@sparkelf/dsh-dataops-managed 0.3.27 → 0.3.29

package/lib/index.js

@@ -1463,6 +1463,41 @@ function buildAiManagementTools(ctx, reviewApi, readScope, collectHub) {
 		if (!Array.isArray(parsed)) throw new Error(tool + ": " + label + " must be a JSON array");
 		return parsed;
 	};
+	/**
+	* Keep only the fields the DataOps execute DTO accepts. The plan tool returns
+	* `createSql`/`targetSchema`/`notes` beside `createTable`; if the model passes
+	* the whole plan (or rebuilds it after a table-name edit), the backend's
+	* `forbidNonWhitelisted` pipe rejects the call with a generic 400.
+	*/
+	const normalizeCreatePlan = (tool, plan) => {
+		if (plan === void 0) return void 0;
+		const tableName = typeof plan.tableName === "string" ? plan.tableName.trim() : "";
+		if (!tableName) throw new Error(tool + ": create_plan_json.tableName is required");
+		const rawColumns = Array.isArray(plan.columns) ? plan.columns : [];
+		if (!rawColumns.length) throw new Error(tool + ": create_plan_json.columns is required");
+		const columns = rawColumns.map((raw, index) => {
+			const column = raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+			const sourceKey = typeof column.sourceKey === "string" ? column.sourceKey : "";
+			const name = typeof column.name === "string" ? column.name : "";
+			const chineseName = typeof column.chineseName === "string" ? column.chineseName : "";
+			const dataType = typeof column.dataType === "string" ? column.dataType : "";
+			if (!sourceKey || !name || !chineseName || !dataType) throw new Error(tool + ": create_plan_json.columns[" + index + "] needs sourceKey/name/chineseName/dataType");
+			return {
+				sourceKey,
+				name,
+				chineseName,
+				dataType,
+				...typeof column.nullable === "boolean" ? { nullable: column.nullable } : {},
+				...typeof column.comment === "string" ? { comment: column.comment } : {}
+			};
+		});
+		return {
+			tableName,
+			...typeof plan.tableChineseName === "string" && plan.tableChineseName.trim() ? { tableChineseName: plan.tableChineseName.trim() } : {},
+			...typeof plan.tableComment === "string" && plan.tableComment.trim() ? { tableComment: plan.tableComment.trim() } : {},
+			columns
+		};
+	};
 	return [
 		{
 			name: "skill_list",
@@ -1949,7 +1984,7 @@ function buildAiManagementTools(ctx, reviewApi, readScope, collectHub) {
 			name: "dataops_collect_execute",
 			definition: defineTool({
 				name: "dataops_collect_execute",
-				description: "Execute one confirmed spreadsheet import: create a table (or write to an existing table), insert rows, and register the DataOps resource. This is the ONLY collection tool that mutates data. Call it only after the user explicitly clicked the plan's \"开始导入\" action; never call it while the plan is still being edited.",
+				description: "Execute one confirmed spreadsheet import: create a table (or write to an existing table), insert rows, and register the DataOps resource. This is the ONLY collection tool that mutates data. Call it only after the user explicitly confirms the read-only plan in natural language (e.g. 确认/开始吧); never call it while the plan is still being edited.",
 				parameters: {
 					session_id: {
 						type: "string",
@@ -1976,7 +2011,7 @@ function buildAiManagementTools(ctx, reviewApi, readScope, collectHub) {
 					},
 					create_plan_json: {
 						type: "string",
-						description: "JSON object returned as plan.createTable, edited by the user."
+						description: "Only plan.createTable (tableName/tableChineseName/tableComment/columns). Do not send createSql/targetSchema/notes; if the user edits the table name, call dataops_collect_plan again and pass its createTable."
 					},
 					mappings_json: {
 						type: "string",
@@ -2010,7 +2045,7 @@ function buildAiManagementTools(ctx, reviewApi, readScope, collectHub) {
 				},
 				execute: async (args, exec) => {
 					if (args.mode !== "CREATE_TABLE" && args.mode !== "EXISTING_TABLE") throw new Error("dataops_collect_execute: mode must be CREATE_TABLE or EXISTING_TABLE");
