dsh-tool-monitoring

English | 中文

A Cordis tool plugin that gives DeepSeek Harness (dsh) monitoring and alerting capabilities. Agents can query Prometheus, inspect targets, alerts, rules, series, labels, metric metadata, TSDB, build, runtime, configuration and command-line flag status, inspect discovered Alertmanagers, run Loki LogQL queries and inspect log labels, series, index statistics, rule groups, rules, alerts, index volume, detected patterns and detected fields, inspect Grafana health, admin stats, datasources, plugins, dashboards, folders, annotations, alert rules, alert instances, service accounts, teams, org users, org quotas, folder, dashboard and datasource permissions, access control roles, built-in roles, user and team role assignments, user/team permissions, org preferences, current user context, library elements, playlists, current org, dashboard versions and snapshots, contact points and notification policies, and manage Alertmanager alerts, alert groups, silences and receivers.

It follows the official plugin architecture with ctx.tools.register(defineTool(...)) and the adding-a-tool contract.

Install

Install from npm:

npm install @libai168/dsh-tool-monitoring

Or install directly from GitHub:

npm install github:LJH-snow/dsh-tool-monitoring

Requires @deepseek-ai/cordis (^4.0.1) and @deepseek-ai/dsh-tools (^0.1.0-rc.6) as peer dependencies, provided by the host dsh runtime.

Configuration

Load the plugin in a dsh composition config (cordis.yml):

- name: 'github:LJH-snow/dsh-tool-monitoring'
  config:
    prometheusBaseUrl: 'http://prometheus:9090'       # optional, default http://localhost:9090
    prometheusToken: 'plain_token_or_Bearer_token'    # optional
    alertmanagerBaseUrl: 'http://alertmanager:9093'   # optional, default http://localhost:9093
    alertmanagerToken: 'plain_token_or_Bearer_token'  # optional
    lokiBaseUrl: 'http://loki:3100'                   # optional, default http://localhost:3100
    lokiToken: 'plain_token_or_Bearer_token'          # optional
    lokiTenantId: 'tenant-a'                          # optional, multi-tenant Loki only
    grafanaBaseUrl: 'http://grafana:3000'             # optional, default http://localhost:3000
    grafanaToken: 'plain_token_or_Bearer_token'       # optional
    timeoutMs: 15000                                  # optional, default 15000
    allowWrite: false                                 # optional, write tools are disabled by default

Full example: examples/cordis.yml.

Each component can also use HTTP Basic Auth with prometheusUsername/prometheusPassword, alertmanagerUsername/alertmanagerPassword, lokiUsername/lokiPassword, or grafanaUsername/grafanaPassword. Set a base URL to an empty string to disable that component and return an explicit connected: false business value.

Security: write tools are gated by allowWrite. Keep it false unless the dsh runtime is explicitly allowed to delete Prometheus series, create or delete Alertmanager silences, or send alerts.

Tools

Prometheus tools:

Loki tools:

Grafana tools:

Alertmanager tools:

Behavior Contract

• If a component base URL is not configured, read tools return { connected: false, reason }.
• Write tools return { ok: false, reason } when allowWrite is disabled or when the monitoring service rejects the request with a validation error.
• Prometheus and Loki API-level errors plus HTTP 400 write validation errors are mapped to business failure values.
• Infrastructure errors such as invalid credentials (401), forbidden access (403), rate limiting (429), or server failures (5xx) throw MonitoringError.
• Every request forwards exec.signal and uses a configurable timeout (default 15 seconds).

Development

npm install
npm run typecheck
npm test
npm run build

See DEVELOPMENT.md for architecture and coverage.

License

MIT