dsh-eval-guard 0.1.2 → 0.1.4

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 huhu233
+Copyright (c) 2026 huhu23333
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -6,7 +6,7 @@
 - 禁止联网、子代理、Agent Team/跨 agent 通信、读取其它工作区。
 - 工具黑名单可配置；未知工具默认放行，但 DSH 内置与 dsh-ops 的工具会做参数路径审计。
 - 每个用户消息后的单轮有可配置的最长时长（默认 90 分钟）；到点只终止当前轮次，并递归清理子代理与后台任务。
-- 设置页可安装“第 6 集 · 坦克大战”任务：空工作区 → 复制素材 → 新会话填入提示词（由用户发送）。
+- 设置页可安装“第 6 集 · 坦克大战”任务：空工作区 → 放入打包好的 `workspace.zip` → 新会话填入提示词（由用户发送）。
 
 插件默认关闭；关闭时不做任何行为。所有 run 记录、usage、violations 写入
 $DSH_HOME/eval-guard/runs/<run-id>/，供独立的 ../tank-eval 评测程序读取。
@@ -20,7 +20,7 @@ $DSH_HOME/eval-guard/runs/<run-id>/，供独立的 ../tank-eval 评测程序读
 - 使用版本：commit `6bd738b`（2026-10-16）
 - 素材来源：该仓库的 `tank/workspace/`（MIT License）
 
-本插件打包的 Linux 版 `workspace.zip` 在原素材基础上做了两处适配：把 `baseline.cpp` 编译为 Linux 可执行文件并移出源码；把 `clock.py` 改为单次 90 分钟版本。规则、引擎、本地裁判、模板等其余文件保持原样。
+本插件打包的 Linux 版 `workspace.zip` 在原素材基础上做了三处适配：把 `baseline.cpp` 编译为 Linux ELF 可执行文件并移出源码，文件名改为 `baseline`（不带 `.exe`）；把 `clock.py` 改为单次 90 分钟版本；`README.md` 中对应的 baseline 示例同步改名。规则、引擎、本地裁判、模板等其余文件保持原样。安装任务时只把 `workspace.zip` 放入工作区，不再散装解压。
 
 ## 构建
 
@@ -34,7 +34,7 @@ node scripts/build-native.mjs
 ~~~bash
 scripts/install.sh web
 # 如果脚本找不到 dsh 命令：
-DSH_CHECKOUT=/home/huhu233/otherProject/deepseek-harness scripts/install.sh web
+DSH_CHECKOUT=/path/to/deepseek-harness scripts/install.sh web
 # 然后重启 dsh web
 ~~~
 

