@tablestore/tablestore-agent-cli 0.1.3 → 0.1.5

package/dist/dashboard-runtime/dashboard/src/components/layout/instance-switcher.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useState } from "react";
-import { useRouter } from "next/navigation";
+import { usePathname, useRouter } from "next/navigation";
 import { Check, ChevronDown, Plus, Settings2 } from "lucide-react";
 
 import { Button } from "@/components/ui/button";
@@ -17,8 +17,26 @@ import { ConnectInstanceDialog } from "@/components/instance/connect-instance-di
 import { useInstances, useSwitchInstance } from "@/hooks/use-instances";
 import { cn } from "@/lib/utils";
 
+/**
+ * Map the current path to a safe destination after switching the active
+ * instance. Pages that address a specific resource by name (knowledge base
+ * detail, memory store detail, ...) would render a "not found" state under
+ * the new instance, so we fall back to the corresponding list view. Pages
+ * that are instance-scoped but not resource-scoped (e.g. the chat homepage
+ * or the LLM provider list) stay where they are.
+ */
+function resolveSwitchTarget(pathname: string | null): string | null {
+  if (!pathname) return null;
+  const kbDetail = pathname.match(/^\/knowledge-base\/[^/]+(?:\/.*)?$/);
+  if (kbDetail) return "/knowledge-base";
+  const memoryDetail = pathname.match(/^\/memory\/[^/]+(?:\/.*)?$/);
+  if (memoryDetail) return "/memory";
+  return null;
+}
+
 export function InstanceSwitcher() {
   const router = useRouter();
+  const pathname = usePathname();
   const [connectOpen, setConnectOpen] = useState(false);
   const { data, isLoading } = useInstances();
   const switchMutation = useSwitchInstance();
@@ -30,7 +48,22 @@ export function InstanceSwitcher() {
     if (name === activeName || switchMutation.isPending) return;
     try {
       await switchMutation.mutateAsync(name);
-      router.refresh();
+      // Hard reload (not router.refresh) so every client-side state owned
+      // by the dashboard rebuilds against the new instance:
+      //   - ChatConfigProvider's mounts / provider / model selection
+      //   - QaChatPanel local drafts and unsent input
+      //   - any in-memory hook state keyed off the previous instance
+      // router.refresh only re-fetches RSC payloads; it leaves the React
+      // tree (and thus all of the above) intact, which is what made the
+      // dashboard appear to "not actually switch" in production builds.
+      // Mirrors the standard Discord / GitHub / Notion workspace-switch UX.
+      //
+      // When the current page is scoped to a resource that does not exist
+      // under the new instance (e.g. /knowledge-base/<name>), redirect to
+      // the corresponding list view to avoid the "knowledge base not found"
+      // dead-end. Other pages keep the current pathname.
+      const target = resolveSwitchTarget(pathname) ?? window.location.pathname;
+      window.location.assign(target);
     } catch {
       // Error toast is handled inside the hook.
     }
@@ -47,19 +80,19 @@ export function InstanceSwitcher() {
             disabled={isLoading}
           >
             <span className="max-w-[140px] truncate">
-              {activeName ? `*${activeName}` : "选择实例"}
+              {activeName ? `*${activeName}` : "选择项目"}
             </span>
             <ChevronDown className="h-3.5 w-3.5 opacity-60" />
           </Button>
         </DropdownMenuTrigger>
         <DropdownMenuContent align="end" className="min-w-[220px]">
           <DropdownMenuLabel className="text-xs font-medium text-muted-foreground">
-            切换实例
+            切换项目
           </DropdownMenuLabel>
 
           {instances.length === 0 ? (
             <div className="px-2 py-3 text-xs text-muted-foreground">
-              暂无实例，先连接一个。
+              暂无项目，先创建一个。
             </div>
           ) : (
             instances.map((item) => {
@@ -100,17 +133,17 @@ export function InstanceSwitcher() {
             className="gap-2"
           >
             <Plus className="h-3.5 w-3.5" />
-            连接新实例
+            创建新项目
           </DropdownMenuItem>
           <DropdownMenuItem
             onSelect={(event) => {
               event.preventDefault();
-              router.push("/instances");
+              router.push("/projects");
             }}
             className="gap-2"
           >
             <Settings2 className="h-3.5 w-3.5" />
-            实例管理
+            项目管理
           </DropdownMenuItem>
         </DropdownMenuContent>
       </DropdownMenu>

package/dist/dashboard-runtime/dashboard/src/components/qa/qa-chat-panel.tsx

@@ -11,6 +11,14 @@ import type { ChatMessage } from "@/types/llm-chat";
 
 import { QaMessage } from "./qa-message";
 
