@yejiming/dsh-data-agent 0.1.1 → 0.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.en.md +35 -50
  2. package/README.md +35 -50
  3. package/dsh-plugin.json +1 -1
  4. package/lib/{catalog-DEJqOXRo.js → catalog-CbxIDQBG.js} +1 -1
  5. package/lib/client.js +145 -145
  6. package/lib/{command-CzzSPmag.js → command-scZcZG11.js} +1 -1
  7. package/lib/command.js +1 -1
  8. package/lib/{connections-CFXOZTHZ.js → connections-dGPjgsGg.js} +11 -10
  9. package/lib/index.js +4 -4
  10. package/lib/routes.js +2 -2
  11. package/lib/{tool-DNkywSph.js → tool-Du1EadNP.js} +1 -1
  12. package/lib/tool.js +1 -1
  13. package/lib/types/clients.d.ts +7 -7
  14. package/package.json +1 -1
package/README.en.md CHANGED
@@ -26,7 +26,7 @@
26
26
 
27
27
  <p align="center">
28
28
 
29
- [Project Overview](#project-overview) · [Ecosystem Status](#ecosystem-specification-status) · [Features](#features) · [Quick Install](#quick-install) · [Web UI](#using-data-agent-in-the-web-ui) · [dsh-tui](#using-data-agent-in-dsh-tui) · [Security](#security)
29
+ [Project Overview](#project-overview) · [Features](#features) · [Quick Install](#quick-install) · [Web UI](#using-data-agent-in-the-web-ui) · [dsh-tui](#using-data-agent-in-dsh-tui) · [Security](#security) · [Local Development](#local-development) · [Ecosystem Status](#ecosystem-specification-status)
30
30
 
31
31
  </p>
32
32
 
@@ -36,27 +36,10 @@ dsh-data-agent is a data analysis plugin for DeepSeek Harness (DSH). Connect a d
36
36
 
37
37
  ![Data analysis charts](assets/charts.webp)
38
38
 
39
- ## Ecosystem Specification Status
40
-
41
- This package includes an experimental declaration for the [DSH Ecosystem Specification](https://github.com/T-Auto/dsh-ecosystem-spec) Community v0.15. It does not replace or double-register the existing Cordis behavior. The native bundle, preset, commands, tools, routes, Web UI, TUI form, and connection storage remain the sole functional implementation.
42
-
43
- | Item | Current status |
44
- | --- | --- |
45
- | Specification and stage | Community v0.15, Draft / Experimental |
46
- | Pinned baseline | `dsh-ecosystem-spec@ec80a4be5d92bbb971655afd0f097bb5586a1a28`; `dsh-std@614dfa1ac168db79fcf4577cf0ebb34e2e3b944b` |
47
- | Manifest | `dsh-plugin.json`, `manifestVersion: 0.15`, package identity `@yejiming/dsh-data-agent@0.1.1` |
48
- | Admission decision | The repository's eligible fixture is `compatible`; this is not an admission result from a real dsh-TUI Host |
49
- | Evidence level | `Parsed`; fixture negotiation is recorded only as `fixture-only` and does not become `Negotiated` evidence |
50
- | Exercised environment | Offline parser/projector/definition validation; disposable local mount/unmount with `@dsh-std/adapter-dsh@0.1.0-rc3` |
51
- | Artifact | The release identity is package name and version; a tarball SHA-256 is written only to an external sidecar after a real `npm pack`, never into the source manifest |
52
- | Unverified | Real Host Descriptor, real Web/Desktop/dsh-tui, real TTY, database, remote, attach/detach, multiple Presentation, `Observed`, and `Attested` evidence |
53
-
54
- Active restrictions include intentionally leaving `UserInteraction` undeclared because the pinned Community manifest cannot carry the requirement spec required by its dsh-std definition. Model tools, the agent preset, Cordis service, HTTP routes, Web slots, persistence domain, and local TTY remain native DSH behavior. During `@dsh-std/adapter-dsh` discovery, the ecosystem facet publishes only a degraded snapshot and no second Command, Tool, or UI handler.
55
-
56
- The plugin remains **trusted in-process** and is not sandboxed. Manifest permissions are Host admission contracts; they do not provide OS, process, or realm isolation. These results are not official DSH certification, security approval, a vulnerability-free guarantee, or a universal Host compatibility claim.
57
-
58
39
  ## Features
59
40
 
41
+ ![DSH Data Agent features: conversation, SQL, data governance, business insights, reports, and read-only protection](assets/dsh-data-agent-features.webp)
42
+
60
43
  - **Analyze data through conversation**: Describe your goal in natural language. DSH understands the question, breaks it into analysis steps, queries real data, and organizes the conclusions. You can keep asking follow-up questions to explore the same context in greater depth.
61
44
  - **Discover business insights automatically**: Data Agent goes beyond returning query results. It helps compare trends, locate anomalies, identify valuable customers or products, and turn the data into explanations that support decisions.
62
45
  - **AI-assisted data governance**: Scan a database with the AI model configured in the current DSH session. Using tables, fields, comments, and relations, it generates candidate business meanings for every table and field. Every AI-generated candidate requires human review, and users can also add business terms and metric definitions manually. During later queries and analysis, Data Agent automatically reads the relevant definitions through the built-in `catalog-search`, `catalog-get`, and `metric-get` tools, grounding SQL and conclusions in governed business context.
@@ -67,42 +50,23 @@ The plugin remains **trusted in-process** and is not sandboxed. Manifest permiss
67
50
  - **Stay focused with Data Mode**: The session uses DSH's native `str_replace_editor` for files and keeps `sql-query`, `sql-write`, `sql-cmd`, `render-analysis`, `catalog-search`, `catalog-get`, and `metric-get`; Web, Desktop, dsh-tui, and headless profiles use the same eight-tool protocol. Host or community tools such as `describe_image` and `ssh_*` do not leak into Data Mode.
68
51
  - **Work safely with real data**: Use read-only mode and a read-only database account when appropriate. TUI passwords are masked and are never restored as part of a form draft. You decide whether the session may modify data.
69
52
 
70
- ![Data governance: AI-generated business meanings for tables and fields with human review](assets/data-governance.png)
71
-
72
- The Web UI also includes an on-demand database workbench. Click the database button in the top-right of the composer to use four tabs—Connection, Tables, Data Governance, and SQL—in one Modal. The Data Governance tab reads the independent persistent `data_agent_catalog@1` domain. Historical snapshots remain searchable after the live database disconnects; a new scan still requires a connection to the same stable profile.
73
-
74
- The SQL tab renders read-query results as a structured table with a sticky header, 100-row pages, and local horizontal scrolling for wide datasets. The complete loaded result can be exported as Excel (`.xlsx`), UTF-8 CSV, or copied to the clipboard, with a hard limit of 50,000 rows per query. Write/administrative commands and errors remain text messages instead of being misparsed as tables.
75
-
76
- ### Data Catalog and metric governance
77
-
78
- A Catalog scan is an explicit human action. Its first stage reads database system catalogs only: it does not read business rows, persist sample rows, or run full-table `COUNT(*)` queries for exact counts. Its second stage uses the model currently configured in the initiating DSH session to generate table-level and field-level business-meaning candidates, one table at a time. The model receives only bounded technical metadata—names, types, nullable flags, database comments, keys, and relations—not sample values, query results, or credentials. Web offers full-source, schema, and single-table scopes in the Data Governance tab, with an extra confirmation for full scans. `/database` and `/catalog` are registered only when the current Cordis composition actually loads `@deepseek-harness-tui/dsh-tui`; the profile label is not consulted, so installing Data Agent or merely naming a profile `dsh-tui` never exposes them. A normal Web composition uses the database workbench instead. dsh-tui uses:
53
+ ### Database Workbench
79
54
 
80
- Catalog metadata queries use an independent `catalogMaxResultChars` capture bound (32 MiB by default), so they no longer inherit the smaller `maxResultChars` budget used by ordinary SQL tools. Exceeding the Catalog-specific bound still fails safely with guidance to narrow the scope or adjust the configuration; a truncated snapshot is never published.
55
+ The Web UI also includes an on-demand database workbench. Click the database button in the top-right of the composer to use four tabs—Connection, Tables, Data Governance, and SQL—in one Modal.
81
56
 
82
- ```text
83
- /catalog scan Choose a scope interactively; reconfirm a full scan
84
- /catalog scan --all Explicit full-source scan
85
- /catalog scan --schema sales Scan one schema
86
- /catalog scan --schema sales --table orders
87
- /catalog status [--run <run-id>]
88
- /catalog cancel [--run <run-id>]
89
- /catalog diff [--from <run-id> --to <run-id>]
90
- /catalog view Open the read-only full-screen Catalog browser
91
- ```
92
-
93
- Scans run in the background, with at most one active run per source. When dsh-tui exposes its public extension services, a persistent line above the prompt follows the real “technical metadata → Catalog publish → AI business meanings” phases. Success, partial success, and failure remain visible until the next scan or `/catalog view`, instead of disappearing with a short notification. `/catalog view` opens a read-only full-screen scene: tables/views are paged on the left, while the selected table's summary, fields, and AI business meanings appear on the right. It supports search, independently scrolling panes, business-schema/all-schema switching, refresh, and Escape to return. Older dsh-tui versions without the public status/scene services keep the scan commands and explicitly fall back to `/catalog status` and the Web Catalog.
57
+ ![Database workbench](assets/tables.webp)
94
58
 
