@sparkelf/dsh-task-bus 0.0.0-stage → 0.1.1

package/lib/index.js

@@ -0,0 +1,485 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import { createUserMessage } from "@deepseek-ai/dsh-llm";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+//#region src/index.ts
+const name = "task-bus";
+const inject = [
+	"webServer",
+	"tools",
+	"sessionController",
+	"credentials",
+	"attachments"
+];
+const TASK_BUS_ROUTE = "/dsh-task-bus/api";
+const TASK_CENTER_PATH = "/api/task-center";
+const DATAOPS_CREDENTIAL_REF = "DATAOPS_ACCESS_TOKEN";
+const resolveBase = () => {
+	const base = process.env.DATAOPS_AI_WORKSPACE_BACKEND_BASE_URL?.trim().replace(/\/+$/u, "");
+	if (!base) throw new Error("DataOps Task Center is not configured in this workspace");
+	return base;
+};
+/** Make approval links usable inside the DataOps iframe, where `/tasks` is not this origin. */
+const absoluteApprovalLinks = (payload) => {
+	const origin = process.env.DATAOPS_PUBLIC_APP_ORIGIN?.trim().replace(/\/+$/u, "");
+	if (!origin || payload === null || typeof payload !== "object") return payload;
+	const fix = (value) => {
+		if (value === null || typeof value !== "object") return;
+		const item = value;
+		if (item.source !== void 0 && typeof item.source.deepLink === "string" && item.source.deepLink.startsWith("/")) item.source.deepLink = origin + item.source.deepLink;
+	};
+	const record = payload;
+	fix(record.item);
+	for (const item of record.items ?? []) fix(item);
+	return payload;
+};
+const createTaskCenterClient = (host) => {
+	const base = resolveBase();
+	return async (path, method = "GET", body) => {
+		const token = (await host.credentials.resolve(credentialRef(DATAOPS_CREDENTIAL_REF)))?.value?.trim();
+		if (!token) throw new Error("DataOps Task Center credential is not configured");
+		const response = await fetch(base + TASK_CENTER_PATH + path, {
+			method,
+			headers: {
+				"content-type": "application/json",
+				authorization: `Bearer ${token}`
+			},
+			...body === void 0 ? {} : { body: JSON.stringify(body) }
+		});
+		const text = await response.text();
+		const payload = text ? JSON.parse(text) : null;
+		if (!response.ok) {
+			const message = payload !== null && typeof payload === "object" && "message" in payload ? String(payload.message) : `Task Center request failed (${response.status})`;
+			throw new Error(message);
+		}
+		return payload;
+	};
+};
+const readJsonBody = async (request) => {
+	if (request.on === void 0) return void 0;
+	let body = "";
+	for await (const chunk of request) body += typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+	return body.trim() ? JSON.parse(body) : void 0;
+};
+const writeJson = (response, status, body) => {
+	response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+	response.end(JSON.stringify(body));
+};
+const taskListPath = (search) => {
+	const params = new URLSearchParams(search);
+	if (!params.has("status")) params.set("status", "all");
+	return "/items?" + params.toString();
+};
+const genericListPath = (search) => {
+	const params = new URLSearchParams(search);
+	if (!params.has("scope")) params.set("scope", "mine");
+	if (!params.has("pageSize")) params.set("pageSize", "20");
+	return "/generic?" + params.toString();
+};
+const open = {
+	type: "object",
+	additionalProperties: true
+};
+/** Where this workspace stores the connector's own enabled state. */
+const CONNECTOR_STATE_PATH = join(process.env.DSH_HOME?.trim() || "/workspace/.dataops/dsh", "task-bus", "connector-state.json");
+const DEFAULT_CONNECTOR_STATE = {
+	enabled: false,
+	capabilities: { "approval.push": true }
+};
+/** Read the workspace connector state; a missing/corrupt file is a safe disabled state. */
+async function readConnectorState(path = CONNECTOR_STATE_PATH) {
+	try {
+		const text = await readFile(path, "utf8");
+		const value = JSON.parse(text);
+		return {
+			enabled: value.enabled === true,
+			capabilities: {
+				...DEFAULT_CONNECTOR_STATE.capabilities,
+				...typeof value.capabilities === "object" && value.capabilities !== null ? value.capabilities : {}
+			}
+		};
+	} catch {
+		return {
+			...DEFAULT_CONNECTOR_STATE,
+			capabilities: { ...DEFAULT_CONNECTOR_STATE.capabilities }
+		};
+	}
+}
+/** Persist the connector state atomically; the host and UI read the same file. */
