@sparkelf/dsh-dataops-managed 0.3.23 → 0.3.25

package/lib/index.js

@@ -1,11 +1,11 @@
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import * as McpClient from "@sparkelf/dsh-plugin-mcp-credentials";
 import { BUNDLED_SKILL_RANK } from "@deepseek-ai/dsh-skill";
 import z from "@deepseek-ai/schemastery";
 import { defineTool } from "@deepseek-ai/dsh-tools";
-import { dirname, join } from "node:path";
+import { basename, dirname, extname, join } from "node:path";
 import { randomUUID } from "node:crypto";
 //#region src/auth-state.ts
 let state = "unknown";
@@ -811,11 +811,12 @@ var ReviewApi = class {
 			status: 503,
 			body: { error: "DataOps is not connected" }
 		};
+		const isMultipart = typeof FormData !== "undefined" && init.body instanceof FormData;
 		const response = await fetch(new URL(path, this.apiBase()), {
 			...init,
 			headers: {
 				authorization: `Bearer ${token}`,
-				...init.body === void 0 ? {} : { "content-type": "application/json" },
+				...init.body === void 0 || isMultipart ? {} : { "content-type": "application/json" },
 				...init.headers
 			}
 		});
@@ -870,7 +871,12 @@ const AI_TOOL_ACCESS = {
 	},
 	review_notifications_list: {},
 	review_notifications_read: {},
-	dataops_api_docs: { superAdminOnly: true }
+	dataops_api_docs: { superAdminOnly: true },
+	dataops_collect_preview: { permission: "data:resource:manage" },
+	dataops_collect_plan: { permission: "data:resource:manage" },
+	dataops_collect_execute: { permission: "data:resource:manage" },
+	dataops_collect_resources: { permission: "data:resource:read" },
+	dataops_open_resource_tab: {}
 };
 /** Every managed tool name, in the order the manager considers them. */
 const AI_TOOL_NAMES = Object.keys(AI_TOOL_ACCESS);
@@ -978,6 +984,104 @@ function normalizeScope(body) {
 	};
 }
 //#endregion
+//#region src/collect-api.ts
+/**
+* DataOps spreadsheet-import transport for the collection skill.
+*
+* The host reads a workspace attachment, uploads it as multipart, asks DataOps for a
+* create-table or existing-table plan, and only executes when the model calls the
+* execute tool after the user's plan confirmation. Nothing here creates a table on
+* preview/plan; execution is the single mutating call.
+*
+* @module collect-api
+*/
+/** Largest spreadsheet the DataOps importer accepts. */
+const COLLECT_FILE_MAX_BYTES = 20971520;
+/** Extensions the importer understands. */
+const SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([
+	".xlsx",
+	".xls",
+	".csv",
+	".tsv"
+]);
+const statusError = (result, operation) => {
+	const body = result.body;
+	const reason = typeof body?.error === "string" ? body.error : typeof body?.message === "string" ? body.message : "";
+	if (result.status === 401) return /* @__PURE__ */ new Error("Unauthorized (401): DataOps session expired");
+	if (result.status === 403) return /* @__PURE__ */ new Error("Forbidden (403): " + (reason || "the current role may not import resources"));
+	return /* @__PURE__ */ new Error(`${operation} failed: HTTP ${result.status}${reason ? ": " + reason : ""}`);
+};
+const unwrap = (result, operation) => {
+	if (result.status < 200 || result.status >= 300) throw statusError(result, operation);
+	return result.body;
+};
+/** Read and validate one spreadsheet attachment from the workspace. */
+const readCollectFile = async (filePath) => {
+	const trimmed = filePath.trim();
+	if (!trimmed) throw new Error("file_path is required");
+	const extension = extname(trimmed).toLowerCase();
+	if (!SUPPORTED_EXTENSIONS.has(extension)) throw new Error(`unsupported spreadsheet extension "${extension || "(none)"}"; expected .xlsx, .xls, .csv or .tsv`);
+	const info = await stat(trimmed);
+	if (!info.isFile()) throw new Error(`not a regular file: ${trimmed}`);
+	if (info.size <= 0) throw new Error(`empty file: ${trimmed}`);
+	if (info.size > 20971520) throw new Error(`file exceeds the ${(COLLECT_FILE_MAX_BYTES / 1024 / 1024).toFixed(0)}MB import limit`);
+	return {
+		buffer: await readFile(trimmed),
+		fileName: basename(trimmed),
+		sizeBytes: info.size
+	};
+};
+/** Spreadsheet import calls bound to one workspace credential. */
+var CollectApi = class {
+	reviewApi;
