1panel-toolkit 0.3.2__tar.gz → 0.4.0__tar.gz

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/CHANGELOG.md

@@ -1,5 +1,42 @@
 # 变更记录
 
+## 0.4.0 — 2026-09-20
+
+多服务包：draft spec 从"只有主服务"变成"compose 里每个服务各一条"。
+
+### 为什么
+
+0.3.1 修了挂载点跨服务错配，但 `image` / `container_port` / `env` 仍然是跨服务聚合的：
+`draft_spec` 取 `images[0]`、`ports[0]`，并把所有服务的环境变量合并成一份。一个
+"应用 + 自带数据库"的 compose 会因此生成**一个** spec service，里面塞着 sidecar 的
+镜像、端口、甚至数据库密码。openviking（openviking + caddy）实测就是这种形态：
+caddy 的 `OV_ACME_EMAIL` 会出现在主服务上，反过来 caddy 只拿到自己的变量。
+
+### 改了什么
+
+- 新增 `analyze.service_facts()`：按服务取出镜像、端口、bind 挂载、环境变量、
+  `depends_on`、运行时字段（security_opt / user / devices …）与 healthcheck。
+- `draft_spec` 为每个服务生成一条 spec（compose 顺序，第一条仍是主服务、拿
+  `PANEL_APP_PORT_HTTP`，其余服务的容器名带后缀）。Dockerfile 里的变量只归主服务，
+  且不会重复落到已经声明过它的服务上；sidecar 的凭据不会被并进应用服务。
+- 多服务时加一条 note：这些服务已按归属写进 draft，如果面板上已有对应应用
+  （postgresql / redis / mysql），考虑改用 `dependencies` 走面板托管（D10）。
+- **healthcheck**：上游的 healthcheck 块（`test` / `interval` / …）会原样带进 spec 和
+  生成的 compose；上游只有"存在 healthcheck"这一事实时，draft 只写一条提示，
+  不再输出 `healthcheck: true`——那不是定义，Docker 会直接解析失败。新增规则
+  **C005** 拦住手写的非映射 healthcheck。
+- 表单字段顺序：端口字段统一排在前面，多服务时不会被另一个服务的变量隔开。
+
+### 实测
+
+- openviking（openviking + caddy）：draft 从 1 条（镜像/端口/挂载/变量全混）变成
+  2 条各自正确——openviking 拿到自己的镜像、1933、`/app/.openviking`、
+  Dockerfile 变量与真实 healthcheck 块；caddy 拿到 `caddy:2`、1934、
+  `./Caddyfile:/etc/caddy/Caddyfile`、`depends_on: [openviking]` 与自己的变量。
+  `p1 gen --check` → `0 fail`。
+- 新增 9 条测试（多服务归属、sidecar 凭据不串味、healthcheck 块 vs 标志、
+  C005、多服务生成），`pytest` 265 passed。
+
 ## 0.3.2 — 2026-09-20
 
 `p1 depth` 的判定阈值校准。用 `p1 fix` 收敛用户自己的四个包时发现的误判。

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: 1panel-toolkit
-Version: 0.3.2
+Version: 0.4.0
 Summary: Generate, check, fix and runtime-verify 1Panel app packages from a single spec.
 Author: idkan
 License: MIT License
@@ -105,7 +105,8 @@ p1 selftest                                # 验收：这个安装能不能用
 `values[].label` 必须是纯字符串、bool label 必须加引号。
 
 规则组 `C0xx` 管 compose：顶层 `version:`、image 引号、`${VAR}` 与表单 envKey
-闭合、`createdBy` 标签、端口 envKey 前缀、外部网络、同名服务 DNS 冲突。
+闭合、`createdBy` 标签、端口 envKey 前缀、外部网络、同名服务 DNS 冲突、
+`healthcheck` 必须是映射（`C005`，`healthcheck: true` 会让 Docker 直接解析失败）。
 
 规则组 `H0xx` 管文件卫生：LF/BOM、README store 风格、`.env.sample` 闭合。
 
@@ -175,6 +176,11 @@ README，抽取出端口、挂载点、环境变量、运行用户、额外运
 落进 draft spec——人工确认过的值必须能到达生成器，而不是停在报告里。产出三份文件：
 `decision-report.md`、`draft-spec.json`、`resolve.json`。
 
