@sparkelf/dsh-dataops-managed 0.3.13 → 0.3.15

package/lib/index.js

@@ -14,17 +14,17 @@ function modelIdOf(entry) {
 	return typeof id === "string" && id.trim() !== "" ? id : null;
 }
 /** Narrow an unknown value to a plain object. */
-function asRecord$3(value) {
+function asRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 /** Read provider profiles out of a settings value. */
 function providersOf(value) {
-	const root = asRecord$3(value);
-	const providers = root === null ? null : asRecord$3(root[PROVIDERS_FIELD]);
+	const root = asRecord$4(value);
+	const providers = root === null ? null : asRecord$4(root[PROVIDERS_FIELD]);
 	if (providers === null) return {};
 	const result = {};
 	for (const [providerId, profile] of Object.entries(providers)) {
-		const narrowed = asRecord$3(profile);
+		const narrowed = asRecord$4(profile);
 		if (narrowed !== null) result[providerId] = narrowed;
 	}
 	return result;
@@ -58,7 +58,7 @@ function modelIdsByProvider(providers) {
 	for (const [providerId, profile] of Object.entries(providers)) {
 		const models = profile[MODELS_FIELD];
 		if (!Array.isArray(models)) continue;
-		result[providerId] = models.map((entry) => asRecord$3(entry)).filter((entry) => entry !== null).map((entry) => modelIdOf(entry)).filter((id) => id !== null);
+		result[providerId] = models.map((entry) => asRecord$4(entry)).filter((entry) => entry !== null).map((entry) => modelIdOf(entry)).filter((id) => id !== null);
 	}
 	return result;
 }
@@ -79,7 +79,7 @@ function selectSharedModels(providers, sharedModelIds) {
 		const models = profile[MODELS_FIELD];
 		if (!Array.isArray(models)) continue;
 		const kept = models.filter((entry) => {
-			const narrowed = asRecord$3(entry);
+			const narrowed = asRecord$4(entry);
 			const id = narrowed === null ? null : modelIdOf(narrowed);
 			return id !== null && offered.has(id);
 		});
@@ -113,9 +113,9 @@ function mergeProviders(local, adopted) {
 			continue;
 		}
 		const localModels = Array.isArray(localProfile[MODELS_FIELD]) ? localProfile[MODELS_FIELD] : [];
-		const localIds = new Set(localModels.map((entry) => asRecord$3(entry)).filter((entry) => entry !== null).map((entry) => modelIdOf(entry)).filter((id) => id !== null));
+		const localIds = new Set(localModels.map((entry) => asRecord$4(entry)).filter((entry) => entry !== null).map((entry) => modelIdOf(entry)).filter((id) => id !== null));
 		const missing = adoptedModels.filter((entry) => {
-			const narrowed = asRecord$3(entry);
+			const narrowed = asRecord$4(entry);
 			const id = narrowed === null ? null : modelIdOf(narrowed);
 			return id !== null && !localIds.has(id);
 		});
@@ -147,7 +147,7 @@ async function writeModels(ctx, providers, revision) {
 //#endregion
 //#region src/model-sync.ts
 /** Narrow an unknown value to a plain object. */
-function asRecord$2(value) {
+function asRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 /**
@@ -190,10 +190,10 @@ var ModelSync = class {
 		});
 		if (response.status === 401) return void 0;
 		if (!response.ok) throw new Error(`Shared model read failed with HTTP ${String(response.status)}`);
-		const body = asRecord$2(await response.json());
+		const body = asRecord$3(await response.json());
 		if (body === null) return void 0;
-		const payload = asRecord$2(body.payload);
-		const providers = payload === null ? null : asRecord$2(payload.providers);
+		const payload = asRecord$3(body.payload);
+		const providers = payload === null ? null : asRecord$3(payload.providers);
 		return {
 			sharingEnabled: body.sharingEnabled === true,
 			payload: {
@@ -257,7 +257,7 @@ var ModelSync = class {
 		const response = await fetch(new URL("/api/ai/shared-models/publication", this.apiBase()), { headers: { authorization: `Bearer ${token}` } });
 		if (response.status === 401) return null;
 		if (!response.ok) throw new Error(`Shared model status read failed with HTTP ${String(response.status)}`);
-		const body = asRecord$2(await response.json());
+		const body = asRecord$3(await response.json());
 		return {
 			sharingEnabled: body?.sharingEnabled === true,
 			canPublish: body?.canPublish === true
@@ -391,7 +391,7 @@ var ModelSync = class {
 /** Default state before this workspace stored anything. */
 const SECTION_SYNC_DEFAULT = { sections: {} };
 /** Narrow an unknown value to a plain object. */
-function asRecord$1(value) {
+function asRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 /**
