@sparkelf/dsh-dataops-managed 0.3.20 → 0.3.22

package/lib/index.js

@@ -1,9 +1,64 @@
-import { readFile } from "node:fs/promises";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import * as McpClient from "@sparkelf/dsh-plugin-mcp-credentials";
 import { BUNDLED_SKILL_RANK } from "@deepseek-ai/dsh-skill";
 import z from "@deepseek-ai/schemastery";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+//#region src/auth-state.ts
+let state = "unknown";
+const listeners = /* @__PURE__ */ new Set();
+/**
+* Observe every recorded transition.
+*
+* The tool manager uses this to drop its disclosure as soon as any DataOps call reports a 401:
+* the scope that produced the tool list can no longer be trusted, and waiting for another
+* explicit sync would leave tools offered against an ended session. Listener failures are
+* contained so a broken observer cannot turn a credential observation into a failed call.
+* @param listener - Called with the new state after it is recorded.
+* @returns The exact unsubscriber.
+*/
+const onAuthStateChange = (listener) => {
+	listeners.add(listener);
+	return () => {
+		listeners.delete(listener);
+	};
+};
+/** Record one observation and notify observers. */
+const setState = (next) => {
+	state = next;
+	for (const listener of listeners) try {
+		listener(next);
+	} catch {}
+};
+/**
+* Record that a DataOps call was accepted.
+*
+* Called on any non-401 answer, including ones that carry a refusal for another reason: a 403
+* says the session is fine and the permission is not, so it must not raise the sign-in prompt.
+*/
+const noteAccepted = () => {
+	setState("valid");
+};
+/** Record that DataOps refused the credential, which means the session is over. */
+const noteExpired = () => {
+	setState("expired");
+};
+/**
+* Read the current observation.
+*
+* @returns `unknown` before any call has completed, then what the last one said.
+*/
+const currentAuthState = () => state;
+/**
+* Test-only reset, so one case cannot leak its observation into the next.
+*/
+const resetAuthState = () => {
+	setState("unknown");
+};
+//#endregion
 //#region src/model-settings.ts
 /** Profile entry id whose Config holds the model providers. */
 const MODEL_SETTINGS_NAMESPACE = "llm-pi-ai";
@@ -191,7 +246,11 @@ var ModelSync = class {
 			method: "POST",
 			headers: { authorization: `Bearer ${token}` }
 		});
-		if (response.status === 401) return void 0;
+		if (response.status === 401) {
+			noteExpired();
+			return;
+		}
+		noteAccepted();
 		if (!response.ok) throw new Error(`Shared model read failed with HTTP ${String(response.status)}`);
 		const body = asRecord$3(await response.json());
 		if (body === null) return void 0;
@@ -258,7 +317,11 @@ var ModelSync = class {
 		const token = await this.token();
 		if (token === void 0) return null;
 		const response = await fetch(new URL("/api/ai/shared-models/publication", this.apiBase()), { headers: { authorization: `Bearer ${token}` } });
-		if (response.status === 401) return null;
+		if (response.status === 401) {
+			noteExpired();
+			return null;
+		}
+		noteAccepted();
 		if (!response.ok) throw new Error(`Shared model status read failed with HTTP ${String(response.status)}`);
 		const body = asRecord$3(await response.json());
 		return {
@@ -605,7 +668,11 @@ var SkillPlaza = class {
 				...init.headers
 			}
 		});
-		if (response.status === 401) return void 0;
+		if (response.status === 401) {
+			noteExpired();
+			return;
+		}
+		noteAccepted();
 		if (!response.ok) throw new Error(`Skill plaza request failed with HTTP ${String(response.status)}`);
 		return response.status === 204 ? null : await response.json();
 	}
@@ -615,13 +682,30 @@ var SkillPlaza = class {
 	* @returns Entries, newest first; empty when the workspace is not authorized.
 	*/
 	async list(options = {}) {
+		return (await this.listPage(options)).skills;
+	}
+	/** List with the server's tab counts, which the plaza shows without re-counting a page. */
+	async listPage(options = {}) {
 		const params = new URLSearchParams();
 		if (options.tag !== void 0 && options.tag !== "") params.set("tag", options.tag);
 		if (options.query !== void 0 && options.query !== "") params.set("q", options.query);
+		if (options.status !== void 0 && options.status !== "") params.set("status", options.status);
+		if (options.scope !== void 0 && options.scope !== "") params.set("scope", options.scope);
+		if (options.departmentCode !== void 0 && options.departmentCode !== "") params.set("departmentCode", options.departmentCode);
 		const suffix = params.size === 0 ? "" : `?${params.toString()}`;
 		const body = await this.call(`/api/ai/skill-plaza/skills${suffix}`);
-		if (!Array.isArray(body)) return [];
-		return body.flatMap((row) => this.toPlazaSkill(row));
+		const record = asRecord$1(body);
+		const rows = Array.isArray(body) ? body : Array.isArray(record?.items) ? record.items : [];
+		const rawCounts = asRecord$1(record?.counts);
+		return {
+			skills: rows.flatMap((row) => this.toPlazaSkill(row)),
+			...rawCounts === null ? {} : { counts: {
+				pending: Number(rawCounts.pending ?? 0),
+				approved: Number(rawCounts.approved ?? 0),
+				rejected: Number(rawCounts.rejected ?? 0),
+				total: Number(rawCounts.total ?? rows.length)
+			} }
+		};
 	}
 	/**
 	* Every tag in use, so the browser offers existing labels.
@@ -680,201 +764,1759 @@ var SkillPlaza = class {
 			instruction: typeof row.instruction === "string" ? row.instruction : "",
 			tags: Array.isArray(row.tags) ? row.tags.filter((tag) => typeof tag === "string") : [],
 			sharedByMe: row.sharedByMe === true,
-			updatedAt: typeof row.updatedAt === "string" ? row.updatedAt : ""
+			updatedAt: typeof row.updatedAt === "string" ? row.updatedAt : "",
+			reviewStatus: row.reviewStatus === "pending" || row.reviewStatus === "rejected" ? row.reviewStatus : "approved",
+			visibility: row.visibility === "department" || row.visibility === "private" ? row.visibility : "global",
+			departmentCode: typeof row.departmentCode === "string" ? row.departmentCode : null,
+			departmentName: typeof row.departmentName === "string" ? row.departmentName : void 0,
+			departmentPath: Array.isArray(row.departmentPath) ? row.departmentPath.flatMap((entry) => {
+				const node = asRecord$1(entry);
+				return node !== null && typeof node.name === "string" ? [{
+					code: typeof node.code === "string" ? node.code : "",
+					name: node.name
+				}] : [];
+			}) : void 0,
+			ownerName: typeof row.ownerName === "string" ? row.ownerName : void 0,
+			riskReport: row.riskReport ?? null,
+			reviewNote: typeof row.reviewNote === "string" ? row.reviewNote : null,
+			submittedAt: typeof row.submittedAt === "string" ? row.submittedAt : void 0
 		}];
 	}
 };
 //#endregion
-//#region src/workspace-limits.ts
-/** Narrow a value to a plain object. */
-function asRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-}
-/** Narrow a value to a positive integer. */
-function asByteCount(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
-}
-/**
-* A rejection DataOps answered with, carrying its status and message.
-*
-* Without this the caller can only tell that something failed, and a value DataOps refused —
-* which the user can correct — is indistinguishable from a fault in the request path.
-*/
-var WorkspaceLimitsRejection = class extends Error {
-	status;
-	constructor(status, message) {
-		super(message);
-		this.status = status;
-		this.name = "WorkspaceLimitsRejection";
-	}
-};
-/** Read DataOps' own explanation from a failed response, falling back to the status line. */
-async function rejectionMessage(response, fallback) {
-	try {
-		const message = asRecord(await response.json())?.message;
-		if (typeof message === "string" && message.trim() !== "") return message;
-		if (Array.isArray(message) && typeof message[0] === "string") return message[0];
-	} catch {}
-	return `${fallback} with HTTP ${String(response.status)}`;
-}
-/**
-* The workspace limits an administrator sets in DataOps.
-*
-* The plugin holds the DataOps JWT, so the browser cannot read these itself; this class is the
-* only path from the Settings panel to that document.
-*/
-var WorkspaceLimits = class {
+//#region src/review-api.ts
+/** Cookie-free same-origin bridge to the review endpoints. */
+var ReviewApi = class {
 	ctx;
 	config;
 	constructor(ctx, config) {
 		this.ctx = ctx;
 		this.config = config;
 	}
-	/**
-	* Read the DataOps JWT this workspace is currently authorized with.
-	* @returns The token, or undefined when the workspace has no session yet.
-	*/
-	async token() {
-		return (await this.ctx.credentials.resolve(credentialRef(this.config.credentialRef)))?.value;
-	}
-	/** The DataOps API origin this workspace reports to. */
 	apiBase() {
 		return new URL(this.config.baseUrl).origin;
 	}
-	/**
-	* Read the current ceilings.
-	* @returns The status, or undefined when the workspace is not authorized.
-	*/
-	async status() {
-		const token = await this.token();
-		if (token === void 0) return void 0;
-		const response = await fetch(new URL("/api/ai/attachment-settings", this.apiBase()), { headers: { authorization: `Bearer ${token}` } });
-		if (response.status === 401) return void 0;
-		if (!response.ok) throw new WorkspaceLimitsRejection(response.status, await rejectionMessage(response, "Workspace limits read failed"));
-		const body = asRecord(await response.json());
-		const settings = body === null ? null : asRecord(body.settings);
-		const size = settings === null ? null : asRecord(settings.workspaceSize);
-		const fileReadMaxBytes = size === null ? null : asByteCount(size.fileReadMaxBytes);
-		const uploadMaxBytes = size === null ? null : asByteCount(size.uploadMaxBytes);
-		if (fileReadMaxBytes === null || uploadMaxBytes === null) throw new Error("Workspace limits read returned an unrecognized document");
-		return {
-			limits: {
-				fileReadMaxBytes,
-				uploadMaxBytes
-			},
-			canWrite: true,
-			readOnlyReason: null
-		};
+	async token() {
+		return (await this.ctx.credentials.resolve(credentialRef(this.config.credentialRef)))?.value;
 	}
 	/**
-	* Write new ceilings.
-	* @param limits - The ceilings to store.
-	* @returns The stored status.
+	* Call one DataOps endpoint with the workspace JWT.
+	* @param path - API path below the DataOps origin.
+	* @param init - Method, body and extra headers.
+	* @returns The upstream status and parsed body; 503 when this workspace has no session.
 	*/
-	async save(limits) {
+	async request(path, init = {}) {
 		const token = await this.token();
-		if (token === void 0) return void 0;
-		const response = await fetch(new URL("/api/ai/attachment-settings", this.apiBase()), {
-			method: "PATCH",
+		if (token === void 0) return {
+			status: 503,
+			body: { error: "DataOps is not connected" }
+		};
+		const response = await fetch(new URL(path, this.apiBase()), {
+			...init,
 			headers: {
 				authorization: `Bearer ${token}`,
-				"content-type": "application/json"
-			},
-			body: JSON.stringify({ workspaceSize: limits })
+				...init.body === void 0 ? {} : { "content-type": "application/json" },
+				...init.headers
+			}
 		});
-		if (response.status === 401) return void 0;
-		if (!response.ok) throw new WorkspaceLimitsRejection(response.status, await rejectionMessage(response, "Workspace limits write failed"));
-		return this.status();
+		if (response.status === 401) {
+			noteExpired();
+			return {
+				status: 401,
+				body: { error: "DataOps session expired" }
+			};
+		}
+		noteAccepted();
+		const text = await response.text();
+		let body = null;
+		if (text !== "") try {
+			body = JSON.parse(text);
+		} catch {
+			body = { error: text };
+		}
+		return {
+			status: response.status,
+			body
+		};
 	}
 };
-/** The live instance, so the Settings route can act on it after activation. */
-let limitsRef;
-/** @param next - Instance to publish, or undefined to clear. */
-function setWorkspaceLimits(next) {
-	limitsRef = next;
+//#endregion
+//#region src/tool-scope.ts
+/**
+* Tool-to-capability disclosure map.
+*
+* `review_notifications_list/read` intentionally carry no policy: every authenticated principal
+* owns their own notification inbox. `dataops_api_docs` is gated by the role itself because the
+* backend grants the OpenAPI reader to 超级管理员 by default; an administrator who happens to hold
+* `developer:openapi:read` is still outside that role and does not receive the tool.
+*/
+const AI_TOOL_ACCESS = {
+	skill_list: { permission: "skill:read" },
+	skill_get: { permission: "skill:read" },
+	skill_submit: { permission: "skill:submit" },
+	skill_install: { permission: "skill:install" },
+	skill_uninstall: { permission: "skill:install" },
+	skill_enable: { permission: "skill:manage" },
+	skill_disable: { permission: "skill:manage" },
+	skill_unshare: { permission: "skill:manage" },
+	skill_delete: { permission: "skill:manage" },
+	review_scan: {
+		permission: "skill:read",
+		reviewer: true
+	},
+	review_decide: {
+		permission: "skill:review:decide",
+		reviewer: true
+	},
+	review_notifications_list: {},
+	review_notifications_read: {},
+	dataops_api_docs: { superAdminOnly: true }
+};
+/** Every managed tool name, in the order the manager considers them. */
+const AI_TOOL_NAMES = Object.keys(AI_TOOL_ACCESS);
+/**
+* Backend permission aliases.
