@rezti/dsh-rez-suite 0.1.33 → 0.1.35

package/README.md

@@ -1,6 +1,8 @@
 # @rezti/dsh-rez-suite
 
-雷泽插件的**唯一安装入口**。Odoo / 企微 / HA / TAPD / GSC / 天眼查（仅老板） / 工作区（老板三室 + 全员助理）都由这一包拉齐，不要再逐个 `plugin add`，**不要**再装 `@rezti/dsh-rez-boss-desk`。
+雷泽插件的**唯一安装入口**。Odoo / 企微 / HA / TAPD / GSC / 企查查（仅法务助理房间） / 天眼查（仅老板） / 工作区（老板三室 + 全员助理）都由这一包拉齐，不要再逐个 `plugin add`，**不要**再装 `@rezti/dsh-rez-boss-desk`。
+
+发版顺序：先发 `@rezti/dsh-rez-sso@0.1.11`，再发 `@rezti/dsh-rez-suite@0.1.34`（或更高）。suite 读取 SSO 的 `REZ_DEFAULT_CONNECTIONS.qcc`；缺字段时用官方 URL 兜底，避免插件加载失败把微信面板一起拖垮。
 
 设置里选身份后，左侧自己出现对应房间（全员三助理；老板另加搞钱/产品/运营），不必手动添加工作区。
 

package/lib/client.d.ts

@@ -7300,6 +7300,9 @@ declare const zh: {
   readonly 'config.gsc': "Google Search Console";
   readonly 'config.gsc.siteUrl': "站点 URL";
   readonly 'config.gsc.key': "服务账号 JSON 或密钥文件路径";
+  readonly 'config.qcc': "企查查（法务助理）";
+  readonly 'config.qcc.url': "企查查企业 MCP URL";
+  readonly 'config.qcc.token': "API Key";
   readonly 'config.tianyancha': "天眼查（法务助理 · 仅老板）";
   readonly 'config.tianyancha.url': "天眼查 MCP URL";
   readonly 'config.tianyancha.token': "OpenAPI Token";
@@ -7318,7 +7321,7 @@ declare const zh: {
   readonly 'config.testResult': "{server}: {status}";
   readonly 'config.testOk': "成功（{tools} 个工具, {latency}ms）";
   readonly 'config.testFail': "失败：{error}";
-  readonly 'status.hint': "绿标表示本机已注册 mcp__<系统>__* 工具。远端 MCP 通了但这里仍红，说明 dsh-mcp-client 还没挂上。";
+  readonly 'status.hint': "绿标表示本机已注册 mcp__<系统>__* 工具。远端 MCP 通了但这里仍红，说明 dsh-mcp-client 还没挂上。企查查只在法务助理房间可用；其它房间不显示或显示「房间未启用」。";
   readonly 'status.total': "当前角色 {role}，共注册 {count} 个 MCP 工具";
   readonly 'status.col.server': "Server";
   readonly 'status.col.state': "状态";

package/lib/client.js

@@ -184,6 +184,9 @@ const zh = {
 	"config.gsc": "Google Search Console",
 	"config.gsc.siteUrl": "站点 URL",
 	"config.gsc.key": "服务账号 JSON 或密钥文件路径",
+	"config.qcc": "企查查（法务助理）",
+	"config.qcc.url": "企查查企业 MCP URL",
+	"config.qcc.token": "API Key",
 	"config.tianyancha": "天眼查（法务助理 · 仅老板）",
 	"config.tianyancha.url": "天眼查 MCP URL",
 	"config.tianyancha.token": "OpenAPI Token",
@@ -202,7 +205,7 @@ const zh = {
 	"config.testResult": "{server}: {status}",
 	"config.testOk": "成功（{tools} 个工具, {latency}ms）",
 	"config.testFail": "失败：{error}",
-	"status.hint": "绿标表示本机已注册 mcp__<系统>__* 工具。远端 MCP 通了但这里仍红，说明 dsh-mcp-client 还没挂上。",
+	"status.hint": "绿标表示本机已注册 mcp__<系统>__* 工具。远端 MCP 通了但这里仍红，说明 dsh-mcp-client 还没挂上。企查查只在法务助理房间可用；其它房间不显示或显示「房间未启用」。",
 	"status.total": "当前角色 {role}，共注册 {count} 个 MCP 工具",
 	"status.col.server": "Server",
 	"status.col.state": "状态",
@@ -304,6 +307,9 @@ const en = {
 	"config.gsc": "Google Search Console",
 	"config.gsc.siteUrl": "Site URL",
 	"config.gsc.key": "Service-account JSON or key file path",
+	"config.qcc": "Qichacha (Legal assistant)",
+	"config.qcc.url": "Qichacha company MCP URL",
+	"config.qcc.token": "API key",
 	"config.tianyancha": "Tianyancha (Legal assistant, boss only)",
 	"config.tianyancha.url": "Tianyancha MCP URL",
 	"config.tianyancha.token": "OpenAPI token",
@@ -322,7 +328,7 @@ const en = {
 	"config.testResult": "{server}: {status}",
 	"config.testOk": "OK ({tools} tools, {latency}ms)",
 	"config.testFail": "Failed: {error}",
-	"status.hint": "Green means this host registered mcp__<system>__* tools. A live remote MCP with a red row means dsh-mcp-client has not attached yet.",
+	"status.hint": "Green means this host registered mcp__<system>__* tools. A live remote MCP with a red row means dsh-mcp-client has not attached yet. Qichacha is only for the Legal assistant room; other rooms hide the row or show “room not enabled”.",
 	"status.total": "Role {role}, {count} MCP tools registered",
 	"status.col.server": "Server",
 	"status.col.state": "State",
@@ -696,7 +702,7 @@ function AuditTab({ api }) {
 //#endregion
 //#region src/client/panel/ConfigTab.tsx
 /**
-* Config tab: company MCP connections (Odoo / Nextcloud / WeCom / HA / TAPD / GSC),
+* Config tab: company MCP connections (Odoo / Nextcloud / WeCom / HA / TAPD / GSC / QCC),
 * role, and billing. Secrets are write-only and land in credentials.yaml.
 */
 const ROLES = [
@@ -728,6 +734,7 @@ const EMPTY_SECRETS = {
 	homeassistant: "",
 	tapd: "",
 	gsc: "",
+	qcc: "",
 	tianyancha: ""
 };
 function Field({ label, children }) {
@@ -895,6 +902,10 @@ function ConfigTab({ api }) {
 						...config.connections.gsc,
 						secret: secrets.gsc || void 0
 					},
+					qcc: {
+						...config.connections.qcc,
+						secret: secrets.qcc || void 0
+					},
 					tianyancha: {
 						...config.connections.tianyancha,
 						secret: secrets.tianyancha || void 0
@@ -1110,6 +1121,25 @@ function ConfigTab({ api }) {
 				},
 				secretLabel: t("config.gsc.key")
 			}),
+			/* @__PURE__ */ (0, react_jsx_runtime.jsx)(McpSection, {
+				title: t("config.qcc"),
+				row: config.connections.qcc,
+				secret: secrets.qcc,
+				onEnabled: (enabled) => {
+					patchConnection("qcc", { enabled });
+				},
+				onUrl: (url) => {
+					patchConnection("qcc", { url });
+				},
+				onSecret: (value) => {
+					setSecrets((prev) => ({
+						...prev,
+						qcc: value
+					}));
+				},
+				urlLabel: t("config.qcc.url"),
+				secretLabel: t("config.qcc.token")
+			}),
 			config.role === "boss" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(McpSection, {
 				title: t("config.tianyancha"),
 				row: config.connections.tianyancha,