+export interface QaChatPanelEmptyState {
+  title: string;
+  description: string;
+  /** Optional CTA shown beneath the empty-state copy. */
+  actionLabel?: string;
+  onAction?: () => void;
+}
+
 interface QaChatPanelProps {
   messages: ChatMessage[];
   isStreaming: boolean;
@@ -18,12 +26,24 @@ interface QaChatPanelProps {
   error: string | null;
   onSend: (text: string) => void;
   onStop: () => void;
+  /**
+   * Override the built-in empty-state copy. The panel always renders the
+   * composer at the bottom, so callers can use this to surface page-level
+   * onboarding (e.g. "open settings to pick a model") without hiding the
+   * input — matching the ChatGPT / Claude convention.
+   */
+  emptyState?: QaChatPanelEmptyState;
+  /** Composer placeholder shown when `canSend` is false. */
+  disabledPlaceholder?: string;
 }
 
 /**
  * Chat surface for the QA playground: scrollable message list on top,
  * sticky composer at the bottom. Handles Enter-to-send / Shift+Enter-for-
  * newline and auto-scrolls to the latest turn.
+ *
+ * The composer is always mounted, even when the message list is empty, so
+ * users can start typing immediately on a fresh session.
  */
 export function QaChatPanel({
   messages,
@@ -32,6 +52,8 @@ export function QaChatPanel({
   error,
   onSend,
   onStop,
+  emptyState,
+  disabledPlaceholder,
 }: QaChatPanelProps) {
   const [input, setInput] = useState("");
   const scrollRef = useRef<HTMLDivElement>(null);
@@ -81,8 +103,18 @@ export function QaChatPanel({
           <div className="flex h-full min-h-[320px] items-center justify-center">
             <EmptyState
               icon={MessageSquare}
-              title="开始对话"
-              description="输入问题，系统会先从知识库检索相关内容，再让大模型基于检索结果回答"
+              title={emptyState?.title ?? "开始对话"}
+              description={
+                emptyState?.description ??
+                "输入问题，系统会先从知识库检索相关内容，再让大模型基于检索结果回答"
+              }
+              action={
+                emptyState?.actionLabel && emptyState?.onAction ? (
+                  <Button type="button" onClick={emptyState.onAction}>
+                    {emptyState.actionLabel}
+                  </Button>
+                ) : undefined
+              }
             />
           </div>
         ) : (
@@ -102,7 +134,7 @@ export function QaChatPanel({
             placeholder={
               canSend
                 ? "输入问题，Enter 发送，Shift+Enter 换行"
-                : "请先在左侧选择模型..."
+                : disabledPlaceholder ?? "请先在左侧选择模型..."
             }
             disabled={!canSend}
             className={cn(

package/dist/dashboard-runtime/dashboard/src/hooks/use-instances.ts

@@ -24,7 +24,9 @@ import type {
 
 export const INSTANCES_QUERY_KEY = ["instances"] as const;
 
-/** Invalidate every cache whose data depends on the active instance. */
+/** Invalidate every cache whose data depends on the active instance.
+ *  Used after non-switch mutations (connect / import / update / delete) where
+ *  the current session can keep the existing data while a refetch lands. */
 function invalidateInstanceScopedCaches(queryClient: QueryClient) {
   queryClient.invalidateQueries({ queryKey: INSTANCES_QUERY_KEY });
   queryClient.invalidateQueries({ queryKey: ["knowledge-bases"] });
@@ -33,6 +35,22 @@ function invalidateInstanceScopedCaches(queryClient: QueryClient) {
   queryClient.invalidateQueries({ queryKey: ["auth-status"] });
 }
 