+**多服务 compose 按服务归属**：compose 里每个服务在 draft spec 里各占一条，镜像、容器端口、
+bind 挂载、环境变量、`depends_on`、运行时字段都只跟着自己的服务走。Dockerfile 里的变量归
+主服务；sidecar（自带的数据库/缓存）的密码不会被并到应用服务上，反过来也一样。多服务时还会给
+一条提示：如果面板上已经有对应的应用，考虑改用 `dependencies` 走面板托管（D10）。
+
 实测：`halo-dev/halo` 的挂载点在 Dockerfile 里没有 `VOLUME`，但 `HALO_WORK_DIR`
 默认值是 `/root/.halo2`；镜像只在 README 里出现——它把两条都标成 `inferred`
 并给出出处，而不是停下来或者瞎猜。
@@ -250,6 +256,9 @@ p1 fix <包目录> --check       # 改完立刻重新校验
 | openviking | 1 fail + 6 warn | **0 fail + 1 warn** | 8 处 |
 | xiaozhi-esp32-server | 1 fail + 13 warn | **0 fail + 1 warn** | 14 处 |
 
+（2026-09-20 在真实包上的实测记录；这些包随后已就地修复，
+`xiaozhi-esp32-server-full` 现在是 `0 fail / 0 warn`。）
+
 静态校验和生成的 YAML 都不能告诉你"容器起不起得来、端口通不通、应用找不找得到配置文件"。
 
 ```bash

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/README.md

@@ -71,7 +71,8 @@ p1 selftest                                # 验收：这个安装能不能用
 `values[].label` 必须是纯字符串、bool label 必须加引号。
 
 规则组 `C0xx` 管 compose：顶层 `version:`、image 引号、`${VAR}` 与表单 envKey
-闭合、`createdBy` 标签、端口 envKey 前缀、外部网络、同名服务 DNS 冲突。
+闭合、`createdBy` 标签、端口 envKey 前缀、外部网络、同名服务 DNS 冲突、
+`healthcheck` 必须是映射（`C005`，`healthcheck: true` 会让 Docker 直接解析失败）。
 
 规则组 `H0xx` 管文件卫生：LF/BOM、README store 风格、`.env.sample` 闭合。
 
@@ -141,6 +142,11 @@ README，抽取出端口、挂载点、环境变量、运行用户、额外运
 落进 draft spec——人工确认过的值必须能到达生成器，而不是停在报告里。产出三份文件：
 `decision-report.md`、`draft-spec.json`、`resolve.json`。
 
+**多服务 compose 按服务归属**：compose 里每个服务在 draft spec 里各占一条，镜像、容器端口、
+bind 挂载、环境变量、`depends_on`、运行时字段都只跟着自己的服务走。Dockerfile 里的变量归
+主服务；sidecar（自带的数据库/缓存）的密码不会被并到应用服务上，反过来也一样。多服务时还会给
+一条提示：如果面板上已经有对应的应用，考虑改用 `dependencies` 走面板托管（D10）。
+
 实测：`halo-dev/halo` 的挂载点在 Dockerfile 里没有 `VOLUME`，但 `HALO_WORK_DIR`
 默认值是 `/root/.halo2`；镜像只在 README 里出现——它把两条都标成 `inferred`
 并给出出处，而不是停下来或者瞎猜。
@@ -216,6 +222,9 @@ p1 fix <包目录> --check       # 改完立刻重新校验
 | openviking | 1 fail + 6 warn | **0 fail + 1 warn** | 8 处 |
 | xiaozhi-esp32-server | 1 fail + 13 warn | **0 fail + 1 warn** | 14 处 |
 
+（2026-09-20 在真实包上的实测记录；这些包随后已就地修复，
+`xiaozhi-esp32-server-full` 现在是 `0 fail / 0 warn`。）
+
 静态校验和生成的 YAML 都不能告诉你"容器起不起得来、端口通不通、应用找不找得到配置文件"。
 
 ```bash

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "1panel-toolkit"
-version = "0.3.2"
+version = "0.4.0"
 description = "Generate, check, fix and runtime-verify 1Panel app packages from a single spec."
 readme = "README.md"
 requires-python = ">=3.10"

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/src/p1toolkit/__init__.py

@@ -1,3 +1,3 @@
 """1panel-toolkit: one spec in, a verified 1Panel app package out."""
 
