@allbluecn/web-app 0.12.0 → 0.12.2

package/src/lib/{chat-handoff.ts → ai/chat-handoff.ts}

@@ -38,40 +38,64 @@ export function consumePendingWorkspaceMessage(): string | null {
   }
 }
 
+export const PENDING_SIDEBAR_DRAFT_KEY = "pendingSidebarDraft";
+
+export function stashSidebarDraft(draft: string): boolean {
+  try {
+    sessionStorage.setItem(PENDING_SIDEBAR_DRAFT_KEY, draft);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function consumeSidebarDraft(): string | null {
+  try {
+    const draft = sessionStorage.getItem(PENDING_SIDEBAR_DRAFT_KEY);
+    if (draft !== null) {
+      sessionStorage.removeItem(PENDING_SIDEBAR_DRAFT_KEY);
+    }
+    return draft;
+  } catch {
+    return null;
+  }
+}
+
 export interface HandoffConversation {
   id: string;
   title?: string;
+  board?: string;
+  entityId?: string;
   [key: string]: unknown;
 }
 
-interface HandoffState<TConv> {
-  pending: string;
-  convPromise: Promise<TConv>;
+export interface HandoffContext {
+  board: string;
+  entityId: string;
 }
 
-let _handoffState: HandoffState<unknown> | null = null;
+const HANDOFF_CONTEXT_KEY = "handoffContext";
 
-export function startHandoff<TConv extends HandoffConversation>(
-  pending: string,
-  createConversation: () => Promise<TConv>,
-): { convPromise: Promise<TConv>; pending: string; reused: false } {
-  const convPromise = createConversation();
-  _handoffState = { pending, convPromise: convPromise as Promise<unknown> };
-  return { convPromise, pending, reused: false };
-}
-
-export function getHandoffState<TConv extends HandoffConversation>():
-  | { convPromise: Promise<TConv>; pending: string; reused: true }
-  | null {
-  if (!_handoffState) return null;
-  return {
-    convPromise: _handoffState.convPromise as Promise<TConv>,
-    pending: _handoffState.pending,
-    reused: true,
-  };
+export function startHandoffWithContext(
+  text: string,
+  context: HandoffContext,
+): { pending: string } {
+  try {
+    sessionStorage.setItem(HANDOFF_CONTEXT_KEY, JSON.stringify(context));
+  } catch {
+    // ignore
+  }
+  return { pending: text };
 }
 
-export function clearHandoffState(): void {
-  _handoffState = null;
+export function consumeHandoffContext(): HandoffContext | null {
+  try {
+    const raw = sessionStorage.getItem(HANDOFF_CONTEXT_KEY);
+    if (raw === null) return null;
+    sessionStorage.removeItem(HANDOFF_CONTEXT_KEY);
+    return JSON.parse(raw) as HandoffContext;
+  } catch {
+    return null;
+  }
 }
 

package/src/lib/ai/story-ai-stream.ts

@@ -32,7 +32,6 @@ export interface StoryAiRequest {
     polishAction?: StoryAiPolishAction
   }
   labels?: string[]
-  systemPrompts?: string[]
   model?: string
 }
 

package/src/lib/ai/use-code-mode-readiness.ts

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { useQuery } from "@tanstack/react-query"
+import { getCodeModeReadinessFn } from "@/server/serverFns/ai/code-mode-readiness"
+
+export interface CodeModeReadinessState {
+  enabled: boolean
+}
+
+export function useCodeModeReadiness(): CodeModeReadinessState {
+  const { data } = useQuery({
+    queryKey: ["code-mode-readiness"],
+    queryFn: getCodeModeReadinessFn,
+    staleTime: 300_000,
+  })
+  return { enabled: data?.enabled ?? false }
+}

package/src/{components → lib}/ai/use-knowledge-bases.ts

@@ -15,10 +15,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-// apps/web/src/components/ai/use-knowledge-bases.ts
+// apps/web/src/lib/ai/use-knowledge-bases.ts
 import { useEffect, useState } from "react"
 import { listKnowledgeFn } from "@/server/serverFns/knowledge"
-import type { KnowledgeBaseItem } from "@/components/chat/ai-prompt-input"
+import type { KnowledgeBaseItem } from "@/components/ai/ai-prompt-input"
 