package/lib/index.d.ts

@@ -1730,6 +1730,10 @@ interface RezConnections {
     enabled: boolean;
     siteUrl: string;
   };
+  qcc: {
+    enabled: boolean;
+    url: string;
+  };
   tianyancha: {
     enabled: boolean;
     url: string;

package/lib/index.js

@@ -2844,6 +2844,57 @@ defineMethod("transform", [
 	"preserve"
 ], ({ inner }, isInner) => inner.toString(isInner));
 //#endregion
+//#region src/rooms.ts
+/**
+* Workspace room identity for execution-time MCP gates.
+* Session cwd is the workspace folder (e.g. ~/.dsh/workspaces/法务助理).
+*/
+const LEGAL_ROOM_FOLDER = "法务助理";
+const QCC_ROOM_DENY = "企查查仅限法务助理房间使用，请切换到法务助理再查询。";
+const QCC_STATUS_ROOM_OFF = "房间未启用";
+const ROOM_SEP = /[/\\]/;
+/** Last path segment of a workspace cwd or folder name. */
+function roomFolderFromPath(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim().replace(/[/\\]+$/, "");
+	if (trimmed.length === 0) return void 0;
+	return trimmed.split(ROOM_SEP).filter((part) => part.length > 0).at(-1);
+}
+function isLegalAssistantRoom(hint) {
+	return roomFolderFromPath(hint) === LEGAL_ROOM_FOLDER;
+}
+function isQccToolName(name) {
+	return name.startsWith("mcp__qcc-") || name.startsWith("mcp__qcc__");
+}
+/** Session cwd from a tool execution. Missing / unknown shapes → undefined. */
+function cwdFromExecution(execution) {
+	const agent = execution.agent;
+	if (typeof agent !== "object" || agent === null) return void 0;
+	const record = agent;
+	const session = record.session;
+	const header = typeof session === "object" && session !== null ? session.header : void 0;
+	const candidates = [
+		typeof header === "object" && header !== null ? header.cwd : void 0,
+		typeof session === "object" && session !== null ? session.cwd : void 0,
+		record.cwd
+	];
+	for (const value of candidates) if (typeof value === "string" && value.trim().length > 0) return value;
+}
+/**
+* Official `ctx.tools.guard` reason. Only Qichacha tools are gated.
+* Must never throw: this guard is global and a throw would block WeChat turns.
+* Missing cwd fails closed — not the legal room.
+*/
+function qccRoomGuard(execution) {
+	if (!isQccToolName(typeof execution?.name === "string" ? execution.name : "")) return void 0;
+	try {
+		if (isLegalAssistantRoom(cwdFromExecution(execution))) return void 0;
+		return QCC_ROOM_DENY;
+	} catch {
+		return QCC_ROOM_DENY;
+	}
+}
+//#endregion
 //#region src/observe-mcp.ts
 /**
 * Live MCP status without a second host.
@@ -2859,9 +2910,11 @@ const COMPOSED_SERVERS = [
 	"homeassistant",
 	"tapd",
 	"gsc",
+	"qcc",
 	"tianyancha"
 ];
 function mcpToolPrefix(server) {
+	if (server === "qcc") return "mcp__qcc-";
 	return "mcp__" + server + "__";
 }
 /** Count tools whose public name belongs to one composed MCP server. */
@@ -2920,8 +2973,27 @@ function observeServer(server, input) {
 		lastError: startError !== void 0 ? ref + " 已配置，但 MCP 未挂上：" + startError : ref + " 已配置，但本机尚未注册 " + mcpToolPrefix(server) + "*（dsh-mcp-client 未挂上）"
 	};
 }
+function composedServersFor(input) {
+	const servers = input.config.role === "boss" ? COMPOSED_SERVERS : COMPOSED_SERVERS.filter((server) => server !== "tianyancha");
+	if (input.room !== void 0 && !isLegalAssistantRoom(input.room)) return servers.filter((server) => server !== "qcc");
+	return [...servers];
+}
+function observeQccOutsideLegalRoom(input) {
+	if (isEnabled(input.config, "qcc") === false) return observeServer("qcc", input);
+	return {
+		server: "qcc",
+		enabled: true,
+		state: "disconnected",
+		toolCount: 0,
+		registeredTools: 0,
+		lastError: QCC_STATUS_ROOM_OFF
+	};
+}
 function observeComposedServers(input) {
-	return (input.config.role === "boss" ? COMPOSED_SERVERS : COMPOSED_SERVERS.filter((server) => server !== "tianyancha")).map((server) => observeServer(server, input));
+	return composedServersFor(input).map((server) => {
+		if (server === "qcc" && !isLegalAssistantRoom(input.room)) return observeQccOutsideLegalRoom(input);
+		return observeServer(server, input);
+	});
 }
 function testComposedServers(input) {
 	return observeComposedServers(input).map((row) => {
@@ -3051,6 +3123,12 @@ function publicConfig(config) {
 				secretConfigured: secretConfigured("gsc"),
 				secretRef: REZ_CREDENTIAL_REFS.gsc
 			},
+			qcc: {
+				enabled: connections.qcc.enabled,
+				url: connections.qcc.url,
+				secretConfigured: secretConfigured("qcc"),
+				secretRef: REZ_CREDENTIAL_REFS.qcc
+			},
 			tianyancha: {
 				enabled: connections.tianyancha.enabled,
 				url: connections.tianyancha.url,
@@ -7679,8 +7757,8 @@ function rezStatusTool(host, config) {
 				].join("\n"));
 			}
 		},
-		async execute() {
-			const servers = host.status().map((server) => {
+		async execute(_args, exec) {
+			const servers = host.status(cwdFromExecution(exec ?? {})).map((server) => {
 				const clean = { ...server };
 				if (clean.lastError === void 0) delete clean.lastError;
 				if (clean.startedAt === void 0) delete clean.startedAt;
@@ -8094,7 +8172,7 @@ const TIANYANCHA_MCP_URL = "https://mcp.tianyancha.com/mcp";
 function shouldStartTianyancha(role) {
 	return role === "boss";
 }
-function bearerAuthorization(secret) {
+function bearerAuthorization$1(secret) {
 	const trimmed = secret.trim();
 	if (/^bearer\s+/i.test(trimmed)) return "Bearer " + trimmed.replace(/^bearer\s+/i, "");
 	return "Bearer " + trimmed;
@@ -8105,7 +8183,7 @@ function tianyanchaMcpConfig(secret) {
 		serverName: "tianyancha",
 		transport: "streamable-http",
 		url: url.length > 0 ? url : TIANYANCHA_MCP_URL,
-		headers: { Authorization: bearerAuthorization(secret) },
+		headers: { Authorization: bearerAuthorization$1(secret) },
 		failOnStartupError: false
 	};
 }
@@ -8148,6 +8226,80 @@ function mountTianyanchaMcp(ctx, getRole, start = startMcpWhenSecret) {
 	return ensure;
 }
 //#endregion
+//#region src/qcc.ts
+const QCC_COMPANY_MCP_URL = "https://agent.qcc.com/mcp/company/stream";
+const QCC_RISK_MCP_URL = "https://agent.qcc.com/mcp/risk/stream";
+function bearerAuthorization(secret) {
+	const trimmed = secret.trim();
+	if (/^bearer\s+/i.test(trimmed)) return "Bearer " + trimmed.replace(/^bearer\s+/i, "");
+	return "Bearer " + trimmed;
+}
+/** Risk stream URL: swap /company/ for /risk/ when the company URL is official-shaped. */
+function qccRiskUrlFrom(companyUrl) {
+	const trimmed = companyUrl.trim();
+	if (trimmed.includes("/company/")) return trimmed.replace("/company/", "/risk/");
