@jingyi0605/codingns 0.7.4 → 0.8.1

package/dist/server/modules/assistant-capability/assistant-capability-controller.d.ts

@@ -75,6 +75,87 @@ interface AssistantDebugRuntimeHistoryQuery {
 interface AssistantWorkspaceBrowseQuery {
     path?: string;
 }
+interface AssistantOfficeDocumentBody {
+    workspaceId?: string | null;
+    title?: string;
+    templateId?: string | null;
+    templateKey?: string | null;
+    content?: unknown;
+    outline?: unknown;
+    summary?: string | null;
+}
+interface AssistantOfficeDocumentUpdateBody {
+    title?: string | null;
+    templateId?: string | null;
+    content?: unknown;
+    outline?: unknown;
+    summary?: string | null;
+    status?: "draft" | "reviewing" | "published" | "archived";
+}
+interface AssistantOfficeDocumentExportBody {
+    workspaceId?: string | null;
+    format?: "docx" | "pdf" | "md";
+    riskLevel?: "low" | "medium" | "high";
+    execute?: boolean;
+}
+interface AssistantOfficeBrowserProfileQuery {
+    workspaceId?: string;
+}
+interface AssistantOfficeBrowserProfileBody {
+    workspaceId?: string | null;
+    engine?: "chrome" | "edge";
+    mode?: "persistent" | "cdp_attached";
+    displayName?: string | null;
+    ownershipScope?: "user" | "workspace";
+    cdpEndpoint?: string | null;
+}
+interface AssistantOfficeBrowserTaskBody {
+    workspaceId?: string | null;
+    title?: string;
+    profileId?: string;
+    riskLevel?: "low" | "medium" | "high";
+    executionBackend?: "playwright" | "opencli_bridge";
+    sessionRequirement?: "none" | "reuse_current_logged_in_browser";
+    input?: unknown;
+    execute?: boolean;
+}
+interface AssistantOfficeOpsTargetListQuery {
+    workspaceId?: string;
+    kind?: "ssh_host" | "web_console";
+    status?: "active" | "disabled" | "error";
+}
+interface AssistantOfficeOpsTargetBody {
+    workspaceId?: string | null;
+    kind?: "ssh_host" | "web_console";
+    displayName?: string;
+    environment?: string | null;
+    config?: unknown;
+    credentialRef?: string | null;
+}
+interface AssistantOfficeOpsSshTaskBody {
+    title?: string;
+    targetId?: string;
+    riskLevel?: "low" | "medium" | "high";
+    input?: unknown;
+    execute?: boolean;
+    confirm?: boolean;
+}
+interface AssistantOfficeOpsBrowserTaskBody {
+    title?: string;
+    targetId?: string;
+    profileId?: string;
+    executionBackend?: "playwright" | "opencli_bridge";
+    riskLevel?: "low" | "medium" | "high";
+    input?: unknown;
+    confirm?: boolean;
+}
+interface AssistantOfficeTaskApprovalBody {
+    status?: "approved" | "rejected";
+    decisionNote?: string | null;
+}
+interface AssistantConfirmationBody {
+    confirm?: boolean;
+}
 interface AssistantWorktreeTreeQuery {
     rootWorkspaceId?: string;
 }
@@ -105,6 +186,14 @@ interface AssistantForkBody {
 }
 interface AssistantTerminalInputBody {
     content?: string;
+    confirm?: boolean;
+}
+interface AssistantCreateTerminalBody {
+    workspaceId?: string | null;
+    projectId?: string | null;
+    name?: string | null;
+    cwd?: string | null;
+    shell?: string | null;
 }
 interface AssistantCreateTimerBody {
     controlSessionId?: string | null;
@@ -235,6 +324,21 @@ interface AssistantReorderWorkspacesBody {
 interface AssistantWorkspaceParams {
     workspaceId: string;
 }
+interface AssistantOfficeDocumentParams {
+    documentId: string;
+}
+interface AssistantOfficeTaskParams {
+    taskId: string;
+}
+interface AssistantOfficeApprovalParams {
+    approvalId: string;
+}
+interface AssistantOfficeBrowserProfileParams {
+    profileId: string;
+}
+interface AssistantOfficeOpsTargetParams {
+    targetId: string;
+}
 interface AssistantWorkspaceNavigationStateBody {
     collapsed?: unknown;
     backgroundColor?: unknown;
@@ -247,14 +351,17 @@ interface AssistantCreateWorktreeBody {
 }
 interface AssistantWorktreeCleanupBody {
     deleteBranch?: boolean;
+    confirm?: boolean;
 }
 interface AssistantAnalyzeDebugTargetBody {
     workspaceId?: string;
     rootPath?: string;
     commandHints?: unknown;
+    confirm?: boolean;
 }
 interface AssistantDebugTargetLaunchPlanBody {
     portRequests?: unknown;
+    confirm?: boolean;
 }
 interface AssistantRunDebugTargetBody extends AssistantDebugTargetLaunchPlanBody {
     shell?: string;
@@ -263,7 +370,7 @@ interface AssistantRunDebugTargetBody extends AssistantDebugTargetLaunchPlanBody
 export declare class AssistantCapabilityController {
     private readonly assistantCapabilityService;
