@tablestore/tablestore-agent-cli 0.1.8 → 0.2.0

package/dist/dashboard-runtime/dashboard/src/lib/server/sdk-client.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { type NextRequest } from "next/server";
+import { type NextRequest, type NextResponse } from "next/server";
 
 import type {
   AppConfig,
@@ -11,7 +11,10 @@ import {
   DEFAULT_REGION,
   DEFAULT_TIMEOUT,
   decodeToken,
+  encodeTokenV2,
+  getActiveInstanceName,
   loadConfigWithSources,
+  readInstance,
 } from "@tablestore/tablestore-agent-shared";
 import {
   KnowledgeBaseClient,
@@ -49,6 +52,83 @@ const EMPTY_MANAGED_OSS: ManagedOssConfig = {
 // ---------------------------------------------------------------------------
 
 export const SESSION_COOKIE_NAME = "tablestore_token";
+export const ACTIVE_INSTANCE_COOKIE_NAME = "tablestore_active_instance";
+export const TOKEN_SOURCE_COOKIE_NAME = "tablestore_token_source";
+
+const COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30; // 30 days
+const RAW_TOKEN_SOURCE = "raw";
+const INSTANCE_TOKEN_SOURCE = "instance";
+
+const COOKIE_OPTIONS = {
+  httpOnly: true,
+  sameSite: "strict" as const,
+  secure: process.env.NODE_ENV === "production",
+  path: "/",
+};
+
+export function setActiveInstanceCookie(
+  response: NextResponse,
+  instanceName: string,
+): void {
+  response.cookies.set({
+    ...COOKIE_OPTIONS,
+    name: ACTIVE_INSTANCE_COOKIE_NAME,
+    value: encodeURIComponent(instanceName),
+    maxAge: COOKIE_MAX_AGE_SECONDS,
+  });
+}
+
+export function clearActiveInstanceCookie(response: NextResponse): void {
+  response.cookies.set({
+    ...COOKIE_OPTIONS,
+    name: ACTIVE_INSTANCE_COOKIE_NAME,
+    value: "",
+    maxAge: 0,
+  });
+}
+
+export function setRawTokenSourceCookie(response: NextResponse): void {
+  response.cookies.set({
+    ...COOKIE_OPTIONS,
+    name: TOKEN_SOURCE_COOKIE_NAME,
+    value: RAW_TOKEN_SOURCE,
+    maxAge: COOKIE_MAX_AGE_SECONDS,
+  });
+}
+
+export function setInstanceTokenSourceCookie(response: NextResponse): void {
+  response.cookies.set({
+    ...COOKIE_OPTIONS,
+    name: TOKEN_SOURCE_COOKIE_NAME,
+    value: INSTANCE_TOKEN_SOURCE,
+    maxAge: COOKIE_MAX_AGE_SECONDS,
+  });
+}
+
+export function clearTokenSourceCookie(response: NextResponse): void {
+  response.cookies.set({
+    ...COOKIE_OPTIONS,
+    name: TOKEN_SOURCE_COOKIE_NAME,
+    value: "",
+    maxAge: 0,
+  });
+}
+
+export function setInstanceSessionCookies(
+  response: NextResponse,
+  instanceName: string,
+): boolean {
+  const fields = tokenFieldsForInstance(instanceName);
+  if (!fields) return false;
+  response.cookies.set({
+    ...COOKIE_OPTIONS,
+    name: SESSION_COOKIE_NAME,
+    value: encodeTokenV2(fields),
+  });
+  setActiveInstanceCookie(response, instanceName);
+  setInstanceTokenSourceCookie(response);
+  return true;
+}
 
 // ---------------------------------------------------------------------------
 // Resolved clients
@@ -61,7 +141,7 @@ export interface ResolvedClients {
   memory: MemoryClient;
   config: AppConfig;
   source: CredentialSource;
-  /** Active instance name when source === "instance", else null. */
+  /** Trusted active project name for named-instance requests, else null. */
   instanceName: string | null;
 }
 