+async function writeConnectorState(next, path = CONNECTOR_STATE_PATH) {
+	await mkdir(dirname(path), { recursive: true });
+	const temporary = path + ".tmp-" + process.pid.toString();
+	await writeFile(temporary, JSON.stringify(next, null, 2), "utf8");
+	await rename(temporary, path);
+}
+const renderJson = (_args, value) => [{
+	type: "text",
+	text: JSON.stringify(value, null, 2)
+}];
+const tool = (name, description, parameters, execute) => defineTool({
+	name,
+	description,
+	parameters,
+	output: {
+		schema: open,
+		render: renderJson
+	},
+	execute: (async (args) => execute(args))
+});
+const apply = (ctx) => {
+	const host = ctx;
+	const client = createTaskCenterClient(host);
+	ctx.effect(() => host.webServer.register({
+		kind: "prefix",
+		path: TASK_BUS_ROUTE,
+		handler: async (rawRequest, rawResponse) => {
+			const request = rawRequest;
+			const response = rawResponse;
+			const url = new URL(request.url ?? "/", "http://dsh.internal");
+			const route = url.pathname.slice(17).replace(/^\/+/u, "");
+			try {
+				if (route === "connector") {
+					if (request.method === "GET") {
+						writeJson(response, 200, await readConnectorState());
+						syncTools().catch(() => {
+							disposeTools();
+						});
+						return;
+					}
+					if (request.method === "POST") {
+						const body = await readJsonBody(request);
+						if (typeof body?.enabled !== "boolean") throw new Error("connector state requires enabled:boolean");
+						const current = await readConnectorState();
+						const capabilities = typeof body.capabilities === "object" && body.capabilities !== null ? {
+							...current.capabilities,
+							...body.capabilities
+						} : current.capabilities;
+						await writeConnectorState({
+							enabled: body.enabled,
+							capabilities
+						});
+						await syncTools();
+						writeJson(response, 200, await readConnectorState());
+						return;
+					}
+					writeJson(response, 405, { error: "connector state supports GET and POST" });
+					return;
+				}
+				if (request.method === "GET" && route === "health") {
+					resolveBase();
+					writeJson(response, 200, {
+						ok: true,
+						source: "dataops_approval"
+					});
+					syncTools();
+					return;
+				}
+				if (request.method === "GET" && route === "overview") {
+					writeJson(response, 200, absoluteApprovalLinks(await client("/overview")));
+					syncTools();
+					return;
+				}
+				if (request.method === "GET" && route === "attachment-materialize") {
+					const attachmentId = url.searchParams.get("attachmentId") ?? "";
+					const name = url.searchParams.get("name") ?? "attachment";
+					const bytes = Number(url.searchParams.get("bytes") ?? "0");
+					if (!attachmentId.startsWith("sha256:") || !Number.isSafeInteger(bytes) || bytes <= 0) throw new Error("attachment-materialize requires a sha256 attachmentId and byte count");
+					const attachments = ctx.attachments;
+					if (attachments === void 0) throw new Error("attachment store is unavailable");
+					const chunks = [];
+					for await (const chunk of attachments.readFileStream({
+						attachmentId,
+						name,
+						bytes
+					})) chunks.push(chunk);
+					const safeName = basename(name).replace(/[^\p{L}\p{N}._-]+/gu, "_") || "attachment";
+					const requestedCwd = url.searchParams.get("cwd")?.trim() ?? "";
+					const root = requestedCwd !== "" && isAbsolute(requestedCwd) ? requestedCwd : process.cwd();
+					const directory = join(root, ".dsh-attachment-preview");
+					await mkdir(directory, { recursive: true });
+					const relativePath = ".dsh-attachment-preview/" + attachmentId.slice(7, 19) + "-" + safeName;
+					await writeFile(join(root, relativePath), Buffer.concat(chunks));
+					writeJson(response, 200, {
+						path: relativePath,
+						absolutePath: join(root, relativePath),
+						name: safeName
+					});
+					return;
+				}
+				if (request.method === "GET" && route === "count") {
+					writeJson(response, 200, await client("/count"));
+					return;
+				}
+				if (request.method === "GET" && route === "attachment") {
+					const taskId = url.searchParams.get("taskId")?.trim() ?? "";
+					const attachmentId = url.searchParams.get("attachmentId")?.trim() ?? "";