 /**
  * 加载当前用户的知识库列表，供 AIPromptInput 的「添加上下文」选择器使用。

package/src/lib/ai/use-search-capability.ts

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { useMemo } from "react"
+import { useQuery } from "@tanstack/react-query"
+import { listAiProvidersFn } from "@/server/serverFns/ai/providers"
+import { getSearchCapabilityFn } from "@/server/serverFns/ai/search-capability"
+
+const NATIVE_SEARCH_KINDS = new Set([
+  "anthropic",
+  "openai",
+  "gemini",
+  "openrouter",
+])
+
+export function hasNativeWebSearchClient(kind?: string | null): boolean {
+  return !!kind && NATIVE_SEARCH_KINDS.has(kind)
+}
+
+export interface SearchCapability {
+  enabled: boolean
+  adapterKind?: string
+  hasNative: boolean
+  searxngEnabled: boolean
+}
+
+export function useSearchCapability(selectedModel: string | undefined): SearchCapability {
+  const { data: providers } = useQuery({
+    queryKey: ["ai-providers"],
+    queryFn: listAiProvidersFn,
+    staleTime: 60_000,
+  })
+  const { data: capability } = useQuery({
+    queryKey: ["search-capability"],
+    queryFn: getSearchCapabilityFn,
+    staleTime: 300_000,
+  })
+
+  return useMemo(() => {
+    const searxngEnabled = capability?.searxngEnabled ?? false
+
+    if (!selectedModel) {
+      return { enabled: searxngEnabled, hasNative: false, searxngEnabled }
+    }
+
+    const provider = providers?.find((p) => {
+      const cfgModels = p.config.models ?? []
+      const presetModels = Array.isArray(p.meta.models)
+        ? p.meta.models.map((m) => (typeof m === "string" ? m : m.id))
+        : []
+      const allModels = cfgModels.length > 0 ? cfgModels : presetModels
+      return allModels.includes(selectedModel)
+    })
+
+    const adapterKind = provider?.meta.adapterKind
+    const hasNative = hasNativeWebSearchClient(adapterKind)
+    return {
+      enabled: hasNative || searxngEnabled,
+      adapterKind,
+      hasNative,
+      searxngEnabled,
+    }
+  }, [selectedModel, providers, capability])
+}

package/src/{components → lib}/ai/use-selected-model.ts

@@ -15,7 +15,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-// apps/web/src/components/ai/use-selected-model.ts
+// apps/web/src/lib/ai/use-selected-model.ts
 import { useEffect, useState } from "react"
 
 const STORAGE_KEY = "chat:selectedModel"

package/src/lib/auth/auth.config.ts

@@ -19,6 +19,7 @@ import type { StartAuthJSConfig } from 'start-authjs'
 import type { SessionUser } from '@/lib/session'
 import CredentialsProvider from '@auth/core/providers/credentials'
 import GoogleProvider from '@auth/core/providers/google'
+import GitHubProvider from '@auth/core/providers/github'
 import { prisma } from '@allbluecn/database'
 import bcrypt from 'bcryptjs'
 import { getRandomConfig, presetBgColors } from '@/components/settings/personal-team/account/avatar/avatar-config'
@@ -35,11 +36,17 @@ type CachedProfile = {
   timezone: string | null
   hasAiKey: boolean
   locale: string | null
+  aiSourceMode: string | null
 }
 
 const profileCache = new Map<string, { data: CachedProfile; at: number }>()
 const PROFILE_CACHE_TTL = 30_000
 
