npm - @stardustlc/dsh-docker - Versions diffs - 0.2.0 → 0.3.1 - Mend

@stardustlc/dsh-docker 0.2.0 → 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/LICENSE ADDED Viewed

@@ -0,0 +1,21 @@
+MIT License
+Copyright (c) 2026 stardustlc
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md CHANGED Viewed

@@ -6,10 +6,14 @@
 DSH (DeepSeek Harness) container-management plugin: runs the docker CLI through the official subprocess service with shell-free argv arrays, six tools including image listing, an approval gate on `docker_exec`, and **zero runtime dependencies**.
-![npm version](https://img.shields.io/npm/v/dsh-docker?label=npm&color=blue) ![npm downloads](https://img.shields.io/npm/dm/dsh-docker) ![license](https://img.shields.io/npm/l/dsh-docker) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-docker?style=social)
+![npm version](https://img.shields.io/npm/v/@stardustlc/dsh-docker?label=npm&color=blue) ![npm downloads](https://img.shields.io/npm/dm/@stardustlc/dsh-docker) ![license](https://img.shields.io/npm/l/@stardustlc/dsh-docker) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-docker?style=social)
 [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
+## Compatibility
+Verified against source-run `@deepseek-ai/dsh@0.1.2-alpha.4` on 2026-09-02. Built for the cordis patch-bundle plugin model (`cordis.patch.yml` + `dsh.bundle.patch`). No runtime imports of `@deepseek-ai/*` internals.
 ## Installation
 ```bash
@@ -18,6 +22,15 @@ dsh plugin --profile web add @stardustlc/dsh-docker
 Requires Docker installed locally (`docker version` should work); use `dockerPath` when it is not on PATH.
+## Uninstall
+```bash
+dsh plugin --profile web remove @stardustlc/dsh-docker
+```
+Then restart the web service. To clean up fully, also remove the plugin entry from your profile `cordis.patch.yml` if you overrode it.
 ## Configuration
 ```yaml

package/README.md CHANGED Viewed

@@ -6,10 +6,14 @@
 DSH（DeepSeek Harness）容器管理插件：走官方 subprocess 服务跑 docker CLI，argv 数组无 shell 注入，`docker_exec` 默认审批门，**零运行时依赖**。
-![npm version](https://img.shields.io/npm/v/dsh-docker?label=npm&color=blue) ![npm downloads](https://img.shields.io/npm/dm/dsh-docker) ![license](https://img.shields.io/npm/l/dsh-docker) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-docker?style=social)
+![npm version](https://img.shields.io/npm/v/@stardustlc/dsh-docker?label=npm&color=blue) ![npm downloads](https://img.shields.io/npm/dm/@stardustlc/dsh-docker) ![license](https://img.shields.io/npm/l/@stardustlc/dsh-docker) ![stars](https://img.shields.io/github/stars/STARDUSTLC666/dsh-docker?style=social)
 [![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
+## 兼容性
+在 `@deepseek-ai/dsh@0.1.2-alpha.4` 源码模式下验证（2026-09-02）。遵循 cordis 组合包补丁模型（`cordis.patch.yml` + `dsh.bundle.patch`），运行时不 import 任何 `@deepseek-ai/*` 内部模块。
 ## 安装
 ```bash
@@ -18,6 +22,15 @@ dsh plugin --profile web add @stardustlc/dsh-docker
 需要本机装有 Docker（`docker version` 能出结果即可）；不在 PATH 上时用 `dockerPath` 指定。
+## 卸载
+```bash
+dsh plugin --profile web remove @stardustlc/dsh-docker
+```
+卸载后重启 Web 服务。如需彻底清理，可再手动删除自己 profile `cordis.patch.yml` 中覆盖的插件行。
 ## 配置
 ```yaml

package/lib/index.d.ts CHANGED Viewed

@@ -11,29 +11,35 @@ import { type DockerConfig } from './config.js';
 import { type SubprocessSpawnLike } from './exec.js';
 import { type DockerToolDefinition } from './tools.js';
 /** cordis 服务注入：apply 里要用 ctx.subprocess 与 ctx.tools。 */
+export declare const name = "docker";
 export declare const inject: string[];
-/** 审批服务最小面。 */
-export interface DockerApproval {
-    request(options: {
-        agent?: unknown;
-        toolName?: unknown;
-        callId?: unknown;
-        reason: string;
-        signal?: unknown;
-    }): Promise<'allowed-once' | 'cancelled' | 'unavailable' | string>;
+/** Harness `tools/pre-execute` 的决策结果。 */
+type DockerPreToolDecision = {
+    kind: 'allow';
+} | {
+    kind: 'deny';
+    reason: string;
+} | {
+    kind: 'ask';
+    reason?: string;
+};
+/** 审批策略需要读取的 alpha.4 工具执行字段。 */
+interface DockerToolExecution {
+    readonly name: string;
+    readonly arguments: unknown;
 }
+/** Harness `tools/pre-execute` waterfall 监听器。 */
+type DockerPreExecuteListener = (exec: DockerToolExecution, next: () => Promise<DockerPreToolDecision>) => Promise<DockerPreToolDecision>;
 /** 插件所需的最小 ctx 面。 */
 export interface DockerPluginContext {
     subprocess: {
         spawn: SubprocessSpawnLike;
     };
     tools: {
-        register(definition: DockerToolDefinition, options?: {
-            prepend?: boolean;
-        }): () => void;
+        register(definition: DockerToolDefinition): () => void;
     };
-    get?(name: 'approval'): DockerApproval | undefined;
-    on?(event: string, listener: () => void): () => void;
+    on(event: 'tools/pre-execute', listener: DockerPreExecuteListener): () => void;
+    on(event: 'dispose', listener: () => void): () => void;
 }
 /**
  * 插件入口：解析配置、封装执行器、注册六工具；docker_exec 注入审批门。

