@sparkelf/dsh-dataops-managed 0.1.0 → 0.2.0

package/README.md

@@ -2,32 +2,32 @@
 
 ## 中文
 
-这是DataOps托管工作区使用的DeepSeek Harness呈现插件。安装后，DSH Settings显示只读的DataOps页面，说明当前Harness由DataOps工作区托管、身份与权限由当前DataOps会话管理、DataOps工具由工作区自动提供。
+这是DataOps托管工作区使用的DeepSeek Harness集成插件。它接收当前DataOps会话JWT，并通过credential-backed HTTP MCP提供DataOps工具；DSH Settings显示只读的DataOps身份与权限说明。
 
-本包不读取DataOps账号，不注册HTTP路由，不发起OAuth，不持有access token、refresh token或DataOps JWT，也不提供连接、重新授权或断开按钮。实际DataOps工具仍由部署方配置的DataOps-owned Unix broker和通用MCP client提供。
+本包不发起OAuth，也不提供连接、重新授权或断开按钮。DataOps父页面把现有JWT交给固定Host route；插件把它存入DSH credential，MCP transport在每次请求前读取当前值。DataOps API根据该JWT对应的当前角色和资源授权决定可执行范围。
 
 本包只应安装到DataOps托管profile。独立DSH需要用户授权时使用@sparkelf/dsh-dataops-integration，两者不应同时安装。
 
 ### 模型体验
 
-本包只贡献Settings呈现，不增加system prompt、tool schema、模型输入或session log事件。token和KV cache均不受影响。
+本包增加命名空间化DataOps MCP tool schema，但不把JWT写入system prompt、tool参数、结果或session log。认证本身不增加token或改变KV cache。
 
 ### 已知限制
 
-- 页面说明部署所有权，不探测broker实时状态；实际工具错误由MCP client和DataOps工作区链路呈现。
+- JWT尚未同步或DataOps拒绝当前权限时，MCP client直接呈现对应连接或工具错误。
 
 ## English
 
-This is the DeepSeek Harness presentation plugin for DataOps-managed workspaces. Once installed, DSH Settings includes a read-only DataOps page explaining that the current Harness is managed by the DataOps workspace, identity and permissions belong to the current DataOps session, and DataOps tools are supplied automatically by the workspace.
+This is the DeepSeek Harness integration plugin for DataOps-managed workspaces. It accepts the current DataOps session JWT and provides DataOps tools through credential-backed HTTP MCP; DSH Settings shows a read-only identity and permission summary.
 
-The package reads no DataOps account, registers no HTTP route, starts no OAuth flow, holds no access token, refresh token, or DataOps JWT, and exposes no connect, reauthorize, or disconnect control. The deployment-owned Unix broker and the generic MCP client continue to provide the actual DataOps tools.
+The package starts no OAuth flow and exposes no connect, reauthorize, or disconnect control. The DataOps parent supplies its existing JWT to one fixed Host route; the plugin stores it as a DSH credential, and the MCP transport resolves the current value before every request. DataOps APIs decide the allowed operations from the JWT principal's current roles and resource grants.
 
 Install this package only in a DataOps-managed profile. Standalone DSH deployments that need user authorization use @sparkelf/dsh-dataops-integration; the two packages must not be installed together.
 
 ### Model Experience
 
-The package contributes Settings presentation only. It adds no system prompt, tool schema, model input, or session-log event, and has no token or KV-cache effect.
+The package adds namespaced DataOps MCP tool schemas but never places the JWT in the system prompt, tool arguments, results, or Session log. Authentication adds no model tokens and does not affect the KV cache.
 
