1panel-toolkit 0.3.0__tar.gz → 0.3.2__tar.gz

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/CHANGELOG.md

@@ -1,5 +1,74 @@
 # 变更记录
 
+## 0.3.2 — 2026-09-20
+
+`p1 depth` 的判定阈值校准。用 `p1 fix` 收敛用户自己的四个包时发现的误判。
+
+### 判定：只缺一个维度不再是 thin
+
+原来的 `assess()` 是"三个多样性维度（对外端口 / 持久化挂载 / 应用自有变量）里
+缺任意一个 → thin"。于是 `xiaozhi-esp32-server` 被判成 `thin`——可它有 2 个对外端口、
+2 个挂载点（其中一个还是模型文件 `model.pt`）、`security_opt`、`init.sh`，只是把配置
+全放在挂载的 `data/.config.yaml` 里，本来就不该有应用变量。
+
+现在：**缺两个及以上才算薄**；只缺一个仍是 `adapted`，但会打一条 `·` 说明；
+与不相干官方包重合 ≥ 50% 仍是 `possibly-reskinned`。顺带 `p1 depth <包>`
+不再需要 `--corpus` 也会给判定（只有"最接近的官方包"那节需要语料）。
+
+四个真实包的判定：hindsight `adapted`、openviking `adapted`、
+xiaozhi-esp32-server `adapted`（附一条"没有任何应用自有环境变量"的说明）、
+xiaozhi-esp32-server-full `adapted`。
+
+### 验证
+
+- 新增 2 条测试（缺一个维度 → adapted + note；缺两个 → thin），`pytest` 257 passed。
+- 收敛后的四个包 `p1 check`：hindsight `0 fail, 2 warn`、openviking `0 fail, 1 warn`、
+  xiaozhi-esp32-server `0 fail, 1 warn`、xiaozhi-esp32-server-full `OK  no issues`，
+  与 README 表格一致；`p1 fix` 二次运行四个包都是"没有需要修复的内容"（幂等）。
+
+## 0.3.1 — 2026-09-20
+
+独立验证（另一个 session 的只读复现）挖出的三个真 bug，外加发布产物卫生。
+其中第 1 条从 0.1.0 起就在**每一个已发布版本**里，PyPI 上的 0.3.0 同样中招。
+
+### 修掉的 bug
+
+- **`p1 resolve` 会被容器内挂载路径打崩**：`draft_spec` 里
+  `host, target = entry.split(":", 1)` 覆盖了同名函数参数，于是
+  `repo_key(target, ...)` 拿到的是 `/app/data` 这种容器路径而不是仓库路径。本地检出
+  的主服务 compose 只要带 `volumes`，`p1 resolve` 就直接
+  `error: cannot interpret '/otel-lgtm/...'`、exit 2、一个文件都不写；运气"好"时
+  （容器路径恰好能被当成路径解析）则静默算出错误的 `key`。0.2.0 修过
+  `for target in mounts` 那处同名覆盖，漏了 `primary_volumes` 这处。
+- **多服务 compose 的挂载点被并进主服务**：主服务 `/app/data`（host `~/.app`）与
+  sidecar `./Caddyfile:/etc/caddy/Caddyfile` 会被配成 `~/.app:/etc/caddy/Caddyfile`，
+  等于把应用的宿主目录 bind 到另一个服务的容器路径上。这种包证据审计 0 fail、
+  `p1 check` 0 fail——因为那个容器路径确实在 D03 证据里，正是 D03 想拦的"挂错路径"。
+  新增 `analyze.service_mounts()` 按服务归属解析；draft 只描述主服务，其它服务的
+  挂载点写进 `notes`（并出现在 `decision-report.md`）交给人判断。
+- **`mounts` 里缺 `target` 的条目被静默丢弃**：`mount_host` 写错会被阻塞，同样意图
+  写进 `mounts[]` 写错却 rc=0、无 volume、无提示。现在按 D03 阻塞；半坏不坏的
+  `mounts` 列表也不会被"修好一半"。
+- 本地检出的产品名不再是一整条路径：`local:D:\...\OpenViking-main` 以前会原样进
+  `name`，现在取目录名。
+
+### 产物卫生
+
+- 发布物不再带真实服务器 IP（`cli.py` help 示例、`lessons.yaml` 的 L005 案例、
+  README 示例、`tests/test_config.py`）——统一换成文档用地址 `203.0.113.10`；
+  `tests/test_config.py` 里的私钥路径也换成占位值。
+- `_debug_*` 与 `*.log` 加进构建排除列表，一次性排查脚本不会再被扫进 sdist。
+  注意 `1panel-toolkit\_debug_resolve.py/.log/.err` 三个文件仍在磁盘上
+  （本会话的删除命令被策略拦下），可手动删除。
+
+### 验证
+
+- 新增 5 条回归测试（容器路径不破坏 key、本地检出命名、按服务归属挂载、
+  `mounts` 缺 target 被拒、半坏 `mounts` 被拒），255 passed。
+- 复现用例：带 `- ./x:/otel-lgtm/.../dash.yaml:ro` 的 5 行 compose，修复前
+  `p1 resolve` exit 2；修复后正常产出 spec 且 `key=repo`。openviking 真实检出：
+  修复前 `mounts` 两条且 host 错配，修复后只剩主服务那条 + 一条说明。
+
 ## 0.3.0 — 2026-09-20
 