package/lib/index.js CHANGED Viewed

@@ -11,6 +11,7 @@ import { resolveConfig } from './config.js';
 import { createSubprocessRunner } from './exec.js';
 import { buildDockerTools } from './tools.js';
 /** cordis 服务注入：apply 里要用 ctx.subprocess 与 ctx.tools。 */
+export const name = 'docker';
 export const inject = ['subprocess', 'tools'];
 /**
  * 插件入口：解析配置、封装执行器、注册六工具；docker_exec 注入审批门。
@@ -26,42 +27,27 @@ export function apply(ctx, config) {
     }
     const runner = createSubprocessRunner(ctx.subprocess.spawn, cfg.graceMs, cfg.timeoutMs);
     const tools = buildDockerTools(cfg, runner);
-    const disposers = [];
-    for (const definition of tools) {
-        if (definition.name === 'docker_exec' && cfg.execApproval) {
-            definition.gate = async (exec, next) => {
-                const approval = ctx.get?.('approval');
-                if (approval === undefined) {
-                    return { kind: 'deny', reason: 'docker_exec 需要确认，但当前环境没有审批通道（如 headless）。如确定安全，可在配置中设置 execApproval: false 后直接执行。' };
-                }
-                const record = (typeof exec === 'object' && exec !== null ? exec : {});
-                const args = (typeof record.args === 'object' && record.args !== null ? record.args : {});
-                const command = typeof args.command === 'string' ? args.command : '';
-                const container = typeof args.container === 'string' ? args.container : '';
-                const outcome = await approval.request({
-                    agent: record.agent,
-                    toolName: record.name,
-                    callId: record.callId,
-                    reason: '在容器 ' + container + ' 内执行：' + command.slice(0, 200),
-                    signal: record.signal,
-                });
-                if (outcome === 'allowed-once')
-                    return next();
-                if (outcome === 'cancelled')
-                    return { kind: 'deny', reason: '容器内执行确认被取消，命令未执行。' };
-                if (outcome === 'unavailable')
-                    return { kind: 'deny', reason: '容器内执行确认不可用（没有可用的审批界面），命令未执行。' };
-                return { kind: 'deny', reason: '容器内执行未获批准：要么你拒绝了，要么当前会话处于 Full Access（审批策略 never）。若在 Full Access：切到 Read Only / Write 再执行，或关闭 execApproval（自行承担风险）。' };
+    if (cfg.execApproval) {
+        ctx.on('tools/pre-execute', async (exec, next) => {
+            if (exec.name !== 'docker_exec')
+                return next();
+            const args = (typeof exec.arguments === 'object' && exec.arguments !== null ? exec.arguments : {});
+            const command = typeof args.command === 'string' ? args.command : '';
+            const container = typeof args.container === 'string' ? args.container : '';
+            return {
+                kind: 'ask',
+                reason: 'docker_exec 需要确认：在容器 ' + (container || '（未指定）') + ' 内执行：' + command.slice(0, 200) + (command.length > 200 ? '…' : ''),
             };
-        }
-        disposers.push(ctx.tools.register(definition, { prepend: true }));
-    }
-    if (typeof ctx.on === 'function') {
-        ctx.on('dispose', () => {
-            for (const dispose of disposers)
-                dispose();
         });
     }
+    const disposers = [];
+    for (const definition of tools) {
+        disposers.push(ctx.tools.register(definition));
+    }
+    ctx.on('dispose', () => {
+        for (const dispose of disposers)
+            dispose();
+    });
 }
 export * from './args.js';
 export * from './config.js';

package/lib/tools.d.ts CHANGED Viewed

@@ -17,7 +17,6 @@ export interface DockerToolDefinition {
         render(args: unknown, value: unknown): ContentBlock[];
     };
     execute(args: unknown, exec: unknown): Promise<unknown>;
-    gate?(exec: unknown, next: () => Promise<unknown>): Promise<unknown>;
     timeoutMs?: number;
 }
 /** 构建五个工具定义。 */

