resolver, workspaceRegistry, readLocale, harnessVersion) {
     if (request.method === "GET") {
         try {
-            return jsonResponse(200, await cardSnapshot(resolver, workspaceRegistry));
+            return jsonResponse(200, await cardSnapshot(resolver, workspaceRegistry, harnessVersion));
         }
         catch (error) {
             return jsonResponse(500, {
@@ -578,13 +578,13 @@ async function handleCardRequest(request, ctx, resolver, workspaceRegistry, read
  * harness API path, so the carrier applies its Host/Origin fence and browser
  * authentication before the handler runs.
  */
-export function registerCardRoute(ctx, resolver, workspaceRegistry, readLocale) {
+export function registerCardRoute(ctx, resolver, workspaceRegistry, readLocale, harnessVersion) {
     ctx.inject(["connection"], (connectionCtx) => {
         connectionCtx.connection.fetch.register({
             path: CARD_PATH,
             methods: ["GET", "POST"],
             requestBody: "buffered",
-            fetch: (request) => handleCardRequest(request, connectionCtx, resolver, workspaceRegistry, readLocale),
+            fetch: (request) => handleCardRequest(request, connectionCtx, resolver, workspaceRegistry, readLocale, harnessVersion),
         });
     });
 }

package/dist/dsh-version.d.ts

@@ -1 +1,7 @@
-export declare function dshVersion(): string;
+export interface PluginPackageLookup {
+    packageOf?(specifier: string, parentURL: string): {
+        version?: unknown;
+    } | undefined;
+}
+export declare function dshVersion(packages?: PluginPackageLookup): string;
+export declare function versionFromPackages(packages?: PluginPackageLookup): string | undefined;

package/dist/dsh-version.js

@@ -4,24 +4,37 @@
 import { createRequire } from "node:module";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-// The harness version this plugin runs inside. Every `@deepseek-ai/dsh-*`
-// package carries the release version, and the dsh app package is linked into
-// the profile's healed node_modules, so it is resolvable from the plugin even
-// though it is not a dependency of it. "" when it cannot be resolved, which the
-// card renders as unknown.
+// The harness version this plugin runs inside. The dsh app package is not a
+// physical dependency of the plugin: the boot loader serves profile plugin
+// imports from an in-memory package table, so the plugin asks that table
+// (`ctx.pluginPackages`) for the package it runs under. The physical module
+// walk below is only a fallback for a development checkout. "" when the
+// version cannot be resolved, which the card renders as unknown.
+const PACKAGE = "@deepseek-ai/dsh";
 let cached;
-export function dshVersion() {
-    cached ??= resolveDshVersion() ?? "";
-    return cached;
+export function dshVersion(packages) {
+    if (cached !== undefined)
+        return cached;
+    const resolved = versionFromPackages(packages) ?? resolveDshVersion();
+    // Only a resolved version is cached, so an early lookup without the package
+    // table cannot pin "" for the process lifetime.
+    if (resolved !== undefined && resolved !== "")
+        cached = resolved;
+    return resolved ?? "";
 }
-// resolveDshVersion walks the module search paths the way the harness resolves
-// its own bundles, so a package that does not export ./package.json still
-// resolves.
+// versionFromPackages reads the running app package's manifest version through
+// the profile package lookup. It is undefined when the lookup is absent, the
+// package is unknown, or the manifest carries no usable version.
+export function versionFromPackages(packages) {
+    const version = packages?.packageOf?.(PACKAGE, import.meta.url)?.version;
+    return typeof version === "string" && version !== "" ? version : undefined;
+}
+// resolveDshVersion walks the physical module search paths, for an install
+// whose app package is a real node_modules entry (a source checkout).
 function resolveDshVersion() {
     let searchPaths;
     try {
-        searchPaths =
-            createRequire(import.meta.url).resolve.paths("@deepseek-ai/dsh") ?? [];
+        searchPaths = createRequire(import.meta.url).resolve.paths(PACKAGE) ?? [];
     }
     catch {
         return undefined;
@@ -29,7 +42,7 @@ function resolveDshVersion() {
     for (const searchPath of searchPaths) {
         if (searchPath === null)
             continue;
-        const manifest = join(searchPath, "@deepseek-ai/dsh", "package.json");
+        const manifest = join(searchPath, PACKAGE, "package.json");
         if (!existsSync(manifest))
             continue;
         try {

package/dist/dsh-version.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/dsh-version.test.js

