@sparkelf/dsh-plugin-dataops 0.1.0-rc.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/plus/dataops/README.md
+README.md: c843fd3c7aac7ea489b5311e4c3c50e8498cab94
+README.zh.md: 10fa42ed24dc8f8295dbe785a234ded025fcb1a4

package/README.md

@@ -0,0 +1,63 @@
+---
+description: "DataOps target identity, browser PKCE authorization, credential lifecycle, authenticated MCP composition, and Settings UI."
+kind: "package-reference"
+---
+
+# @sparkelf/dsh-plugin-dataops
+
+English | [中文](README.zh.md)
+
+## Summary
+
+This complete Host and Client plugin owns one DataOps target identity, browser Authorization Code with PKCE, access and refresh credential lifecycle, authenticated MCP child composition, and a localized Settings section. Privileged local routes apply official Connection rejection before request inspection; the callback also requires one-use PKCE state.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+Set `DSH_DATAOPS_BASE_URL` to the DataOps Web origin that serves both `/auth/dsh/authorize` and proxied `/api`; `DSH_DATAOPS_CALLBACK_ORIGIN` optionally names a non-loopback DSH browser origin. The package stores the delegated access token and stable target identity under `dataops_access_token` and `dataops_target_ref`; DataOps ties the token lifetime to its authenticated browser session. When the current grant expires or its browser session is revoked, the DataOps Client contribution raises a DSH shell modal with **Later** and **Sign in again**; the latter opens the real OAuth popup from the user gesture. Settings also distinguishes the rejected stored grant from a never-connected state and keeps the same recovery action available. An authentication-rejected MCP call remains an error result inside the agent turn; it does not terminate the task, and Plus does not automatically replay an unconfirmed tool operation. Disconnect revokes account tokens but retains target identity. OAuth callback failures expose only a fixed, actionable stage in Settings; authorization codes, state, tokens, upstream bodies, and arbitrary error text remain outside the browser message.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+### Authorized DataOps MCP tools
+
+#### What the model sees
+
+After authorization, the model sees the DataOps server current tool schemas under the `dataops` namespace and the upstream MCP tool results. OAuth state, account data, target metadata, and token values never enter model context.
+
+#### Token effect
+
+Connected tool schemas add their current prefix cost, and calls add upstream arguments and results. OAuth and credential operations add zero model tokens.
+
+#### KV Cache effect
+
+Connecting, disconnecting, or MCP discovery changes can alter the tool-schema prefix. Stable connected operation adds no OAuth or token metadata to that prefix.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **External authenticated account required**: the DataOps deployment must implement the DSH authorization and MCP endpoints and present an authenticated user session; this package provides no fallback token grant or login credential.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers, click to expand</summary>
+
+This Dev Note is working context for maintainers; shipped behavior, limits, and rationale live in the sections above, the package code, and the linked Agent Note.
+
+- `src/index.ts` owns authorization, credentials, access expiry, and MCP child lifecycle. `src/client/store.ts` and `src/client/controller.ts` own shared browser status and OAuth lifecycle; `src/client/DataOpsExpiryModal.tsx` contributes the shell prompt and `src/client/DataOpsSection.tsx` contributes Settings. The [distribution Agent Note](../../../.agents/notes/proposed/architecture/2026-08-29-ranged-plus-patchset-distribution.md) records the package boundary.
+
+</details>

package/README.zh.md

@@ -0,0 +1,63 @@
+---
+description: "DataOps target identity、browser PKCE authorization、credential lifecycle、authenticated MCP composition及Settings UI。"
+kind: "package-reference"
+---
+
+# @sparkelf/dsh-plugin-dataops
+
+[English](README.md) | 中文
+
+## 概述
+
+该完整Host及Client plugin持有一个DataOps target identity、带PKCE的browser Authorization Code、access及refresh credential lifecycle、authenticated MCP child composition及localized Settings section。privileged local routes会在request inspection前应用official Connection rejection；callback还要求one-use PKCE state。
+
+## 目录
+
+- [使用此软件包](#use-this-package)
+- [模型体验](#model-experience)
+- [已知限制和延期工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用此软件包
+
+把`DSH_DATAOPS_BASE_URL`设为同时提供`/auth/dsh/authorize`及proxied `/api`的DataOps Web origin；`DSH_DATAOPS_CALLBACK_ORIGIN`可选指定non-loopback DSH browser origin。该package把delegated access token及stable target identity存入`dataops_access_token`与`dataops_target_ref`；DataOps把token lifetime绑定到authenticated browser session。Current grant过期或其browser session被revoke时，DataOps Client contribution会弹出带**稍后**与**重新登录**的DSH shell modal；后者从用户手势打开real OAuth popup。Settings也会把rejected stored grant与never-connected state区分，并保留同一个恢复动作。Authentication-rejected MCP call仍是agent turn内的error result，不会终止task；Plus不会自动重放结果未知的tool operation。Disconnect会revoke account tokens但保留target identity。OAuth callback failure只在Settings暴露固定、可操作的failure stage；authorization code、state、token、upstream body及任意error text不会进入browser message。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+### Authorized DataOps MCP tools
+
+#### 模型看到什么
+
+authorization成功后，模型看到`dataops` namespace下DataOps server当前tool schemas及upstream MCP tool results。OAuth state、account data、target metadata及token values不会进入model context。
+
+#### Token 影响
+
+connected tool schemas增加当前prefix cost，call增加upstream arguments及results。OAuth及credential operations增加零model tokens。
+
+#### KV Cache 影响
+
+Connecting、disconnecting或MCP discovery change可能改变tool-schema prefix。稳定connected operation不会向该prefix加入OAuth或token metadata。
+
+## 已知限制和延期工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **需要external authenticated account**：DataOps deployment必须实现DSH authorization及MCP endpoints并提供authenticated user session；该package不提供fallback token grant或login credential。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者工作上下文，点击展开</summary>
+
+该开发备注是maintainer working context；shipped behavior、limits及rationale以以上sections、package code及linked Agent Note为准。
+
+- `src/index.ts`持有authorization、credentials、access expiry及MCP child lifecycle。`src/client/store.ts`与`src/client/controller.ts`持有shared browser status及OAuth lifecycle；`src/client/DataOpsExpiryModal.tsx`贡献shell prompt，`src/client/DataOpsSection.tsx`贡献Settings。[Distribution Agent Note](../../../.agents/notes/proposed/architecture/2026-08-29-ranged-plus-patchset-distribution.zh.md)记录package boundary。
+
+</details>