95
- Results are stored by stable profile, asset identity, and immutable revision. Unchanged assets do not duplicate revisions. Only a complete successful technical scan may mark absent objects `missing`, and only inside its exact scope. Table/schema scans do not alter out-of-scope assets or the last-full-scan time. Reappearing assets become `restored`. Failed, cancelled, interrupted, or permission-incomplete metadata runs never replace the previous successful snapshot, and ambiguous permission failures are not treated as deletions. AI enrichment has separate queued, running, succeeded, partial, failed, and cancelled states. Model output remains bounded; if a full-table response reaches the token limit, the same model configuration automatically retries smaller field batches and persists only after every field is complete. An AI failure does not erase a committed technical snapshot or publish an incomplete result for a table.
59
+ ### Analyze Data Through Conversation
96
60
 
97
- Database facts are `observed`; AI-generated table/field meanings and candidate business terms or metrics are `inferred`. Only human review in Web can verify the current version as `verified`. The Data Catalog groups meanings by table and lets a user confirm or delete each table or field candidate. Delete creates an auditable retired revision, hides it from the default detail, and prevents later scans from reviving or overwriting the human decision. Structural changes mark affected definitions `needs_review` without auto-verifying them. For business analysis, the agent first uses read-only `catalog-search`, then `catalog-get` for technical context or `metric-get` for an exact metric version; it falls back to live schema inspection when the Catalog has no match. AI candidates, database comments, human text, and formulas are always untrusted reference data.
61
+ Choose “Data Mode” when creating a session, and DSH will use the data-analysis workflow for everything that follows.
98
62
 
99
- The first release does not include scheduled scans, business-row sampling, AI auto-certification, external-catalog synchronization, complete lineage, Catalog-level RBAC, or physical deletion driven by a scan.
63
+ ![Data Mode preset](assets/settings.webp)
100
64
 
101
- ![Database workbench](assets/tables.webp)
65
+ ### Data Catalog and Metric Governance
102
66
 
103
- Choose “Data Mode” when creating a session, and DSH will use the data-analysis workflow for everything that follows.
67
+ In Web, open Data Governance, choose a source and scan scope, then click Scan. Search or compare results, review AI meanings, and add terms or metrics. Full scans require confirmation.
104
68
 
105
- ![Data Mode preset](assets/settings.webp)
69
+ ![Data governance: AI-generated business meanings for tables and fields with human review](assets/data-governance.png)
106
70
 
107
71
  ## Quick Install
108
72
 
@@ -226,6 +190,8 @@ The plugin tries the active profile process PATH first. If that fails, it also c
226
190
 
227
191
  MySQL and Doris invocations include `--default-character-set=utf8mb4` by default, preventing Windows code pages from corrupting Chinese database, table, column, or query-result text before it reaches DSH. You do not need to repeat this argument in the profile.
228
192
 
193
+ Schema and table names used for metadata browsing may contain Unicode letters, combining marks, numbers, `_`, and `$`; column names returned by the database are displayed unchanged. For example, a SQLite table named `中文表名` with a `姓名` column can be browsed directly in the workbench. To keep the metadata SQL boundary explicit, whitespace, controls, quotes, backticks, backslashes, semicolons, dots, hyphens, and other punctuation in schema or table inputs are still rejected before a database client starts.
194
+
229
195
  SQL Server reads use T-SQL `TOP` or an existing `OFFSET ... FETCH` clause and never append `LIMIT`. To prevent `sqlcmd` scripting from crossing the SQL boundary, `GO`, `!!`, colon commands, and `$(...)` substitutions are rejected before the client starts. The plugin does not add `-C` or another trust-server-certificate option by default.
230
196
 
231
197
  If a client lives in a company toolchain or another custom directory, add search directories to the current profile's `data-agent` config. Use an absolute command path when you need to pin one exact version, or use `args` for other CLI arguments. The current profile PATH always wins, and `searchPaths` is checked before platform defaults:
@@ -294,9 +260,24 @@ The prebuilt `lib/` directory is committed to the repository, so npm and GitHub
294
260
 
295
261
  Upgrading the specification baseline requires an explicit update to both revisions and pinned digests in `conformance/dsh-ecosystem/baseline.json`, offline conformance against the matching local checkouts, review of inventory/restriction drift, and a complete build and test run. Generate release evidence with `pnpm conformance:artifact --output-dir <outside-worktree-directory>` so a real `npm pack` tarball produces an external sidecar. Documentation and claims must stay within the weakest verified evidence level in that sidecar.
296
262
 
297
- ## License
263
+ ## Ecosystem Specification Status
298
264
 
299
- MIT
265
+ This package includes an experimental declaration for the [DSH Ecosystem Specification](https://github.com/T-Auto/dsh-ecosystem-spec) Community v0.15. It does not replace or double-register the existing Cordis behavior. The native bundle, preset, commands, tools, routes, Web UI, TUI form, and connection storage remain the sole functional implementation.
266
+
267
+ | Item | Current status |
268
+ | -------------------------| --------------------------------------------------------------------------------------------------------------------------------------------------------------------|
269
+ | Specification and stage | Community v0.15, Draft / Experimental |
270
+ | Pinned baseline | `dsh-ecosystem-spec@ec80a4be5d92bbb971655afd0f097bb5586a1a28`; `dsh-std@614dfa1ac168db79fcf4577cf0ebb34e2e3b944b` |
271
+ | Manifest | `dsh-plugin.json`, `manifestVersion: 0.15`, package identity `@yejiming/dsh-data-agent@0.1.2` |
272
+ | Admission decision | The repository's eligible fixture is `compatible`; this is not an admission result from a real dsh-TUI Host |
273
+ | Evidence level | `Parsed`; fixture negotiation is recorded only as `fixture-only` and does not become `Negotiated` evidence |
274
+ | Exercised environment | Offline parser/projector/definition validation; disposable local mount/unmount with `@dsh-std/adapter-dsh@0.1.0-rc3` |
275
+ | Artifact | The release identity is package name and version; a tarball SHA-256 is written only to an external sidecar after a real `npm pack`, never into the source manifest |
276
+ | Unverified | Real Host Descriptor, real Web/Desktop/dsh-tui, real TTY, database, remote, attach/detach, multiple Presentation, `Observed`, and `Attested` evidence |
277
+
278
+ Active restrictions include intentionally leaving `UserInteraction` undeclared because the pinned Community manifest cannot carry the requirement spec required by its dsh-std definition. Model tools, the agent preset, Cordis service, HTTP routes, Web slots, persistence domain, and local TTY remain native DSH behavior. During `@dsh-std/adapter-dsh` discovery, the ecosystem facet publishes only a degraded snapshot and no second Command, Tool, or UI handler.
279
+
280
+ The plugin remains **trusted in-process** and is not sandboxed. Manifest permissions are Host admission contracts; they do not provide OS, process, or realm isolation. These results are not official DSH certification, security approval, a vulnerability-free guarantee, or a universal Host compatibility claim.
300
281
 
301
282
  ## Related Links
302
283
 
@@ -304,3 +285,7 @@ MIT
304
285
  - [dsh-web-ui](https://github.com/dsh-external/dsh-web-ui): An extensible Web UI for DeepSeek Harness, with browser-based interaction and a plugin and theme ecosystem
305
286
  - [dsh-cc-tui](https://github.com/dsh-external/dsh-cc-tui): A keyboard-first, full-screen terminal interface for DeepSeek Harness, designed for efficient conversational development workflows
306
287
  - [platonai/Browser4](https://github.com/platonai/Browser4): an AI-native browser engine for autonomous agents, intelligent extraction, and large-scale web automation.
288
+
289
+ ## License
290
+
291
+ MIT
package/README.md CHANGED
@@ -26,7 +26,7 @@
26
26
 
27
27
  <p align="center">
28
28
 
29
- [项目简介](#项目简介) · [生态规范状态](#生态规范状态) · [主要功能](#主要功能) · [快速安装](#快速安装) · [Web UI](#在web-ui中使用) · [dsh-tui](#在dsh-tui中使用) · [安全说明](#安全说明)
29
+ [项目简介](#项目简介) · [主要功能](#主要功能) · [快速安装](#快速安装) · [Web UI](#在web-ui中使用) · [dsh-tui](#在dsh-tui中使用) · [安全说明](#安全说明) · [本地开发](#本地开发) · [生态规范状态](#生态规范状态)
30
30
 