     constructor(assistantCapabilityService: AssistantCapabilityService);
-    readonly listCapabilities: (_request: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    readonly listCapabilities: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
     readonly listProjects: (request: FastifyRequest<{
         Querystring: AssistantProjectListQuery;
     }>, reply: FastifyReply) => Promise<void>;
@@ -382,6 +489,9 @@ export declare class AssistantCapabilityController {
     readonly listTerminals: (request: FastifyRequest<{
         Querystring: AssistantTerminalListQuery;
     }>, reply: FastifyReply) => Promise<void>;
+    readonly createTerminal: (request: FastifyRequest<{
+        Body: AssistantCreateTerminalBody;
+    }>, reply: FastifyReply) => Promise<void>;
     readonly readTerminalHistory: (request: FastifyRequest<{
         Params: AssistantTerminalParams;
         Querystring: AssistantTerminalHistoryQuery;
@@ -392,6 +502,62 @@ export declare class AssistantCapabilityController {
     }>, reply: FastifyReply) => Promise<void>;
     readonly closeTerminal: (request: FastifyRequest<{
         Params: AssistantTerminalParams;
+        Body: AssistantConfirmationBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly createOfficeDocument: (request: FastifyRequest<{
+        Body: AssistantOfficeDocumentBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly updateOfficeDocument: (request: FastifyRequest<{
+        Params: AssistantOfficeDocumentParams;
+        Body: AssistantOfficeDocumentUpdateBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly exportOfficeDocument: (request: FastifyRequest<{
+        Params: AssistantOfficeDocumentParams;
+        Body: AssistantOfficeDocumentExportBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly getOfficeDocumentTask: (request: FastifyRequest<{
+        Params: AssistantOfficeTaskParams;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly listOfficeBrowserProfiles: (request: FastifyRequest<{
+        Querystring: AssistantOfficeBrowserProfileQuery;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly createOfficeBrowserProfile: (request: FastifyRequest<{
+        Body: AssistantOfficeBrowserProfileBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly getOfficeBrowserProfile: (request: FastifyRequest<{
+        Params: AssistantOfficeBrowserProfileParams;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly createOfficeBrowserTask: (request: FastifyRequest<{
+        Body: AssistantOfficeBrowserTaskBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly getOfficeBrowserTask: (request: FastifyRequest<{
+        Params: AssistantOfficeTaskParams;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly listOfficeOpsTargets: (request: FastifyRequest<{
+        Querystring: AssistantOfficeOpsTargetListQuery;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly createOfficeOpsTarget: (request: FastifyRequest<{
+        Body: AssistantOfficeOpsTargetBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly getOfficeOpsTarget: (request: FastifyRequest<{
+        Params: AssistantOfficeOpsTargetParams;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly createOfficeOpsSshTask: (request: FastifyRequest<{
+        Body: AssistantOfficeOpsSshTaskBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly executeOfficeOpsTask: (request: FastifyRequest<{
+        Params: AssistantOfficeTaskParams;
+        Body: AssistantConfirmationBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly replyOfficeTaskApproval: (request: FastifyRequest<{
+        Params: AssistantOfficeApprovalParams;
+        Body: AssistantOfficeTaskApprovalBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly createOfficeOpsBrowserTask: (request: FastifyRequest<{
+        Body: AssistantOfficeOpsBrowserTaskBody;
+    }>, reply: FastifyReply) => Promise<void>;
+    readonly getOfficeOpsTask: (request: FastifyRequest<{
+        Params: AssistantOfficeTaskParams;
     }>, reply: FastifyReply) => Promise<void>;
     readonly listWorkspaces: (_request: FastifyRequest, reply: FastifyReply) => Promise<void>;
     readonly browseWorkspaces: (request: FastifyRequest<{
@@ -430,6 +596,7 @@ export declare class AssistantCapabilityController {
     }>, reply: FastifyReply) => Promise<void>;
     readonly mergeWorktreeIntoParent: (request: FastifyRequest<{
         Params: AssistantWorkspaceParams;
+        Body: AssistantConfirmationBody;
     }>, reply: FastifyReply) => Promise<void>;