@@ -430,7 +430,7 @@ var SettingsSync = class {
 	readSection(ns) {
 		const descriptor = this.ctx.settings.describe().find((entry) => entry.ns === ns);
 		if (descriptor === void 0) return void 0;
-		const value = asRecord$1(descriptor.value);
+		const value = asRecord$2(descriptor.value);
 		if (value === null) return void 0;
 		return {
 			value,
@@ -534,7 +534,7 @@ var SettingsSync = class {
 //#endregion
 //#region src/skill-plaza.ts
 /** Narrow an unknown value to a plain object. */
-function asRecord(value) {
+function asRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 /**
@@ -658,7 +658,7 @@ var SkillPlaza = class {
 			method: "POST",
 			body: JSON.stringify({ skillId })
 		});
-		const record = body === void 0 ? null : asRecord(body);
+		const record = body === void 0 ? null : asRecord$1(body);
 		if (record === null) return null;
 		return {
 			installed: record.installed === true,
@@ -668,7 +668,7 @@ var SkillPlaza = class {
 	}
 	/** Project one API row into the shape the browser reads. */
 	toPlazaSkill(value) {
-		const row = asRecord(value);
+		const row = asRecord$1(value);
 		if (row === null || typeof row.id !== "number" || typeof row.name !== "string") return [];
 		return [{
 			id: row.id,
@@ -682,6 +682,119 @@ var SkillPlaza = class {
 	}
 };
 //#endregion
+//#region src/workspace-limits.ts
+/** Narrow a value to a plain object. */
+function asRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+/** Narrow a value to a positive integer. */
+function asByteCount(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+/**
+* A rejection DataOps answered with, carrying its status and message.
+*
+* Without this the caller can only tell that something failed, and a value DataOps refused —
+* which the user can correct — is indistinguishable from a fault in the request path.
+*/
+var WorkspaceLimitsRejection = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+		this.name = "WorkspaceLimitsRejection";
+	}
+};
+/** Read DataOps' own explanation from a failed response, falling back to the status line. */
+async function rejectionMessage(response, fallback) {
+	try {
+		const message = asRecord(await response.json())?.message;
+		if (typeof message === "string" && message.trim() !== "") return message;
+		if (Array.isArray(message) && typeof message[0] === "string") return message[0];
+	} catch {}
+	return `${fallback} with HTTP ${String(response.status)}`;
+}
+/**
+* The workspace limits an administrator sets in DataOps.
+*
+* The plugin holds the DataOps JWT, so the browser cannot read these itself; this class is the
+* only path from the Settings panel to that document.
+*/
+var WorkspaceLimits = class {
+	ctx;
+	config;
+	constructor(ctx, config) {
+		this.ctx = ctx;
+		this.config = config;
+	}
+	/**
+	* Read the DataOps JWT this workspace is currently authorized with.
+	* @returns The token, or undefined when the workspace has no session yet.
+	*/
+	async token() {
+		return (await this.ctx.credentials.resolve(credentialRef(this.config.credentialRef)))?.value;
+	}
+	/** The DataOps API origin this workspace reports to. */
+	apiBase() {
+		return new URL(this.config.baseUrl).origin;
+	}
+	/**
+	* Read the current ceilings.
+	* @returns The status, or undefined when the workspace is not authorized.
+	*/
+	async status() {
+		const token = await this.token();
+		if (token === void 0) return void 0;
+		const response = await fetch(new URL("/api/ai/attachment-settings", this.apiBase()), { headers: { authorization: `Bearer ${token}` } });
+		if (response.status === 401) return void 0;
+		if (!response.ok) throw new WorkspaceLimitsRejection(response.status, await rejectionMessage(response, "Workspace limits read failed"));
+		const body = asRecord(await response.json());
+		const settings = body === null ? null : asRecord(body.settings);
+		const size = settings === null ? null : asRecord(settings.workspaceSize);
+		const fileReadMaxBytes = size === null ? null : asByteCount(size.fileReadMaxBytes);
+		const uploadMaxBytes = size === null ? null : asByteCount(size.uploadMaxBytes);
+		if (fileReadMaxBytes === null || uploadMaxBytes === null) throw new Error("Workspace limits read returned an unrecognized document");
+		return {
+			limits: {
+				fileReadMaxBytes,
+				uploadMaxBytes
+			},
+			canWrite: true,
+			readOnlyReason: null
+		};
+	}
+	/**
+	* Write new ceilings.