+/** 外部调用者在写入 aiSourceMode 后清空缓存，避免后续 30s 内 JWT session 读到旧值 */
+export function invalidateProfileCache(userId: string): void {
+  profileCache.delete(userId)
+}
+
 async function getCachedProfile(userId: string): Promise<CachedProfile | null> {
   const cached = profileCache.get(userId)
   if (cached && Date.now() - cached.at < PROFILE_CACHE_TTL) return cached.data
@@ -56,6 +63,7 @@ async function getCachedProfile(userId: string): Promise<CachedProfile | null> {
         timezone: true,
         aiApiKey: true,
         locale: true,
+        aiSourceMode: true,
       },
     })
     if (!dbUser) return null
@@ -84,6 +92,7 @@ async function getCachedProfile(userId: string): Promise<CachedProfile | null> {
       timezone: null,
       hasAiKey: false,
       locale: null,
+      aiSourceMode: null,
     }
   }
 }
@@ -196,6 +205,17 @@ const GOOGLE_PROVIDER_BASE = {
   userinfo: 'https://www.googleapis.com/oauth2/v3/userinfo',
 } as const
 
+const GITHUB_PROVIDER_BASE = {
+  token: 'https://github.com/login/oauth/access_token',
+  userinfo: 'https://api.github.com/user',
+  profiles: (response: Record<string, unknown>) => ({
+    id: response.id?.toString(),
+    name: (response.name ?? response.login) as string | undefined,
+    email: response.email as string | undefined,
+    image: response.avatar_url as string | undefined,
+  }),
+} as const
+
 export const authConfig: StartAuthJSConfig = {
   basePath: '/api/auth',
   session: { strategy: 'jwt', maxAge: 30 * 24 * 60 * 60 },
@@ -223,6 +243,13 @@ export const authConfig: StartAuthJSConfig = {
           ...GOOGLE_PROVIDER_BASE,
         })]
       : []),
+    ...(process.env.AUTH_GITHUB_ID && process.env.AUTH_GITHUB_SECRET
+      ? [GitHubProvider({
+          clientId: process.env.AUTH_GITHUB_ID,
+          clientSecret: process.env.AUTH_GITHUB_SECRET,
+          ...GITHUB_PROVIDER_BASE,
+        })]
+      : []),
   ],
   callbacks: {
     async signIn({ user, account, profile }) {
@@ -372,6 +399,7 @@ export const authConfig: StartAuthJSConfig = {
         user.hasAiKey = dbUser.hasAiKey
         user.timezone = (dbUser.timezone as string | null) ?? null
         user.locale = (dbUser.locale as string | null) ?? null
+        user.aiSourceMode = (dbUser.aiSourceMode as string | null) ?? null
 
         try {
           const sub = await prisma.subscription.findUnique({
@@ -393,14 +421,24 @@ export const authConfig: StartAuthJSConfig = {
 export async function getAuthConfig(): Promise<StartAuthJSConfig> {
   const resolved = await getResolvedOAuthProviders()
   const google = resolved.find((p) => p.provider === 'google')
-  const providers = google
+  const github = resolved.find((p) => p.provider === 'github')
+  const providers = google || github
     ? [
         credentialsProvider,
-        GoogleProvider({
-          clientId: google.clientId,
-          clientSecret: google.clientSecret,
-          ...GOOGLE_PROVIDER_BASE,
-        }),
+        ...(google
+          ? [GoogleProvider({
+              clientId: google.clientId,
+              clientSecret: google.clientSecret,
+              ...GOOGLE_PROVIDER_BASE,
+            })]
+          : []),
+        ...(github
+          ? [GitHubProvider({
+              clientId: github.clientId,
+              clientSecret: github.clientSecret,
+              ...GITHUB_PROVIDER_BASE,
+            })]
+          : []),
       ]
     : authConfig.providers
   return { ...authConfig, providers }