     readonly cleanupWorktree: (request: FastifyRequest<{
         Params: AssistantWorkspaceParams;
@@ -444,6 +611,7 @@ export declare class AssistantCapabilityController {
     }>, reply: FastifyReply) => Promise<void>;
     readonly refreshDebugFrameworkAnalysis: (request: FastifyRequest<{
         Params: AssistantDebugTargetParams;
+        Body: AssistantConfirmationBody;
     }>, reply: FastifyReply) => Promise<void>;
     readonly createDebugLaunchPlan: (request: FastifyRequest<{
         Params: AssistantDebugTargetParams;

package/dist/server/modules/assistant-capability/assistant-capability-controller.js

@@ -5,8 +5,8 @@ export class AssistantCapabilityController {
     constructor(assistantCapabilityService) {
         this.assistantCapabilityService = assistantCapabilityService;
     }
-    listCapabilities = async (_request, reply) => {
-        reply.send(this.assistantCapabilityService.listCapabilities());
+    listCapabilities = async (request, reply) => {
+        reply.send(this.assistantCapabilityService.listCapabilities(readAssistantExecutionContext(request)));
     };
     listProjects = async (request, reply) => {
         reply.send(this.assistantCapabilityService.listProjects({
@@ -16,9 +16,11 @@ export class AssistantCapabilityController {
         }));
     };
     getProject = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("projects.get", readAssistantExecutionContext(request), { projectId: request.params.projectId });
         reply.send(await this.assistantCapabilityService.getProject(request.params.projectId, requireUserId(request)));
     };
     listProjectSessions = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("projects.sessions.list", readAssistantExecutionContext(request), { projectId: request.params.projectId });
         reply.send(await this.assistantCapabilityService.listProjectSessions(request.params.projectId, requireUserId(request)));
     };
     startProjectSession = async (request, reply) => {
@@ -44,12 +46,14 @@ export class AssistantCapabilityController {
         }));
     };
     getSession = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("sessions.get", readAssistantExecutionContext(request), { sessionId: request.params.sessionId });
         reply.send(this.assistantCapabilityService.getSession(request.params.sessionId, requireUserId(request)));
     };
     deleteSession = async (request, reply) => {
         reply.send(await this.assistantCapabilityService.deleteSession(request.params.sessionId, requireUserId(request)));
     };
     listSessionMessages = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("sessions.messages.list", readAssistantExecutionContext(request), { sessionId: request.params.sessionId });
         reply.send(await this.assistantCapabilityService.listSessionMessages({
             sessionId: request.params.sessionId,
             userId: requireUserId(request),
@@ -59,6 +63,7 @@ export class AssistantCapabilityController {
         }));
     };
     getSessionRuntime = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("sessions.runtime.get", readAssistantExecutionContext(request), { sessionId: request.params.sessionId });
         reply.send(await this.assistantCapabilityService.getSessionRuntime(request.params.sessionId, requireUserId(request)));
     };
     sendSessionMessage = async (request, reply) => {
@@ -314,13 +319,28 @@ export class AssistantCapabilityController {
                 field: "projectId"
             });
         }
+        this.assistantCapabilityService.assertExecutionAllowed("terminals.list", readAssistantExecutionContext(request), { projectId, workspaceId });
         reply.send(await this.assistantCapabilityService.listTerminals({
             userId: requireUserId(request),
             projectId,
             workspaceId
         }));
     };
+    createTerminal = async (request, reply) => {
+        const projectId = normalizeNullableText(request.body.projectId);
+        const workspaceId = normalizeNullableText(request.body.workspaceId);
+        this.assistantCapabilityService.assertExecutionAllowed("terminals.create", readAssistantExecutionContext(request), { projectId, workspaceId });
+        reply.send(await this.assistantCapabilityService.createTerminal({
+            userId: requireUserId(request),
+            projectId,
+            workspaceId,
+            name: normalizeNullableText(request.body.name),
+            cwd: normalizeNullableText(request.body.cwd),