+*
+* The DataOps role matrix stores the capability family as `skill:capability:*`; this task's
+* disclosure contract names them `skill:*`. Accepting both keeps the plugin working against
+* either spelling without asking the backend to rename a published key.
+*/
+const PERMISSION_ALIASES = {
+	"skill:read": ["skill:read", "skill:capability:read"],
+	"skill:submit": ["skill:submit", "skill:capability:submit"],
+	"skill:install": ["skill:install", "skill:capability:install"],
+	"skill:manage": ["skill:manage", "skill:capability:manage"],
+	"skill:review:decide": ["skill:review:decide"]
+};
+const SUPER_ADMIN = "超级管理员";
+const ADMIN = "管理员";
+const DEPARTMENT_ADMIN = "部门管理员";
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const strings$1 = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : void 0;
+const roleSet = (scope) => new Set(scope.roleCodes ?? []);
+/** Whether the context carries the stable super-administrator role. */
+const isSuperAdmin = (scope) => roleSet(scope).has(SUPER_ADMIN) || scope.primaryRole === SUPER_ADMIN || (scope.systemKeys ?? []).includes("SUPER_ADMIN");
+/** Whether the context carries an administrator or super-administrator role. */
+const isAdmin = (scope) => isSuperAdmin(scope) || roleSet(scope).has(ADMIN) || scope.primaryRole === ADMIN || (scope.systemKeys ?? []).includes("ADMIN");
+/** Whether the context carries a department-administrator role. */
+const isDepartmentAdmin = (scope) => roleSet(scope).has(DEPARTMENT_ADMIN) || scope.primaryRole === DEPARTMENT_ADMIN || (scope.systemKeys ?? []).includes("DEPT_ADMIN");
+/**
+* Whether the caller may run review operations.
+*
+* The current backend returns `canReview` at the top level; the nested `review` shape is
+* accepted for older contexts. Role membership is a fallback, not an override.
+*/
+const canReview = (scope) => scope.canReview === true || scope.review?.canReview === true || isAdmin(scope) || isDepartmentAdmin(scope);
+/** The effective permission list, or `undefined` for a context that predates permission keys. */
+const permissionList = (scope) => scope.permissions ?? scope.permissionKeys;
+/**
+* Whether the caller holds one capability.
+*
+* A context that carries a permission list is authoritative. Before the list existed, the
+* four-role fallback kept the old behavior; it is only used when neither spelling is present.
+*/
+const hasPermission = (scope, key) => {
+	const permissions = permissionList(scope);
+	if (permissions !== void 0) {
+		const set = new Set(permissions);
+		return (PERMISSION_ALIASES[key] ?? [key]).some((alias) => set.has(alias));
+	}
+	if (isAdmin(scope)) return true;
+	if (isDepartmentAdmin(scope)) return key !== "skill:review:global";
+	if (roleSet(scope).size === 0) return false;
+	return key === "skill:read" || key === "skill:install" || key === "skill:submit";
+};
+/**
+* Whether one tool should be registered for this scope.
+*
+* Every check is disclosure metadata, not an execution gate: a visible tool still lets DataOps
+* answer with 403 when the underlying grant changed between a scope sync and the call.
+*/
+function isToolVisible(name, scope) {
+	const policy = AI_TOOL_ACCESS[name];
+	if (policy.superAdminOnly === true && !isSuperAdmin(scope)) return false;
+	if (policy.reviewer === true && !canReview(scope)) return false;
+	if (policy.permission !== void 0 && !hasPermission(scope, policy.permission)) return false;
+	return true;
 }
-/** @returns The live workspace-limits instance, when the plugin activated. */
-function currentWorkspaceLimits() {
-	return limitsRef;
+/**
+* Validate one `/api/ai/review/context` body.
+*
+* A body without `roleCodes` is not a usable scope: treating it as "no roles" would let the
+* role-name fallback hand an ordinary capability set to an answer this plugin cannot interpret.
+* @param body - Parsed JSON from the context endpoint.
+* @returns The normalized scope, or undefined when the answer is not a context document.
+*/
+function normalizeScope(body) {
+	if (!isRecord$1(body)) return void 0;
+	const roleCodes = strings$1(body.roleCodes);
+	if (roleCodes === void 0) return void 0;
+	const roleSystemKeys = (Array.isArray(body.roles) ? body.roles : []).flatMap((entry) => {
+		if (!isRecord$1(entry)) return [];
+		return typeof entry.systemKey === "string" ? [entry.systemKey] : [];
+	});
+	const explicitSystemKeys = strings$1(body.systemKeys) ?? [];
+	const systemKeys = Array.from(/* @__PURE__ */ new Set([...explicitSystemKeys, ...roleSystemKeys]));
+	const permissions = strings$1(body.permissions) ?? (Array.isArray(body.permissionKeys) ? strings$1(body.permissionKeys) : void 0);
+	const review = isRecord$1(body.review) ? {
+		...typeof body.review.canReview === "boolean" ? { canReview: body.review.canReview } : {},
+		...typeof body.review.canReviewGlobal === "boolean" ? { canReviewGlobal: body.review.canReviewGlobal } : {},
+		...typeof body.review.canManagePermissions === "boolean" ? { canManagePermissions: body.review.canManagePermissions } : {}
+	} : void 0;
+	return {
+		...typeof body.userId === "string" ? { userId: body.userId } : {},
+		...typeof body.username === "string" ? { username: body.username } : {},
+		roleCodes,
+		...typeof body.primaryRole === "string" ? { primaryRole: body.primaryRole } : {},
+		...systemKeys.length === 0 ? {} : { systemKeys },
+		...typeof body.departmentCode === "string" || body.departmentCode === null ? { departmentCode: body.departmentCode } : {},
+		...permissions === void 0 ? {} : { permissions },
+		...isRecord$1(body.dataScope) ? { dataScope: body.dataScope } : {},
+		...review === void 0 ? {} : { review },
+		...typeof body.canReview === "boolean" ? { canReview: body.canReview } : {},
+		...typeof body.canReviewGlobal === "boolean" ? { canReviewGlobal: body.canReviewGlobal } : {}
+	};
 }
 //#endregion
-//#region src/index.ts
-/** Cordis plugin name for the DataOps-managed integration. */
-const name = "dataops-managed";
-/** Host services required by managed JWT and MCP ownership. */
-const inject = [
-	"credentials",
-	"webServer",
-	"tools",
-	"settings",
-	"skills"
+//#region src/api-docs.ts
+/** Raised when the upstream body is not an OpenAPI document this module can search. */
+var ApiDocsUnavailableError = class extends Error {};
+/** HTTP methods a path item may declare, in a stable presentation order. */
+const HTTP_METHODS = [
+	"get",
+	"post",
+	"put",
+	"patch",
+	"delete",
+	"head",
+	"options",
+	"trace"
 ];
-const MANAGED_AUTH_PATH = "/integrations/dataops/managed-auth";
-/** This plugin's profile entry id, which owns its Config and sync state. */
-const MANAGED_PLUGIN_ID = "dataops-managed";
-/** Same-origin route the workspace settings pages use to read and change model sharing. */
-const MODEL_SYNC_PATH = "/integrations/dataops/model-sync";
-/** Same-origin route the skill center uses to read and change plaza sharing. */
-const SKILL_PLAZA_PATH = "/integrations/dataops/skill-plaza";
-/** Same-origin route the Settings panel uses to read and change this workspace's limits. */
-const WORKSPACE_LIMITS_PATH = "/integrations/dataops/workspace-limits";
-/** Same-origin route the Settings panel uses to read and change the tool-call timeout. */
-const TOOL_TIMEOUT_PATH = "/integrations/dataops/tool-timeout";
-/** The ends a tool-call timeout may take, in whole seconds. */
-const TOOL_TIMEOUT_MIN_SECONDS = 1;
-const TOOL_TIMEOUT_MAX_SECONDS = 3600;
-/** The live sync instance, so the settings routes can act on it after activation. */
-let modelSyncRef;
-/** The live plaza instance, so the skill center routes can act on it after activation. */
-let skillPlazaRef;
-/** The live skill plaza, once this plugin activated. */
-function currentSkillPlaza() {
-	return skillPlazaRef;
+/** Cap on returned operations, so one broad query cannot flood a model turn. */
+const MAX_RESULTS = 50;
+/** Cap on projected schema properties. */
+const MAX_PROPERTIES = 25;
+/** Cap on projected parameters. */
+const MAX_PARAMETERS = 25;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const strings = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : void 0;
+const normalized = (value) => (value ?? "").trim().toLowerCase();
+/** Split a query into whitespace-separated keywords; an empty query matches everything. */
+const keywords = (query) => normalized(query).split(/\s+/u).filter((token) => token !== "");
+/** Resolve one local JSON pointer such as `#/components/schemas/ReviewQuery`. */
+function resolvePointer(document, ref) {
+	if (!ref.startsWith("#/")) return void 0;
+	let current = document;
+	for (const raw of ref.slice(2).split("/")) {
+		if (!isRecord(current)) return void 0;
+		const key = decodeURIComponent(raw).replace(/~1/gu, "/").replace(/~0/gu, "~");
+		current = current[key];
+	}
+	return current;
 }
-/** The live model-sync instance, once this plugin activated. */
-function currentModelSync() {
-	return modelSyncRef;
+/** Resolve one `$ref` object one level, leaving a non-reference value unchanged. */
+function dereference(value, document, depth = 0) {
+	if (!isRecord(value) || typeof value.$ref !== "string" || depth >= 4) return value;
+	return dereference(resolvePointer(document, value.$ref), document, depth + 1);
 }
-/** The live settings-sync instance, once this plugin activated. */
-let settingsSyncRef;
-/** @returns The live instance, or undefined before this plugin activated. */
-function currentSettingsSync() {
-	return settingsSyncRef;
+/** The final segment of a local reference, used as a stable type label. */
+function refName(ref) {
+	const segment = ref.split("/").pop() ?? ref;
+	return decodeURIComponent(segment).replace(/~1/gu, "/").replace(/~0/gu, "~");
+}
+/** A short type label for one schema, resolving one local reference chain when useful. */
+function schemaType(schema, document, depth = 0) {
+	const resolved = dereference(schema, document, depth);
+	if (!isRecord(resolved)) return "unknown";
+	if (typeof resolved.type === "string") {
+		if (resolved.type === "array" && isRecord(resolved.items)) return schemaType(resolved.items, document, depth + 1) + "[]";
+		return resolved.type;
+	}
+	if (isRecord(resolved.properties)) return "object";
+	if (resolved.items !== void 0) return "array";
+	if (typeof resolved.$ref === "string") return refName(resolved.$ref);
+	return "unknown";
+}
+/** Project one schema into a bounded summary without following cycles forever. */
+function summarizeSchema(schema, document, depth = 0) {
+	if (!isRecord(schema)) return null;
+	const ref = typeof schema.$ref === "string" ? refName(schema.$ref) : void 0;
+	const resolved = dereference(schema, document, depth);
+	if (!isRecord(resolved)) return ref === void 0 ? null : { ref };
+	const required = strings(resolved.required) ?? [];
+	const requiredSet = new Set(required);
+	const properties = isRecord(resolved.properties) ? Object.entries(resolved.properties).slice(0, MAX_PROPERTIES).map(([name, property]) => ({
+		name,
+		type: schemaType(property, document, depth + 1),
+		required: requiredSet.has(name)
+	})) : void 0;
+	const type = typeof resolved.type === "string" ? resolved.type : isRecord(resolved.properties) ? "object" : resolved.items === void 0 ? void 0 : "array";
+	return {
+		...type === void 0 ? {} : { type },
+		...ref === void 0 ? {} : { ref },
+		...required.length === 0 ? {} : { required },
+		...properties === void 0 ? {} : { properties }
+	};
+}
+/** Merge path-level and operation-level parameters; the operation wins on name+location. */
+function summarizeParameters(pathItem, operation, document) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const source of [pathItem.parameters, operation.parameters]) {
+		if (!Array.isArray(source)) continue;
+		for (const raw of source) {
+			const parameter = dereference(raw, document);
+			if (!isRecord(parameter)) continue;
+			if (typeof parameter.name !== "string" || typeof parameter.in !== "string") continue;
+			const schema = parameter.schema !== void 0 ? parameter.schema : parameter;
+			merged.set(parameter.in + ":" + parameter.name, {
+				name: parameter.name,
+				in: parameter.in,
+				required: parameter.required === true,
+				type: schemaType(schema, document)
+			});
+		}
+	}
+	return [...merged.values()].slice(0, MAX_PARAMETERS);
+}
+/** Describe the request body's chosen media type and bounded schema fields. */
+function summarizeRequestBody(operation, document) {
+	const body = dereference(operation.requestBody, document);
+	if (!isRecord(body) || !isRecord(body.content)) return null;
+	const contentTypes = Object.keys(body.content);
+	if (contentTypes.length === 0) return null;
+	const preferred = contentTypes.includes("application/json") ? "application/json" : contentTypes[0];
+	const media = body.content[preferred];
+	const schema = isRecord(media) ? summarizeSchema(media.schema, document) : null;
+	return {
+		required: body.required === true,
+		contentTypes,
+		schema
+	};
+}
+/** The security requirement list that applies to one operation. */
+function summarizeSecurity(operation, document) {
+	return (Array.isArray(operation.security) ? operation.security : Array.isArray(document.security) ? document.security : []).filter(isRecord);
+}
+/** Read one operation into its compact projection. */
+function compactOperation(method, path, pathItem, operation, document) {
+	return {
+		method: method.toUpperCase(),
+		path,
+		operationId: typeof operation.operationId === "string" ? operation.operationId : null,
+		summary: typeof operation.summary === "string" ? operation.summary : null,
+		tags: strings(operation.tags) ?? [],
+		parameters: summarizeParameters(pathItem, operation, document),
+		requestBody: summarizeRequestBody(operation, document),
+		security: summarizeSecurity(operation, document)
+	};
+}
+/** Whether one operation passes every supplied filter. */
+function matches(operation, filters, tokens) {
+	if (filters.tag !== "" && !operation.tags.some((tag) => tag.toLowerCase() === filters.tag)) return false;
+	if (filters.path !== "" && !operation.path.toLowerCase().includes(filters.path)) return false;
+	if (filters.operationId !== "" && !(operation.operationId ?? "").toLowerCase().includes(filters.operationId)) return false;
+	if (filters.method !== "" && operation.method !== filters.method) return false;
+	if (tokens.length === 0) return true;
+	const haystack = [
+		operation.path,
+		operation.operationId ?? "",
+		operation.summary ?? "",
+		operation.description,
+		operation.tags.join(" ")
+	].join(" ").toLowerCase();
+	return tokens.every((token) => haystack.includes(token));
+}
+/** Relevance used only to order matches; equal scores keep the document order. */
+function scoreOf(operation, tokens) {
+	if (tokens.length === 0) return 0;
+	let score = 0;
+	const operationId = (operation.operationId ?? "").toLowerCase();
+	const path = operation.path.toLowerCase();
+	const summary = (operation.summary ?? "").toLowerCase();
+	const tags = operation.tags.map((tag) => tag.toLowerCase());
+	const description = operation.description.toLowerCase();
+	for (const token of tokens) {
+		if (operationId === token) score += 5;
+		else if (operationId.includes(token)) score += 3;
+		if (path.includes(token)) score += 2;
+		if (summary.includes(token)) score += 1;
+		if (tags.some((tag) => tag.includes(token))) score += 1;
+		if (description.includes(token)) score += 2;
+	}
+	return score;
 }
 /**
-* Read the value behind a possibly-volatile field.
