@dsh-workbench/core 0.1.17 → 0.2.0

package/dist/host/index.js

@@ -67,7 +67,12 @@ var DECLARATION_REQUIRED_KEYS = [
 	"host"
 ];
 var CARD_KEYS = ["titleKey", "order"];
-var TOOL_KEYS = ["name", "writes"];
+var TOOL_KEYS = [
+	"name",
+	"writes",
+	"key"
+];
+var TOOL_KEY_SHAPE = /^[a-z][a-zA-Z0-9]*$/;
 var HOST_KEYS = ["inject", "optional"];
 function text$1(value) {
 	return typeof value === "string" ? value.trim() : "";
@@ -109,6 +114,7 @@ function declarationProblemsOf(subject, raw) {
 		if (!Array.isArray(tools)) problems.push(`${subject}: dsh.workbench.tools 要是一串声明，现在是 ${JSON.stringify(tools)}`);
 		else {
 			const seen = /* @__PURE__ */ new Set();
+			const seenKeys = /* @__PURE__ */ new Set();
 			tools.forEach((tool, index) => {
 				const at = `dsh.workbench.tools[${index}]`;
 				if (!isRecord(tool)) {
@@ -122,6 +128,12 @@ function declarationProblemsOf(subject, raw) {
 				else if (seen.has(name)) problems.push(`${subject}: ${at}.name「${name}」与前面那条撞了 —— 工具名会进 dsh 的工具表，不许重`);
 				else seen.add(name);
 				if (typeof tool.writes !== "boolean") problems.push(`${subject}: ${at}.writes 要是 true / false（它是"这会写"的唯一声明，缺了审批无从认领）`);
+				if (tool.key !== void 0) {
+					const key = text$1(tool.key);
+					if (!TOOL_KEY_SHAPE.test(key)) problems.push(`${subject}: ${at}.key 要是 lowerCamelCase 的标识符（如 \`sync\` / \`podLogs\`），现在是 ${JSON.stringify(tool.key)} —— 它会变成生成物里的键名，所以不引号、不许带点或横线`);
+					else if (seenKeys.has(key)) problems.push(`${subject}: ${at}.key「${key}」与前面那条撞了 —— 生成物里的键只能有一个`);
+					else seenKeys.add(key);
+				}
 			});
 		}
 	}
@@ -201,6 +213,71 @@ function parseJsonLoose(text) {
 	}
 }
 //#endregion
+//#region ../shared/dist/host/cli-error.js
+function unquote(raw) {
+	const value = raw.trim();
+	if (value.length >= 2 && (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'"))) return value.slice(1, -1);
+	return value;
+}
+function joinBlock(previous, line, fold) {
+	if (previous === "") return line;
+	return fold ? `${previous} ${line}` : `${previous}\n${line}`;
+}
+function parseCliErrorEnvelope(text) {
+	if (text === void 0 || text.trim() === "") return void 0;
+	const lines = text.split("\n");
+	const start = lines.findIndex((line) => /^error:\s*$/.test(line.trim()) || /^error:\s*\S/.test(line.trim()));
+	if (start === -1) return void 0;
+	const scalars = {};
+	let current;
+	let block;
+	const errorIndent = lines[start]?.search(/\S/) ?? 0;
+	for (const line of lines.slice(start + 1)) {
+		if (line.trim() === "") continue;
+		const indent = line.search(/\S/);
+		if (block !== void 0 && indent > block.indent) {
+			scalars[block.key] = joinBlock(scalars[block.key] ?? "", line.trim(), block.fold);
+			continue;
+		}
+		block = void 0;
+		if (indent <= errorIndent) break;
+		const match = /^\s*(code|message|help|exitCode):\s*(.*)$/.exec(line);
+		if (match === null) {
+			if (current !== void 0) scalars[current] = `${scalars[current] ?? ""} ${line.trim()}`.trim();
+			continue;
+		}
+		const [, key, value] = match;
+		if (key === void 0) continue;
+		const raw = (value ?? "").trim();
+		const marker = /^([|>])[0-9]*([+-]?)$/.exec(raw);
+		if (marker !== null) {
+			scalars[key] = "";
+			block = {
+				key,
+				fold: marker[1] === ">",
+				indent
+			};
+			current = key;
+			continue;
+		}
+		scalars[key] = unquote(raw);
+		current = key;
+	}
+	const code = scalars["code"];
+	const message = scalars["message"];
+	if (code === void 0 || code === "") return void 0;
+	const exitCode = scalars["exitCode"];
+	return {
+		code,
+		message: message ?? code,
+		...scalars["help"] === void 0 || scalars["help"] === "" ? {} : { help: scalars["help"] },
+		...exitCode === void 0 || Number.isNaN(Number(exitCode)) ? {} : { exitCode: Number(exitCode) }