+            shell: normalizeNullableText(request.body.shell)
+        }));
+    };
     readTerminalHistory = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("terminals.history.read", readAssistantExecutionContext(request), { terminalId: request.params.terminalId });
         reply.send(await this.assistantCapabilityService.readTerminalHistory({
             terminalId: request.params.terminalId,
             beforeSeq: normalizeOptionalInteger(request.query.beforeSeq, "beforeSeq"),
@@ -328,14 +348,164 @@ export class AssistantCapabilityController {
         }));
     };
     sendTerminalInput = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("terminals.input.send", readAssistantExecutionContext(request, request.body.confirm === true), { terminalId: request.params.terminalId });
         reply.send(await this.assistantCapabilityService.sendTerminalInput({
             terminalId: request.params.terminalId,
             content: requireNonEmptyText(request.body.content, "content", "终端输入必须提供 content")
         }));
     };
     closeTerminal = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("terminals.close", readAssistantExecutionContext(request, request.body?.confirm === true), { terminalId: request.params.terminalId });
         reply.send(await this.assistantCapabilityService.closeTerminal(request.params.terminalId));
     };
+    createOfficeDocument = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.document.create", readAssistantExecutionContext(request), { workspaceId: normalizeNullableText(request.body.workspaceId) });
+        reply.send(this.assistantCapabilityService.createOfficeDocument({
+            userId: requireUserId(request),
+            workspaceId: normalizeNullableText(request.body.workspaceId),
+            title: requireNonEmptyText(request.body.title, "title", "创建文档必须提供 title"),
+            templateId: normalizeNullableText(request.body.templateId),
+            templateKey: normalizeNullableText(request.body.templateKey),
+            content: request.body.content,
+            outline: request.body.outline,
+            summary: normalizeNullableText(request.body.summary)
+        }));
+    };
+    updateOfficeDocument = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.document.update", readAssistantExecutionContext(request), { documentId: request.params.documentId });
+        reply.send(this.assistantCapabilityService.updateOfficeDocument({
+            userId: requireUserId(request),
+            documentId: request.params.documentId,
+            title: request.body.title === undefined ? undefined : normalizeNullableText(request.body.title),
+            templateId: normalizeNullableText(request.body.templateId),
+            content: request.body.content,
+            outline: request.body.outline,
+            summary: request.body.summary === undefined ? undefined : normalizeNullableText(request.body.summary),
+            status: request.body.status
+        }));
+    };
+    exportOfficeDocument = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.document.export", readAssistantExecutionContext(request), {
+            documentId: request.params.documentId,
+            workspaceId: normalizeNullableText(request.body.workspaceId)
+        });
+        reply.send(await this.assistantCapabilityService.exportOfficeDocument({
+            userId: requireUserId(request),
+            documentId: request.params.documentId,
+            workspaceId: normalizeNullableText(request.body.workspaceId),
+            format: request.body.format,
+            riskLevel: request.body.riskLevel,
+            execute: typeof request.body.execute === "boolean" ? request.body.execute : undefined
+        }));
+    };
+    getOfficeDocumentTask = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.document.task.get", readAssistantExecutionContext(request), { officeTaskId: request.params.taskId });
+        reply.send(this.assistantCapabilityService.getOfficeDocumentTask(request.params.taskId, requireUserId(request)));
+    };
+    listOfficeBrowserProfiles = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.browser.profile.list", readAssistantExecutionContext(request), { workspaceId: normalizeNullableText(request.query.workspaceId) });
+        reply.send(this.assistantCapabilityService.listOfficeBrowserProfiles(requireUserId(request), normalizeNullableText(request.query.workspaceId)));
+    };