+	return QCC_RISK_MCP_URL;
+}
+function qccHeaders(secret) {
+	return { Authorization: bearerAuthorization(secret) };
+}
+function qccCompanyUrl() {
+	const url = loadRezConnections().qcc?.url;
+	return typeof url === "string" && url.length > 0 ? url : QCC_COMPANY_MCP_URL;
+}
+function qccCompanyMcpConfig(secret) {
+	return {
+		serverName: "qcc-company",
+		transport: "streamable-http",
+		url: qccCompanyUrl(),
+		headers: qccHeaders(secret),
+		failOnStartupError: false
+	};
+}
+function qccRiskMcpConfig(secret) {
+	return {
+		serverName: "qcc-risk",
+		transport: "streamable-http",
+		url: qccRiskUrlFrom(qccCompanyUrl()),
+		headers: qccHeaders(secret),
+		failOnStartupError: false
+	};
+}
+/** Start company + risk clients whenever the Qichacha secret exists. */
+function mountQccMcp(ctx, start = startMcpWhenSecret) {
+	let session;
+	let pending = false;
+	const ensure = () => {
+		(async () => {
+			if (session !== void 0 || pending) return;
+			pending = true;
+			try {
+				const disposeCompany = await start(ctx, {
+					system: "qcc",
+					label: "企查查·企业",
+					config: qccCompanyMcpConfig
+				});
+				const disposeRisk = await start(ctx, {
+					system: "qcc",
+					label: "企查查·风险",
+					config: qccRiskMcpConfig
+				});
+				session = () => {
+					disposeCompany();
+					disposeRisk();
+				};
+			} catch (error) {
+				const why = error instanceof Error ? error.message : String(error);
+				console.error("[dsh-rez-suite] qcc MCP start failed:", why);
+			} finally {
+				pending = false;
+			}
+		})();
+	};
+	ensure();
+	return ensure;
+}
+//#endregion
 //#region src/index.ts
 const name = "rez-suite";
 const inject = [
@@ -8202,10 +8354,20 @@ const Config = Schema.object({
 			enabled: Schema.boolean().default(true),
 			siteUrl: Schema.string().default(REZ_DEFAULT_CONNECTIONS.gsc.siteUrl)
 		}).default(REZ_DEFAULT_CONNECTIONS.gsc),
+		qcc: Schema.object({
+			enabled: Schema.boolean().default(true),
+			url: Schema.string().default(REZ_DEFAULT_CONNECTIONS.qcc?.url ?? "https://agent.qcc.com/mcp/company/stream")
+		}).default(REZ_DEFAULT_CONNECTIONS.qcc ?? {
+			enabled: true,
+			url: "https://agent.qcc.com/mcp/company/stream"
+		}),
 		tianyancha: Schema.object({
 			enabled: Schema.boolean().default(true),
-			url: Schema.string().default(REZ_DEFAULT_CONNECTIONS.tianyancha.url)
-		}).default(REZ_DEFAULT_CONNECTIONS.tianyancha)
+			url: Schema.string().default(REZ_DEFAULT_CONNECTIONS.tianyancha?.url ?? "https://mcp.tianyancha.com/mcp")
+		}).default(REZ_DEFAULT_CONNECTIONS.tianyancha ?? {
+			enabled: true,
+			url: "https://mcp.tianyancha.com/mcp"
+		})
 	}).default(REZ_DEFAULT_CONNECTIONS),
 	billing: Schema.object({
 		inputCostPer1k: Schema.number().default(.001),
@@ -8237,12 +8399,13 @@ function normalize(input) {
 	return mergeConfig(defaultConfig(), input ?? {});
 }
 function delegatedHost(ctx, getConfig) {
-	const snapshot = () => observeComposedServers({
+	const snapshot = (room) => observeComposedServers({
 		config: getConfig(),
-		toolNames: listRegisteredToolNames(ctx.tools)
+		toolNames: listRegisteredToolNames(ctx.tools),
+		room
 	});
 	return {
-		status: () => snapshot(),
+		status: (room) => snapshot(room),
 		test: async () => testComposedServers({
 			config: getConfig(),
 			toolNames: listRegisteredToolNames(ctx.tools)
@@ -8254,12 +8417,15 @@ function delegatedHost(ctx, getConfig) {
 function apply(ctx, config) {
 	let current = () => normalize(config);
 	const syncWorkspaces = mountRezWorkspaces(ctx, () => current().role);
+	const syncQcc = mountQccMcp(ctx);
 	const syncTianyancha = mountTianyanchaMcp(ctx, () => current().role);
 	const tokens = new TokenManager(joinTokenDb());
 	const host = delegatedHost(ctx, () => current());
 	ctx.effect(() => () => {
 		tokens.close();
 	}, "dsh-rez-suite: ledger view");
+	const toolsHost = ctx.tools;
+	if (typeof toolsHost.guard === "function") ctx.effect(() => toolsHost.guard(qccRoomGuard), "dsh-rez-suite: qcc room guard");
 	const tools = [rezStatusTool(host, () => current()), rezConfigTool(() => current())];
 	const routes = makeRoutes({
 		getConfig: () => current(),
@@ -8268,6 +8434,7 @@ function apply(ctx, config) {
 			saveConfig(value);
 			current = () => value;
 			syncWorkspaces();
+			syncQcc();
 			syncTianyancha();
 			try {
 				const settings = ctx.get("settings");
@@ -8326,11 +8493,13 @@ function apply(ctx, config) {
 			current = source;
 			sync();
 			syncWorkspaces();
+			syncQcc();
 			syncTianyancha();
 		},
 		onChange: () => {
 			sync();
 			syncWorkspaces();
+			syncQcc();
 			syncTianyancha();
 		}
 	});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rezti/dsh-rez-suite",
   "description": "ReZ-TI one-package install for DeepSeek Harness. Update with: dsh plugin --profile web update @rezti/dsh-rez-suite",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -37,17 +37,17 @@
     }
   },
   "dependencies": {
+    "@rezti/dsh-rez-gsc": "^0.1.1",
+    "@rezti/dsh-rez-ha-bridge": "^0.1.9",
+    "@rezti/dsh-rez-intent": "^0.1.5",
+    "@rezti/dsh-rez-nextcloud": "^0.1.9",
+    "@rezti/dsh-rez-odoo": "^0.1.9",
+    "@rezti/dsh-rez-sso": "^0.1.11",
+    "@rezti/dsh-rez-tapd": "^0.1.1",
+    "@rezti/dsh-rez-token-manager": "^0.1.4",
+    "@rezti/dsh-rez-wechat": "^0.1.14",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "zod": "^4.4.3",
-    "@rezti/dsh-rez-gsc": "0.1.0",
-    "@rezti/dsh-rez-ha-bridge": "0.1.9",
-    "@rezti/dsh-rez-odoo": "0.1.9",
-    "@rezti/dsh-rez-nextcloud": "0.1.9",
-    "@rezti/dsh-rez-token-manager": "0.1.4",
-    "@rezti/dsh-rez-tapd": "0.1.0",
-    "@rezti/dsh-rez-wechat": "0.1.14",
-    "@rezti/dsh-rez-sso": "0.1.10",
-    "@rezti/dsh-rez-intent": "0.1.5"
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
     "react": "^18.2.0",
@@ -95,16 +95,16 @@
   "publishConfig": {
     "access": "public"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ReZ-TI/deepseek-harness.git",
-    "directory": "packages/dsh-rez-suite"
-  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json && tsdown --config-loader native && node scripts/wrap-client.mjs",
     "bundle": "tsdown --config-loader native",
     "watch": "tsdown --config-loader native --watch",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ReZ-TI/deepseek-harness.git",
+    "directory": "packages/dsh-rez-suite"
   }
-}
+}

