fix: manual-only CI/releases and safer Docker inventory

.claude/skills/vibeshell/references/docker-containers.md

@@ -1,6 +1,6 @@
 # Docker Containers — docker-containers
 
-Plugin `docker-containers` version `1.4.0`.
+Plugin `docker-containers` version `1.5.0`.
 
 Inspect and manage containers, images, live resource usage and recent container logs through the remote Docker CLI.
 
@@ -18,6 +18,116 @@ Required permissions: `["remote_exec","local_exec"]`. Session types: `["ssh","lo
 
 `describe` returns machine-readable action input schemas. `docs` regenerates the current reference, including imported plugins. `run` reuses the selected session. `--confirm` is only for an action the user has explicitly approved; `--sudo` is opt-in and also needs confirmation. No operation bypasses installation, enablement, permission or input checks. Output is bounded and carries timing/truncation metadata. Local targets require a running GUI-owned local session.
 
+## `running-containers`
+
+List running containers with full IDs; paused and restarting containers are not shell-ready.
+
+```sh
+vibeshell plugins run docker-containers running-containers --session SESSION_ID --inputs '{}'
+```
+
+Replace SESSION_ID and supply all fields marked required below. Do not execute placeholder values. Append `--confirm` only after consent for this exact action.
+
+```json
+{
+  "allowSudo": true,
+  "description": "List running containers with full IDs; paused and restarting containers are not shell-ready.",
+  "elevate": false,
+  "id": "running-containers",
+  "inputSchema": {
+    "additionalProperties": false,
+    "properties": {},
+    "required": [],
+    "type": "object"
+  },
+  "name": "Running containers",
+  "output": {
+    "columns": [
+      "ID",
+      "Name",
+      "Image",
+      "State",
+      "Status",
+      "Ports"
+    ],
+    "delimiter": "\t",
+    "kind": "table"
+  },
+  "requiresConfirmation": false
+}
+```
+
+## `exited-containers`
+
+Inspect exited containers separately without starting or restarting them.
+
+```sh
+vibeshell plugins run docker-containers exited-containers --session SESSION_ID --inputs '{}'
+```
+
+Replace SESSION_ID and supply all fields marked required below. Do not execute placeholder values. Append `--confirm` only after consent for this exact action.
+
+```json
+{
+  "allowSudo": true,
+  "description": "Inspect exited containers separately without starting or restarting them.",
+  "elevate": false,
+  "id": "exited-containers",
+  "inputSchema": {
+    "additionalProperties": false,
+    "properties": {},
+    "required": [],
+    "type": "object"
+  },
+  "name": "Exited containers",
+  "output": {
+    "columns": [
+      "ID",
+      "Name",
+      "Image",
+      "State",
+      "Status",
+      "Ports"
+    ],
+    "delimiter": "\t",
+    "kind": "table"
+  },
+  "requiresConfirmation": false
+}
+```
+
+## `container-inventory`
+
+Read all container states and full IDs as one JSON object per line, not a JSON array. This does not create a container session.
+
+```sh
+vibeshell plugins run docker-containers container-inventory --session SESSION_ID --inputs '{}'
+```
+
+Replace SESSION_ID and supply all fields marked required below. Do not execute placeholder values. Append `--confirm` only after consent for this exact action.
+
+```json
+{
+  "allowSudo": true,
+  "description": "Read all container states and full IDs as one JSON object per line, not a JSON array. This does not create a container session.",
+  "elevate": false,
+  "id": "container-inventory",
+  "inputSchema": {
+    "additionalProperties": false,
+    "properties": {},
+    "required": [],
+    "type": "object"
+  },
+  "name": "Container inventory (JSON Lines)",
+  "output": {
+    "columns": [],
+    "delimiter": "\t",
+    "kind": "text"
+  },
+  "requiresConfirmation": false
+}
+```
+
 ## `containers`
 
