@sparkelf/dsh-task-bus 0.1.0 → 0.1.2

package/lib/index.js

@@ -1,5 +1,5 @@
-import { mkdir, writeFile } from "node:fs/promises";
-import { basename, isAbsolute, join } from "node:path";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -81,6 +81,38 @@ const open = {
 	type: "object",
 	additionalProperties: true
 };
+/** Where this workspace stores the connector's own enabled state. */
+const CONNECTOR_STATE_PATH = join(process.env.DSH_HOME?.trim() || "/workspace/.dataops/dsh", "task-bus", "connector-state.json");
+const DEFAULT_CONNECTOR_STATE = {
+	enabled: false,
+	capabilities: { "approval.push": true }
+};
+/** Read the workspace connector state; a missing/corrupt file is a safe disabled state. */
+async function readConnectorState(path = CONNECTOR_STATE_PATH) {
+	try {
+		const text = await readFile(path, "utf8");
+		const value = JSON.parse(text);
+		return {
+			enabled: value.enabled === true,
+			capabilities: {
+				...DEFAULT_CONNECTOR_STATE.capabilities,
+				...typeof value.capabilities === "object" && value.capabilities !== null ? value.capabilities : {}
+			}
+		};
+	} catch {
+		return {
+			...DEFAULT_CONNECTOR_STATE,
+			capabilities: { ...DEFAULT_CONNECTOR_STATE.capabilities }
+		};
+	}
+}
+/** Persist the connector state atomically; the host and UI read the same file. */
+async function writeConnectorState(next, path = CONNECTOR_STATE_PATH) {
+	await mkdir(dirname(path), { recursive: true });
+	const temporary = path + ".tmp-" + process.pid.toString();
+	await writeFile(temporary, JSON.stringify(next, null, 2), "utf8");
+	await rename(temporary, path);
+}
 const renderJson = (_args, value) => [{
 	type: "text",
 	text: JSON.stringify(value, null, 2)
@@ -107,16 +139,45 @@ const apply = (ctx) => {
 			const url = new URL(request.url ?? "/", "http://dsh.internal");
 			const route = url.pathname.slice(17).replace(/^\/+/u, "");
 			try {
+				if (route === "connector") {
+					if (request.method === "GET") {
+						writeJson(response, 200, await readConnectorState());
+						syncTools().catch(() => {
+							disposeTools();
+						});
+						return;
+					}
+					if (request.method === "POST") {
+						const body = await readJsonBody(request);
+						if (typeof body?.enabled !== "boolean") throw new Error("connector state requires enabled:boolean");
+						const current = await readConnectorState();
+						const capabilities = typeof body.capabilities === "object" && body.capabilities !== null ? {
+							...current.capabilities,
+							...body.capabilities
+						} : current.capabilities;
+						await writeConnectorState({
+							enabled: body.enabled,
+							capabilities
+						});
+						await syncTools();
+						writeJson(response, 200, await readConnectorState());
+						return;
+					}
+					writeJson(response, 405, { error: "connector state supports GET and POST" });
+					return;
+				}
 				if (request.method === "GET" && route === "health") {
 					resolveBase();
 					writeJson(response, 200, {
 						ok: true,
 						source: "dataops_approval"
 					});
+					syncTools();
 					return;
 				}
 				if (request.method === "GET" && route === "overview") {
 					writeJson(response, 200, absoluteApprovalLinks(await client("/overview")));
+					syncTools();
 					return;
 				}
 				if (request.method === "GET" && route === "attachment-materialize") {
@@ -237,107 +298,188 @@ const apply = (ctx) => {
 			}
 		}
 	}), "task-bus: browser API");
-	ctx.effect(() => host.tools.register(tool("task_center_list", "List DataOps Task Center cards visible to the current workspace user, including approval tasks and generic Task Bus tasks. Approval cards are read-only projections of DataOps tasks.", {
-		status: {
-			type: "string",
-			enum: [
-				"all",
-				"pending",
-				"done"
-			]
+	/**
+	* Tool definitions are static; only their registration is permission-dependent.