+	};
+}
+function helpUrlOf(envelope) {
+	return /https?:\/\/[^\s"'`]+/.exec(envelope.help ?? "")?.[0];
+}
+//#endregion
 //#region ../shared/dist/host/data-root.js
 function dshHome() {
 	const configured = process.env.DSH_HOME?.trim();
@@ -270,20 +347,20 @@ var PERMISSION_CODES = /* @__PURE__ */ new Set([
 function asRecord$9(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
 }
-function textOf$4(value) {
+function textOf$5(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
 function codeOf(page) {
 	const record = asRecord$9(page);
-	return record === void 0 ? "" : textOf$4(record["code"]);
+	return record === void 0 ? "" : textOf$5(record["code"]);
 }
-function messageOf$1(page) {
+function messageOf$2(page) {
 	const record = asRecord$9(page);
-	return record === void 0 ? "" : textOf$4(record["message"]);
+	return record === void 0 ? "" : textOf$5(record["message"]);
 }
 function hintOf$1(page) {
 	const record = asRecord$9(page);
-	const hint = record === void 0 ? "" : textOf$4(record["hint"]);
+	const hint = record === void 0 ? "" : textOf$5(record["hint"]);
 	return hint === "" ? void 0 : hint;
 }
 function pageFailed(page) {
@@ -472,7 +549,7 @@ async function browserRead(options) {
 		message: "读到了"
 	};
 	const pageCode = codeOf(page) || "read-failed";
-	const message = messageOf$1(page) || `读不到（${pageCode}）`;
+	const message = messageOf$2(page) || `读不到（${pageCode}）`;
 	const blocker = blockerFor(pageCode);
 	if (blocker === "auth-required") return {
 		ok: false,
@@ -514,7 +591,7 @@ var DEFAULT_TEXT_MAX = 200;
 function asRecord$8(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
 }
-function textOf$3(value) {
+function textOf$4(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
 function entriesOf(value) {
@@ -527,8 +604,8 @@ function entriesOf(value) {
 		if (item === void 0) continue;
 		const nth = typeof item["nth"] === "number" ? item["nth"] : entries.length;
 		entries.push({
-			text: textOf$3(item["text"]),
-			tag: textOf$3(item["tag"]),
+			text: textOf$4(item["text"]),
+			tag: textOf$4(item["tag"]),
 			nth
 		});
 	}
@@ -537,7 +614,7 @@ function entriesOf(value) {
 function reasonOf(stdout, stderr) {
 	const parsed = asRecord$8(parseJsonLoose(stdout));
 	const error = parsed === void 0 ? void 0 : asRecord$8(parsed["error"]);
-	const message = error === void 0 ? "" : textOf$3(error["message"]);
+	const message = error === void 0 ? "" : textOf$4(error["message"]);
 	if (message !== "") return message;
 	const lines = (stderr.trim() === "" ? stdout : stderr).split("\n").map((one) => one.trim()).filter((one) => one !== "");
 	return (lines[lines.length - 1] ?? "").slice(-200);
@@ -545,7 +622,7 @@ function reasonOf(stdout, stderr) {
 function hintOf(stdout) {
 	const parsed = asRecord$8(parseJsonLoose(stdout));
 	const error = parsed === void 0 ? void 0 : asRecord$8(parsed["error"]);
-	const hint = error === void 0 ? "" : textOf$3(error["hint"]);
+	const hint = error === void 0 ? "" : textOf$4(error["hint"]);
 	return hint === "" ? void 0 : hint;
 }
 function sameOrigin(left, right) {
@@ -559,7 +636,7 @@ function urlOf(stdout) {
 	const bare = (stdout.split("\n").map((one) => one.trim()).filter((one) => one !== "")[0] ?? "").replace(/^url:\s*/i, "").trim().replace(/^["']+|["']+$/g, "");
 	if (bare.startsWith("{")) {
 		const parsed = asRecord$8(parseJsonLoose(bare));
-		const url = parsed === void 0 ? "" : textOf$3(parsed["url"]);
+		const url = parsed === void 0 ? "" : textOf$4(parsed["url"]);
 		if (url !== "") return url;
 	}
 	return bare;
@@ -784,7 +861,8 @@ var PROVISION_ACTIONS = [
 	"cancel-install",
 	"update-dependency",
 	"update-plugin",
-	"uninstall-plugin"