 List running and stopped containers.
@@ -215,7 +325,7 @@ Replace SESSION_ID and supply all fields marked required below. Do not execute p
 
 ## `exec-command`
 
-Run one non-interactive shell command inside a container.
+Run one non-interactive shell command inside a container. This does not create a persistent container session or change the host session.
 
 ```sh
 vibeshell plugins run docker-containers exec-command --session SESSION_ID --inputs '{}'
@@ -226,7 +336,7 @@ Replace SESSION_ID and supply all fields marked required below. Do not execute p
 ```json
 {
   "allowSudo": true,
-  "description": "Run one non-interactive shell command inside a container.",
+  "description": "Run one non-interactive shell command inside a container. This does not create a persistent container session or change the host session.",
   "elevate": false,
   "id": "exec-command",
   "inputSchema": {

.codex/skills/vibeshell/references/docker-containers.md

@@ -1,6 +1,6 @@
 # Docker Containers — docker-containers
 
-Plugin `docker-containers` version `1.4.0`.
+Plugin `docker-containers` version `1.5.0`.
 
 Inspect and manage containers, images, live resource usage and recent container logs through the remote Docker CLI.
 
@@ -18,6 +18,116 @@ Required permissions: `["remote_exec","local_exec"]`. Session types: `["ssh","lo
 
 `describe` returns machine-readable action input schemas. `docs` regenerates the current reference, including imported plugins. `run` reuses the selected session. `--confirm` is only for an action the user has explicitly approved; `--sudo` is opt-in and also needs confirmation. No operation bypasses installation, enablement, permission or input checks. Output is bounded and carries timing/truncation metadata. Local targets require a running GUI-owned local session.
 
+## `running-containers`
+
+List running containers with full IDs; paused and restarting containers are not shell-ready.
+
+```sh
+vibeshell plugins run docker-containers running-containers --session SESSION_ID --inputs '{}'
+```
+
+Replace SESSION_ID and supply all fields marked required below. Do not execute placeholder values. Append `--confirm` only after consent for this exact action.
+
+```json
+{
+  "allowSudo": true,
+  "description": "List running containers with full IDs; paused and restarting containers are not shell-ready.",
+  "elevate": false,
+  "id": "running-containers",
+  "inputSchema": {
+    "additionalProperties": false,
+    "properties": {},
+    "required": [],
+    "type": "object"
+  },
+  "name": "Running containers",
+  "output": {
+    "columns": [
+      "ID",
+      "Name",
+      "Image",
+      "State",
+      "Status",
+      "Ports"
+    ],
+    "delimiter": "\t",
+    "kind": "table"
+  },
+  "requiresConfirmation": false
+}
+```
+
+## `exited-containers`
+
+Inspect exited containers separately without starting or restarting them.
+
+```sh
+vibeshell plugins run docker-containers exited-containers --session SESSION_ID --inputs '{}'
+```
+
+Replace SESSION_ID and supply all fields marked required below. Do not execute placeholder values. Append `--confirm` only after consent for this exact action.
+
+```json
+{
+  "allowSudo": true,
+  "description": "Inspect exited containers separately without starting or restarting them.",
+  "elevate": false,
+  "id": "exited-containers",
+  "inputSchema": {
+    "additionalProperties": false,
+    "properties": {},
+    "required": [],
+    "type": "object"
+  },
+  "name": "Exited containers",
+  "output": {
+    "columns": [
+      "ID",
+      "Name",
+      "Image",
+      "State",
+      "Status",
+      "Ports"
+    ],
+    "delimiter": "\t",
+    "kind": "table"
+  },
+  "requiresConfirmation": false
+}
+```
+
+## `container-inventory`
+
+Read all container states and full IDs as one JSON object per line, not a JSON array. This does not create a container session.
+
+```sh
+vibeshell plugins run docker-containers container-inventory --session SESSION_ID --inputs '{}'
+```
+
+Replace SESSION_ID and supply all fields marked required below. Do not execute placeholder values. Append `--confirm` only after consent for this exact action.
+
+```json
+{
+  "allowSudo": true,
+  "description": "Read all container states and full IDs as one JSON object per line, not a JSON array. This does not create a container session.",
+  "elevate": false,
+  "id": "container-inventory",
+  "inputSchema": {
+    "additionalProperties": false,
+    "properties": {},
+    "required": [],
+    "type": "object"
+  },
+  "name": "Container inventory (JSON Lines)",
+  "output": {
+    "columns": [],
+    "delimiter": "\t",
+    "kind": "text"
+  },
+  "requiresConfirmation": false
+}
+```
+
 ## `containers`
 