+	* @param limits - The ceilings to store.
+	* @returns The stored status.
+	*/
+	async save(limits) {
+		const token = await this.token();
+		if (token === void 0) return void 0;
+		const response = await fetch(new URL("/api/ai/attachment-settings", this.apiBase()), {
+			method: "PATCH",
+			headers: {
+				authorization: `Bearer ${token}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({ workspaceSize: limits })
+		});
+		if (response.status === 401) return void 0;
+		if (!response.ok) throw new WorkspaceLimitsRejection(response.status, await rejectionMessage(response, "Workspace limits write failed"));
+		return this.status();
+	}
+};
+/** The live instance, so the Settings route can act on it after activation. */
+let limitsRef;
+/** @param next - Instance to publish, or undefined to clear. */
+function setWorkspaceLimits(next) {
+	limitsRef = next;
+}
+/** @returns The live workspace-limits instance, when the plugin activated. */
+function currentWorkspaceLimits() {
+	return limitsRef;
+}
+//#endregion
 //#region src/index.ts
 /** Cordis plugin name for the DataOps-managed integration. */
 const name = "dataops-managed";
@@ -700,6 +813,8 @@ const MANAGED_PLUGIN_ID = "dataops-managed";
 const MODEL_SYNC_PATH = "/integrations/dataops/model-sync";
 /** Same-origin route the skill center uses to read and change plaza sharing. */
 const SKILL_PLAZA_PATH = "/integrations/dataops/skill-plaza";
+/** Same-origin route the Settings panel uses to read and change this workspace's limits. */
+const WORKSPACE_LIMITS_PATH = "/integrations/dataops/workspace-limits";
 /** The live sync instance, so the settings routes can act on it after activation. */
 let modelSyncRef;
 /** The live plaza instance, so the skill center routes can act on it after activation. */
@@ -718,21 +833,54 @@ let settingsSyncRef;
 function currentSettingsSync() {
 	return settingsSyncRef;
 }
+/**
+* Read the value behind a possibly-volatile field.
+*
+* A volatile field always arrives as a reference, but the plain shape is accepted too so a
+* caller that validated the config without a settings service still reads its value.
+* @param field - The config field as the runtime supplied it.
+* @param fallback - Value to use when nothing is stored yet.
+* @returns The current value.
+*/
+function volatileValue(field, fallback) {
+	if (field === void 0) return fallback;
+	if (typeof field === "object" && field !== null && "get" in field && typeof field.get === "function") return field.get() ?? fallback;
+	return field;
+}
+/**
+* Per-tool-call timeout a workspace starts with.
+*
+* Named rather than inlined so the schema default and the read fallback cannot drift: the field is
+* volatile, so a workspace that never changed it reads no value at all and both places have to
+* answer the same number.
+*/
+const DEFAULT_TOOL_CALL_TIMEOUT_MS = 3e5;
+/** Default sync state before this workspace stored anything. */
+const MODEL_SYNC_DEFAULT = {
+	detached: false,
+	adoptedModelIds: [],
+	privateModelIds: []
+};
 /** Schemastery parser for managed DataOps configuration. */
 const Config = z.object({
 	baseUrl: z.string().default("http://host.docker.internal:3101"),
 	serverName: z.string().default("dataops"),
 	credentialRef: z.string().role("credential-ref").default("DATAOPS_ACCESS_TOKEN"),
-	toolCallTimeoutMs: z.number().min(1).default(12e4),
+	/**
+	* Volatile so the settings service persists it in this workspace's document: the timeout an
+	* operator needs depends on the query behind a tool, which is deployment knowledge the profile
+	* that mounts this plugin does not have.
+	*
+	* `z.any()` like the sync state above, and for the same reason: a volatile field is delivered
+	* to `apply` as a reference rather than a value, so a narrowed schema would describe a shape
+	* the runtime does not pass. The range is enforced where the value is read.