+	"uninstall-plugin",
+	"update-workbench"
 ];
 var DEPENDENCY_ACTIONS = ["update-dependency"];
 function isDependencyAction(action) {
@@ -795,6 +873,7 @@ function provisionTargetOf(action) {
 	if (action === "install-bundle") return "spec";
 	if (action === "remove-bundle") return "name";
 	if (action === "update-plugin" || action === "uninstall-plugin") return "name";
+	if (action === "update-workbench") return "name";
 	if (action === "cancel-install") return "requestId";
 	return "unit";
 }
@@ -808,7 +887,7 @@ var TARGET_CODE = {
 function asRecord$7(value) {
 	return typeof value === "object" && value !== null ? value : {};
 }
-function stringsOf$2(value) {
+function stringsOf$3(value) {
 	if (!Array.isArray(value)) return void 0;
 	const items = value.filter((item) => typeof item === "string" && item.trim() !== "");
 	return items.length === 0 ? void 0 : items;
@@ -830,6 +909,10 @@ function requestOf$1(action, value) {
 		action,
 		name: value
 	};
+	if (action === "update-workbench") return {
+		action,
+		name: value
+	};
 	if (action === "cancel-install") return {
 		action,
 		requestId: value
@@ -860,7 +943,7 @@ function parseProvisionBody(body) {
 		request: requestOf$1(wanted, value.trim())
 	};
 	const registry = typeof raw.registry === "string" && raw.registry.trim() !== "" ? raw.registry.trim() : void 0;
-	const approvedBuilds = stringsOf$2(raw.approvedBuilds);
+	const approvedBuilds = stringsOf$3(raw.approvedBuilds);
 	const requestId = typeof raw.requestId === "string" && raw.requestId.trim() !== "" ? raw.requestId.trim() : void 0;
 	return {
 		ok: true,
@@ -874,6 +957,7 @@ function parseProvisionBody(body) {
 }
 //#endregion
 //#region ../shared/dist/host/opencli.js
+var FORBIDDEN_CODES = /* @__PURE__ */ new Set(["FORBIDDEN", "PERMISSION_DENIED"]);
 var SITE_SESSION_ARGS = ["--site-session", "persistent"];
 var WorkbenchDataError = class extends Error {
 	code;
@@ -901,6 +985,102 @@ function opencliCommandLine(command, argv, session = "persistent") {
 		"json"
 	].join(" ");
 }
+function createOpencli(options) {
+	const { shell, plugin, logger, command = "opencli", timeoutMs = OPENCLI_TIMEOUT_MS, maxConcurrent = 4 } = options;
+	const inflight = /* @__PURE__ */ new Map();
+	const MAX_CONCURRENT = maxConcurrent;
+	let running = 0;
+	const waiting = [];
+	async function acquire() {
+		if (running < MAX_CONCURRENT) {
+			running += 1;
+			return;
+		}
+		await new Promise((resolve) => waiting.push(resolve));
+	}
+	function release() {
+		const next = waiting.shift();
+		if (next === void 0) running -= 1;
+		else next();
+	}
+	async function runLimited(task) {
+		await acquire();
+		try {
+			return await task();
+		} finally {
+			release();
+		}
+	}
+	async function call(commandLine, workdir) {
+		let result;
+		try {
+			result = await runShell(shell, commandLine, {
+				...workdir === void 0 ? {} : { workdir },
+				timeoutMs
+			});
+		} catch (error) {
+			throw new WorkbenchDataError("cli-exec-failed", `执行 opencli 失败：${String(error)}`, { hint: "确认 opencli 已安装且在 PATH 里（which opencli）。" });
+		}
+		if (result.timedOut) throw new WorkbenchDataError("cli-timeout", `opencli 超过 ${Math.round(timeoutMs / 1e3)} 秒没有返回`, { hint: "无头浏览器可能没起来，重试一次通常就好。" });
+		if (result.exitCode !== 0) {
+			const detail = tailLines(result.stderr || result.stdout, 6);
+			const envelope = parseCliErrorEnvelope(result.stderr) ?? parseCliErrorEnvelope(result.stdout);
+			const url = envelope === void 0 ? void 0 : helpUrlOf(envelope);
+			if (envelope?.code === "AUTH_REQUIRED") throw new WorkbenchDataError("auth-required", envelope.message, {
+				detail,
+				...url === void 0 ? {} : { helpUrl: url }
+			});