 List running and stopped containers.
@@ -215,7 +325,7 @@ Replace SESSION_ID and supply all fields marked required below. Do not execute p
 
 ## `exec-command`
 
-Run one non-interactive shell command inside a container.
+Run one non-interactive shell command inside a container. This does not create a persistent container session or change the host session.
 
 ```sh
 vibeshell plugins run docker-containers exec-command --session SESSION_ID --inputs '{}'
@@ -226,7 +336,7 @@ Replace SESSION_ID and supply all fields marked required below. Do not execute p
 ```json
 {
   "allowSudo": true,
-  "description": "Run one non-interactive shell command inside a container.",
+  "description": "Run one non-interactive shell command inside a container. This does not create a persistent container session or change the host session.",
   "elevate": false,
   "id": "exec-command",
   "inputSchema": {

.github/workflows/ci.yml

@@ -1,11 +1,10 @@
-name: CI
-
-on:
-  pull_request:
-    branches: [dev, main]
-  push:
-    branches: [dev, main]
-  workflow_dispatch:
+name: CI
+run-name: Manual CI · ${{ github.ref_name }}
+
+# Maintainers explicitly run this on the PR head branch or exact release tag.
+# PR Target remains automatic; compilation never runs on a push or PR event.
+on:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -14,9 +13,29 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-jobs:
-  check-frontend:
-    name: Frontend Check
+jobs:
+  status-start:
+    name: Initialize required CI statuses
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      statuses: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - run: node scripts/report-ci-status.mjs start
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  check-frontend:
+    name: Frontend Check
+    needs: status-start
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -25,14 +44,16 @@ jobs:
           node-version: '22'
           cache: npm
       - run: npm ci
-      - run: node scripts/check-release.mjs
+      - run: node scripts/check-release.mjs
+      - run: node --test scripts/tests/*.test.mjs
       - run: npm test
       - run: npm run build
       - name: Release helper tests
         run: python3 -m unittest discover -s scripts/tests -p 'test_*.py'
 
-  check-backend:
-    name: Rust Check (${{ matrix.platform }})
+  check-backend:
+    name: Rust Check (${{ matrix.platform }})
+    needs: status-start
     strategy:
       fail-fast: false
       matrix:
@@ -66,8 +87,9 @@ jobs:
           rustup target add aarch64-apple-ios-sim
           cargo check --locked --manifest-path src-tauri/Cargo.toml --target aarch64-apple-ios-sim
 
-  check-clippy:
-    name: Clippy Lint
+  check-clippy:
+    name: Clippy Lint
+    needs: status-start
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -86,5 +108,26 @@ jobs:
           rustup toolchain install stable --profile minimal --component clippy
           rustup default stable
       - run: cargo clippy --workspace --all-targets --locked -- -D warnings
-      - name: Isolated OpenSSH compatibility
-        run: bash scripts/test-ssh-compatibility.sh
+      - name: Isolated OpenSSH compatibility
+        run: bash scripts/test-ssh-compatibility.sh
+
+  status-finish:
+    name: Report verified CI statuses
+    needs: [status-start, check-frontend, check-backend, check-clippy]
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      statuses: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - run: node scripts/report-ci-status.mjs finish
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}