 ### Known Limitations
 
-- The page explains deployment ownership rather than probing live broker state. MCP client and DataOps workspace errors remain the source for actual tool failures.
+- Before JWT synchronization, or when DataOps rejects current permissions, the MCP client exposes the corresponding connection or tool error.

package/lib/client.js

@@ -17,17 +17,17 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var ManagedDataOpsSection_module_css_default = {
-			"statusRow": "aGKsna_statusRow",
 			"details": "aGKsna_details",
 			"detailRow": "aGKsna_detailRow",
-			"section": "aGKsna_section",
+			"statusRow": "aGKsna_statusRow",
+			"title": "aGKsna_title",
 			"description": "aGKsna_description",
-			"title": "aGKsna_title"
+			"section": "aGKsna_section"
 		};
 		//#endregion
 		//#region src/client/ManagedDataOpsSection.tsx
 		/**
-		* Explain DataOps-managed ownership without exposing standalone authorization controls.
+		* Explain the DataOps-managed JWT and permission owner without standalone controls.
 		* @param props - Settings slot injection values.
 		* @returns The localized managed DataOps section, or nothing before injection.
 		*/
@@ -69,26 +69,28 @@ window.__ModuleLoader__.load({
 			nav: "DataOps",
 			title: "DataOps",
 			managed: "Managed by this DataOps workspace",
-			description: "DataOps tools are provided automatically through the workspace-managed channel. No connection or authorization is required here.",
+			description: "DSH uses your current DataOps session JWT. DataOps applies its role and resource permissions to every tool request.",
 			identityLabel: "Identity and permissions",
-			identityValue: "Managed by your current DataOps session",
+			identityValue: "Current DataOps JWT",
 			toolsLabel: "DataOps tools",
-			toolsValue: "Provided automatically by the workspace"
+			toolsValue: "Authorized by DataOps on every request"
 		};
 		/** Chinese managed DataOps Settings copy. */
 		const zh = {
 			nav: "DataOps",
 			title: "DataOps",
 			managed: "由当前 DataOps 工作区托管",
-			description: "DataOps 工具通过工作区托管通道自动提供，无需在这里连接、重新授权或断开。",
+			description: "DSH 使用当前 DataOps 会话 JWT；DataOps 对每次工具请求应用角色与资源权限。",
 			identityLabel: "身份与权限",
-			identityValue: "由当前 DataOps 会话管理",
+			identityValue: "当前 DataOps JWT",
 			toolsLabel: "DataOps 工具",
-			toolsValue: "由工作区自动提供"
+			toolsValue: "每次请求均由 DataOps 授权"
 		};
 		//#endregion
 		//#region src/client/index.ts
 		const NS = "settings.dataops-managed";
+		const AUTH_UPDATED_MESSAGE = "dataops-auth-updated";
+		const MANAGED_AUTH_PATH = "/integrations/dataops/managed-auth";
 		/** Required client services for the managed DataOps Settings section. */
 		const inject = ["slots", "locale"];
 		/**
@@ -108,6 +110,22 @@ window.__ModuleLoader__.load({
 				label: () => t("nav"),
 				inject: () => ({ t })
 			}, ManagedDataOpsSection));
+			const synchronizeJwt = async () => {
+				const response = await fetch(new URL(MANAGED_AUTH_PATH, window.location.origin), {
+					method: "POST",
+					credentials: "same-origin"
+				});
+				if (!response.ok) throw new Error(`DataOps managed JWT synchronization failed with HTTP ${String(response.status)}`);
+			};
+			const onMessage = (event) => {
+				if (event.source !== window.parent || event.data?.type !== AUTH_UPDATED_MESSAGE) return;
+				synchronizeJwt().catch((error) => console.error("dataops-managed.jwt_sync_failed", error));
+			};
+			ctx.effect(() => {
+				window.addEventListener("message", onMessage);
+				synchronizeJwt().catch((error) => console.error("dataops-managed.jwt_sync_failed", error));
+				return () => window.removeEventListener("message", onMessage);
+			}, "dataops-managed: JWT synchronization");
 		}
 		//#endregion
 		exports.apply = apply;

