chore: enable entire dsh (#46 )

* Enable Entire * entire dsh --------- Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
fix(gateway): grant sandboxclaims patch and map API errors to 503 (#45 )
2026-11-03 01:13:24 +00:00 · 2026-11-02 20:56:51 -03:00 · 2026-11-01 21:38:49 -03:00 · 2026-10-31 07:48:51 -03:00 · 2026-10-31 06:25:39 -03:00
22 changed files with 189 additions and 65 deletions
--- a/.entire/.gitignore
+++ b/.entire/.gitignore
@@ -0,0 +1,5 @@
+tmp/
+settings.local.json
+metadata/
+logs/
+redactors/local/
--- a/.entire/dsh-hooks.json
+++ b/.entire/dsh-hooks.json
@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "agent": "dsh",
+  "bridge": "@sredevopsorg/dsh-entire-bridge",
+  "hook_names": [
+    "session-start",
+    "turn-start",
+    "turn-end",
+    "compaction",
+    "session-end",
+    "subagent-start",
+    "subagent-end"
+  ],
+  "installed_at": "2026-11-02T06:02:27.816Z",
+  "local_dev": false
+}
--- a/.entire/settings.json
+++ b/.entire/settings.json
@@ -0,0 +1,9 @@
+{
+  "enabled": true,
+  "telemetry": true,
+  "checkpoints": {
+    "primary": {
+      "type": "git-refs"
+    }
+  }
+}
--- a/.env.sample
+++ b/.env.sample
@@ -26,7 +26,7 @@ DSH_VERSION=dsh-v0.2.1-rc.5
 # Full upstream commit SHA that DSH_VERSION resolves to; the main image build
 # fails if the clone's HEAD differs (guards against a moved tag).
 DSH_COMMIT=b830ec950faba0a46dda564be3e2d854afed94f1
-RELEASE_REVISION=
+RELEASE_REVISION=r6
 PNPM_VERSION=11.28.5
 # Container port, and the host port published by "make run".
 DSH_PORT=3080
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -82,7 +82,7 @@ needs kind plus the agent-sandbox CRDs (see the example README).
 ## Versioning and releases

 - Release identity = DSH_VERSION plus an optional -rN repository revision.
-  The current identity is dsh-v0.2.1-rc.5 (first release at this DSH ref, so no
+  The current identity is dsh-v0.2.1-rc.5-r6 (first release at this DSH ref, so no
  suffix); a repository-only change at the same ref publishes -r2.
 - Channels: release tags are immutable; latest follows the newest release;
  main is the development channel for both image packages.
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,39 @@
 All notable changes to this repository are documented here.
 Generated by git-cliff from Conventional Commits; do not edit this file by hand.

+## [dsh-v0.2.1-rc.5-r6] - 2026-10-31
+
+### Added
+
+- **example:** Persist the agent workspace on the PVC via subPath (#34) (367294b)
+- **example:** Start DSH's folder picker on the persisted workspace (#36) (82ee0d0)
+
+### CI
+
+- **workflows:** Streamline CI and remove redundant builds (#31) (dcb5b43)
+
+### Documentation
+
+- Align readmes, docs and agent guidance with current behavior (#37) (24f23e0)
+
+### Fixed
+
+- **gateway:** Answer client-aborted requests with 499, not a traceback (#32) (cbcc56f)
+- Ship bubblewrap for DSH's command sandbox, keep agents usable without it (#35) (a09d4ac)
+- **ci:** Harden workflow token scope and download integrity (#39) (2f959e6)
+- **gateway:** Replace token cookies with revocable sessions and harden abuse controls (#40) (1a929e3)
+
+### Maintenance
+
+- **changelog:** Refresh for dsh-v0.2.1-rc.5 (#30) (b57916d)
+- Bump docker/login-action (#28) (8c34f43)
+- **deps:** Bump agent-sandbox to v1.0.9 (#38) (4c073ee)
+- Improve package installation and add Python depend… (#42) (8e9bd47)
+
+### Other
+
+- Add continue-on-error to CHANGELOG PR step (97c5632)
+
 ## [dsh-v0.2.1-rc.5] - 2026-10-30

 ### Added
--- a/9
+++ b/9
@@ -68,7 +68,7 @@ RUN cd /opt/dsh \
 FROM $NODE_RUNTIME_IMAGE AS runtime

 ARG DSH_VERSION=dsh-v0.2.1-rc.5
-ARG RELEASE_REVISION=
+ARG RELEASE_REVISION=r6
 ARG PNPM_VERSION=11.28.5
 ARG VCS_REF=unknown