+/** Hard-reset every cache whose data is scoped to the active instance.
+ *  `removeQueries` evicts the entries outright instead of marking them
+ *  stale, so observers on the next render fetch from scratch — no stale
+ *  data flash from the previous instance during the brief refetch window.
+ *  Mirrors the pattern recommended by TanStack Query maintainers for
+ *  logout / tenant-switch flows. */
+function resetInstanceScopedCaches(queryClient: QueryClient) {
+  queryClient.removeQueries({ queryKey: ["knowledge-bases"] });
+  queryClient.removeQueries({ queryKey: ["memory-stores"] });
+  queryClient.removeQueries({ queryKey: ["llm-providers"] });
+  queryClient.removeQueries({ queryKey: ["documents"] });
+  queryClient.removeQueries({ queryKey: ["instance"] });
+  queryClient.invalidateQueries({ queryKey: INSTANCES_QUERY_KEY });
+  queryClient.invalidateQueries({ queryKey: ["auth-status"] });
+}
+
 export function useInstances() {
   return useQuery({
     queryKey: INSTANCES_QUERY_KEY,
@@ -56,10 +74,10 @@ export function useConnectInstance() {
     mutationFn: (payload: ConnectInstancePayload) => connectInstance(payload),
     onSuccess: () => {
       invalidateInstanceScopedCaches(queryClient);
-      toast.success("实例已连接");
+      toast.success("项目已创建");
     },
     onError: (error) => {
-      toast.error(error instanceof Error ? error.message : "连接实例失败");
+      toast.error(error instanceof Error ? error.message : "创建项目失败");
     },
   });
 }
@@ -85,10 +103,10 @@ export function useUpdateInstance(name: string) {
     onSuccess: () => {
       invalidateInstanceScopedCaches(queryClient);
       queryClient.invalidateQueries({ queryKey: ["instance", name] });
-      toast.success("实例已更新");
+      toast.success("项目已更新");
     },
     onError: (error) => {
-      toast.error(error instanceof Error ? error.message : "更新实例失败");
+      toast.error(error instanceof Error ? error.message : "更新项目失败");
     },
   });
 }
@@ -99,10 +117,10 @@ export function useDeleteInstance() {
     mutationFn: (name: string) => deleteInstance(name),
     onSuccess: () => {
       invalidateInstanceScopedCaches(queryClient);
-      toast.success("实例已删除");
+      toast.success("项目已删除");
     },
     onError: (error) => {
-      toast.error(error instanceof Error ? error.message : "删除实例失败");
+      toast.error(error instanceof Error ? error.message : "删除项目失败");
     },
   });
 }
@@ -112,11 +130,15 @@ export function useSwitchInstance() {
   return useMutation({
     mutationFn: (name: string) => switchInstance(name),
     onSuccess: () => {
-      invalidateInstanceScopedCaches(queryClient);
-      toast.success("已切换活跃实例");
+      // Switching the active instance is conceptually a tenant change:
+      // every instance-scoped cache must be evicted (not just invalidated)
+      // so the new instance never inherits the old one's KB / memory /
+      // provider rows for even a single render.
+      resetInstanceScopedCaches(queryClient);
+      toast.success("已切换当前项目");
     },
     onError: (error) => {
-      toast.error(error instanceof Error ? error.message : "切换实例失败");
+      toast.error(error instanceof Error ? error.message : "切换项目失败");
     },
   });
 }

package/dist/dashboard-runtime/dashboard/src/lib/server/sdk-client.ts

@@ -1,7 +1,11 @@
 import { createHash } from "node:crypto";
 import { type NextRequest } from "next/server";
 
-import type { AppConfig } from "@tablestore/tablestore-agent-shared";
+import type {
+  AppConfig,
+  ManagedOssConfig,
+  ManagedOtsConfig,
+} from "@tablestore/tablestore-agent-shared";
 import {
   CLIError,
   DEFAULT_REGION,
@@ -15,6 +19,31 @@ import {
   inferRegionFromOtsEndpoint,
 } from "@tablestore/tablestore-agent-sdk";
 