 补上 D09（生命周期脚本、首次启动配置）与 D10（依赖接入）两件"生成器一直在躲"的事。

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: 1panel-toolkit
-Version: 0.3.0
+Version: 0.3.2
 Summary: Generate, check, fix and runtime-verify 1Panel app packages from a single spec.
 Author: idkan
 License: MIT License
@@ -47,7 +47,7 @@ agent 调用。
 ## 安装
 
 ```bash
-uv tool install 1panel-toolkit
+uv tool install 1panel-toolkit     # PyPI 上当前是 0.3.0
 p1 --version
 p1 selftest        # 验收：规则数据、写法库、生成→校验链路是否都正常
 ```
@@ -74,7 +74,7 @@ p1 check <app-package-dir>
 p1 check <dir> --strict
 p1 check <dir> --json
 p1 rules lessons
-p1 ports 47.113.177.168 10000,15000,8080
+p1 ports 203.0.113.10 10000,15000,8080
 p1 patterns list
 p1 patterns show compose/panel-db-env
 p1 patterns find 数据库

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/README.md

@@ -13,7 +13,7 @@ agent 调用。
 ## 安装
 
 ```bash
-uv tool install 1panel-toolkit
+uv tool install 1panel-toolkit     # PyPI 上当前是 0.3.0
 p1 --version
 p1 selftest        # 验收：规则数据、写法库、生成→校验链路是否都正常
 ```
@@ -40,7 +40,7 @@ p1 check <app-package-dir>
 p1 check <dir> --strict
 p1 check <dir> --json
 p1 rules lessons
-p1 ports 47.113.177.168 10000,15000,8080
+p1 ports 203.0.113.10 10000,15000,8080
 p1 patterns list
 p1 patterns show compose/panel-db-env
 p1 patterns find 数据库

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/docs/generation-depth.md

@@ -99,7 +99,10 @@ p1 depth <包目录> --corpus <官方apps目录>          # 单个包的判定 +
 判定逻辑基于"应用特有特征指纹"（容器内端口、挂载点、应用变量名、镜像、额外运行时
 字段），做 Jaccard 相似度：
 
-- 缺少端口 / 挂载 / 应用变量 → `thin`
+- 三个"多样性维度"（对外端口 / 持久化挂载 / 应用自有变量）里**缺两个及以上** → `thin`
+- 只缺一个 → 仍是 `adapted`，但会打一条 `·` 说明。应用完全可以把配置放在挂载的
+  配置文件里（xiaozhi 的 `data/.config.yaml`、openviking 的 `ov.conf`），这时
+  "没有应用变量"是设计而不是薄——把这种情况判成 thin 会逼人往 compose 里塞无意义的变量
 - 与某个不相干的包重合度 ≥ 50% → `possibly-reskinned`
 - 都不满足 → `adapted`
 