@@ -106,8 +106,11 @@ RUN apt-get update \
      tini \
      gh \
      bubblewrap \
+      python3 \
+      python3-pip \
+      python3-venv \
 && rm -rf /var/lib/apt/lists/* \
- && curl -LsSf https://astral.sh/uv/install.sh | sh \
+ && apt-get autoclean -y \
     && install -d -o node -g node -m 0755 /workspace "$DSH_HOME" \
     && corepack enable \
     && corepack prepare "pnpm@$PNPM_VERSION" --activate \
@@ -160,6 +163,6 @@ WORKDIR /workspace
 USER node

 EXPOSE 3080
-VOLUME ["/home/node/.dsh"]
+VOLUME ["/home/node/.dsh", "/workspace"]
 STOPSIGNAL SIGTERM
 ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/dsh-entrypoint"]
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ docker run -d --name dsh-web \
  -p 3080:3080 \
  -v dsh-home:/home/node/.dsh \
  -e DEEPSEEK_API_KEY \
-  ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5
+  ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
 ```

 DSH Web is **not usable at a bare `/`**. Without its launch-token cookie it
@@ -45,7 +45,7 @@ docker run -d --name dsh-web -p 18081:3080 \
  -e DSH_PUBLIC_URL=http://localhost:18081 \
  -v dsh-home:/home/node/.dsh \
  -e DEEPSEEK_API_KEY \
-  ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5
+  ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
 # then open http://localhost:18081/?token=...
 ```

@@ -94,20 +94,20 @@ ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway

 | Tag | Contents | Meaning |
 | --- | --- | --- |
-| `dsh-v0.2.1-rc.5` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. |
+| `dsh-v0.2.1-rc.5-r6` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. |
 | `latest` | DSH Web | Most recent release; same digest as the current identity. |
 | `main` | DSH Web | Development channel rebuilt when image-definition files change on `main`. Not a release; not for production. |

 The example gateway is published under its nested path with the same release
 identity, e.g.
-`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5`.
+`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5-r6`.

 Release identities, channels and rollback rules are explained in
 [docs/versioning.md](docs/versioning.md). Production deployments should pin a
 digest:

 ```bash
-docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5
+docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
 # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest>
 ```

@@ -188,7 +188,7 @@ required checks and releases: [docs/gitflow.md](docs/gitflow.md).

 The release identity is the upstream DSH ref plus an optional repository
 revision: `DSH_VERSION` and `RELEASE_REVISION` in [versions.env](versions.env).
-The current identity is **`dsh-v0.2.1-rc.5`** — the first release at this
+The current identity is **`dsh-v0.2.1-rc.5-r6`** — the first release at this
 upstream DSH ref, so it carries no repository revision. Tags are immutable; a
 broken release is fixed by publishing `-r(N+1)`, never by re-tagging.

--- a/docs/README.md
+++ b/docs/README.md
@@ -14,7 +14,7 @@ gets a DSH Web container running before anything else.
 | [main-image.md](main-image.md) | The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests. |
 | [examples.md](examples.md) | The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example. |
 | [gitflow.md](gitflow.md) | Branches, protected `main`, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist. |
-| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), the current identity `dsh-v0.2.1-rc.5`, why identities are immutable, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. |
+| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), the current identity `dsh-v0.2.1-rc.5-r6`, why identities are immutable, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. |
 | [workflow-security.md](workflow-security.md) | GitHub Actions security posture: least-privilege tokens, pinned actions, untrusted-input handling, download integrity checks, artifact hygiene, the latest audit record and residual repository-setting recommendations. |

 ## Project skills
--- a/docs/main-image.md
+++ b/docs/main-image.md
@@ -39,12 +39,12 @@ To reproduce the equivalent by hand:

 ```bash
 docker build \
-  --build-arg DSH_VERSION=dsh-v0.2.1-rc.5 \
+  --build-arg DSH_VERSION=dsh-v0.2.1-rc.5-r6 \
  --build-arg DSH_COMMIT=b830ec950faba0a46dda564be3e2d854afed94f1 \
  --build-arg RELEASE_REVISION= \
  --build-arg PNPM_VERSION=11.28.5 \
  --build-arg VCS_REF="$(git rev-parse --short HEAD)" \
-  -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 .
+  -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6 .
 ```

 ### Build args
@@ -209,7 +209,7 @@ GitHub Container Registry:

 | Tag | Meaning |
 | --- | --- |
-| `dsh-v0.2.1-rc.5` | Current release identity. **Immutable**: once published it never moves. |
+| `dsh-v0.2.1-rc.5-r6` | Current release identity. **Immutable**: once published it never moves. |
 | `latest` | Most recent release; points at the same digest as the current identity. |
 | `main` | Development channel rebuilt when image-definition files change on `main`; not a release, not for production. |