-*
-* A volatile field always arrives as a reference, but the plain shape is accepted too so a
-* caller that validated the config without a settings service still reads its value.
-* @param field - The config field as the runtime supplied it.
-* @param fallback - Value to use when nothing is stored yet.
-* @returns The current value.
+* Search one parsed OpenAPI document.
+* @param document - Parsed `/api/openapi.json` body.
+* @param filters - Keyword, tag, path, operationId and method filters.
+* @returns Matching operations, bounded and ordered by relevance.
+* @throws ApiDocsUnavailableError when the document has no searchable `paths` object.
 */
-function volatileValue(field, fallback) {
-	if (field === void 0) return fallback;
-	if (typeof field === "object" && field !== null && "get" in field && typeof field.get === "function") return field.get() ?? fallback;
-	return field;
+function searchOpenApiDocument(document, filters = {}) {
+	if (!isRecord(document)) throw new ApiDocsUnavailableError("DataOps API docs are unavailable: the response is not an OpenAPI document");
+	if (!isRecord(document.paths)) throw new ApiDocsUnavailableError("DataOps API docs are unavailable: the document has no paths object");
+	const wanted = {
+		tag: normalized(filters.tag),
+		path: normalized(filters.path),
+		operationId: normalized(filters.operation_id),
+		method: normalized(filters.method)
+	};
+	const tokens = keywords(filters.query);
+	const matched = [];
+	let index = 0;
+	for (const [path, rawPathItem] of Object.entries(document.paths)) {
+		const pathItem = dereference(rawPathItem, document);
+		if (!isRecord(pathItem)) continue;
+		for (const method of HTTP_METHODS) {
+			const operation = pathItem[method];
+			if (!isRecord(operation)) continue;
+			const candidate = {
+				method,
+				path,
+				operationId: typeof operation.operationId === "string" ? operation.operationId : null,
+				summary: typeof operation.summary === "string" ? operation.summary : null,
+				tags: strings(operation.tags) ?? [],
+				description: typeof operation.description === "string" ? operation.description : "",
+				pathItem,
+				operation,
+				index
+			};
+			index += 1;
+			if (!matches(candidate, wanted, tokens)) continue;
+			matched.push({
+				operation: candidate,
+				score: scoreOf(candidate, tokens)
+			});
+		}
+	}
+	matched.sort((left, right) => right.score - left.score || left.operation.index - right.operation.index);
+	const results = matched.slice(0, MAX_RESULTS).map(({ operation }) => compactOperation(operation.method, operation.path, operation.pathItem, operation.operation, document));
+	const info = isRecord(document.info) ? document.info : {};
+	return {
+		title: typeof info.title === "string" ? info.title : null,
+		version: typeof info.version === "string" ? info.version : null,
+		openapi: typeof document.openapi === "string" ? document.openapi : typeof document.swagger === "string" ? "swagger " + document.swagger : null,
+		total: matched.length,
+		returned: results.length,
+		truncated: matched.length > results.length,
+		results
+	};
+}
+//#endregion
+//#region src/tool-output.ts
+/** An open object schema: tools declare their canonical shape in code and docs. */
+const OPEN_OBJECT_SCHEMA = {
+	type: "object",
+	additionalProperties: true
+};
+/** Render one canonical value as pretty JSON text. */
+const renderJson = (_args, value) => [{
+	type: "text",
+	text: JSON.stringify(value, null, 2)
+}];
+//#endregion
+//#region src/tools.ts
+/** Parse one plaza response body into rows without trusting its shape. */
+function rowsOf(body) {
+	if (Array.isArray(body)) return body.filter((row) => typeof row === "object" && row !== null);
+	if (typeof body === "object" && body !== null && Array.isArray(body.skills)) return body.skills.filter((row) => typeof row === "object" && row !== null);
+	return [];
 }
+const forbidden = (message) => /* @__PURE__ */ new Error("Forbidden (403): " + message);
 /**
-* Per-tool-call timeout a workspace starts with.
+* Build every managed tool definition.
 *
-* Named rather than inlined so the schema default and the read fallback cannot drift: the field is
-* volatile, so a workspace that never changed it reads no value at all and both places have to
-* answer the same number.
+* The definitions are built once; `readScope` is a live getter so a tool that survives a role
+* change reports the scope the manager currently holds instead of the one it was registered
+* with. An undefined scope can only be observed by an in-flight call during disposal, where the
+* safe behavior is to show only the public catalogue.
+* @param ctx - Host context used for local skills, approval and audit.
+* @param reviewApi - Same-origin bridge holding the workspace JWT.
+* @param readScope - Live accessor for the manager's current scope.
+* @returns One definition per managed tool name.
 */
-const DEFAULT_TOOL_CALL_TIMEOUT_MS = 3e5;
-/** Default sync state before this workspace stored anything. */
-const MODEL_SYNC_DEFAULT = {
-	detached: false,
-	adoptedModelIds: [],
-	privateModelIds: []
-};
-/** Schemastery parser for managed DataOps configuration. */
-const Config = z.object({
-	baseUrl: z.string().default("http://host.docker.internal:3101"),
-	serverName: z.string().default("dataops"),
-	credentialRef: z.string().role("credential-ref").default("DATAOPS_ACCESS_TOKEN"),
-	/**
+function buildAiManagementTools(ctx, reviewApi, readScope) {
+	const approve = async (tool, exec, reason) => {
+		if (exec.agent === void 0) throw new Error(tool + " requires an initiating agent");
+		const outcome = await ctx.approval.request({
+			agent: exec.agent,
+			toolName: tool,
+			callId: exec.callId,
+			signal: exec.signal,
+			reason
+		});
+		if (outcome !== "allowed-once") throw new Error(tool + " approval was " + outcome);
+	};
+	const audit = (tool, exec, detail) => {
+		try {
+			const agent = exec.agent;
+			ctx.logger.info("[audit] " + tool + " " + JSON.stringify({
+				sessionId: agent?.session?.id ?? null,
+				callId: exec.callId,
+				...detail
+			}));
+		} catch {}
+	};
+	const call = async (path, init = {}) => {
+		const result = await reviewApi.request(path, init);
+		if (result.status === 401) throw new Error("Unauthorized (401): DataOps session expired");
+		const detail = result.body;
+		const reason = typeof detail?.error === "string" ? detail.error : typeof detail?.message === "string" ? detail.message : "";
+		if (result.status === 403) throw forbidden(reason || "the current role may not perform this action");
+		if (result.status === 409) throw new Error("Conflict (409): " + (reason || "the skill still has installations"));
+		if (result.status < 200 || result.status >= 300) throw new Error("DataOps " + path + " failed: HTTP " + result.status.toString() + (reason ? ": " + reason : ""));
+		return result.body;
+	};
+	const listSkills = async (scope, includeLocal) => {
+		const mine = rowsOf(await call("/api/ai/skill-plaza/skills?scope=mine"));
+		const publicRows = rowsOf(await call("/api/ai/skill-plaza/skills"));
+		const admin = isAdmin(scope) ? rowsOf(await call("/api/ai/skill-plaza/admin/skills")) : [];
+		const byId = /* @__PURE__ */ new Map();
+		for (const row of [
+			...mine,
+			...publicRows,
+			...admin
+		]) if (typeof row.id === "number") byId.set(row.id, {
+			...byId.get(row.id),
+			...row
+		});
+		const rows = [...byId.values()];
+		return {
+			catalog: {
+				local: includeLocal ? (await readLocalSkills(ctx)).map((skill) => ({
+					name: skill.name,
+					description: skill.description ?? null,
+					source: "local"
+				})) : [],
+				pending: rows.filter((row) => row.reviewStatus === "pending"),
+				approved: rows.filter((row) => row.reviewStatus === "approved"),
+				rejected: rows.filter((row) => row.reviewStatus === "rejected")
+			},
+			canReview: canReview(scope),
+			isAdmin: isAdmin(scope),
+			isDepartmentAdmin: isDepartmentAdmin(scope),
+			departmentCode: scope.departmentCode ?? null,
+			skills: rows
+		};
+	};
+	/**
+	* Build the enable/disable pair.
+	*
+	* The two tools share one body so their approval reason, audit detail and endpoint stay in
+	* step; only the verb and the boolean they send differ.
+	*/
+	function defineSkillStatusTool(enabled) {
+		const name = enabled ? "skill_enable" : "skill_disable";
+		return defineTool({
+			name,
+			description: (enabled ? "Enable" : "Disable") + " one plaza skill for distribution. Administrator only. Requires user approval; audited.",
+			parameters: { skill_id: {
+				type: "number",
+				required: true,
+				description: "Plaza skill id."
+			} },
+			output: {
+				schema: OPEN_OBJECT_SCHEMA,
+				render: renderJson
+			},
+			execute: async (args, exec) => {
+				await approve(name, exec, (enabled ? "Enable" : "Disable") + " skill " + args.skill_id.toString());
+				await call("/api/ai/skill-plaza/admin/skills/" + args.skill_id.toString() + "/status", {
+					method: "PATCH",
+					body: JSON.stringify({ enabled })
+				});
+				audit(name, exec, {
+					skillId: args.skill_id,
+					enabled
+				});
+				return {
+					skillId: args.skill_id,
+					enabled
+				};
+			}
+		});
+	}
+	return [
+		{
+			name: "skill_list",
+			definition: defineTool({
+				name: "skill_list",
+				description: "List skills in the DataOps skill centre: local workspace skills plus the caller's pending/rejected submissions and the approved plaza entries they may install. Scope follows the caller role (department admins see their department; ordinary users see their own and approved entries). Read-only.",
+				parameters: { include_local: {
+					type: "boolean",
+					description: "Include local workspace skills (default true)."
+				} },
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args) => {
+					return await listSkills(readScope() ?? {}, args.include_local !== false);
+				}
+			})
+		},
+		{
+			name: "skill_get",
+			definition: defineTool({
+				name: "skill_get",
+				description: "Read one skill-centre entry by id: description, instruction, review status, review note, risk report and visibility. Only entries visible to the caller can be read.",
+				parameters: { skill_id: {
+					type: "number",
+					required: true,
+					description: "Skill/plaza id from skill_list."