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "1panel-toolkit"
-version = "0.3.0"
+version = "0.3.2"
 description = "Generate, check, fix and runtime-verify 1Panel app packages from a single spec."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -38,6 +38,9 @@ exclude = [
     ".pytest_cache/",
     "*.egg-info/",
     "*.pyc",
+    # Scratch files from debugging sessions must never ride along in the sdist.
+    "_debug_*",
+    "*.log",
 ]
 
 [tool.pytest.ini_options]

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/src/p1toolkit/__init__.py

@@ -1,3 +1,3 @@
 """1panel-toolkit: one spec in, a verified 1Panel app package out."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.2"

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/src/p1toolkit/cli.py

@@ -268,11 +268,14 @@ def cmd_depth(args: argparse.Namespace) -> int:
                 print(f"  - {value}")
             if len(values) > 12:
                 print(f"  ... 另外 {len(values) - 12} 项")
+        # The profile-based verdict needs no corpus; only the twin search does.
+        verdict = depth_module.assess(profile, corpus)
+        print(f"\n判定：{verdict.status}")
+        for reason in verdict.reasons:
+            print(f"  ! {reason}")
+        for note in verdict.notes:
+            print(f"  · {note}")
         if corpus:
-            verdict = depth_module.assess(profile, corpus)
-            print(f"\n判定：{verdict.status}")
-            for reason in verdict.reasons:
-                print(f"  ! {reason}")
             print("\n与官方语料最接近的包：")
             found = depth_module.nearest(profile, corpus)
             if not found:
@@ -679,7 +682,7 @@ def build_parser() -> argparse.ArgumentParser:
         "ports",
         help="classify host ports as open / closed / filtered before a smoke test",
     )
-    ports.add_argument("host", help="target host, e.g. 47.113.177.168")
+    ports.add_argument("host", help="target host, e.g. 203.0.113.10")
     ports.add_argument(
         "ports", help="comma separated ports or ranges, e.g. 10000,15000 or 10000-10010"
     )

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/src/p1toolkit/depth.py

@@ -366,6 +366,7 @@ class Verdict:
     status: str
     score: float
     reasons: list[str] = field(default_factory=list)
+    notes: list[str] = field(default_factory=list)
     twin: str | None = None
 
     @property
@@ -380,18 +381,28 @@ def assess(
 
     The dimensions that carry all the diversity in the store (container ports,
     mount targets, application variable names) are exactly the ones a template
-    cannot answer. A package with thin values there, or one that is nearly
-    identical to an unrelated app, is probably a reskin.
+    cannot answer. A package missing *one* of them is a judgement call and only
+    gets a note — an app can legitimately carry its configuration in a mounted
+    file instead of environment variables. Missing two or more means the
+    package is a shell; a near-identical unrelated app means it is a reskin.
     """
     reasons: list[str] = []
+    notes: list[str] = []
     if not profile.images:
         reasons.append("compose 里没有可识别的镜像")
-    if not profile.port_pairs:
-        reasons.append("没有对外端口映射")
-    if not profile.mount_targets:
-        reasons.append("没有持久化挂载点（除非这个应用真的无状态）")
-    if not profile.app_env_keys:
-        reasons.append("没有任何应用自有环境变量（多数应用都有配置项）")
+    missing = [
+        text
+        for present, text in (
+            (profile.port_pairs, "没有对外端口映射"),
+            (profile.mount_targets, "没有持久化挂载点（除非这个应用真的无状态）"),
+            (profile.app_env_keys, "没有任何应用自有环境变量（多数应用都有配置项）"),
+        )
+        if not present
+    ]
+    if len(missing) >= 2:
+        reasons.extend(missing)
+    else:
+        notes.extend(missing)
     twin = None
     score = 0.0
     found = nearest(profile, corpus, threshold=twin_threshold, limit=1)
@@ -404,10 +415,16 @@ def assess(
         )
 
     if not reasons:
-        return Verdict(status="adapted", score=score)
+        return Verdict(status="adapted", score=score, notes=notes)
     if twin:
-        return Verdict(status="possibly-reskinned", score=score, reasons=reasons, twin=twin)
-    return Verdict(status="thin", score=score, reasons=reasons)
+        return Verdict(
+            status="possibly-reskinned",
+            score=score,
+            reasons=reasons,
+            notes=notes,
+            twin=twin,
+        )
+    return Verdict(status="thin", score=score, reasons=reasons, notes=notes)
 
 
 def to_json(data: dict[str, Any]) -> str:

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/src/p1toolkit/evidence.py

@@ -193,6 +193,23 @@ def _mount_targets(service: dict[str, Any]) -> list[str]:
     return []
 
 
+def _mount_gaps(service: dict[str, Any]) -> list[str]:
+    """``mounts`` entries the generator would silently drop.
+
+    A host path with no container path is refused (see below); the same mistake
+    written as a ``mounts`` entry used to vanish without a word.
+    """
+    gaps: list[str] = []
+    mounts = service.get("mounts")
+    if isinstance(mounts, list):
+        for index, item in enumerate(mounts):
+            if not isinstance(item, dict):
+                gaps.append(f"mounts[{index}] 不是对象")
+            elif not item.get("target"):
+                gaps.append(f"mounts[{index}] 没有 target（host={item.get('host') or '—'}）")
+    return gaps
+
+
 def _mount_host(service: dict[str, Any]) -> str:
     host = service.get("mount_host")
     if host:
@@ -314,6 +331,15 @@ def _audit_services(audit: Audit, spec: dict[str, Any]) -> None:
             )
 
         # D03 — a host path without a container path silently drops persistence.
+        gaps = _mount_gaps(service)
+        if gaps and not audit.acknowledged.get("D03"):
+            audit.add(
+                "D03",
+                FAIL,
+                f"{name}: {'；'.join(gaps)}",
+                "挂载点必须写出容器内路径；这条会被生成器静默丢弃，"
+                "装出来的包看着有挂载、实际没有",
+            )
         if targets:
             if d03:
                 unknown = [item for item in targets if item not in d03]

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/src/p1toolkit/resolve/__init__.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from typing import Any
 