+	constructor(reviewApi) {
+		this.reviewApi = reviewApi;
+	}
+	async preview(filePath) {
+		const file = await readCollectFile(filePath);
+		const form = new FormData();
+		form.append("file", new Blob([new Uint8Array(file.buffer)]), file.fileName);
+		const result = await this.reviewApi.request("/api/resources/spreadsheet-import/preview", {
+			method: "POST",
+			body: form
+		});
+		return unwrap(result, "spreadsheet preview");
+	}
+	async dataSources() {
+		const result = await this.reviewApi.request("/api/resources/spreadsheet-import/data-sources", { method: "GET" });
+		const body = unwrap(result, "import data sources");
+		return Array.isArray(body.dataSources) ? body.dataSources : [];
+	}
+	async plan(payload) {
+		const result = await this.reviewApi.request("/api/resources/spreadsheet-import/plan", {
+			method: "POST",
+			body: JSON.stringify(payload)
+		});
+		return unwrap(result, "spreadsheet plan");
+	}
+	async execute(payload) {
+		const result = await this.reviewApi.request("/api/resources/spreadsheet-import/execute", {
+			method: "POST",
+			body: JSON.stringify(payload)
+		});
+		return unwrap(result, "spreadsheet execute");
+	}
+	async listResources(query = "", limit = 20) {
+		const result = await this.reviewApi.request("/api/resources", { method: "GET" });
+		const body = unwrap(result, "resource list");
+		const rows = Array.isArray(body.resources) ? body.resources : [];
+		const keyword = query.trim().toLowerCase();
+		return rows.filter((row) => row.resourceType === void 0 || row.resourceType === "TABLE").filter((row) => {
+			if (!keyword) return true;
+			return [
+				row.chineseName,
+				row.sourceTable,
+				row.urn
+			].filter(Boolean).join(" ").toLowerCase().includes(keyword);
+		}).slice(0, Math.max(1, Math.min(50, limit)));
+	}
+};
+//#endregion
 //#region src/api-docs.ts
 /** Raised when the upstream body is not an OpenAPI document this module can search. */
 var ApiDocsUnavailableError = class extends Error {};
@@ -1235,7 +1339,8 @@ const forbidden = (message) => /* @__PURE__ */ new Error("Forbidden (403): " + m
 * @param readScope - Live accessor for the manager's current scope.
 * @returns One definition per managed tool name.
 */
-function buildAiManagementTools(ctx, reviewApi, readScope) {
+function buildAiManagementTools(ctx, reviewApi, readScope, collectHub) {
+	const collectApi = new CollectApi(reviewApi);
 	const approve = async (tool, exec, reason) => {
 		if (exec.agent === void 0) throw new Error(tool + " requires an initiating agent");
 		const outcome = await ctx.approval.request({
@@ -1336,6 +1441,28 @@ function buildAiManagementTools(ctx, reviewApi, readScope) {
 			}
 		});
 	}
+	const parseJsonObject = (tool, label, value) => {
+		if (value === void 0 || value.trim() === "") return void 0;
+		let parsed;
+		try {
+			parsed = JSON.parse(value);
+		} catch {
+			throw new Error(tool + ": " + label + " must be valid JSON");
+		}
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(tool + ": " + label + " must be a JSON object");
+		return parsed;
+	};
+	const parseJsonArray = (tool, label, value) => {
+		if (value === void 0 || value.trim() === "") return [];
+		let parsed;
+		try {
+			parsed = JSON.parse(value);
+		} catch {
+			throw new Error(tool + ": " + label + " must be valid JSON");
+		}
+		if (!Array.isArray(parsed)) throw new Error(tool + ": " + label + " must be a JSON array");
+		return parsed;
+	};
 	return [
 		{
 			name: "skill_list",
@@ -1729,6 +1856,264 @@ function buildAiManagementTools(ctx, reviewApi, readScope) {
 					}
 				}
 			})
+		},
+		{
+			name: "dataops_collect_preview",
+			definition: defineTool({
+				name: "dataops_collect_preview",
+				description: "Parse one spreadsheet attachment from the workspace and return DataOps's preview plus the importable database destinations. Read-only: it does not create a table and does not write rows. Use this first in the data-collection skill, then ask the user to choose the destination when more than one is returned.",
+				parameters: {
+					file_path: {
+						type: "string",
+						required: true,
+						description: "Absolute or workspace-relative path to one .xlsx/.xls/.csv/.tsv file."