-__version__ = "0.3.2"
+__version__ = "0.4.0"

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/src/p1toolkit/checks/compose.py

@@ -59,6 +59,7 @@ def run(package: Package, report: Report, strict: bool = False) -> None:
         _check_services(version, report, name, generic)
         _check_ports(version, report, name)
         _check_networks(version, report, name)
+        _check_healthcheck(version, report, name)
 
 
 def _check_images(version: Version, report: Report, name: str, strict: bool) -> None:
@@ -186,3 +187,18 @@ def _check_networks(version: Version, report: Report, name: str) -> None:
             "can be reached through 1Panel's entry",
             name,
         )
+
+
+def _check_healthcheck(version: Version, report: Report, name: str) -> None:
+    """`healthcheck:` must be a mapping; `healthcheck: true` breaks the parse."""
+    for service_name, service in version.services.items():
+        if not isinstance(service, dict) or "healthcheck" not in service:
+            continue
+        healthcheck = service["healthcheck"]
+        if not isinstance(healthcheck, dict):
+            report.fail(
+                "C005",
+                f"service {service_name}: healthcheck 必须是映射（test/interval/…），"
+                f"现在是 {type(healthcheck).__name__}；Docker 解析不过",
+                name,
+            )

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/src/p1toolkit/gen.py

@@ -208,6 +208,9 @@ def build_fields(
     dependency wiring (which is rendered literally, not as a default).
     """
     fields: list[dict] = []
+    # Ports first: with more than one service the port fields would otherwise be
+    # scattered between another service's variables.
+    port_fields: list[dict] = []
     hidden: dict[str, list[str]] = {}
     # Keys the generator adds on its own; they must not be double counted as
     # "hidden upstream variables" when the upstream compose also sets them.
@@ -219,7 +222,7 @@ def build_fields(
         port = service.get("container_port")
         if port:
             env_key = "PANEL_APP_PORT_HTTP" if port_index == 0 else f"PANEL_APP_PORT_{port_index}"
-            fields.append(
+            port_fields.append(
                 {
                     "envKey": env_key,
                     "type": "number",
@@ -252,6 +255,7 @@ def build_fields(
                 entry["description"] = item["description"]
             fields.append(entry)
 
+    fields = port_fields + fields
     hidden = {
         service: [key for key in keys if key not in reserved]
         for service, keys in hidden.items()
@@ -370,7 +374,6 @@ def build_compose(
         if env_lines:
             entry["environment"] = env_lines
         for extra in (
-            "healthcheck",
             "security_opt",
             "cap_add",
             "cap_drop",
@@ -392,6 +395,16 @@ def build_compose(
         ):
             if service.get(extra):
                 entry[extra] = service[extra]
+        # `healthcheck` is a mapping, never a flag: a boolean from a spec (or an
+        # evidence flag) must not reach the compose file, Docker rejects it.
+        healthcheck = service.get("healthcheck")
+        if isinstance(healthcheck, dict):
+            entry["healthcheck"] = healthcheck
+        elif healthcheck:
+            warnings.append(
+                f"{name}: healthcheck 不是映射（{healthcheck!r}），已忽略；"
+                "探针要写成 {test: [...], interval: 10s, ...}"
+            )
         entry["labels"] = {"createdBy": "Apps"}
         services[name] = entry
 

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/src/p1toolkit/resolve/__init__.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from typing import Any
 