+			if (envelope !== void 0 && FORBIDDEN_CODES.has(envelope.code)) throw new WorkbenchDataError("permission-denied", envelope.message, {
+				detail,
+				...url === void 0 ? {} : { helpUrl: url }
+			});
+			if (envelope !== void 0) throw new WorkbenchDataError("cli-command-failed", `${envelope.code}：${envelope.message}`, {
+				detail,
+				...envelope.help === void 0 ? {} : { hint: envelope.help }
+			});
+			throw new WorkbenchDataError("cli-unclassified", `opencli 这条命令没跑通（退出码 ${result.exitCode}），而且没有结构化错误码`, {
+				detail,
+				hint: "多半是插件里没有这条命令（版本旧就会缺），也可能是命令自己失败了：先确认命令存在，再更新插件重试。"
+			});
+		}
+		const parsed = parseJsonLoose(result.stdout);
+		if (parsed === void 0) throw new WorkbenchDataError("cli-bad-output", "opencli 输出不是 JSON", { detail: tailLines(result.stdout, 4) });
+		return parsed;
+	}
+	async function json(args, callOptions = {}) {
+		const { key, workdir } = callOptions;
+		const session = callOptions.session ?? "persistent";
+		const callKey = key ?? args.map((arg) => String(arg)).join(" ");
+		const pending = inflight.get(callKey);
+		if (pending !== void 0) return pending;
+		const commandLine = opencliCommandLine(command, [plugin, ...args], session);
+		const once = async () => {
+			return {
+				value: await call(commandLine, workdir),
+				at: Date.now()
+			};
+		};
+		const task = runLimited(async () => {
+			try {
+				return await once();
+			} catch (error) {
+				if (!(error instanceof WorkbenchDataError) || error.code !== "auth-required") throw error;
+				return await once();
+			}
+		});
+		inflight.set(callKey, task);
+		try {
+			return await task;
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			logger?.warn?.(`[dsh-workbench] opencli 调用失败：${message}`);
+			throw error;
+		} finally {
+			inflight.delete(callKey);
+		}
+	}
+	return { json };
+}
 //#endregion
 //#region ../shared/dist/host/write-result.js
 function writeResultForClient(value, code) {
@@ -1435,7 +1615,7 @@ var PLUGIN_LEDGER_FILE = "plugins.json";
 function ledgerKeyOf(entry) {
 	return `${entry.opencliHome}\u0000${entry.package}`;
 }
-function textOf$2(value) {
+function textOf$3(value) {
 	if (typeof value !== "string") return void 0;
 	const trimmed = value.trim();
 	return trimmed === "" ? void 0 : trimmed;
@@ -1443,13 +1623,13 @@ function textOf$2(value) {
 function entryOf(value) {
 	if (typeof value !== "object" || value === null) return void 0;
 	const box = value;
-	const opencliHome = textOf$2(box["opencliHome"]);
-	const pkg = textOf$2(box["package"]);
-	const installedAt = textOf$2(box["installedAt"]);
+	const opencliHome = textOf$3(box["opencliHome"]);
+	const pkg = textOf$3(box["package"]);
+	const installedAt = textOf$3(box["installedAt"]);
 	if (opencliHome === void 0 || pkg === void 0 || installedAt === void 0) return void 0;
-	const name = textOf$2(box["name"]);
-	const registry = textOf$2(box["registry"]);
-	const releasedAt = textOf$2(box["releasedAt"]);
+	const name = textOf$3(box["name"]);
+	const registry = textOf$3(box["registry"]);
+	const releasedAt = textOf$3(box["releasedAt"]);
 	return {
 		opencliHome,
 		package: pkg,
@@ -1616,7 +1796,7 @@ function resolvePluginSource(source, env, options = {}) {
 }
 //#endregion
 //#region ../shared/dist/host/tool-approval.js
-function messageOf(error) {
+function messageOf$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 function compose(detail, verdict) {
@@ -1634,7 +1814,7 @@ async function approvalFor(call, context = {}) {
 	} catch (error) {
 		return {
 			kind: "deny",
-			reason: `问"要不要审批"的时候套件的策略抛了错，已经停下：${messageOf(error)}`
+			reason: `问"要不要审批"的时候套件的策略抛了错，已经停下：${messageOf$1(error)}`
 		};
 	}
 	if (verdict?.kind === "read") return void 0;