package/src/client/locales.ts

@@ -52,6 +52,9 @@ export const zh = {
   'config.gsc': 'Google Search Console',
   'config.gsc.siteUrl': '站点 URL',
   'config.gsc.key': '服务账号 JSON 或密钥文件路径',
+  'config.qcc': '企查查（法务助理）',
+  'config.qcc.url': '企查查企业 MCP URL',
+  'config.qcc.token': 'API Key',
   'config.tianyancha': '天眼查（法务助理 · 仅老板）',
   'config.tianyancha.url': '天眼查 MCP URL',
   'config.tianyancha.token': 'OpenAPI Token',
@@ -71,7 +74,7 @@ export const zh = {
   'config.testOk': '成功（{tools} 个工具, {latency}ms）',
   'config.testFail': '失败：{error}',
   // status
-  'status.hint': '绿标表示本机已注册 mcp__<系统>__* 工具。远端 MCP 通了但这里仍红，说明 dsh-mcp-client 还没挂上。',
+  'status.hint': '绿标表示本机已注册 mcp__<系统>__* 工具。远端 MCP 通了但这里仍红，说明 dsh-mcp-client 还没挂上。企查查只在法务助理房间可用；其它房间不显示或显示「房间未启用」。',
   'status.total': '当前角色 {role}，共注册 {count} 个 MCP 工具',
   'status.col.server': 'Server',
   'status.col.state': '状态',
@@ -178,6 +181,9 @@ export const en: Record<RezKey, string> = {
   'config.gsc': 'Google Search Console',
   'config.gsc.siteUrl': 'Site URL',
   'config.gsc.key': 'Service-account JSON or key file path',
+  'config.qcc': 'Qichacha (Legal assistant)',
+  'config.qcc.url': 'Qichacha company MCP URL',
+  'config.qcc.token': 'API key',
   'config.tianyancha': 'Tianyancha (Legal assistant, boss only)',
   'config.tianyancha.url': 'Tianyancha MCP URL',
   'config.tianyancha.token': 'OpenAPI token',
@@ -196,7 +202,7 @@ export const en: Record<RezKey, string> = {
   'config.testResult': '{server}: {status}',
   'config.testOk': 'OK ({tools} tools, {latency}ms)',
   'config.testFail': 'Failed: {error}',
-  'status.hint': 'Green means this host registered mcp__<system>__* tools. A live remote MCP with a red row means dsh-mcp-client has not attached yet.',
+  'status.hint': 'Green means this host registered mcp__<system>__* tools. A live remote MCP with a red row means dsh-mcp-client has not attached yet. Qichacha is only for the Legal assistant room; other rooms hide the row or show “room not enabled”.',
   'status.total': 'Role {role}, {count} MCP tools registered',
   'status.col.server': 'Server',
   'status.col.state': 'State',

package/src/client/panel/ConfigTab.tsx

@@ -1,5 +1,5 @@
 /**
- * Config tab: company MCP connections (Odoo / Nextcloud / WeCom / HA / TAPD / GSC),
+ * Config tab: company MCP connections (Odoo / Nextcloud / WeCom / HA / TAPD / GSC / QCC),
  * role, and billing. Secrets are write-only and land in credentials.yaml.
  */
 
@@ -24,10 +24,11 @@ type SecretDrafts = {
   homeassistant: string
   tapd: string
   gsc: string
+  qcc: string
   tianyancha: string
 }
 