+				} },
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args) => {
+					const found = (await listSkills(readScope() ?? {}, false)).skills.find((row) => row.id === args.skill_id);
+					if (found === void 0) throw new Error("Skill not found or not visible: " + args.skill_id.toString());
+					return found;
+				}
+			})
+		},
+		{
+			name: "skill_submit",
+			definition: defineTool({
+				name: "skill_submit",
+				description: "Submit the caller's own skill for plaza review. When the workspace review switch is off DataOps approves immediately; otherwise the entry becomes pending. Requires user approval; audited.",
+				parameters: { skill_id: {
+					type: "number",
+					required: true,
+					description: "Own skill/plaza id."
+				} },
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					await approve("skill_submit", exec, "Submit skill " + args.skill_id.toString() + " for review");
+					const value = await call("/api/ai/skill-plaza/skills/" + args.skill_id.toString() + "/submit", {
+						method: "POST",
+						body: "{}"
+					});
+					audit("skill_submit", exec, { skillId: args.skill_id });
+					return value;
+				}
+			})
+		},
+		{
+			name: "skill_install",
+			definition: defineTool({
+				name: "skill_install",
+				description: "Install one approved, visible plaza skill into the caller's workspace. Requires user approval; audited. The secret-free result reports the local skill key.",
+				parameters: { skill_id: {
+					type: "number",
+					required: true,
+					description: "Plaza skill id."
+				} },
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					await approve("skill_install", exec, "Install skill " + args.skill_id.toString());
+					const value = await call("/api/ai/skill-plaza/install", {
+						method: "POST",
+						body: JSON.stringify({ skillId: args.skill_id })
+					});
+					audit("skill_install", exec, { skillId: args.skill_id });
+					return value;
+				}
+			})
+		},
+		{
+			name: "skill_uninstall",
+			definition: defineTool({
+				name: "skill_uninstall",
+				description: "Uninstall one skill from the caller's own workspace only: deletes the current user's installation record. The plaza entry, its review status, visibility and enabled flag are unchanged and no “unpublished” notification is sent. Requires user approval; audited.",
+				parameters: { skill_id: {
+					type: "number",
+					required: true,
+					description: "Plaza skill id."
+				} },
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					await approve("skill_uninstall", exec, "Uninstall skill " + args.skill_id.toString() + " from the current workspace");
+					const result = await call("/api/ai/skill-plaza/skills/" + args.skill_id.toString() + "/install", { method: "DELETE" });
+					audit("skill_uninstall", exec, {
+						skillId: args.skill_id,
+						scope: "installation-only",
+						removed: result.removed ?? null
+					});
+					return {
+						uninstalled: result.uninstalled === true,
+						removed: typeof result.removed === "number" ? result.removed : 0
+					};
+				}
+			})
+		},
+		{
+			name: "skill_enable",
+			definition: defineSkillStatusTool(true)
+		},
+		{
+			name: "skill_disable",
+			definition: defineSkillStatusTool(false)
+		},
+		{
+			name: "skill_unshare",
+			definition: defineTool({
+				name: "skill_unshare",
+				description: "Stop sharing one plaza skill (soft unpublish): the entry and its installations remain, review status/visibility are kept, and DataOps sends an “unpublished” notification. Owners may unshare their own entries; 超级管理员/管理员 any entry; 部门管理员 their department. Requires user approval; audited.",
+				parameters: { skill_id: {
+					type: "number",
+					required: true,
+					description: "Plaza skill id."
+				} },
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					await approve("skill_unshare", exec, "Unshare skill " + args.skill_id.toString());
+					await call("/api/ai/skill-plaza/skills/" + args.skill_id.toString(), { method: "DELETE" });
+					audit("skill_unshare", exec, {
+						skillId: args.skill_id,
+						effect: "soft-unpublish"
+					});
+					return {
+						unshared: args.skill_id,
+						effect: "plaza-sharing-disabled"
+					};
+				}
+			})
+		},
+		{
+			name: "skill_delete",
+			definition: defineTool({
+				name: "skill_delete",
+				description: "Permanently delete one plaza skill. This is not unshare: the record is removed, DataOps sends a “deleted” notification (not “unpublished”), and the audit entry records the permanent action. Requires confirm=true as a second confirmation; owners may delete their own entries, 超级管理员/管理员 any entry, 部门管理员 their department. If installations still exist the backend returns 409 and the error is passed through. Requires user approval; audited.",
+				parameters: {
+					skill_id: {
+						type: "number",
+						required: true,
+						description: "Plaza skill id."
+					},
+					confirm: {
+						type: "boolean",
+						required: true,
+						description: "Must be true: explicitly confirms permanent deletion."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					if (args.confirm !== true) throw new Error("skill_delete requires confirm=true (permanent deletion)");
+					await approve("skill_delete", exec, "Permanently delete skill " + args.skill_id.toString());
+					await call("/api/ai/skill-plaza/skills/" + args.skill_id.toString() + "/permanent", { method: "DELETE" });
+					audit("skill_delete", exec, {
+						skillId: args.skill_id,
+						permanent: true
+					});
+					return {
+						deleted: args.skill_id,
+						permanent: true
+					};
+				}
+			})
+		},
+		{
+			name: "review_scan",
+			definition: defineTool({
+				name: "review_scan",
+				description: "Run the DataOps AI risk scan for skill and/or workflow ids. Reviewers only; the tool is disclosed to principals with review capability and skill read access, and DataOps still enforces the permission on every call. Read-only.",
+				parameters: {
+					skills: {
+						type: "array",
+						items: { type: "number" },
+						description: "Skill ids to scan."
+					},
+					workflows: {
+						type: "array",
+						items: { type: "string" },
+						description: "Workflow ids to scan."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args) => {
+					return await call("/api/ai/review/scan", {
+						method: "POST",
+						body: JSON.stringify({
+							skills: args.skills ?? [],
+							workflows: args.workflows ?? []
+						})
+					});
+				}
+			})
+		},
+		{
+			name: "review_decide",
+			definition: defineTool({
+				name: "review_decide",
+				description: "Approve or reject skills/workflows. Requires authorization.confirmed=true (the administrator explicitly confirmed), a reviewer role, resource scope and the review-decide capability; DataOps enforces all of them on the call. Requires a second user approval at tool level and writes an audit entry.",
+				parameters: {
+					skills: {
+						type: "array",
+						items: { type: "number" },
+						description: "Skill ids."
+					},
+					workflows: {
+						type: "array",
+						items: { type: "string" },
+						description: "Workflow ids."
+					},
+					decision: {
+						type: "string",
+						required: true,
+						description: "approve or reject."
+					},
+					note: {
+						type: "string",
+						description: "Review note (max 2000 chars)."
+					},
+					confirmed: {
+						type: "boolean",
+						required: true,
+						description: "Must be true: the administrator confirmed this decision."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					if (args.confirmed !== true) throw new Error("authorization.confirmed=true is required for review_decide");
+					if (args.decision !== "approve" && args.decision !== "reject") throw new Error("decision must be approve or reject");
+					if ((args.skills ?? []).length === 0 && (args.workflows ?? []).length === 0) throw new Error("at least one skill or workflow id is required");
+					await approve("review_decide", exec, "Review " + args.decision + " for " + (args.skills ?? []).length.toString() + " skill(s) / " + (args.workflows ?? []).length.toString() + " workflow(s)");
+					const value = await call("/api/ai/review/decide", {
+						method: "POST",
+						body: JSON.stringify({
+							skills: args.skills ?? [],
+							workflows: args.workflows ?? [],
+							decision: args.decision,
+							note: args.note ?? "",
+							authorization: { confirmed: true }
+						})
+					});
+					audit("review_decide", exec, {
+						decision: args.decision,
+						skills: args.skills ?? [],
+						workflows: args.workflows ?? [],
+						confirmed: true
+					});
+					return value;
+				}
+			})
+		},
+		{
+			name: "review_notifications_list",
+			definition: defineTool({
+				name: "review_notifications_list",
+				description: "List the caller's review notifications and unread count. Read-only and always scoped to the current DataOps user.",
+				parameters: {
+					unread_only: {
+						type: "boolean",
+						description: "Only unread notifications."
+					},
+					limit: {
+						type: "number",
+						description: "Maximum rows (default 20)."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args) => {
+					const query = new URLSearchParams({
+						unreadOnly: args.unread_only === true ? "true" : "false",
+						limit: String(args.limit ?? 20)
+					});
+					return await call("/api/ai/review-notifications?" + query.toString());
+				}
+			})
+		},
+		{
+			name: "review_notifications_read",
+			definition: defineTool({
+				name: "review_notifications_read",
+				description: "Mark the caller's review notifications as read, either selected ids or all. Scoped to the current DataOps user; no secret is involved.",
+				parameters: {
+					ids: {
+						type: "array",
+						items: { type: "string" },
+						description: "Notification ids to mark read."
+					},
+					all: {
+						type: "boolean",
+						description: "Mark every notification read."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					const value = await call("/api/ai/review-notifications/read", {
+						method: "POST",
+						body: JSON.stringify({
+							ids: args.ids ?? [],
+							all: args.all === true
+						})
+					});
+					audit("review_notifications_read", exec, {
+						count: args.ids?.length ?? 0,
+						all: args.all === true
+					});
+					return value;
+				}
+			})
+		},
+		{
+			name: "dataops_api_docs",
+			definition: defineTool({
+				name: "dataops_api_docs",
+				description: "Search the DataOps HTTP API reference (OpenAPI 3) for endpoint contracts. Super administrators only; read-only. Returns compact operations — method, path, operationId, summary, tags, parameters, request-body fields and security — filtered by keyword, tag, path, operationId or HTTP method. It only reads the fixed /api/openapi.json document and cannot execute arbitrary requests.",
+				parameters: {
+					query: {
+						type: "string",
+						description: "Case-insensitive keywords matched against path, operationId, summary, tags and description. All keywords must match."
+					},
+					tag: {
+						type: "string",
+						description: "Exact OpenAPI tag (case-insensitive)."
+					},
+					path: {
+						type: "string",
+						description: "Case-insensitive substring of the operation path."
+					},
+					operation_id: {
+						type: "string",
+						description: "Case-insensitive substring of the operationId."
+					},
+					method: {
+						type: "string",
+						description: "HTTP method: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS or TRACE."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args) => {
+					const result = await reviewApi.request("/api/openapi.json");
+					if (result.status === 401) throw new Error("Unauthorized (401): DataOps session expired; sign in again to read the API reference");
+					if (result.status === 403) throw new Error("Forbidden (403): the DataOps OpenAPI document is not available to this role");
+					if (result.status === 404) throw new Error("DataOps API docs are unavailable: /api/openapi.json is not configured (DATAOPS_OPENAPI_UNAVAILABLE)");
+					if (result.status === 503) throw new Error("DataOps API docs are unavailable: this workspace has no DataOps session");
+					if (result.status < 200 || result.status >= 300) throw new Error("DataOps API docs request failed: HTTP " + result.status.toString());
+					try {
+						return searchOpenApiDocument(result.body, args);
+					} catch (error) {
+						if (error instanceof ApiDocsUnavailableError) throw new Error(error.message);
+						throw error;
+					}
+				}
+			})
+		}
+	];
+}
+//#endregion
+//#region src/tool-manager.ts
+/**
+* Reconcile the managed tools with the current DataOps scope.
+*
+* Construct once per plugin activation. `refresh` is idempotent and coalesces concurrent calls;
+* the constructor also subscribes to the credential observation so an expired session removes
+* the tools without waiting for another explicit sync.
+*/
+var AiToolManager = class {
+	ctx;
+	reviewApi;
+	definitions;
+	registrations = /* @__PURE__ */ new Map();
+	unsubscribeExpiry;
+	disposeViewer;
+	scope;
+	revision = 0;
+	inflight;
+	disposed = false;
+	constructor(ctx, reviewApi) {
+		this.ctx = ctx;
+		this.reviewApi = reviewApi;
+		this.definitions = new Map(buildAiManagementTools(ctx, reviewApi, () => this.scope).map((tool) => [tool.name, tool.definition]));
+		this.unsubscribeExpiry = onAuthStateChange((state) => {
+			if (state === "expired") this.clear();
+		});
+	}
+	/** The scope the current registration set was derived from, when one has been read. */
+	currentScope() {
+		return this.scope;
+	}
+	/** The tool names currently registered, for diagnostics and tests. */
+	registeredToolNames() {
+		return AI_TOOL_NAMES.filter((name) => this.registrations.has(name));
+	}
+	/**
+	* Re-read the workspace's DataOps scope and reconcile the tool list.
+	*
+	* Definitive denials clear the list; transient failures (network, 5xx) keep what the last good
+	* observation produced. The method never throws: sync happens in the background of a browser
+	* request and must not fail that request.