@@ -218,7 +218,7 @@ Release identities, channels and rollback rules are defined in
 pin a digest:

 ```bash
-docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5
+docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
 # ... pin the digest in your deployment manifests:
 #   image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest>
 ```
@@ -226,7 +226,7 @@ docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbo
 ## Verifying an image

 ```bash
-docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5 \
+docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6 \
  --format '{{json .Config.Labels}}'
 # org.opencontainers.image.title / .version / .source
 # io.sredevopsorg.dsh.version / io.sredevopsorg.release.revision
--- a/docs/versioning.md
+++ b/docs/versioning.md
@@ -15,12 +15,12 @@ release identity = DSH_VERSION + optional "-" + RELEASE_REVISION

 | Piece | Meaning |
 | --- | --- |
-| `DSH_VERSION` | The upstream DeepSeek Harness git ref being packaged, e.g. `dsh-v0.2.1-rc.5`. It mirrors upstream's own tag. |
+| `DSH_VERSION` | The upstream DeepSeek Harness git ref being packaged, e.g. `dsh-v0.2.1-rc.5-r6`. It mirrors upstream's own tag. |
 | `RELEASE_REVISION` | An optional repository revision at that DSH ref: empty for the first release, `rN` (`N >= 2`) for a repository-only re-release. |

 Examples:

- `DSH_VERSION=dsh-v0.2.1-rc.5`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.5`
+- `DSH_VERSION=dsh-v0.2.1-rc.5-r6`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.5-r6`
  (first release at that upstream ref).
 - `DSH_VERSION=<ref>`, `RELEASE_REVISION=rN` → identity `<ref>-rN` (for example
  documentation, CI or gateway changes on top of an already-released ref; no DSH
@@ -36,7 +36,7 @@ with an empty revision); a repository-only change at the same DSH ref increments
 change what an existing deployment runs. A fix therefore publishes a new identity;
 see the rules above.

-The current identity is `dsh-v0.2.1-rc.5`, the first release at this upstream
+The current identity is `dsh-v0.2.1-rc.5-r6`, the first release at this upstream
 ref, so it carries no revision suffix. The identity is stored in
 [versions.env](../versions.env) and consumed everywhere: the Dockerfile labels
 (version and revision), the example manifests, the Makefile and the release
@@ -46,7 +46,7 @@ workflow.

 | Channel | Image tag | Meaning |
 | --- | --- | --- |
-| Release | `dsh-v0.2.1-rc.5` | The current immutable release identity. What production should pin (preferably by digest). |
+| Release | `dsh-v0.2.1-rc.5-r6` | The current immutable release identity. What production should pin (preferably by digest). |
 | `latest` | `latest` | Alias for the most recent release; moves only when a new release is published. |
 | `main` | `main` | Development channel, rebuilt when image or gateway sources change on `main`. Never treat it as a release; it exists so `main` can be tested. |

@@ -60,7 +60,7 @@ Values from [versions.env](../versions.env) at the current identity:
 | Component | Pin | Source |
 | --- | --- | --- |
 | Upstream DSH source | `DSH_REPO` | [versions.env](../versions.env) |
-| DSH ref | `dsh-v0.2.1-rc.5` | `DSH_VERSION` |
+| DSH ref | `dsh-v0.2.1-rc.5-r6` | `DSH_VERSION` |
 | DSH commit | `b830ec950faba0a46dda564be3e2d854afed94f1` | `DSH_COMMIT`; the main image build fails unless the clone's `HEAD` matches |
 | Repository revision | `(empty)` | `RELEASE_REVISION` |
 | pnpm | `11.28.5` | `PNPM_VERSION` |
@@ -176,7 +176,7 @@ Release identities are immutable in theory; deployments should still pin the
 _resolved_ digest for reproducibility and supply-chain safety:

 ```bash
-docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5
+docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
 # then, in the deployment:
 #   image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256:<digest>
 ```
--- a/examples/dsh-agents-as-a-service/README.md
+++ b/examples/dsh-agents-as-a-service/README.md
@@ -270,7 +270,7 @@ kubectl delete -f manifests/40-claim-rejected.yaml
 ```bash
 # Published image (on kind, load it into the cluster; on a real cluster the
 # kubelet pulls it from GHCR):
-GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5
+GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5-r6
 docker pull "$GW"
 kind load docker-image "$GW" --name <kind-cluster>