package/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":["styles","StateDot"],"sources":["../src/client/ManagedDataOpsSection.tsx","../src/client/locales.ts","../src/client/index.ts"],"sourcesContent":["import { StateDot } from '@deepseek-ai/dsh-client-ui-primitives'\nimport type { InjectFace } from '@deepseek-ai/dsh-client-ui-slots'\nimport type { en } from './locales.ts'\nimport styles from './ManagedDataOpsSection.module.css'\n\n/** Values injected by the DSH Settings slot. */\nexport interface ManagedDataOpsSectionInjected {\n  /** Translate one managed DataOps Settings message key. */\n  t: (key: keyof typeof en) => string\n}\n\n/** Props accepted by the managed DataOps Settings section. */\nexport type ManagedDataOpsSectionProps = Partial<InjectFace<ManagedDataOpsSectionInjected>>\n\n/**\n * Explain DataOps-managed ownership without exposing standalone authorization controls.\n * @param props - Settings slot injection values.\n * @returns The localized managed DataOps section, or nothing before injection.\n */\nexport function ManagedDataOpsSection(props: ManagedDataOpsSectionProps) {\n  const { t } = props\n  if (t === undefined) return null\n\n  return (\n    <section className={styles.section}>\n      <h2 className={styles.title}>{t('title')}</h2>\n      <div className={styles.statusRow}>\n        <StateDot state=\"done\" />\n        <strong>{t('managed')}</strong>\n      </div>\n      <p className={styles.description}>{t('description')}</p>\n      <dl className={styles.details}>\n        <div className={styles.detailRow}>\n          <dt>{t('identityLabel')}</dt>\n          <dd>{t('identityValue')}</dd>\n        </div>\n        <div className={styles.detailRow}>\n          <dt>{t('toolsLabel')}</dt>\n          <dd>{t('toolsValue')}</dd>\n        </div>\n      </dl>\n    </section>\n  )\n}\n","/** English managed DataOps Settings copy. */\nexport const en = {\n  nav: 'DataOps',\n  title: 'DataOps',\n  managed: 'Managed by this DataOps workspace',\n  description: 'DataOps tools are provided automatically through the workspace-managed channel. No connection or authorization is required here.',\n  identityLabel: 'Identity and permissions',\n  identityValue: 'Managed by your current DataOps session',\n  toolsLabel: 'DataOps tools',\n  toolsValue: 'Provided automatically by the workspace',\n} as const\n\n/** Stable key set shared by every managed DataOps locale. */\nexport type ManagedDataOpsKey = keyof typeof en\n\n/** Chinese managed DataOps Settings copy. */\nexport const zh: Record<ManagedDataOpsKey, string> = {\n  nav: 'DataOps',\n  title: 'DataOps',\n  managed: '由当前 DataOps 工作区托管',\n  description: 'DataOps 工具通过工作区托管通道自动提供，无需在这里连接、重新授权或断开。',\n  identityLabel: '身份与权限',\n  identityValue: '由当前 DataOps 会话管理',\n  toolsLabel: 'DataOps 工具',\n  toolsValue: '由工作区自动提供',\n}\n","import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'\nimport type {} from '@deepseek-ai/dsh-client-ui-settings/client'\nimport type {} from '@deepseek-ai/dsh-client-locale/client'\nimport { ManagedDataOpsSection } from './ManagedDataOpsSection.tsx'\nimport type { ManagedDataOpsSectionInjected } from './ManagedDataOpsSection.tsx'\nimport { en, zh, type ManagedDataOpsKey } from './locales.ts'\n\ndeclare module '@deepseek-ai/dsh-client-ui-slots' {\n  interface LocaleNamespaceMap {\n    'settings.dataops-managed': ManagedDataOpsKey\n  }\n}\n\nconst NS = 'settings.dataops-managed'\n\n/** Required client services for the managed DataOps Settings section. */\nexport const inject = ['slots', 'locale']\n\n/**\n * Register localized managed DataOps Settings navigation and content.