 from .. import rules
-from .analyze import Analysis, Evidence, analyze
+from .analyze import Analysis, Evidence, analyze, service_mounts
 from .sources import (
     DEFAULT_FETCH_BUDGET,
     GitHub,
@@ -281,38 +281,38 @@ def draft_spec(target: str, analysis: Analysis, decisions: list[Decision]) -> di
     # value never reaches the generator.
     images = analysis.values("image") or analysis.values("image_hint")
     ports = analysis.values("container_port")
-    mounts = (
-        analysis.values("mount_target")
-        or analysis.values("mount_target_hint")
-    )
-    host_mounts = analysis.values("mount_host")
     services = analysis.compose.get("services") or {}
     primary = next(iter(services), "")
-    # Pair each container path with its own host path, in the order they appear:
-    # a service can mount a data directory and a single file from two places.
-    mount_pairs: list[dict[str, str]] = []
-    seen_targets: set[str] = set()
-    primary_volumes = (
-        services.get(primary, {}).get("volumes") if isinstance(services.get(primary), dict) else None
-    )
-    for entry in primary_volumes or []:
-        if not isinstance(entry, str) or ":" not in entry:
-            continue
-        host, target = entry.split(":", 1)
-        target = target.split(":")[0].strip()
-        if target.startswith("/") and target not in seen_targets:
-            seen_targets.add(target)
-            mount_pairs.append({"host": host.strip(), "target": target})
+    # Pair each container path with its own host path, and only within one
+    # service: a compose file can mount a data directory for the app and a
+    # config file for a sidecar, and mixing them binds the wrong directory into
+    # the wrong service. The draft describes the primary service; mounts that
+    # belong to other services are reported for a human to decide.
+    per_service = service_mounts(analysis.compose)
+    primary_mounts = per_service.get(primary, [])
+    mount_pairs: list[dict[str, str]] = [
+        {"host": host, "target": container_path} for host, container_path in primary_mounts
+    ]
+    seen_targets: set[str] = {container_path for _, container_path in primary_mounts}
+    # The primary service's own container paths. Sidecar mounts are deliberately
+    # not included: they belong to another service and another host path.
+    mounts = [container_path for _, container_path in primary_mounts]
+    # Weak evidence (a path-valued env default such as HALO_WORK_DIR) has no host
+    # of its own. It only fills in when the primary service mounts nothing, and
+    # it gets the primary service's first host, never a sidecar's.
+    if not mounts:
+        mounts = analysis.values("mount_target_hint")
+    hint_host = primary_mounts[0][0] if primary_mounts else "./data"
     for container_path in mounts:
         if container_path not in seen_targets:
             seen_targets.add(container_path)
-            mount_pairs.append(
-                {
-                    "host": host_mounts[0] if host_mounts else "./data",
-                    "target": container_path,
-                }
-            )
-    repo_name = str(source.label).split("/")[-1].split("@")[0] or "app"
+            mount_pairs.append({"host": hint_host, "target": container_path})
+    # The product name, never the local checkout path.
+    label = str(source.label)
+    if label.startswith("local:"):
+        repo_name = Path(label.split(":", 1)[1]).name or "app"
+    else:
+        repo_name = label.split("/")[-1].split("@")[0] or "app"
     # Values discovered for the application's own variables become compose
     # defaults; the generator decides later which of them a user must see.
     env_map: dict[str, Any] = env_map_of(analysis)
@@ -356,8 +356,20 @@ def draft_spec(target: str, analysis: Analysis, decisions: list[Decision]) -> di
     # default: `p1 gen` refuses it, so only carry a host path when something is
     # actually mounted.
     if mounts:
-        service_spec["mount_host"] = (
-            mount_pairs[0]["host"] if mount_pairs else (host_mounts[0] if host_mounts else "./data")
+        service_spec["mount_host"] = mount_pairs[0]["host"] if mount_pairs else hint_host
+
+    other_mounts = {
+        name: pairs for name, pairs in per_service.items() if name != primary and pairs
+    }
+    notes = list(source.notes) + list(analysis.notes)
+    if other_mounts:
+        described = "、".join(
+            f"{name}({', '.join(target for _, target in pairs)})"
+            for name, pairs in sorted(other_mounts.items())
+        )
+        notes.append(
+            f"compose 里还有其它服务的挂载点：{described}；本 draft 只描述主服务 "
+            f"{primary or 'app'}，这些挂载点要不要并进这个包由人工判断"
         )
 
     spec: dict[str, Any] = {
@@ -392,7 +404,7 @@ def draft_spec(target: str, analysis: Analysis, decisions: list[Decision]) -> di
             "architectures 默认 amd64：容器镜像仓库在本机不可达，无法读取 manifest",
             "type/tags 暂定 tool/Tool，需按应用实际形态确认",
         ],
-        "notes": list(source.notes) + list(analysis.notes),
+        "notes": notes,
     }
     hints = dependency_hints(analysis, env_map)
     if hints:
@@ -408,6 +420,8 @@ def render_report(target: str, analysis: Analysis, decisions: list[Decision]) ->
             lines.append(f"- {key}: {value}")
     for note in source.notes:
         lines.append(f"- 注意：{note}")
+    for note in analysis.notes:
+        lines.append(f"- 注意：{note}")
     lines.append("")
     lines.append("| 决策 | 状态 | 答案 | 证据 |")
     lines.append("| --- | --- | --- | --- |")

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/src/p1toolkit/resolve/analyze.py

@@ -191,6 +191,35 @@ def _volume_split(entry: Any) -> tuple[str, str] | None:
     return parts[0].strip(), parts[1].strip()
 