@@ -1648,7 +1828,7 @@ async function approvalFor(call, context = {}) {
 	} catch (error) {
 		return {
 			kind: "deny",
-			reason: `拿不到"这次会发生什么"，已经停下：${messageOf(error)}`
+			reason: `拿不到"这次会发生什么"，已经停下：${messageOf$1(error)}`
 		};
 	}
 	if (facts !== void 0 && "blocked" in facts) return {
@@ -1667,6 +1847,15 @@ function sessionWorkspace(exec) {
 	const cwd = exec?.agent?.session?.header?.cwd;
 	return typeof cwd === "string" && cwd.trim() !== "" ? cwd.trim() : null;
 }
+function textOutput(text) {
+	return [{
+		type: "text",
+		text
+	}];
+}
+function jsonText(value) {
+	return JSON.stringify(value);
+}
 //#endregion
 //#region ../shared/dist/host/value-handoff.js
 function handoffId(entry) {
@@ -1988,7 +2177,7 @@ function profileDirOf(ctx) {
 	const dir = typeof profile?.dir === "string" ? profile.dir.trim() : "";
 	return dir === "" ? null : dir;
 }
-function stringsOf$1(value) {
+function stringsOf$2(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 function profileManifestOf(profileDir) {
@@ -2002,7 +2191,7 @@ function profileManifestOf(profileDir) {
 function profileModules(profileDir) {
 	const record = profileManifestOf(profileDir);
 	if (record === void 0) return [];
-	const bundles = stringsOf$1(asRecord$5(asRecord$5(record.dsh)?.profile)?.bundles);
+	const bundles = stringsOf$2(asRecord$5(asRecord$5(record.dsh)?.profile)?.bundles);
 	const dependencies = asRecord$5(record.dependencies) ?? {};
 	const names = bundles.length > 0 ? bundles : Object.keys(dependencies);
 	const found = [];
@@ -2013,7 +2202,7 @@ function profileModules(profileDir) {
 			unit: read.unit,
 			version: read.version,
 			...read.registry === void 0 ? {} : { registry: read.registry },
-			local: asText$3(dependencies[read.pkg]).startsWith("link:")
+			local: isLocalDependencySpec(asText$3(dependencies[read.pkg]))
 		});
 	}
 	return found;
@@ -2058,6 +2247,20 @@ function declarationGaps(profileDir) {
 	}
 	return gaps;
 }
+function declaredPluginCommands(profileDir) {
+	const declared = /* @__PURE__ */ new Map();
+	for (const module of profileModules(profileDir)) {
+		const read = readDeclaration(module.pkg, moduleDeclarationOf(profileDir, module.pkg));
+		for (const need of read.manifest?.env?.plugins ?? []) {
+			const name = need.name.trim();
+			if (name === "") continue;
+			const commands = declared.get(name) ?? /* @__PURE__ */ new Set();
+			for (const command of need.commands ?? []) commands.add(command);
+			declared.set(name, commands);
+		}
+	}
+	return declared;
+}
 function readInstalledModule(profileDir, pkg) {
 	if (profileDir === null || !isPackageName(pkg)) return {
 		kind: "unknown",
@@ -2093,6 +2296,32 @@ function readInstalledModule(profileDir, pkg) {
 		...registry === "" ? {} : { registry }
 	};
 }
+function isLocalDependencySpec(spec) {
+	const trimmed = spec.trim();
+	return trimmed.startsWith("link:") || trimmed.startsWith("file:") || trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("/");
+}
+function readProfilePackage(profileDir, pkg) {
+	if (profileDir === null || !isPackageName(pkg)) return void 0;
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(path.join(profileDir, "node_modules", pkg, "package.json"), "utf8"));
+	} catch {
+		return;
+	}
+	const record = asRecord$5(manifest);
+	if (record === void 0) return void 0;
+	const version = asText$3(record.version);
+	if (version === "") return void 0;
+	const declaredRegistry = asText$3(asRecord$5(record.publishConfig)?.registry);
+	const registry = declaredRegistry === "" ? registryFromLockfile(profileDir, pkg) : declaredRegistry;
+	const local = isLocalDependencySpec(asText$3((asRecord$5(profileManifestOf(profileDir)?.dependencies) ?? {})[pkg]));
+	return {
+		pkg,
+		version,