+    createOfficeBrowserProfile = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.browser.profile.create", readAssistantExecutionContext(request), { workspaceId: normalizeNullableText(request.body.workspaceId) });
+        reply.send(this.assistantCapabilityService.createOfficeBrowserProfile({
+            userId: requireUserId(request),
+            workspaceId: normalizeNullableText(request.body.workspaceId),
+            engine: request.body.engine ?? "chrome",
+            mode: request.body.mode ?? "persistent",
+            displayName: normalizeNullableText(request.body.displayName),
+            ownershipScope: request.body.ownershipScope ?? undefined,
+            cdpEndpoint: normalizeNullableText(request.body.cdpEndpoint)
+        }));
+    };
+    getOfficeBrowserProfile = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.browser.profile.get", readAssistantExecutionContext(request), { browserProfileId: request.params.profileId });
+        reply.send(this.assistantCapabilityService.getOfficeBrowserProfile(request.params.profileId, requireUserId(request)));
+    };
+    createOfficeBrowserTask = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.browser.task.create", readAssistantExecutionContext(request), {
+            workspaceId: normalizeNullableText(request.body.workspaceId),
+            browserProfileId: request.body.profileId?.trim() ?? null
+        });
+        reply.send(await this.assistantCapabilityService.createOfficeBrowserTask({
+            userId: requireUserId(request),
+            workspaceId: normalizeNullableText(request.body.workspaceId),
+            title: request.body.title?.trim() ?? "浏览器任务",
+            profileId: normalizeNullableText(request.body.profileId),
+            riskLevel: request.body.riskLevel,
+            executionBackend: request.body.executionBackend,
+            sessionRequirement: request.body.sessionRequirement,
+            input: request.body.input,
+            execute: typeof request.body.execute === "boolean" ? request.body.execute : undefined
+        }));
+    };
+    getOfficeBrowserTask = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.browser.task.get", readAssistantExecutionContext(request), { officeTaskId: request.params.taskId });
+        reply.send(this.assistantCapabilityService.getOfficeBrowserTask(request.params.taskId, requireUserId(request)));
+    };
+    listOfficeOpsTargets = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.ops.target.list", readAssistantExecutionContext(request), { workspaceId: normalizeNullableText(request.query.workspaceId) });
+        reply.send(this.assistantCapabilityService.listOfficeOpsTargets(requireUserId(request), normalizeNullableText(request.query.workspaceId), request.query.kind ?? null, request.query.status ?? null));
+    };
+    createOfficeOpsTarget = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.ops.target.create", readAssistantExecutionContext(request), { workspaceId: normalizeNullableText(request.body.workspaceId) });
+        reply.send(this.assistantCapabilityService.createOfficeOpsTarget({
+            userId: requireUserId(request),
+            workspaceId: normalizeNullableText(request.body.workspaceId),
+            kind: request.body.kind ?? "ssh_host",
+            displayName: requireNonEmptyText(request.body.displayName, "displayName", "创建运维目标必须提供 displayName"),
+            environment: normalizeNullableText(request.body.environment),
+            config: request.body.config ?? {},
+            credentialRef: normalizeNullableText(request.body.credentialRef)
+        }));
+    };
+    getOfficeOpsTarget = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.ops.target.get", readAssistantExecutionContext(request));
+        reply.send(this.assistantCapabilityService.getOfficeOpsTarget(request.params.targetId, requireUserId(request)));
+    };
+    createOfficeOpsSshTask = async (request, reply) => {
+        const requiresConfirm = request.body.execute === true;
+        this.assistantCapabilityService.assertExecutionAllowed("office.ops.ssh-task.create", readAssistantExecutionContext(request, requiresConfirm && request.body.confirm === true));
+        reply.send(await this.assistantCapabilityService.createOfficeOpsSshTask({
+            userId: requireUserId(request),
+            title: request.body.title?.trim() ?? "SSH 运维任务",
+            targetId: requireNonEmptyText(request.body.targetId, "targetId", "创建 SSH 运维任务必须提供 targetId"),
+            riskLevel: request.body.riskLevel,
+            input: request.body.input,