\n * @param ctx - DSH client context with locale and settings slots.\n */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dataops-managed: settings copy')\n  const t = ctx.locale.bind(NS) as ManagedDataOpsSectionInjected['t']\n  ctx.slots.inject('settings.section', () => ctx.slots.register({\n    name: 'settings.section',\n    id: 'dataops',\n    order: 25,\n    label: () => t('nav'),\n    inject: () => ({ t }),\n  }, ManagedDataOpsSection))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBA,SAAgB,sBAAsB,OAAmC;GACvE,MAAM,EAAE,MAAM;GACd,IAAI,MAAM,KAAA,GAAW,OAAO;GAE5B,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;IAAS,WAAWA,yCAAO;IAA3B,UAAA;KACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD;MAAI,WAAWA,yCAAO;MAAQ,UAAA,EAAE,OAAO;KAAM,CAAA;KAC7C,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,yCAAO;MAAvB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAACC,sCAAAA,UAAD,EAAU,OAAM,OAAQ,CAAA,GACxB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,SAAS,EAAU,CAAA,CAC3B;;KACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,WAAWD,yCAAO;MAAc,UAAA,EAAE,aAAa;KAAK,CAAA;KACvD,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD;MAAI,WAAWA,yCAAO;MAAtB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,WAAWA,yCAAO;OAAvB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD,EAAA,UAAK,EAAE,eAAe,EAAM,CAAA,GAC5B,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD,EAAA,UAAK,EAAE,eAAe,EAAM,CAAA,CACzB;MACL,CAAA,GAAA,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,WAAWA,yCAAO;OAAvB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD,EAAA,UAAK,EAAE,YAAY,EAAM,CAAA,GACzB,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD,EAAA,UAAK,EAAE,YAAY,EAAM,CAAA,CACtB;MACH,CAAA,CAAA;;IACG;;EAEb;;;;EC1CA,MAAa,KAAK;GAChB,KAAK;GACL,OAAO;GACP,SAAS;GACT,aAAa;GACb,eAAe;GACf,eAAe;GACf,YAAY;GACZ,YAAY;EACd;;EAMA,MAAa,KAAwC;GACnD,KAAK;GACL,OAAO;GACP,SAAS;GACT,aAAa;GACb,eAAe;GACf,eAAe;GACf,YAAY;GACZ,YAAY;EACd;;;ECZA,MAAM,KAAK;;EAGX,MAAa,SAAS,CAAC,SAAS,QAAQ;;;;;EAMxC,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa,IAAI,OAAO,SAAS,IAAI;IAAE;IAAI;GAAG,CAAC,GAAG,gCAAgC;GACtF,MAAM,IAAI,IAAI,OAAO,KAAK,EAAE;GAC5B,IAAI,MAAM,OAAO,0BAA0B,IAAI,MAAM,SAAS;IAC5D,MAAM;IACN,IAAI;IACJ,OAAO;IACP,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,EAAE;GACrB,GAAG,qBAAqB,CAAC;EAC3B"}
+{"version":3,"file":"client.js","names":["styles","StateDot"],"sources":["../src/client/ManagedDataOpsSection.tsx","../src/client/locales.ts","../src/client/index.ts"],"sourcesContent":["import { StateDot } from '@deepseek-ai/dsh-client-ui-primitives'\nimport type { InjectFace } from '@deepseek-ai/dsh-client-ui-slots'\nimport type { en } from './locales.ts'\nimport styles from './ManagedDataOpsSection.module.css'\n\n/** Values injected by the DSH Settings slot. */\nexport interface ManagedDataOpsSectionInjected {\n  /** Translate one managed DataOps Settings message key. */\n  t: (key: keyof typeof en) => string\n}\n\n/** Props accepted by the managed DataOps Settings section. */\nexport type ManagedDataOpsSectionProps = Partial<InjectFace<ManagedDataOpsSectionInjected>>\n\n/**\n * Explain the DataOps-managed JWT and permission owner without standalone controls.