@@ -0,0 +1,25 @@
+// SPDX-FileCopyrightText: 2026 Elouan Martinet <exa@elou.world>
+//
+// SPDX-License-Identifier: MIT
+import test from "node:test";
+import assert from "node:assert/strict";
+import { versionFromPackages } from "./dsh-version.js";
+test("versionFromPackages reads the app version through the profile lookup", () => {
+    const packages = {
+        packageOf: (specifier, parentURL) => {
+            assert.equal(specifier, "@deepseek-ai/dsh");
+            assert.ok(parentURL.startsWith("file:"), "lookup uses this module's URL");
+            return { version: "1.2.3" };
+        },
+    };
+    assert.equal(versionFromPackages(packages), "1.2.3");
+});
+test("versionFromPackages reports no version when the package is unknown", () => {
+    assert.equal(versionFromPackages({ packageOf: () => undefined }), undefined);
+});
+test("versionFromPackages ignores a missing lookup and unusable versions", () => {
+    assert.equal(versionFromPackages(undefined), undefined);
+    assert.equal(versionFromPackages({}), undefined);
+    assert.equal(versionFromPackages({ packageOf: () => ({ version: "" }) }), undefined);
+    assert.equal(versionFromPackages({ packageOf: () => ({ version: 3 }) }), undefined);
+});

package/dist/generated/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.3.0";
-export declare const GIT_COMMIT = "7db83bb";
+export declare const VERSION = "0.4.0";
+export declare const GIT_COMMIT = "e5c1eb5";

package/dist/generated/version.js

@@ -2,5 +2,5 @@
 //
 // SPDX-License-Identifier: MIT
 // Generated by scripts/generate-version.mjs; do not edit.
-export const VERSION = "0.3.0";
-export const GIT_COMMIT = "7db83bb";
+export const VERSION = "0.4.0";
+export const GIT_COMMIT = "e5c1eb5";

package/dist/index.js

@@ -12,6 +12,7 @@ import { toolHandlers } from "./tool-handlers.js";
 import { defineTool, TOOL_DESCRIPTIONS, toolOutput, TOOLS, } from "./tool-schemas.js";
 import { toolCallView, toolResultView } from "./tool-views.js";
 import { registerCardRoute } from "./card-route.js";
+import { dshVersion } from "./dsh-version.js";
 import { registerTerminalRoutes } from "./terminal-route.js";
 import { TerminalSessions } from "./terminal-sessions.js";
 import { normalizeToolError, WorkspaceResolver } from "./workspace-binding.js";
@@ -103,7 +104,11 @@ export function apply(ctx, config) {
     ctx.inject(["settings"], (child) => {
         child.effect(() => child.settings.configure({ auto: false }, ctx.fiber), "podman: settings presentation");
     });
-    registerCardRoute(ctx, resolver, ctx.workspaceRegistry, readLocale);
+    // The harness version is read through the profile's package lookup: the dsh
+    // app package is served from the loader's in-memory table, not a physical
+    // node_modules entry. It is resolved once and served with every snapshot.
+    const dshVersionValue = dshVersion(ctx.get("pluginPackages"));
+    registerCardRoute(ctx, resolver, ctx.workspaceRegistry, readLocale, dshVersionValue);
     // The Podman terminal tab talks to guest ptys through its own routes; the
     // registry keeps shells alive while the browser is away.
     const terminalSessions = new TerminalSessions({ resolver });

package/dist/workspace-binding.test.js

@@ -8,7 +8,7 @@ import loader from "@grpc/proto-loader";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
 import { tmpdir } from "node:os";
-import { mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, rmSync } from "node:fs";
 import { controlClient, guestClient } from "./grpc/runtime-client.js";
 import { containerNotFound, metadata, normalizeToolError, WorkspaceResolver, workspaceSlug, } from "./workspace-binding.js";
 import { VERSION } from "./generated/version.js";
@@ -190,9 +190,20 @@ async function startControlServer(containers = [], options = {}) {
         versions,
         createRequests,
         recreateRequests,
-        stop: () => server.forceShutdown(),
+        stop: () => {
+            server.forceShutdown();
+            // gRPC unlinks its sockets on shutdown; drop the root too so repeated
+            // runs do not accumulate directories under the system temp dir.
+            rmSync(socketsRoot, { recursive: true, force: true });
+        },
     };
 }
+test("the control server cleanup removes its temp root", async () => {
+    const control = await startControlServer();
+    assert.ok(existsSync(control.socketsRoot));
+    control.stop();
+    assert.equal(existsSync(control.socketsRoot), false);
+});
 test("control calls carry the bearer token", async () => {
     const { socketsRoot, received, versions, stop } = await startControlServer();
     try {