package/lib/tools.js CHANGED Viewed

@@ -209,9 +209,6 @@ export function buildDockerTools(config, runner) {
             const result = await runChecked(runner, execArgs(cfg.dockerPath, container, command), timeout, 'docker exec');
             return { container, exitCode: result.exitCode, stdout: result.stdout };
         },
-        gate(exec, next) {
-            return next();
-        },
         timeoutMs: timeout,
     };
     const dockerManage = {
@@ -239,5 +236,39 @@ export function buildDockerTools(config, runner) {
         },
         timeoutMs: timeout,
     };
-    return [dockerPs, dockerLogs, dockerImages, dockerInspect, dockerExec, dockerManage];
+    const dockerHealth = {
+        name: 'docker_health',
+        description: 'dsh-docker 自检：验证 docker CLI 与守护进程是否可用（执行 docker version），并汇总安全配置（exec 审批门、超时）。遇到问题时先运行本工具定位。',
+        parameters: compileParameters({}),
+        output: {
+            schema: { type: 'object', additionalProperties: true },
+            render: (_args, value) => {
+                const rec = asRecord(value);
+                const checks = Array.isArray(rec.checks) ? rec.checks : [];
+                const lines = ['dsh-docker 自检' + (rec.ok === true ? '：正常。' : '：发现问题。')];
+                for (const item of checks) {
+                    const c = asRecord(item);
+                    lines.push('- ' + c.name + '：' + (c.ok === true ? '✅' : '❌ ' + String(c.detail ?? '')));
+                }
+                return [{ type: 'text', text: lines.join('\n') }];
+            },
+        },
+        async execute() {
+            const checks = [];
+            let ok = true;
+            try {
+                const result = await runChecked(runner, [cfg.dockerPath, 'version', '--format', '{{.Server.Version}}'], 15000, 'docker version');
+                checks.push({ name: 'docker daemon', ok: true, detail: 'server ' + result.stdout.trim() });
+            }
+            catch (error) {
+                ok = false;
+                checks.push({ name: 'docker daemon', ok: false, detail: error instanceof Error ? error.message : String(error) });
+            }
+            checks.push({ name: 'exec 审批门', ok: true, detail: cfg.execApproval === true ? '开启' : '关闭' });
+            checks.push({ name: '超时配置', ok: true, detail: 'timeoutMs=' + cfg.timeoutMs + ', graceMs=' + cfg.graceMs });
+            return { ok, plugin: 'dsh-docker', checks };
+        },
+        timeoutMs: 20000,
+    };
+    return [dockerPs, dockerLogs, dockerImages, dockerInspect, dockerExec, dockerManage, dockerHealth];
 }

package/package.json CHANGED Viewed

@@ -1,60 +1,59 @@
-{
-  "name": "@stardustlc/dsh-docker",
-  "version": "0.2.0",
-  "description": "DSH 容器管理插件：docker_ps/logs/images/inspect/exec/manage 六工具，走官方 subprocess 服务跑 docker CLI、argv 无 shell 注入、exec 审批门、零运行时依赖。",
-  "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "cordis.patch.yml",
-    "README.md",
-    "README.en.md"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "prepare": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
-    "prepublishOnly": "pnpm run build"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  },
-  "keywords": [
-    "dsh",
-    "deepseek-harness",
-    "plugin",
-    "docker",
-    "container",
-    "devops"
-  ],
-  "license": "MIT",
-  "engines": {
-    "node": ">=20"
-  },
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "typescript": "^5.6.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/STARDUSTLC666/dsh-docker.git"
-  },
-  "bugs": {
-    "url": "https://github.com/STARDUSTLC666/dsh-docker/issues"
-  },
-  "homepage": "https://github.com/STARDUSTLC666/dsh-docker#readme",
-  "author": "stardustlc",
-  "packageManager": "pnpm@11.7.0"
-}
+{
+  "name": "@stardustlc/dsh-docker",
+  "version": "0.3.1",
+  "description": "DSH 容器管理插件：docker_ps/logs/images/inspect/exec/manage 六工具，走官方 subprocess 服务跑 docker CLI、argv 无 shell 注入、exec 审批门、零运行时依赖。",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm run build && node --test \"test/*.test.mjs\"",
+    "prepublishOnly": "pnpm run build"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "docker",
+    "container",
+    "devops"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.6.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/STARDUSTLC666/dsh-docker.git"
+  },
+  "bugs": {
+    "url": "https://github.com/STARDUSTLC666/dsh-docker/issues"
+  },
+  "homepage": "https://github.com/STARDUSTLC666/dsh-docker#readme",
+  "author": "stardustlc",
+  "packageManager": "pnpm@11.7.0"
+}