+	*/
+	toolCallTimeoutMs: z.any().default(DEFAULT_TOOL_CALL_TIMEOUT_MS).volatile(),
 	/**
 	* Volatile so the settings service persists it in this workspace's document. The shape is
 	* left open because the sync state is this plugin's own record, not user configuration.
 	*/
-	modelSync: z.any().default({
-		detached: false,
-		adoptedModelIds: [],
-		privateModelIds: []
-	}).volatile(),
+	modelSync: z.any().default(MODEL_SYNC_DEFAULT).volatile(),
 	/** Volatile for the same reason as `modelSync`: it is this plugin's own record. */
 	settingsSync: z.any().default(SECTION_SYNC_DEFAULT).volatile(),
 	/**
@@ -765,7 +913,7 @@ async function apply(ctx, config) {
 			url: `${baseUrl}/api/ai/data-query/mcp`,
 			headers: {},
 			bearerTokenRef: config.credentialRef,
-			toolCallTimeoutMs: config.toolCallTimeoutMs
+			toolCallTimeoutMs: volatileValue(config.toolCallTimeoutMs, DEFAULT_TOOL_CALL_TIMEOUT_MS)
 		});
 		mcpFiber = fiber;
 		try {
@@ -781,23 +929,47 @@ async function apply(ctx, config) {
 		mcpFiber = void 0;
 		if (fiber !== void 0 && fiber.uid !== null) await fiber.dispose();
 	}, "dataops-managed: MCP lifecycle");
-	if (await ctx.credentials.resolve(accessRef) !== void 0) await ensureMcp();
+	/**
+	* Connect the MCP client when a JWT is already stored.
+	*
+	* A connect can fail for reasons this plugin does not own — the stored JWT may have expired,
+	* or DataOps may be unreachable at this moment — and those are states the settings routes
+	* report and recover from. Awaiting it here would abort activation, leaving the plugin with
+	* no routes at all: the panel then cannot read the very state that explains the failure, and
+	* the browser reports a connection error instead. The routes below are registered first, and
+	* a failed connect is reported rather than thrown.
+	*/
+	const connectExisting = async () => {
+		if (await ctx.credentials.resolve(accessRef) === void 0) return;
+		try {
+			await ensureMcp();
+		} catch (error) {
+			ctx.logger.warn("dataops-managed: connecting the DataOps MCP server failed; the settings routes stay up so a new JWT can be connected");
+			ctx.logger.warn(error);
+		}
+	};
 	/**
 	* The sync state lives in this plugin's own Config, so the settings service persists it in
 	* the workspace document and it survives a restart.
 	*/
 	const syncStore = {
-		read: () => ({
-			detached: config.modelSync?.detached === true,
-			adoptedModelIds: Array.isArray(config.modelSync?.adoptedModelIds) ? config.modelSync.adoptedModelIds : [],
-			privateModelIds: Array.isArray(config.modelSync?.privateModelIds) ? config.modelSync.privateModelIds : []
-		}),
+		read: () => {
+			const state = volatileValue(config.modelSync, MODEL_SYNC_DEFAULT);
+			return {
+				detached: state?.detached === true,
+				adoptedModelIds: Array.isArray(state?.adoptedModelIds) ? state.adoptedModelIds : [],
+				privateModelIds: Array.isArray(state?.privateModelIds) ? state.privateModelIds : []
+			};
+		},
 		write: async (next) => {
 			await ctx.settings.update(MANAGED_PLUGIN_ID, { modelSync: next });
 		}
 	};
 	const settingsSync = new SettingsSync(ctx, {
-		read: () => ({ sections: typeof config.settingsSync?.sections === "object" && config.settingsSync.sections !== null ? config.settingsSync.sections : {} }),
+		read: () => {
+			const state = volatileValue(config.settingsSync, SECTION_SYNC_DEFAULT);
+			return { sections: typeof state?.sections === "object" && state.sections !== null ? state.sections : {} };
+		},
 		write: async (next) => {
 			await ctx.settings.update(MANAGED_PLUGIN_ID, { settingsSync: next });
 		}
@@ -843,6 +1015,10 @@ async function apply(ctx, config) {
 		baseUrl,
 		credentialRef: config.credentialRef
 	});
+	setWorkspaceLimits(new WorkspaceLimits(ctx, {
+		baseUrl,
+		credentialRef: config.credentialRef
+	}));
 	/**
 	* Adopt the publisher's models once the workspace has a session.