 from .. import rules
-from .analyze import Analysis, Evidence, analyze, service_mounts
+from .analyze import Analysis, Evidence, analyze, service_facts, service_mounts
 from .sources import (
     DEFAULT_FETCH_BUDGET,
     GitHub,
@@ -316,60 +316,96 @@ def draft_spec(target: str, analysis: Analysis, decisions: list[Decision]) -> di
     # Values discovered for the application's own variables become compose
     # defaults; the generator decides later which of them a user must see.
     env_map: dict[str, Any] = env_map_of(analysis)
-    # Runtime knobs upstream asks for (security_opt, cap_add, devices, ...) must
-    # survive into the generated compose: silently dropping one breaks a feature.
-    carried_keys = (
-        "security_opt",
-        "cap_add",
-        "cap_drop",
-        "devices",
-        "user",
-        "sysctls",
-        "ulimits",
-        "shm_size",
-        "stop_grace_period",
-        "command",
-    )
-    primary_service = services.get(primary)
-    primary_service = primary_service if isinstance(primary_service, dict) else {}
-    carried = {
-        key: primary_service[key] for key in carried_keys if primary_service.get(key) is not None
-    }
-
     evidence: dict[str, str] = {"repository": source.label}
     for kind, key in (("compose", "compose_file"), ("dockerfile", "dockerfile"), ("readme", "readme")):
         if kind in source.paths:
             evidence[key] = source.paths[kind]
 
-    service_spec: dict[str, Any] = {
-        "name": primary or "app",
-        "image": images[0] if images else "",
-        "container_port": int(ports[0]) if ports and ports[0].isdigit() else None,
-        "mount_targets": mounts,
-        "mounts": mount_pairs,
-        "env": env_map,
-        "env_keys": analysis.values("env_key"),
-        "healthcheck": bool(analysis.evidence.get("healthcheck")),
-        **carried,
-    }
-    # A host path with no container path is not a decision, it is a dangling
-    # default: `p1 gen` refuses it, so only carry a host path when something is
-    # actually mounted.
-    if mounts:
-        service_spec["mount_host"] = mount_pairs[0]["host"] if mount_pairs else hint_host
-
-    other_mounts = {
-        name: pairs for name, pairs in per_service.items() if name != primary and pairs
-    }
+    # One spec service per compose service, each carrying its own image, port,
+    # mounts, variables and runtime knobs. The first one (compose order) owns
+    # `PANEL_APP_PORT_HTTP`; the others get suffixed container names.
+    facts = service_facts(analysis.compose)
+    # Keys the compose already attributes to some service. Anything else in the
+    # Dockerfile-derived map belongs to the image the primary service runs; a
+    # sidecar's own variables must never leak back into it.
+    claimed = {key for fact in facts.values() for key in fact["env"]}
+    primary_extra = {key: value for key, value in env_map.items() if key not in claimed}
     notes = list(source.notes) + list(analysis.notes)
-    if other_mounts:
+    services_spec: list[dict[str, Any]] = []
+    for index, (name, fact) in enumerate(facts.items()):
+        is_primary = index == 0
+        service_mounts_ = fact["mounts"]
+        if is_primary and not service_mounts_ and mounts:
+            # Weak evidence (a path-valued env default such as HALO_WORK_DIR)
+            # belongs to the app image, so it only lands on the primary service.
+            service_mounts_ = [(hint_host, target) for target in mounts]
+        spec_service: dict[str, Any] = {
+            "name": name,
+            "image": fact["image"] or (images[0] if is_primary and images else ""),
+            "container_port": fact["container_port"]
+            or (
+                int(ports[0])
+                if is_primary and ports and ports[0].isdigit()
+                else None
+            ),
+            "mount_targets": [target for _, target in service_mounts_],
+            "mounts": [
+                {"host": host, "target": target} for host, target in service_mounts_
+            ],
+            "env": {
+                **fact["env"],
+                **(primary_extra if is_primary else {}),
+            },
+            "env_keys": sorted(set(fact["env"]) | (set(primary_extra) if is_primary else set())),
+            **fact["runtime"],
+        }
+        # `healthcheck:` must be a mapping. Upstream having one is a fact worth
+        # reporting, but writing `healthcheck: true` produces a compose file
+        # Docker refuses to parse — so it is a note, not a spec field.
+        if isinstance(fact.get("healthcheck_block"), dict):
+            spec_service["healthcheck"] = fact["healthcheck_block"]
+        elif fact["healthcheck"]:
+            healthcheck_note = (
+                f"{name}: 上游声明了 healthcheck，但 draft 里没有它的定义（EXPOSE/CMD 推导不出来），"
+                "打包时请把探针命令补进 spec 的 healthcheck"
+            )
+            notes.append(healthcheck_note)
+        if fact["depends_on"]:
+            spec_service["depends_on"] = fact["depends_on"]
+        # A host path with no container path is not a decision, it is a dangling
+        # default: `p1 gen` refuses it, so only carry a host path when something
+        # is actually mounted.
+        if service_mounts_:
+            spec_service["mount_host"] = service_mounts_[0][0]
+        services_spec.append(spec_service)
+
+    if not services_spec:
+        services_spec = [
+            {
+                "name": primary or "app",
+                "image": images[0] if images else "",
+                "container_port": int(ports[0]) if ports and ports[0].isdigit() else None,
+                "mount_targets": mounts,
+                "mounts": mount_pairs,
+                "env": env_map,
+                "env_keys": analysis.values("env_key"),
+                "healthcheck": bool(analysis.evidence.get("healthcheck")),
+            }
+        ]
+        if mounts:
+            services_spec[0]["mount_host"] = mount_pairs[0]["host"] if mount_pairs else hint_host
+
+    if len(services_spec) > 1:
         described = "、".join(
-            f"{name}({', '.join(target for _, target in pairs)})"
-            for name, pairs in sorted(other_mounts.items())
+            f"{item['name']}"
+            + (f"({', '.join(target for _, target in facts[item['name']]['mounts'])})" if facts.get(item["name"], {}).get("mounts") else "")
+            for item in services_spec[1:]
         )
         notes.append(
-            f"compose 里还有其它服务的挂载点：{described}；本 draft 只描述主服务 "
-            f"{primary or 'app'}，这些挂载点要不要并进这个包由人工判断"
+            f"compose 里还有 {len(services_spec) - 1} 个服务：{described}；"
+            "它们已按服务归属一并写进 draft。如果面板上已经有对应的应用"
+            "（postgresql / redis / mysql 等），考虑把它们改成 spec 的 dependencies 走"
+            "面板托管（D10），而不是在包里再塞一个 sidecar"
         )
 