+const EMPTY_MANAGED_OTS: ManagedOtsConfig = {
+  ots_endpoint: "",
+  ots_instance_name: "",
+  region: "",
+  source: "",
+  created_at: "",
+};
+
+const EMPTY_MANAGED_OSS: ManagedOssConfig = {
+  oss_endpoint: "",
+  oss_bucket_name: "",
+  region: "",
+  source: "",
+  created_at: "",
+};
+
+// The legacy single-instance schema let `buildAppConfig` re-read the active
+// instance from disk to hydrate `managed_*` whenever the cookie carried only
+// raw credentials. With strict per-instance isolation in shared/sdk that
+// fallback is no longer correct (it could re-hydrate from the wrong
+// instance after a CLI-side switch in another terminal). The cookie issued
+// by `use/route.ts` now projects the per-instance managed_* coordinates
+// onto the flat `oss_*`/`ots_*` fields directly, so the SDK can be
+// constructed from cookie alone.
+
 // ---------------------------------------------------------------------------
 // Cookie / token constants
 // ---------------------------------------------------------------------------
@@ -83,6 +112,12 @@ function buildAppConfig(fields: Record<string, string>): AppConfig {
     ? inferRegionFromOtsEndpoint(otsEndpoint) ?? ""
     : "";
 
+  // The cookie issued by `use/route.ts` already projects the per-instance
+  // managed_* coordinates onto the flat `oss_*`/`ots_*` fields, so the SDK
+  // can resolve every endpoint from the cookie alone. Passing empty
+  // managed_* placeholders here keeps the AppConfig shape stable for the
+  // few SDK helpers that still touch those fields without re-introducing a
+  // disk-backed fallback that could leak across instances.
   return {
     access_key_id: fields.access_key_id ?? "",
     access_key_secret: fields.access_key_secret ?? "",
@@ -97,20 +132,8 @@ function buildAppConfig(fields: Record<string, string>): AppConfig {
     memory_agent_id: "",
     memory_run_id: "",
     timeout: DEFAULT_TIMEOUT,
-    managed_ots: {
-      ots_endpoint: "",
-      ots_instance_name: "",
-      region: "",
-      source: "",
-      created_at: "",
-    },
-    managed_oss: {
-      oss_endpoint: "",
-      oss_bucket_name: "",
-      region: "",
-      source: "",
-      created_at: "",
-    },
+    managed_ots: { ...EMPTY_MANAGED_OTS },
+    managed_oss: { ...EMPTY_MANAGED_OSS },
     verbose: false,
     quiet: false,
     yes: false,
@@ -176,10 +199,30 @@ interface ClientCacheEntry {
 
 const clientCache = new Map<string, ClientCacheEntry>();
 
+/**
+ * Drop every cached client. Called from POST /api/v1/instances/[name]/use
+ * after the active instance flips so the next request rebuilds the client
+ * with the new instance's OTS / OSS coordinates instead of waiting for the
+ * 10-minute TTL on the per-key entry.
+ *
+ * Without this eviction the next upload could still hit the previous
+ * tenant's `NodeAgentStorageClient` and fail with
+ * `AccessDeniedError: bucket acl`, because the SDK binds OSS coordinates at
+ * construction time and the cache key fingerprint may not change when only
+ * the active instance flag flips on disk.
+ */
+export function clearClientCache(): void {
+  clientCache.clear();
+}
+
 function computeClientCacheKey(
   fields: Record<string, string>,
   source: CredentialSource,
 ): string {
+  // Raw cookie/env fields uniquely identify a tenant tuple now that the
+  // cookie carries the per-instance OSS coordinates directly — there is no
+  // longer a hidden disk-fallback that could vary between requests sharing
+  // the same fingerprint.
   const raw = [
     source,
     fields.access_key_id ?? "",
@@ -267,11 +310,14 @@ export function resolveClients(request: NextRequest): ResolvedClients {
     );
   }
 
+  // The cache key is now derived from the raw cookie/env tuple alone
+  // (no disk-backed managed_* hydrate), so compute it before constructing
+  // the AppConfig — saves one allocation on a cache hit.
   const cacheKey = computeClientCacheKey(fields, source);
   const cached = cacheGet(cacheKey);
   if (cached) return cached;
-
   const appConfig = buildAppConfig(fields);
+
   const resolved: ResolvedClients = {
     kb: new KnowledgeBaseClient(appConfig),
     memory: new MemoryClient(appConfig),