 	*
@@ -1052,6 +1228,67 @@ async function apply(ctx, config) {
 			}
 		}
 	}), "dataops-managed: skill plaza routes");
+	/**
+	* The workspace limits an administrator sets in DataOps.
+	*
+	* Read through the plugin because it holds the DataOps JWT; the page cannot reach those settings
+	* itself. Same-origin only, like its neighbours.
+	*/
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: WORKSPACE_LIMITS_PATH,
+		handler: async (request, response) => {
+			const limits = currentWorkspaceLimits();
+			if (limits === void 0) {
+				writeJson(response, 503, { error: "workspace limits are not active" });
+				return;
+			}
+			try {
+				if (request.method === "GET") {
+					const status = await limits.status();
+					if (status === void 0) {
+						writeJson(response, 503, { error: "workspace limits are not active" });
+						return;
+					}
+					writeJson(response, 200, status);
+					return;
+				}
+				if (request.method !== "POST") {
+					response.writeHead(405, {
+						allow: "GET, POST",
+						"content-length": "0"
+					});
+					response.end();
+					return;
+				}
+				const body = await readJson(request);
+				const fileReadMaxBytes = body?.fileReadMaxBytes;
+				const uploadMaxBytes = body?.uploadMaxBytes;
+				if (typeof fileReadMaxBytes !== "number" || typeof uploadMaxBytes !== "number") {
+					writeJson(response, 400, { error: "both byte ceilings are required" });
+					return;
+				}
+				const status = await limits.save({
+					fileReadMaxBytes,
+					uploadMaxBytes
+				});
+				if (status === void 0) {
+					writeJson(response, 503, { error: "workspace limits are not active" });
+					return;
+				}
+				writeJson(response, 200, status);
+			} catch (error) {
+				if (error instanceof WorkspaceLimitsRejection) {
+					writeJson(response, error.status, { error: error.message });
+					return;
+				}
+				ctx.logger.warn("dataops-managed: workspace limits request failed");
+				ctx.logger.warn(error);
+				writeJson(response, 500, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: workspace limits route");
+	await connectExisting();
 }
 /** Read and parse a JSON request body, tolerating an absent one. */
 async function readJson(request) {
@@ -1075,4 +1312,4 @@ function writeJson(response, status, body) {
 	response.end(payload);
 }
 //#endregion
-export { Config, MANAGED_AUTH_PATH, MANAGED_PLUGIN_ID, MODEL_SYNC_PATH, SKILL_PLAZA_PATH, apply, currentModelSync, currentSettingsSync, currentSkillPlaza, inject, name };
+export { Config, DEFAULT_TOOL_CALL_TIMEOUT_MS, MANAGED_AUTH_PATH, MANAGED_PLUGIN_ID, MODEL_SYNC_PATH, SKILL_PLAZA_PATH, WORKSPACE_LIMITS_PATH, apply, currentModelSync, currentSettingsSync, currentSkillPlaza, currentWorkspaceLimits, inject, name };

package/lib/types/client/ManagedDataOpsSection.d.ts

@@ -1,6 +1,5 @@
 import type { InjectFace } from '@deepseek-ai/dsh-client-ui-slots';
 import type { en } from './locales.ts';
-import { MODEL_SYNC_PATH } from './model-sync-client.ts';
 /** Values injected by the DSH Settings slot. */
 export interface ManagedDataOpsSectionInjected {
     /** Translate one managed DataOps Settings message key. */
@@ -9,10 +8,9 @@ export interface ManagedDataOpsSectionInjected {
 /** Props accepted by the managed DataOps Settings section. */
 export type ManagedDataOpsSectionProps = Partial<InjectFace<ManagedDataOpsSectionInjected>>;
 /**
- * Explain the DataOps-managed JWT and permission owner, and share model configuration.
+ * The DataOps settings this workspace owns: its connection state, its branding, its file ceilings,
+ * and the default configuration it publishes to other workspaces.
  * @param props - Settings slot injection values.
  * @returns The localized managed DataOps section, or nothing before injection.