@@ -169,6 +249,125 @@ function configFromToken(token: string): Record<string, string> {
   return decodeToken(token);
 }
 
+function getCookieActiveInstanceName(request: NextRequest): string | null {
+  const raw = request.cookies.get(ACTIVE_INSTANCE_COOKIE_NAME)?.value;
+  if (!raw) return null;
+  try {
+    const decoded = decodeURIComponent(raw);
+    return decoded ? decoded : null;
+  } catch {
+    return null;
+  }
+}
+
+function tokenFieldsForInstance(
+  instanceName: string,
+): Record<string, string> | null {
+  try {
+    const detail = readInstance(instanceName);
+    if (!detail) return null;
+    const ots = detail.managed_ots;
+    const oss = detail.managed_oss;
+    return {
+      access_key_id: detail.access_key_id,
+      access_key_secret: detail.access_key_secret,
+      ots_endpoint: detail.ots_endpoint || ots.ots_endpoint,
+      ots_instance_name: detail.ots_instance_name || ots.ots_instance_name,
+      oss_endpoint: detail.oss_endpoint || oss.oss_endpoint,
+      oss_bucket_name: detail.oss_bucket_name || oss.oss_bucket_name,
+      region: detail.region || ots.region || oss.region,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function sameCredentialValue(
+  left: Record<string, string>,
+  right: Record<string, string>,
+  key: string,
+): boolean {
+  return (left[key] ?? "") === (right[key] ?? "");
+}
+
+function tokenMatchesInstance(
+  fields: Record<string, string>,
+  instanceName: string,
+): boolean {
+  const expected = tokenFieldsForInstance(instanceName);
+  if (!expected) return false;
+  const requiredKeys = [
+    "access_key_id",
+    "access_key_secret",
+    "ots_endpoint",
+    "ots_instance_name",
+    "oss_endpoint",
+    "oss_bucket_name",
+  ];
+  if (!requiredKeys.every((key) => sameCredentialValue(fields, expected, key))) {
+    return false;
+  }
+  // Region can be inferred by older tokens. Only reject it when both sides
+  // carry a concrete value and those values differ.
+  if (fields.region && expected.region && fields.region !== expected.region) {
+    return false;
+  }
+  return true;
+}
+
+function safeGetActiveInstanceName(): string | null {
+  try {
+    return getActiveInstanceName();
+  } catch {
+    return null;
+  }
+}
+
+function trustedActiveInstanceFromCookie(
+  request: NextRequest,
+  fields: Record<string, string>,
+): string | null {
+  if (getCookieTokenSource(request) === RAW_TOKEN_SOURCE) return null;
+
+  const instanceName = getCookieActiveInstanceName(request);
+  const activeInstance = safeGetActiveInstanceName();
+
+  if (instanceName) {
+    if (activeInstance !== instanceName) return null;
+    return tokenMatchesInstance(fields, instanceName) ? instanceName : null;
+  }
+
+  return null;
+}
+
+function getCookieTokenSource(request: NextRequest): string | null {
+  const raw = request.cookies.get(TOKEN_SOURCE_COOKIE_NAME)?.value;
+  return raw === RAW_TOKEN_SOURCE || raw === INSTANCE_TOKEN_SOURCE ? raw : null;
+}
+
+function shouldUseCookieCredentials(
+  request: NextRequest,
+  fields: Record<string, string>,
+): boolean {
+  const tokenSource = getCookieTokenSource(request);
+  if (tokenSource === RAW_TOKEN_SOURCE) return true;
+
+  const instanceName = getCookieActiveInstanceName(request);
+  if (instanceName) {
+    return trustedActiveInstanceFromCookie(request, fields) === instanceName;
+  }
+
+  const activeInstance = safeGetActiveInstanceName();
+  if (!activeInstance) return true;
+
+  // A cookie with neither explicit raw-token marker nor active-instance
+  // companion is a legacy ambiguous session. In the dashboard project UX the
+  // local TOML active instance is the source of truth, especially after an
+  // external `tablestore-agent-cli configure use`. Prefer TOML here so the
+  // header, runtime context, and resource APIs cannot split across tenants.
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // LRU cache for resolved clients
 // ---------------------------------------------------------------------------
@@ -218,14 +417,16 @@ export function clearClientCache(): void {
 function computeClientCacheKey(
   fields: Record<string, string>,
   source: CredentialSource,
+  instanceName: string | null,
 ): string {
-  // Raw cookie/env fields uniquely identify a tenant tuple now that the
-  // cookie carries the per-instance OSS coordinates directly — there is no
-  // longer a hidden disk-fallback that could vary between requests sharing
-  // the same fingerprint.
+  // The fingerprint includes the secret and named project identity so CLI-side
+  // key rotation or switching between same-tenant named projects takes effect
+  // without waiting for the TTL.
   const raw = [
     source,
+    instanceName ?? "",
     fields.access_key_id ?? "",
+    fields.access_key_secret ?? "",
     fields.ots_endpoint ?? "",
     fields.ots_instance_name ?? "",
     fields.oss_endpoint ?? "",
@@ -235,6 +436,19 @@ function computeClientCacheKey(
   return createHash("sha256").update(raw).digest("hex");
 }
 