--- a/examples/dsh-agents-as-a-service/docs/architecture.md
+++ b/examples/dsh-agents-as-a-service/docs/architecture.md
@@ -339,7 +339,7 @@ The gateway runs with a namespace-scoped ServiceAccount (`manifests/50-gateway.y

 | API group | Resource | Verbs | Why |
 | --- | --- | --- | --- |
-| `extensions.agents.x-k8s.io` | `sandboxclaims` | `get`, `list`, `create`, `delete` | signup, state, account deletion |
+| `extensions.agents.x-k8s.io` | `sandboxclaims` | `get`, `list`, `create`, `patch`, `delete` | signup, state, account deletion, token rotation |
 | `agents.x-k8s.io` | `sandboxes` | `get`, `list`, `patch` | resolve DNS/pod, wake/suspend |
 | `""` (core) | `pods` | `get`, `list` | resolve the pod behind a sandbox |
 | `""` (core) | `pods/log` | `get` | launch-token handshake |
@@ -404,6 +404,7 @@ Notes and limits:
 | DSH log line changed or rotated away | Proxy returns `503` (missing launch token) | Fix the parser or restart the pod so the token line is re-emitted |
 | Probe on `/` | Pod `CrashLoopBackOff`, `401` in probe logs | Use `/favicon.svg` for readiness/liveness (shipped templates do) |
 | Warm pool exhausted | JSON signup returns `202` (state `Waking`); form signup is slow | Increase `replicas` in the warm pool |
+| Kubernetes API error (API down or throttled, missing RBAC verb) | HTTP `503` + `Retry-After`; WebSocket close `1011` | One credential-free log line with the API `status`/`reason`, plus a fixed body; the Kubernetes `Status` payload is never proxied. Check the ServiceAccount Role and the API server — RBAC is evaluated per request, so a Role fix needs no restart |
 | Gateway restart | Idle sandboxes stop suspending; handshake cache and browser sessions lost | Idle clocks and handshake cache rebuild lazily; sessions do not, so browsers must sign in again after a rollout. Use a shared session store for production |
 | Gateway configured `COOKIE_SECURE=false` without `ALLOW_INSECURE_COOKIES=1` | Gateway pod exits at startup / `CrashLoopBackOff` | Intentional guard against an insecure cookie on an HTTPS deployment; set `ALLOW_INSECURE_COOKIES=1` only for the local plain-HTTP demo, or set `COOKIE_SECURE=true` |
 | Auth rate limit hit | `429` + `Retry-After` on signup/login | Per-client in-memory bucket (`AUTH_RATE_LIMIT`/`AUTH_RATE_WINDOW`); wait for the window or tune it. Behind a proxy, keying uses the rightmost `X-Forwarded-For` entry |
--- a/examples/dsh-agents-as-a-service/gateway/README.md
+++ b/examples/dsh-agents-as-a-service/gateway/README.md
@@ -24,7 +24,7 @@ It does four things:
 The DSH version pin lives in [`versions.env`](../../../versions.env)
 (`DSH_VERSION` plus the optional repository `RELEASE_REVISION`); the example
 manifests and published images use the release identity built from it (currently
-`dsh-v0.2.1-rc.5`). DSH binds `:3080`, gates the UI and `/api` behind a
+`dsh-v0.2.1-rc.5-r6`). DSH binds `:3080`, gates the UI and `/api` behind a
 `dsh-auth-*` cookie and requires a WebSocket at `/api/remote.mux`.

 ## Flow
@@ -175,9 +175,11 @@ oauth2-proxy's egress to the gateway, DNS and public HTTPS.
 | Sandbox not provisioned, wake timeout, handshake failure | `503` + `Retry-After: 10`. The handshake error body is a fixed message: it never contains the launch token, the handshake URL or pod/credential details. |
 | User over `MAX_IN_FLIGHT_PER_USER` | `503` + `Retry-After` (HTTP); the existing in-flight requests are untouched |
 | Upstream connection/protocol failure | `502` |
+| Kubernetes API error (API unreachable/throttled, RBAC `403`, `5xx`) | `503` + `Retry-After: 10`. The body is a fixed message; the Kubernetes `Status` payload (which can name cluster objects) is never proxied, and the API `status`/`reason` is logged once |
 | WS auth failure (unknown user, bad token, cross-origin) | accept, then close `4401` |
 | WS per-user concurrency cap | accept, then close `1011` |
 | WS upstream/handshake failure | accept, then close `1011` |
+| WS Kubernetes API error | accept, then close `1011` |
 | WS message from DSH over `WS_MAX_MESSAGE_BYTES` | the upstream/relay closes the connection (websockets' message-too-big path) |

 A close code can only be delivered after the WebSocket upgrade is accepted;
@@ -230,7 +232,8 @@ would never be sent). HTTPS deployments must set `COOKIE_SECURE=true`.

