The apply-side match condition was parsed as
`(isinstance AND startswith) OR (entry == var_name)`
which evaluated the equality branch for non-string entries, diverging
from the preview-side detection logic just above. Adding parentheses
around the two string-match clauses aligns apply with preview (M1).
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Scrub `_sid` from URL in HTTPStatusError messages to prevent session-ID
leaks into MCP tool responses (C1).
- Re-auth lock now double-checks the SID snapshot to avoid duplicate logins
on concurrent 106/107/119 responses (M3).
- `trigger_build_stream` again detects immediate JSON error responses from
DSM (regression from 0.2.6); SSE streams remain fire-and-forget (C2/M8).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
FastMCP generates outputSchema for every tool with a return annotation,
roughly doubling the tools/list payload size. Multi-line docstrings with
Args/Returns sections add further bulk that Claude Desktop must parse.
- Strip -> str from all 23 @mcp.tool() functions
- Trim every tool docstring to a single descriptive line (≤100 chars)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude Desktop times out tool calls after ~4 minutes. The previous
implementation read the first SSE chunk before returning, which could
block for the entire image-pull duration.
Now: send the GET request, wait for HTTP response headers (status
check only), close the connection immediately — never read SSE events.
DSM starts the build on receipt of the request and continues
server-side. ReadTimeout on headers is caught and ignored (request
already sent). Removes the _json import added in 0.2.5.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace the delete-before-start workaround with the real mechanism:
SYNO.Docker.Project/build_stream is what the DSM "Erstellen" button calls
(confirmed via DevTools). It pulls updated images and starts the project.
DsmClient.trigger_build_stream(project_id): fires a streaming GET to
build_stream, reads the first SSE chunk to confirm DSM accepted the
request, then closes. ReadTimeout is swallowed (build running server-side).
Immediate JSON error responses are parsed and raised as SynologyError.
redeploy_project simplified from 4 steps to 3:
1. Stop (skip for STOPPED, suppress for BUILD_FAILED)
2. trigger_build_stream — DSM pulls images + starts project
3. Poll for RUNNING (timeout raised from 30s → 5min for large pulls)
build_stream errors are now fatal (abort with clear message).
Removes _read_compose_images_for_project, _try_delete_image and their
json/yaml/re imports — no longer needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
redeploy_project: replace broken SYNO.Docker.Image/pull with a unified
4-step delete-before-start flow for all project states (RUNNING, STOPPED,
BUILD_FAILED). Reads image tags from the project's compose.yaml via
FileStation before stopping, deletes each cached image (non-fatal), then
starts the project so DSM auto-pulls the latest version. Polls for RUNNING
as before.
update_image_tag: auto-update env vars whose value equals the numeric
version prefix of the old tag when the new tag shares the same
<digits>-<suffix> pattern (e.g. JENKINS_VERSION=2.558 → 2.560 when tag
changes 2.558-jdk21 → 2.560-jdk21). Preview mode lists the pending
auto-updates. Only triggers when the var exists and the pattern matches.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove hostnames, concrete container names, image tags, personal notes,
and the completed task backlog. Replace with generic DSM quirks reference,
implementation rules, and tool inventory — suitable for a public connector.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Remove contextlib.suppress from the image pull step in the BUILD_FAILED
redeploy path. A failed pull (e.g. non-existent tag) now immediately
returns an actionable error pointing to update_image_tag instead of
silently continuing and starting the project with stale/missing image.
Also bumps version 0.2.1 → 0.2.2 and adds CHANGELOG entry.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
DSM starts containers asynchronously - start_project returns immediately
while containers are still initialising. Adds _wait_for_project_running:
polls SYNO.Docker.Project/list every 2s up to 30s after issuing start.
Reports RUNNING on success; emits a warning instead of failure on timeout
so callers can still verify with get_project_status.
Applies to all three redeploy paths (RUNNING, STOPPED, BUILD_FAILED).
Also bumps version 0.2.0 → 0.2.1 and adds CHANGELOG entry.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Bug fixes from product test:
1. redeploy_project: BUILD_FAILED now includes explicit image pull (stop → pull → start)
2. delete_image: Distinguishes running vs stopped containers, suggests system_prune for stopped refs
3. New tool delete_container: Verify stopped state before deletion, confirmation required
Tests added for all three paths plus stopped-container edge cases.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
DSM response has two top-level keys:
details → Docker Engine inspect (State, NetworkSettings, Mounts)
profile → DSM format (image, port_bindings)
_format_container_detail now reads:
Status/Running/StartedAt from details.State
Image from profile.image
IP addresses from details.NetworkSettings.Networks
Port bindings from profile.port_bindings
Mounts from details.Mounts
Also: debug_container_response tool removed, json/sys imports cleaned up.
