@sparkelf/dsh-dataops-managed 0.3.19 → 0.3.21

package/lib/types/client/settings-gate.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Whether the managed DataOps settings section may be registered at all.
+ *
+ * Registration is the gate, not a CSS class: an ordinary user's profile should not contain a
+ * section whose controls they may not use. The identity record is presentation-only and arrives
+ * from the portal after the iframe loads, so the registration follows it instead of reading it
+ * once at startup. Authorization still lives in DataOps; this only keeps a forbidden panel out of
+ * the interface.
+ */
+/** Read the current role label without trusting any other field. */
+export declare function currentManagedSettingsRole(): string | null;
+/** Whether the current identity may see the managed DataOps settings section. */
+export declare function canSeeManagedSettings(): boolean;
+/**
+ * Observe identity changes.
+ *
+ * The account plugin keeps one store on `window`; subscribing to its listener set catches the
+ * in-page update even before the portal's DOM event. The event is kept as a second signal because
+ * a future portal may publish the event without touching the store this plugin reads.
+ */
+export declare function subscribeManagedSettingsVisibility(listener: () => void): () => void;

package/lib/types/client/skill-plaza-client.d.ts

@@ -1,4 +1,5 @@
 /** Same-origin skill plaza calls from the DataOps skill center section. */
+import type { ReviewStatus, ResourceVisibility } from './review-types.ts';
 /** Route the plugin's Host half serves for the plaza. */
 export declare const SKILL_PLAZA_PATH = "/integrations/dataops/skill-plaza";
 /** One plaza entry as the section reads it. */
@@ -10,11 +11,29 @@ export interface PlazaSkill {
     tags: string[];
     sharedByMe: boolean;
     updatedAt: string;
+    reviewStatus: ReviewStatus;
+    visibility: ResourceVisibility;
+    departmentCode?: string | null;
+    departmentName?: string;
+    departmentPath?: readonly {
+        code: string;
+        name: string;
+    }[];
+    ownerName?: string;
+    riskReport?: import('./review-types.ts').RiskReport | null;
+    reviewNote?: string | null;
+    submittedAt?: string;
 }
 /** The plaza listing and the tags in use. */
 export interface PlazaListing {
     skills: PlazaSkill[];
     tags: string[];
+    counts?: {
+        pending: number;
+        approved: number;
+        rejected: number;
+        total: number;
+    };
 }
 /**
  * Read the plaza.
@@ -24,6 +43,8 @@ export interface PlazaListing {
 export declare function fetchPlaza(filter?: {
     tag?: string;
     query?: string;
+    status?: string;
+    scope?: string;
 }): Promise<PlazaListing | null>;
 /**
  * Change the plaza.

package/lib/types/client/workspace-upgrade-client.d.ts

@@ -0,0 +1,29 @@
+/** Same-origin calls for the workspace image upgrade banner. */
+/** Route the plugin's Host half serves for upgrade detection and start. */
+export declare const WORKSPACE_UPGRADE_PATH = "/integrations/dataops/workspace-upgrade";
+/** A DSH session that will receive "继续" after the restart. */
+export interface WorkspaceUpgradeSession {
+    sessionId: string;
+    title?: string;
+    cwd?: string;
+}
+/** The status the DSH page reads before offering an upgrade. */
+export interface WorkspaceUpgradeStatus {
+    imageStatus: 'CURRENT' | 'UPDATE_AVAILABLE' | 'NOT_RUNNING' | 'UNKNOWN';
+    configuredImage: string;
+    activeSessions: WorkspaceUpgradeSession[];
+}
+/**
+ * Read the workspace upgrade preview.
+ * @returns the status, or null when the Host route is not ready or not connected.
+ */
+export declare function fetchWorkspaceUpgrade(): Promise<WorkspaceUpgradeStatus | null>;
+/**
+ * Ask the Host to snapshot sessions and recreate the workspace container.
+ * @returns the accepted hand-off summary.
+ */
+export declare function requestWorkspaceUpgrade(): Promise<{
+    accepted: boolean;
+    upgradeId: string;
+    sessions: number;
+}>;