 The gateway's ServiceAccount needs, in its namespace:

-* `sandboxclaims` (`extensions.agents.x-k8s.io`): get, list, create, delete
+* `sandboxclaims` (`extensions.agents.x-k8s.io`): get, list, create, patch, delete
+  (patch rotates the token-hash annotation when a session is minted)
 * `sandboxes` (`agents.x-k8s.io`): get, list, patch
 * `pods`: get, list
 * `pods/log`: get
--- a/examples/dsh-agents-as-a-service/gateway/gateway.py
+++ b/examples/dsh-agents-as-a-service/gateway/gateway.py
@@ -1510,7 +1510,13 @@ against the JSON API. The browser session is an HttpOnly cookie.</p>
        user = websocket.path_params["user"]
        if not valid_user(user):
            return await self._ws_reject(websocket, 4401)
-        claim = await self.k8s.get_claim(user)
+        try:
+            claim = await self.k8s.get_claim(user)
+        except ApiException:
+            # Starlette has no exception handler for WebSocket scopes, so an
+            # unhandled API error would escape as a traceback and an unclean
+            # close.  1011 keeps the HTTP 503 meaning on the WS channel.
+            return await self._ws_reject(websocket, 1011)
        if claim is None:
            return await self._ws_reject(websocket, 4401)
        token, cookie_user = self.credentials(websocket.headers, websocket.cookies)
@@ -1746,6 +1752,28 @@ async def client_gone(request: Request, exc: ClientDisconnect) -> Response:
    return Response(status_code=CLIENT_CLOSED_REQUEST)