+					},
+					model_id: {
+						type: "number",
+						description: "Optional shared AI model id for the later plan call."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					const preview = await collectApi.preview(args.file_path);
+					const dataSources = await collectApi.dataSources();
+					audit("dataops_collect_preview", exec, {
+						filePath: args.file_path,
+						sessionId: preview.sessionId,
+						dataSourceCount: dataSources.length
+					});
+					return {
+						sessionId: preview.sessionId,
+						preview,
+						dataSources
+					};
+				}
+			})
+		},
+		{
+			name: "dataops_collect_plan",
+			definition: defineTool({
+				name: "dataops_collect_plan",
+				description: "Generate a create-table plan or an existing-table field mapping for a parsed spreadsheet session. Read-only: DataOps only plans, it does not execute DDL or write rows. Call this after the user has chosen a data source; pass root_schema + root_table only when appending to an existing table.",
+				parameters: {
+					session_id: {
+						type: "string",
+						required: true,
+						description: "Session id returned by dataops_collect_preview."
+					},
+					data_source_urn: {
+						type: "string",
+						required: true,
+						description: "Destination URN from the preview result."
+					},
+					target_schema: {
+						type: "string",
+						description: "Existing-table schema; required when root_table is set."
+					},
+					target_table: {
+						type: "string",
+						description: "Existing table name; omit to create a new table."
+					},
+					model_id: {
+						type: "number",
+						description: "Optional shared AI model id."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					const plan = await collectApi.plan({
+						sessionId: args.session_id,
+						dataSourceUrn: args.data_source_urn,
+						...args.target_table ? { targetTable: {
+							schema: args.target_schema || "",
+							table: args.target_table
+						} } : {},
+						...args.model_id === void 0 ? {} : { modelId: args.model_id }
+					});
+					audit("dataops_collect_plan", exec, {
+						sessionId: args.session_id,
+						dataSourceUrn: args.data_source_urn,
+						targetTable: args.target_table ?? null
+					});
+					return plan;
+				}
+			})
+		},
+		{
+			name: "dataops_collect_execute",
+			definition: defineTool({
+				name: "dataops_collect_execute",
+				description: "Execute one confirmed spreadsheet import: create a table (or write to an existing table), insert rows, and register the DataOps resource. This is the ONLY collection tool that mutates data. Call it only after the user explicitly clicked the plan's \"开始导入\" action; never call it while the plan is still being edited.",
+				parameters: {
+					session_id: {
+						type: "string",
+						required: true,
+						description: "Session id from dataops_collect_preview."
+					},
+					data_source_urn: {
+						type: "string",
+						required: true,
+						description: "Destination URN."
+					},
+					mode: {
+						type: "string",
+						required: true,
+						description: "CREATE_TABLE or EXISTING_TABLE."
+					},
+					target_schema: {
+						type: "string",
+						description: "Target schema for EXISTING_TABLE."
+					},
+					target_table: {
+						type: "string",
+						description: "Target table for EXISTING_TABLE."
+					},
+					create_plan_json: {
+						type: "string",
+						description: "JSON object returned as plan.createTable, edited by the user."