31
31
  </p>
32
32
 
@@ -36,27 +36,10 @@ dsh-data-agent是DeepSeek Harness（DSH）的数据分析插件。连接数据
36
36
 
37
37
  ![数据分析图表](assets/charts.webp)
38
38
 
39
- ## 生态规范状态
40
-
41
- 本包附带一层实验性的 [DSH Ecosystem Specification](https://github.com/T-Auto/dsh-ecosystem-spec) Community v0.15 声明。它不会替代或重复注册现有 Cordis 功能；原生 bundle、preset、命令、工具、路由、Web UI、TUI 表单和连接存储仍是唯一功能实现。
42
-
43
- | 项目 | 当前状态 |
44
- | --- | --- |
45
- | 规范与阶段 | Community v0.15，Draft / Experimental |
46
- | 固定基线 | `dsh-ecosystem-spec@ec80a4be5d92bbb971655afd0f097bb5586a1a28`；`dsh-std@614dfa1ac168db79fcf4577cf0ebb34e2e3b944b` |
47
- | Manifest | `dsh-plugin.json`，`manifestVersion: 0.15`，包身份 `@yejiming/dsh-data-agent@0.1.1` |
48
- | 准入结果 | 仓库内 eligible fixture 为 `compatible`；这不是实际 dsh-TUI Host 的准入结论 |
49
- | 证据等级 | `Parsed`；fixture negotiation 只记录为 `fixture-only`，不提升为 `Negotiated` |
50
- | 已执行环境 | 离线 parser/projector/definition 校验；`@dsh-std/adapter-dsh@0.1.0-rc3` 一次性本地 fixture 挂载/卸载 |
51
- | Artifact | 发布物身份为包名和版本；tarball SHA-256 只在真实 `npm pack` 后写入工作树外 sidecar，不嵌入 source manifest |
52
- | 未验证 | 真实 Host Descriptor、真实 Web/Desktop/dsh-tui、真实 TTY、数据库、remote、attach/detach、多 Presentation、`Observed`、`Attested` |
53
-
54
- 主要限制包括：`UserInteraction` 因固定 Community manifest 无法携带 dsh-std definition 所需 requirement spec 而暂不声明；模型工具、agent preset、Cordis service、HTTP routes、Web slots、持久化域和本地 TTY 仍由原生 DSH 路径拥有。安装 `@dsh-std/adapter-dsh` 进行发现时，生态 facet 只发布降级快照，不发布第二个 Command、Tool 或 UI handler。
55
-
56
- 该插件仍是 **trusted in-process**、非沙箱代码。Manifest permission 是 Host 的准入契约，不提供 OS、进程或 realm 隔离。上述结果不代表 DSH 官方认证、安全批准、无漏洞保证或对所有 Host 的普遍兼容承诺。
57
-
58
39
  ## 主要功能
59
40
 
41
+ ![DSH Data Agent主要功能：对话、SQL、数据治理、商业洞察、分析报告与只读保护](assets/dsh-data-agent-features.webp)
42
+
60
43
  - **通过对话完成数据分析**：直接用自然语言描述目标，DSH会理解问题、拆解分析步骤、查询真实数据并整理结论。你可以继续追问，分析会沿着当前上下文逐步深入。
61
44
  - **自动寻找商业洞察**：不仅返回查询结果，还能帮助比较趋势、定位异常、识别高价值客户或商品，并把数据转化为便于业务决策的说明。
62
45
  - **AI驱动的数据治理**：使用当前DSH会话配置的AI模型扫描数据库，根据库表、字段、注释和关系，为每张表及每个字段生成业务含义候选。所有AI候选都需要人工确认，用户也可以人工补充业务术语和指标定义。后续查询分析时，数据Agent会通过内置的`catalog-search`、`catalog-get`和`metric-get`工具自动读取相关业务定义，让SQL和分析结论基于经过治理的业务口径。
@@ -67,42 +50,23 @@ dsh-data-agent是DeepSeek Harness（DSH）的数据分析插件。连接数据
67
50
  - **专注数据任务的数据模式**：会话使用DSH原生`str_replace_editor`处理文件，并保留`sql-query`、`sql-write`、`sql-cmd`、`render-analysis`、`catalog-search`、`catalog-get`与`metric-get`；Web、Desktop、dsh-tui和headless profile使用同一套八工具协议。`describe_image`、`ssh_*`等宿主或社区插件工具不会进入数据模式。
68
51
  - **安全地使用真实数据**：支持只读模式和数据库只读账号；TUI密码会被隐藏，且不会作为表单草稿恢复。是否允许修改数据由你决定。
69
52
 
70
- ![数据治理：AI生成表和字段业务含义，并由用户审核](assets/data-governance.png)
71
-
72
- Web UI还提供按需数据库工作台：点击输入框右上角的数据库按钮，即可在同一个Modal的“连接配置、库表、数据治理、SQL”四个页签中配置连接、浏览结构、治理口径或临时运行SQL。“数据治理”页读取独立的`data_agent_catalog@1`持久化域；只要存在历史snapshot，断开实时数据库后仍可搜索和查看，重新扫描则必须连接到同一个稳定Profile。
73
-
74
- SQL命令页会把读查询结果显示为带固定表头的结构化表格，并按100行分页，宽表可在结果区内横向滚动。当前结果可导出为Excel（`.xlsx`）、UTF-8 CSV或复制到剪贴板；三种导出都包含已加载的完整结果，单次最多50,000行。写入/管理命令及错误仍显示为文本消息，不会被误解析成表格。
53
+ ### 数据库工作台
75
54
 
76
- ### 数据目录与口径治理
55
+ Web UI还提供按需数据库工作台：点击输入框右上角的数据库按钮，即可在同一个Modal的“连接配置、库表、数据治理、SQL”四个页签中配置连接、浏览结构、治理口径或临时运行SQL。
77
56
 
78
- Catalog扫描是显式人工动作。第一阶段只读取数据库系统目录，不读取业务明细、不保存样例行，也不会为精确行数执行全表`COUNT(*)`；第二阶段调用发起扫描的DSH会话当前配置模型，按表生成表级和字段级业务含义候选。发送给模型的只有表/字段名称、类型、nullable、数据库注释、键和关系等有界技术元数据，不包含样例值、查询结果或凭据。Web可在“数据治理”页选择全库、Schema或单表范围；全库扫描需要二次确认。`/database`和`/catalog`只在当前Cordis组合实际加载`@deepseek-harness-tui/dsh-tui`插件时注册；Profile名称不参与判断，仅安装Data Agent或把Profile命名为`dsh-tui`都不会暴露命令。普通Web组合不展示这两个命令，而是在数据库工作台中完成连接和扫描。dsh-tui使用：
79
-
80
- Catalog元数据查询使用独立的`catalogMaxResultChars`捕获上限（默认32 MiB），不会再受普通SQL工具较小的`maxResultChars`限制；超过Catalog专属上限时仍会安全失败，并提示缩小扫描范围或调整配置，不会发布被截断的snapshot。
81
-
82
- ```text
83
- /catalog scan 交互选择范围；选择全库时再次确认
84
- /catalog scan --all 显式全库扫描
85
- /catalog scan --schema sales 扫描一个Schema
86
- /catalog scan --schema sales --table orders
87
- /catalog status [--run <run-id>]
88
- /catalog cancel [--run <run-id>]
89
- /catalog diff [--from <run-id> --to <run-id>]
90
- /catalog view 打开只读全屏目录浏览器
91
- ```
92
-
93
- 扫描在后台运行，同一个source同时只允许一个活动run。在提供公开扩展接口的dsh-tui中，输入框上方会持续显示“技术元数据采集 → 目录发布 → AI业务含义”的实际进度；成功、部分成功或失败终态会一直保留到下一次扫描或打开`/catalog view`，不再依赖短暂通知。`/catalog view`使用全屏只读场景：左侧按表/视图分页，右侧展示表级说明、字段类型与字段级AI业务含义，支持搜索、左右独立滚动、业务Schema/全部Schema切换和刷新；按Esc返回。旧版dsh-tui没有公开状态/scene服务时，扫描命令仍可用，并明确回退到`/catalog status`和Web“数据治理”页。
57
+ ![数据库工作台](assets/tables.webp)
94
58
 
95
- 结果按稳定Profile、资产身份和不可变revision保存：未变化对象不复制revision；完整成功的技术扫描只在其精确范围内把消失对象标记为`missing`；单表/Schema扫描不会改动范围外对象，也不会更新最近全库扫描时间；对象重新出现时记录为`restored`。元数据失败、取消、中断或权限不完整的run不会覆盖上一份成功snapshot，权限不确定时也不会把对象误判为删除。AI阶段具有独立的排队、运行、成功、部分成功、失败和取消状态；模型输出保持有界，整表输出触及token上限时会沿用当前模型配置并自动按字段分批重试，只有整张表的字段结果齐全后才写入。AI失败不会抹掉已经成功提交的技术snapshot，也不会把不完整表结果写成候选。
59
+ ### 通过对话完成数据分析
96
60
 
97
- 数据库事实是`observed`，AI生成的表/字段业务含义以及候选业务术语/指标是`inferred`；只有Web中的人工审核可以基于当前version确认成`verified`。数据目录按表展示表级说明和每个字段说明，用户可以逐项确认或删除；删除会保留审计revision并从默认详情隐藏，后续扫描不会自动复活或覆盖已确认/已删除决策。结构变化会把受影响口径标为`needs_review`，不会自动确认。Agent分析业务问题时先用只读`catalog-search`查找目录，再用`catalog-get`读取技术上下文或`metric-get`读取精确指标版本；目录无命中时再回退到实时Schema探查。目录中的AI候选、数据库注释、人工说明和公式都按不可信参考文本处理。
61
+ 创建会话时选择“数据模式”，DSH就会以数据分析工作流处理后续问题。
98
62
 