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/index.d.ts

@@ -4,6 +4,5 @@ export { ensureOtsTarget, getResolvedOtsTarget, loadManagedOtsTarget, saveManage
 export { ensureOssTarget, getResolvedOssTarget, loadManagedOssTarget, saveManagedOss, buildPublicOssEndpoint, generateBucketName, } from "./managed-oss.js";
 export { KnowledgeBaseClient, Client } from "./kb-client.js";
 export { MemoryClient, normalizeMemoryMessagesPage } from "./memory-client.js";
-export { buildOssKey, buildOssFullPath, createOssClient, putFileStream, deleteOssObjects, resolveAbsolutePath, } from "./oss-uploader.js";
 export { paginateAll, fetchPage, type PaginatedInvoker, type PaginatedResult, } from "./sdk-pagination.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAE7F,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAE/E,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,WAAW,EACX,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAE7F,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAE/E,OAAO,EACL,WAAW,EACX,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC"}

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/index.js

@@ -8,6 +8,5 @@ export { ensureOtsTarget, getResolvedOtsTarget, loadManagedOtsTarget, saveManage
 export { ensureOssTarget, getResolvedOssTarget, loadManagedOssTarget, saveManagedOss, buildPublicOssEndpoint, generateBucketName, } from "./managed-oss.js";
 export { KnowledgeBaseClient, Client } from "./kb-client.js";
 export { MemoryClient, normalizeMemoryMessagesPage } from "./memory-client.js";
-export { buildOssKey, buildOssFullPath, createOssClient, putFileStream, deleteOssObjects, resolveAbsolutePath, } from "./oss-uploader.js";
 export { paginateAll, fetchPage, } from "./sdk-pagination.js";
 //# sourceMappingURL=index.js.map

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,oCAAoC;AAEpC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAE7F,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAE/E,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,WAAW,EACX,SAAS,GAGV,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,oCAAoC;AAEpC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAE7F,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAE/E,OAAO,EACL,WAAW,EACX,SAAS,GAGV,MAAM,qBAAqB,CAAC"}

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/internal/managed-section-writer.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Persist a managed_* subsection under the currently active instance.
+ *
+ * Resolution order:
+ *   1. `active_instance` pointing at an existing `[instances.<name>]` block.
+ *   2. `[default]` (created lazily when missing).
+ *
+ * The legacy single-instance schema wrote these tables at the TOML top
+ * level, which made them shared by every instance and was the root cause
+ * of the multi-tenant `AccessDeniedError: bucket acl` regression — two
+ * instances onboarding in sequence would silently overwrite each other's
+ * bucket name. Strict per-instance writes paired with the read-side
+ * migration in `readConfigFile` keep every instance's managed_* metadata
+ * isolated from the others.
+ */
+export declare function writeManagedSectionForActive(fileData: Record<string, unknown>, key: "managed_ots" | "managed_oss", payload: Record<string, unknown>): void;
+//# sourceMappingURL=managed-section-writer.d.ts.map

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/internal/managed-section-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-section-writer.d.ts","sourceRoot":"","sources":["../../src/internal/managed-section-writer.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,GAAG,EAAE,aAAa,GAAG,aAAa,EAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,IAAI,CA2BN"}

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/internal/managed-section-writer.js

