fix(docker): install pnpm for DeepSeek profile - #350
Conversation
… gate Follow-up to #350, which fixed the actual blocker (issue #352): `dsh plugin` is a thin forwarder that `spawnSync`s a literal `pnpm` with no npm fallback, so an image without pnpm dies at exit 127 and takes the whole build with it. That PR also pinned an allowlist of the two packages whose lifecycle scripts pnpm blocked at the time. Replace it with a policy that cannot go stale: pnpm, unlike npm, refuses dependency build scripts by default and FAILS the install over it (`ERR_PNPM_IGNORED_BUILDS`, exit 1, measured on pnpm 11.24), and the names to allow move between rebuilds because `@deepseek-harness-tui/dsh-tui` is resolved by dist-tag, not pinned: 0.9.3 pulled `@google/genai` (whose script is a literal `preinstall: no-op`), 0.10.0-beta.x does not. An allowlist of two names would have let the next tree break the build the same way. Allowing them wholesale is also the exposure this image already accepts three layers up, where `npm install -g` runs the install scripts of every transitive dep of the five CLIs above with no gate at all. Also correct a comment in the `/api/deepseek/install-profile` route that asserted the opposite of what #352 proved ("dsh bundles its own package manager, so no system pnpm is required"). The route's behavior is already right: dsh's own "pnpm not found on PATH" stderr reaches the caller as the OPERATION_FAILED detail, so the UI's "add a terminal profile" button names the fix. Documented the prerequisite in docs/deepseek-integration.md, and taught the docker-cases image smoke test about `dsh`/`omp` plus the profile check that `dsh --version` does NOT cover.
|
Merged, thanks. Your diagnosis was exactly right, and it holds up in the source: One follow-up landed on top (d5b5f8f). I dropped the Verified with a full Thanks for the fix and for the write-up, it made this a five-minute confirmation instead of a hunt. Ships in the next release. |
2 participants
What
Restore clean builds of the Docker agent base image by installing pnpm and preparing the DeepSeek Harness TUI profile with its required lifecycle-script allow-list.
This preserves Codeman's ability to auto-build
codeman/agent:baseand then spawn isolated case containers when the base image is not already present.When
The failure was reproduced on 27 August 2026 against upstream
masterat7dfb4acfwith a no-cache, pull-enabled build:docker build --progress=plain --no-cache --pull --file docker/agent.Dockerfile .The build stopped while adding the DeepSeek TUI profile with exit code 127:
Why
@deepseek-ai/dshdelegates profile dependency management to pnpm. The Dockerfile installed thedshCLI but did not install pnpm, sodsh plugin --profile dsh-tui add ...could not complete.Because Codeman normally auto-builds this base image on the first isolated Docker case, a clean host could not create its first isolated agent container after the image build failed.
pnpm also controls dependency lifecycle scripts through the profile workspace configuration. The DeepSeek TUI dependency tree requires the
@google/genaipreinstall andprotobufjspostinstall scripts during profile installation.How
@deepseek-ai/dshas an image build dependency.dsh-tuiprofile with lifecycle scripts disabled.allowBuildspolicy for@google/genaiandprotobufjs.@deepseek-harness-tui/dsh-tuiafter the policy exists, allowing only those required scripts to run.Validation
agentuser and contains pnpm 11.24.0, dsh 0.1.1-rc.2, and@deepseek-harness-tui/dsh-tui0.9.3.npm run typecheckpassed.npm run lintpassed.npm run format:checkpassed.npm run check:frontend-syntaxpassed for all 34 frontend JavaScript files.npm testpassed: 6,283 passed and 12 skipped across 318 test files.