99
- 首版不包含定时扫描、业务明细采样、AI自动认证、外部Catalog同步、完整血缘、Catalog级RBAC或扫描结果物理删除。
63
+ ![数据模式预设](assets/settings.webp)
100
64
 
101
- ![数据库工作台](assets/tables.webp)
65
+ ### 数据治理
102
66
 
103
- 创建会话时选择“数据模式”，DSH就会以数据分析工作流处理后续问题。
67
+ 在Web数据库工作台打开“数据治理”页，选择数据源和扫描范围（全库、Schema或单表），点击“扫描”；全库扫描需再次确认。完成后可搜索表、字段、术语或指标，查看版本变化，并逐项确认或删除AI生成的表/字段业务含义，也可人工新增业务术语和指标定义。后续分析会自动参考已保存的口径。
104
68
 
105
- ![数据模式预设](assets/settings.webp)
69
+ ![数据治理：AI生成表和字段业务含义，并由用户审核](assets/data-governance.png)
106
70
 
107
71
  ## 快速安装
108
72
 
@@ -225,6 +189,8 @@ DSH运行查询时需要本机能够访问目标数据库，并安装相应的
225
189
 
226
190
  插件调用MySQL或Doris客户端时会内置`--default-character-set=utf8mb4`，确保Windows代码页不会使库名、表名、字段名或查询结果中的中文在进入DSH前乱码，无需在profile中重复配置该参数。
227
191
 
192
+ 库表元数据浏览支持由Unicode字母、组合标记、数字以及`_`、`$`组成的schema和表名，数据库返回的字段名会原样展示。例如SQLite中的`中文表名`及其`姓名`字段可以直接在工作台中浏览。为保持元数据SQL边界明确，schema和表名中的空白、控制字符、引号、反引号、反斜杠、分号、点号、连字符及其他标点仍会在启动数据库客户端前被拒绝。
193
+
228
194
  SQL Server查询使用T-SQL `TOP`或已有的`OFFSET ... FETCH`限行，绝不会追加`LIMIT`。为避免`sqlcmd`自身脚本能力绕过SQL边界，输入中的`GO`、`!!`、冒号命令和`$(...)`变量替换会在启动客户端前被拒绝。插件不会默认添加`-C`或其他“信任服务器证书”选项。
229
195
 
230
196
  如果客户端安装在公司工具链或其他自定义目录，可在当前profile的`data-agent`配置中补充搜索目录；需要锁定具体版本时则直接填写绝对命令路径，也可通过`args`添加其他CLI参数。当前profile的PATH始终优先，`searchPaths`在系统常见目录之前：
@@ -293,9 +259,24 @@ pnpm conformance
293
259
 
294
260
  升级规范基线必须显式更新`conformance/dsh-ecosystem/baseline.json`中的两个revision和固定digest，使用对应的本地checkout离线运行conformance，复核inventory/restriction漂移，并重新执行完整构建与测试。发布证据应运行`pnpm conformance:artifact --output-dir <工作树外目录>`，从真实`npm pack` tarball生成外部sidecar；文档和claim不得超过其中最弱的已验证证据等级。
295
261
 
296
- ## 许可
262
+ ## 生态规范状态
297
263
 
298
- MIT
264
+ 本包附带一层实验性的 [DSH Ecosystem Specification](https://github.com/T-Auto/dsh-ecosystem-spec) Community v0.15 声明。它不会替代或重复注册现有 Cordis 功能；原生 bundle、preset、命令、工具、路由、Web UI、TUI 表单和连接存储仍是唯一功能实现。
265
+
266
+ | 项目 | 当前状态 |
267
+ | --- | --- |
268
+ | 规范与阶段 | Community v0.15，Draft / Experimental |
269
+ | 固定基线 | `dsh-ecosystem-spec@ec80a4be5d92bbb971655afd0f097bb5586a1a28`；`dsh-std@614dfa1ac168db79fcf4577cf0ebb34e2e3b944b` |
270
+ | Manifest | `dsh-plugin.json`，`manifestVersion: 0.15`，包身份 `@yejiming/dsh-data-agent@0.1.2` |
271
+ | 准入结果 | 仓库内 eligible fixture 为 `compatible`；这不是实际 dsh-TUI Host 的准入结论 |
272
+ | 证据等级 | `Parsed`；fixture negotiation 只记录为 `fixture-only`，不提升为 `Negotiated` |
273
+ | 已执行环境 | 离线 parser/projector/definition 校验；`@dsh-std/adapter-dsh@0.1.0-rc3` 一次性本地 fixture 挂载/卸载 |
274
+ | Artifact | 发布物身份为包名和版本；tarball SHA-256 只在真实 `npm pack` 后写入工作树外 sidecar，不嵌入 source manifest |
275
+ | 未验证 | 真实 Host Descriptor、真实 Web/Desktop/dsh-tui、真实 TTY、数据库、remote、attach/detach、多 Presentation、`Observed`、`Attested` |
276
+
277
+ 主要限制包括：`UserInteraction` 因固定 Community manifest 无法携带 dsh-std definition 所需 requirement spec 而暂不声明；模型工具、agent preset、Cordis service、HTTP routes、Web slots、持久化域和本地 TTY 仍由原生 DSH 路径拥有。安装 `@dsh-std/adapter-dsh` 进行发现时，生态 facet 只发布降级快照，不发布第二个 Command、Tool 或 UI handler。
278
+
279
+ 该插件仍是 **trusted in-process**、非沙箱代码。Manifest permission 是 Host 的准入契约，不提供 OS、进程或 realm 隔离。上述结果不代表 DSH 官方认证、安全批准、无漏洞保证或对所有 Host 的普遍兼容承诺。
299
280
 