  */
 export declare function ManagedDataOpsSection(props: ManagedDataOpsSectionProps): import("react").JSX.Element | null;
-/** Re-exported so the settings entry can be discovered from the section alone. */
-export { MODEL_SYNC_PATH };

package/lib/types/client/locales.d.ts

@@ -2,27 +2,23 @@
 export declare const en: {
     readonly nav: "DataOps";
     readonly title: "DataOps";
-    readonly managed: "Managed by this DataOps workspace";
-    readonly description: "DSH uses your current DataOps session JWT. DataOps applies its role and resource permissions to every tool request.";
-    readonly identityLabel: "Identity and permissions";
-    readonly identityValue: "Current DataOps JWT";
-    readonly toolsLabel: "DataOps tools";
-    readonly toolsValue: "Authorized by DataOps on every request";
-    readonly brandingTitle: "Apply Wanxiang branding";
-    readonly brandingDescription: "Use the Wanxiang Data Platform identity in navigation, the New Session welcome view, browser title, and favicon.";
-    readonly brandingToggle: "Apply Wanxiang branding";
-    readonly modelsTitle: "Model configuration";
-    readonly modelsDescription: "Share the models configured here with other users, and choose which of them they may use.";
-    readonly modelsUnavailable: "Model configuration is unavailable until this workspace is connected to DataOps.";
+    readonly managed: "Connected to DataOps";
+    readonly unavailable: "DataOps is not connected.";
+    readonly loadFailed: "Loading failed. Try again.";
+    readonly brandingTitle: "Wanxiang branding";
+    readonly brandingToggle: "Wanxiang branding";
+    readonly limitsTitle: "File size limits";
+    readonly limitsFileReadLabel: "Largest file to read (MiB)";
+    readonly limitsUploadLabel: "Largest file to upload (MiB)";
+    readonly limitsInvalid: "Enter a size in MiB.";
+    readonly limitsSave: "Save";
+    readonly limitsSaving: "Saving…";
     readonly defaultsTitle: "Default configuration";
-    readonly defaultsDescription: "Publish the configuration this workspace holds — models, permissions, and general settings — as the values other users start from. Their workspace takes that copy once and may then change anything, and a change they make is never overwritten.";
-    readonly defaultsActionTitle: "Publish as the default";
-    readonly defaultsNotAdmin: "Only an administrator may publish the default configuration.";
-    readonly defaultsNeverPublished: "Not published yet.";
-    readonly defaultsPublishedAt: "Last published:";
-    readonly defaultsPublish: "Publish default configuration";
+    readonly defaultsPublish: "Publish";
     readonly defaultsPublishing: "Publishing…";
-    readonly loadFailed: "The model configuration could not be loaded. Try again.";
+    readonly defaultsPublishedAt: "Last published";
+    readonly defaultsNeverPublished: "Not published yet";
+    readonly defaultsNotAdmin: "Administrators only";
     readonly plazaTitle: "Skill plaza";
     readonly plazaIntro: "Skills other users shared. Install one to use it in this workspace, or share a skill of your own.";
     readonly plazaSearch: "Search skills";

package/lib/types/client/workspace-limits-client.d.ts

@@ -0,0 +1,36 @@
+/** Same-origin workspace-limits calls from the DataOps settings surface. */
+/** Route the plugin's Host half serves for workspace limits. */
+export declare const WORKSPACE_LIMITS_PATH = "/integrations/dataops/workspace-limits";
+/** The two byte ceilings, as the panel edits them. */
+export interface WorkspaceLimits {
+    /** Largest file a sidebar download or agent read may carry. */
+    fileReadMaxBytes: number;
+    /** Largest file an upload may carry. */
+    uploadMaxBytes: number;
+}
+/** Limits as this workspace currently holds them. */
+export interface WorkspaceLimitsStatus {
+    limits: WorkspaceLimits;
+    canWrite: boolean;
+    readOnlyReason: string | null;
+}
+/**
+ * A write DataOps refused, carrying the reason it gave.
+ *
+ * The message is written for the person who set the value, so the panel shows it as-is rather
+ * than replacing it with a generic failure notice.
+ */
+export declare class WorkspaceLimitsRejection extends Error {
+    constructor(message: string);
+}
+/**
+ * Read the workspace limits the panel shows.
+ * @returns The status, or null when the workspace is not connected to DataOps.
+ */
+export declare function fetchWorkspaceLimits(): Promise<WorkspaceLimitsStatus | null>;
+/**
+ * Store new workspace limits.
+ * @param limits - The ceilings to store.
+ * @returns The stored status.
