Merge pull request #358 from flashcatcloud/doc-review/2026-09-07-084500

docs: doc-review 2026-09-07 — CLI/SSO/monitors/go-sdk/API 增量审计修复

Author: ysyneu

docs.json

@@ -1752,7 +1752,8 @@
                     "pages": [
                       "zh/on-call/integration/sso/authing",
                       "zh/on-call/integration/sso/keycloak",
-                      "zh/on-call/integration/sso/openldap"
+                      "zh/on-call/integration/sso/openldap",
+                      "zh/on-call/integration/sso/role-team-sync"
                     ]
                   },
                   {
@@ -3162,7 +3163,8 @@
                     "pages": [
                       "en/on-call/integration/sso/authing",
                       "en/on-call/integration/sso/keycloak",
-                      "en/on-call/integration/sso/openldap"
+                      "en/on-call/integration/sso/openldap",
+                      "en/on-call/integration/sso/role-team-sync"
                     ]
                   },
                   {

en/ai-sre/sessions.mdx

@@ -226,10 +226,11 @@ Beyond subagents, the agent can push time-consuming work into the background. Ta
 | shell | The `bash` tool with `run_in_background` | A long one-shot command (build, batch job, data pull); only its completion needs reporting |
 | monitor | The `monitor` tool | A standing watcher task: watches a condition until it hits or reaches its deadline, and the script's output flows back to the agent as event batches; a one-shot delayed action (e.g. "check again in half an hour") is done with a monitor plus `sleep` |
 
-A unified **Tasks** panel on the right side of the session tracks every task of the session, grouped into **Needs you / Running / Finished**. There are two entry points:
+A unified **Tasks** panel on the right side of the session tracks every task of the session, grouped into **Needs you / Running / Finished**. There are three entry points:
 
 - **The tasks button in the chat header**: carries a count badge for "needs you + running" tasks, capped at `9+`; the badge is red when any task needs you (awaiting authorization / awaiting input), and blue when tasks are only running.
 - **The generation status row while a turn is running**: shows the live task count (e.g. "3 tasks · 1 agent needs you"); clicking it opens the same task panel.
+- **The tool row that started a monitor / background bash**: the tool row in the conversation that started a `monitor` or a background command (`bash` with `run_in_background`) — when it is the only tool in its group, that group's header — is itself that task's handle in the transcript: its trailing external-link icon marks it clickable, the tooltip reads **Open task detail**, and clicking it opens that task's detail panel directly. Such rows no longer expand into raw Input/Output (a background bash row used to show only the command, with no status or output). In a read-only shared session the detail opens in read-only mode as well.
 
 Task details differ by kind: clicking an **agent** task opens the child session's execution transcript (see above); clicking a **shell / monitor** task opens its own event-timeline detail, which includes the status (a running task also shows how many seconds ago its last liveness probe landed — probing happens roughly every 30 seconds), run duration, event count, output bytes, the monitor's deadline (standing tasks with no deadline show "Persistent"), the exit code, the full command, and the event timeline in order. **The stop button lives in the detail header** — **Stop task** for shell / monitor tasks and **Stop Subagent** for subagents — and interrupts only that task, without affecting the main session.
 
@@ -238,7 +239,7 @@ How this surfaces in the conversation stream:
 - A tool line that starts a background command reads **Started background command**; when a turn mixes foreground and background commands, the collapsed tool group counts each category separately (e.g. `Ran 1 command, started 1 background command`).
 - Each time a monitor's condition hits, a 🔭 system line is inlined into the conversation: the first line shows the monitor's description plus a first-line summary of that output batch, and clicking it expands the full batch in place.
 - When a task ends, a terminal line appears with the end state and a result summary, plus the exit code and a note when the task envelope carries them.
-- The `monitor` tool line itself does not expand into input / output — the bookkeeping it returns (task ID, output file, deadline, and so on) is presented more completely in the task panel's detail.
+- The `monitor` tool line itself does not expand into input / output — clicking it opens the corresponding task's detail panel, where the bookkeeping it returns (task ID, output file, deadline, and so on) is presented more completely.
 
 Two status indicators related to background tasks:
 

en/changelog/changelog.mdx

@@ -4,6 +4,37 @@ description: "This page documents important updates and feature releases for Fla
 keywords: ["Changelog", "Product Release", "Feature Updates", "Flashduty", "Version History"]
 ---
 
+<Update label="2026-09-07" description="👥 SSO sync configuration: sync roles and teams by identity provider claims">
+
+### SSO sync configuration: role and team sync
+
+The SSO settings page for SAML2.0 / OIDC / CAS gains a **Sync Configuration** section that syncs a member's roles and teams at login based on fields returned by the identity provider (IdP):
+
+- **Sync roles / Sync teams toggles**: enable role or team sync independently; at login, the member's current roles and teams are overwritten with the matching result
+- **Role field / Team field**: the claim names carrying the role and team names returned by the IdP (e.g. `roles` / `teams`); the value may be a string or a string array, matched by name **exactly** (case-sensitive)
+- **Default roles / Default teams**: when no returned name matches any role or team, the configured defaults are assigned at login; if nothing matches and no defaults are configured, they are cleared
+- **Protocol differences**: LDAP is unchanged — it still maps Group DN to roles/teams; this sync configuration applies only to SAML2.0 / OIDC / CAS
+
+See [Role and Team Sync](/en/on-call/integration/sso/role-team-sync).
+
+</Update>
+
+<Update label="2026-09-07" description="🧰 Monit datasource diagnostics and new datasource types">
+
+### Monit datasource diagnostics and new datasource types
+
+Monit datasources gain **datasource diagnostics**: run structured read-only named-tool inspections against a configured datasource:
+
+- **Datasource diagnostic tool**: invokes exactly one deterministic tool per datasource ID (e.g. `mysql.lock_contention`, `postgres.activity`, `redis_node.slowlog`, `kafka.consumer_lag`, `elasticsearch.cat`, `prometheus.metric_trends`, `loki.log_patterns`, `victorialogs.log_patterns`); there is no tool catalog, and the datasource must have `enabled=true` (`alerting_enabled=false` does not block diagnostics)
+- **Version requirement**: all routable online Edge sessions in the selected cluster must support the **v0.71.0** baseline protocol, otherwise errors such as `edge_upgrade_required` / `mixed_edge_versions` / `no_active_edge` / `tool_not_supported` are returned
+- **Legacy tools removed**: `mysql.query` / `postgres.query` are gone — use the query API for free-form SQL
+- **Five new diagnostic-only datasource types**: Redis (Node / Sentinel), MongoDB (Mongod / Mongos), and Kafka — for diagnostics only, they never evaluate alerts; address formats are a single `host:port` (bracket IPv6) or 1–32 unique comma-separated Kafka bootstrap addresses
+- **Switch semantics split**: `alerting_enabled` (whether the datasource may evaluate alerts; always false for diagnostic-only types, and disabling it is rejected with a conflict while enabled rules reference the datasource) is now independent of `enabled` (business execution, on by default at creation)
+
+See [Data Sources](/en/monitors/data-sources/data-sources) and [Monitoring Targets](/en/monitors/targets/overview).
+
+</Update>
+
 <Update label="2026-09-04" description="🔭 AI SRE background task panel, RUM WeChat Mini Program remote config, incident list filter bar">
 
 ### AI SRE: background tasks and task panel