package/src/lib/changelog/sdk-versions.ts

@@ -33,8 +33,8 @@ export const SDK_GROUPS: SdkGroup[] = [
       {
         "name": "@tanstack/ai",
         "displayName": "TanStack AI",
-        "version": "v0.52.0",
-        "lastUpdate": "Sep 11, 2026",
+        "version": "v0.54.0",
+        "lastUpdate": "Sep 14, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tanstack.com/ai/latest"
       },
@@ -95,8 +95,8 @@ export const SDK_GROUPS: SdkGroup[] = [
     "items": [
       {
         "name": "@allbluecn/web-app",
-        "version": "v0.12.0",
-        "lastUpdate": "Sep 13, 2026",
+        "version": "v0.12.2",
+        "lastUpdate": "Sep 19, 2026",
         "source": "apps/web/package.json",
         "docsUrl": "https://github.com/allbluecn/allblue"
       },
@@ -144,8 +144,8 @@ export const SDK_GROUPS: SdkGroup[] = [
       },
       {
         "name": "TipTap",
-        "version": "v3.27.4",
-        "lastUpdate": "Sep 11, 2026",
+        "version": "v3.31.3",
+        "lastUpdate": "Sep 13, 2026",
         "source": "apps/web/package.json#dependencies",
         "docsUrl": "https://tiptap.dev/"
       },

package/src/lib/commands/__tests__/registry.test.ts

@@ -21,7 +21,7 @@ import { HOTKEY_REGISTRY } from "../../hotkeys/registry"
 
 const KNOWN_ROUTES = new Set([
   "/dashboard",
-  "/chat",
+  "/harness",
   "/agents",
   "/inspiration",
   "/stories",

package/src/lib/commands/registry.ts

@@ -20,7 +20,8 @@ import { m } from '@/paraglide/messages.js'
 
 export const COMMAND_REGISTRY: CommandDefinition[] = [
   { id: "goto-dashboard", title: m.common_command_gotoDashboard, icon: "sparkles", group: "navigation", action: { kind: "navigate", to: "/dashboard" }, keywords: ["工作台", "仪表盘", "dashboard", "gzt"], shortcut: ["G", "D"] },
-  { id: "goto-chat", title: m.common_command_gotoChat, icon: "message", group: "navigation", action: { kind: "navigate", to: "/chat" }, keywords: ["对话", "聊天", "chat", "dh"], shortcut: ["G", "C"] },
+  // 保留 goto-chat 的 id / shortcut / i18n key 以兼容快捷键肌肉记忆；目标已迁移到 /harness（检索靠 keywords 双收录）
+  { id: "goto-chat", title: m.common_command_gotoChat, icon: "message", group: "navigation", action: { kind: "navigate", to: "/harness" }, keywords: ["对话", "聊天", "chat", "harness", "dh"], shortcut: ["G", "C"] },
   { id: "goto-agents", title: m.common_command_gotoAgents, icon: "bot", group: "navigation", action: { kind: "navigate", to: "/agents" }, keywords: ["智能体", "agent", "znt"], shortcut: ["G", "A"] },
   { id: "goto-inspiration", title: m.common_command_gotoInspiration, icon: "lightbulb", group: "navigation", action: { kind: "navigate", to: "/inspiration" }, keywords: ["灵感", "inspiration", "lg"], shortcut: ["G", "I"] },
   { id: "goto-stories", title: m.common_command_gotoStories, icon: "clipboardList", group: "navigation", action: { kind: "navigate", to: "/stories" }, keywords: ["需求", "故事", "story", "xq"], shortcut: ["G", "S"] },