+async def k8s_api_error(request: Request, exc: ApiException) -> Response:
+    """Answer a Kubernetes API failure with 503 instead of a bare 500.
+
+    The gateway is the only path between the browser and the cluster, so an
+    API outage, a throttle or a missing RBAC verb is a server-side
+    availability problem, not a client error.  A 503 keeps ingress and
+    browser retry semantics honest, and the body is a fixed message: the
+    Kubernetes ``Status`` payload can name cluster objects and is never
+    proxied.  The API ``status``/``reason`` is logged once, credential-free.
+    """
+    print(
+        "gateway: kubernetes API error: "
+        f"status={getattr(exc, 'status', None)} reason={getattr(exc, 'reason', None)}",
+        flush=True,
+    )
+    return JSONResponse(
+        {"error": "cluster API unavailable, retry shortly"},
+        status_code=503,
+        headers={"Retry-After": "10"},
+    )
+
+
 def create_app(
    settings: Settings | None = None,
    k8s=None,
@@ -1778,7 +1806,7 @@ def create_app(
    ]
    app = Starlette(
        routes=routes,
-        exception_handlers={ClientDisconnect: client_gone},
+        exception_handlers={ClientDisconnect: client_gone, ApiException: k8s_api_error},
        lifespan=_lifespan(gateway, http_client if owns_http_client else None),
    )
    app.state.gateway = gateway
--- a/examples/dsh-agents-as-a-service/gateway/requirements-dev.txt
+++ b/examples/dsh-agents-as-a-service/gateway/requirements-dev.txt
@@ -1207,12 +1207,12 @@ pydantic-core==2.50.2 \
 pygments==2.21.0 \
    --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \
    --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c
-pytest==9.2.0 \
-    --hash=sha256:07acdcf88ec174f907dc01af70bf52d49b014bbab03faeeade31c96b18c2e588 \
-    --hash=sha256:97c4f3b1f3c7414aa36465e09b8220f1d03627993bd51b1282e193753c80557b
-pytest-asyncio==1.4.1 \
-    --hash=sha256:507afa78ec77c6661164ef1a2368bc7820383fd1a14b2a7f813de8b5a92949cc \
-    --hash=sha256:e8266eb094e5ee9ffdb2068c9836f33e209ea77a970eb846933d416b5602669b
+pytest==9.1.1 \
+    --hash=sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313 \
+    --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
+pytest-asyncio==1.4.0 \
+    --hash=sha256:933ca923a23075a87fb7070c0ec272a6848489824d887c85c812670932835aa1 \
+    --hash=sha256:c6c0d2259945122819f171a32ecea2c349ead889ee28176caaf492143424be42
 pytest-cov==7.1.0 \
    --hash=sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2 \
    --hash=sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678
@@ -1305,25 +1305,25 @@ requests==2.34.2 \
 requests-oauthlib==2.0.0 \
    --hash=sha256:7dd8a5c40426b779b0868c404bdef9768deccf22749cde15852df527e6269b36 \
    --hash=sha256:b3dffaebd884d8cd778494369603a9e7b58d29111bf6b41bdc2dcd87203af4e9
-ruff==0.17.3 \
-    --hash=sha256:029c37cbd3de48ca37aa12117bead2d065f15da17d66bf84e0d4274013705db2 \
-    --hash=sha256:27bb571ac78fef178fe5118d2827df95c2aae74a48fff2b15f6acd03af5ff5bb \
-    --hash=sha256:39405f341deec934b4289634324ad695f72df2970f9121582872eaf5b722f0f5 \
-    --hash=sha256:4590b9d86c0b1543ebb09094254e191cd43fe8edaf330baa035aab03da251532 \
-    --hash=sha256:46539cb031b01fd29ae0a02142483c46640b233ee12bb1c1b690bffa1555d5ca \
-    --hash=sha256:56b8ffb3f3b3cbccb8b76b71b38261b7ed982ef5d20f5b447b1b61a7f4949b24 \
-    --hash=sha256:68074094f55ca3d29ab19491f640282f7a84061c4c7977aa5094b968ca457e9a \
-    --hash=sha256:692fdb46d0fd9c71e380947dc5fc72f2c3f881073bc1f739e4579376231affbe \
-    --hash=sha256:6a754c0341bc9ca151b7b335988b3263921c08859f84ca219b70cee825571b6f \
-    --hash=sha256:7fa4b0f931cdbcb8a52044f370a3eb429fb42eb88807b0e800fcaa98dd42b24e \
-    --hash=sha256:81fce74bcd6be0e9da7c67c7553fd0f1f12964a2052cd728ef917b937a5ca1d9 \
-    --hash=sha256:a57049c8addb3662073859bb55a7ad35aa54f8a7c9ed268911d1333c5aadaaa9 \
-    --hash=sha256:ab5fa7ed5ce18554ea69d850ad162cbaa0c85fc47c08d83a569f806681c9a6ad \
-    --hash=sha256:ab86b84cd9d05e56d329742c0cabdcbe2d1d56c98f4a04aab9b5b66196febfb4 \
-    --hash=sha256:b75cc113b3aca388933d8296b667b1ac401a80317ea3074c9b0a66541199da29 \
-    --hash=sha256:bbde18beccd98c29a227c63c99022e3443b99258e08326df6425dfe0443705ef \
-    --hash=sha256:c673c170e27834d1262e3a9c1e97bdc9b9c3b180c63d89173ce69747232474c1 \
-    --hash=sha256:e407b4a6852853a9a2cdce96963e94ad9775578bb44e7561a0f2829f3cc04b11
+ruff==0.17.2 \
+    --hash=sha256:122258f6ecde0e0dd1bb60b24263c3edde4338caf723fca711cc729f9bfd414a \
+    --hash=sha256:195ad918027f817c119310ca89a42d347887dfc28934aaa869325e9c5dc9d962 \
+    --hash=sha256:1b59d447f197bef9ef48a22ba1a6016137753c6099e9bac9c36eb566e422424c \
+    --hash=sha256:2d086be452eed686aa51271ecf2cbe5037956517cc6ee39a17b4489ac12f8bbe \
+    --hash=sha256:39c5b55c960515cdb32be16e69efb5734c589c06a0eb38a22694524a336b889d \
+    --hash=sha256:583bd67bb9e7061dd09bc46a0a884bae2bbd214dbcd48e509813612619683869 \
+    --hash=sha256:5875a16b0de70b43cb81eabea5ae5e8f5d1b2fd1b5e6ed07f80cfe5019d0bd5a \
+    --hash=sha256:6bce7d1f5165701ae18f5df85c65afe78cddfa6c5fb4b9bdb0014d60388f3edd \
+    --hash=sha256:7cfd783590edf2b77317882631900f6a13ea2e8eacefe6ebf2370d2715299160 \
+    --hash=sha256:7f8fba429d6ac4128ab29cfb8fa6240d2fa671d04adf7f84d3b22fc7b6b6bea4 \
+    --hash=sha256:84d632402d14c23b488f941db23712d6736a013225162062d34558c3f3c780eb \
+    --hash=sha256:8c21b4ab24485358f17291a4f8dc5399b834e963b8efedd920fe4fdb02081bb4 \
+    --hash=sha256:92a80d2f44584dabb0189b3a6c393e37e525e04942838482010575cb81945be7 \
+    --hash=sha256:96a65e755d8dba094707fb23ab602111d9a31ec2835b3a6992a1914a8fcb211e \
+    --hash=sha256:b7d0906677d89bbf3cf73cde64b5bbe2ab35df3ae43e49ee2627301e91265bac \
+    --hash=sha256:ba405cbd5ec7bda1f555d5e52be1fd68d02608d4d95d24591bdac92cfacb579f \
+    --hash=sha256:c555a877f8f41447e318101cfefea9bf12dfa9f82eedf90c376e57e069f917d0 \
+    --hash=sha256:c60f93fec7142dba5b8f487f94bf2f6231dae24dc11e4c48648347c8b0720004
 six==1.17.0 \
    --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
    --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81
--- a/examples/dsh-agents-as-a-service/gateway/test_gateway.py
+++ b/examples/dsh-agents-as-a-service/gateway/test_gateway.py
@@ -1176,12 +1176,14 @@ async def test_delete_missing_claim_is_404(env):