-					const createPlan = parseJsonObject("dataops_collect_execute", "create_plan_json", args.create_plan_json);
+					const createPlan = normalizeCreatePlan("dataops_collect_execute", parseJsonObject("dataops_collect_execute", "create_plan_json", args.create_plan_json));
 					const mappings = parseJsonArray("dataops_collect_execute", "mappings_json", args.mappings_json);
 					if (args.mode === "CREATE_TABLE" && createPlan === void 0) throw new Error("dataops_collect_execute: create_plan_json is required for CREATE_TABLE");
 					if (args.mode === "EXISTING_TABLE" && (!args.target_schema || !args.target_table)) throw new Error("dataops_collect_execute: target_schema and target_table are required for EXISTING_TABLE");
@@ -2433,10 +2468,10 @@ const CONNECTOR_STATE_PATH = join(process.env.DSH_HOME?.trim() || "/workspace/.d
 /**
 * Capability definitions before permission filtering.
 *
-* The set and its order follow `dataops/docs/dataops-connector-development-spec.md` §2.3,
-* whose credential `requiredFor` list is `approval.push`, `data.query`, and `admin.manage`.
-* Skill plaza and review queue are governed by `skill:*` permissions and stay out of the
-* connector's capability switches.
+* The set follows `dataops/docs/dataops-connector-development-spec.md` §2.3's credential list.
+* `approval.push` was renamed to `resource.manage` when the capability grew from approval push
+* into resource approval and authorization. Skill plaza and review queue are governed by
+* `skill:*` permissions and stay out of the connector's capability switches.
 */
 const CAPABILITIES = [
 	{
@@ -2444,23 +2479,34 @@ const CAPABILITIES = [
 		name: "数据查询",
 		description: "通过 DataOps 数据查询能力回答业务问题",
 		defaultEnabled: true,
+		visible: () => true,
 		allowed: () => true
 	},
 	{
-		id: "approval.push",
-		name: "审批资源",
-		description: "读取/办理万相中台的审批任务，并把状态回写",
+		id: "resource.manage",
+		name: "资源管理",
+		description: "在对话中批量审批资源申请，给用户或角色授予资源访问权限",
 		defaultEnabled: true,
-		allowed: (scope) => canReview(scope)
+		visible: (scope) => isAdmin(scope),
+		allowed: (scope) => isAdmin(scope)
 	},
 	{
 		id: "admin.manage",
 		name: "万相中台管理",
 		description: "登录万相中台后台执行管理动作",
 		defaultEnabled: true,
+		visible: (scope) => isAdmin(scope),
 		allowed: (scope) => isAdmin(scope)
 	}
 ];
+/**
+* Persisted ids that moved to a new capability id.
+*
+* `approval.push` shipped before the capability grew from approval push into resource
+* approval and authorization. Its stored toggle carries over to `resource.manage`; when both
+* keys are present the current id wins.
+*/
+const CAPABILITY_ALIASES = { "approval.push": "resource.manage" };
 /** The ids the catalogue accepts; any other persisted key is a legacy value. */
 const CAPABILITY_IDS = CAPABILITIES.map((capability) => capability.id);
 /**
@@ -2477,6 +2523,7 @@ function migrateCapabilities(value) {
 	const stored = value;
 	const capabilities = {};
 	for (const id of CAPABILITY_IDS) if (typeof stored[id] === "boolean") capabilities[id] = stored[id];
+	for (const [legacyId, id] of Object.entries(CAPABILITY_ALIASES)) if (capabilities[id] === void 0 && typeof stored[legacyId] === "boolean") capabilities[id] = stored[legacyId];
 	return capabilities;
 }
 /** Read state; a missing or corrupt file is a safe disabled state. */
@@ -2512,7 +2559,7 @@ async function writeConnectorState(state, path = CONNECTOR_STATE_PATH) {
 }
 /** Build the connector row for one current scope. */
 function buildConnectorView(scope, state) {
-	const capabilities = scope === void 0 ? [] : CAPABILITIES.filter((capability) => capability.allowed(scope)).map((capability) => ({
+	const capabilities = scope === void 0 ? [] : CAPABILITIES.filter((capability) => capability.visible(scope) && capability.allowed(scope)).map((capability) => ({
 		id: capability.id,
 		name: capability.name,
 		description: capability.description,