-const EMPTY_SECRETS: SecretDrafts = { odoo: '', nextcloud: '', wechat: '', homeassistant: '', tapd: '', gsc: '', tianyancha: '' }
+const EMPTY_SECRETS: SecretDrafts = { odoo: '', nextcloud: '', wechat: '', homeassistant: '', tapd: '', gsc: '', qcc: '', tianyancha: '' }
 
 function Field({ label, children }: { label: string; children: ReactNode }) {
   return (
@@ -174,6 +175,7 @@ export function ConfigTab({ api }: { api: RezApi }) {
           homeassistant: { ...config.connections.homeassistant, secret: secrets.homeassistant || undefined },
           tapd: { ...config.connections.tapd, secret: secrets.tapd || undefined },
           gsc: { ...config.connections.gsc, secret: secrets.gsc || undefined },
+          qcc: { ...config.connections.qcc, secret: secrets.qcc || undefined },
           tianyancha: { ...config.connections.tianyancha, secret: secrets.tianyancha || undefined },
         },
       }
@@ -296,6 +298,16 @@ export function ConfigTab({ api }: { api: RezApi }) {
         onSecret={value => { setSecrets(prev => ({ ...prev, gsc: value })) }}
         secretLabel={t('config.gsc.key')}
       />
+      <McpSection
+        title={t('config.qcc')}
+        row={config.connections.qcc}
+        secret={secrets.qcc}
+        onEnabled={enabled => { patchConnection('qcc', { enabled }) }}
+        onUrl={url => { patchConnection('qcc', { url }) }}
+        onSecret={value => { setSecrets(prev => ({ ...prev, qcc: value })) }}
+        urlLabel={t('config.qcc.url')}
+        secretLabel={t('config.qcc.token')}
+      />
       {config.role === 'boss' && (
         <McpSection
           title={t('config.tianyancha')}

package/src/index.ts

@@ -30,6 +30,8 @@ import type { RezConfig } from './protocol.ts'
 import { workspaceGuidanceFor, mountRezWorkspaces } from './boss/mount.ts'
 import { liveSelfUpdate } from './self-update.ts'
 import { mountTianyanchaMcp } from './tianyancha.ts'
+import { mountQccMcp, QCC_COMPANY_MCP_URL } from './qcc.ts'
+import { qccRoomGuard } from './rooms.ts'
 
 export const name = 'rez-suite'
 
@@ -80,10 +82,14 @@ export const Config: z<RezConfig> = z.object({
       enabled: z.boolean().default(true),
       siteUrl: z.string().default(REZ_DEFAULT_CONNECTIONS.gsc.siteUrl),
     }).default(REZ_DEFAULT_CONNECTIONS.gsc),
+    qcc: z.object({
+      enabled: z.boolean().default(true),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.qcc?.url ?? QCC_COMPANY_MCP_URL),
+    }).default(REZ_DEFAULT_CONNECTIONS.qcc ?? { enabled: true, url: QCC_COMPANY_MCP_URL }),
     tianyancha: z.object({
       enabled: z.boolean().default(true),
-      url: z.string().default(REZ_DEFAULT_CONNECTIONS.tianyancha.url),
-    }).default(REZ_DEFAULT_CONNECTIONS.tianyancha),
+      url: z.string().default(REZ_DEFAULT_CONNECTIONS.tianyancha?.url ?? 'https://mcp.tianyancha.com/mcp'),
+    }).default(REZ_DEFAULT_CONNECTIONS.tianyancha ?? { enabled: true, url: 'https://mcp.tianyancha.com/mcp' }),
   }).default(REZ_DEFAULT_CONNECTIONS),
   billing: z.object({
     inputCostPer1k: z.number().default(0.001),
@@ -117,12 +123,13 @@ function normalize(input: Partial<RezConfig> | undefined): RezConfig {
 }
 
 function delegatedHost(ctx: Context, getConfig: () => RezConfig): McpHost {
-  const snapshot = () => observeComposedServers({
+  const snapshot = (room?: string) => observeComposedServers({
     config: getConfig(),
     toolNames: listRegisteredToolNames(ctx.tools),
+    room,
   })
   return {
-    status: () => snapshot(),
+    status: (room?: string) => snapshot(room),
     test: async () => testComposedServers({
       config: getConfig(),
       toolNames: listRegisteredToolNames(ctx.tools),
@@ -135,11 +142,16 @@ function delegatedHost(ctx: Context, getConfig: () => RezConfig): McpHost {
 export function apply(ctx: Context, config?: RezConfig): void {
   let current: () => RezConfig = () => normalize(config)
   const syncWorkspaces = mountRezWorkspaces(ctx, () => current().role)
+  const syncQcc = mountQccMcp(ctx)
   const syncTianyancha = mountTianyanchaMcp(ctx, () => current().role)
 
   const tokens = new TokenManager(joinTokenDb())
   const host = delegatedHost(ctx, () => current())
   ctx.effect(() => () => { tokens.close() }, 'dsh-rez-suite: ledger view')
+  const toolsHost = ctx.tools as { guard?: (guard: typeof qccRoomGuard) => () => void }
+  if (typeof toolsHost.guard === 'function') {
+    ctx.effect(() => toolsHost.guard!(qccRoomGuard), 'dsh-rez-suite: qcc room guard')
+  }
 
   const tools = [
     rezStatusTool(host, () => current()),
@@ -153,6 +165,7 @@ export function apply(ctx: Context, config?: RezConfig): void {
       saveConfig(value)
       current = () => value
       syncWorkspaces()
+      syncQcc()
       syncTianyancha()
       try {
         const settings = ctx.get('settings') as { update?: (namespace: unknown, value: unknown) => Promise<void> } | undefined
@@ -207,11 +220,13 @@ export function apply(ctx: Context, config?: RezConfig): void {
       current = source
       sync()
       syncWorkspaces()
+      syncQcc()
       syncTianyancha()
     },
     onChange: () => {
       sync()
       syncWorkspaces()
+      syncQcc()
       syncTianyancha()
     },
   })

package/src/mcp-host.ts

@@ -368,7 +368,7 @@ export class McpHost {
     return results
   }
 
-  status(): RezServerStatus[] {
+  status(_room?: string): RezServerStatus[] {
     const ids = new Set<string>([...this.enabledIds, ...this.connections.keys()])
     return [...ids].sort().map(id => {
       const connection = this.connections.get(id)

package/src/observe-mcp.ts

@@ -8,12 +8,14 @@
 
 import { lastMcpStartError, REZ_CREDENTIAL_REFS, secretConfigured, type RezSystem } from '@rezti/dsh-rez-sso'
 import type { RezConfig, RezServerStatus, RezTestResult } from './protocol.ts'
+import { isLegalAssistantRoom, QCC_STATUS_ROOM_OFF } from './rooms.ts'
 
-export const COMPOSED_SERVERS = ['odoo', 'nextcloud', 'wechat', 'homeassistant', 'tapd', 'gsc', 'tianyancha'] as const
+export const COMPOSED_SERVERS = ['odoo', 'nextcloud', 'wechat', 'homeassistant', 'tapd', 'gsc', 'qcc', 'tianyancha'] as const
 
 export type ComposedServer = (typeof COMPOSED_SERVERS)[number]
 
 export function mcpToolPrefix(server: string): string {
+  if (server === 'qcc') return 'mcp__qcc-'
   return 'mcp__' + server + '__'
 }
 