     spec: dict[str, Any] = {
@@ -386,7 +422,7 @@ def draft_spec(target: str, analysis: Analysis, decisions: list[Decision]) -> di
         "port": 10000,
         "architectures": ["amd64"],
         "source_evidence": evidence,
-        "services": [service_spec],
+        "services": services_spec,
         "decisions": {
             d.id: {
                 "question": d.question,

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/src/p1toolkit/resolve/analyze.py

@@ -220,6 +220,67 @@ def service_mounts(compose: Any) -> dict[str, list[tuple[str, str]]]:
     return result
 
 
+RUNTIME_KEYS = (
+    "security_opt",
+    "cap_add",
+    "cap_drop",
+    "devices",
+    "user",
+    "sysctls",
+    "ulimits",
+    "shm_size",
+    "stop_grace_period",
+    "command",
+)
+
+
+def service_facts(compose: Any) -> dict[str, dict[str, Any]]:
+    """Everything the draft spec needs, attributed to the service it belongs to.
+
+    Aggregating these across services is how a sidecar's image, port or secret
+    ends up wired into the application service: the store has plenty of compose
+    files with an app plus a bundled database, and the two must stay apart.
+    """
+    if not isinstance(compose, dict):
+        return {}
+    services = compose.get("services")
+    if not isinstance(services, dict):
+        return {}
+    mounts = service_mounts(compose)
+    result: dict[str, dict[str, Any]] = {}
+    for name, service in services.items():
+        if not isinstance(service, dict):
+            continue
+        ports = [
+            int(port)
+            for port in (_container_port(mapping) for mapping in service.get("ports") or [])
+            if port
+        ]
+        env: dict[str, str] = {}
+        for key, value in _env_map(service):
+            # A value that is itself a variable reference stays empty: the panel
+            # supplies it, and inventing a default would point at nothing.
+            env[key] = "" if "${" in value else value
+        depends = service.get("depends_on") or []
+        if isinstance(depends, dict):
+            depends = list(depends)
+        result[str(name)] = {
+            "name": str(name),
+            "image": str(service.get("image") or "").strip(),
+            "container_port": ports[0] if ports else None,
+            "ports": ports,
+            "mounts": mounts.get(str(name), []),
+            "env": env,
+            "runtime": {key: service[key] for key in RUNTIME_KEYS if service.get(key) is not None},
+            "healthcheck": bool(service.get("healthcheck")),
+            "healthcheck_block": service.get("healthcheck")
+            if isinstance(service.get("healthcheck"), dict)
+            else None,
+            "depends_on": [str(item) for item in depends],
+        }
+    return result
+
+
 def _env_map(service: dict[str, Any]) -> list[tuple[str, str]]:
     env = service.get("environment")
     if isinstance(env, dict):