+            execute: typeof request.body.execute === "boolean" ? request.body.execute : undefined
+        }));
+    };
+    executeOfficeOpsTask = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.ops.task.execute", readAssistantExecutionContext(request, request.body?.confirm === true), { officeTaskId: request.params.taskId });
+        reply.send(await this.assistantCapabilityService.executeOfficeOpsTask({
+            userId: requireUserId(request),
+            taskId: request.params.taskId
+        }));
+    };
+    replyOfficeTaskApproval = async (request, reply) => {
+        reply.send(this.assistantCapabilityService.replyOfficeTaskApproval({
+            userId: requireUserId(request),
+            approvalId: request.params.approvalId,
+            status: request.body.status ?? "approved",
+            decisionNote: normalizeNullableText(request.body.decisionNote)
+        }));
+    };
+    createOfficeOpsBrowserTask = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.ops.browser-task.create", readAssistantExecutionContext(request, request.body.confirm === true), { browserProfileId: request.body.profileId?.trim() ?? null });
+        reply.send(this.assistantCapabilityService.createOfficeOpsBrowserTask({
+            userId: requireUserId(request),
+            title: request.body.title?.trim() ?? "浏览器运维任务",
+            targetId: requireNonEmptyText(request.body.targetId, "targetId", "创建浏览器运维任务必须提供 targetId"),
+            profileId: normalizeNullableText(request.body.profileId),
+            executionBackend: request.body.executionBackend,
+            riskLevel: request.body.riskLevel,
+            input: request.body.input
+        }));
+    };
+    getOfficeOpsTask = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("office.ops.task.get", readAssistantExecutionContext(request), { officeTaskId: request.params.taskId });
+        reply.send(this.assistantCapabilityService.getOfficeOpsTask(request.params.taskId, requireUserId(request)));
+    };
     listWorkspaces = async (_request, reply) => {
         reply.send(this.assistantCapabilityService.listWorkspaces());
     };
@@ -398,23 +568,29 @@ export class AssistantCapabilityController {
                 field: "rootWorkspaceId"
             });
         }
+        this.assistantCapabilityService.assertExecutionAllowed("worktrees.tree", readAssistantExecutionContext(request), { worktreeWorkspaceId: rootWorkspaceId });
         reply.send(await this.assistantCapabilityService.getWorktreeTree(rootWorkspaceId));
     };
     createWorktree = async (request, reply) => {
+        const sourceWorkspaceId = requireNonEmptyText(request.body.sourceWorkspaceId, "sourceWorkspaceId", "创建工作树必须提供 sourceWorkspaceId");
+        this.assistantCapabilityService.assertExecutionAllowed("worktrees.create", readAssistantExecutionContext(request), { worktreeWorkspaceId: sourceWorkspaceId });
         reply.send(await this.assistantCapabilityService.createWorktree({
-            sourceWorkspaceId: requireNonEmptyText(request.body.sourceWorkspaceId, "sourceWorkspaceId", "创建工作树必须提供 sourceWorkspaceId"),
+            sourceWorkspaceId,
             branchName: requireNonEmptyText(request.body.branchName, "branchName", "创建工作树必须提供 branchName"),
             displayName: normalizeNullableText(request.body.displayName),
             baseRef: normalizeNullableText(request.body.baseRef)
         }));
     };
     getWorktreeMergePreview = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("worktrees.merge-preview", readAssistantExecutionContext(request), { worktreeWorkspaceId: request.params.workspaceId });
         reply.send(await this.assistantCapabilityService.getWorktreeMergePreview(request.params.workspaceId));
     };
     mergeWorktreeIntoParent = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("worktrees.merge-into-parent", readAssistantExecutionContext(request, request.body?.confirm === true), { worktreeWorkspaceId: request.params.workspaceId });
         reply.send(await this.assistantCapabilityService.mergeWorktreeIntoParent(request.params.workspaceId));
     };
     cleanupWorktree = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("worktrees.cleanup", readAssistantExecutionContext(request), { worktreeWorkspaceId: request.params.workspaceId });
         reply.send(await this.assistantCapabilityService.cleanupWorktree(request.params.workspaceId, requireUserId(request), {
             deleteBranch: request.body?.deleteBranch === true
         }));
@@ -423,19 +599,24 @@ export class AssistantCapabilityController {