 
+def service_mounts(compose: Any) -> dict[str, list[tuple[str, str]]]:
+    """Bind mounts per service: ``{service: [(host, container_path), ...]}``.
+
+    Attribution matters. A compose file can mount a data directory for the app
+    and a config file for a sidecar; pairing every container path with the
+    first host path produces a package that binds the wrong directory into the
+    wrong service.
+    """
+    if not isinstance(compose, dict):
+        return {}
+    services = compose.get("services")
+    if not isinstance(services, dict):
+        return {}
+    result: dict[str, list[tuple[str, str]]] = {}
+    for name, service in services.items():
+        if not isinstance(service, dict):
+            continue
+        pairs: list[tuple[str, str]] = []
+        for volume in service.get("volumes") or []:
+            split = _volume_split(volume)
+            # Only bind mounts with a container path; named volumes and paths
+            # relative to the container are a different decision.
+            if split and split[1].startswith("/") and split not in pairs:
+                pairs.append(split)
+        if pairs:
+            result[str(name)] = pairs
+    return result
+
+
 def _env_map(service: dict[str, Any]) -> list[tuple[str, str]]:
     env = service.get("environment")
     if isinstance(env, dict):

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/src/p1toolkit/rules/data/lessons.yaml

@@ -58,7 +58,8 @@ lessons:
     root_cause: 云厂商安全组只放行了部分端口，表单默认端口落在未放行区间。
     fix: "先跑 `p1 ports <host> <候选端口>`：立即被拒绝（closed）= 安全组已放行且无人监听，可直接用；超时（filtered）= 被上游拦掉，换端口。冒烟测试只用 closed/open 的端口。"
     cases:
-      - "47.113.177.168：10000/15000/12345/18888 返回 RST（放行且空闲），9999/8080 超时（被安全组拦截）"
+      - "某云主机实测：部分端口返回 RST（安全组已放行且无人监听），另一些端口超时（被安全组拦截），
+        与打包无关"
     applies_when: 在云服务器上做运行时验证。
 
   - id: L006

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/tests/test_config.py

@@ -45,13 +45,13 @@ def test_windows_paths_survive_a_round_trip(tmp_path: Path, monkeypatch) -> None
     """A backslash is a TOML escape; writing one raw corrupts the whole file."""
     monkeypatch.setenv("P1_CONFIG", str(tmp_path / "config.toml"))
     cfg = config_module.load()
-    cfg.set("ssh.key", r"C:\Users\idkan\.ssh\p1_1panel_cloud")
-    cfg.set("ssh.host", "47.113.177.168")
+    cfg.set("ssh.key", r"C:\Users\example\.ssh\panel_key")
+    cfg.set("ssh.host", "203.0.113.10")
     cfg.save()
 
     reloaded = config_module.load()
-    assert reloaded.get("ssh.key") == r"C:\Users\idkan\.ssh\p1_1panel_cloud"
-    assert reloaded.get("ssh.host") == "47.113.177.168"
+    assert reloaded.get("ssh.key") == r"C:\Users\example\.ssh\panel_key"
+    assert reloaded.get("ssh.host") == "203.0.113.10"
 
 
 def test_quotes_in_values_survive(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/tests/test_depth.py

@@ -64,6 +64,56 @@ def test_adapted_package_passes(tmp_path: Path) -> None:
     assert assess(profile, []).status == "adapted"
 