@@ -0,0 +1,39 @@
+import { ACTIVE_INSTANCE_KEY, DEFAULT_INSTANCE_NAME, INSTANCES_SECTION, } from "@tablestore/tablestore-agent-shared";
+/**
+ * Persist a managed_* subsection under the currently active instance.
+ *
+ * Resolution order:
+ *   1. `active_instance` pointing at an existing `[instances.<name>]` block.
+ *   2. `[default]` (created lazily when missing).
+ *
+ * The legacy single-instance schema wrote these tables at the TOML top
+ * level, which made them shared by every instance and was the root cause
+ * of the multi-tenant `AccessDeniedError: bucket acl` regression — two
+ * instances onboarding in sequence would silently overwrite each other's
+ * bucket name. Strict per-instance writes paired with the read-side
+ * migration in `readConfigFile` keep every instance's managed_* metadata
+ * isolated from the others.
+ */
+export function writeManagedSectionForActive(fileData, key, payload) {
+    const active = typeof fileData[ACTIVE_INSTANCE_KEY] === "string"
+        ? fileData[ACTIVE_INSTANCE_KEY]
+        : "";
+    if (active && active !== DEFAULT_INSTANCE_NAME) {
+        const instancesRaw = fileData[INSTANCES_SECTION] && typeof fileData[INSTANCES_SECTION] === "object"
+            ? fileData[INSTANCES_SECTION]
+            : {};
+        const target = instancesRaw[active] && typeof instancesRaw[active] === "object"
+            ? instancesRaw[active]
+            : {};
+        target[key] = payload;
+        instancesRaw[active] = target;
+        fileData[INSTANCES_SECTION] = instancesRaw;
+        return;
+    }
+    const def = fileData.default && typeof fileData.default === "object"
+        ? fileData.default
+        : {};
+    def[key] = payload;
+    fileData.default = def;
+}
+//# sourceMappingURL=managed-section-writer.js.map

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/internal/managed-section-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-section-writer.js","sourceRoot":"","sources":["../../src/internal/managed-section-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAiC,EACjC,GAAkC,EAClC,OAAgC;IAEhC,MAAM,MAAM,GACV,OAAO,QAAQ,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAC/C,CAAC,CAAE,QAAQ,CAAC,mBAAmB,CAAY;QAC3C,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,MAAM,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC/C,MAAM,YAAY,GAChB,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,QAAQ,CAAC,iBAAiB,CAAC,KAAK,QAAQ;YAC5E,CAAC,CAAE,QAAQ,CAAC,iBAAiB,CAA6C;YAC1E,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,QAAQ;YAC9D,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;QACtB,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;QAC9B,QAAQ,CAAC,iBAAiB,CAAC,GAAG,YAAY,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GACP,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACtD,CAAC,CAAE,QAAQ,CAAC,OAAmC;QAC/C,CAAC,CAAC,EAAE,CAAC;IACT,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IACnB,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC;AACzB,CAAC"}