@@ -39,6 +41,8 @@ export function listRegisteredToolNames(tools: { schemas?: () => ReadonlyArray<{
 export interface ObserveInput {
   config: RezConfig
   toolNames: readonly string[]
+  /** Session cwd or folder name. Settings panel omits this. */
+  room?: string
   secretPresent?: (server: RezSystem) => boolean
   startError?: (server: RezSystem) => string | undefined
 }
@@ -101,11 +105,37 @@ export function observeServer(
   }
 }
 
-export function observeComposedServers(input: ObserveInput): RezServerStatus[] {
+function composedServersFor(input: ObserveInput): ComposedServer[] {
   const servers = input.config.role === 'boss'
     ? COMPOSED_SERVERS
     : COMPOSED_SERVERS.filter((server) => server !== 'tianyancha')
-  return servers.map(server => observeServer(server, input))
+  if (input.room !== undefined && !isLegalAssistantRoom(input.room)) {
+    return servers.filter((server) => server !== 'qcc')
+  }
+  return [...servers]
+}
+
+function observeQccOutsideLegalRoom(input: ObserveInput): RezServerStatus {
+  if (isEnabled(input.config, 'qcc') === false) {
+    return observeServer('qcc', input)
+  }
+  return {
+    server: 'qcc',
+    enabled: true,
+    state: 'disconnected',
+    toolCount: 0,
+    registeredTools: 0,
+    lastError: QCC_STATUS_ROOM_OFF,
+  }
+}
+
+export function observeComposedServers(input: ObserveInput): RezServerStatus[] {
+  return composedServersFor(input).map((server) => {
+    if (server === 'qcc' && !isLegalAssistantRoom(input.room)) {
+      return observeQccOutsideLegalRoom(input)
+    }
+    return observeServer(server, input)
+  })
 }
 
 export function testComposedServers(input: ObserveInput): RezTestResult[] {

package/src/protocol.ts

@@ -48,6 +48,7 @@ export interface RezConnections {
   homeassistant: { enabled: boolean; url: string }
   tapd: { enabled: boolean; workspaceId: string; nickName: string }
   gsc: { enabled: boolean; siteUrl: string }
+  qcc: { enabled: boolean; url: string }
   tianyancha: { enabled: boolean; url: string }
 }
 
@@ -91,6 +92,7 @@ export interface RezPublicConfig {
     homeassistant: RezPublicConnection
     tapd: RezPublicConnection
     gsc: RezPublicConnection
+    qcc: RezPublicConnection
     tianyancha: RezPublicConnection
   }
   billing: { inputCostPer1k: number; outputCostPer1k: number; monthlyBudget: number }

package/src/qcc.ts

@@ -0,0 +1,95 @@
+/**
+ * Qichacha official MCP for the 法务助理 workspace.
+ * Reuse https://agent.qcc.com/mcp/{company,risk}/stream via dsh-mcp-client.
+ * One API key starts two streamable-http servers (qcc-company, qcc-risk).
+ * Start for every suite role so 法务助理 can query. Execution is room-gated
+ * (`ctx.tools.guard` in rooms.ts). Do not dump into the global prompt.
+ */
+import type { Context } from '@deepseek-ai/cordis'
+import { loadRezConnections, startMcpWhenSecret } from '@rezti/dsh-rez-sso'
+
+export const QCC_COMPANY_MCP_URL = 'https://agent.qcc.com/mcp/company/stream'
+export const QCC_RISK_MCP_URL = 'https://agent.qcc.com/mcp/risk/stream'
+
+export function bearerAuthorization(secret: string): string {
+  const trimmed = secret.trim()
+  if (/^bearer\s+/i.test(trimmed)) return 'Bearer ' + trimmed.replace(/^bearer\s+/i, '')
+  return 'Bearer ' + trimmed
+}
+
+/** Risk stream URL: swap /company/ for /risk/ when the company URL is official-shaped. */
+export function qccRiskUrlFrom(companyUrl: string): string {
+  const trimmed = companyUrl.trim()
+  if (trimmed.includes('/company/')) return trimmed.replace('/company/', '/risk/')
+  return QCC_RISK_MCP_URL
+}
+
+function qccHeaders(secret: string): Record<string, string> {
+  return { Authorization: bearerAuthorization(secret) }
+}
+
+function qccCompanyUrl(): string {
+  const url = loadRezConnections().qcc?.url
+  return typeof url === 'string' && url.length > 0 ? url : QCC_COMPANY_MCP_URL
+}
+
+export function qccCompanyMcpConfig(secret: string): Record<string, unknown> {
+  return {
+    serverName: 'qcc-company',
+    transport: 'streamable-http',
+    url: qccCompanyUrl(),
+    headers: qccHeaders(secret),
+    failOnStartupError: false,
+  }
+}
+
+export function qccRiskMcpConfig(secret: string): Record<string, unknown> {
+  const companyUrl = qccCompanyUrl()
+  return {
+    serverName: 'qcc-risk',
+    transport: 'streamable-http',
+    url: qccRiskUrlFrom(companyUrl),
+    headers: qccHeaders(secret),
+    failOnStartupError: false,
+  }
+}
+
+/** Start company + risk clients whenever the Qichacha secret exists. */
+export function mountQccMcp(
+  ctx: Context,
+  start: typeof startMcpWhenSecret = startMcpWhenSecret,
+): () => void {
+  let session: (() => void) | undefined
+  let pending = false
+
+  const ensure = (): void => {
+    void (async () => {
+      if (session !== undefined || pending) return
+      pending = true
+      try {
+        const disposeCompany = await start(ctx, {
+          system: 'qcc',
+          label: '企查查·企业',
+          config: qccCompanyMcpConfig,
+        })
+        const disposeRisk = await start(ctx, {
+          system: 'qcc',
+          label: '企查查·风险',
+          config: qccRiskMcpConfig,
+        })
+        session = () => {
+          disposeCompany()
+          disposeRisk()
+        }
+      } catch (error: unknown) {
+        const why = error instanceof Error ? error.message : String(error)
+        console.error('[dsh-rez-suite] qcc MCP start failed:', why)
+      } finally {
+        pending = false
+      }
+    })()
+  }
+
+  ensure()
+  return ensure
+}