 
+def test_missing_one_dimension_is_a_note_not_a_verdict(tmp_path: Path) -> None:
+    """An app can carry its config in a mounted file instead of env vars.
+
+    xiaozhi-esp32-server is exactly that shape: two ports, a model-file mount,
+    security_opt, an init script, and zero application variables because
+    everything lives in `data/.config.yaml`. Calling that "thin" is wrong.
+    """
+    compose = (
+        "services:\n"
+        "  app:\n"
+        '    image: "ghcr.io/example/app:1.0"\n'
+        "    container_name: ${CONTAINER_NAME}\n"
+        "    networks:\n"
+        "      - 1panel-network\n"
+        "    ports:\n"
+        '      - "${PANEL_APP_PORT_HTTP}:8000"\n'
+        "    volumes:\n"
+        "      - ./data:/opt/app/data\n"
+        "networks:\n"
+        "  1panel-network:\n"
+        "    external: true\n"
+    )
+    profile = profile_app(write_package(tmp_path / "demo", key="demo", compose=compose))
+    verdict = assess(profile, [])
+    assert verdict.status == "adapted"
+    assert not verdict.reasons
+    assert any("环境变量" in note for note in verdict.notes)
+
+
+def test_two_missing_dimensions_are_still_thin(tmp_path: Path) -> None:
+    compose = (
+        "services:\n"
+        "  app:\n"
+        '    image: "ghcr.io/example/app:1.0"\n'
+        "    container_name: ${CONTAINER_NAME}\n"
+        "    networks:\n"
+        "      - 1panel-network\n"
+        "    ports:\n"
+        '      - "${PANEL_APP_PORT_HTTP}:8000"\n'
+        "networks:\n"
+        "  1panel-network:\n"
+        "    external: true\n"
+    )
+    profile = profile_app(write_package(tmp_path / "demo", key="demo", compose=compose))
+    verdict = assess(profile, [])
+    assert verdict.shallow
+    assert any("挂载" in reason for reason in verdict.reasons)
+    assert any("环境变量" in reason for reason in verdict.reasons)
+
+
 def test_similarity_finds_a_reskin(tmp_path: Path) -> None:
     first = profile_app(write_package(tmp_path / "a", key="a"))
     second = profile_app(write_package(tmp_path / "b", key="b"))
@@ -131,4 +181,3 @@ def test_templateable_dimensions_documented() -> None:
     templatable = data.get("templatable") or []
     assert templatable
     assert any("重启策略" in str(item.get("dimension")) for item in templatable)
-

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/tests/test_evidence.py

@@ -136,6 +136,25 @@ def test_dangling_mount_host_is_refused() -> None:
     assert "D03" in result.blocked_decisions
 
 
+def test_mount_entry_without_a_target_is_refused() -> None:
+    """The same mistake written into `mounts` used to vanish without a word."""
+    spec = make_spec()
+    spec["services"][0]["mounts"] = [{"host": "./data"}]
+    result = audit(spec)
+    assert not result.ok
+    assert "D03" in result.blocked_decisions
+    assert any("mounts[0]" in item.message for item in result.failures)
+
+
+def test_partially_broken_mounts_are_refused_not_trimmed() -> None:
+    spec = make_spec()
+    spec["services"][0]["mounts"] = [
+        {"host": "./data", "target": "/app/data"},
+        {"host": "./extra"},
+    ]
+    assert not audit(spec).ok
+
+
 def test_port_declared_in_the_ledger_but_missing_from_the_spec_is_refused() -> None:
     spec = make_spec()
     spec["services"][0].pop("container_port")

{1panel_toolkit-0.3.0 → 1panel_toolkit-0.3.2}/tests/test_resolve.py

@@ -230,6 +230,76 @@ def test_draft_spec_has_no_dangling_mount_host(tmp_path: Path) -> None:
     assert "mount_host" not in service
 