+					},
+					mappings_json: {
+						type: "string",
+						description: "JSON array of {sourceKey,targetColumn} for EXISTING_TABLE."
+					},
+					resource_name: {
+						type: "string",
+						description: "Resource display name drafted by the plan and confirmed by the user."
+					},
+					resource_description: {
+						type: "string",
+						description: "Optional resource description."
+					},
+					resource_tags: {
+						type: "array",
+						items: { type: "string" },
+						description: "Optional resource tags."
+					},
+					ai_visible: {
+						type: "boolean",
+						description: "Whether AI may retrieve this resource. Defaults to true."
+					},
+					access_level: {
+						type: "string",
+						description: "PUBLIC, PROTECTED or PRIVATE. Defaults to PRIVATE."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					if (args.mode !== "CREATE_TABLE" && args.mode !== "EXISTING_TABLE") throw new Error("dataops_collect_execute: mode must be CREATE_TABLE or EXISTING_TABLE");
+					const createPlan = parseJsonObject("dataops_collect_execute", "create_plan_json", args.create_plan_json);
+					const mappings = parseJsonArray("dataops_collect_execute", "mappings_json", args.mappings_json);
+					if (args.mode === "CREATE_TABLE" && createPlan === void 0) throw new Error("dataops_collect_execute: create_plan_json is required for CREATE_TABLE");
+					if (args.mode === "EXISTING_TABLE" && (!args.target_schema || !args.target_table)) throw new Error("dataops_collect_execute: target_schema and target_table are required for EXISTING_TABLE");
+					const payload = {
+						sessionId: args.session_id,
+						dataSourceUrn: args.data_source_urn,
+						mode: args.mode,
+						mappings,
+						...createPlan === void 0 ? {} : { createPlan },
+						...args.target_schema && args.target_table ? { targetTable: {
+							schema: args.target_schema,
+							table: args.target_table
+						} } : {},
+						...args.resource_name === void 0 ? {} : { resourceName: args.resource_name },
+						...args.resource_description === void 0 ? {} : { resourceDescription: args.resource_description },
+						...args.resource_tags === void 0 ? {} : { resourceTags: args.resource_tags },
+						...args.ai_visible === void 0 ? {} : { aiVisible: args.ai_visible },
+						...args.access_level === void 0 ? {} : { accessLevel: args.access_level }
+					};
+					const result = await collectApi.execute(payload);
+					const resource = result.resource;
+					audit("dataops_collect_execute", exec, {
+						sessionId: args.session_id,
+						mode: args.mode,
+						resourceId: resource?.id ?? null,
+						importedRows: result.importedRows ?? null
+					});
+					return result;
+				}
+			})
+		},
+		{
+			name: "dataops_collect_resources",
+			definition: defineTool({
+				name: "dataops_collect_resources",
+				description: "Search the current DataOps resource catalog for an append target. Read-only and scoped by DataOps resource visibility. Use it when the user chooses \"追加到已有资源\" instead of a remote select control.",
+				parameters: {
+					query: {
+						type: "string",
+						description: "Resource name, table name or URN keyword."
+					},
+					limit: {
+						type: "number",
+						description: "Maximum rows (default 20, max 50)."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args) => {
+					return { resources: await collectApi.listResources(args.query ?? "", args.limit ?? 20) };
+				}
+			})
+		},
+		{
+			name: "dataops_open_resource_tab",
+			definition: defineTool({
+				name: "dataops_open_resource_tab",
+				description: "Open or focus the DataOps resource tab in the right sidebar. This only navigates the browser: it does not grant access or mutate data. Use mode=focus after an import succeeds, grant for 分配权限, detail for 查看详情, and audit for 查看操作记录.",
+				parameters: {
+					resource_id: {
+						type: "number",
+						required: true,
+						description: "DataOps resource id."
+					},
+					resource_name: {
+						type: "string",
+						description: "Display name used as the tab subtitle."
+					},
+					mode: {
+						type: "string",
+						description: "focus | grant | detail | audit. Defaults to focus."