+	* @param force - Start a new read even when one is already in flight. Credential adoption uses
+	*   this because an older read may have captured the previous token; its answer must not win
+	*   over the scope the new token produces.
+	*/
+	async refresh(force = false) {
+		if (this.disposed) return;
+		if (this.inflight !== void 0 && !force) return this.inflight;
+		const revision = ++this.revision;
+		const run = this.loadScope(revision).catch((error) => {
+			this.ctx.logger.warn("dataops-managed: tool disclosure refresh failed");
+			this.ctx.logger.warn(error);
+		}).finally(() => {
+			if (this.inflight === run) this.inflight = void 0;
+		});
+		this.inflight = run;
+		return run;
+	}
+	/**
+	* Apply a context answer already fetched by a same-origin route.
+	*
+	* The review-context route is how the UI learns about a role change, so its answer is also the
+	* freshest scope this plugin will see. Reusing it avoids a second fetch on a page that polls.
+	* @param result - The upstream status and parsed body.
+	*/
+	observeContext(result) {
+		if (result.status === 200) {
+			this.applyContext(result.body);
+			return;
+		}
+		if (result.status === 401 || result.status === 403 || result.status === 404 || result.status === 503) this.clear();
+	}
+	/**
+	* Apply one parsed context body without contacting DataOps.
+	* @param body - Parsed `/api/ai/review/context` body.
+	*/
+	applyContext(body) {
+		if (this.disposed) return;
+		this.revision += 1;
+		const scope = normalizeScope(body);
+		this.applyScope(scope);
+	}
+	/** Drop every managed tool because no usable DataOps scope is known. */
+	clear() {
+		if (this.disposed) return;
+		this.revision += 1;
+		this.applyScope(void 0);
+	}
+	/** Dispose every tool this manager registered and stop observing auth state. */
+	dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		this.revision += 1;
+		this.unsubscribeExpiry();
+		this.disposeRegistrations();
+		this.disposeViewer?.();
+		this.disposeViewer = void 0;
+		this.scope = void 0;
+	}
+	async loadScope(revision) {
+		let result;
+		try {
+			result = await this.reviewApi.request("/api/ai/review/context");
+		} catch (error) {
+			this.ctx.logger.warn("dataops-managed: tool disclosure could not read the DataOps scope");
+			this.ctx.logger.warn(error);
+			return;
+		}
+		if (this.disposed || revision !== this.revision) return;
+		if (result.status === 200) {
+			this.applyScope(normalizeScope(result.body));
+			return;
+		}
+		if (result.status === 401 || result.status === 403 || result.status === 404 || result.status === 503) {
+			this.applyScope(void 0);
+			return;
+		}
+		this.ctx.logger.warn("dataops-managed: tool disclosure scope read failed with HTTP " + result.status.toString());
+	}
+	/** Store the scope and make the registry match it. */
+	applyScope(scope) {
+		this.scope = scope;
+		if (this.disposed) return;
+		this.applyViewer(scope);
+		const desired = new Set(scope === void 0 ? [] : AI_TOOL_NAMES.filter((name) => isToolVisible(name, scope)));
+		for (const [name, registration] of this.registrations) {
+			if (desired.has(name)) continue;
+			this.disposeRegistration(name, registration);
+		}
+		for (const name of AI_TOOL_NAMES) {
+			if (!desired.has(name) || this.registrations.has(name)) continue;
+			const definition = this.definitions.get(name);
+			if (definition === void 0) continue;
+			try {
+				const dispose = this.ctx.tools.register(definition);
+				this.registrations.set(name, { dispose });
+			} catch (error) {
+				this.ctx.logger.warn("dataops-managed: could not register tool " + name);
+				this.ctx.logger.warn(error);
+			}
+		}
+	}
+	/** Map one DataOps scope to the skill registry's audience filter. */
+	applyViewer(scope) {
+		this.disposeViewer?.();
+		this.disposeViewer = void 0;
+		const viewer = scope === void 0 ? {
+			role: "user",
+			permissions: []
+		} : {
+			role: isSuperAdmin(scope) ? "super-admin" : isAdmin(scope) || isDepartmentAdmin(scope) ? "admin" : "user",
+			permissions: [...scope.permissions ?? scope.permissionKeys ?? []]
+		};
+		try {
+			const skills = this.ctx.skills;
+			if (typeof skills.useViewer !== "function") return;
+			this.disposeViewer = skills.useViewer(viewer);
+		} catch (error) {
+			this.ctx.logger.warn("dataops-managed: could not apply the skill viewer");
+			this.ctx.logger.warn(error);
+		}
+	}
+	/** Dispose one registration, tolerating a disposer that has already run. */
+	disposeRegistration(name, registration) {
+		this.registrations.delete(name);
+		try {
+			registration.dispose();
+		} catch (error) {
+			this.ctx.logger.warn("dataops-managed: could not dispose tool " + name);
+			this.ctx.logger.warn(error);
+		}
+	}
+	/** Dispose the whole current set. */
+	disposeRegistrations() {
+		for (const [name, registration] of [...this.registrations]) this.disposeRegistration(name, registration);
+	}
+};
+//#endregion
+//#region src/connector-state.ts
+/**
+* The DataOps connector's workspace-visible state and skill-center catalogue.
+*
+* The skill center is skill-first, with connectors as its fourth tab. DataOps contributes one
+* connector whose capability rows are derived from the same scope that drives tool disclosure;
+* a capability the account cannot use is omitted rather than rendered as a disabled placeholder.
+*
+* This module owns only state and presentation. It never authorizes a tool call or a DataOps
+* request: the backend remains the final boundary.
+*
+* @module connector-state
+*/
+/** Same-origin route the skill center's connector tab reads and writes. */
+const CONNECTORS_PATH = "/api/dsh-skill-center/connectors";
+/** Connector id shown in the skill center. */
+const DATAOPS_CONNECTOR_ID = "dataops-managed";
+/** Resolve the persisted state file without depending on a global DSH path. */
+const CONNECTOR_STATE_PATH = join(process.env.DSH_HOME?.trim() || "/workspace/.dataops/dsh", "dataops-managed", "connector-state.json");
+/** Capability definitions before permission filtering. */
+const CAPABILITIES = [
+	{
+		id: "skill.plaza",
+		name: "技能广场",
+		description: "读取、安装和管理当前账号可见的技能",
+		allowed: (scope) => hasPermission(scope, "skill:read")
+	},
+	{
+		id: "review.queue",
+		name: "审核队列",
+		description: "查看待审技能、扫描风险并给出审核结论",
+		allowed: (scope) => canReview(scope)
+	},
+	{
+		id: "data.query",
+		name: "数据查询",
+		description: "通过 DataOps 数据查询能力回答业务问题",
+		allowed: () => true
+	},
+	{
+		id: "api.docs",
+		name: "管理接口文档",
+		description: "仅超级管理员可查询 DataOps OpenAPI 接口文档",
+		allowed: (scope) => isSuperAdmin(scope)
+	}
+];
+/** Read state; a missing or corrupt file is a safe disabled state. */
+async function readConnectorState(path = CONNECTOR_STATE_PATH) {
+	try {
+		const payload = JSON.parse(await readFile(path, "utf8"));
+		return {
+			enabled: payload.enabled === true,
+			capabilities: typeof payload.capabilities === "object" && payload.capabilities !== null ? { ...payload.capabilities } : {}
+		};
+	} catch {
+		return {
+			enabled: false,
+			capabilities: {}
+		};
+	}
+}
+/** Persist state atomically. */
+async function writeConnectorState(state, path = CONNECTOR_STATE_PATH) {
+	await mkdir(dirname(path), { recursive: true });
+	const temporary = path + ".tmp-" + process.pid.toString();
+	await writeFile(temporary, JSON.stringify(state, null, 2), "utf8");
+	await rename(temporary, path);
+}
+/** Build the connector row for one current scope. */
+function buildConnectorView(scope, state) {
+	const capabilities = scope === void 0 ? [] : CAPABILITIES.filter((capability) => capability.allowed(scope)).map((capability) => ({
+		id: capability.id,
+		name: capability.name,
+		description: capability.description,
+		enabled: state.capabilities[capability.id] !== false,
+		permitted: true
+	}));
+	return {
+		id: DATAOPS_CONNECTOR_ID,
+		name: "万相AI中台连接器",
+		vendor: "DataOps",
+		description: "把万相AI中台的技能、审核和数据能力接入当前工作区。",
+		enabled: state.enabled,
+		connected: scope !== void 0,
+		capabilities
+	};
+}
+/** Whether one capability id is in the fixed catalogue. */
+function hasCapability(id) {
+	return CAPABILITIES.some((capability) => capability.id === id);
+}
+//#endregion
+//#region src/workspace-limits.ts
+/** Narrow a value to a plain object. */
+function asRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+/** Narrow a value to a positive integer. */
+function asByteCount(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+/**
+* A rejection DataOps answered with, carrying its status and message.
+*
+* Without this the caller can only tell that something failed, and a value DataOps refused —
+* which the user can correct — is indistinguishable from a fault in the request path.
+*/
+var WorkspaceLimitsRejection = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+		this.name = "WorkspaceLimitsRejection";
+	}
+};
+/** Read DataOps' own explanation from a failed response, falling back to the status line. */
+async function rejectionMessage(response, fallback) {
+	try {
+		const message = asRecord(await response.json())?.message;
+		if (typeof message === "string" && message.trim() !== "") return message;
+		if (Array.isArray(message) && typeof message[0] === "string") return message[0];
+	} catch {}
+	return `${fallback} with HTTP ${String(response.status)}`;
+}
+/**
+* The workspace limits an administrator sets in DataOps.
+*
+* The plugin holds the DataOps JWT, so the browser cannot read these itself; this class is the
+* only path from the Settings panel to that document.
+*/
+var WorkspaceLimits = class {
+	ctx;
+	config;
+	constructor(ctx, config) {
+		this.ctx = ctx;
+		this.config = config;
+	}
+	/**
+	* Read the DataOps JWT this workspace is currently authorized with.
+	* @returns The token, or undefined when the workspace has no session yet.
+	*/
+	async token() {
+		return (await this.ctx.credentials.resolve(credentialRef(this.config.credentialRef)))?.value;
+	}
+	/** The DataOps API origin this workspace reports to. */
+	apiBase() {
+		return new URL(this.config.baseUrl).origin;
+	}
+	/**
+	* Read the current ceilings.
+	* @returns The status, or undefined when the workspace is not authorized.
+	*/
+	async status() {
+		const token = await this.token();
+		if (token === void 0) return void 0;
+		const response = await fetch(new URL("/api/ai/attachment-settings", this.apiBase()), { headers: { authorization: `Bearer ${token}` } });
+		if (response.status === 401) {
+			noteExpired();
+			return;
+		}
+		noteAccepted();
+		if (!response.ok) throw new WorkspaceLimitsRejection(response.status, await rejectionMessage(response, "Workspace limits read failed"));
+		const body = asRecord(await response.json());
+		const settings = body === null ? null : asRecord(body.settings);
+		const size = settings === null ? null : asRecord(settings.workspaceSize);
+		const fileReadMaxBytes = size === null ? null : asByteCount(size.fileReadMaxBytes);
+		const uploadMaxBytes = size === null ? null : asByteCount(size.uploadMaxBytes);
+		if (fileReadMaxBytes === null || uploadMaxBytes === null) throw new Error("Workspace limits read returned an unrecognized document");
+		return {
+			limits: {
+				fileReadMaxBytes,
+				uploadMaxBytes
+			},
+			canWrite: true,
+			readOnlyReason: null
+		};
+	}
+	/**
+	* Write new ceilings.
+	* @param limits - The ceilings to store.
+	* @returns The stored status.
+	*/
+	async save(limits) {
+		const token = await this.token();
+		if (token === void 0) return void 0;
+		const response = await fetch(new URL("/api/ai/attachment-settings", this.apiBase()), {
+			method: "PATCH",
+			headers: {
+				authorization: `Bearer ${token}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({ workspaceSize: limits })
+		});
+		if (response.status === 401) {
+			noteExpired();
+			return;
+		}
+		noteAccepted();
+		if (!response.ok) throw new WorkspaceLimitsRejection(response.status, await rejectionMessage(response, "Workspace limits write failed"));
+		return this.status();
+	}
+};
+/** The live instance, so the Settings route can act on it after activation. */
+let limitsRef;
+/** @param next - Instance to publish, or undefined to clear. */
+function setWorkspaceLimits(next) {
+	limitsRef = next;
+}
+/** @returns The live workspace-limits instance, when the plugin activated. */
+function currentWorkspaceLimits() {
+	return limitsRef;
+}
+/** Directory used by this plugin below the DSH home. */
+const WORKSPACE_UPGRADE_STATE_DIR = "dataops-managed";
+/** Name of the hand-off file. */
+const WORKSPACE_UPGRADE_STATE_FILE = "workspace-upgrade.json";
+/**
+* Resolve the persistent DSH home used by this workspace.