300
281
  ## 友情链接
301
282
 
@@ -303,3 +284,7 @@ MIT
303
284
  - [dsh-web-ui](https://github.com/dsh-external/dsh-web-ui)：DeepSeek Harness的可扩展Web UI，支持浏览器端交互以及插件与主题扩展
304
285
  - [dsh-cc-tui](https://github.com/dsh-external/dsh-cc-tui)：面向DeepSeek Harness的键盘优先全屏终端界面，适用于高效的对话式开发工作流
305
286
  - [platonai/Browser4](https://github.com/platonai/Browser4)：面向自主智能体、智能信息抽取与大规模Web自动化的AI原生浏览器引擎
287
+
288
+ ## 许可
289
+
290
+ MIT
package/dsh-plugin.json CHANGED
@@ -3,7 +3,7 @@
3
3
  "manifestVersion": "0.15",
4
4
  "id": "io.github.omdsh-dev.dsh-data-agent",
5
5
  "name": "DSH Data Agent",
6
- "version": "0.1.1",
6
+ "version": "0.1.2",
7
7
  "facets": {
8
8
  "host": {
9
9
  "entry": "lib/ecosystem.js",
package/lib/{catalog-DEJqOXRo.js → catalog-CbxIDQBG.js} RENAMED
@@ -1,4 +1,4 @@
1
- import { b as DATABASE_TYPES, r as redactSecretText } from "./connections-CFXOZTHZ.js";
1
+ import { b as DATABASE_TYPES, r as redactSecretText } from "./connections-dGPjgsGg.js";
2
2
  import { a as catalogSemanticRevisionId, c as normalizeCatalogIdentifier, i as catalogSemanticId, l as normalizeCatalogText, n as catalogAssetId, o as catalogSourceId, r as catalogRevisionId, s as catalogTechnicalFingerprint, t as canonicalCatalogIdentity, u as stableJson } from "./catalog-identity-CVftmvQL.js";
3
3
  import { createHash } from "node:crypto";
4
4
  import { basename } from "node:path";
package/lib/client.js CHANGED
@@ -1011,150 +1011,150 @@ window.__ModuleLoader__.load({
1011
1011
  document.head.appendChild(tag);
1012
1012
  }
1013
1013
  var DataAgentWorkbench_module_css_default = {
1014
- "catalogDetailHeader": "Sv3uVW_catalogDetailHeader",
1015
- "catalogMeaningActions": "Sv3uVW_catalogMeaningActions",
1014
+ "workbench": "Sv3uVW_workbench",
1015
+ "connectionSummary": "Sv3uVW_connectionSummary",
1016
+ "shortcutHint": "Sv3uVW_shortcutHint",
1017
+ "catalogError": "Sv3uVW_catalogError",
1018
+ "catalogBadge_needs_review": "Sv3uVW_catalogBadge_needs_review",
1019
+ "catalogScanTimes": "Sv3uVW_catalogScanTimes",
1020
+ "treeIcon": "Sv3uVW_treeIcon",
1016
1021
  "fieldGrid": "Sv3uVW_fieldGrid",
1022
+ "sqlResultToolbar": "Sv3uVW_sqlResultToolbar",
1023
+ "tree": "Sv3uVW_tree",
1017
1024
  "modalColTitle": "Sv3uVW_modalColTitle",
1018
- "sqlPageActions": "Sv3uVW_sqlPageActions",
1025
+ "sqlResultEmpty": "Sv3uVW_sqlResultEmpty",
1026
+ "catalogSearchActions": "Sv3uVW_catalogSearchActions",
1027
+ "catalogSectionLabel": "Sv3uVW_catalogSectionLabel",
1028
+ "catalogCounts": "Sv3uVW_catalogCounts",
1029
+ "errorText": "Sv3uVW_errorText",
1030
+ "field": "Sv3uVW_field",
1031
+ "nullCell": "Sv3uVW_nullCell",
1032
+ "trigger": "Sv3uVW_trigger",
1019
1033
  "treeNode": "Sv3uVW_treeNode",
1020
- "catalogBadge_retired": "Sv3uVW_catalogBadge_retired",
1021
- "rememberHint": "Sv3uVW_rememberHint",
1022
- "catalogScanBar": "Sv3uVW_catalogScanBar",
1023
- "catalogDefinition": "Sv3uVW_catalogDefinition",
1024
- "sqlTableScroll": "Sv3uVW_sqlTableScroll",
1025
- "treeScroll": "Sv3uVW_treeScroll",
1026
- "catalogMeaningSection": "Sv3uVW_catalogMeaningSection",
1027
- "tabPanel": "Sv3uVW_tabPanel",
1028
- "ghost": "Sv3uVW_ghost",
1034
+ "catalogLatestLabel": "Sv3uVW_catalogLatestLabel",
1029
1035
  "catalogSearch": "Sv3uVW_catalogSearch",
1030
- "modalCol": "Sv3uVW_modalCol",
1031
- "active": "Sv3uVW_active",
1032
- "catalogDetailTab": "Sv3uVW_catalogDetailTab",
1033
- "errorText": "Sv3uVW_errorText",
1036
+ "catalogBadge_inferred": "Sv3uVW_catalogBadge_inferred",
1037
+ "catalogDetailTabActive": "Sv3uVW_catalogDetailTabActive",
1038
+ "catalogBusinessEmpty": "Sv3uVW_catalogBusinessEmpty",
1039
+ "catalogMeaningFields": "Sv3uVW_catalogMeaningFields",
1040
+ "catalogLatestRun": "Sv3uVW_catalogLatestRun",
1041
+ "sqlResultMeta": "Sv3uVW_sqlResultMeta",
1042
+ "ghost": "Sv3uVW_ghost",
1043
+ "triggerDot": "Sv3uVW_triggerDot",
1044
+ "catalogToolbar": "Sv3uVW_catalogToolbar",
1045
+ "input": "Sv3uVW_input",
1046
+ "catalogBadge_observed": "Sv3uVW_catalogBadge_observed",
1047
+ "rememberRow": "Sv3uVW_rememberRow",
1034
1048
  "visuallyHidden": "Sv3uVW_visuallyHidden",
1049
+ "tab": "Sv3uVW_tab",
1050
+ "catalogBadge": "Sv3uVW_catalogBadge",
1051
+ "primary": "Sv3uVW_primary",
1052
+ "catalogProgress": "Sv3uVW_catalogProgress",
1053
+ "catalogScanBar": "Sv3uVW_catalogScanBar",
1054
+ "actions": "Sv3uVW_actions",
1055
+ "catalogDetailTitle": "Sv3uVW_catalogDetailTitle",
1056
+ "sqlResultTable": "Sv3uVW_sqlResultTable",
1057
+ "treeItem": "Sv3uVW_treeItem",
1035
1058
  "connectionState": "Sv3uVW_connectionState",
1059
+ "sqlMessageError": "Sv3uVW_sqlMessageError",
1060
+ "catalogActions": "Sv3uVW_catalogActions",
1061
+ "catalogWorkspace": "Sv3uVW_catalogWorkspace",
1062
+ "colScroll": "Sv3uVW_colScroll",
1036
1063
  "summaryDb": "Sv3uVW_summaryDb",
1037
- "triggerSlot": "Sv3uVW_triggerSlot",
1038
- "typeCell": "Sv3uVW_typeCell",
1039
- "workbenchModalContent": "Sv3uVW_workbenchModalContent",
1040
- "catalogMeaningMissing": "Sv3uVW_catalogMeaningMissing",
1041
- "workbench": "Sv3uVW_workbench",
1042
- "sqlNull": "Sv3uVW_sqlNull",
1043
- "catalogDetailTabs": "Sv3uVW_catalogDetailTabs",
1044
- "catalogToolbar": "Sv3uVW_catalogToolbar",
1064
+ "treeScroll": "Sv3uVW_treeScroll",
1065
+ "catalogPanel": "Sv3uVW_catalogPanel",
1066
+ "catalogItem": "Sv3uVW_catalogItem",
1067
+ "catalogBadge_retired": "Sv3uVW_catalogBadge_retired",
1068
+ "tabActive": "Sv3uVW_tabActive",
1069
+ "sqlEmptyString": "Sv3uVW_sqlEmptyString",
1070
+ "catalogBadge_verified": "Sv3uVW_catalogBadge_verified",
1045
1071
  "sqlActions": "Sv3uVW_sqlActions",
1046
- "catalogBadge_unavailable": "Sv3uVW_catalogBadge_unavailable",
1047
- "catalogBadge_missing": "Sv3uVW_catalogBadge_missing",
1048
- "triggerDot": "Sv3uVW_triggerDot",
1049
- "catalogBusinessEmpty": "Sv3uVW_catalogBusinessEmpty",
1050
- "sqlExportActions": "Sv3uVW_sqlExportActions",
1051
- "tabs": "Sv3uVW_tabs",
1052
- "errorIcon": "Sv3uVW_errorIcon",
1053
- "catalogHistoryItem": "Sv3uVW_catalogHistoryItem",
1072
+ "rememberHint": "Sv3uVW_rememberHint",
1073
+ "catalogBadge_changed": "Sv3uVW_catalogBadge_changed",
1074
+ "catalogStats": "Sv3uVW_catalogStats",
1075
+ "modalHint": "Sv3uVW_modalHint",
1076
+ "catalogRelations": "Sv3uVW_catalogRelations",
1077
+ "catalogDetailScroll": "Sv3uVW_catalogDetailScroll",
1054
1078
  "catalogMeaningReview": "Sv3uVW_catalogMeaningReview",
1055
- "catalogControl": "Sv3uVW_catalogControl",
1056
- "emptyStateText": "Sv3uVW_emptyStateText",
1057
- "catalogLatestLabel": "Sv3uVW_catalogLatestLabel",
1058
- "treeName": "Sv3uVW_treeName",
1059
- "treeIcon": "Sv3uVW_treeIcon",
1060
- "catalogLatestRun": "Sv3uVW_catalogLatestRun",
1061
- "trigger": "Sv3uVW_trigger",
1079
+ "catalogMeaningField": "Sv3uVW_catalogMeaningField",
1080
+ "catalogMeaningCardCompact": "Sv3uVW_catalogMeaningCardCompact",
1081
+ "sqlExportButton": "Sv3uVW_sqlExportButton",
1082
+ "catalogHistoryItem": "Sv3uVW_catalogHistoryItem",
1083
+ "hint": "Sv3uVW_hint",
1084
+ "tabPanel": "Sv3uVW_tabPanel",
1085
+ "catalogDiffBar": "Sv3uVW_catalogDiffBar",
1062
1086
  "catalogCheck": "Sv3uVW_catalogCheck",