\n * @param props - Settings slot injection values.\n * @returns The localized managed DataOps section, or nothing before injection.\n */\nexport function ManagedDataOpsSection(props: ManagedDataOpsSectionProps) {\n  const { t } = props\n  if (t === undefined) return null\n\n  return (\n    <section className={styles.section}>\n      <h2 className={styles.title}>{t('title')}</h2>\n      <div className={styles.statusRow}>\n        <StateDot state=\"done\" />\n        <strong>{t('managed')}</strong>\n      </div>\n      <p className={styles.description}>{t('description')}</p>\n      <dl className={styles.details}>\n        <div className={styles.detailRow}>\n          <dt>{t('identityLabel')}</dt>\n          <dd>{t('identityValue')}</dd>\n        </div>\n        <div className={styles.detailRow}>\n          <dt>{t('toolsLabel')}</dt>\n          <dd>{t('toolsValue')}</dd>\n        </div>\n      </dl>\n    </section>\n  )\n}\n","/** English managed DataOps Settings copy. */\nexport const en = {\n  nav: 'DataOps',\n  title: 'DataOps',\n  managed: 'Managed by this DataOps workspace',\n  description: 'DSH uses your current DataOps session JWT. DataOps applies its role and resource permissions to every tool request.',\n  identityLabel: 'Identity and permissions',\n  identityValue: 'Current DataOps JWT',\n  toolsLabel: 'DataOps tools',\n  toolsValue: 'Authorized by DataOps on every request',\n} as const\n\n/** Stable key set shared by every managed DataOps locale. */\nexport type ManagedDataOpsKey = keyof typeof en\n\n/** Chinese managed DataOps Settings copy. */\nexport const zh: Record<ManagedDataOpsKey, string> = {\n  nav: 'DataOps',\n  title: 'DataOps',\n  managed: '由当前 DataOps 工作区托管',\n  description: 'DSH 使用当前 DataOps 会话 JWT；DataOps 对每次工具请求应用角色与资源权限。',\n  identityLabel: '身份与权限',\n  identityValue: '当前 DataOps JWT',\n  toolsLabel: 'DataOps 工具',\n  toolsValue: '每次请求均由 DataOps 授权',\n}\n","import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'\nimport type {} from '@deepseek-ai/dsh-client-ui-settings/client'\nimport type {} from '@deepseek-ai/dsh-client-locale/client'\nimport { ManagedDataOpsSection } from './ManagedDataOpsSection.tsx'\nimport type { ManagedDataOpsSectionInjected } from './ManagedDataOpsSection.tsx'\nimport { en, zh, type ManagedDataOpsKey } from './locales.ts'\n\ndeclare module '@deepseek-ai/dsh-client-ui-slots' {\n  interface LocaleNamespaceMap {\n    'settings.dataops-managed': ManagedDataOpsKey\n  }\n}\n\nconst NS = 'settings.dataops-managed'\nconst AUTH_UPDATED_MESSAGE = 'dataops-auth-updated'\nconst MANAGED_AUTH_PATH = '/integrations/dataops/managed-auth'\n\n/** Required client services for the managed DataOps Settings section. */\nexport const inject = ['slots', 'locale']\n\n/**\n * Register localized managed DataOps Settings navigation and content.\n * @param ctx - DSH client context with locale and settings slots.