+function computeCredentialFingerprint(fields: Record<string, string>): string {
+  const raw = [
+    fields.access_key_id ?? "",
+    fields.access_key_secret ?? "",
+    fields.ots_endpoint ?? "",
+    fields.ots_instance_name ?? "",
+    fields.oss_endpoint ?? "",
+    fields.oss_bucket_name ?? "",
+    fields.region ?? "",
+  ].join("|");
+  return createHash("sha256").update(raw).digest("hex").slice(0, 12);
+}
+
 function cacheGet(key: string): ResolvedClients | undefined {
   const hit = clientCache.get(key);
   if (!hit) return undefined;
@@ -280,8 +494,12 @@ export function resolveClients(request: NextRequest): ResolvedClients {
 
   if (token) {
     try {
-      fields = configFromToken(token);
-      source = "cookie";
+      const tokenFields = configFromToken(token);
+      if (shouldUseCookieCredentials(request, tokenFields)) {
+        fields = tokenFields;
+        source = "cookie";
+        instanceName = trustedActiveInstanceFromCookie(request, tokenFields);
+      }
     } catch (err) {
       throw new CLIError(
         "UNAUTHORIZED",
@@ -310,10 +528,9 @@ export function resolveClients(request: NextRequest): ResolvedClients {
     );
   }
 
-  // The cache key is now derived from the raw cookie/env tuple alone
-  // (no disk-backed managed_* hydrate), so compute it before constructing
-  // the AppConfig — saves one allocation on a cache hit.
-  const cacheKey = computeClientCacheKey(fields, source);
+  // The cache key is derived before constructing the AppConfig so a cache hit
+  // avoids rebuilding SDK clients while still reflecting credential rotations.
+  const cacheKey = computeClientCacheKey(fields, source, instanceName);
   const cached = cacheGet(cacheKey);
   if (cached) return cached;
   const appConfig = buildAppConfig(fields);
@@ -338,21 +555,30 @@ export function inspectCredentials(request: NextRequest): {
   region: string;
   source: CredentialSource;
   activeInstance: string | null;
+  credentialFingerprint: string;
 } | null {
   const token = request.cookies.get(SESSION_COOKIE_NAME)?.value;
   if (token) {
     try {
       const fields = configFromToken(token);
-      const region =
-        fields.region ||
-        inferRegionFromOtsEndpoint(fields.ots_endpoint) ||
-        DEFAULT_REGION;
-      return {
-        instanceName: fields.ots_instance_name,
-        region,
-        source: "cookie",
-        activeInstance: null,
-      };
+      if (!shouldUseCookieCredentials(request, fields)) {
+        // Named-project cookies are snapshots of the TOML-backed active
+        // instance. If the CLI changed or rewrote that project behind the
+        // browser's back, ignore the stale snapshot and inspect the current
+        // file/env layers below.
+      } else {
+        const region =
+          fields.region ||
+          inferRegionFromOtsEndpoint(fields.ots_endpoint) ||
+          DEFAULT_REGION;
+        return {
+          instanceName: fields.ots_instance_name,
+          region,
+          source: "cookie",
+          activeInstance: trustedActiveInstanceFromCookie(request, fields),
+          credentialFingerprint: computeCredentialFingerprint(fields),
+        };
+      }
     } catch {
       return null;
     }
@@ -369,6 +595,7 @@ export function inspectCredentials(request: NextRequest): {
       region,
       source: "instance",
       activeInstance: fromInstance.instanceName,
+      credentialFingerprint: computeCredentialFingerprint(fromInstance.fields),
     };
   }
 