1063
- "sqlFeedback": "Sv3uVW_sqlFeedback",
1064
- "catalogResults": "Sv3uVW_catalogResults",
1065
- "sqlEmptyString": "Sv3uVW_sqlEmptyString",
1066
- "workbenchModal": "Sv3uVW_workbenchModal",
1067
- "connectionSummary": "Sv3uVW_connectionSummary",
1087
+ "errorBar": "Sv3uVW_errorBar",
1088
+ "sqlTableEmpty": "Sv3uVW_sqlTableEmpty",
1089
+ "triggerSlot": "Sv3uVW_triggerSlot",
1090
+ "catalogDetailTabs": "Sv3uVW_catalogDetailTabs",
1091
+ "summaryType": "Sv3uVW_summaryType",
1092
+ "catalogListEmpty": "Sv3uVW_catalogListEmpty",
1093
+ "treeChildren": "Sv3uVW_treeChildren",
1094
+ "catalogDetailTab": "Sv3uVW_catalogDetailTab",
1095
+ "triggerActive": "Sv3uVW_triggerActive",
1096
+ "catalogConfirm": "Sv3uVW_catalogConfirm",
1068
1097
  "schemaPanel": "Sv3uVW_schemaPanel",
1069
- "catalogError": "Sv3uVW_catalogError",
1070
- "catalogSearchQuery": "Sv3uVW_catalogSearchQuery",
1071
- "tree": "Sv3uVW_tree",
1072
- "nullCell": "Sv3uVW_nullCell",
1073
- "tabActive": "Sv3uVW_tabActive",
1074
- "catalogNotice": "Sv3uVW_catalogNotice",
1098
+ "catalogList": "Sv3uVW_catalogList",
1099
+ "tabs": "Sv3uVW_tabs",
1100
+ "typeCell": "Sv3uVW_typeCell",
1075
1101
  "catalogSourceName": "Sv3uVW_catalogSourceName",
1076
- "catalogDetailScroll": "Sv3uVW_catalogDetailScroll",
1077
- "catalogMeaningOrigin": "Sv3uVW_catalogMeaningOrigin",
1078
- "catalogActions": "Sv3uVW_catalogActions",
1079
- "catalogSearchActions": "Sv3uVW_catalogSearchActions",
1080
- "catalogDetailCounts": "Sv3uVW_catalogDetailCounts",
1081
- "sqlResultLimit": "Sv3uVW_sqlResultLimit",
1082
- "catalogActionGroup": "Sv3uVW_catalogActionGroup",
1102
+ "catalogControl": "Sv3uVW_catalogControl",
1103
+ "sqlExportActions": "Sv3uVW_sqlExportActions",
1104
+ "sqlNull": "Sv3uVW_sqlNull",
1083
1105
  "catalogOverview": "Sv3uVW_catalogOverview",
1084
- "catalogMeaningField": "Sv3uVW_catalogMeaningField",
1085
- "catalogSectionLabel": "Sv3uVW_catalogSectionLabel",
1086
- "catalogBadge": "Sv3uVW_catalogBadge",
1087
- "catalogTextArea": "Sv3uVW_catalogTextArea",
1106
+ "treeName": "Sv3uVW_treeName",
1107
+ "treeChevron": "Sv3uVW_treeChevron",
1088
1108
  "catalogInlineNotice": "Sv3uVW_catalogInlineNotice",
1089
- "sqlPageButton": "Sv3uVW_sqlPageButton",
1090
- "catalogBadge_needs_review": "Sv3uVW_catalogBadge_needs_review",
1091
- "catalogBadge_changed": "Sv3uVW_catalogBadge_changed",
1092
- "hint": "Sv3uVW_hint",
1093
- "errorBar": "Sv3uVW_errorBar",
1094
- "open": "Sv3uVW_open",
1095
- "catalogDetailTitle": "Sv3uVW_catalogDetailTitle",
1096
- "catalogBadge_inferred": "Sv3uVW_catalogBadge_inferred",
1097
- "sqlResultTable": "Sv3uVW_sqlResultTable",
1098
- "catalogDetail": "Sv3uVW_catalogDetail",
1099
- "errorHead": "Sv3uVW_errorHead",
1100
- "catalogCounts": "Sv3uVW_catalogCounts",
1109
+ "sqlResultPanel": "Sv3uVW_sqlResultPanel",
1110
+ "catalogNotice": "Sv3uVW_catalogNotice",
1101
1111
  "label": "Sv3uVW_label",
1102
- "colCount": "Sv3uVW_colCount",
1112
+ "sqlResultLimit": "Sv3uVW_sqlResultLimit",
1113
+ "catalogDetailCounts": "Sv3uVW_catalogDetailCounts",
1103
1114
  "catalogBadge_restored": "Sv3uVW_catalogBadge_restored",
1115
+ "sqlInput": "Sv3uVW_sqlInput",
1116
+ "catalogMeaningMissing": "Sv3uVW_catalogMeaningMissing",
1117
+ "colCount": "Sv3uVW_colCount",
1118
+ "emptyStateIcon": "Sv3uVW_emptyStateIcon",
1104
1119
  "catalogMeaningFieldMeta": "Sv3uVW_catalogMeaningFieldMeta",
1105
- "catalogBadge_observed": "Sv3uVW_catalogBadge_observed",
1106
- "sqlTableEmpty": "Sv3uVW_sqlTableEmpty",
1107
1120
  "columnsTable": "Sv3uVW_columnsTable",
1108
- "catalogProgress": "Sv3uVW_catalogProgress",
1109
- "catalogListEmpty": "Sv3uVW_catalogListEmpty",
1110
- "catalogMeaningCardCompact": "Sv3uVW_catalogMeaningCardCompact",
1111
- "input": "Sv3uVW_input",
1112
- "sqlMessage": "Sv3uVW_sqlMessage",
1113
- "fieldRow2": "Sv3uVW_fieldRow2",
1114
- "field": "Sv3uVW_field",
1115
- "sqlInput": "Sv3uVW_sqlInput",
1116
- "colScroll": "Sv3uVW_colScroll",
1117
- "sqlResultMeta": "Sv3uVW_sqlResultMeta",
1118
- "catalogLatestError": "Sv3uVW_catalogLatestError",
1121
+ "sqlPageActions": "Sv3uVW_sqlPageActions",
1122
+ "catalogMeaningOrigin": "Sv3uVW_catalogMeaningOrigin",
1123
+ "treeCount": "Sv3uVW_treeCount",
1124
+ "catalogDetailHeader": "Sv3uVW_catalogDetailHeader",
1125
+ "emptyStateText": "Sv3uVW_emptyStateText",
1126
+ "catalogMeaningActions": "Sv3uVW_catalogMeaningActions",
1127
+ "catalogMeaningSection": "Sv3uVW_catalogMeaningSection",
1128
+ "active": "Sv3uVW_active",
1129
+ "sqlTableScroll": "Sv3uVW_sqlTableScroll",
1119
1130
  "catalogScanFacts": "Sv3uVW_catalogScanFacts",
1120
1131
  "catalogEditor": "Sv3uVW_catalogEditor",
1121
- "treeItem": "Sv3uVW_treeItem",
1122
- "catalogMeaningFields": "Sv3uVW_catalogMeaningFields",
1123
1132
  "catalogFacts": "Sv3uVW_catalogFacts",
1124
- "sqlExportButton": "Sv3uVW_sqlExportButton",
1125
- "catalogDiffBar": "Sv3uVW_catalogDiffBar",
1126
- "catalogRelations": "Sv3uVW_catalogRelations",
1127
- "sqlResultEmpty": "Sv3uVW_sqlResultEmpty",
1128
- "sqlResultPanel": "Sv3uVW_sqlResultPanel",
1129
- "catalogStats": "Sv3uVW_catalogStats",
1130
- "emptyStateIcon": "Sv3uVW_emptyStateIcon",
1131
- "catalogWorkspace": "Sv3uVW_catalogWorkspace",
1132
- "triggerActive": "Sv3uVW_triggerActive",
1133
- "catalogList": "Sv3uVW_catalogList",
1134
- "catalogScanTimes": "Sv3uVW_catalogScanTimes",
1135
- "sqlPagination": "Sv3uVW_sqlPagination",
1136
- "sqlMessageError": "Sv3uVW_sqlMessageError",
1137
- "emptyState": "Sv3uVW_emptyState",
1138
- "sqlPanel": "Sv3uVW_sqlPanel",
1139
- "treeChevron": "Sv3uVW_treeChevron",
1140
- "treeCount": "Sv3uVW_treeCount",
1141
- "summaryType": "Sv3uVW_summaryType",
1142
- "catalogPanel": "Sv3uVW_catalogPanel",
1143
- "catalogConfirm": "Sv3uVW_catalogConfirm",
1144
- "catalogItem": "Sv3uVW_catalogItem",
1145
- "modalHint": "Sv3uVW_modalHint",
1146
- "shortcutHint": "Sv3uVW_shortcutHint",
1147
- "rememberRow": "Sv3uVW_rememberRow",
1148
- "catalogBadge_verified": "Sv3uVW_catalogBadge_verified",
1149
- "tab": "Sv3uVW_tab",
1150
1133
  "catalogMeaningCard": "Sv3uVW_catalogMeaningCard",
1151
- "actions": "Sv3uVW_actions",
1152
- "catalogItemHead": "Sv3uVW_catalogItemHead",
1153
- "treeChildren": "Sv3uVW_treeChildren",
1134
+ "catalogTextArea": "Sv3uVW_catalogTextArea",
1135
+ "sqlPanel": "Sv3uVW_sqlPanel",
1136
+ "errorHead": "Sv3uVW_errorHead",
1137
+ "workbenchModal": "Sv3uVW_workbenchModal",
1138
+ "errorIcon": "Sv3uVW_errorIcon",
1139
+ "sqlMessage": "Sv3uVW_sqlMessage",
1140
+ "sqlPagination": "Sv3uVW_sqlPagination",
1141
+ "catalogLatestError": "Sv3uVW_catalogLatestError",
1142
+ "catalogDetail": "Sv3uVW_catalogDetail",
1154
1143
  "catalogItemActive": "Sv3uVW_catalogItemActive",
1155
- "primary": "Sv3uVW_primary",
1156
- "sqlResultToolbar": "Sv3uVW_sqlResultToolbar",
1157
- "catalogDetailTabActive": "Sv3uVW_catalogDetailTabActive"
1144
+ "workbenchModalContent": "Sv3uVW_workbenchModalContent",
1145
+ "catalogActionGroup": "Sv3uVW_catalogActionGroup",
1146
+ "catalogResults": "Sv3uVW_catalogResults",
1147
+ "fieldRow2": "Sv3uVW_fieldRow2",
1148