\n */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dataops-managed: settings copy')\n  const t = ctx.locale.bind(NS) as ManagedDataOpsSectionInjected['t']\n  ctx.slots.inject('settings.section', () => ctx.slots.register({\n    name: 'settings.section',\n    id: 'dataops',\n    order: 25,\n    label: () => t('nav'),\n    inject: () => ({ t }),\n  }, ManagedDataOpsSection))\n\n  const synchronizeJwt = async (): Promise<void> => {\n    const response = await fetch(new URL(MANAGED_AUTH_PATH, window.location.origin), {\n      method: 'POST',\n      credentials: 'same-origin',\n    })\n    if (!response.ok) throw new Error(`DataOps managed JWT synchronization failed with HTTP ${String(response.status)}`)\n  }\n  const onMessage = (event: MessageEvent<unknown>): void => {\n    if (event.source !== window.parent\n      || (event.data as { type?: unknown } | null)?.type !== AUTH_UPDATED_MESSAGE) return\n    void synchronizeJwt().catch(error => console.error('dataops-managed.jwt_sync_failed', error))\n  }\n  ctx.effect(() => {\n    window.addEventListener('message', onMessage)\n    void synchronizeJwt().catch(error => console.error('dataops-managed.jwt_sync_failed', error))\n    return () => window.removeEventListener('message', onMessage)\n  }, 'dataops-managed: JWT synchronization')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBA,SAAgB,sBAAsB,OAAmC;GACvE,MAAM,EAAE,MAAM;GACd,IAAI,MAAM,KAAA,GAAW,OAAO;GAE5B,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;IAAS,WAAWA,yCAAO;IAA3B,UAAA;KACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD;MAAI,WAAWA,yCAAO;MAAQ,UAAA,EAAE,OAAO;KAAM,CAAA;KAC7C,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,yCAAO;MAAvB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAACC,sCAAAA,UAAD,EAAU,OAAM,OAAQ,CAAA,GACxB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD,EAAA,UAAS,EAAE,SAAS,EAAU,CAAA,CAC3B;;KACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,WAAWD,yCAAO;MAAc,UAAA,EAAE,aAAa;KAAK,CAAA;KACvD,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD;MAAI,WAAWA,yCAAO;MAAtB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,WAAWA,yCAAO;OAAvB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD,EAAA,UAAK,EAAE,eAAe,EAAM,CAAA,GAC5B,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD,EAAA,UAAK,EAAE,eAAe,EAAM,CAAA,CACzB;MACL,CAAA,GAAA,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,WAAWA,yCAAO;OAAvB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD,EAAA,UAAK,EAAE,YAAY,EAAM,CAAA,GACzB,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD,EAAA,UAAK,EAAE,YAAY,EAAM,CAAA,CACtB;MACH,CAAA,CAAA;;IACG;;EAEb;;;;EC1CA,MAAa,KAAK;GAChB,KAAK;GACL,OAAO;GACP,SAAS;GACT,aAAa;GACb,eAAe;GACf,eAAe;GACf,YAAY;GACZ,YAAY;EACd;;EAMA,MAAa,KAAwC;GACnD,KAAK;GACL,OAAO;GACP,SAAS;GACT,aAAa;GACb,eAAe;GACf,eAAe;GACf,YAAY;GACZ,YAAY;EACd;;;ECZA,MAAM,KAAK;EACX,MAAM,uBAAuB;EAC7B,MAAM,oBAAoB;;EAG1B,MAAa,SAAS,CAAC,SAAS,QAAQ;;;;;EAMxC,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa,IAAI,OAAO,SAAS,IAAI;IAAE;IAAI;GAAG,CAAC,GAAG,gCAAgC;GACtF,MAAM,IAAI,IAAI,OAAO,KAAK,EAAE;GAC5B,IAAI,MAAM,OAAO,0BAA0B,IAAI,MAAM,SAAS;IAC5D,MAAM;IACN,IAAI;IACJ,OAAO;IACP,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,EAAE;GACrB,GAAG,qBAAqB,CAAC;GAEzB,MAAM,iBAAiB,YAA2B;IAChD,MAAM,WAAW,MAAM,MAAM,IAAI,IAAI,mBAAmB,OAAO,SAAS,MAAM,GAAG;KAC/E,QAAQ;KACR,aAAa;IACf,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,wDAAwD,OAAO,SAAS,MAAM,GAAG;GACrH;GACA,MAAM,aAAa,UAAuC;IACxD,IAAI,MAAM,WAAW,OAAO,UACtB,MAAM,MAAoC,SAAS,sBAAsB;IAC/E,eAAoB,CAAC,CAAC,OAAM,UAAS,QAAQ,MAAM,mCAAmC,KAAK,CAAC;GAC9F;GACA,IAAI,aAAa;IACf,OAAO,iBAAiB,WAAW,SAAS;IAC5C,eAAoB,CAAC,CAAC,OAAM,UAAS,QAAQ,MAAM,mCAAmC,KAAK,CAAC;IAC5F,aAAa,OAAO,oBAAoB,WAAW,SAAS;GAC9D,GAAG,sCAAsC;EAC3C"}