+	*
+	* This is the plugin-side disclosure boundary: the model never sees a tool the
+	* current DataOps principal cannot use. Authorization itself remains at the
+	* DataOps Task Center API; this layer only adjusts what the connector contributes.
+	*/
+	const toolDefinitions = [
+		{
+			permission: "workflow:task:read",
+			definition: tool("task_center_list", "List DataOps Task Center cards visible to the current workspace user, including approval tasks and generic Task Bus tasks. Approval cards are read-only projections of DataOps tasks.", {
+				status: {
+					type: "string",
+					enum: [
+						"all",
+						"pending",
+						"done"
+					]
+				},
+				scope: {
+					type: "string",
+					enum: [
+						"mine",
+						"created",
+						"all"
+					]
+				},
+				limit: { type: "number" }
+			}, async (args) => {
+				const status = typeof args.status === "string" ? args.status : "all";
+				const limit = typeof args.limit === "number" ? Math.max(1, Math.min(50, args.limit)) : 20;
+				const result = absoluteApprovalLinks(await client("/overview"));
+				const items = (result.items ?? []).filter((item) => {
+					if (status === "pending") return item.status !== "completed" && item.status !== "cancelled";
+					if (status === "done") return item.status === "completed" || item.status === "cancelled";
+					return true;
+				}).slice(0, limit);
+				return {
+					...result,
+					items,
+					total: items.length
+				};
+			})
 		},
-		scope: {
-			type: "string",
-			enum: [
-				"mine",
-				"created",
-				"all"
-			]
+		{
+			permission: "workflow:task:read",
+			definition: tool("task_center_get", "Read one Task Center card by its stable id. Use approval:<id> for a DataOps approval task or task:<uuid> for a generic Task Bus task.", { id: {
+				type: "string",
+				required: true
+			} }, async (args) => {
+				const id = String(args.id ?? "");
+				if (id.startsWith("approval:")) return client(`/items/${encodeURIComponent(id)}`);
+				if (id.startsWith("task:")) return client(`/generic/${encodeURIComponent(id.slice(5))}`);
+				throw new Error("Task Center id must start with approval: or task:");
+			})
 		},
-		limit: { type: "number" }
-	}, async (args) => {
-		const status = typeof args.status === "string" ? args.status : "all";
-		typeof args.scope === "string" && args.scope;
-		const limit = typeof args.limit === "number" ? Math.max(1, Math.min(50, args.limit)) : 20;
-		const result = absoluteApprovalLinks(await client("/overview"));
-		const items = (result.items ?? []).filter((item) => {
-			if (status === "pending") return item.status !== "completed" && item.status !== "cancelled";
-			if (status === "done") return item.status === "completed" || item.status === "cancelled";
-			return true;
-		}).slice(0, limit);
-		return {
-			...result,
-			items,
-			total: items.length
-		};
-	})), "task-bus: list tool");
-	ctx.effect(() => host.tools.register(tool("task_center_get", "Read one Task Center card by its stable id. Use approval:<id> for a DataOps approval task or task:<uuid> for a generic Task Bus task.", { id: {
-		type: "string",
-		required: true
-	} }, async (args) => {
-		const id = String(args.id ?? "");
-		if (id.startsWith("approval:")) return client(`/items/${encodeURIComponent(id)}`);
-		if (id.startsWith("task:")) return client(`/generic/${encodeURIComponent(id.slice(5))}`);
-		throw new Error("Task Center id must start with approval: or task:");
-	})), "task-bus: get tool");
-	ctx.effect(() => host.tools.register(tool("task_center_create", [
-		"Create a generic Task Center card ONLY when the user explicitly asks you to create a task/card in this turn.",
-		"Never call this tool proactively, speculatively, as a side effect of another request, or merely because work could be tracked.",
-		"If the user did not explicitly ask for a new card, do not call it; ask for confirmation instead.",
-		"This never creates or mutates a DataOps approval task."