package/lib/types/index.d.ts

@@ -1,5 +1,7 @@
 /** DataOps-managed JWT intake and credential-backed MCP composition. */
+import type { IncomingMessage } from 'node:http';
 import type { Context } from '@deepseek-ai/cordis';
+import { credentialRef } from '@deepseek-ai/dsh-credentials';
 import z from '@deepseek-ai/schemastery';
 import { ModelSync } from './model-sync.ts';
 import { SettingsSync, type SectionSyncState } from './settings-sync.ts';
@@ -16,10 +18,26 @@ export declare const MANAGED_PLUGIN_ID = "dataops-managed";
 export declare const MODEL_SYNC_PATH = "/integrations/dataops/model-sync";
 /** Same-origin route the skill center uses to read and change plaza sharing. */
 export declare const SKILL_PLAZA_PATH = "/integrations/dataops/skill-plaza";
+/** Caller role and review capability. */
+export declare const REVIEW_CONTEXT_PATH = "/integrations/dataops/review-context";
+/** Notification inbox and read receipts. */
+export declare const REVIEW_NOTIFICATIONS_PATH = "/integrations/dataops/review-notifications";
+/** AI scan and the administrator's decision. */
+export declare const REVIEW_ACTION_PATH = "/integrations/dataops/review";
+/** Permission-centre reads and writes. */
+export declare const RBAC_PATH = "/integrations/dataops/rbac";
+/** The three plaza-review switches. */
+export declare const REVIEW_SETTINGS_PATH = "/integrations/dataops/review-settings";
+/** Department CRUD bridge (task-67). */
+export declare const DEPARTMENTS_PATH = "/integrations/dataops/departments";
 /** Same-origin route the Settings panel uses to read and change this workspace's limits. */
 export declare const WORKSPACE_LIMITS_PATH = "/integrations/dataops/workspace-limits";
 /** Same-origin route the Settings panel uses to read and change the tool-call timeout. */
 export declare const TOOL_TIMEOUT_PATH = "/integrations/dataops/tool-timeout";
+/** Same-origin route reporting what the last DataOps answer said about the credential. */
+export declare const AUTH_STATE_PATH = "/integrations/dataops/auth-state";
+/** Same-origin route the DSH page uses to detect and start a workspace image upgrade. */
+export declare const WORKSPACE_UPGRADE_PATH = "/integrations/dataops/workspace-upgrade";
 /** The ends a tool-call timeout may take, in whole seconds. */
 export declare const TOOL_TIMEOUT_MIN_SECONDS = 1;
 export declare const TOOL_TIMEOUT_MAX_SECONDS = 3600;
@@ -103,6 +121,24 @@ export interface ModelSyncState {
 export declare const DEFAULT_TOOL_CALL_TIMEOUT_MS = 300000;
 /** Schemastery parser for managed DataOps configuration. */
 export declare const Config: z<Config>;
+/**
+ * Adopt the JWT the browser gateway attached to one request.
+ *
+ * Every browser request reaches this workspace through the DataOps gateway, which resolves the
+ * caller's session and forwards a fresh `authorization: Bearer <jwt>` — so the current credential
+ * arrives continuously, without any push, handshake or refresh protocol. The routes below are
+ * the only place this plugin can see that header, and reading it here is what keeps the stored
+ * credential from going stale: the value in it was captured once, while the caller's session is
+ * renewed by DataOps for as long as they stay signed in.
+ *
+ * A request without the header is normal rather than an error (same-origin fetches from inside
+ * the workspace do carry it, but a probe or a health check may not), so this only ever improves
+ * the stored value and never rejects the request.
+ *
+ * @param request - the incoming request, whose headers the gateway filled in.
+ * @returns once the credential has been updated, or immediately when there is nothing to adopt.
+ */
+export declare function adoptRequestJwt(ctx: Context, accessRef: ReturnType<typeof credentialRef>, request: IncomingMessage): Promise<void>;
 /**
  * Accept the current DataOps JWT and expose DataOps MCP tools through its credential.
  * @param ctx - DSH Host context with credentials, Web routes, and tools.

