@sparkelf/dsh-dataops-managed 0.3.20 → 0.3.22

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. package/README.md +8 -0
  2. package/lib/client.js +3996 -267
  3. package/lib/client.js.map +1 -1
  4. package/lib/index.js +2355 -181
  5. package/lib/types/api-docs.d.ts +80 -0
  6. package/lib/types/auth-state.d.ts +50 -0
  7. package/lib/types/client/NotificationBell.d.ts +19 -0
  8. package/lib/types/client/PermissionCenterIcon.d.ts +9 -0
  9. package/lib/types/client/PermissionCenterSection.d.ts +15 -0
  10. package/lib/types/client/ReloginPrompt.d.ts +27 -0
  11. package/lib/types/client/ReviewSettingsCard.d.ts +12 -0
  12. package/lib/types/client/SkillPlazaSection.d.ts +3 -5
  13. package/lib/types/client/WanxiangBrand.d.ts +7 -1
  14. package/lib/types/client/WorkspaceUpgradePrompt.d.ts +21 -0
  15. package/lib/types/client/combobox.d.ts +17 -0
  16. package/lib/types/client/index.d.ts +17 -2
  17. package/lib/types/client/locales.d.ts +109 -6
  18. package/lib/types/client/review-client.d.ts +155 -0
  19. package/lib/types/client/review-demo.d.ts +13 -0
  20. package/lib/types/client/review-notification-store.d.ts +23 -0
  21. package/lib/types/client/review-types.d.ts +114 -0
  22. package/lib/types/client/settings-gate.d.ts +21 -0
  23. package/lib/types/client/skill-plaza-client.d.ts +21 -0
  24. package/lib/types/client/workspace-upgrade-client.d.ts +29 -0
  25. package/lib/types/connector-state.d.ts +51 -0
  26. package/lib/types/index.d.ts +36 -0
  27. package/lib/types/review-api.d.ts +32 -0
  28. package/lib/types/skill-plaza.d.ts +31 -0
  29. package/lib/types/tool-manager.d.ts +81 -0
  30. package/lib/types/tool-output.d.ts +25 -0
  31. package/lib/types/tool-scope.d.ts +156 -0
  32. package/lib/types/tools.d.ts +41 -0
  33. package/lib/types/workspace-upgrade-state.d.ts +66 -0
  34. package/lib/types/workspace-upgrade.d.ts +83 -0
  35. package/package.json +1 -1
package/README.md CHANGED
@@ -16,6 +16,10 @@ DataOps设置中的“应用万相品牌”默认开启，并在本机浏览器
16
16
 
17
17
  本包增加命名空间化DataOps MCP tool schema，但不把JWT写入system prompt、tool参数、结果或session log。认证本身不增加token或改变KV cache。
18
18
 
19
+ ### 工具按权限披露
20
+
21
+ 工作区的DataOps角色决定模型能看到哪些技能/审核工具：插件在JWT变更、首次连接和审核上下文刷新时读取`/api/ai/review/context`，按`skill:*`能力与审核角色注册或注销工具；没有能力的工具不会出现在模型工具列表中。工具执行时不再重复读取角色，DataOps后端仍对每次API调用做最终授权、参数校验、审批与审计。`dataops_api_docs`只向「超级管理员」披露，用于只读检索`/api/openapi.json`。同一份 scope 还会通过`ctx.skills.useViewer`约束技能目录；技能中心的连接器 Tab 读取`/api/dsh-skill-center/connectors`，未授权能力不会出现在目录中。
22
+
19
23
  ### 已知限制
20
24
 
21
25
  - JWT尚未同步或DataOps拒绝当前权限时，MCP client直接呈现对应连接或工具错误。
@@ -36,6 +40,10 @@ The Apply Wanxiang branding setting defaults on and persists in the local browse
36
40
 
37
41
  The package adds namespaced DataOps MCP tool schemas but never places the JWT in the system prompt, tool arguments, results, or Session log. Authentication adds no model tokens and does not affect the KV cache.
38
42
 
43
+ ### Permission-Based Tool Disclosure
44
+
45
+ The workspace's DataOps role decides which skill and review tools the model can see. The plugin reads `/api/ai/review/context` when the JWT changes, on the first connect, and whenever the review-context route refreshes, then registers or disposes tools according to the `skill:*` capabilities and review role. A tool the principal cannot use is never offered. Execution does not re-read the role; DataOps still performs final authorization, parameter validation, approval and audit on every API call. `dataops_api_docs` is disclosed only to 超级管理员 and searches `/api/openapi.json` read-only. The same scope is applied to the skill catalog through `ctx.skills.useViewer`; the skill center's connector tab reads `/api/dsh-skill-center/connectors`, which omits capabilities the account cannot use.
46
+
39
47
  ### Known Limitations
40
48
 
41
49
  - Before JWT synchronization, or when DataOps rejects current permissions, the MCP client exposes the corresponding connection or tool error.