+					}
+				},
+				output: {
+					schema: OPEN_OBJECT_SCHEMA,
+					render: renderJson
+				},
+				execute: async (args, exec) => {
+					if (!Number.isSafeInteger(args.resource_id) || args.resource_id <= 0) throw new Error("dataops_open_resource_tab: resource_id must be a positive integer");
+					const requested = args.mode ?? "focus";
+					const mode = requested === "grant" || requested === "detail" || requested === "audit" ? requested : "focus";
+					const payload = collectHub.broadcast({
+						resourceId: args.resource_id,
+						resourceName: args.resource_name ?? null,
+						mode,
+						nonce: Date.now().toString(36) + Math.random().toString(36).slice(2, 8)
+					});
+					audit("dataops_open_resource_tab", exec, {
+						resourceId: args.resource_id,
+						mode,
+						subscribers: collectHub.size()
+					});
+					return {
+						opened: collectHub.size() > 0,
+						mode,
+						resourceId: args.resource_id,
+						requestId: payload.requestId,
+						subscribers: collectHub.size()
+					};
+				}
+			})
 		}
 	];
 }
@@ -1744,6 +2129,7 @@ function buildAiManagementTools(ctx, reviewApi, readScope) {
 var AiToolManager = class {
 	ctx;
 	reviewApi;
+	collectHub;
 	definitions;
 	registrations = /* @__PURE__ */ new Map();
 	unsubscribeExpiry;
@@ -1752,10 +2138,11 @@ var AiToolManager = class {
 	revision = 0;
 	inflight;
 	disposed = false;
-	constructor(ctx, reviewApi) {
+	constructor(ctx, reviewApi, collectHub) {
 		this.ctx = ctx;
 		this.reviewApi = reviewApi;
-		this.definitions = new Map(buildAiManagementTools(ctx, reviewApi, () => this.scope).map((tool) => [tool.name, tool.definition]));
+		this.collectHub = collectHub;
+		this.definitions = new Map(buildAiManagementTools(ctx, reviewApi, () => this.scope, this.collectHub).map((tool) => [tool.name, tool.definition]));
 		this.unsubscribeExpiry = onAuthStateChange((state) => {
 			if (state === "expired") this.clear();
 		});
@@ -1911,6 +2298,119 @@ var AiToolManager = class {
 	}
 };
 //#endregion
+//#region src/resource-tab.ts
+/** SSE route the client subscribes to. */
+const OPEN_RESOURCE_EVENTS_PATH = "/integrations/dataops/open-resource/events";
+/** Same-origin route the client uses to learn where the DataOps frontend lives. */
+const RESOURCE_TAB_CONFIG_PATH = "/integrations/dataops/resource-tab/config";
+/** Browser tab type registered by the client half. */
+const RESOURCE_TAB_TYPE = "dataops-resources";
+/**
+* Fan-out registry for the workspace's live SSE subscribers.
+*
+* A workspace has one browser in the normal case, but a reconnect can briefly leave the
+* previous response open. Broadcasting to the current set makes the new connection and the
+* stale one harmless: the browser keeps one tab, and the client dedupes by resource tab id.