-	].join(" "), {
-		title: {
-			type: "string",
-			required: true
+		{
+			permission: "workflow:task:create",
+			definition: tool("task_center_create", [
+				"Create a generic Task Center card ONLY when the user explicitly asks you to create a task/card in this turn.",
+				"Never call this tool proactively, speculatively, as a side effect of another request, or merely because work could be tracked.",
+				"If the user did not explicitly ask for a new card, do not call it; ask for confirmation instead.",
+				"This never creates or mutates a DataOps approval task."
+			].join(" "), {
+				title: {
+					type: "string",
+					required: true
+				},
+				description: { type: "string" },
+				source_type: { type: "string" },
+				source_id: { type: "string" },
+				assignee_user_id: { type: "string" },
+				priority: { type: "string" },
+				user_requested: {
+					type: "boolean",
+					required: true,
+					description: "Must be true only when the user explicitly requested creation of this card in the current turn."
+				}
+			}, async (args) => {
+				if (args.user_requested !== true) throw new Error("task_center_create requires an explicit user request; do not create Task Center cards proactively");
+				return client("/generic", "POST", {
+					title: String(args.title ?? ""),
+					description: typeof args.description === "string" ? args.description : void 0,
+					sourceType: typeof args.source_type === "string" ? args.source_type : "agent",
+					sourceId: typeof args.source_id === "string" ? args.source_id : void 0,
+					assigneeUserId: typeof args.assignee_user_id === "string" ? args.assignee_user_id : void 0,
+					priority: typeof args.priority === "string" ? args.priority : void 0
+				});
+			})
 		},
-		description: { type: "string" },
-		source_type: { type: "string" },
-		source_id: { type: "string" },
-		assignee_user_id: { type: "string" },
-		priority: { type: "string" },
-		user_requested: {
-			type: "boolean",
-			required: true,
-			description: "Must be true only when the user explicitly requested creation of this card in the current turn."
+		{
+			permission: "workflow:task:execute",
+			definition: tool("task_center_transition", "Advance a generic Task Bus task. Approval tasks must be handled through the existing DataOps approval UI and APIs; this tool refuses approval ids.", {
+				id: {
+					type: "string",
+					required: true
+				},
+				action: {
+					type: "string",
+					required: true,
+					enum: [
+						"accept",
+						"start",
+						"submit",
+						"complete",
+						"cancel",
+						"block",
+						"unblock"
+					]
+				},
+				comment: { type: "string" }
+			}, async (args) => {
+				const id = String(args.id ?? "");
+				if (!id.startsWith("task:")) throw new Error("Only generic task:<uuid> cards can be transitioned here");
+				return client(`/generic/${encodeURIComponent(id.slice(5))}/transition`, "POST", {
+					action: String(args.action ?? ""),
+					comment: typeof args.comment === "string" ? args.comment : void 0
+				});
+			})
 		}
-	}, async (args) => {
-		if (args.user_requested !== true) throw new Error("task_center_create requires an explicit user request; do not create Task Center cards proactively");
-		return client("/generic", "POST", {
-			title: String(args.title ?? ""),
-			description: typeof args.description === "string" ? args.description : void 0,
-			sourceType: typeof args.source_type === "string" ? args.source_type : "agent",
-			sourceId: typeof args.source_id === "string" ? args.source_id : void 0,
-			assigneeUserId: typeof args.assignee_user_id === "string" ? args.assignee_user_id : void 0,
-			priority: typeof args.priority === "string" ? args.priority : void 0
-		});
-	})), "task-bus: create tool");