package/src/lib/crypto/__tests__/base64.test.ts

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect } from "vitest"
+
+import {
+  decodeBase64,
+  decodeBase64Strict,
+  decodeBase64Url,
+  encodeBase64,
+  encodeBase64Url,
+} from "@/lib/crypto/base64"
+
+const encoder = new TextEncoder()
+
+describe("base64（标准，带 padding）", () => {
+  it("padding 往返：1/2 字节必须产出带 = 的标准 base64", () => {
+    // GCM IV(12B) / auth tag(16B) 无 padding，但密文长度任意——必须锁定 padding 语义
+    expect(encodeBase64(encoder.encode("a"))).toBe("YQ==")
+    expect(encodeBase64(encoder.encode("ab"))).toBe("YWI=")
+    expect(encodeBase64(encoder.encode("abc"))).toBe("YWJj")
+  })
+
+  it("decodeBase64 宽松解码（兼容 Buffer 语义）", () => {
+    expect(decodeBase64("YQ==").length).toBe(1)
+    expect(Array.from(decodeBase64("YWJj"))).toEqual(Array.from(encoder.encode("abc")))
+  })
+
+  it("decodeBase64Strict 拒绝非法字符（Buffer.from 会静默忽略）", () => {
+    expect(() => decodeBase64Strict("!!!not base64!!!")).toThrow(TypeError)
+    expect(() => decodeBase64Strict("YQ==X")).toThrow(TypeError)
+    expect(() => decodeBase64Strict("YWI")).toThrow(TypeError) // 长度非 4 倍数
+  })
+
+  it("decodeBase64Strict 接受合法 padding", () => {
+    expect(Array.from(decodeBase64Strict("YQ=="))).toEqual(Array.from(encoder.encode("a")))
+    expect(Array.from(decodeBase64Strict("YWI="))).toEqual(Array.from(encoder.encode("ab")))
+  })
+})
+
+describe("base64url（无 padding，-_ 字母表）", () => {
+  it("不含 + / = 与标准 base64 语义区分", () => {
+    // '????' 编码出 + 和 / ——base64url 必须映射为 - _
+    const tricky = new Uint8Array([0xfb, 0xef, 0xbe, 0xdf])
+    const out = encodeBase64Url(tricky)
+    expect(out).not.toContain("+")
+    expect(out).not.toContain("=")
+    expect(out).not.toContain("/")
+    expect(Array.from(decodeBase64Url(out))).toEqual(Array.from(tricky))
+  })
+
+  it("往返无损（含长度非 4 倍数的载荷）", () => {
+    for (const text of ["", "a", "ab", "abc", "hello world", "中文载荷"]) {
+      const bytes = encoder.encode(text)
+      expect(Array.from(decodeBase64Url(encodeBase64Url(bytes)))).toEqual(Array.from(bytes))
+    }
+  })
+
+  it("拒绝非法 base64url 字符", () => {
+    expect(() => decodeBase64Url("YQ+=")).toThrow(TypeError)
+    expect(() => decodeBase64Url("YQ==")).toThrow(TypeError)
+    expect(() => decodeBase64Url("YQ/=")).toThrow(TypeError)
+  })
+})

package/src/lib/crypto/base64.ts

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// ⚠ 仅服务端 import。依赖 node:crypto，禁止在客户端组件/路由文件顶层引用。
+import { Buffer } from "node:buffer"
+
+/**
+ * base64 单一事实源。
+ *
+ * 为什么不用 `@tanstack/ai-utils` 的 base64 三件套：ai-utils 在运行时探测
+ * `Uint8Array.fromBase64`（TC39 Stage 3）后切换到 fast path，Node 版本不同
+ * 语义不同——本模块承载的是 AES-GCM 密文（IV / auth tag / ciphertext）的编解码，
+ * 存量 `enc:v1:` 密文依赖标准 base64 的 padding 语义，运行时分支漂移会让线上
+ * 已加密的 API key 静默解不开。此处刻意固定 Buffer 实现，换取跨 Node 版本稳定。
+ */
+
+const BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/
+const BASE64URL_RE = /^[A-Za-z0-9_-]*$/
+
+function isStrictBase64(input: string, strict: RegExp): boolean {
+  if (input.length % 4 !== 0) return false
+  return strict.test(input)
+}
+
+export function encodeBase64(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString("base64")
+}
+
+export function decodeBase64(input: string): Uint8Array {
+  return new Uint8Array(Buffer.from(input, "base64"))
+}
+
+export function decodeBase64Strict(input: string): Uint8Array {
+  if (!isStrictBase64(input, BASE64_RE)) {
+    throw new TypeError(`非法 base64 载荷：${JSON.stringify(input.slice(0, 32))}`)
+  }
+  return decodeBase64(input)
+}
+
+export function encodeBase64Url(bytes: Uint8Array): string {
+  return Buffer.from(bytes).toString("base64url")
+}
+
+export function decodeBase64Url(input: string): Uint8Array {
+  if (!BASE64URL_RE.test(input)) {
+    throw new TypeError(`非法 base64url 载荷：${JSON.stringify(input.slice(0, 32))}`)
+  }
+  return new Uint8Array(Buffer.from(input, "base64url"))
+}