+*
+* The companion currently starts with `DSH_HOME=/workspace/.dataops/dsh`; the fallback
+* keeps tests and a manually launched host deterministic without reaching outside the
+* mounted workspace.
+* @param dshHome - override for tests.
+* @returns the state directory path.
+*/
+function workspaceUpgradeStatePath(dshHome = process.env.DSH_HOME ?? "/workspace/.dataops/dsh") {
+	return join(dshHome, WORKSPACE_UPGRADE_STATE_DIR, WORKSPACE_UPGRADE_STATE_FILE);
+}
+/** Validate one persisted session entry. */
+function asSession(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const record = value;
+	if (typeof record.sessionId !== "string" || record.sessionId.trim() === "") return null;
+	return {
+		sessionId: record.sessionId.trim(),
+		...typeof record.title === "string" && record.title.trim() !== "" ? { title: record.title.trim() } : {},
+		...typeof record.cwd === "string" && record.cwd.trim() !== "" ? { cwd: record.cwd.trim() } : {}
+	};
+}
+/** Validate a parsed state document. */
+function asWorkspaceUpgradeState(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const record = value;
+	if (record.version !== 1) return null;
+	if (typeof record.upgradeId !== "string" || record.upgradeId.trim() === "") return null;
+	if (typeof record.targetImage !== "string" || record.targetImage.trim() === "") return null;
+	if (!Array.isArray(record.sessions)) return null;
+	const sessions = record.sessions.map(asSession).filter((session) => session !== null);
+	return {
+		version: 1,
+		upgradeId: record.upgradeId.trim(),
+		targetImage: record.targetImage.trim(),
+		sessions,
+		createdAt: typeof record.createdAt === "string" ? record.createdAt : (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+/**
+* Read the pending hand-off record.
+* @param file - state file path.
+* @returns the record, or null when none exists or it cannot be parsed.
+*/
+async function readWorkspaceUpgradeState(file = workspaceUpgradeStatePath()) {
+	try {
+		return asWorkspaceUpgradeState(JSON.parse(await readFile(file, "utf8")));
+	} catch {
+		return null;
+	}
+}
+/**
+* Persist the hand-off record atomically.
+*
+* A partially written JSON file would be indistinguishable from "no upgrade pending",
+* which would silently skip recovery. The temporary file is renamed into place only
+* after the content is complete.
+* @param state - record to persist.
+* @param file - state file path.
+*/
+async function writeWorkspaceUpgradeState(state, file = workspaceUpgradeStatePath()) {
+	await mkdir(dirname(file), { recursive: true });
+	const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
+	await writeFile(temporary, JSON.stringify(state, null, 2) + "\n", "utf8");
+	await rename(temporary, file);
+}
+/**
+* Remove the hand-off record after recovery has been attempted.
+* @param file - state file path.
+*/
+async function clearWorkspaceUpgradeState(file = workspaceUpgradeStatePath()) {
+	await rm(file, { force: true });
+}
+//#endregion
+//#region src/workspace-upgrade.ts
+/**
+* Workspace image upgrade orchestration.
+*
+* DataOps owns the Docker image comparison and the container restart. This plugin owns
+* the two facts DSH alone can know: which sessions are running right now, and how to
+* bring those sessions back after the container has been recreated. A small JSON file
+* on the shared workspace volume carries that hand-off across the restart.
+*
+* @module workspace-upgrade
+*/
+/** A refusal or transport failure from the DataOps API. */
+var WorkspaceUpgradeError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+		this.name = "WorkspaceUpgradeError";
+	}
+};
+/** Create the user-message value `agent.followup` accepts. */
+function userMessage(text) {
+	return {
+		id: randomUUID(),
+		role: "user",
+		content: [{
+			type: "text",
+			text
+		}],
+		source: { kind: "user" }
+	};
+}
+/** Extract a useful message from a DataOps error body. */
+async function responseMessage(response, fallback) {
+	try {
+		const message = (await response.json()).message;
+		if (typeof message === "string" && message.trim() !== "") return message;
+		if (Array.isArray(message) && typeof message[0] === "string") return message[0];
+	} catch {}
+	return `${fallback} (HTTP ${String(response.status)})`;
+}
+/** Owns DataOps preview/restart calls and the DSH session hand-off. */
+var WorkspaceUpgrade = class {
+	ctx;
+	config;
+	statePath;
+	constructor(ctx, config, statePath = workspaceUpgradeStatePath()) {
+		this.ctx = ctx;
+		this.config = config;
+		this.statePath = statePath;
+	}
+	/** Resolve the injected DSH agents service, if the profile provides one. */
+	agents() {
+		return this.ctx.agents;
+	}
+	/** Read the current DataOps credential. */
+	async token() {
+		return (await this.ctx.credentials.resolve(credentialRef(this.config.credentialRef)))?.value;
+	}
+	/** DataOps origin used by this workspace. */
+	apiBase() {
+		return new URL(this.config.baseUrl).origin;
+	}
+	/** Call one DataOps API path with the workspace JWT. */
+	async request(path, init) {
+		const token = await this.token();
+		if (token === void 0) throw new WorkspaceUpgradeError(401, "workspace is not signed in to DataOps");
+		let response;
+		try {
+			response = await fetch(new URL(path, this.apiBase()), {
+				...init,
+				headers: {
+					authorization: `Bearer ${token}`,
+					...init?.body === void 0 ? {} : { "content-type": "application/json" },
+					...init?.headers ?? {}
+				}
+			});
+		} catch (error) {
+			throw new WorkspaceUpgradeError(502, error instanceof Error ? error.message : String(error));
+		}
+		if (response.status === 401) {
+			noteExpired();
+			throw new WorkspaceUpgradeError(401, "DataOps session has ended");
+		}
+		noteAccepted();
+		return response;
+	}
+	/** Read the DataOps restart preview plus this host's running-session snapshot. */
+	async preview() {
+		const response = await this.request("/api/ai/workspace/restart-preview");
+		if (!response.ok) throw new WorkspaceUpgradeError(response.status, await responseMessage(response, "workspace preview failed"));
+		const body = await response.json();
+		const imageStatus = body.workspace?.imageStatus;
+		if (imageStatus !== "CURRENT" && imageStatus !== "UPDATE_AVAILABLE" && imageStatus !== "NOT_RUNNING" && imageStatus !== "UNKNOWN") throw new WorkspaceUpgradeError(502, "workspace preview returned an unrecognized image status");
+		return {
+			imageStatus,
+			configuredImage: typeof body.workspace?.configuredImage === "string" ? body.workspace.configuredImage : "",
+			activeSessions: this.runningSessions()
+		};
+	}
+	/** Snapshot sessions that are executing a turn right now. */
+	runningSessions() {
+		const agents = this.agents();
+		if (agents === void 0) return [];
+		return agents.list().filter((agent) => agent.status === "running").map((agent) => ({
+			sessionId: agent.session.id,
+			...agent.session.header?.title ? { title: agent.session.header.title } : {},
+			...agent.session.header?.cwd ? { cwd: agent.session.header.cwd } : {}
+		}));
+	}
+	/** Restart DataOps' workspace container; force is required when sessions are snapshot. */
+	async restart() {
+		const response = await this.request("/api/ai/workspace/restart", {
+			method: "POST",
+			body: JSON.stringify({ force: true })
+		});
+		if (!response.ok) throw new WorkspaceUpgradeError(response.status, await responseMessage(response, "workspace restart failed"));
+	}
+	/**
+	* Persist the running-session snapshot and ask DataOps to recreate the container.
+	* @returns the accepted hand-off record.
+	*/
+	async upgrade() {
+		const preview = await this.preview();
+		if (preview.imageStatus !== "UPDATE_AVAILABLE") throw new WorkspaceUpgradeError(409, "workspace image is already current or not running");
+		const state = {
+			version: 1,
+			upgradeId: randomUUID(),
+			targetImage: preview.configuredImage,
+			sessions: preview.activeSessions,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		await writeWorkspaceUpgradeState(state, this.statePath);
+		try {
+			await this.restart();
+		} catch (error) {
+			await clearWorkspaceUpgradeState(this.statePath);
+			throw error;
+		}
+		return state;
+	}
+	/**
+	* Resume every snapshotted session and send one "继续".
+	*
+	* The method deliberately does not wait for an answer: the user's workspace should
+	* become usable immediately, and an in-flight tool call cannot be replayed safely.
+	* `recoverWorkspaceUpgradeAfterBoot` removes the hand-off file after this attempt.
+	*/
+	async recover() {
+		const state = await readWorkspaceUpgradeState(this.statePath);
+		if (state === null) return {
+			recovered: 0,
+			skipped: 0
+		};
+		if (this.agents() === void 0) throw new Error("DSH agents service is not ready");
+		let recovered = 0;
+		let skipped = 0;
+		for (const session of state.sessions) try {
+			const agent = await this.ensureAgent(session.sessionId);
+			if (agent === void 0) {
+				skipped += 1;
+				continue;
+			}
+			agent.followup(userMessage("继续"));
+			recovered += 1;
+		} catch (error) {
+			skipped += 1;
+			this.ctx.logger.warn(`dataops-managed: could not resume session ${session.sessionId}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		return {
+			recovered,
+			skipped
+		};
+	}
+	/** Remove the hand-off record once recovery has been attempted. */
+	async clearRecoveryState() {
+		await clearWorkspaceUpgradeState(this.statePath);
+	}
+	/** Find a live session or resume it from persisted state. */
+	async ensureAgent(sessionId) {
+		const agents = this.agents();
+		if (agents === void 0) return void 0;
+		const live = agents.get(sessionId);
+		if (live !== void 0) return live;
+		return (await agents.resume({ resumeSessionId: sessionId }))?.agent;
+	}
+};
+/** Delay helper for boot-time recovery without keeping the plugin apply() pending. */
+const sleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/**
+* Run recovery after the DSH host and its session persistence have had time to boot.
+*
+* `apply()` runs before a persisted session necessarily has its live agent; resuming
+* eagerly can race that boot. A short bounded retry is enough, and a failed attempt
+* still removes the hand-off file so the next page load cannot send "继续" forever.
+* @param upgrade - upgrade service.
+*/
+async function recoverWorkspaceUpgradeAfterBoot(upgrade) {
+	let lastState = null;
+	for (let attempt = 0; attempt < 10; attempt += 1) {
+		const state = await readWorkspaceUpgradeState(upgrade.statePath);
+		if (state === null) return;
+		lastState = state;
+		if (attempt > 0) await sleep(1500);
+		try {
+			if ((await upgrade.recover()).recovered > 0 || state.sessions.length === 0) {
+				await upgrade.clearRecoveryState();
+				return;
+			}
+		} catch (error) {
+			console.warn("[dataops-managed] workspace upgrade recovery failed:", error);
+		}
+	}
+	if (lastState !== null) await upgrade.clearRecoveryState();
+}
+//#endregion
+//#region src/index.ts
+/** Cordis plugin name for the DataOps-managed integration. */
+const name = "dataops-managed";
+/** Host services required by managed JWT and MCP ownership. */
+const inject = [
+	"credentials",
+	"webServer",
+	"tools",
+	"settings",
+	"skills",
+	"approval",
+	"agents"
+];
+const MANAGED_AUTH_PATH = "/integrations/dataops/managed-auth";
+/** This plugin's profile entry id, which owns its Config and sync state. */
+const MANAGED_PLUGIN_ID = "dataops-managed";
+/** Same-origin route the workspace settings pages use to read and change model sharing. */
+const MODEL_SYNC_PATH = "/integrations/dataops/model-sync";
+/** Same-origin route the skill center uses to read and change plaza sharing. */
+const SKILL_PLAZA_PATH = "/integrations/dataops/skill-plaza";
+/** Caller role and review capability. */
+const REVIEW_CONTEXT_PATH = "/integrations/dataops/review-context";
+/** Notification inbox and read receipts. */
+const REVIEW_NOTIFICATIONS_PATH = "/integrations/dataops/review-notifications";
+/** AI scan and the administrator's decision. */
+const REVIEW_ACTION_PATH = "/integrations/dataops/review";
+/** Permission-centre reads and writes. */
+const RBAC_PATH = "/integrations/dataops/rbac";
+/** The three plaza-review switches. */
+const REVIEW_SETTINGS_PATH = "/integrations/dataops/review-settings";
+/** Department CRUD bridge (task-67). */
+const DEPARTMENTS_PATH = "/integrations/dataops/departments";
+/** Same-origin route the Settings panel uses to read and change this workspace's limits. */
+const WORKSPACE_LIMITS_PATH = "/integrations/dataops/workspace-limits";
+/** Same-origin route the Settings panel uses to read and change the tool-call timeout. */
+const TOOL_TIMEOUT_PATH = "/integrations/dataops/tool-timeout";
+/** Same-origin route reporting what the last DataOps answer said about the credential. */
+const AUTH_STATE_PATH = "/integrations/dataops/auth-state";
+/** Same-origin route the DSH page uses to detect and start a workspace image upgrade. */
+const WORKSPACE_UPGRADE_PATH = "/integrations/dataops/workspace-upgrade";
+/** The ends a tool-call timeout may take, in whole seconds. */
+const TOOL_TIMEOUT_MIN_SECONDS = 1;
+const TOOL_TIMEOUT_MAX_SECONDS = 3600;
+/** The live sync instance, so the settings routes can act on it after activation. */
+let modelSyncRef;
+/** The live plaza instance, so the skill center routes can act on it after activation. */
+let skillPlazaRef;
+/** The live review API, once this plugin activated. */
+let reviewApiRef;
+/** The live skill plaza, once this plugin activated. */
+function currentSkillPlaza() {
+	return skillPlazaRef;
+}
+/** The live model-sync instance, once this plugin activated. */
+function currentModelSync() {
+	return modelSyncRef;
+}
+/** The live settings-sync instance, once this plugin activated. */
+let settingsSyncRef;
+/** @returns The live instance, or undefined before this plugin activated. */
+function currentSettingsSync() {
+	return settingsSyncRef;
+}
+/**
+* Read the value behind a possibly-volatile field.