+*/
+var OpenResourceHub = class {
+	logger;
+	clients = /* @__PURE__ */ new Set();
+	heartbeat;
+	constructor(logger) {
+		this.logger = logger;
+	}
+	/** Accept one SSE subscription and own its response until the client disconnects. */
+	subscribe(request, response) {
+		response.writeHead(200, {
+			"content-type": "text/event-stream; charset=utf-8",
+			"cache-control": "no-cache, no-transform",
+			connection: "keep-alive",
+			"x-accel-buffering": "no"
+		});
+		response.write(": connected\n\n");
+		this.clients.add(response);
+		this.ensureHeartbeat();
+		const remove = () => {
+			this.clients.delete(response);
+			if (this.clients.size === 0 && this.heartbeat !== void 0) {
+				clearInterval(this.heartbeat);
+				this.heartbeat = void 0;
+			}
+		};
+		request.on("close", remove);
+		request.on("aborted", remove);
+		response.on("error", (error) => {
+			this.logger.warn("dataops-managed: resource tab SSE response failed: " + String(error));
+			remove();
+		});
+	}
+	/** Send one navigation event to every connected client. */
+	broadcast(event) {
+		const payload = {
+			type: "open_resource",
+			requestId: event.requestId ?? randomUUID(),
+			resourceId: event.resourceId,
+			resourceName: event.resourceName,
+			mode: event.mode,
+			nonce: event.nonce
+		};
+		const frame = "event: dataops-open-resource\ndata: " + JSON.stringify(payload) + "\n\n";
+		for (const client of this.clients) try {
+			client.write(frame);
+		} catch (error) {
+			this.clients.delete(client);
+			this.logger.warn("dataops-managed: resource tab SSE write failed: " + String(error));
+		}
+		return payload;
+	}
+	/** Number of live subscribers, used by the tool result to explain a missing browser. */
+	size() {
+		return this.clients.size;
+	}
+	/** Close every subscriber; called by the plugin disposer. */
+	dispose() {
+		if (this.heartbeat !== void 0) clearInterval(this.heartbeat);
+		this.heartbeat = void 0;
+		for (const client of this.clients) try {
+			client.end();
+		} catch {}
+		this.clients.clear();
+	}
+	ensureHeartbeat() {
+		if (this.heartbeat !== void 0) return;
+		this.heartbeat = setInterval(() => {
+			for (const client of this.clients) try {
+				client.write(": keep-alive\n\n");
+			} catch {
+				this.clients.delete(client);
+			}
+		}, 25e3);
+		this.heartbeat.unref?.();
+	}
+};
+/** Resolve the browser-facing DataOps origin for the iframe. */
+const resolveResourceTabConfig = (request, configuredWebBaseUrl) => {
+	const header = (name) => {
+		const value = request.headers[name];
+		return Array.isArray(value) ? value[0] : value;
+	};
+	const forwardedProto = header("x-forwarded-proto")?.split(",")[0]?.trim();
+	const host = header("x-forwarded-host")?.split(",")[0]?.trim() || header("host") || "";
+	const requestOrigin = host ? `${forwardedProto || "http"}://${host}` : "";
+	const embedBaseUrl = configuredWebBaseUrl?.trim() || requestOrigin || "http://127.0.0.1:8080";
+	let sameOrigin = false;
+	try {
+		sameOrigin = new URL(embedBaseUrl).origin === requestOrigin;
+	} catch {
+		sameOrigin = false;
+	}
+	return {
+		embedBaseUrl,
+		sameOrigin,
+		tabType: RESOURCE_TAB_TYPE
+	};
+};
+//#endregion
 //#region src/connector-state.ts
 /**
 * The DataOps connector's workspace-visible state and skill-center catalogue.
@@ -1930,40 +2430,67 @@ const CONNECTORS_PATH = "/api/dsh-skill-center/connectors";
 const DATAOPS_CONNECTOR_ID = "dataops-managed";
 /** Resolve the persisted state file without depending on a global DSH path. */
 const CONNECTOR_STATE_PATH = join(process.env.DSH_HOME?.trim() || "/workspace/.dataops/dsh", "dataops-managed", "connector-state.json");
-/** Capability definitions before permission filtering. */
+/**
+* Capability definitions before permission filtering.
+*
+* The set and its order follow `dataops/docs/dataops-connector-development-spec.md` §2.3,
+* whose credential `requiredFor` list is `approval.push`, `data.query`, and `admin.manage`.
+* Skill plaza and review queue are governed by `skill:*` permissions and stay out of the
+* connector's capability switches.