package/docs/usage.md

@@ -49,6 +49,18 @@ dsh-podman organizes the images its containers run into three tiers:
 Image references (`imageId`, `parent`, `image`) are **short names only** (no
 registry prefix, no `:tag`).
 
+### Base images
+
+Each base image is built from its primitive reference with the same fixed,
+dsh-podman-owned package list, and a custom image inherits its parent's package
+manager.
+
+| Short name  | Package manager | Primitive                            | Packages                                                                                                                                                                                                |
+| ----------- | --------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `archlinux` | `pacman`        | `docker.io/library/archlinux:latest` | `base-devel`, `ca-certificates`, `curl`, `diffutils`, `fd`, `git`, `inetutils`, `jq`, `less`, `openbsd-netcat`, `openssh`, `patch`, `procps-ng`, `python`, `ripgrep`, `tree`, `unzip`, `wget`, `zstd`   |
+| `ubuntu`    | `apt`           | `docker.io/library/ubuntu:latest`    | `build-essential`, `ca-certificates`, `curl`, `diffutils`, `fd-find`, `git`, `jq`, `less`, `netcat-openbsd`, `openssh-client`, `patch`, `procps`, `python3`, `ripgrep`, `tree`, `unzip`, `wget`, `zstd` |
+| `alpine`    | `apk`           | `docker.io/library/alpine:latest`    | `bash`, `build-base`, `ca-certificates`, `curl`, `diffutils`, `fd`, `git`, `jq`, `less`, `openssh-client`, `patch`, `procps`, `python3`, `ripgrep`, `tree`, `unzip`, `wget`, `zstd`                     |
+
 ## Tools
 
 The plugin registers the following model-facing tools. Tools marked `✱` require

package/docs/usage.zh.md

@@ -42,6 +42,17 @@ dsh-podman 将容器运行的镜像组织为三个层级：
 镜像引用（`imageId`、`parent`、`image`）**只能是短名称**（没有镜像仓库前缀，没有
 `:tag`）。
 
+### 基础镜像
+
+每个基础镜像都从其原始引用构建，安装同一份由 dsh-podman
+拥有的固定软件包列表；自定义镜像继承其父镜像的软件包管理器。
+
+| 短名称      | 软件包管理器 | 原始镜像                             | 软件包                                                                                                                                                                                                  |
+| ----------- | ------------ | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `archlinux` | `pacman`     | `docker.io/library/archlinux:latest` | `base-devel`、`ca-certificates`、`curl`、`diffutils`、`fd`、`git`、`inetutils`、`jq`、`less`、`openbsd-netcat`、`openssh`、`patch`、`procps-ng`、`python`、`ripgrep`、`tree`、`unzip`、`wget`、`zstd`   |
+| `ubuntu`    | `apt`        | `docker.io/library/ubuntu:latest`    | `build-essential`、`ca-certificates`、`curl`、`diffutils`、`fd-find`、`git`、`jq`、`less`、`netcat-openbsd`、`openssh-client`、`patch`、`procps`、`python3`、`ripgrep`、`tree`、`unzip`、`wget`、`zstd` |
+| `alpine`    | `apk`        | `docker.io/library/alpine:latest`    | `bash`、`build-base`、`ca-certificates`、`curl`、`diffutils`、`fd`、`git`、`jq`、`less`、`openssh-client`、`patch`、`procps`、`python3`、`ripgrep`、`tree`、`unzip`、`wget`、`zstd`                     |
+
 ## 工具
 
 插件注册了以下面向模型的工具。标记 `✱`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exagone313/dsh-podman",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Podman-backed execution for DeepSeek Harness (dsh).",
   "license": "MIT",
   "repository": {