+					if (!/^\d+$/u.test(taskId) || !/^[0-9a-fA-F-]{36}$/u.test(attachmentId)) throw new Error("attachment requires numeric taskId and UUID attachmentId");
+					const token = (await host.credentials.resolve(credentialRef(DATAOPS_CREDENTIAL_REF)))?.value?.trim();
+					if (!token) throw new Error("DataOps Task Center credential is not configured");
+					const upstream = await fetch(resolveBase() + "/api/tasks/" + encodeURIComponent(taskId) + "/attachments/" + encodeURIComponent(attachmentId) + "/download", { headers: { authorization: `Bearer ${token}` } });
+					if (!upstream.ok) {
+						const text = await upstream.text();
+						throw new Error(text || `Attachment download failed (${upstream.status})`);
+					}
+					const buffer = Buffer.from(await upstream.arrayBuffer());
+					response.writeHead(upstream.status, {
+						"content-type": upstream.headers.get("content-type") ?? "application/octet-stream",
+						"content-disposition": upstream.headers.get("content-disposition") ?? "attachment",
+						"content-length": String(buffer.length),
+						"cache-control": "private, no-store"
+					});
+					response.end(buffer);
+					return;
+				}
+				if (request.method === "GET" && route === "items") {
+					writeJson(response, 200, absoluteApprovalLinks(await client(taskListPath(url.search))));
+					return;
+				}
+				if (request.method === "GET" && route === "generic") {
+					writeJson(response, 200, await client(genericListPath(url.search)));
+					return;
+				}
+				if (request.method === "POST" && route === "ai-accept") {
+					const body = await readJsonBody(request);
+					const id = typeof body?.id === "string" ? body.id : "";
+					if (!id) throw new Error("ai-accept requires a task id");
+					const task = id.startsWith("approval:") ? await client(`/items/${encodeURIComponent(id)}`) : id.startsWith("task:") ? await client(`/generic/${encodeURIComponent(id.slice(5))}`) : null;
+					if (task === null) throw new Error("ai-accept requires an approval:<id> or task:<uuid> id");
+					const card = task.item;
+					const title = card?.title ?? id;
+					const sessionId = `task-bus-${crypto.randomUUID()}`;
+					await host.sessionController.create({
+						sessionId,
+						...process.env.DATAOPS_AI_WORKSPACE_MOUNT_PATH === void 0 ? {} : { cwd: process.env.DATAOPS_AI_WORKSPACE_MOUNT_PATH }
+					});
+					const resolved = await host.sessionController.resolveAgent(sessionId);
+					const agent = "agent" in resolved ? resolved.agent : void 0;
+					if (agent === void 0) throw new Error("无法为任务绑定 AI 会话");
+					const prompt = String(body?.prompt ?? "") || `这是 DataOps 任务「${title}」（${id}），来源：${card?.source?.label ?? card?.sourceType ?? "Task Center"}。请先阅读任务上下文，整理材料并给出办理建议；不要替审批人通过、驳回或提交审批。`;
+					agent.followup(createUserMessage({
+						source: {
+							kind: "task-bus",
+							taskId: id
+						},
+						content: [{
+							type: "text",
+							text: prompt
+						}]
+					}));
+					writeJson(response, 201, {
+						sessionId,
+						taskId: id
+					});
+					return;
+				}
+				const transition = /^generic\/([^/]+)\/transition$/u.exec(route);
+				if (request.method === "POST" && transition !== null) {
+					writeJson(response, 200, await client(`/generic/${encodeURIComponent(transition[1])}/transition`, "POST", await readJsonBody(request)));
+					return;
+				}
+				if (request.method === "POST" && route === "generic") {
+					writeJson(response, 201, await client("/generic", "POST", await readJsonBody(request)));
+					return;
+				}
+				const detail = /^generic\/([^/]+)$/u.exec(route);
+				if (request.method === "GET" && detail !== null) {
+					writeJson(response, 200, await client(`/generic/${encodeURIComponent(detail[1])}`));
+					return;
+				}
+				const approval = /^items\/([^/]+)$/u.exec(route);
+				if (request.method === "GET" && approval !== null) {
+					writeJson(response, 200, absoluteApprovalLinks(await client(`/items/${encodeURIComponent(decodeURIComponent(approval[1]))}`)));
+					return;
+				}
+				writeJson(response, 404, { error: "Unknown Task Bus route" });
+			} catch (error) {
+				writeJson(response, 502, { error: error instanceof Error ? error.message : String(error) });
+			}
+		}
+	}), "task-bus: browser API");
+	/**
+	* Tool definitions are static; only their registration is permission-dependent.