package/src/rooms.ts

@@ -0,0 +1,65 @@
+/**
+ * Workspace room identity for execution-time MCP gates.
+ * Session cwd is the workspace folder (e.g. ~/.dsh/workspaces/法务助理).
+ */
+
+export const LEGAL_ROOM_FOLDER = '法务助理'
+
+export const QCC_ROOM_DENY = '企查查仅限法务助理房间使用，请切换到法务助理再查询。'
+
+export const QCC_STATUS_ROOM_OFF = '房间未启用'
+
+const ROOM_SEP = /[/\\]/
+
+/** Last path segment of a workspace cwd or folder name. */
+export function roomFolderFromPath(value: string | undefined): string | undefined {
+  if (typeof value !== 'string') return undefined
+  const trimmed = value.trim().replace(/[/\\]+$/, '')
+  if (trimmed.length === 0) return undefined
+  const parts = trimmed.split(ROOM_SEP).filter((part) => part.length > 0)
+  return parts.at(-1)
+}
+
+export function isLegalAssistantRoom(hint: string | undefined): boolean {
+  return roomFolderFromPath(hint) === LEGAL_ROOM_FOLDER
+}
+
+export function isQccToolName(name: string): boolean {
+  return name.startsWith('mcp__qcc-') || name.startsWith('mcp__qcc__')
+}
+
+/** Session cwd from a tool execution. Missing / unknown shapes → undefined. */
+export function cwdFromExecution(execution: { agent?: unknown }): string | undefined {
+  const agent = execution.agent
+  if (typeof agent !== 'object' || agent === null) return undefined
+  const record = agent as Record<string, unknown>
+  const session = record.session
+  const header = typeof session === 'object' && session !== null
+    ? (session as Record<string, unknown>).header
+    : undefined
+  const candidates = [
+    typeof header === 'object' && header !== null ? (header as Record<string, unknown>).cwd : undefined,
+    typeof session === 'object' && session !== null ? (session as Record<string, unknown>).cwd : undefined,
+    record.cwd,
+  ]
+  for (const value of candidates) {
+    if (typeof value === 'string' && value.trim().length > 0) return value
+  }
+  return undefined
+}
+
+/**
+ * Official `ctx.tools.guard` reason. Only Qichacha tools are gated.
+ * Must never throw: this guard is global and a throw would block WeChat turns.
+ * Missing cwd fails closed — not the legal room.
+ */
+export function qccRoomGuard(execution: { name?: unknown; agent?: unknown }): string | undefined {
+  const name = typeof execution?.name === 'string' ? execution.name : ''
+  if (!isQccToolName(name)) return undefined
+  try {
+    if (isLegalAssistantRoom(cwdFromExecution(execution))) return undefined
+    return QCC_ROOM_DENY
+  } catch {
+    return QCC_ROOM_DENY
+  }
+}

package/src/store.ts

@@ -125,6 +125,12 @@ export function publicConfig(config: RezConfig): RezPublicConfig {
         secretConfigured: secretConfigured('gsc'),
         secretRef: REZ_CREDENTIAL_REFS.gsc,
       },
+      qcc: {
+        enabled: connections.qcc.enabled,
+        url: connections.qcc.url,
+        secretConfigured: secretConfigured('qcc'),
+        secretRef: REZ_CREDENTIAL_REFS.qcc,
+      },
       tianyancha: {
         enabled: connections.tianyancha.enabled,
         url: connections.tianyancha.url,

package/src/tools.ts

@@ -12,6 +12,7 @@ import type { RezConfig, RezTestResult } from './protocol.ts'
 import type { McpHost } from './mcp-host.ts'
 import type { TokenManager } from './token-manager.ts'
 import { publicConfig } from './store.ts'
+import { cwdFromExecution } from './rooms.ts'
 
 function text(value: string): ContentBlock[] {
   return [{ type: 'text', text: value }]
@@ -69,8 +70,8 @@ export function rezStatusTool(host: McpHost, config: () => RezConfig) {
         return text('role: ' + (value.role ?? '') + '\n' + ['server | state | discovered | registered | error', '--- | --- | --- | --- | ---', ...rows].join('\n'))
       },
     },
-    async execute() {
-      const servers = host.status().map(server => {
+    async execute(_args: unknown, exec?: { agent?: unknown }) {
+      const servers = host.status(cwdFromExecution(exec ?? {})).map(server => {
         const clean: Record<string, unknown> = { ...server }
         if (clean.lastError === undefined) delete clean.lastError
         if (clean.startedAt === undefined) delete clean.startedAt

package/templates/boss/money/.agents/skills/boss-money/SKILL.md

@@ -3,4 +3,4 @@ name: boss-money
 description: 老板·搞钱作战室。回款/应收/库存占用简报；初始化后四段回答；Odoo 只读。
 ---
 
-本 Skill 的完整规矩在工作区根目录 `AGENTS.md`。有 `BOOTSTRAP.md` 时先做三拍仪式。记忆写在 `PRIORITIES.md`、`MEMORY.md`、`memory/YYYY-MM-DD.md`。
+本 Skill 的完整规矩在工作区根目录 `AGENTS.md`。有 `BOOTSTRAP.md` 时先做三拍仪式。记忆写在 `PRIORITIES.md`、`MEMORY.md`、`memory/YYYY-MM-DD.md`。工商查询请切到法务助理，避免串房间。

package/templates/boss/money/AGENTS.md

@@ -49,6 +49,7 @@
 - 谁付钱、钱在哪、卡在哪：回款、逾期应收、未交货金额、库存占用。
 - Odoo **只读**。多公司必须带 `company_id`。
 - 禁止过账、付款、自动给客户发消息、在这里写代码或控 HA。
+- 工商查询请切到法务助理，避免串房间。
 
 ## 公司（问数字时点名）
 

package/templates/boss/ops/.agents/skills/boss-ops/SKILL.md

@@ -3,4 +3,4 @@ name: boss-ops
 description: 老板·运营作战室。只报红灯（缺料/逾期/超账期/系统）；初始化后四段回答。
 ---
 
-完整规矩在工作区 `AGENTS.md`。有 `BOOTSTRAP.md` 时先做三拍。记忆写在 `PRIORITIES.md`、`MEMORY.md`、`memory/YYYY-MM-DD.md`。
+完整规矩在工作区 `AGENTS.md`。有 `BOOTSTRAP.md` 时先做三拍。记忆写在 `PRIORITIES.md`、`MEMORY.md`、`memory/YYYY-MM-DD.md`。工商查询请切到法务助理，避免串房间。

package/templates/boss/ops/AGENTS.md

@@ -40,6 +40,7 @@
 - 缺料、逾期交货、应收超账期、系统连不上。
 - Odoo 只读采购在途 / 库存 / 逾期；TAPD 只看迭代红灯。
 - 禁止改库存、群发、自动上架、在这里控 HA。企微只出「需要老板出面」的摘要。
+- 工商查询请切到法务助理，避免串房间。
 
 ## 公司
 

package/templates/boss/product/.agents/skills/boss-product/SKILL.md

@@ -3,4 +3,4 @@ name: boss-product
 description: 老板·产品作战室。主销 SKU / 质量认证 / 该砍该保；初始化后四段回答。
 ---
 