+*
+* A volatile field always arrives as a reference, but the plain shape is accepted too so a
+* caller that validated the config without a settings service still reads its value.
+* @param field - The config field as the runtime supplied it.
+* @param fallback - Value to use when nothing is stored yet.
+* @returns The current value.
+*/
+function volatileValue(field, fallback) {
+	if (field === void 0) return fallback;
+	if (typeof field === "object" && field !== null && "get" in field && typeof field.get === "function") return field.get() ?? fallback;
+	return field;
+}
+/**
+* Per-tool-call timeout a workspace starts with.
+*
+* Named rather than inlined so the schema default and the read fallback cannot drift: the field is
+* volatile, so a workspace that never changed it reads no value at all and both places have to
+* answer the same number.
+*/
+const DEFAULT_TOOL_CALL_TIMEOUT_MS = 3e5;
+/** Default sync state before this workspace stored anything. */
+const MODEL_SYNC_DEFAULT = {
+	detached: false,
+	adoptedModelIds: [],
+	privateModelIds: []
+};
+/** Schemastery parser for managed DataOps configuration. */
+const Config = z.object({
+	baseUrl: z.string().default("http://host.docker.internal:3101"),
+	serverName: z.string().default("dataops"),
+	credentialRef: z.string().role("credential-ref").default("DATAOPS_ACCESS_TOKEN"),
+	/**
 	* Volatile so the settings service persists it in this workspace's document: the timeout an
 	* operator needs depends on the query behind a tool, which is deployment knowledge the profile
 	* that mounts this plugin does not have.
@@ -903,6 +2545,38 @@ function bearerToken(request) {
 	const token = authorization.slice(7).trim();
 	return token === "" ? null : token;
 }
+/**
+* Adopt the JWT the browser gateway attached to one request.
+*
+* Every browser request reaches this workspace through the DataOps gateway, which resolves the
+* caller's session and forwards a fresh `authorization: Bearer <jwt>` — so the current credential
+* arrives continuously, without any push, handshake or refresh protocol. The routes below are
+* the only place this plugin can see that header, and reading it here is what keeps the stored
+* credential from going stale: the value in it was captured once, while the caller's session is
+* renewed by DataOps for as long as they stay signed in.
+*
+* A request without the header is normal rather than an error (same-origin fetches from inside
+* the workspace do carry it, but a probe or a health check may not), so this only ever improves
+* the stored value and never rejects the request.
+*
+* @param request - the incoming request, whose headers the gateway filled in.
+* @returns once the credential has been updated, or immediately when there is nothing to adopt.
+*/
+function adoptRequestJwt(ctx, accessRef, request) {
+	const token = bearerToken(request);
+	if (token === null) return Promise.resolve();
+	return (async () => {
+		if ((await ctx.credentials.resolve(accessRef))?.value === token) {
+			resetAuthState();
+			return;
+		}
+		await ctx.credentials.set(accessRef, token);
+		resetAuthState();
+	})().catch((error) => {
+		ctx.logger.warn("dataops-managed: request JWT could not be adopted");
+		ctx.logger.warn(error);
+	});
+}
 /** The skill this plugin contributes: how to answer a DataOps data question. */
 const QUERY_SKILL_NAME = "dataops-query";
 /** Location of the skill document inside the published package. */
@@ -986,7 +2660,11 @@ async function apply(ctx, config) {
 	* a failed connect is reported rather than thrown.
 	*/
 	const connectExisting = async () => {
-		if (await ctx.credentials.resolve(accessRef) === void 0) return;
+		if (await ctx.credentials.resolve(accessRef) === void 0) {
+			aiTools.clear();
+			return;
+		}
+		aiTools.refresh();
 		try {
 			await ensureMcp();
 		} catch (error) {
@@ -1061,10 +2739,34 @@ async function apply(ctx, config) {
 		baseUrl,
 		credentialRef: config.credentialRef
 	});
+	const reviewApi = new ReviewApi(ctx, {
+		baseUrl,
+		credentialRef: config.credentialRef
+	});
+	reviewApiRef = reviewApi;
+	/**
+	* The managed tool list follows the workspace's DataOps scope.
+	*
+	* `AiToolManager` registers only the skill/review tools the current principal can use and
+	* disposes them when the role changes. The credential event below is the existing auth-sync
+	* path: JWT adoption and the managed-auth route both go through `credentials.set`, which
+	* publishes this event after the write commits. The manager also observes the review-context
+	* route's answer, because a role edit does not change the JWT but does change the scope.
+	*/
+	const aiTools = new AiToolManager(ctx, reviewApi);
+	ctx.effect(() => () => aiTools.dispose(), "dataops-managed: skill and review tool disclosure");
+	ctx.effect(() => ctx.on("credentials/reference-updated", (ref) => {
+		if (String(ref) !== config.credentialRef) return;
+		aiTools.refresh(true);
+	}), "dataops-managed: tool disclosure follows the DataOps credential");
 	setWorkspaceLimits(new WorkspaceLimits(ctx, {
 		baseUrl,
 		credentialRef: config.credentialRef
 	}));
+	const workspaceUpgrade = new WorkspaceUpgrade(ctx, {
+		baseUrl,
+		credentialRef: config.credentialRef
+	});
 	/**
 	* Adopt the publisher's models once the workspace has a session.
 	*
@@ -1086,7 +2788,7 @@ async function apply(ctx, config) {
 			ctx.logger.warn(error);
 		}
 	};
-	if (await ctx.credentials.resolve(accessRef) !== void 0) await adoptNow();
+	if (await ctx.credentials.resolve(accessRef) !== void 0) adoptNow();
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: MANAGED_AUTH_PATH,
@@ -1099,6 +2801,7 @@ async function apply(ctx, config) {
 				response.end();
 				return;
 			}
+			await adoptRequestJwt(ctx, accessRef, request);
 			const token = bearerToken(request);
 			if (token === null) {
 				response.writeHead(401, { "content-length": "0" });
@@ -1106,6 +2809,8 @@ async function apply(ctx, config) {
 				return;
 			}
 			await ctx.credentials.set(accessRef, token);
+			resetAuthState();
+			aiTools.refresh(true);
 			await ensureMcp();
 			await adoptNow();
 			response.writeHead(204, { "cache-control": "no-store" });
@@ -1217,12 +2922,18 @@ async function apply(ctx, config) {
 			try {
 				if (request.method === "GET") {
 					const url = new URL(request.url ?? "/", "http://localhost");
+					const mine = url.searchParams.get("mine") === "1";
+					const page = await plaza.listPage({
+						tag: url.searchParams.get("tag") ?? void 0,
+						query: url.searchParams.get("q") ?? void 0,
+						status: url.searchParams.get("status") ?? void 0,
+						scope: mine ? "mine" : url.searchParams.get("scope") ?? void 0,
+						departmentCode: url.searchParams.get("departmentCode") ?? void 0
+					});
 					writeJson(response, 200, {
-						skills: await plaza.list({
-							tag: url.searchParams.get("tag") ?? void 0,
-							query: url.searchParams.get("q") ?? void 0
-						}),
-						tags: await plaza.tags()
+						skills: mine ? page.skills.filter((skill) => skill.sharedByMe) : page.skills,
+						tags: mine ? [] : await plaza.tags(),
+						...page.counts === void 0 ? {} : { counts: page.counts }
 					});
 					return;
 				}
@@ -1240,17 +2951,52 @@ async function apply(ctx, config) {
 					writeJson(response, 200, { skills: await readLocalSkills(ctx) });
 					return;
 				}
-				if (action === "share") {
+				if (action === "share" || action === "submit") {
 					const name = typeof body?.name === "string" ? body.name : "";
 					const instruction = typeof body?.instruction === "string" ? body.instruction : "";
 					const description = typeof body?.description === "string" ? body.description : void 0;
 					const tags = Array.isArray(body?.tags) ? body.tags.filter((tag) => typeof tag === "string") : [];
-					writeJson(response, 200, { skill: await plaza.share({
-						name,
-						description,
-						instruction,
-						tags
-					}) });
+					if (name.trim() === "" || instruction.trim() === "") {
+						writeJson(response, 400, { error: "name and instruction are required" });
+						return;
+					}
+					writeJson(response, 200, {
+						ok: true,
+						skill: await plaza.share({
+							name,
+							description,
+							instruction,
+							tags
+						})
+					});
+					return;
+				}
+				if (action === "review") {
+					const api = reviewApiRef;
+					if (api === void 0) {
+						writeJson(response, 503, { error: "review api is not active" });
+						return;
+					}
+					const id = typeof body?.id === "number" ? body.id : void 0;
+					const decision = body?.decision === "reject" ? "reject" : body?.decision === "approve" ? "approve" : null;
+					if (id === void 0 || decision === null) {
+						writeJson(response, 400, { error: "id and decision are required" });
+						return;
+					}
+					const result = await api.request("/api/ai/review/decide", {
+						method: "POST",
+						body: JSON.stringify({
+							skills: [id],
+							workflows: [],
+							decision,
+							note: typeof body?.note === "string" ? body.note : "",
+							authorization: {
+								confirmed: true,
+								reason: "skill-plaza-review"
+							}
+						})
+					});
+					writeJson(response, result.status, result.body);
 					return;
 				}
 				if (action === "unshare") {
@@ -1275,6 +3021,307 @@ async function apply(ctx, config) {
 		}
 	}), "dataops-managed: skill plaza routes");
 	/**
+	* Review context, notifications, AI scan/decide, the permission centre and review settings.
+	*
+	* These are thin same-origin bridges: DataOps owns identity, authorization, the state machine
+	* and the audit trail; this route only attaches the workspace JWT and forwards answers so the
+	* browser can show a precise waiting/refused state instead of flattening both to "empty".