+	*
+	* This is the plugin-side disclosure boundary: the model never sees a tool the
+	* current DataOps principal cannot use. Authorization itself remains at the
+	* DataOps Task Center API; this layer only adjusts what the connector contributes.
+	*/
+	const toolDefinitions = [
+		{
+			permission: "workflow:task:read",
+			definition: tool("task_center_list", "List DataOps Task Center cards visible to the current workspace user, including approval tasks and generic Task Bus tasks. Approval cards are read-only projections of DataOps tasks.", {
+				status: {
+					type: "string",
+					enum: [
+						"all",
+						"pending",
+						"done"
+					]
+				},
+				scope: {
+					type: "string",
+					enum: [
+						"mine",
+						"created",
+						"all"
+					]
+				},
+				limit: { type: "number" }
+			}, async (args) => {
+				const status = typeof args.status === "string" ? args.status : "all";
+				const limit = typeof args.limit === "number" ? Math.max(1, Math.min(50, args.limit)) : 20;
+				const result = absoluteApprovalLinks(await client("/overview"));
+				const items = (result.items ?? []).filter((item) => {
+					if (status === "pending") return item.status !== "completed" && item.status !== "cancelled";
+					if (status === "done") return item.status === "completed" || item.status === "cancelled";
+					return true;
+				}).slice(0, limit);
+				return {
+					...result,
+					items,
+					total: items.length
+				};
+			})
+		},
+		{
+			permission: "workflow:task:read",
+			definition: tool("task_center_get", "Read one Task Center card by its stable id. Use approval:<id> for a DataOps approval task or task:<uuid> for a generic Task Bus task.", { id: {
+				type: "string",
+				required: true
+			} }, async (args) => {
+				const id = String(args.id ?? "");
+				if (id.startsWith("approval:")) return client(`/items/${encodeURIComponent(id)}`);
+				if (id.startsWith("task:")) return client(`/generic/${encodeURIComponent(id.slice(5))}`);
+				throw new Error("Task Center id must start with approval: or task:");
+			})
+		},
+		{
+			permission: "workflow:task:create",
+			definition: tool("task_center_create", [
+				"Create a generic Task Center card ONLY when the user explicitly asks you to create a task/card in this turn.",
+				"Never call this tool proactively, speculatively, as a side effect of another request, or merely because work could be tracked.",
+				"If the user did not explicitly ask for a new card, do not call it; ask for confirmation instead.",
+				"This never creates or mutates a DataOps approval task."
+			].join(" "), {
+				title: {
+					type: "string",
+					required: true
+				},
+				description: { type: "string" },
+				source_type: { type: "string" },
+				source_id: { type: "string" },
+				assignee_user_id: { type: "string" },
+				priority: { type: "string" },
+				user_requested: {
+					type: "boolean",
+					required: true,
+					description: "Must be true only when the user explicitly requested creation of this card in the current turn."