package/lib/index.js

@@ -1,10 +1,88 @@
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import * as McpClient from "@sparkelf/dsh-plugin-mcp-credentials";
+import z from "@deepseek-ai/schemastery";
 //#region src/index.ts
-/** Cordis plugin name for the DataOps-managed Settings contribution. */
+/** Cordis plugin name for the DataOps-managed integration. */
 const name = "dataops-managed";
+/** Host services required by managed JWT and MCP ownership. */
+const inject = [
+	"credentials",
+	"webServer",
+	"tools"
+];
+const MANAGED_AUTH_PATH = "/integrations/dataops/managed-auth";
+/** Schemastery parser for managed DataOps configuration. */
+const Config = z.object({
+	baseUrl: z.string().default("http://host.docker.internal:3101"),
+	serverName: z.string().default("dataops"),
+	credentialRef: z.string().role("credential-ref").default("DATAOPS_ACCESS_TOKEN"),
+	toolCallTimeoutMs: z.number().min(1).default(12e4)
+});
+function bearerToken(request) {
+	const authorization = request.headers.authorization?.trim() ?? "";
+	if (!authorization.startsWith("Bearer ")) return null;
+	const token = authorization.slice(7).trim();
+	return token === "" ? null : token;
+}
 /**
-* Keep the Host seat intentionally empty because DataOps owns the broker process.
-* @param _ctx - DSH Host context retained for the installable bundle contract.
+* Accept the current DataOps JWT and expose DataOps MCP tools through its credential.
+* @param ctx - DSH Host context with credentials, Web routes, and tools.
+* @param config - Managed DataOps origin and MCP settings.
+* @returns Startup readiness after an existing JWT is connected when present.
 */
-function apply(_ctx) {}
+async function apply(ctx, config) {
+	const baseUrl = new URL(config.baseUrl).origin;
+	const accessRef = credentialRef(config.credentialRef);
+	let mcpFiber;
+	const ensureMcp = async () => {
+		if (mcpFiber !== void 0 && mcpFiber.uid !== null) return;
+		const fiber = ctx.plugin(McpClient, {
+			transport: "streamable-http",
+			serverName: config.serverName,
+			url: `${baseUrl}/api/ai/data-query/mcp`,
+			headers: {},
+			bearerTokenRef: config.credentialRef,
+			toolCallTimeoutMs: config.toolCallTimeoutMs
+		});
+		mcpFiber = fiber;
+		try {
+			await fiber.await();
+		} catch (error) {
+			if (mcpFiber === fiber) mcpFiber = void 0;
+			await fiber.dispose();
+			throw error;
+		}
+	};
+	ctx.effect(() => async () => {
+		const fiber = mcpFiber;
+		mcpFiber = void 0;
+		if (fiber !== void 0 && fiber.uid !== null) await fiber.dispose();
+	}, "dataops-managed: MCP lifecycle");
+	if (await ctx.credentials.resolve(accessRef) !== void 0) await ensureMcp();
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: MANAGED_AUTH_PATH,
+		handler: async (request, response) => {
+			if (request.method !== "POST") {
+				response.writeHead(405, {
+					allow: "POST",
+					"content-length": "0"
+				});
+				response.end();
+				return;
+			}
+			const token = bearerToken(request);
+			if (token === null) {
+				response.writeHead(401, { "content-length": "0" });
+				response.end();
+				return;
+			}
+			await ctx.credentials.set(accessRef, token);
+			await ensureMcp();
+			response.writeHead(204, { "cache-control": "no-store" });
+			response.end();
+		}
+	}), "dataops-managed: JWT intake route");
+}
 //#endregion
-export { apply, name };
+export { Config, MANAGED_AUTH_PATH, apply, inject, name };