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/kb-client.d.ts

@@ -1,28 +1,45 @@
 import type { AppConfig } from "@tablestore/tablestore-agent-shared";
 import type { StandardResponse } from "./types.js";
 /**
- * High-level Knowledge Base client that wraps the raw `tablestore` npm SDK.
+ * High-level Knowledge Base client built on top of the upstream
+ * `@tablestore/agent-storage` SDK. The wrapper preserves the legacy
+ * {@link StandardResponse} envelope so that existing CLI / Dashboard code
+ * continues to work without changes.
  *
  * Every public method returns a {@link StandardResponse} — even on SDK error
  * (we never throw for remote errors, only for programmer errors / bad config).
- * The Dashboard and CLI both rely on this consistent envelope.
  */
 export declare class KnowledgeBaseClient {
     private readonly config;
-    private sdkInstance;
     constructor(config: AppConfig);
+    /**
+     * Construct a fresh SDK client for every call.
+     *
+     * The new `@tablestore/agent-storage` runtime is a thin fetch wrapper with
+     * no connection pool, so reconstruction overhead is negligible. Caching
+     * the instance turned out to be unsafe: `NodeAgentStorageClient` binds OSS
+     * coordinates at construction time, so a cached instance kept serving the
+     * previous tenant's bucket after an instance switch (manifesting as
+     * `AccessDeniedError: bucket acl`).
+     */
     private getSdk;
     /**
-     * Return an SDK client with OSS configured. When `autoCreate` is true a
-     * managed bucket will be provisioned on demand.
+     * Return an SDK client that is guaranteed to be a {@link NodeAgentStorageClient}
+     * (i.e. has OSS configured). When `autoCreate` is true a managed bucket
+     * will be provisioned on demand.
+     *
+     * Always reconstructs the underlying client to avoid the cross-tenant
+     * leak described on {@link getSdk}.
      */
     private sdkWithOss;
     /**
-     * `methodName` is typed to the KB-side ambient declarations, so typos are
-     * caught at compile time. A runtime guard still protects users on older
-     * `tablestore` npm versions that predate a given method.
+     * Single funnel for invoking SDK methods. Wraps the bare server response in
+     * the standard envelope and converts thrown SDK errors into envelope-form
+     * errors (or, for connectivity failures, a thrown {@link NetworkError} that
+     * the CLI / Dashboard layer translates into the right exit code / HTTP
+     * status).
      */
-    private invokeOnSdk;
+    private invoke;
     createKnowledgeBase(request: Record<string, unknown>): Promise<StandardResponse>;
     describeKnowledgeBase(request: Record<string, unknown>): Promise<StandardResponse>;
     deleteKnowledgeBase(request: Record<string, unknown>): Promise<StandardResponse>;
@@ -31,14 +48,13 @@ export declare class KnowledgeBaseClient {
     listKnowledgeBases(request: Record<string, unknown>): Promise<StandardResponse>;
     addDocuments(request: Record<string, unknown>): Promise<StandardResponse>;
     /**
-     * Upload local files to the managed OSS bucket and then register them via
-     * `addDocuments`. Mirrors the Python reference implementation
-     * (`client.py::upload_documents`) but uploads and registers one file at a
-     * time so that a registration failure only rolls back its own OSS object
-     * — matching the per-file rollback semantics chosen for this SDK.
-     *
-     * The downstream `tablestore` npm SDK does not ship an OSS-capable
-     * `uploadDocuments`, so we handle the OSS side ourselves with `ali-oss`.
+     * Upload local files to the managed OSS bucket and register them via
+     * `addDocuments`. Delegates the heavy lifting to
+     * {@link NodeAgentStorageClient.uploadDocuments}; the wrapper is only here
+     * to preserve the historical `originalName` field — the upstream SDK keys
+     * each OSS object off `basename(filePath)`, so when the caller wants the
+     * OSS key tail to be the browser-supplied name we materialise a sibling
+     * file with that exact basename and forward its path instead.
      */
     uploadDocuments(request: Record<string, unknown>): Promise<StandardResponse>;
     getDocument(request: Record<string, unknown>): Promise<StandardResponse>;

package/dist/dashboard-runtime/node_modules/@tablestore/tablestore-agent-sdk/dist/kb-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kb-client.d.ts","sourceRoot":"","sources":["../src/kb-client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAoBrE,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,YAAY,CAAC;AAiCrE;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,WAAW,CAA0B;gBAEjC,MAAM,EAAE,SAAS;YAIf,MAAM;IAOpB;;;OAGG;YACW,UAAU;IA2BxB;;;;OAIG;YACW,WAAW;IA0CnB,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKhF,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKlF,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKhF,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKtF,yEAAyE;IACnE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO/E,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAK/E;;;;;;;;;OASG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA4K5E,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKxE,eAAe,CACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,UAAQ,GACjB,OAAO,CAAC,gBAAgB,CAAC;IAWtB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO1E,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKvE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAOzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAI5E;AAGD,OAAO,EAAE,mBAAmB,IAAI,MAAM,EAAE,CAAC"}
+{"version":3,"file":"kb-client.d.ts","sourceRoot":"","sources":["../src/kb-client.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAYrE,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,YAAY,CAAC;AA+GrE;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;gBAEvB,MAAM,EAAE,SAAS;IAI7B;;;;;;;;;OASG;YACW,MAAM;IAIpB;;;;;;;OAOG;YACW,UAAU;IAgBxB;;;;;;OAMG;YACW,MAAM;IAYd,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKhF,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKlF,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKhF,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKtF,yEAAyE;IACnE,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO/E,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAK/E;;;;;;;;OAQG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiD5E,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKxE,eAAe,CACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,UAAQ,GACjB,OAAO,CAAC,gBAAgB,CAAC;IAStB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO1E,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKvE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAOzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAI5E;AAGD,OAAO,EAAE,mBAAmB,IAAI,MAAM,EAAE,CAAC"}