 
+def test_a_container_path_volume_does_not_break_the_repository_key(
+    tmp_path: Path,
+) -> None:
+    """A volume's container path used to overwrite `draft_spec`'s `target`
+    argument, so `repo_key` received `/otel-lgtm/...` and resolve died with
+    "cannot interpret ..." before writing anything."""
+    root = tmp_path / "repo"
+    root.mkdir()
+    (root / "docker-compose.yml").write_text(
+        "services:\n"
+        "  grafana:\n"
+        "    image: grafana/otel-lgtm:latest\n"
+        "    volumes:\n"
+        "      - ./x:/otel-lgtm/grafana/conf/provisioning/dashboards/dash.yaml:ro\n",
+        encoding="utf-8",
+    )
+    result = resolve(str(root))
+    assert result.spec["key"] == "repo"
+    assert result.spec["name"] == "repo"
+    assert result.spec["services"][0]["mounts"] == [
+        {
+            "host": "./x",
+            "target": "/otel-lgtm/grafana/conf/provisioning/dashboards/dash.yaml",
+        }
+    ]
+
+
+def test_local_checkout_never_names_the_product_after_its_path(tmp_path: Path) -> None:
+    root = tmp_path / "My-App-main"
+    root.mkdir()
+    (root / "Dockerfile").write_text("FROM alpine\nEXPOSE 8080\n", encoding="utf-8")
+    spec = resolve(str(root)).spec
+    assert spec["name"] == "My-App-main"
+    assert spec["key"] == "my-app-main"
+    assert "\\\\" not in spec["name"] and "tmp" not in spec["key"]
+
+
+def test_each_service_keeps_its_own_mounts(tmp_path: Path) -> None:
+    """A sidecar's config mount must not be paired with the app's data host.
+
+    Getting this wrong produces a package that binds the app's data directory
+    into the sidecar's container path, and every static check passes.
+    """
+    root = tmp_path / "repo"
+    root.mkdir()
+    (root / "docker-compose.yml").write_text(
+        "services:\n"
+        "  app:\n"
+        "    image: example/app:1.0\n"
+        "    ports:\n"
+        '      - "1933:1933"\n'
+        "    volumes:\n"
+        "      - ~/.app:/app/data\n"
+        "  caddy:\n"
+        "    image: caddy:2\n"
+        "    volumes:\n"
+        "      - ./Caddyfile:/etc/caddy/Caddyfile:ro\n",
+        encoding="utf-8",
+    )
+    spec = resolve(str(root)).spec
+    service = spec["services"][0]
+    assert service["mounts"] == [{"host": "~/.app", "target": "/app/data"}]
+    assert service["mount_targets"] == ["/app/data"]
+    assert service["mount_host"] == "~/.app"
+    # The sidecar's mount is reported, not silently merged.
+    assert any("caddy" in note and "/etc/caddy/Caddyfile" in note for note in spec["notes"])
+    report = render_report("repo", resolve(str(root)).analysis, resolve(str(root)).decisions)
+    assert "/etc/caddy/Caddyfile" in report
+
+
 def test_dependency_hints_point_at_the_upstream_variable_names(tmp_path: Path) -> None:
     """D10 的线索：把上游那几个数据库变量指出来，人不用自己抄。"""
     root = tmp_path / "repo"

1panel_toolkit-0.3.0/_debug_resolve.log

@@ -1,21 +0,0 @@
-GET https://api.github.com/repos/halo-dev/halo
-   -> 0.5 s
-GET https://api.github.com/repos/halo-dev/halo/git/trees/main?recursive=1
-   -> 2.2 s
-GET https://api.github.com/repos/halo-dev/halo/releases/latest
-   -> 0.5 s
-GET https://raw.githubusercontent.com/halo-dev/halo/main/Dockerfile
-   -> 20.5 s
-GET https://raw.githubusercontent.com/halo-dev/halo/main/README.md
-   -> 60.5 s
-GET https://raw.githubusercontent.com/halo-dev/halo/main/docs/index/README.md
-   -> 60.0 s
-GET https://raw.githubusercontent.com/halo-dev/halo/main/docs/notification/README.md
-   -> 36.4 s
-GET https://raw.githubusercontent.com/halo-dev/halo/main/ui/tsconfig.json
-   -> 16.2 s
-GET https://raw.githubusercontent.com/halo-dev/halo/main/openspec/config.yaml
-   -> 0.9 s
-GET https://raw.githubusercontent.com/halo-dev/halo/main/ui/tsconfig.app.json
-   -> 0.9 s
-total 198.7 s

1panel_toolkit-0.3.0/_debug_resolve.py

@@ -1,18 +0,0 @@
-import sys, time
-sys.path.insert(0, "src")
-from p1toolkit.resolve import sources
-
-orig_get = sources.GitHub._get
-def traced(self, url, limit=sources.MAX_FILE_BYTES):
-    started = time.time()
-    print("GET", url[:110], flush=True)
-    try:
-        return orig_get(self, url, limit)
-    finally:
-        print("   ->", round(time.time() - started, 1), "s", flush=True)
-
-sources.GitHub._get = traced
-from p1toolkit.resolve import resolve
-started = time.time()
-result = resolve("halo-dev/halo")
-print("total", round(time.time() - started, 1), "s", flush=True)