+ "catalogBadge_unavailable": "Sv3uVW_catalogBadge_unavailable",
1149
+ "catalogDefinition": "Sv3uVW_catalogDefinition",
1150
+ "open": "Sv3uVW_open",
1151
+ "modalCol": "Sv3uVW_modalCol",
1152
+ "sqlPageButton": "Sv3uVW_sqlPageButton",
1153
+ "catalogItemHead": "Sv3uVW_catalogItemHead",
1154
+ "catalogBadge_missing": "Sv3uVW_catalogBadge_missing",
1155
+ "sqlFeedback": "Sv3uVW_sqlFeedback",
1156
+ "emptyState": "Sv3uVW_emptyState",
1157
+ "catalogSearchQuery": "Sv3uVW_catalogSearchQuery"
1158
1158
  };
1159
1159
  //#endregion
1160
1160
  //#region src/client/QueryResultTable.tsx
@@ -45574,40 +45574,40 @@ window.__ModuleLoader__.load({
45574
45574
  document.head.appendChild(tag);
45575
45575
  }
45576
45576
  var AnalysisDashboard_module_css_default = {
45577
- "visuallyHidden": "_1tppBG_visuallyHidden",
45577
+ "modalShell": "_1tppBG_modalShell",
45578
+ "rowHead": "_1tppBG_rowHead",
45579
+ "preview": "_1tppBG_preview",
45580
+ "rowActions": "_1tppBG_rowActions",
45578
45581
  "empty": "_1tppBG_empty",
45579
- "metric": "_1tppBG_metric",
45582
+ "table": "_1tppBG_table",
45580
45583
  "row": "_1tppBG_row",
45581
- "modalTitleWrap": "_1tppBG_modalTitleWrap",
45584
+ "rowTitle": "_1tppBG_rowTitle",
45585
+ "emptyText": "_1tppBG_emptyText",
45586
+ "modalClose": "_1tppBG_modalClose",
45587
+ "rowInterrupted": "_1tppBG_rowInterrupted",
45588
+ "metricLabel": "_1tppBG_metricLabel",
45582
45589
  "viewFull": "_1tppBG_viewFull",
45583
- "viewHalf": "_1tppBG_viewHalf",
45584
- "modal": "_1tppBG_modal",
45585
- "viewTitle": "_1tppBG_viewTitle",
45586
- "modalBody": "_1tppBG_modalBody",
45587
- "modalSummary": "_1tppBG_modalSummary",
45588
- "preview": "_1tppBG_preview",
45589
45590
  "metricValue": "_1tppBG_metricValue",
45590
- "rowTitle": "_1tppBG_rowTitle",
45591
- "tableWrap": "_1tppBG_tableWrap",
45592
- "chartCanvas": "_1tppBG_chartCanvas",
45593
- "rowSummary": "_1tppBG_rowSummary",
45591
+ "modalTitle": "_1tppBG_modalTitle",
45592
+ "modal": "_1tppBG_modal",
45594
45593
  "grid": "_1tppBG_grid",
45595
- "view": "_1tppBG_view",
45594
+ "modalCount": "_1tppBG_modalCount",
45595
+ "modalSummary": "_1tppBG_modalSummary",
45596
+ "viewTitle": "_1tppBG_viewTitle",
45596
45597
  "rowButton": "_1tppBG_rowButton",
45597
- "modalShell": "_1tppBG_modalShell",
45598
- "table": "_1tppBG_table",
45599
- "emptyText": "_1tppBG_emptyText",
45600
- "modalTitle": "_1tppBG_modalTitle",
45601
- "metricLabel": "_1tppBG_metricLabel",
45602
- "rowHead": "_1tppBG_rowHead",
45603
45598
  "rowError": "_1tppBG_rowError",
45604
45599
  "modalHeader": "_1tppBG_modalHeader",
45605
- "rowActions": "_1tppBG_rowActions",
45600
+ "modalBody": "_1tppBG_modalBody",
45601
+ "view": "_1tppBG_view",
45602
+ "tableWrap": "_1tppBG_tableWrap",
45603
+ "modalTitleWrap": "_1tppBG_modalTitleWrap",
45604
+ "visuallyHidden": "_1tppBG_visuallyHidden",
45605
+ "rowSummary": "_1tppBG_rowSummary",
45606
45606
  "metricBand": "_1tppBG_metricBand",
45607
- "modalClose": "_1tppBG_modalClose",
45608
- "modalCount": "_1tppBG_modalCount",
45607
+ "metric": "_1tppBG_metric",
45609
45608
  "chart": "_1tppBG_chart",
45610
- "rowInterrupted": "_1tppBG_rowInterrupted"
45609
+ "chartCanvas": "_1tppBG_chartCanvas",
45610
+ "viewHalf": "_1tppBG_viewHalf"
45611
45611
  };
45612
45612
  //#endregion
45613
45613
  //#region src/client/AnalysisChart.tsx
package/lib/{command-CzzSPmag.js → command-scZcZG11.js} RENAMED
@@ -1,4 +1,4 @@
1
- import { C as isDatabaseType, S as defaultDatabasePort$1, b as DATABASE_TYPES, i as validatePasswordRef, r as redactSecretText, x as databaseTypeLabel$1 } from "./connections-CFXOZTHZ.js";
1
+ import { C as isDatabaseType, S as defaultDatabasePort$1, b as DATABASE_TYPES, i as validatePasswordRef, r as redactSecretText, x as databaseTypeLabel$1 } from "./connections-dGPjgsGg.js";
2
2
  import { RUN_CODE_NAME } from "@deepseek-ai/dsh-tools";
3
3
  //#region src/tui-connection-form.ts
4
4
  /**
package/lib/command.js CHANGED
@@ -1,2 +1,2 @@
1
- import { a as executeDatabaseCommand, c as isDshTuiPluginLoaded, d as parseDatabaseAction, i as apply, l as name, n as DATA_AGENT_TOOL_NAMES, o as formatConnectionStatus, r as DSH_TUI_PLUGIN_RUNTIME_NAME, s as inject, t as DATABASE_COMMAND_USAGE, u as parseConnectArguments } from "./command-CzzSPmag.js";
1
+ import { a as executeDatabaseCommand, c as isDshTuiPluginLoaded, d as parseDatabaseAction, i as apply, l as name, n as DATA_AGENT_TOOL_NAMES, o as formatConnectionStatus, r as DSH_TUI_PLUGIN_RUNTIME_NAME, s as inject, t as DATABASE_COMMAND_USAGE, u as parseConnectArguments } from "./command-scZcZG11.js";
2
2
  export { DATABASE_COMMAND_USAGE, DATA_AGENT_TOOL_NAMES, DSH_TUI_PLUGIN_RUNTIME_NAME, apply, executeDatabaseCommand, formatConnectionStatus, inject, isDshTuiPluginLoaded, name, parseConnectArguments, parseDatabaseAction };
package/lib/{connections-CFXOZTHZ.js → connections-dGPjgsGg.js} RENAMED
@@ -807,16 +807,16 @@ function rewriteTopLevelLimit(sql, maxRows) {
807
807
  }
808
808
  return sql;
809
809
  }
810
+ const METADATA_IDENTIFIER = /^[\p{L}\p{M}\p{N}_$]+$/u;
810
811
  /**
811
812
  * Validate and quote one schema/table identifier for a safe metadata query.
812
- * Identifiers are restricted to `[A-Za-z0-9_$]+` and then wrapped per type:
813
- * backticks (mysql/hive/impala) or double quotes (postgres/oracle/sqlite),
814
- * with the wrapping quote doubled for any interior occurrence. Rejects any
815
- * input that could cross the identifier boundary (`#`, `--`, `;`, `'`, `` ` ``,
816
- * `"`, `.`, `-` are all refused).
813
+ * Identifiers accept Unicode letters, combining marks and numbers plus `_`/`$`
814
+ * without normalizing or case-folding the database-provided text. Each value is
815
+ * then wrapped for its dialect. Whitespace, controls, punctuation and quoting
816
+ * delimiters remain outside the deliberately narrow metadata-input boundary.
817
817
  */
818
818
  function sanitizeIdentifier(type, identifier) {
819
- if (!/^[A-Za-z0-9_$]+$/.test(identifier)) throw new Error(`标识符含非法字符（仅允许字母、数字与 _ $）：${identifier}`);
819
+ if (!METADATA_IDENTIFIER.test(identifier)) throw new Error(`标识符含非法字符（仅允许 Unicode 字母、组合标记、数字与 _ $）：${identifier}`);
820
820
  switch (type) {
821
821
  case "mysql":
822
822
  case "doris":
@@ -834,8 +834,8 @@ function sanitizeIdentifier(type, identifier) {
834
834
  * interior `'` doubled). postgres/oracle metadata queries filter system
835
835
  * catalogs by NAME (a string value), not by identifier, so those positions
836
836
  * need a quoted literal — not {@link sanitizeIdentifier}'s identifier quoting.
837
- * The whitelist already excludes `'`, so doubling is a defense-in-depth no-op
838
- * here but keeps the helper correct for any future widened charset.
837
+ * The whitelist excludes `'`, so doubling is a defense-in-depth no-op here but
838
+ * keeps the helper correct for any future widened metadata-input boundary.
839
839
  */
840
840
  function quoteStringLiteral(value) {
841
841
  return "'" + value.replace(/'/g, "''") + "'";
@@ -1124,8 +1124,9 @@ function tableListingSql(type, connection) {
1124
1124
  }
1125
1125