@@ -383,6 +610,7 @@ export function inspectCredentials(request: NextRequest): {
     region,
     source: "env",
     activeInstance: null,
+    credentialFingerprint: computeCredentialFingerprint(envFields),
   };
 }
 

package/dist/dashboard-runtime/dashboard/src/lib/utils.ts

@@ -0,0 +1,15 @@
+import { type ClassValue, clsx } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}
+
+/**
+ * Extract the file name from an OSS key / path string.
+ * e.g. "uploads/2024/report.pdf" → "report.pdf"
+ */
+export function extractFileName(ossKey: string): string {
+  const parts = ossKey.split("/");
+  return parts[parts.length - 1] || ossKey;
+}

package/dist/dashboard-runtime/dashboard/src/providers/query-provider.tsx

@@ -2,6 +2,7 @@
 
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { useState, type ReactNode } from 'react';
+import { RuntimeContextProvider } from './runtime-context-provider';
 
 export function QueryProvider({ children }: { children: ReactNode }) {
   const [queryClient] = useState(
@@ -17,6 +18,8 @@ export function QueryProvider({ children }: { children: ReactNode }) {
   );
 
   return (
-    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+    <QueryClientProvider client={queryClient}>
+      <RuntimeContextProvider>{children}</RuntimeContextProvider>
+    </QueryClientProvider>
   );
 }

package/dist/dashboard-runtime/dashboard/src/providers/runtime-context-provider.tsx