package/lib/types/client/DataOpsResourcesTab.d.ts

@@ -21,7 +21,11 @@ export interface DataOpsResourcesTabProps {
     };
     tab: ResourceTabRecord;
     visible?: boolean;
-    sendReference?: (text: string, sessionId?: string) => Promise<void>;
+    insertResourceReference?: (resource: {
+        id?: unknown;
+        name?: unknown;
+        table?: unknown;
+    }, reference: Record<string, unknown>, sessionId?: string) => void;
 }
 /** Render the embedded DataOps resource page and translate its parent messages. */
-export declare function DataOpsResourcesTab({ tab, scope, sendReference }: DataOpsResourcesTabProps): import("react").JSX.Element;
+export declare function DataOpsResourcesTab({ tab, scope, insertResourceReference }: DataOpsResourcesTabProps): import("react").JSX.Element;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sparkelf/dsh-dataops-managed",
-  "version": "0.3.27",
+  "version": "0.3.29",
   "description": "DataOps JWT intake and credential-backed MCP tools for managed DeepSeek Harness workspaces.",
   "type": "module",
   "main": "./lib/index.js",

package/skills/dataops-collect/SKILL.md

@@ -38,7 +38,7 @@ description: 把表格 / Excel / CSV 建成可问数的数据资源，或把新
 
 1. **一次会话一份文件、一个目标资源。** 多文件批量不做。
 2. **有引用 = 追加；无引用 = 先问，不默认新建。** 用户话里已经说清“新建”或“追加”的，跳过这一问；没说清又没引用，必须先出「新建资源 / 选择已有资源」二选一，不能直接出新建计划。
-3. **计划确认是唯一硬闸。** 用户点「开始导入」之前，绝不调用 `dataops_collect_execute`，绝不建表、绝不写数。预览和计划工具本身不建表，可以放心调用。
+3. **计划确认是唯一硬闸。** 用户明确回复「确认」「开始吧」「可以」等之前，绝不调用 `dataops_collect_execute`，绝不建表、绝不写数。预览和计划工具本身不建表，可以放心调用。
 4. **执行走原生工具流。** 不要自己造执行卡、进度卡；工具参数、结果、耗时、失败原因都在原生工具卡里。你只在旁边说人话。
 
 ## 三、主流程
@@ -86,43 +86,42 @@ description: 把表格 / Excel / CSV 建成可问数的数据资源，或把新
 - 新建表：`plan.mode === 'CREATE_TABLE'`，有 `plan.createTable`、`plan.createSql`；
 - 追加：`plan.mode === 'EXISTING_TABLE'`，有 `plan.mappings`，并在计划里多一行映射摘要（匹配 N 个字段、新增 N 个、N 个类型不兼容）。
 
-### 5. 出计划 GenUI
+### 5. 出计划 GenUI（只读预览，语言确认）
 
-计划是主确认点。必须包含：
+计划是主确认点，但**只读**：卡上不放 `input` / `textarea` / 下拉 / `submit`，也不放「开始导入」「再调整」按钮。用户看完卡后，直接用自然语言回复「确认」「开始吧」才执行。
 
-- 资源名（AI 起草，可改）
-- 目标表（原始层库表名，AI 起草，可改）
-- 导入数据源（只有一个源时自动选中并置灰；多个源时让用户选）
-- 字段总数，以及哪几个类型拿不准（标黄 / 写“需确认”）
-- 去向（新建资源 / 追加到某个已有资源）
-- 描述与标签（AI 起草，可改）
-- 默认权限（仅自己可见）
+必须包含（全部纯展示）：
 
-底部只有一组主次按钮：**开始导入**（`submit`，提交资源名/表名/描述）和 **再调整**（`button`）。不要做第二个确认步骤。
+- 资源名（AI 起草）
+- 去向（新建资源 / 追加到「已有资源名」）
+- 目标表（库.表）
+- 导入数据源
+- 行数 / 字段数
+- **表头映射**：原表头 → 目标字段 → 类型；低置信度类型写「需确认」，并用 warning callout 再列一遍（GenUI 表格单元格不支持单独标黄）
+- 默认权限
 