@pytest.mark.asyncio
-async def test_unexpected_api_error_propagates(env):
+async def test_unexpected_api_error_returns_503(env):
    add_user(env.k8s)
    env.k8s.get_claim_error = ApiException(status=500)
    async with asgi_client(env) as client:
-        with pytest.raises(ApiException):
-            await client.get("/users/alice")
+        response = await client.get("/users/alice")
+    assert response.status_code == 503
+    assert response.headers["retry-after"] == "10"
+    assert response.json() == {"error": "cluster API unavailable, retry shortly"}


@pytest.mark.asyncio
@@ -1831,6 +1833,16 @@ def test_ws_unauthenticated_closes_4401(env):
    assert exc.value.code == 4401


+def test_ws_kubernetes_api_error_closes_1011(env):
+    add_user(env.k8s)
+    env.k8s.get_claim_error = ApiException(status=503)
+    with TestClient(env.app) as client:
+        with client.websocket_connect("/u/alice/api/remote.mux") as ws:
+            with pytest.raises(WebSocketDisconnect) as exc:
+                ws.receive_text()
+    assert exc.value.code == 1011
+
+
 def test_ws_cookie_cross_origin_closes_4401(env):
    add_user(env.k8s)
    with TestClient(env.app) as client:
@@ -2149,6 +2161,19 @@ def test_remote_user_returns_valid_and_rejects_invalid(env):
    assert g.remote_user({}) is None


+@pytest.mark.asyncio
+async def test_sso_landing_returns_503_when_claim_patch_is_forbidden(env):
+    """A missing RBAC verb on ``patch sandboxclaims`` used to escape as a 500."""
+    enable_sso(env)
+    env.k8s.claims["alice"] = {"metadata": {"name": claim_name("alice")}}
+    env.k8s.patch_error = ApiException(status=403)
+    async with asgi_client(env) as client:
+        response = await client.get("/", headers={"X-Forwarded-User": "alice"})
+    assert response.status_code == 503
+    assert response.headers["retry-after"] == "10"
+    assert response.json() == {"error": "cluster API unavailable, retry shortly"}
+
+
@pytest.mark.asyncio
 async def test_sso_landing_new_user_shows_provisioning(env):
    enable_sso(env)
--- a/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml
+++ b/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml
@@ -73,7 +73,7 @@ spec:
        fsGroupChangePolicy: OnRootMismatch
      containers:
        - name: dsh-web
-          image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5
+          image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
          imagePullPolicy: IfNotPresent
          ports:
            - name: web
--- a/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml
+++ b/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml
@@ -26,7 +26,8 @@ metadata:
  namespace: dsh-demo
 ---
 # Least privilege:
-#   - claims are created/deleted per user (signup/delete);
+#   - claims are created/deleted per user (signup/delete) and patched only to
+#     rotate the token-hash annotation when a session is minted;
 #   - sandboxes are read, and patched only to flip operatingMode (suspend/resume);
 #   - pods are read, and pods/log is read to capture DSH's launch token from
 #     the startup log line (`dsh web: ...?token=...`).
@@ -39,7 +40,7 @@ metadata:
 rules:
  - apiGroups: ["extensions.agents.x-k8s.io"]
    resources: ["sandboxclaims"]
-    verbs: ["get", "list", "create", "delete"]
+    verbs: ["get", "list", "create", "patch", "delete"]
  - apiGroups: ["agents.x-k8s.io"]
    resources: ["sandboxes"]
    verbs: ["get", "list", "patch"]
@@ -101,7 +102,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: gateway
-          image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5
+          image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.5-r6
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
--- a/examples/minimal-single-tenant/manifests/10-sandboxtemplate.yaml
+++ b/examples/minimal-single-tenant/manifests/10-sandboxtemplate.yaml
@@ -56,7 +56,7 @@ spec:
        fsGroupChangePolicy: OnRootMismatch
      containers:
        - name: dsh-web
-          image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5
+          image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.5-r6
          imagePullPolicy: IfNotPresent
          ports:
            - name: web
--- a/scripts/set-version.sh
+++ b/scripts/set-version.sh
@@ -3,7 +3,7 @@
 # "make check".
 #
 #   ./scripts/set-version.sh dsh-v0.2.2-rc.1        # new DSH ref, no revision
-#   ./scripts/set-version.sh dsh-v0.2.1-rc.5 r3    # same ref, new repo revision
+#   ./scripts/set-version.sh dsh-v0.2.1-rc.5-r6 r3    # same ref, new repo revision
 #
 # For a new DSH ref the script resolves the tag's commit with "git ls-remote"
 # (peeled ^{} commit first, tag ref as fallback) and rewrites DSH_COMMIT in
--- a/versions.env
+++ b/versions.env
@@ -18,9 +18,9 @@ PNPM_VERSION=11.28.5
 # Release identity = DSH_VERSION plus an optional repository revision.
 # An empty RELEASE_REVISION is the first release at this DSH ref; rN (N >= 2)
 # marks a repository-only re-release at the same DSH ref. This is the first
-# release at dsh-v0.2.1-rc.5, so the identity is the plain tag; a later
+# release at dsh-v0.2.1-rc.5-r6, so the identity is the plain tag; a later
 # repository-only change at the same ref becomes -r2.
-RELEASE_REVISION=
+RELEASE_REVISION=r6