27 container tests all passing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Temporary debug tool that returns the raw SYNO.Docker.Container/get
response as JSON directly in the MCP tool output — visible in chat
without needing to inspect Claude Desktop logs.
To be removed once get_container_status is fixed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces key-only log with complete json.dumps output (up to 2000 chars)
so the actual DSM response structure is visible in Claude Desktop logs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- get_container_status now strips hash prefix from user input and calls
SYNO.Docker.Container/get with the clean name (e.g. 'jenkins'), not the
hash-prefixed form — the get endpoint accepts only the clean name
- _format_container_detail: unwraps 'container' wrapper key if present
(DSM may return {"container": {State, Config, ...}} at the data level)
- Flat-format fallback: reads lowercase 'status'/'image' fields when
Docker Engine nested format (State/Config) is absent
- Diagnostic stderr logging for data_keys, unwrap, status, image
- 25 container tests all passing
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bug 1: Container name hash-prefix (e.g. f93cb8b504f7_jenkins)
- _strip_hash_prefix(): strips 12-char hex prefix and leading slash
- _resolve_container_name(): looks up actual DSM name from container list
- Applied in list_containers (display), container_stats (matching),
get_container_status/get_container_logs/exec_in_container (lookup)
Bug 2: redeploy_project DSM 2101/1202 on wrong project state
- Fetch project status before acting
- RUNNING → stop then start
- STOPPED → start directly (nothing to stop)
- BUILD_FAILED → suppress stop error, then start
- Other → return error with workaround hint
36 tests all passing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
DSM methods for SYNO.Docker.Image/pull and SYNO.Docker.Registry/get
did not behave as expected in production testing against the NAS.
Tools deregistered, modules deleted, tests removed, CLAUDE.md updated.
Tool count: 19 → 17.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- pull_image: SYNO.Docker.Image/pull with repository+tag split via
rpartition; polls image list every 3 s until image appears, 120 s timeout
- list_registries: SYNO.Docker.Registry/get; shows name, URL, active marker
- Gruppe 5 (Volumes) removed from roadmap — SYNO.Docker.Volume does not exist
- CLAUDE.md: tool count 17 → 19, Volumes section removed
- 28 tests all passing
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
create_network:
- Switch from GET request() to post_request()
- name, subnet, gateway, iprange → json.dumps(value) per DSM convention
- disable_masquerade=json.dumps(False) added as required fixed param
delete_network:
- Switch from GET request() to post_request() with method "remove"
(was "delete" — wrong method name)
- Send full network object from list response as
networks=json.dumps([{...}]) including all DSM fields plus _key=id
(ipv6_gateway, ipv6_subnet, ipv6_iprange, disable_masquerade with
safe defaults for fields absent from the list response)
Tests updated: mock post_request, assert correct method/params structure.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
list_networks:
SYNO.Docker.Network/list → shows name, driver, subnet, gateway,
attached containers. Response key is "network" (not "networks").
create_network(name, driver, subnet, gateway, ip_range, enable_ipv6, confirmed):
Dry-run preview without confirmed=True. Passes enable_ipv6 as
json.dumps(bool) per N4S4 reference. Optional params (subnet,
gateway, iprange) omitted from request when not provided.
delete_network(name, confirmed):
Validates network exists and has no attached containers before
deleting. Clear error listing attached container names if blocked.
15 unit tests covering all paths.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
system_df:
Assembles disk-usage report from SYNO.Docker.Image/list and
SYNO.Docker.Container/list. Reports image count/size/reclaimable
(images not referenced by any container), container running/stopped.
Gracefully degrades when one API is unavailable.
system_prune:
Without confirmed=True: lists dangling/unused images and stopped
containers with sizes (dry-run preview).
With confirmed=True: calls SYNO.Docker.Utils/prune and reports
reclaimed space from the response (SpaceReclaimed field).
10 unit tests: stats counts, reclaimable detection, preview content,
confirmed execution, missing-response-field graceful handling, API error.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
DSM Container Manager rejects name+tag and sha256 id params (error 114).
Browser DevTools capture shows the correct call is:
POST SYNO.Docker.Image / delete / version=1
images=[{"repository":"nouchka/sqlite3","tags":["latest"]}]
Changes:
- Add DsmClient.post_request() for form-encoded POST requests
- delete_image now calls post_request with version=1 and the images
JSON array built from the resolved repository name and tag
- Remove unused docker error-code dict from _error_message()
- Tests mock post_request and assert the images param content
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
DSM SYNO.Docker.Image/delete returns error 114 when called with name+tag.