+*/
 const CAPABILITIES = [
-	{
-		id: "skill.plaza",
-		name: "技能广场",
-		description: "读取、安装和管理当前账号可见的技能",
-		allowed: (scope) => hasPermission(scope, "skill:read")
-	},
-	{
-		id: "review.queue",
-		name: "审核队列",
-		description: "查看待审技能、扫描风险并给出审核结论",
-		allowed: (scope) => canReview(scope)
-	},
 	{
 		id: "data.query",
 		name: "数据查询",
 		description: "通过 DataOps 数据查询能力回答业务问题",
+		defaultEnabled: true,
 		allowed: () => true
 	},
 	{
-		id: "api.docs",
-		name: "管理接口文档",
-		description: "仅超级管理员可查询 DataOps OpenAPI 接口文档",
-		allowed: (scope) => isSuperAdmin(scope)
+		id: "approval.push",
+		name: "审批资源",
+		description: "读取/办理万相中台的审批任务，并把状态回写",
+		defaultEnabled: true,
+		allowed: (scope) => canReview(scope)
+	},
+	{
+		id: "admin.manage",
+		name: "万相中台管理",
+		description: "登录万相中台后台执行管理动作",
+		defaultEnabled: true,
+		allowed: (scope) => isAdmin(scope)
 	}
 ];
+/** The ids the catalogue accepts; any other persisted key is a legacy value. */
+const CAPABILITY_IDS = CAPABILITIES.map((capability) => capability.id);
+/**
+* Keep only boolean values for known capability ids.
+*
+* A state file written before the catalogue changed may still hold retired ids. Those keys are
+* ignored rather than treated as a corrupt file; a missing new key takes the capability's
+* `defaultEnabled`.
+* @param value - the `capabilities` member of a parsed state file.
+* @returns the readable toggles, keyed by current capability id.
+*/
+function migrateCapabilities(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return {};
+	const stored = value;
+	const capabilities = {};
+	for (const id of CAPABILITY_IDS) if (typeof stored[id] === "boolean") capabilities[id] = stored[id];
+	return capabilities;
+}
 /** Read state; a missing or corrupt file is a safe disabled state. */
 async function readConnectorState(path = CONNECTOR_STATE_PATH) {
 	try {
 		const payload = JSON.parse(await readFile(path, "utf8"));
+		if (typeof payload !== "object" || payload === null || Array.isArray(payload)) return {
+			enabled: false,
+			capabilities: {}
+		};
+		const record = payload;
 		return {
-			enabled: payload.enabled === true,
-			capabilities: typeof payload.capabilities === "object" && payload.capabilities !== null ? { ...payload.capabilities } : {}
+			enabled: record.enabled === true,
+			capabilities: migrateCapabilities(record.capabilities)
 		};
 	} catch {
 		return {
@@ -1976,7 +2503,11 @@ async function readConnectorState(path = CONNECTOR_STATE_PATH) {
 async function writeConnectorState(state, path = CONNECTOR_STATE_PATH) {
 	await mkdir(dirname(path), { recursive: true });
 	const temporary = path + ".tmp-" + process.pid.toString();
-	await writeFile(temporary, JSON.stringify(state, null, 2), "utf8");
+	const payload = {
+		enabled: state.enabled,
+		capabilities: migrateCapabilities(state.capabilities)
+	};
+	await writeFile(temporary, JSON.stringify(payload, null, 2), "utf8");
 	await rename(temporary, path);
 }
 /** Build the connector row for one current scope. */
@@ -1985,7 +2516,7 @@ function buildConnectorView(scope, state) {
 		id: capability.id,
 		name: capability.name,
 		description: capability.description,
-		enabled: state.capabilities[capability.id] !== false,
+		enabled: state.capabilities[capability.id] ?? capability.defaultEnabled,
 		permitted: true
 	}));
 	return {
@@ -2430,8 +2961,7 @@ const inject = [
 	"tools",
 	"settings",
 	"skills",
-	"approval",
-	"agents"
+	"approval"
 ];
 const MANAGED_AUTH_PATH = "/integrations/dataops/managed-auth";
 /** This plugin's profile entry id, which owns its Config and sync state. */
@@ -2514,6 +3044,7 @@ const MODEL_SYNC_DEFAULT = {
 /** Schemastery parser for managed DataOps configuration. */
 const Config = z.object({
 	baseUrl: z.string().default("http://host.docker.internal:3101"),
+	webBaseUrl: z.string().default(""),
 	serverName: z.string().default("dataops"),
 	credentialRef: z.string().role("credential-ref").default("DATAOPS_ACCESS_TOKEN"),
 	/**
@@ -2614,6 +3145,43 @@ const querySkillProvider = {
 		};
 	}
 };
+/** The skill this plugin contributes: turn one spreadsheet into a queryable resource. */
+const COLLECT_SKILL_NAME = "dataops-collect";
+/** Location of the collection skill document inside the published package. */
+const COLLECT_SKILL_FILE = new URL("../skills/dataops-collect/SKILL.md", import.meta.url);
+/**
+* Describe the collection skill to the catalog without reading it.