  }
1126
1126
  /**
1127
- * Metadata query per kind × type. `schema`/`table` are identifier whitelist
1128
- * validated by the caller (`[A-Za-z0-9_$]`) before they reach here.
1127
+ * Metadata query per kind × type. `schema`/`table` are validated by the shared
1128
+ * connection service before they reach here; builders still quote identifier
1129
+ * positions or escape value positions rather than concatenating raw text.
1129
1130
  */
1130
1131
  function metadataQuery(kind, type, schema, table) {
1131
1132
  switch (kind) {
package/lib/index.js CHANGED
@@ -1,7 +1,7 @@
1
- import { _ as clientsSchema, b as DATABASE_TYPES, c as DEFAULT_CATALOG_MAX_RESULT_CHARS, d as DEFAULT_CONNECT_TIMEOUT_MS, f as DEFAULT_MAX_QUERY_CHARS, h as DEFAULT_QUERY_TIMEOUT_MS, l as DEFAULT_CATALOG_MAX_TEXT_CHARS, m as DEFAULT_PRESET_ID, p as DEFAULT_MAX_RESULT_CHARS, s as DEFAULT_CATALOG_MAX_ASSETS, t as createConnectionService, u as DEFAULT_CATALOG_QUERY_TIMEOUT_MS } from "./connections-CFXOZTHZ.js";
2
- import { a as catalogDateTimeSchema, c as catalogRunSchema, f as catalogSemanticEntrySchema, i as catalogAssetRevisionSchema, m as catalogSourceSchema, n as createCatalogService, o as catalogObservationSchema, p as catalogSemanticRevisionSchema, r as catalogAssetHeadSchema, s as catalogRelationSchema, u as catalogSearchItemSchema } from "./catalog-DEJqOXRo.js";
3
- import { i as apply$1 } from "./command-CzzSPmag.js";
4
- import { n as apply$2 } from "./tool-DNkywSph.js";
1
+ import { _ as clientsSchema, b as DATABASE_TYPES, c as DEFAULT_CATALOG_MAX_RESULT_CHARS, d as DEFAULT_CONNECT_TIMEOUT_MS, f as DEFAULT_MAX_QUERY_CHARS, h as DEFAULT_QUERY_TIMEOUT_MS, l as DEFAULT_CATALOG_MAX_TEXT_CHARS, m as DEFAULT_PRESET_ID, p as DEFAULT_MAX_RESULT_CHARS, s as DEFAULT_CATALOG_MAX_ASSETS, t as createConnectionService, u as DEFAULT_CATALOG_QUERY_TIMEOUT_MS } from "./connections-dGPjgsGg.js";
2
+ import { a as catalogDateTimeSchema, c as catalogRunSchema, f as catalogSemanticEntrySchema, i as catalogAssetRevisionSchema, m as catalogSourceSchema, n as createCatalogService, o as catalogObservationSchema, p as catalogSemanticRevisionSchema, r as catalogAssetHeadSchema, s as catalogRelationSchema, u as catalogSearchItemSchema } from "./catalog-CbxIDQBG.js";
3
+ import { i as apply$1 } from "./command-scZcZG11.js";
4
+ import { n as apply$2 } from "./tool-Du1EadNP.js";
5
5
  import { createHash } from "node:crypto";
6
6
  import { access, cp, mkdir, readFile, writeFile } from "node:fs/promises";
7
7
  import { homedir } from "node:os";
package/lib/routes.js CHANGED
@@ -1,5 +1,5 @@
1
- import { C as isDatabaseType, b as DATABASE_TYPES, d as DEFAULT_CONNECT_TIMEOUT_MS, f as DEFAULT_MAX_QUERY_CHARS, h as DEFAULT_QUERY_TIMEOUT_MS, p as DEFAULT_MAX_RESULT_CHARS } from "./connections-CFXOZTHZ.js";
2
- import { d as catalogSearchRequestSchema, h as semanticDefinitionSchema, l as catalogScopeSchema, t as CatalogVersionConflictError } from "./catalog-DEJqOXRo.js";
1
+ import { C as isDatabaseType, b as DATABASE_TYPES, d as DEFAULT_CONNECT_TIMEOUT_MS, f as DEFAULT_MAX_QUERY_CHARS, h as DEFAULT_QUERY_TIMEOUT_MS, p as DEFAULT_MAX_RESULT_CHARS } from "./connections-dGPjgsGg.js";
2
+ import { d as catalogSearchRequestSchema, h as semanticDefinitionSchema, l as catalogScopeSchema, t as CatalogVersionConflictError } from "./catalog-CbxIDQBG.js";
3
3
  import { resolve } from "node:path";
4
4
  import z from "schemastery";
5
5
  import { z as z$1 } from "zod";
package/lib/{tool-DNkywSph.js → tool-Du1EadNP.js} RENAMED
@@ -1,4 +1,4 @@
1
- import { _ as clientsSchema, a as parseStructuredQueryOutput, f as DEFAULT_MAX_QUERY_CHARS, g as classifyStatement, h as DEFAULT_QUERY_TIMEOUT_MS, n as redactQueryResult, o as runClientQuery, p as DEFAULT_MAX_RESULT_CHARS, r as redactSecretText, v as enforceReadRowLimit, y as assertSingleStatement } from "./connections-CFXOZTHZ.js";
1
+ import { _ as clientsSchema, a as parseStructuredQueryOutput, f as DEFAULT_MAX_QUERY_CHARS, g as classifyStatement, h as DEFAULT_QUERY_TIMEOUT_MS, n as redactQueryResult, o as runClientQuery, p as DEFAULT_MAX_RESULT_CHARS, r as redactSecretText, v as enforceReadRowLimit, y as assertSingleStatement } from "./connections-dGPjgsGg.js";
2
2
  import { l as normalizeCatalogText } from "./catalog-identity-CVftmvQL.js";
3
3
  import { randomUUID } from "node:crypto";
4
4
  import { link, mkdir, unlink, writeFile } from "node:fs/promises";
package/lib/tool.js CHANGED
@@ -1,2 +1,2 @@
1
- import { i as name, n as apply, r as inject, t as Config } from "./tool-DNkywSph.js";
1
+ import { i as name, n as apply, r as inject, t as Config } from "./tool-Du1EadNP.js";
2
2
  export { Config, apply, inject, name };
package/lib/types/clients.d.ts CHANGED
@@ -38,11 +38,10 @@ export declare function enforceReadRowLimit(sql: string, type: DatabaseType, max
38
38
  export declare const SQLSERVER_COLUMN_SEPARATOR = "\u001F";
39
39
  /**
40
40
  * Validate and quote one schema/table identifier for a safe metadata query.
41
- * Identifiers are restricted to `[A-Za-z0-9_$]+` and then wrapped per type:
42
- * backticks (mysql/hive/impala) or double quotes (postgres/oracle/sqlite),
43
- * with the wrapping quote doubled for any interior occurrence. Rejects any
44
- * input that could cross the identifier boundary (`#`, `--`, `;`, `'`, `` ` ``,
45
- * `"`, `.`, `-` are all refused).
41
+ * Identifiers accept Unicode letters, combining marks and numbers plus `_`/`$`
42
+ * without normalizing or case-folding the database-provided text. Each value is
43
+ * then wrapped for its dialect. Whitespace, controls, punctuation and quoting
44
+ * delimiters remain outside the deliberately narrow metadata-input boundary.
46
45
  */
47
46
  export declare function sanitizeIdentifier(type: DatabaseType, identifier: string): string;
48
47
  /** One deployment override for a database type's CLI client. */
@@ -112,8 +111,9 @@ export declare function buildStructuredQueryTemplate(type: DatabaseType, connect
112
111
  */
113
112
  export declare function tableListingSql(type: DatabaseType, connection?: DatabaseConnection): string;
114
113
  /**
115
- * Metadata query per kind × type. `schema`/`table` are identifier whitelist
116
- * validated by the caller (`[A-Za-z0-9_$]`) before they reach here.
114
+ * Metadata query per kind × type. `schema`/`table` are validated by the shared
115
+ * connection service before they reach here; builders still quote identifier
116
+ * positions or escape value positions rather than concatenating raw text.
117
117
  */
118
118
  export declare function metadataQuery(kind: 'schemas' | 'tables' | 'describe', type: DatabaseType, schema?: string, table?: string): string;
119
119
  /**
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@yejiming/dsh-data-agent",
3
3
  "description": "Data Agent for DSH Web and TUI: shared database connections, versioned metadata Catalog governance, secure credentials, SQL and Catalog tools, and the data-agent preset",
4
- "version": "0.1.1",
4
+ "version": "0.1.2",
5
5
  "publishConfig": {
6
6
  "access": "public"
7
7
  },