@@ -0,0 +1,237 @@
+"use client";
+
+import {
+  createContext,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  type ReactNode,
+} from "react";
+import { usePathname } from "next/navigation";
+import { useQuery, useQueryClient, type QueryClient } from "@tanstack/react-query";
+import { toast } from "sonner";
+
+import { fetchRuntimeContext } from "../services/runtime-context";
+import type { RuntimeContext } from "../types/runtime-context";
+import {
+  PENDING_DATA_SCOPE_KEY,
+  RUNTIME_CONTEXT_QUERY_KEY,
+  resetInstanceScopedQueries,
+} from "../lib/query-keys";
+
+const RUNTIME_CONTEXT_REFETCH_INTERVAL_MS = 5_000;
+const RUNTIME_CONTEXT_NOTICE_KEY = "tsagent.runtimeContextNotice";
+const RUNTIME_CONTEXT_DASHBOARD_CHANGE_KEY =
+  "tsagent.runtimeContextDashboardChange";
+const RUNTIME_CONTEXT_DASHBOARD_CHANGE_TTL_MS = 30_000;
+
+const DEFAULT_CONTEXT: RuntimeContext = {
+  configured: false,
+  credentialSource: null,
+  activeInstance: null,
+  configRevision: "unknown",
+  dataScopeKey: PENDING_DATA_SCOPE_KEY,
+  hasAnyInstance: false,
+};
+
+interface RuntimeContextValue {
+  context: RuntimeContext;
+  ready: boolean;
+}
+
+const RuntimeContextState = createContext<RuntimeContextValue>({
+  context: DEFAULT_CONTEXT,
+  ready: false,
+});
+
+export function RuntimeContextProvider({ children }: { children: ReactNode }) {
+  const queryClient = useQueryClient();
+  const pathname = usePathname();
+  const previousRef = useRef<RuntimeContext | null>(null);
+
+  const { data } = useQuery({
+    queryKey: RUNTIME_CONTEXT_QUERY_KEY,
+    queryFn: fetchRuntimeContext,
+    staleTime: 0,
+    refetchInterval: RUNTIME_CONTEXT_REFETCH_INTERVAL_MS,
+    refetchOnWindowFocus: "always",
+    refetchOnReconnect: "always",
+  });
+
+  useEffect(() => {
+    const notice = window.sessionStorage.getItem(RUNTIME_CONTEXT_NOTICE_KEY);
+    if (!notice) return;
+    window.sessionStorage.removeItem(RUNTIME_CONTEXT_NOTICE_KEY);
+    toast.info(notice, { id: "runtime-context-changed" });
+  }, []);
+
+  useEffect(() => {
+    if (!data) return;
+    const previous = previousRef.current;
+    previousRef.current = data;
+    applyRuntimeContextTransition({
+      previous,
+      current: data,
+      pathname,
+      queryClient,
+      location: window.location,
+      storage: window.sessionStorage,
+    });
+  }, [data, pathname, queryClient]);
+
+  const value = useMemo<RuntimeContextValue>(
+    () => ({
+      context: data ?? DEFAULT_CONTEXT,
+      ready: Boolean(data),
+    }),
+    [data],
+  );
+
+  return (
+    <RuntimeContextState.Provider value={value}>
+      {children}
+    </RuntimeContextState.Provider>
+  );
+}
+
+export function useRuntimeContext(): RuntimeContextValue {
+  return useContext(RuntimeContextState);
+}
+
+export function useDataScopeKey(): string {
+  return useRuntimeContext().context.dataScopeKey;
+}
+
+interface RuntimeContextTransitionOptions {
+  previous: RuntimeContext | null;
+  current: RuntimeContext;
+  pathname: string | null;
+  queryClient: QueryClient;
+  location: Pick<Location, "href" | "replace">;
+  storage: Pick<Storage, "getItem" | "removeItem" | "setItem">;
+  resetQueries?: typeof resetInstanceScopedQueries;
+  now?: number;
+}
+
+interface DashboardRuntimeContextChange {
+  previousDataScopeKey?: string;
+  targetActiveInstance: string | null;
+  createdAt: number;
+}
+
+export function applyRuntimeContextTransition({
+  previous,
+  current,
+  pathname,
+  queryClient,
+  location,
+  storage,
+  resetQueries = resetInstanceScopedQueries,
+  now = Date.now(),
+}: RuntimeContextTransitionOptions): boolean {
+  if (!previous || previous.dataScopeKey === current.dataScopeKey) {
+    return false;
+  }
+
+  resetQueries(queryClient, previous.dataScopeKey);
+  const target = resolveRuntimeContextChangeTarget(pathname);
+  if (!consumeDashboardRuntimeContextChange(storage, previous, current, now)) {
+    storage.setItem(
+      RUNTIME_CONTEXT_NOTICE_KEY,
+      buildRuntimeContextChangeMessage(previous, current),
+    );
+  }
+  location.replace(target ?? location.href);
+  return true;
+}
+
+export function markDashboardRuntimeContextChange(
+  storage: Pick<Storage, "setItem">,
+  change: Omit<DashboardRuntimeContextChange, "createdAt">,
+  now = Date.now(),
+): void {
+  try {
+    storage.setItem(
+      RUNTIME_CONTEXT_DASHBOARD_CHANGE_KEY,
+      JSON.stringify({ ...change, createdAt: now }),
+    );
+  } catch {
+    // The marker is only for friendlier copy; losing it must never block a
+    // successful project switch.
+  }
+}
+
+function consumeDashboardRuntimeContextChange(
+  storage: Pick<Storage, "getItem" | "removeItem">,
+  previous: RuntimeContext,
+  current: RuntimeContext,
+  now: number,
+): boolean {
+  let raw: string | null;
+  try {
+    raw = storage.getItem(RUNTIME_CONTEXT_DASHBOARD_CHANGE_KEY);
+  } catch {
+    return false;
+  }
+  if (!raw) return false;
+
+  let change: DashboardRuntimeContextChange;
+  try {
+    change = JSON.parse(raw) as DashboardRuntimeContextChange;
+  } catch {
+    try {
+      storage.removeItem(RUNTIME_CONTEXT_DASHBOARD_CHANGE_KEY);
+    } catch {
+      // Ignore storage cleanup failures; the TTL keeps stale markers bounded.
+    }
+    return false;
+  }
+
+  const expired =
+    !Number.isFinite(change.createdAt) ||
+    now - change.createdAt > RUNTIME_CONTEXT_DASHBOARD_CHANGE_TTL_MS;
+  const matchesPrevious =
+    !change.previousDataScopeKey ||
+    change.previousDataScopeKey === previous.dataScopeKey;
+  const matchesTarget = change.targetActiveInstance === current.activeInstance;
+
+  try {
+    storage.removeItem(RUNTIME_CONTEXT_DASHBOARD_CHANGE_KEY);
+  } catch {
+    // Ignore storage cleanup failures; the TTL keeps stale markers bounded.
+  }
+  return !expired && matchesPrevious && matchesTarget;
+}
+
+export function resolveRuntimeContextChangeTarget(
+  pathname: string | null,
+): string | null {
+  if (!pathname) return null;
+  if (/^\/knowledge-base\/[^/]+(?:\/.*)?$/.test(pathname)) {
+    return "/knowledge-base";
+  }
+  if (/^\/memory\/[^/]+(?:\/.*)?$/.test(pathname)) {
+    return "/memory";
+  }
+  const llmProviderDetail = pathname.match(/^\/llm-providers\/([^/]+)(?:\/.*)?$/);
+  if (llmProviderDetail && llmProviderDetail[1] !== "new") {
+    return "/llm-providers";
+  }
+  return null;
+}
+
+export function buildRuntimeContextChangeMessage(
+  previous: RuntimeContext,
+  current: RuntimeContext,
+): string {
+  if (previous.activeInstance !== current.activeInstance) {
+    return current.activeInstance
+      ? `检测到 CLI 切换项目，已刷新到 ${current.activeInstance}`
+      : "检测到 CLI 切换配置，已刷新到当前凭据";
+  }
+  if (current.activeInstance) {
+    return "项目配置已更新，数据已刷新";
+  }
+  return "运行时配置已更新，数据已刷新";
+}

