deepseek-harness

32 Commits 5 Branches 35 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
dsh-relay	0af110766d	ci: pick the webserver bind address from the installed schema Sync upstream and build images / sync-and-build (push) Successful in 38m42s Details The 0.2.1-alpha.2 fix rendered `host` onto the container's own address unconditionally. Every earlier release still validates it against the union of the two literals 127.0.0.1 and 0.0.0.0, so those images now die in the boot smoke test with @deepseek-ai/dsh-host-webserver: ValidationError: invalid config: - $.host expected "127.0.0.1" \| "0.0.0.0" but got "172.17.0.22" (at host) and their refresh rebuilds -- which the recipe-hash change re-queued anyway -- can no longer succeed. Probe the installed webserver schema instead: where it rejects the unspecified address render the container's own IPv4, otherwise keep 0.0.0.0 so older versions build exactly as they did before. The probe is overridable through DSH_INSTALL_ROOT so both branches are testable.	2026-10-13 21:09:56 -04:00
dsh-relay	8363be933d	Bind the web UI to the container's own address: dsh 0.2.1+ rejects 0.0.0.0 Sync upstream and build images / sync-and-build (push) Successful in 24m26s Details dsh 0.2.1-alpha.2 validates `webserver.host` in a schemastery transform and throws on the unspecified address ("is an unspecified (wildcard) address, which is not supported: binding every interface would expose remote code execution to the network; bind one concrete IPv4 or IPv6 address of a local interface instead"). The check is config-level, so the --patch opt-in that carried 0.0.0.0 through the 0.1.x schema no longer works, and every build of 0.2.1-alpha.2 has failed the boot smoke test before the image could be pushed (the tag exists, so the release page has no image and no notes). The shipped patch becomes a template; docker-entrypoint.sh renders it onto the container's first non-internal IPv4 (the same address the smoke test probes) and passes the rendered copy to dsh, so a port published on the Docker host still reaches the UI while the socket binds one concrete interface. Set DSH_WEB_HOST to override the address. The substitution also accepts the old literal `host: 0.0.0.0` template, so either file can land first.	2026-10-13 20:45:00 -04:00
Miles WardandClaude Fable 5	768de4ac75	Unraid template support: baked --patch layer, /workspace, logo, template in README Sync upstream and build image / sync-and-build (push) Successful in 19s Details - Ship /opt/deepseek-harness/web.cordis.patch.yml and pass it via upstream's --patch launcher flag (must precede the web command's own flags) instead of seeding DSH_HOME; entrypoint accepts template Post Arguments verbatim. - Add /workspace (agent WORKDIR) and pin DSH_HOME=/home/node/.dsh; drop the implicit /home/node volume so templates mount .dsh and /workspace cleanly. - README: Unraid template (repo/support/icon/versions corrected for this image, lanmode plugin caution), first-run chown note, DeepSeek logo. Verified: no-args, flags-only, and full template invocations all serve the web UI; trust fence still 403s unknown Hosts; state persists to mounted .dsh. Co-Authored-By: Claude Fable 5 <[email protected]>	2026-09-02 03:07:45 -04:00

Author

SHA1

Message

Date

dsh-relay

0af110766d

ci: pick the webserver bind address from the installed schema

Sync upstream and build images / sync-and-build (push) Successful in 38m42s

Details

The 0.2.1-alpha.2 fix rendered `host` onto the container's own address
unconditionally. Every earlier release still validates it against the union of
the two literals 127.0.0.1 and 0.0.0.0, so those images now die in the boot
smoke test with

  @deepseek-ai/dsh-host-webserver: ValidationError: invalid config:
    - $.host expected "127.0.0.1" | "0.0.0.0" but got "172.17.0.22" (at host)

and their refresh rebuilds -- which the recipe-hash change re-queued anyway --
can no longer succeed. Probe the installed webserver schema instead: where it
rejects the unspecified address render the container's own IPv4, otherwise keep
0.0.0.0 so older versions build exactly as they did before. The probe is
overridable through DSH_INSTALL_ROOT so both branches are testable.

2026-10-13 21:09:56 -04:00

dsh-relay

8363be933d

Bind the web UI to the container's own address: dsh 0.2.1+ rejects 0.0.0.0

Sync upstream and build images / sync-and-build (push) Successful in 24m26s

Details

dsh 0.2.1-alpha.2 validates `webserver.host` in a schemastery transform and
throws on the unspecified address ("is an unspecified (wildcard) address,
which is not supported: binding every interface would expose remote code
execution to the network; bind one concrete IPv4 or IPv6 address of a local
interface instead"). The check is config-level, so the --patch opt-in that
carried 0.0.0.0 through the 0.1.x schema no longer works, and every build of
0.2.1-alpha.2 has failed the boot smoke test before the image could be pushed
(the tag exists, so the release page has no image and no notes).

The shipped patch becomes a template; docker-entrypoint.sh renders it onto the
container's first non-internal IPv4 (the same address the smoke test probes)
and passes the rendered copy to dsh, so a port published on the Docker host
still reaches the UI while the socket binds one concrete interface. Set
DSH_WEB_HOST to override the address. The substitution also accepts the old
literal `host: 0.0.0.0` template, so either file can land first.

2026-10-13 20:45:00 -04:00

Miles WardandClaude Fable 5

768de4ac75

Unraid template support: baked --patch layer, /workspace, logo, template in README

Sync upstream and build image / sync-and-build (push) Successful in 19s

Details

- Ship /opt/deepseek-harness/web.cordis.patch.yml and pass it via upstream's
  --patch launcher flag (must precede the web command's own flags) instead of
  seeding DSH_HOME; entrypoint accepts template Post Arguments verbatim.
- Add /workspace (agent WORKDIR) and pin DSH_HOME=/home/node/.dsh; drop the
  implicit /home/node volume so templates mount .dsh and /workspace cleanly.
- README: Unraid template (repo/support/icon/versions corrected for this
  image, lanmode plugin caution), first-run chown note, DeepSeek logo.

Verified: no-args, flags-only, and full template invocations all serve the
web UI; trust fence still 403s unknown Hosts; state persists to mounted .dsh.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-09-02 03:07:45 -04:00