package/lib/types/review-api.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The DataOps review, notification, permission and settings API.
+ *
+ * One transport for the four new surfaces keeps the JWT handling, 401 observation and error
+ * mapping identical; the browser routes only translate same-origin actions into these calls.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Configuration shared with the skill plaza: where DataOps is and which credential holds its JWT. */
+export interface ReviewApiConfig {
+    baseUrl: string;
+    credentialRef: string;
+}
+/** One upstream answer, status included so a 404/503 can reach the browser unchanged. */
+export interface ReviewApiResult {
+    status: number;
+    body: unknown;
+}
+/** Cookie-free same-origin bridge to the review endpoints. */
+export declare class ReviewApi {
+    private readonly ctx;
+    private readonly config;
+    constructor(ctx: Context, config: ReviewApiConfig);
+    private apiBase;
+    private token;
+    /**
+     * Call one DataOps endpoint with the workspace JWT.
+     * @param path - API path below the DataOps origin.
+     * @param init - Method, body and extra headers.
+     * @returns The upstream status and parsed body; 503 when this workspace has no session.
+     */
+    request(path: string, init?: RequestInit): Promise<ReviewApiResult>;
+}

package/lib/types/skill-plaza.d.ts

@@ -11,6 +11,18 @@ export interface PlazaSkill {
     /** Whether the current user shared this entry. */
     sharedByMe: boolean;
     updatedAt: string;
+    reviewStatus: 'pending' | 'approved' | 'rejected';
+    visibility: 'global' | 'department' | 'private';
+    departmentCode?: string | null;
+    departmentName?: string;
+    departmentPath?: {
+        code: string;
+        name: string;
+    }[];
+    ownerName?: string;
+    riskReport?: unknown;
+    reviewNote?: string | null;
+    submittedAt?: string;
 }
 /** A skill the local workspace holds, offered by name for sharing. */
 export interface LocalSkillCandidate {
@@ -74,7 +86,26 @@ export declare class SkillPlaza {
     list(options?: {
         tag?: string;
         query?: string;
+        status?: string;
+        scope?: string;
+        departmentCode?: string;
     }): Promise<PlazaSkill[]>;
+    /** List with the server's tab counts, which the plaza shows without re-counting a page. */
+    listPage(options?: {
+        tag?: string;
+        query?: string;
+        status?: string;
+        scope?: string;
+        departmentCode?: string;
+    }): Promise<{
+        skills: PlazaSkill[];
+        counts?: {
+            pending: number;
+            approved: number;
+            rejected: number;
+            total: number;
+        };
+    }>;
     /**
      * Every tag in use, so the browser offers existing labels.
      * @returns Distinct tags.

package/lib/types/tools.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Model tools for the skill centre and the shared review queues.
+ *
+ * Every tool reads the caller's DataOps role from `/api/ai/review/context` and asks DataOps on
+ * every call; the Host never caches an authorization decision. Mutations require user approval
+ * and write an audit line. Secret material is never a parameter and never a return value: the
+ * API only sees the workspace JWT that the credential service already holds.
+ *
+ * The skill plaza is the catalogue. `scope=mine` exposes the caller's pending/rejected rows,
+ * the public list exposes what the caller may install, and the admin list (administrators only)
+ * exposes disabled entries. Installation, sharing and deletion are deliberately three different
+ * actions: uninstall removes only the caller's installation, unshare unpublishes the shared entry
+ * (with an unpublished notification), and delete permanently removes the entry after a second
+ * confirmation, with its own deleted notification and audit trail.
+ *
+ * @module tools
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ReviewApi } from './review-api.ts';
+/** Register the skill-centre and review tools. */
+export declare function registerAiManagementTools(ctx: Context, reviewApi: ReviewApi): () => void;