+	*/
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: REVIEW_CONTEXT_PATH,
+		handler: async (request, response) => {
+			if (request.method !== "GET") {
+				response.writeHead(405, {
+					allow: "GET",
+					"content-length": "0"
+				});
+				response.end();
+				return;
+			}
+			const api = reviewApiRef;
+			if (api === void 0) {
+				writeJson(response, 503, { error: "review api is not active" });
+				return;
+			}
+			try {
+				const result = await api.request("/api/ai/review/context");
+				aiTools.observeContext(result);
+				writeJson(response, result.status, result.body);
+			} catch (error) {
+				ctx.logger.warn("dataops-managed: review context failed");
+				writeJson(response, 502, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: review context route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: REVIEW_NOTIFICATIONS_PATH,
+		handler: async (request, response) => {
+			const api = reviewApiRef;
+			if (api === void 0) {
+				writeJson(response, 503, { error: "review api is not active" });
+				return;
+			}
+			try {
+				if (request.method === "GET") {
+					const url = new URL(request.url ?? "/", "http://localhost");
+					const params = new URLSearchParams();
+					if (url.searchParams.get("unreadOnly") === "true") params.set("unreadOnly", "true");
+					if (url.searchParams.get("limit") !== null) params.set("limit", url.searchParams.get("limit"));
+					const result = await api.request("/api/ai/review-notifications" + (params.size === 0 ? "" : "?" + params.toString()));
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				if (request.method !== "POST") {
+					response.writeHead(405, {
+						allow: "GET, POST",
+						"content-length": "0"
+					});
+					response.end();
+					return;
+				}
+				const body = await readJson(request);
+				const result = await api.request("/api/ai/review-notifications/read", {
+					method: "POST",
+					body: JSON.stringify(body ?? {})
+				});
+				writeJson(response, result.status, result.body);
+			} catch (error) {
+				ctx.logger.warn("dataops-managed: review notifications failed");
+				writeJson(response, 502, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: review notifications route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: REVIEW_ACTION_PATH,
+		handler: async (request, response) => {
+			if (request.method !== "POST") {
+				response.writeHead(405, {
+					allow: "POST",
+					"content-length": "0"
+				});
+				response.end();
+				return;
+			}
+			const api = reviewApiRef;
+			if (api === void 0) {
+				writeJson(response, 503, { error: "review api is not active" });
+				return;
+			}
+			try {
+				const body = await readJson(request);
+				const action = typeof body?.action === "string" ? body.action : "";
+				const skills = Array.isArray(body?.skills) ? body.skills : [];
+				const workflows = Array.isArray(body?.workflows) ? body.workflows : [];
+				if (action === "scan") {
+					const result = await api.request("/api/ai/review/scan", {
+						method: "POST",
+						body: JSON.stringify({
+							skills,
+							workflows
+						})
+					});
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				if (action === "decide") {
+					const result = await api.request("/api/ai/review/decide", {
+						method: "POST",
+						body: JSON.stringify({
+							skills,
+							workflows,
+							decision: body?.decision,
+							note: body?.note,
+							authorization: body?.authorization
+						})
+					});
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				writeJson(response, 400, { error: "unknown review action" });
+			} catch (error) {
+				ctx.logger.warn("dataops-managed: review action failed");
+				writeJson(response, 502, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: review action route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: RBAC_PATH,
+		handler: async (request, response) => {
+			const api = reviewApiRef;
+			if (api === void 0) {
+				writeJson(response, 503, { error: "review api is not active" });
+				return;
+			}
+			try {
+				if (request.method === "GET") {
+					const url = new URL(request.url ?? "/", "http://localhost");
+					const section = url.searchParams.get("section") ?? "matrix";
+					const suffix = section === "members" ? "?q=" + encodeURIComponent(url.searchParams.get("q") ?? "") + "&departmentCode=" + encodeURIComponent(url.searchParams.get("departmentCode") ?? "") : section === "resources" ? "?kind=" + encodeURIComponent(url.searchParams.get("kind") ?? "") : "";
+					const target = section === "members" ? "/api/system/permission-center/members" + suffix : section === "departments" ? "/api/system/permission-center/departments" : section === "resources" ? "/api/system/permission-center/resources" + suffix : "/api/system/permission-center/matrix" + (url.searchParams.get("scope") === "dsh" ? "?scope=dsh" : "");
+					const result = await api.request(target);
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				if (request.method !== "PUT") {
+					response.writeHead(405, {
+						allow: "GET, PUT",
+						"content-length": "0"
+					});
+					response.end();
+					return;
+				}
+				const body = await readJson(request);
+				const section = typeof body?.section === "string" ? body.section : "";
+				const value = typeof body?.value === "object" && body.value !== null ? body.value : {};
+				if (section === "roles") {
+					const result = await api.request("/api/system/permission-center/matrix", {
+						method: "PUT",
+						body: JSON.stringify(value)
+					});
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				if (section === "members" && typeof value.userId === "string") {
+					const result = await api.request("/api/system/permission-center/members/" + encodeURIComponent(value.userId) + "/roles", {
+						method: "PUT",
+						body: JSON.stringify({ roleCodes: value.roleCodes })
+					});
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				if (section === "departments" && typeof value.code === "string") {
+					const result = await api.request("/api/system/permission-center/departments/" + encodeURIComponent(value.code) + "/admin", {
+						method: "PUT",
+						body: JSON.stringify({ userIds: value.userIds })
+					});
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				if (section === "resources" && typeof value.kind === "string" && value.id !== void 0) {
+					const result = await api.request("/api/system/permission-center/resources/" + encodeURIComponent(value.kind) + "/" + encodeURIComponent(String(value.id)) + "/scope", {
+						method: "PUT",
+						body: JSON.stringify({
+							departmentCode: value.departmentCode,
+							visibility: value.visibility,
+							ownerId: value.ownerId
+						})
+					});
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				writeJson(response, 400, { error: "unknown rbac section" });
+			} catch (error) {
+				ctx.logger.warn("dataops-managed: permission centre failed");
+				writeJson(response, 502, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: permission centre route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: DEPARTMENTS_PATH,
+		handler: async (request, response) => {
+			const api = reviewApiRef;
+			if (api === void 0) {
+				writeJson(response, 503, { error: "review api is not active" });
+				return;
+			}
+			try {
+				const body = await readJson(request);
+				if (request.method === "POST") {
+					const result = await api.request("/api/system/departments", {
+						method: "POST",
+						body: JSON.stringify(body ?? {})
+					});
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				if (request.method !== "PATCH" && request.method !== "DELETE") {
+					response.writeHead(405, {
+						allow: "POST, PATCH, DELETE",
+						"content-length": "0"
+					});
+					response.end();
+					return;
+				}
+				const code = typeof body?.code === "string" ? body.code : "";
+				if (code === "") {
+					writeJson(response, 400, { error: "department code is required" });
+					return;
+				}
+				const current = await api.request("/api/system/departments/" + encodeURIComponent(code));
+				const record = typeof current.body === "object" && current.body !== null ? current.body : {};
+				const department = typeof record.department === "object" && record.department !== null ? record.department : {};
+				const updatedAt = typeof body?.updatedAt === "string" ? body.updatedAt : department.updatedAt;
+				if (typeof updatedAt !== "string") {
+					writeJson(response, current.status === 200 ? 409 : current.status, { error: "department not found" });
+					return;
+				}
+				if (request.method === "PATCH") {
+					const result = await api.request("/api/system/departments/" + encodeURIComponent(code), {
+						method: "PATCH",
+						body: JSON.stringify({
+							updatedAt,
+							name: body?.name,
+							parentCode: body?.parentCode,
+							description: body?.description,
+							owner: body?.owner,
+							enabled: body?.enabled
+						})
+					});
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				const result = await api.request("/api/system/departments/" + encodeURIComponent(code), {
+					method: "DELETE",
+					body: JSON.stringify({ updatedAt })
+				});
+				writeJson(response, result.status, result.body);
+			} catch (error) {
+				ctx.logger.warn("dataops-managed: department bridge failed");
+				writeJson(response, 502, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: department CRUD bridge");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: REVIEW_SETTINGS_PATH,
+		handler: async (request, response) => {
+			const api = reviewApiRef;
+			if (api === void 0) {
+				writeJson(response, 503, { error: "review api is not active" });
+				return;
+			}
+			try {
+				if (request.method === "GET") {
+					const result = await api.request("/api/integrations/dataops/review-settings");
+					writeJson(response, result.status, result.body);
+					return;
+				}
+				if (request.method !== "PUT" && request.method !== "POST") {
+					response.writeHead(405, {
+						allow: "GET, POST, PUT",
+						"content-length": "0"
+					});
+					response.end();
+					return;
+				}
+				const body = await readJson(request);
+				const result = await api.request("/api/integrations/dataops/review-settings", {
+					method: "POST",
+					body: JSON.stringify(body ?? {})
+				});
+				writeJson(response, result.status, result.body);
+			} catch (error) {
+				ctx.logger.warn("dataops-managed: review settings failed");
+				writeJson(response, 502, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: review settings route");
+	/**
 	* The workspace limits an administrator sets in DataOps.
 	*
 	* Read through the plugin because it holds the DataOps JWT; the page cannot reach those settings
@@ -1378,6 +3425,133 @@ async function apply(ctx, config) {
 			}
 		}
 	}), "dataops-managed: tool timeout route");
+	/**
+	* Workspace image upgrade: DataOps owns the image comparison and restart; this
+	* plugin adds the DSH-side running-session snapshot and post-restart recovery.
+	*/
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: WORKSPACE_UPGRADE_PATH,
+		handler: async (request, response) => {
+			try {
+				if (request.method === "GET") {
+					const preview = await workspaceUpgrade.preview();
+					writeJson(response, 200, {
+						imageStatus: preview.imageStatus,
+						configuredImage: preview.configuredImage,
+						activeSessions: preview.activeSessions
+					});
+					return;
+				}
+				if (request.method !== "POST") {
+					response.writeHead(405, {
+						allow: "GET, POST",
+						"content-length": "0"
+					});
+					response.end();
+					return;
+				}
+				const state = await workspaceUpgrade.upgrade();
+				writeJson(response, 202, {
+					accepted: true,
+					upgradeId: state.upgradeId,
+					sessions: state.sessions.length
+				});
+			} catch (error) {
+				writeJson(response, error instanceof WorkspaceUpgradeError ? error.status : 502, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: workspace upgrade route");
+	recoverWorkspaceUpgradeAfterBoot(workspaceUpgrade);
+	/**
+	* What the last DataOps answer said about this workspace's credential.
+	*
+	* The settings surfaces need this because a 401 is handled deep inside a call that degrades to
+	* "no data", so the panel renders as if the workspace simply has nothing to show. Reading this
+	* route is how the interface learns the reason is an ended session rather than an empty one.
+	* The recorded state is an observation, never an authority: DataOps still decides.
+	*/
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: AUTH_STATE_PATH,
+		handler: async (request, response) => {
+			if (request.method !== "GET") {
+				response.writeHead(405, {
+					allow: "GET",
+					"content-length": "0"
+				});
+				response.end();
+				return;
+			}
+			await adoptRequestJwt(ctx, accessRef, request);
+			writeJson(response, 200, { state: currentAuthState() });
+		}
+	}), "dataops-managed: auth state route");
+	/**
+	* The skill center's connector tab. The route is a same-origin presentation bridge: reads
+	* return only capabilities the current scope can use, and writes persist the connector's own
+	* enable state. It never substitutes for a DataOps authorization decision.
+	*/
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: CONNECTORS_PATH,
+		handler: async (request, response) => {
+			try {
+				if (request.method === "GET") {
+					if (aiTools.currentScope() === void 0) await aiTools.refresh();
+					const state = await readConnectorState();
+					writeJson(response, 200, { connectors: [buildConnectorView(aiTools.currentScope(), state)] });
+					return;
+				}
+				if (request.method === "POST") {
+					const body = await readJson(request);
+					if (body === null) {
+						writeJson(response, 400, { error: "connector state requires a JSON body" });
+						return;
+					}
+					if (body.connectorId !== "dataops-managed") {
+						writeJson(response, 404, { error: "unknown connector" });
+						return;
+					}
+					const state = await readConnectorState();
+					const capabilityId = typeof body.capabilityId === "string" ? body.capabilityId : void 0;
+					if (capabilityId !== void 0) {
+						if (!hasCapability(capabilityId)) {
+							writeJson(response, 400, { error: "unknown capability" });
+							return;
+						}
+						if (!buildConnectorView(aiTools.currentScope(), state).capabilities.some((row) => row.id === capabilityId)) {
+							writeJson(response, 403, { error: "capability is not available to this account" });
+							return;
+						}
+						if (typeof body.enabled !== "boolean") {
+							writeJson(response, 400, { error: "capability state requires enabled:boolean" });
+							return;
+						}
+						state.capabilities[capabilityId] = body.enabled;
+					} else {
+						if (typeof body.enabled !== "boolean") {
+							writeJson(response, 400, { error: "connector state requires enabled:boolean" });
+							return;
+						}
+						state.enabled = body.enabled;
+					}
+					await writeConnectorState(state);
+					writeJson(response, 200, { connectors: [buildConnectorView(aiTools.currentScope(), state)] });
+					return;
+				}
+				response.writeHead(405, {
+					allow: "GET, POST",
+					"content-length": "0"
+				});
+				response.end();
+			} catch (error) {
+				ctx.logger.warn("dataops-managed: connector catalogue route failed");
+				ctx.logger.warn(error);
+				writeJson(response, 500, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "dataops-managed: skill-center connector catalogue");
 	await connectExisting();
 }
 /** Read and parse a JSON request body, tolerating an absent one. */
@@ -1402,4 +3576,4 @@ function writeJson(response, status, body) {
 	response.end(payload);
 }
 //#endregion
-export { Config, DEFAULT_TOOL_CALL_TIMEOUT_MS, MANAGED_AUTH_PATH, MANAGED_PLUGIN_ID, MODEL_SYNC_PATH, SKILL_PLAZA_PATH, TOOL_TIMEOUT_MAX_SECONDS, TOOL_TIMEOUT_MIN_SECONDS, TOOL_TIMEOUT_PATH, WORKSPACE_LIMITS_PATH, apply, currentModelSync, currentSettingsSync, currentSkillPlaza, currentWorkspaceLimits, inject, name };
+export { AUTH_STATE_PATH, Config, DEFAULT_TOOL_CALL_TIMEOUT_MS, DEPARTMENTS_PATH, MANAGED_AUTH_PATH, MANAGED_PLUGIN_ID, MODEL_SYNC_PATH, RBAC_PATH, REVIEW_ACTION_PATH, REVIEW_CONTEXT_PATH, REVIEW_NOTIFICATIONS_PATH, REVIEW_SETTINGS_PATH, SKILL_PLAZA_PATH, TOOL_TIMEOUT_MAX_SECONDS, TOOL_TIMEOUT_MIN_SECONDS, TOOL_TIMEOUT_PATH, WORKSPACE_LIMITS_PATH, WORKSPACE_UPGRADE_PATH, adoptRequestJwt, apply, currentModelSync, currentSettingsSync, currentSkillPlaza, currentWorkspaceLimits, inject, name };