-	ctx.effect(() => host.tools.register(tool("task_center_transition", "Advance a generic Task Bus task. Approval tasks must be handled through the existing DataOps approval UI and APIs; this tool refuses approval ids.", {
-		id: {
-			type: "string",
-			required: true
-		},
-		action: {
-			type: "string",
-			required: true,
-			enum: [
-				"accept",
-				"start",
-				"submit",
-				"complete",
-				"cancel",
-				"block",
-				"unblock"
-			]
-		},
-		comment: { type: "string" }
-	}, async (args) => {
-		const id = String(args.id ?? "");
-		if (!id.startsWith("task:")) throw new Error("Only generic task:<uuid> cards can be transitioned here");
-		return client(`/generic/${encodeURIComponent(id.slice(5))}/transition`, "POST", {
-			action: String(args.action ?? ""),
-			comment: typeof args.comment === "string" ? args.comment : void 0
+	];
+	const toolDisposers = /* @__PURE__ */ new Map();
+	let syncGeneration = 0;
+	const disposeTools = () => {
+		for (const dispose of toolDisposers.values()) dispose();
+		toolDisposers.clear();
+	};
+	/** Read the current principal's DataOps permission keys without caching them per tool call. */
+	const loadPermissionKeys = async () => {
+		try {
+			const token = (await host.credentials.resolve(credentialRef(DATAOPS_CREDENTIAL_REF)))?.value?.trim();
+			if (!token) return null;
+			const response = await fetch(resolveBase() + "/api/ai/review/context", { headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json"
+			} });
+			if (!response.ok) return null;
+			const body = await response.json();
+			const values = Array.isArray(body.permissions) ? body.permissions : Array.isArray(body.permissionKeys) ? body.permissionKeys : null;
+			return values === null ? null : new Set(values.filter((item) => typeof item === "string"));
+		} catch {
+			return null;
+		}
+	};
+	/**
+	* Reconcile connector state, principal permissions and the registered tool set.
+	*
+	* Called at plugin start, after every browser API request, and after a connector
+	* enable/disable change. The tool execution path never repeats this work.
+	*/
+	const syncTools = async () => {
+		const generation = ++syncGeneration;
+		const state = await readConnectorState();
+		if (!state.enabled || state.capabilities["approval.push"] === false) {
+			disposeTools();
+			return;
+		}
+		const permissions = await loadPermissionKeys();
+		if (permissions === null) {
+			disposeTools();
+			return;
+		}
+		if (generation !== syncGeneration) return;
+		for (const item of toolDefinitions) {
+			const existing = toolDisposers.get(item.definition.name);
+			if (permissions.has(item.permission)) {
+				if (existing === void 0) toolDisposers.set(item.definition.name, host.tools.register(item.definition));
+			} else if (existing !== void 0) {
+				existing();
+				toolDisposers.delete(item.definition.name);
+			}
+		}
+	};
+	ctx.effect(() => {
+		syncTools().catch(() => {
+			disposeTools();
 		});
-	})), "task-bus: transition tool");
+		return () => {
+			syncGeneration += 1;
+			disposeTools();
+		};
+	}, "task-bus: permission-aware tool disclosure");
 };
 //#endregion
-export { TASK_BUS_ROUTE, apply, inject, name };
+export { CONNECTOR_STATE_PATH, TASK_BUS_ROUTE, apply, inject, name, readConnectorState, writeConnectorState };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sparkelf/dsh-task-bus",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "DataOps Task Center and Task Bus for the official DSH Web shell.",
   "type": "module",
   "main": "./lib/index.js",
@@ -37,6 +37,10 @@
     "cordis.patch.yml",
     "README.md"
   ],
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
   },
@@ -81,9 +85,5 @@
     "@deepseek-ai/dsh-credentials": "0.1.7-rc.2",
     "@deepseek-ai/dsh-client-ui-conversation": "0.1.7-rc.2",
     "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.2"
-  },
-  "scripts": {
-    "build": "tsdown",
-    "typecheck": "tsc --noEmit -p tsconfig.json"
   }
-}
+}