-计划 GenUI 示例（把 `<...>` 换成真实值）：
+计划 GenUI 示例（把 `<...>` 换成真实值；注意没有任何输入控件）：
 
 ```dsh-ui
-{"title":"导入计划","items":[{"type":"text","size":"body","content":"看了下，明细 sheet 共 <行数> 行、<列数> 列；我先按明细建资源。"},{"type":"card","title":"<资源名>","items":[{"type":"keyvalue","pairs":[{"key":"去向","value":"新建资源"},{"key":"导入数据源","value":"<数据源名>"},{"key":"目标表","value":"<schema.table>"},{"key":"字段","value":"<字段数> 列（<需确认数> 列类型需确认）"},{"key":"默认权限","value":"仅自己可见"}]},{"type":"table","columns":["字段","类型","说明"],"rows":[["<字段1>","<类型>","<说明>"],["<字段2>","<类型>","需确认"]]},{"type":"input","id":"resourceName","label":"资源名","value":"<资源名>"},{"type":"input","id":"tableName","label":"目标表","value":"<目标表>"},{"type":"textarea","id":"description","label":"描述与标签","value":"<描述>"},{"type":"submit","label":"开始导入","action":"dataops_collect_confirm","groups":["resourceName","tableName","description"]},{"type":"button","label":"再调整","tone":"ghost","action":"dataops_collect_adjust"}]}]}
+{"title":"导入计划","items":[{"type":"text","size":"body","content":"看了下，明细 sheet 共 <行数> 行、<列数> 列；我先按明细建资源。"},{"type":"card","title":"<资源名>","items":[{"type":"keyvalue","pairs":[{"key":"资源名","value":"<资源名>"},{"key":"去向","value":"新建资源"},{"key":"目标表","value":"<schema.table>"},{"key":"导入数据源","value":"<数据源名>"},{"key":"行数 / 字段数","value":"<行数> 行 / <字段数> 列"},{"key":"默认权限","value":"仅自己可见"}]},{"type":"table","columns":["原表头","目标字段","类型"],"rows":[["<原表头1>","<目标字段1>","<类型1>"],["<原表头2>","<目标字段2>","⚠️ 需确认"]]},{"type":"callout","tone":"warning","content":"以下类型需要确认：<列出低置信度字段>。"},{"type":"callout","tone":"info","content":"确认无误请直接回复「确认」或「开始吧」；要改表名、类型或资源名，直接说，我会重新出计划，不会执行。"}]}]}
 ```
 
 规则：
 
-- 用户点「再调整」后，只在对话里改参数，然后重新调用 `dataops_collect_plan` / 修改计划，**不要执行**；
-- 用户改了参数，重新出计划，不直接执行；
-- 确认后，计划折叠成一行“已按此计划执行”的回执，把屏幕让给工具流；
+- 用户提出修改（「表名换成 xxx」「金额按文本存」「资源名改成 xxx」）→ 只在对话里改参数，然后重新调用 `dataops_collect_plan` / 调整计划，**重新出只读计划卡，不要执行**；
+- 用户确认后，计划折叠成一行“已按此计划执行”的回执，把屏幕让给工具流；
 - 确认后如果要改参数，先停，再出新计划。
 
 ### 6. 执行
 
-用户点「开始导入」后，从 GenUI 的 `fields` 取 `resourceName`、`tableName`、`description`，然后调用：
+用户明确回复「确认」「开始吧」「可以」后，使用计划卡上展示的资源名/目标表/描述调用：
 
 `dataops_collect_execute({ session_id, data_source_urn, mode, target_schema?, target_table?, create_plan_json, mappings_json, resource_name, resource_description, resource_tags?, ai_visible?, access_level? })`
 
 - `mode` 用 `plan.mode`；
 - 新建表：`create_plan_json` 传 `JSON.stringify(plan.createTable)`，`mappings_json` 传 `"[]"`；
 - 追加：`mappings_json` 传 `JSON.stringify(plan.mappings)`；
-- `resource_name` 用用户确认后的资源名；
+- `resource_name` 用计划卡上展示、用户确认过的资源名；
 - `access_level` 默认 `PRIVATE`；`ai_visible` 默认 `true`。
 
 执行期间只说阶段小结，例如：