         reply.send(this.assistantCapabilityService.getDebugCompatibilityMatrix());
     };
     analyzeDebugTarget = async (request, reply) => {
+        const workspaceId = requireNonEmptyText(request.body.workspaceId, "workspaceId", "分析调试目标必须提供 workspaceId");
+        this.assistantCapabilityService.assertExecutionAllowed("debug-targets.analyze", readAssistantExecutionContext(request, request.body.confirm === true), { workspaceId });
         reply.send(this.assistantCapabilityService.analyzeDebugTarget({
-            workspaceId: requireNonEmptyText(request.body.workspaceId, "workspaceId", "分析调试目标必须提供 workspaceId"),
+            workspaceId,
             rootPath: requireNonEmptyText(request.body.rootPath, "rootPath", "分析调试目标必须提供 rootPath"),
             commandHints: normalizeCommandHints(request.body.commandHints)
         }));
     };
     getDebugFrameworkAnalysis = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("debug-targets.framework-analysis.get", readAssistantExecutionContext(request), { debugTargetId: request.params.targetId });
         reply.send(this.assistantCapabilityService.getDebugFrameworkAnalysis(request.params.targetId));
     };
     refreshDebugFrameworkAnalysis = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("debug-targets.framework-analysis.refresh", readAssistantExecutionContext(request, request.body?.confirm === true), { debugTargetId: request.params.targetId });
         reply.send(this.assistantCapabilityService.refreshDebugFrameworkAnalysis(request.params.targetId));
     };
     createDebugLaunchPlan = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("debug-targets.launch-plan.create", readAssistantExecutionContext(request, request.body?.confirm === true), { debugTargetId: request.params.targetId });
         reply.send(await this.assistantCapabilityService.createDebugLaunchPlan({
             targetId: request.params.targetId,
             userId: requireUserId(request),
@@ -443,6 +624,7 @@ export class AssistantCapabilityController {
         }));
     };
     runDebugTarget = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("debug-targets.run", readAssistantExecutionContext(request, request.body?.confirm === true), { debugTargetId: request.params.targetId });
         reply.send(await this.assistantCapabilityService.runDebugTarget({
             targetId: request.params.targetId,
             userId: requireUserId(request),
@@ -452,15 +634,18 @@ export class AssistantCapabilityController {
         }));
     };
     getLatestDebugRuntime = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("debug-targets.runtime-latest.get", readAssistantExecutionContext(request), { debugTargetId: request.params.targetId });
         reply.send(await this.assistantCapabilityService.getLatestDebugRuntime(request.params.targetId));
     };
     listDebugRuntimes = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("debug-targets.runtimes.list", readAssistantExecutionContext(request), { debugTargetId: request.params.targetId });
         reply.send(await this.assistantCapabilityService.listDebugRuntimes({
             targetId: request.params.targetId,
             limit: normalizePositiveInteger(request.query.limit, 5, 50, "limit")
         }));
     };
     getDebugRuntime = async (request, reply) => {
+        this.assistantCapabilityService.assertExecutionAllowed("debug-runtimes.get", readAssistantExecutionContext(request), { debugRuntimeId: request.params.runtimeId });
         reply.send(await this.assistantCapabilityService.getDebugRuntime(request.params.runtimeId));
     };
 }
@@ -741,4 +926,21 @@ function normalizeDebugPortRequestRole(value) {
         field: "portRequests"
     });
 }
+function readAssistantExecutionContext(request, confirmed = false) {
+    return {
+        userId: request.auth?.user.userId ?? null,
+        callerKind: request.auth?.callerKind ?? null,
+        capabilityProfile: normalizeAssistantCapabilityProfile(request.auth?.capabilityProfile),
+        workspaceId: request.auth?.workspaceId ?? null,
+        projectId: request.auth?.projectId ?? null,
+        sessionId: request.auth?.sessionId ?? null,
+        confirmationToken: confirmed ? "confirmed" : null
+    };
+}
+function normalizeAssistantCapabilityProfile(value) {
+    if (value === "butler-full" || value === "butler-ui" || value === "workspace-scoped") {
+        return value;
+    }
+    return null;
+}
 //# sourceMappingURL=assistant-capability-controller.js.map