package/dist/dashboard-runtime/dashboard/src/schemas/common.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+
+export const paginationSchema = z.object({
+  page: z.number().int().min(1).default(1),
+  pageSize: z.number().int().min(1).max(100).default(20),
+});
+
+export type PaginationInput = z.infer<typeof paginationSchema>;

package/dist/dashboard-runtime/dashboard/src/schemas/document.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+
+const documentItemSchema = z.object({
+  ossKey: z.string().min(1, "OSS key is required").max(256),
+  metadata: z.record(z.unknown()).optional(),
+});
+
+export const addDocumentsSchema = z.object({
+  knowledgeBaseName: z.string().min(1),
+  subspace: z.string().max(128).optional(),
+  documents: z
+    .array(documentItemSchema)
+    .min(1, "At least one document is required")
+    .max(10, "At most 10 documents per request"),
+});
+
+export const uploadDocumentsSchema = z.object({
+  knowledgeBaseName: z.string().min(1),
+  subspace: z.string().max(128).optional(),
+  files: z
+    .array(z.instanceof(File))
+    .min(1, "At least one file is required")
+    .max(500, "At most 500 files per request"),
+  metadata: z.record(z.unknown()).optional(),
+});
+
+export type AddDocumentsInput = z.infer<typeof addDocumentsSchema>;
+export type UploadDocumentsInput = z.infer<typeof uploadDocumentsSchema>;