@hyzyn/dsh-docker 0.5.0 → 0.5.1

package/README.en.md

@@ -6,11 +6,11 @@
 
 ## Features
 
-- **Many targets, one screen**: the "Overview" page fetches in parallel and one target failing does not affect the others; on the agent side `docker_ps target:'*'` gets the whole picture in one call.
-- **The "needs attention" criteria are accurate**: unhealthy / repeatedly restarting / **OOM-killed** / non-zero exit / zombie — OOM and the real exit code come from one `docker inspect` (a `ps` summary cannot tell whether 137 was an OOM kill or a manual kill).
-- **Four live SSE streams**: log FOLLOW, `docker stats`, `docker events` and `docker pull` share one piece of infrastructure (heartbeat / active-stream registry / teardown on disconnect); merged logs from a multi-select can be merged into one true timeline by timestamp, and "pause" is a real freeze.
-- **Read-only by default**: start / stop / remove, exec and image mutations all require switches explicitly enabled in settings; while they are off the tools are not registered and the routes return 403; passwords and passphrases are never sent back to the browser.
-- **tty is an optional partner**: with it installed there is an extra "Containers" button in the connection bar, SSH targets can reference connection-book entries directly, and cards gain a "Terminal" button that goes straight into the container; it also works without tty (degrading to copying the command).
+- **Aggregated fetches across targets**: the Overview page fans out over every `targets[]` entry in parallel, and an unreachable target only spoils its own cell; the agent side exposes the same shape through `docker_ps target:"*"` / `docker_attention target:"*"`, so targets never block one another.
+- **"Needs attention" reads authoritative fields**: unhealthy / repeatedly restarting / OOM-killed / non-zero exit / dead; OOM and the real exit code come from one `docker inspect` — the 137 in a `docker ps` summary cannot separate an OOM kill from a manual kill, so filtering on the summary alone must misreport.
+- **Four long-lived SSE streams on one substrate**: log FOLLOW, `docker stats`, `docker events` and `docker pull` all run through the same `openSseStream` (heartbeat / active-stream registry / teardown on disconnect) and differ only in how they end — logs and pulls finish on their own, stats and events are aborted by the browser. Multi-select merged logs recover true cross-container ordering from the `--timestamps` prefix; "pause" freezes rendering only (the stream keeps receiving and flushes in one batch on resume).
+- **Read-only by default, capability switches in three tiers**: start / stop / remove, exec and image mutations are independent switches; while one is off the agent tools are **not registered** and the HTTP routes return 403 (the capability does not exist, rather than failing when called). Container names and IDs pass a whitelist, every command is built as argv with single-quote escaping, and passwords / passphrases are referenced as `env:VAR` and never sent back to the browser.
+- **Data-level reuse of dsh-tty, no code coupling**: no tty code is imported and tty needs no source change, so the two install and upgrade independently; with tty present three optional extension points are consumed — connection-bar actions (`ttyConnbar`), the right-side dock host (`ttyPanel.mountPane`) and the in-container terminal drawer (`ttyTerminal.mount`, embedded in place or opened as a tab by negotiated version) — and each degrades silently without tty or below the required version.
 
 ## Relationship with dsh-tty
 

package/README.md

@@ -6,11 +6,11 @@
 
 ## 特性
 
-- **多目标一屏**：总览页并行取数、单目标失败不影响其余；agent 侧 `docker_ps target:'*'` 一次拿全局。
-- **「需关注」口径够准**：不健康 / 反复重启 / **被 OOM 杀** / 非零退出 / 僵死——OOM 与真实退出码由一次 `docker inspect` 给出（`ps` 摘要分不出 137 是 OOM 还是手动 kill）。
-- **四条 SSE 实时流**：日志 FOLLOW、`docker stats`、`docker events`、`docker pull` 共用一套基建（心跳 / 活跃流登记 / 断开清理）；多选聚合日志可按时间戳合成一条真时间线，「暂停」是真冻结。
-- **默认只读**：启停删 / exec / 镜像变更都要在设置里显式开开关，关着时工具不注册、路由 403；密码与口令永不回传浏览器。
-- **tty 是可选搭档**：装了就在连接栏多一个「容器」按钮、SSH 目标可直接引用连接簿条目、卡片上多「终端」按钮直进容器；不装也能用（退化为复制命令）。
+- **多目标聚合取数**：总览页对全部 `targets[]` 并行请求，单个目标不可达只污染自己那一格；agent 侧同一口径由 `docker_ps target:"*"` / `docker_attention target:"*"` 暴露，跨目标不互相阻塞。
+- **「需关注」读权威字段**：不健康 / 反复重启 / OOM 被杀 / 非零退出 / 僵死；OOM 与真实退出码由一次 `docker inspect` 补齐——`docker ps` 摘要里的 137 分不出 OOM 与手动 kill，只按摘要筛必然误报。
+- **四条 SSE 长流共用一套基建**：日志 FOLLOW、`docker stats`、`docker events`、`docker pull` 走同一个 `openSseStream`（心跳 / 活跃流登记 / 断开清理），差异只在收尾语义——日志与拉取自然结束，统计与事件由前端主动断。多选聚合日志按 `--timestamps` 前缀还原跨容器真实时序，「暂停」只冻结渲染（流继续接收，恢复时一次性补齐）。
+- **默认只读，能力开关分三级**：启停删 / exec / 镜像变更各自独立开关，未开启时 agent 工具**不注册**、HTTP 路由 403（能力不存在，而非调用后报错）；容器名与 ID 过白名单，命令一律 argv 构造 + 单引号转义，密码 / 口令以 `env:VAR` 引用且永不回传浏览器。
+- **与 dsh-tty 数据级复用、代码级不耦合**：不 import 任何 tty 代码，tty 也无需改一行源码，两者可各自安装与升级；装了 tty 则消费三个可选扩展点——连接栏动作（`ttyConnbar`）、右侧 dock 承载（`ttyPanel.mountPane`）、容器内终端抽屉（`ttyTerminal.mount`，就地嵌入或开标签按版本协商），未装或版本不足逐项静默降级。
 