+ */
+export declare function saveWorkspaceLimits(limits: WorkspaceLimits): Promise<WorkspaceLimitsStatus | null>;

package/lib/types/index.d.ts

@@ -4,6 +4,7 @@ import z from '@deepseek-ai/schemastery';
 import { ModelSync } from './model-sync.ts';
 import { SettingsSync, type SectionSyncState } from './settings-sync.ts';
 import { SkillPlaza } from './skill-plaza.ts';
+import { currentWorkspaceLimits } from './workspace-limits.ts';
 /** Cordis plugin name for the DataOps-managed integration. */
 export declare const name = "dataops-managed";
 /** Host services required by managed JWT and MCP ownership. */
@@ -15,12 +16,27 @@ export declare const MANAGED_PLUGIN_ID = "dataops-managed";
 export declare const MODEL_SYNC_PATH = "/integrations/dataops/model-sync";
 /** Same-origin route the skill center uses to read and change plaza sharing. */
 export declare const SKILL_PLAZA_PATH = "/integrations/dataops/skill-plaza";
+/** Same-origin route the Settings panel uses to read and change this workspace's limits. */
+export declare const WORKSPACE_LIMITS_PATH = "/integrations/dataops/workspace-limits";
 /** The live skill plaza, once this plugin activated. */
 export declare function currentSkillPlaza(): SkillPlaza | undefined;
 /** The live model-sync instance, once this plugin activated. */
 export declare function currentModelSync(): ModelSync | undefined;
+export { currentWorkspaceLimits };
 /** @returns The live instance, or undefined before this plugin activated. */
 export declare function currentSettingsSync(): SettingsSync | undefined;
+/**
+ * A volatile config reference.
+ *
+ * A field marked volatile is not stored with the plugin's own configuration: the settings
+ * service keeps it in this workspace's document and hands the plugin a reference that it
+ * updates in place, so a value written through the Settings panel is visible without a
+ * restart. Reading the field directly therefore reads the reference, not the value.
+ */
+interface VolatileRef<T> {
+    /** The current value behind the reference. */
+    get(): T;
+}
 /** Configuration for the DataOps-managed MCP connection. */
 export interface Config {
     /** DataOps browser/API origin reachable from the DSH Host. */
@@ -29,23 +45,32 @@ export interface Config {
     serverName: string;
     /** DSH credential reference that stores the current DataOps access JWT. */
     credentialRef: string;
-    /** Per-tool-call timeout forwarded to the MCP client. */
-    toolCallTimeoutMs: number;
+    /**
+     * Per-tool-call timeout forwarded to the MCP client.
+     *
+     * Volatile, so the settings service stores the platform default in this workspace's document
+     * and the panel can raise it without a profile edit. The read goes through `volatileValue`.
+     */
+    toolCallTimeoutMs: number | VolatileRef<number>;
     /**
      * Model-sync state this workspace keeps.
      *
      * Volatile, so the settings service stores it in this workspace's own document. It belongs
      * to the workspace rather than to DataOps because it records whether the user here wrote
      * their own models, which is a fact about this workspace.
+     *
+     * Volatile, so the runtime supplies a reference and the read goes through `volatileValue`.
      */
-    modelSync: ModelSyncState;
+    modelSync: ModelSyncState | VolatileRef<ModelSyncState>;
     /**
      * Settings-distribution state this workspace keeps.
      *
      * Volatile, like the model-sync state beside it, and for the same reason: it records whether
      * the user here wrote their own values, which is a fact about this workspace.
+     *
+     * Volatile, like the field above, so the read goes through `volatileValue`.
      */
-    settingsSync: SectionSyncState;
+    settingsSync: SectionSyncState | VolatileRef<SectionSyncState>;
     /**
      * Settings namespaces this deployment distributes to other workspaces.
      *
@@ -63,6 +88,14 @@ export interface ModelSyncState {
     /** Model ids the administrator keeps private; every other model is offered by default. */
     privateModelIds: string[];
 }
+/**
+ * Per-tool-call timeout a workspace starts with.
+ *
+ * Named rather than inlined so the schema default and the read fallback cannot drift: the field is
+ * volatile, so a workspace that never changed it reads no value at all and both places have to
+ * answer the same number.
+ */
+export declare const DEFAULT_TOOL_CALL_TIMEOUT_MS = 300000;
 /** Schemastery parser for managed DataOps configuration. */
 export declare const Config: z<Config>;
 /**