-完整规矩在工作区 `AGENTS.md`。有 `BOOTSTRAP.md` 时先做三拍。记忆写在 `PRIORITIES.md`、`MEMORY.md`、`memory/YYYY-MM-DD.md`。
+完整规矩在工作区 `AGENTS.md`。有 `BOOTSTRAP.md` 时先做三拍。记忆写在 `PRIORITIES.md`、`MEMORY.md`、`memory/YYYY-MM-DD.md`。工商查询请切到法务助理，避免串房间。

package/templates/boss/product/AGENTS.md

@@ -42,3 +42,4 @@
 - 新产品或改产品 Wiki：Wiki **必须**同时写死 Nextcloud RAW 路径，以及 Git 3D 源路径 `products/{slug}/models` 与 `products/{slug}/motion`。缺任一项就说「Wiki 未归档」，不要猜路径。
 - 问某产品素材在哪：打开 Nextcloud `Documents/Standards/INDEX.yaml`，再按相对 uri 读路径规则；加上该产品 Wiki **首次创建标题**，不要用会变的 Odoo `name` / 销售标题。
 - 禁止在这里写固件、开辅线、做 HA Add-on、做微信通道。那些走仓库和员工机。
+- 工商查询请切到法务助理，避免串房间。

package/templates/staff/finance/.agents/skills/staff-finance/SKILL.md

@@ -3,4 +3,4 @@ name: staff-finance
 description: 财务助理。全员报销；审批/报表/过账仅当当前 Odoo 帐号能看见对应单据。不自审不自过账。
 ---
 
-完整规矩在工作区 `AGENTS.md`。先 `mcp__odoo__get_current_context`。报销走 `hr.expense` / `hr.expense.sheet`。搞钱室不要在这里做。问制度/报销标准先打开 Nextcloud `Documents/Standards/INDEX.yaml`，再按相对 uri 读，不要把手册写入 MEMORY。用户用中文就中文、用英文就英文。
+完整规矩在工作区 `AGENTS.md`。先 `mcp__odoo__get_current_context`。报销走 `hr.expense` / `hr.expense.sheet`。搞钱室不要在这里做。问制度/报销标准先打开 Nextcloud `Documents/Standards/INDEX.yaml`，再按相对 uri 读，不要把手册写入 MEMORY。工商查询请切到法务助理，避免串房间。用户用中文就中文、用英文就英文。

package/templates/staff/finance/AGENTS.md

@@ -63,6 +63,7 @@
 - 只用 `mcp__odoo__*`。费用模型已开放读写；工资单模型若列表里没有就不要编。
 - `AGENTS.md` 仓级红线：不擅自改生产库表；过账/付款先说明再执行。
 - 对外付款、给供应商打款 = 资金操作，必须用户明确选「执行」且 Odoo 允许。
+- 工商查询请切到法务助理，避免串房间。
 
 ## 公司
 

package/templates/staff/hr/.agents/skills/staff-hr/SKILL.md

@@ -3,4 +3,4 @@ name: staff-hr
 description: 人事助理。全员请假/查自己；主管批假；权限完全跟当前 Odoo 帐号。
 ---
 
-完整规矩在工作区 `AGENTS.md`。先 `mcp__odoo__get_current_context`。有 `BOOTSTRAP.md` 时正事优先再三拍。问制度/出差标准先打开 Nextcloud `Documents/Standards/INDEX.yaml`，再按相对 uri 读，不要把手册写入 MEMORY。用户用中文就中文、用英文就英文。
+完整规矩在工作区 `AGENTS.md`。先 `mcp__odoo__get_current_context`。有 `BOOTSTRAP.md` 时正事优先再三拍。问制度/出差标准先打开 Nextcloud `Documents/Standards/INDEX.yaml`，再按相对 uri 读，不要把手册写入 MEMORY。工商查询请切到法务助理，避免串房间。用户用中文就中文、用英文就英文。

package/templates/staff/hr/AGENTS.md

@@ -46,6 +46,7 @@
 
 - 走现成 `mcp__odoo__*`（`hr.leave`、`hr.leave.allocation`、`hr.employee` 等）。不自写人事系统。
 - 工资审批若出现，请转到 **财务助理**（工资单 MCP 未开放时据实说做不了）。
+- 工商查询请切到法务助理，避免串房间。
 - 禁止伪造审批、禁止把别人的假期余额讲给无权限的人。
 
 ## 公司

package/templates/staff/legal/.agents/skills/staff-legal/SKILL.md

@@ -3,4 +3,4 @@ name: staff-legal
 description: 法务助理。全员可问制度、整理风险；能看哪些合同跟当前 Odoo/Nextcloud 帐号。不下具约束力的法律结论。
 ---
 
-完整规矩在工作区 `AGENTS.md`。先 `mcp__odoo__get_current_context`。不是律师。问制度先打开 Nextcloud `Documents/Standards/INDEX.yaml`，再按相对 uri 读，不要把手册写入 MEMORY。有 `mcp__tianyancha__*` 才查工商（仅老板身份会挂上）。用户用中文就中文、用英文就英文。
+完整规矩在工作区 `AGENTS.md`。先 `mcp__odoo__get_current_context`。不是律师。问制度先打开 Nextcloud `Documents/Standards/INDEX.yaml`，再按相对 uri 读，不要把手册写入 MEMORY。查对方公司（仅本法务房间）：有 `mcp__qcc-*` 先用企查查；否则有 `mcp__tianyancha__*` 再用天眼查（仅老板会挂上天眼查）；都没有就说工商查询未开通。用户用中文就中文、用英文就英文。

package/templates/staff/legal/AGENTS.md

@@ -21,9 +21,13 @@
 
 没有独立的法务 App 时，不要假装有「案件模块」。用订单、伙伴、Nextcloud 文档凑齐材料即可。
 
-## 天眼查（仅老板身份）
+## 工商查询（企查查优先）
 
-出现 `mcp__tianyancha__*` 时，才用来查对方公司工商/司法。官方 `tools/list` 只有搜索、公司画像、`call_tool` 等入口，不要枚举 162 个工具。没有这些工具就当没开通，不要提天眼查。
+企查查只在**本法务助理房间**可用。查对方公司时，**哪个 MCP 挂上了就用哪个；默认先企查查**。扣积分，不要无意义翻页。
+
+1. 有 `mcp__qcc-company__*` / `mcp__qcc-risk__*`：先用企查查。企业概况走 company，风险/司法走 risk。
+2. 没有企查查、有 `mcp__tianyancha__*`：再用天眼查。官方 `tools/list` 只有搜索、公司画像、`call_tool` 等入口，不要枚举 162 个工具。
+3. 两者都没有：明确说「工商查询未开通」，不要编造，也不要点名没挂上的供应商。
 
 ## 每次回答