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/tests/test_checks.py

@@ -18,6 +18,34 @@ def test_good_package_has_no_failures(good_package: Path) -> None:
     assert report.ok, report.render()
 
 
+def test_a_boolean_healthcheck_is_a_failure(tmp_path: Path) -> None:
+    """C005: `healthcheck: true` makes Docker refuse to parse the file."""
+    root = write_package(
+        tmp_path / "demo",
+        compose=COMPOSE.replace(
+            "    labels:\n      createdBy: \"Apps\"\n",
+            "    healthcheck: true\n    labels:\n      createdBy: \"Apps\"\n",
+        ),
+    )
+    report = run_all(load_package(root))
+    assert "C005" in {issue.rule_id for issue in report.failures}
+    assert not report.ok
+
+
+def test_a_healthcheck_mapping_passes_the_check(tmp_path: Path) -> None:
+    root = write_package(
+        tmp_path / "demo",
+        compose=COMPOSE.replace(
+            "    labels:\n      createdBy: \"Apps\"\n",
+            "    healthcheck:\n"
+            "      test: [\"CMD\", \"wget\", \"-qO-\", \"http://localhost\"]\n"
+            "      interval: 30s\n"
+            "    labels:\n      createdBy: \"Apps\"\n",
+        ),
+    )
+    assert "C005" not in rules_hit(root)
+
+
 def test_top_level_form_fields_fail(tmp_path: Path) -> None:
     root = write_package(
         tmp_path / "demo",

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/tests/test_gen.py

@@ -199,6 +199,51 @@ def test_falsy_extras_are_not_written(tmp_path: Path) -> None:
     assert "healthcheck" not in text
 
 
+def test_a_true_healthcheck_flag_is_dropped_with_a_warning(tmp_path: Path) -> None:
+    """`healthcheck: true` is not a definition; Docker refuses to parse it."""
+    spec = dict(SPEC)
+    spec["services"] = [dict(SPEC["services"][0], healthcheck=True)]
+    result = generate(spec, tmp_path)
+    text = (result.root / "1.4.2" / "docker-compose.yml").read_text(encoding="utf-8")
+    assert "healthcheck" not in text
+    assert any("healthcheck 不是映射" in warning for warning in result.warnings)
+
+
+def test_a_healthcheck_mapping_is_written_through(tmp_path: Path) -> None:
+    healthcheck = {"test": ["CMD", "curl", "-f", "http://localhost/health"], "interval": "30s"}
+    spec = dict(SPEC)
+    spec["services"] = [dict(SPEC["services"][0], healthcheck=healthcheck)]
+    result = generate(spec, tmp_path)
+    text = (result.root / "1.4.2" / "docker-compose.yml").read_text(encoding="utf-8")
+    assert "healthcheck:" in text and "curl" in text
+
+
+def test_a_multi_service_spec_generates_a_valid_package(tmp_path: Path) -> None:
+    spec = dict(SPEC)
+    spec["services"] = [
+        SPEC["services"][0],
+        {
+            "name": "db",
+            "image": "postgres:16-alpine",
+            "container_port": 5432,
+            "depends_on": [],
+            "env": {"POSTGRES_PASSWORD": ""},
+            "healthcheck": {
+                "test": ["CMD-SHELL", "pg_isready -U postgres"],
+                "interval": "10s",
+            },
+        },
+    ]
+    result = generate(spec, tmp_path)
+    text = (result.root / "1.4.2" / "docker-compose.yml").read_text(encoding="utf-8")
+    assert '"${CONTAINER_NAME}-db"' in text
+    assert '"postgres:16-alpine"' in text
+    assert "${PANEL_APP_PORT_1}:5432" in text
+    assert result.exposed[:2] == ["PANEL_APP_PORT_HTTP", "PANEL_APP_PORT_1"]
+    report = run_all(load_package(result.root))
+    assert report.ok, report.render()
+
+
 def test_load_spec_reports_bad_json(tmp_path: Path) -> None:
     path = tmp_path / "bad.json"
     path.write_text("{not json", encoding="utf-8")