package/src/lib/fsap.ts

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+/** 浏览器是否支持 File System Access API */
+export function hasFileSystemAccess(): boolean {
+  return typeof window !== "undefined" && "showDirectoryPicker" in window
+}
+
+/** 挂载本地目录（Chromium 系）；返回目录句柄或 null（不支持/用户取消） */
+export async function pickLocalDirectory(): Promise<FileSystemDirectoryHandle | null> {
+  if (!hasFileSystemAccess()) return null
+  try {
+    return await ((window as unknown as { showDirectoryPicker: (opts: { mode: "read" }) => Promise<FileSystemDirectoryHandle> }).showDirectoryPicker({ mode: "read" }))
+  } catch {
+    return null // 用户取消
+  }
+}
+
+/** 懒加载读取目录下文件列表（首次展开才 list） */
+export async function listDirEntries(
+  handle: FileSystemDirectoryHandle,
+): Promise<{ name: string; kind: "file" | "directory" }[]> {
+  const entries: { name: string; kind: "file" | "directory" }[] = []
+  for await (const [name, childHandle] of handle.entries()) {
+    entries.push({ name, kind: childHandle.kind })
+  }
+  return entries.sort((a, b) =>
+    a.kind === b.kind ? a.name.localeCompare(b.name) : a.kind === "directory" ? -1 : 1,
+  )
+}
+
+/** 按需读取文件内容为文本（@ 引用时流式进上下文） */
+export async function readFileText(
+  dirHandle: FileSystemDirectoryHandle,
+  relPath: string,
+): Promise<string | null> {
+  const parts = relPath.split("/").filter(Boolean)
+  let current: FileSystemHandle = dirHandle
+  for (let i = 0; i < parts.length - 1; i++) {
+    if (current.kind !== "directory") return null
+    current = await (current as FileSystemDirectoryHandle).getDirectoryHandle(parts[i])
+  }
+  if (current.kind !== "directory") return null
+  const fileHandle = await (current as FileSystemDirectoryHandle).getFileHandle(parts[parts.length - 1])
+  const file = await fileHandle.getFile()
+  return file.text()
+}

package/src/lib/optimistic/use-optimistic-mutation.ts

@@ -16,7 +16,7 @@
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import { useCallback, useRef, useState } from "react";
-import { toast } from "sonner";
+import { toast } from "@/components/ui/toast";
 
 export interface OptimisticMutationOptions<TVariables, TData, TSnapshot = void> {
   mutationFn: (variables: TVariables) => Promise<TData>;

package/src/lib/plugin-runtime/bridge.ts

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 主线程 bridge：处理 Worker 发来的 fetch 代理请求
+// 调用服务端 serverFn 进行白名单校验 + fetch
+
+export async function handleFetchProxy(
+  worker: Worker,
+  data: { url: string; method: string; headers: Record<string, string>; body?: string }
+): Promise<void> {
+  try {
+    const response = await fetch(data.url, {
+      method: data.method,
+      headers: data.headers,
+      body: data.body,
+    });
+
+    const responseHeaders: Record<string, string> = {};
+    response.headers.forEach((value, key) => {
+      responseHeaders[key] = value;
+    });
+
+    const responseBody = await response.text();
+
+    worker.postMessage({
+      type: "fetch-response",
+      status: response.status,
+      headers: responseHeaders,
+      body: responseBody,
+    });
+  } catch (error) {
+    worker.postMessage({
+      type: "fetch-response",
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}