package/lib/index.js

@@ -4,7 +4,7 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
-import { execFileSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 //#region src/config.ts
 /**
 * Plugin configuration. The Settings page writes this document through the
@@ -337,10 +337,29 @@ function packageRoot() {
 function supervisorPath() {
 	return path.join(packageRoot(), "native", "dsh-eval-supervisor");
 }
-/** The DSH home: $DSH_HOME or ~/.dsh. */
+/** Launcher-provided facts; nothing here is a fixed install path. */
+let runtimeHome;
+let runtimeProfileDir;
+/** Record the launcher's profile/home paths. */
+function configureRuntimeContext(next) {
+	if (next.home !== void 0 && next.home !== "") runtimeHome = next.home;
+	if (next.profileDir !== void 0 && next.profileDir !== "") runtimeProfileDir = next.profileDir;
+}
+/** The DSH home: launcher profile context, then $DSH_HOME, then ~/.dsh. */
 function dshHome() {
+	if (runtimeHome !== void 0) return runtimeHome;
 	return process.env.DSH_HOME && process.env.DSH_HOME !== "" ? process.env.DSH_HOME : path.join(os.homedir(), ".dsh");
 }
+/** Candidate node_modules directories, launcher profile first and then profiles/*. */
+function profileNodeModules() {
+	const out = [];
+	if (runtimeProfileDir !== void 0) out.push(path.join(runtimeProfileDir, "node_modules"));
+	const profiles = path.join(dshHome(), "profiles");
+	try {
+		for (const entry of fs.readdirSync(profiles, { withFileTypes: true })) if (entry.isDirectory()) out.push(path.join(profiles, entry.name, "node_modules"));
+	} catch {}
+	return out;
+}
 /** Root for run records, audits, and sandbox policy files. */
 function guardRoot() {
 	return path.join(dshHome(), "eval-guard");
@@ -381,14 +400,9 @@ function packageDir(name) {
 		const require = createRequire(path.join(process.cwd(), "noop.js"));
 		candidates.push(path.dirname(require.resolve(name + "/package.json")));
 	} catch {}
-	if (name === "@deepseek-ai/dsh-ptc-runtime-node") {
-		candidates.push(path.join(process.cwd(), "packages", "ptc-runtime", "ptc-runtime-node"));
-		candidates.push(path.join(dshHome(), "profiles", "web", "node_modules", name));
-	}
-	if (name === "@deepseek-ai/dsh-subprocess") {
-		candidates.push(path.join(process.cwd(), "packages", "subprocess", "subprocess"));
-		candidates.push(path.join(dshHome(), "profiles", "web", "node_modules", name));
-	}
+	if (name === "@deepseek-ai/dsh-ptc-runtime-node") candidates.push(path.join(process.cwd(), "packages", "ptc-runtime", "ptc-runtime-node"));
+	if (name === "@deepseek-ai/dsh-subprocess") candidates.push(path.join(process.cwd(), "packages", "subprocess", "subprocess"));
+	for (const modules of profileNodeModules()) candidates.push(path.join(modules, name));
 	for (const candidate of candidates) try {
 		if (fs.statSync(path.join(candidate, "package.json")).isFile()) return fs.realpathSync.native(candidate);
 	} catch {}
@@ -1421,7 +1435,7 @@ function registerRoutes(ctx, guard, tasks) {
 //#endregion
 //#region src/task.ts
 /**
-* The tank task pack: workspace extraction, prompt construction, and the one
+* The tank task pack: packaged workspace.zip install, prompt construction, and the one
 * run record the evaluator later reads.
 * @module dsh-eval-guard/task
 */
@@ -1429,7 +1443,7 @@ function registerRoutes(ctx, guard, tasks) {
 const TASKS = [{
 	id: TANK_TASK,
 	label: TANK_TASK_LABEL,
-	description: "1v1 坦克大战 bot：编写 submission/bot.cpp，评测时与基准及其它提交打循环赛。"
+	description: "1v1 坦克大战 bot：解压 workspace.zip 后编写 workspace/submission/bot.cpp，评测时与基准及其它提交打循环赛。"
 }];
 /** Format a blacklist for the prompt. */
 function blacklistBlock(blacklist) {
@@ -1455,19 +1469,23 @@ const TANK_DEFINITION = {
 			"",
 			"## 交付",
 			"",
-			"- 把最终 bot 保存到工作区内的 submission/bot.cpp（只需要这一个文件）。",
-			"- 交付前检查并关闭所有后台任务；最多 " + String(options.minutes ?? 90) + " 分钟，到点会被强制终止。",
+			"- 解压工作区里的 workspace.zip，把最终 bot 保存到解压后的 workspace/submission/bot.cpp（只需要这一个文件）。",
 			"- 最后用几句话说明你的策略。",
 			"",
+			"## 时间规则",
+			"",
+			"- 本次是**连续 " + String(options.minutes ?? 90) + " 分钟的单次任务**，从对话开始时开始计时。",
+			"- 交付前检查并关闭所有后台任务；到点会被强制终止。",
+			"- clock.py 从解压那一刻开始计算，而实际计时从对话开始计算；它**只能作为参考**，请尽快解压以减小误差。实际时间以评测守护为准。",
+			"",
 			"## 本次评测禁止调用的工具",
 			"",
 			blacklistBlock(blacklist),
 			"",
 			"## 工作区内容",
 			"",
-			"工作区根目录就是选手包：先读 README.md 和 RULES.md，规则引擎是 tank.hpp。",
-			"本地工具（arena.py、check、play、batch、vs 等）和起步模板都在工作区里，可直接使用。",
-			"README.md 里提到的上下半场属于原始赛制；clock.py 只是参考，本次是单次任务，以本提示词的时间规则为准。",