 # Base images for the main DSH Web image (root Dockerfile), pinned by digest.
 NODE_BUILD_IMAGE=docker.io/node:24-trixie@sha256:8c761eca2bf7eec965f946cf47b8090143cb41f45f2f8699af0cc0298d2d2d19
Author	SHA1	Message	Date
SREDevOps.org Agent	2178e58d57	chore: enable entire dsh (#46 ) * Enable Entire * entire dsh --------- Co-authored-by: SREDevOpsAgents <agents@sredevops.org>	2026-11-02 20:56:51 -03:00
SREDevOps.org Agent	fbe886f3b9	fix(gateway): grant sandboxclaims patch and map API errors to 503 (#45 ) * fix(gateway): grant patch on sandboxclaims for token rotation The SSO landing path calls K8sClient.patch_token(), which patches the `dsh-<user>` SandboxClaim's token-hash annotation whenever the browser has no valid gateway session: first visit, an expired or foreign cookie, or a gateway restart that drops the in-memory session store. The gateway Role only granted get/list/create/delete on sandboxclaims, so the patch returned 403 and, because ApiException is not handled, every such GET / answered a bare 500 "Internal Server Error". Grant the missing `patch` verb on extensions.agents.x-k8s.io/sandboxclaims, and update the least-privilege comment plus the two docs that enumerate the Role verbs. Verified with `make check` (versions, example layout, manifests) and `yamllint`; the 403 and the resulting 500 were reproduced from a running install and cleared by applying the equivalent Role patch (RBAC is evaluated per request, so no gateway restart is needed). * fix(gateway): return 503 instead of a bare 500 on Kubernetes API errors Every gateway route talks to the Kubernetes API, and ApiException used to be unhandled: Starlette's ServerErrorMiddleware turned it into a bare 500 "Internal Server Error" plus an ERROR traceback. That masked a missing RBAC verb as a client-visible crash on GET / (the SSO landing path), and it would equally hide an API outage or throttling. Register an ApiException handler that logs one credential-free line (status/reason) and answers 503 + Retry-After with a fixed body, so the Kubernetes Status payload (which can name cluster objects) is never proxied. Guard the first get_claim() in the WebSocket route the same way: WebSocket scopes bypass Starlette's HTTP exception handlers, so it now closes with 1011 instead of escaping as a traceback. Tests assert the 503 + Retry-After response, cover the SSO landing path that produced the reported 500 (forbidden claim patch), and assert the WebSocket close code. The failure-semantics tables document the new behaviour. --------- Co-authored-by: SREDevOpsAgents <agents@sredevops.org>	2026-11-01 21:38:49 -03:00
Nicolás Georger	c5b8afde48	chore(changelog): refresh for dsh-v0.2.1-rc.5-r6 (#44 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-10-31 07:48:51 -03:00
Nicolás Georger	8e9bd478b4	chore: improve package installation and add Python depend… (#42 ) * chore(dockerfile): improve package installation and add Python dependencies * chore(dockerfile): update package installation commands for consistency * chore: update release version to dsh-v0.2.1-rc.5-r6 across documentation and configuration files	2026-10-31 06:25:39 -03:00