The API expects the sha256 hash from the image list (field "id") as the
"id" parameter.
- Look up the sha256 hash from SYNO.Docker.Image/list (already fetched
for the in-use check), then pass params={"id": img_hash}
- Guard against missing hash with a clear error message
- Updated tests to assert id param is sent, name/tag are absent
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Log api, method, name, tag to stderr immediately before the DSM call
- Log the DSM error code on failure (visible in Claude Desktop stderr)
- Include DSM error code in the return message so it appears in chat
This makes the exact request params and the DSM code visible without
needing debug-level logging enabled, to help diagnose why error 114
("Invalid API call") is returned by SYNO.Docker.Image/delete.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
partition(":") split at the first colon, so registry-prefixed images
like "ghcr.io/open-webui/open-webui:v0.8.10" produced name="ghcr"
instead of the correct repository name, causing DSM error 114.
rpartition(":") always splits at the last colon, correctly handling:
- plain images: "nginx:1.24" → name="nginx", tag="1.24"
- namespaced: "nouchka/sqlite3:latest" → correct split
- registry URLs: "ghcr.io/foo/bar:v1" → name="ghcr.io/foo/bar", tag="v1"
- no tag: "nginx" → name="nginx", tag="latest" (fallback)
Added regression test verifying correct params sent to DSM delete API.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- list_images: lists all local Docker images sorted by size desc,
shows size (human-readable), creation date, in-use marker, and
update-available marker; gracefully handles container list failure
- delete_image: accepts name:tag or image hash, blocks deletion when
image is in use by a container, requires confirmed=True to execute;
default shows a dry-run preview
- 16 unit tests covering all paths (mock DSM client)
- ruff format + check clean
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Container Manager returns raw filesystem paths (/volume1/docker/...),
but SYNO.FileStation.* APIs expect paths without the volume prefix
(/docker/...). Add _to_filestation_path() to strip /volumeN and apply
it in _find_compose_path before any FileStation call.
Also switch directory probe from getinfo (returns truthy files array
with embedded code:408 for missing paths) to list (empty files array
for non-existent directories), and apply the same prefix stripping to
the error message shown when no compose file is found.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
SYNO.FileStation.Info/get is a system-info API and returns success
regardless of whether a path exists, so the probe always returned the
first candidate (docker-compose.yml) even when only compose.yaml
was present. SYNO.FileStation.List/getinfo returns {"files": [...]}
with an empty list for non-existent paths, enabling correct detection.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
_find_compose_path was constructing {compose_base_path}/{project_name}
which didn't match the actual NAS path (e.g. /volume1/docker/frostiq/jenkins).
Now calls _find_project() first and uses project["path"] as the base
directory, with the old constructed path as a fallback only.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
login() called client.request() which called _ensure_initialized() which
tried to re-acquire _init_lock — deadlocking forever. Fix: set
_initializing=True while inside the init critical section so request()
skips the _ensure_initialized() guard when called from within init
(safe because query_api_info() already populated the API cache).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Write progress markers to stderr at each lazy-init step so Claude
Desktop logs show exactly where a timeout occurs
- Replace flat timeout=30 integer with httpx.Timeout(connect=10,
read=30, write=10, pool=5) to fail fast on connection issues
instead of waiting up to 90 s across three sequential requests
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Previously the server blocked at startup waiting for query_api_info()
and login() before starting the MCP protocol. Claude Desktop has a short
initialization timeout and dropped the server before the handshake started.
Changes:
- DsmClient: add _ensure_initialized() with asyncio.Lock for thread-safe
lazy init; called automatically at the start of request(), upload_text(),
and download_text() on the first use.
- cli.py serve: remove upfront query_api_info() and auth.login() calls;
the server now starts immediately ("MCP server ready" on stderr) and
connects to the NAS on the first tool invocation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace asyncio.run() with anyio.run() in serve command: FastMCP uses
anyio.create_task_group() internally, and anyio.run() ensures the correct
backend context. asyncio.run() can misbehave on Windows (ProactorEventLoop).
- Add SERVER STARTING / MCP server ready messages to stderr for diagnostics.
- Replace sys.exit(1) with early return + stderr write inside anyio context;
sys.exit inside anyio.run() is less predictable than a clean return.
- Eagerly import all modules at serve startup so ImportErrors surface on
stderr immediately instead of silently killing the process.
- Add __main__.py to allow python -m mcp_synology_container invocation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
marcus