package/lib/types/workspace-upgrade-state.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Persistent hand-off record for one workspace image upgrade.
+ *
+ * The DSH companion and the workspace container share the same named volume at
+ * `/workspace`; a JSON file there survives the container recreate that applies a new
+ * image. The record is deliberately small: only sessions that were running when the
+ * user confirmed the upgrade, so recovery cannot send "继续" to unrelated history.
+ *
+ * @module workspace-upgrade-state
+ */
+/** Format version of the persisted hand-off record. */
+export declare const WORKSPACE_UPGRADE_STATE_VERSION = 1;
+/** One DSH session that was running when the upgrade was confirmed. */
+export interface WorkspaceUpgradeSession {
+    /** DSH session id, the id `agents.get` and `agents.resume` accept. */
+    sessionId: string;
+    /** Optional human-readable title captured for diagnostics. */
+    title?: string;
+    /** Optional workspace directory captured for diagnostics. */
+    cwd?: string;
+}
+/** The JSON document written before the container is recreated. */
+export interface WorkspaceUpgradeState {
+    version: typeof WORKSPACE_UPGRADE_STATE_VERSION;
+    upgradeId: string;
+    targetImage: string;
+    sessions: WorkspaceUpgradeSession[];
+    createdAt: string;
+}
+/** Directory used by this plugin below the DSH home. */
+export declare const WORKSPACE_UPGRADE_STATE_DIR = "dataops-managed";
+/** Name of the hand-off file. */
+export declare const WORKSPACE_UPGRADE_STATE_FILE = "workspace-upgrade.json";
+/**
+ * Resolve the persistent DSH home used by this workspace.
+ *
+ * The companion currently starts with `DSH_HOME=/workspace/.dataops/dsh`; the fallback
+ * keeps tests and a manually launched host deterministic without reaching outside the
+ * mounted workspace.
+ * @param dshHome - override for tests.
+ * @returns the state directory path.
+ */
+export declare function workspaceUpgradeStatePath(dshHome?: string): string;
+/** Validate a parsed state document. */
+export declare function asWorkspaceUpgradeState(value: unknown): WorkspaceUpgradeState | null;
+/**
+ * Read the pending hand-off record.
+ * @param file - state file path.
+ * @returns the record, or null when none exists or it cannot be parsed.
+ */
+export declare function readWorkspaceUpgradeState(file?: string): Promise<WorkspaceUpgradeState | null>;
+/**
+ * Persist the hand-off record atomically.
+ *
+ * A partially written JSON file would be indistinguishable from "no upgrade pending",
+ * which would silently skip recovery. The temporary file is renamed into place only
+ * after the content is complete.
+ * @param state - record to persist.
+ * @param file - state file path.
+ */
+export declare function writeWorkspaceUpgradeState(state: WorkspaceUpgradeState, file?: string): Promise<void>;
+/**
+ * Remove the hand-off record after recovery has been attempted.
+ * @param file - state file path.
+ */
+export declare function clearWorkspaceUpgradeState(file?: string): Promise<void>;