 ## 与 dsh-tty 的关系
 

package/client.js

@@ -887,6 +887,16 @@
   padding: var(--dk-gap-xs) 92px var(--dk-gap-xs) 0;
 }
 
+/**
+ * \u540C\u4E00\u6761\u8FC7\u6EE4\u884C\u6302\u5728\u4E24\u5904\uFF0C\u4F38\u7F29\u8F74\u4E0D\u540C\uFF0C\u5FC5\u987B\u5206\u5F00\u5BF9\u5F85\uFF1A
+ *   - \u5355\u5BB9\u5668\u65E5\u5FD7\uFF1A\u5B83\u5728 \`.dk_tabs\`\uFF08\u6A2A\u5411\u884C\uFF09\u91CC\uFF0C\`flex: 1 1 auto\` \u662F\u300C\u6A2A\u5411\u5360\u6EE1\u5269\u4F59\u5BBD\u5EA6\u300D\uFF0C\u6B63\u786E\uFF1B
+ *   - \u805A\u5408\u65E5\u5FD7\uFF08ComposeLogs\uFF09\uFF1A\u5B83\u662F \`.dk_logs\`\uFF08\u7EB5\u5411 flex\uFF09\u7684\u76F4\u63A5\u5B50\u9879\uFF0C\u6B64\u65F6 \`flex: 1 1 auto\`
+ *     \u4F1A\u53D8\u6210**\u7EB5\u5411\u6491\u9AD8**\u2014\u2014\u8FC7\u6EE4\u5230\u5C11\u91CF\u884C\u65F6\u65E5\u5FD7\u4F53\u57FA\u51C6\u9AD8\u5EA6\u53D8\u5C0F\u3001\u5269\u4F59\u7A7A\u95F4\u51FA\u73B0\uFF0C\u5DE5\u5177\u6761\u4E0E
+ *     \`.dk_logBody\` \u5404\u5206\u4E00\u534A\uFF0C\u6574\u6761\u5DE5\u5177\u6761\u957F\u6210\u4E24\u767E\u591A\u50CF\u7D20\u7684\u6A2A\u6761\uFF08\u8F93\u5165\u6846\u5782\u76F4\u5C45\u4E2D\u3001\u72B6\u6001\u884C\u88AB
+ *     \u9876\u5230\u4E0B\u9762\uFF09\uFF0C\u4E5F\u5C31\u662F\u300C\u8F93\u5165\u6587\u5B57\u540E\u754C\u9762\u53D8\u5F62\u300D\u3002\u5DE5\u5177\u6761\u662F\u56FA\u5B9A\u9AD8\u5EA6\u7684\u4E00\u884C\uFF0C\u4E0D\u8BE5\u53C2\u4E0E\u7EB5\u5411\u4F38\u7F29\u3002
+ */
+.dk_logs > .dk_filterBar { flex: 0 0 auto; }
+
 .dk_tab {
   height: var(--dk-h-lg);
   padding: 0 var(--dk-gap-md);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyzyn/dsh-docker",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "DSH Web GUI 的 Docker 容器面板插件：本机或 SSH 主机上的容器列表 / 启停删 / 日志 / 统计 / 镜像 / 一次性 exec，默认只读，配套只读优先的 agent 工具。",
   "keywords": [
     "dsh",