+*
+* The description carries the natural-language triggers so a request like "把这份表格建成
+* 能问数的资源" selects this skill before the model sees the body.
+*/
+const COLLECT_SKILL = {
+	name: COLLECT_SKILL_NAME,
+	description: "把表格 / Excel / CSV 建成可问数的数据资源，或把新表格追加到已有资源时使用。包含新建与追加的分岔、计划确认、建表写入、权限入口和结果汇报；确认计划前绝不建表。",
+	invocation: {
+		modelInvocable: true,
+		userInvocable: true
+	},
+	provider: COLLECT_SKILL_NAME,
+	source: "bundled",
+	resourceBase: {
+		kind: "directory",
+		path: fileURLToPath(new URL("../", import.meta.url))
+	},
+	rank: BUNDLED_SKILL_RANK,
+	locator: COLLECT_SKILL_FILE
+};
+/** Serve the collection skill to the catalog. */
+const collectSkillProvider = {
+	name: COLLECT_SKILL_NAME,
+	list: () => Promise.resolve([COLLECT_SKILL]),
+	async get() {
+		return {
+			...COLLECT_SKILL,
+			content: await readFile(COLLECT_SKILL_FILE, "utf8")
+		};
+	}
+};
 /**
 * Accept the current DataOps JWT and expose DataOps MCP tools through its credential.
 * @param ctx - DSH Host context with credentials, Web routes, and tools.
@@ -2625,6 +3193,7 @@ async function apply(ctx, config) {
 	const accessRef = credentialRef(config.credentialRef);
 	let mcpFiber;
 	ctx.skills.registerProvider(() => querySkillProvider);
+	ctx.skills.registerProvider(() => collectSkillProvider);
 	const ensureMcp = async () => {
 		if (mcpFiber !== void 0 && mcpFiber.uid !== null) return;
 		const fiber = ctx.plugin(McpClient, {
@@ -2744,6 +3313,25 @@ async function apply(ctx, config) {
 		credentialRef: config.credentialRef
 	});
 	reviewApiRef = reviewApi;
+	const resourceTabHub = new OpenResourceHub(ctx.logger);
+	ctx.effect(() => () => resourceTabHub.dispose(), "dataops-managed: resource tab SSE clients");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: OPEN_RESOURCE_EVENTS_PATH,
+		handler: (request, response) => resourceTabHub.subscribe(request, response)
+	}), "dataops-managed: resource tab SSE route");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: RESOURCE_TAB_CONFIG_PATH,
+		handler: (request, response) => {
+			const payload = resolveResourceTabConfig(request, config.webBaseUrl);
+			response.writeHead(200, {
+				"content-type": "application/json; charset=utf-8",
+				"cache-control": "no-store"
+			});
+			response.end(JSON.stringify(payload));
+		}
+	}), "dataops-managed: resource tab config route");
 	/**
 	* The managed tool list follows the workspace's DataOps scope.
 	*
@@ -2753,7 +3341,7 @@ async function apply(ctx, config) {
 	* publishes this event after the write commits. The manager also observes the review-context
 	* route's answer, because a role edit does not change the JWT but does change the scope.
 	*/
-	const aiTools = new AiToolManager(ctx, reviewApi);
+	const aiTools = new AiToolManager(ctx, reviewApi, resourceTabHub);
 	ctx.effect(() => () => aiTools.dispose(), "dataops-managed: skill and review tool disclosure");
 	ctx.effect(() => ctx.on("credentials/reference-updated", (ref) => {
 		if (String(ref) !== config.credentialRef) return;