package/lib/types/workspace-upgrade.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Workspace image upgrade orchestration.
+ *
+ * DataOps owns the Docker image comparison and the container restart. This plugin owns
+ * the two facts DSH alone can know: which sessions are running right now, and how to
+ * bring those sessions back after the container has been recreated. A small JSON file
+ * on the shared workspace volume carries that hand-off across the restart.
+ *
+ * @module workspace-upgrade
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type WorkspaceUpgradeSession, type WorkspaceUpgradeState } from './workspace-upgrade-state.ts';
+/** Configuration needed to talk to DataOps. */
+export interface WorkspaceUpgradeConfig {
+    /** DataOps API origin reachable from the DSH Host. */
+    baseUrl: string;
+    /** Credential reference holding the current DataOps JWT. */
+    credentialRef: string;
+}
+/** The subset of the DataOps restart-preview response this plugin uses. */
+export interface WorkspaceUpgradePreview {
+    imageStatus: 'CURRENT' | 'UPDATE_AVAILABLE' | 'NOT_RUNNING' | 'UNKNOWN';
+    configuredImage: string;
+    activeSessions: WorkspaceUpgradeSession[];
+}
+/** A refusal or transport failure from the DataOps API. */
+export declare class WorkspaceUpgradeError extends Error {
+    /** HTTP status, or 502 when DataOps could not be reached. */
+    readonly status: number;
+    constructor(
+    /** HTTP status, or 502 when DataOps could not be reached. */
+    status: number, message: string);
+}
+/** Owns DataOps preview/restart calls and the DSH session hand-off. */
+export declare class WorkspaceUpgrade {
+    private readonly ctx;
+    private readonly config;
+    readonly statePath: string;
+    constructor(ctx: Context, config: WorkspaceUpgradeConfig, statePath?: string);
+    /** Resolve the injected DSH agents service, if the profile provides one. */
+    private agents;
+    /** Read the current DataOps credential. */
+    private token;
+    /** DataOps origin used by this workspace. */
+    private apiBase;
+    /** Call one DataOps API path with the workspace JWT. */
+    private request;
+    /** Read the DataOps restart preview plus this host's running-session snapshot. */
+    preview(): Promise<WorkspaceUpgradePreview>;
+    /** Snapshot sessions that are executing a turn right now. */
+    private runningSessions;
+    /** Restart DataOps' workspace container; force is required when sessions are snapshot. */
+    private restart;
+    /**
+     * Persist the running-session snapshot and ask DataOps to recreate the container.
+     * @returns the accepted hand-off record.
+     */
+    upgrade(): Promise<WorkspaceUpgradeState>;
+    /**
+     * Resume every snapshotted session and send one "继续".
+     *
+     * The method deliberately does not wait for an answer: the user's workspace should
+     * become usable immediately, and an in-flight tool call cannot be replayed safely.
+     * `recoverWorkspaceUpgradeAfterBoot` removes the hand-off file after this attempt.
+     */
+    recover(): Promise<{
+        recovered: number;
+        skipped: number;
+    }>;
+    /** Remove the hand-off record once recovery has been attempted. */
+    clearRecoveryState(): Promise<void>;
+    /** Find a live session or resume it from persisted state. */
+    private ensureAgent;
+}
+/**
+ * Run recovery after the DSH host and its session persistence have had time to boot.
+ *
+ * `apply()` runs before a persisted session necessarily has its live agent; resuming
+ * eagerly can race that boot. A short bounded retry is enough, and a failed attempt
+ * still removes the hand-off file so the next page load cannot send "继续" forever.
+ * @param upgrade - upgrade service.
+ */
+export declare function recoverWorkspaceUpgradeAfterBoot(upgrade: WorkspaceUpgrade): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sparkelf/dsh-dataops-managed",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "DataOps JWT intake and credential-backed MCP tools for managed DeepSeek Harness workspaces.",
   "type": "module",
   "main": "./lib/index.js",
@@ -40,6 +40,7 @@
     "lib/types/**/*.d.ts",
     "cordis.patch.yml",
     "skills/dataops-query/SKILL.md",
+    "skills/dataops-query/i18n/zh.json",
     "README.md",
     "LICENSE"
   ],

package/skills/dataops-query/i18n/zh.json

@@ -0,0 +1,10 @@
+{
+  "_meta": {
+    "sourceHash": "37ae0b8aeb21d1e6bcc0b4b81d33b56280161fa5",
+    "model": "deepseek-v4.1-flash",
+    "translatedAt": "2026-10-18T03:56:00.000Z"
+  },
+  "title": "智能问数",
+  "description": "用户问数、取数、查数据、要报表时使用。包含选表策略（优先总表；有地域区分时先大后小）、取数前与用户确认资源清单、以及超时时主动分批次。",
+  "summary": "规定从业务系统取数的完整流程：如何挑选数据表与接口、取数前如何与用户确认资源清单、字段不足时如何下探分表，以及查询超时时如何主动分批次执行。"
+}