+			"工作区里有一个 workspace.zip；解压后进入 workspace/ 目录，先读 README.md 和 RULES.md，规则引擎是 tank.hpp。",
+			"本地工具（arena.py、check、play、batch、vs 等）和起步模板都在解压后的 workspace/ 里，可直接使用。",
 			"",
 			"开始吧。"
 		].join("\n");
@@ -1513,20 +1531,21 @@ var TaskService = class {
 			entries
 		};
 	}
-	/** Extract the task pack to a material directory the manual channel can reveal. */
-	materialDir() {
+	/** Copy the packaged workspace.zip to a stable material path for install/manual use. */
+	materialZip() {
 		const dir = path.join(guardRoot(), "material", "tank");
-		const marker = path.join(guardRoot(), "material", ".tank-complete");
-		if (fs.existsSync(marker) && fs.existsSync(path.join(dir, "RULES.md"))) return dir;
-		fs.rmSync(dir, {
-			recursive: true,
-			force: true
-		});
 		fs.mkdirSync(dir, { recursive: true });
-		fs.mkdirSync(path.dirname(marker), { recursive: true });
-		this.extract(TANK_DEFINITION.asset, dir);
-		fs.writeFileSync(marker, "ok\n", "utf8");
-		return dir;
+		const target = path.join(dir, "workspace.zip");
+		const source = TANK_DEFINITION.asset;
+		if (!fs.existsSync(source)) throw new Error("task asset is missing: " + source);
+		let stale = true;
+		try {
+			stale = !fs.existsSync(target) || fs.statSync(target).size !== fs.statSync(source).size;
+		} catch {
+			stale = true;
+		}
+		if (stale) fs.copyFileSync(source, target);
+		return target;
 	}
 	/** Install the task pack into an empty workspace. */
 	install(workspaceId, promptOverride) {
@@ -1549,7 +1568,7 @@ var TaskService = class {
 			error: "请先启用评测守护，再安装评测任务。"
 		};
 		try {
-			this.extract(TANK_DEFINITION.asset, checked.path);
+			fs.copyFileSync(this.materialZip(), path.join(checked.path, "workspace.zip"));
 		} catch (error) {
 			return {
 				ok: false,
@@ -1559,7 +1578,7 @@ var TaskService = class {
 			};
 		}
 		const runId = this.newRunId();
-		const prompt = promptOverride ?? this.guard.promptFor(checked.path, this.materialDir());
+		const prompt = promptOverride ?? this.guard.promptFor(checked.path, this.materialZip());
 		const run = {
 			runId,
 			task: TANK_TASK,
@@ -1585,39 +1604,16 @@ var TaskService = class {
 	/** The prompt for manual copying, without installing anything. */
 	prompt(workspaceId) {
 		const workspace = this.registry.get(workspaceId);
-		return this.guard.promptFor(workspace?.path ?? "", this.materialDir());
+		return this.guard.promptFor(workspace?.path ?? "", this.materialZip());
 	}
 	/** Filesystem paths for the manual channel. */
 	manualPaths(workspaceId) {
 		const workspace = this.registry.get(workspaceId);
 		return {
-			source: this.materialDir(),
-			prompt: this.guard.promptFor(workspace?.path ?? "", this.materialDir())
+			source: this.materialZip(),
+			prompt: this.guard.promptFor(workspace?.path ?? "", this.materialZip())
 		};
 	}
-	/** Extract a workspace.zip into a destination, stripping the workspace/ prefix. */
-	extract(zip, destination) {
-		if (!fs.existsSync(zip)) throw new Error("task asset is missing: " + zip);
-		fs.mkdirSync(path.join(guardRoot(), "tmp"), { recursive: true });
-		const temporary = fs.mkdtempSync(path.join(guardRoot(), "tmp", "extract-"));
-		try {
-			execFileSync("unzip", [
-				"-q",
-				"-o",
-				zip,
-				"-d",
-				temporary
-			], { stdio: "ignore" });
-			const inner = path.join(temporary, "workspace");
-			if (!fs.existsSync(inner)) throw new Error("task asset has no workspace/ root");
-			fs.cpSync(inner, destination, { recursive: true });
-		} finally {
-			fs.rmSync(temporary, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
 	/** A unique run id. */
 	newRunId() {
 		return (/* @__PURE__ */ new Date()).toISOString().replace(/[-:.TZ]/g, "").slice(0, 14) + "-" + Math.random().toString(16).slice(2, 8);
@@ -1650,6 +1646,12 @@ function apply(ctx, config) {
 		"sandboxPolicy",
 		"workspaceRegistry"
 	], (child) => {
+		const getService = ctx.get;
+		const profile = typeof getService === "function" ? getService.call(ctx, "profileContext") : void 0;
+		configureRuntimeContext({
+			home: profile?.home,
+			profileDir: profile?.dir
+		});
 		const services = {
 			sessions: child.get("sessions"),
 			agents: child.get("agents"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-eval-guard",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "description": "Evaluation guard for DSH: workspace-only filesystem, no network/subagents, wall-clock limits, and task installation for the meow-ai-arena tank task.",
   "license": "MIT",