package/lib/types/client/ManagedDataOpsSection.d.ts

@@ -8,7 +8,7 @@ export interface ManagedDataOpsSectionInjected {
 /** Props accepted by the managed DataOps Settings section. */
 export type ManagedDataOpsSectionProps = Partial<InjectFace<ManagedDataOpsSectionInjected>>;
 /**
- * Explain DataOps-managed ownership without exposing standalone authorization controls.
+ * Explain the DataOps-managed JWT and permission owner without standalone controls.
  * @param props - Settings slot injection values.
  * @returns The localized managed DataOps section, or nothing before injection.
  */

package/lib/types/client/locales.d.ts

@@ -3,11 +3,11 @@ export declare const en: {
     readonly nav: "DataOps";
     readonly title: "DataOps";
     readonly managed: "Managed by this DataOps workspace";
-    readonly description: "DataOps tools are provided automatically through the workspace-managed channel. No connection or authorization is required here.";
+    readonly description: "DSH uses your current DataOps session JWT. DataOps applies its role and resource permissions to every tool request.";
     readonly identityLabel: "Identity and permissions";
-    readonly identityValue: "Managed by your current DataOps session";
+    readonly identityValue: "Current DataOps JWT";
     readonly toolsLabel: "DataOps tools";
-    readonly toolsValue: "Provided automatically by the workspace";
+    readonly toolsValue: "Authorized by DataOps on every request";
 };
 /** Stable key set shared by every managed DataOps locale. */
 export type ManagedDataOpsKey = keyof typeof en;

package/lib/types/index.d.ts

@@ -1,8 +1,28 @@
+/** DataOps-managed JWT intake and credential-backed MCP composition. */
 import type { Context } from '@deepseek-ai/cordis';
-/** Cordis plugin name for the DataOps-managed Settings contribution. */
+import z from '@deepseek-ai/schemastery';
+/** Cordis plugin name for the DataOps-managed integration. */
 export declare const name = "dataops-managed";
+/** Host services required by managed JWT and MCP ownership. */
+export declare const inject: string[];
+export declare const MANAGED_AUTH_PATH = "/integrations/dataops/managed-auth";
+/** Configuration for the DataOps-managed MCP connection. */
+export interface Config {
+    /** DataOps browser/API origin reachable from the DSH Host. */
+    baseUrl: string;
+    /** Local namespace for DataOps MCP tools. */
+    serverName: string;
+    /** DSH credential reference that stores the current DataOps access JWT. */
+    credentialRef: string;
+    /** Per-tool-call timeout forwarded to the MCP client. */
+    toolCallTimeoutMs: number;
+}
+/** Schemastery parser for managed DataOps configuration. */
+export declare const Config: z<Config>;
 /**
- * Keep the Host seat intentionally empty because DataOps owns the broker process.
- * @param _ctx - DSH Host context retained for the installable bundle contract.
+ * Accept the current DataOps JWT and expose DataOps MCP tools through its credential.
+ * @param ctx - DSH Host context with credentials, Web routes, and tools.
+ * @param config - Managed DataOps origin and MCP settings.
+ * @returns Startup readiness after an existing JWT is connected when present.
  */
-export declare function apply(_ctx: Context): void;
+export declare function apply(ctx: Context, config: Config): Promise<void>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sparkelf/dsh-dataops-managed",
-  "version": "0.1.0",
-  "description": "Managed DataOps workspace ownership information for DeepSeek Harness settings.",
+  "version": "0.2.0",
+  "description": "DataOps JWT intake and credential-backed MCP tools for managed DeepSeek Harness workspaces.",
   "type": "module",
   "main": "./lib/index.js",
   "types": "./lib/types/index.d.ts",
@@ -54,20 +54,30 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-primitives": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
+    "@deepseek-ai/schemastery": ">=3.18.1",
+    "@sparkelf/dsh-plugin-mcp-credentials": ">=0.1.0-rc.11",
     "react": ">=18.2.0 <20"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-primitives": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@sparkelf/dsh-plugin-mcp-credentials": "0.1.0-rc.11",
     "@types/react": "~18.3.1",
     "lightningcss": "^1.32.0",
     "react": "^18.2.0",