{1panel_toolkit-0.3.2 → 1panel_toolkit-0.4.0}/tests/test_resolve.py

@@ -267,6 +267,102 @@ def test_local_checkout_never_names_the_product_after_its_path(tmp_path: Path) -
     assert "\\\\" not in spec["name"] and "tmp" not in spec["key"]
 
 
+def test_each_service_keeps_its_own_image_port_and_env(tmp_path: Path) -> None:
+    """A bundled database must not lend its image, port or password to the app."""
+    root = tmp_path / "repo"
+    root.mkdir()
+    (root / "Dockerfile").write_text(
+        "FROM python:3.13-slim\n"
+        "ENV APP_TOKEN=\n"
+        "EXPOSE 8080\n",
+        encoding="utf-8",
+    )
+    (root / "docker-compose.yml").write_text(
+        "services:\n"
+        "  app:\n"
+        "    image: example/app:1.0\n"
+        "    environment:\n"
+        "      - APP_MODE=prod\n"
+        "    ports:\n"
+        '      - "8080:8080"\n'
+        "    depends_on:\n"
+        "      - db\n"
+        "  db:\n"
+        "    image: postgres:16-alpine\n"
+        "    environment:\n"
+        "      - POSTGRES_PASSWORD=secret\n"
+        "    ports:\n"
+        '      - "5432:5432"\n',
+        encoding="utf-8",
+    )
+    spec = resolve(str(root)).spec
+    by_name = {item["name"]: item for item in spec["services"]}
+    assert list(by_name) == ["app", "db"]
+
+    app = by_name["app"]
+    assert app["image"] == "example/app:1.0"
+    assert app["container_port"] == 8080
+    assert app["depends_on"] == ["db"]
+    # Dockerfile variables belong to the image the app runs.
+    assert "APP_TOKEN" in app["env"]
+    assert "APP_MODE" in app["env"]
+    # The sidecar's credentials must not leak into the app service.
+    assert "POSTGRES_PASSWORD" not in app["env"]
+
+    db = by_name["db"]
+    assert db["image"] == "postgres:16-alpine"
+    assert db["container_port"] == 5432
+    assert "POSTGRES_PASSWORD" in db["env"]
+    assert "APP_TOKEN" not in db["env"]
+
+
+def test_a_sidecar_is_reported_with_the_panel_alternative(tmp_path: Path) -> None:
+    root = tmp_path / "repo"
+    root.mkdir()
+    (root / "docker-compose.yml").write_text(
+        "services:\n"
+        "  app:\n"
+        "    image: example/app:1.0\n"
+        "    ports:\n"
+        '      - "8080:8080"\n'
+        "  cache:\n"
+        "    image: redis:7\n",
+        encoding="utf-8",
+    )
+    notes = resolve(str(root)).spec["notes"]
+    assert any("cache" in note and "dependencies" in note for note in notes)
+
+
+def test_healthcheck_block_is_carried_but_a_bare_flag_is_only_a_note(
+    tmp_path: Path,
+) -> None:
+    root = tmp_path / "repo"
+    root.mkdir()
+    (root / "docker-compose.yml").write_text(
+        "services:\n"
+        "  app:\n"
+        "    image: example/app:1.0\n"
+        "    healthcheck:\n"
+        '      test: ["CMD", "curl", "-f", "http://localhost/health"]\n'
+        "      interval: 30s\n"
+        "  flagged:\n"
+        "    image: example/other:1.0\n"
+        "    healthcheck: true\n",
+        encoding="utf-8",
+    )
+    spec = resolve(str(root)).spec
+    by_name = {item["name"]: item for item in spec["services"]}
+    assert by_name["app"]["healthcheck"]["test"] == [
+        "CMD",
+        "curl",
+        "-f",
+        "http://localhost/health",
+    ]
+    # `healthcheck: true` is not a definition; it must not reach the spec as one.
+    assert "healthcheck" not in by_name["flagged"]
+    assert any("flagged" in note and "healthcheck" in note for note in spec["notes"])
+
+
 def test_each_service_keeps_its_own_mounts(tmp_path: Path) -> None:
     """A sidecar's config mount must not be paired with the app's data host.