+				}
+			}, async (args) => {
+				if (args.user_requested !== true) throw new Error("task_center_create requires an explicit user request; do not create Task Center cards proactively");
+				return client("/generic", "POST", {
+					title: String(args.title ?? ""),
+					description: typeof args.description === "string" ? args.description : void 0,
+					sourceType: typeof args.source_type === "string" ? args.source_type : "agent",
+					sourceId: typeof args.source_id === "string" ? args.source_id : void 0,
+					assigneeUserId: typeof args.assignee_user_id === "string" ? args.assignee_user_id : void 0,
+					priority: typeof args.priority === "string" ? args.priority : void 0
+				});
+			})
+		},
+		{
+			permission: "workflow:task:execute",
+			definition: tool("task_center_transition", "Advance a generic Task Bus task. Approval tasks must be handled through the existing DataOps approval UI and APIs; this tool refuses approval ids.", {
+				id: {
+					type: "string",
+					required: true
+				},
+				action: {
+					type: "string",
+					required: true,
+					enum: [
+						"accept",
+						"start",
+						"submit",
+						"complete",
+						"cancel",
+						"block",
+						"unblock"
+					]
+				},
+				comment: { type: "string" }
+			}, async (args) => {
+				const id = String(args.id ?? "");
+				if (!id.startsWith("task:")) throw new Error("Only generic task:<uuid> cards can be transitioned here");
+				return client(`/generic/${encodeURIComponent(id.slice(5))}/transition`, "POST", {
+					action: String(args.action ?? ""),
+					comment: typeof args.comment === "string" ? args.comment : void 0
+				});
+			})
+		}
+	];
+	const toolDisposers = /* @__PURE__ */ new Map();
+	let syncGeneration = 0;
+	const disposeTools = () => {
+		for (const dispose of toolDisposers.values()) dispose();
+		toolDisposers.clear();
+	};
+	/** Read the current principal's DataOps permission keys without caching them per tool call. */
+	const loadPermissionKeys = async () => {
+		try {
+			const token = (await host.credentials.resolve(credentialRef(DATAOPS_CREDENTIAL_REF)))?.value?.trim();
+			if (!token) return null;
+			const response = await fetch(resolveBase() + "/api/ai/review/context", { headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json"
+			} });
+			if (!response.ok) return null;
+			const body = await response.json();
+			const values = Array.isArray(body.permissions) ? body.permissions : Array.isArray(body.permissionKeys) ? body.permissionKeys : null;
+			return values === null ? null : new Set(values.filter((item) => typeof item === "string"));
+		} catch {
+			return null;
+		}
+	};
+	/**
+	* Reconcile connector state, principal permissions and the registered tool set.
+	*
+	* Called at plugin start, after every browser API request, and after a connector
+	* enable/disable change. The tool execution path never repeats this work.
+	*/
+	const syncTools = async () => {
+		const generation = ++syncGeneration;
+		const state = await readConnectorState();
+		if (!state.enabled || state.capabilities["approval.push"] === false) {
+			disposeTools();
+			return;
+		}
+		const permissions = await loadPermissionKeys();
+		if (permissions === null) {
+			disposeTools();
+			return;
+		}
+		if (generation !== syncGeneration) return;
+		for (const item of toolDefinitions) {
+			const existing = toolDisposers.get(item.definition.name);
+			if (permissions.has(item.permission)) {
+				if (existing === void 0) toolDisposers.set(item.definition.name, host.tools.register(item.definition));
+			} else if (existing !== void 0) {
+				existing();
+				toolDisposers.delete(item.definition.name);
+			}
+		}
+	};
+	ctx.effect(() => {
+		syncTools().catch(() => {
+			disposeTools();
+		});
+		return () => {
+			syncGeneration += 1;
+			disposeTools();
+		};
+	}, "task-bus: permission-aware tool disclosure");
+};
+//#endregion
+export { CONNECTOR_STATE_PATH, TASK_BUS_ROUTE, apply, inject, name, readConnectorState, writeConnectorState };

package/package.json

@@ -1,6 +1,89 @@
 {
   "name": "@sparkelf/dsh-task-bus",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "DataOps Task Center and Task Bus for the official DSH Web shell.",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json",
+    "./client": {
+      "default": "./lib/client.js"
+    }
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-primitives"
+      ],
+      "platform": "web"
+    }
+  },
+  "files": [
+    "lib/index.js",
+    "lib/index.d.ts",
+    "lib/client.js",
+    "lib/client.js.map",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SparkElf/dsh-plugins-plus.git",
+    "directory": "packages/task-bus"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.4",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": ">=0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.7-rc.2",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.7-rc.2",
+    "@deepseek-ai/dsh-tools": ">=0.1.7-rc.2",
+    "react": ">=18.2.0 <20",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.2.1-alpha.2",
+    "@deepseek-ai/dsh-credentials": ">=0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.2.0-rc.2"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/dsh-client-locale": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.7-rc.2",
+    "@types/node": "^22.0.0",
+    "@types/react": "~18.3.1",
+    "@types/react-dom": "^18.3.0",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "tsdown": "^0.22.2",
+    "@deepseek-ai/dsh-llm": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-credentials": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2"
+  }
+}