+		...registry === "" ? {} : { registry },
+		...local ? { local: true } : {}
+	};
+}
 //#endregion
 //#region src/shared/api/host/profile-registries.ts
 var REGISTRY_MARKER = "# dsh-workbench 写的：这一行的包只在这个源上（dsh 卸载没有源参数，pnpm 得问得到）";
@@ -2338,6 +2567,13 @@ var panelsApproval = (call) => {
 				zh: `agent 想${verb} opencli 插件 ${what}（会改这台机器上装的东西）。允许吗？`
 			});
 		}
+		if (action === "update-workbench") return askOf("workbench_modules update-workbench replaces the workbench itself with the new version from the registry", {
+			en: "it updates the workbench itself on this machine (the panel picks the new version up by itself). Allow?",
+			zh: "会把工作台自己更新到源上的新版（面板会自己换新）。允许吗？"
+		}, {
+			en: "The agent wants to update the workbench itself to the new version from the registry (it changes what is installed on this machine; the panel picks the new version up by itself). Allow?",
+			zh: "agent 想把工作台自己更新到源上的新版（会改这台机器上装的东西，面板会自己换新）。允许吗？"
+		});
 		if (action === "update-dependency") return askOf(`workbench_modules update-dependency ${id ?? ""} upgrades a shared dependency on this machine`, {
 			en: "it upgrades that shared dependency on this machine. Allow?",
 			zh: `会升级共用依赖 ${what}。允许吗？`
@@ -2411,13 +2647,20 @@ var EMPTY_BOARD = {
 };
 var BOARD_TARGETS = ["workspace", "machine"];
 var DEFAULT_BOARD_TARGET = "workspace";
-function resolveScope(query) {
-	const { id, boards } = query;
-	const board = boards.workspace ?? boards.machine;
+function overrideOf(board, id) {
+	if (board === null) return void 0;
+	if (board.hidden.includes(id)) return false;
+	if (board.shown.includes(id)) return true;
+}
+function defaultOf(board, id) {
 	if (board === null) return false;
 	if (board.hidden.includes(id)) return false;
 	return board.shown.includes(id);
 }
+function resolveScope(query) {
+	const { id, boards } = query;
+	return overrideOf(boards.workspace, id) ?? defaultOf(boards.machine, id);
+}
 function strings(raw) {
 	return Array.isArray(raw) ? raw.filter((item) => typeof item === "string") : [];
 }
@@ -2434,7 +2677,7 @@ function parseReleased(raw) {
 	return strings(raw.ids);
 }
 function resolvePanels(manifests, boards) {
-	const ordered = boards.workspace?.shown ?? boards.machine?.shown ?? [];
+	const ordered = [.../* @__PURE__ */ new Set([...boards.workspace?.shown ?? [], ...boards.machine?.shown ?? []])];
 	const rank = new Map(ordered.map((id, index) => [id, index]));
 	return manifests.filter((manifest) => manifest.card !== null).map((manifest) => {
 		const on = resolveScope({
@@ -2447,11 +2690,39 @@ function resolvePanels(manifests, boards) {
 			titleKey: manifest.card?.titleKey ?? manifest.id,
 			order,
 			shown: on,
-			source: on && (boards.workspace?.shown.includes(manifest.id) ?? false) ? "user" : "default",
+			source: overrideOf(boards.workspace, manifest.id) === void 0 ? "default" : "user",
 			hasCard: true
 		};
 	}).sort((a, b) => a.order - b.order || a.id.localeCompare(b.id));
 }
+var PLUGIN_PANEL_PREFIX = "plugin:";
+function pluginPanelId(pkg) {
+	return `${PLUGIN_PANEL_PREFIX}${pkg}`;
+}
+function resolvePluginPanels(plugins, boards) {
+	const ordered = [.../* @__PURE__ */ new Set([...boards.workspace?.shown ?? [], ...boards.machine?.shown ?? []])];
+	const rank = new Map(ordered.map((id, index) => [id, index]));
+	const seen = /* @__PURE__ */ new Set();
+	return plugins.map((plugin) => {
+		const id = pluginPanelId(plugin.pkg);
+		return {
+			id,
+			pkg: plugin.pkg,
+			title: plugin.title,
+			...plugin.name === void 0 ? {} : { name: plugin.name },
+			order: rank.get(id) ?? ordered.length,
+			shown: resolveScope({
+				id,
+				boards
+			}),
+			source: overrideOf(boards.workspace, id) === void 0 ? "default" : "user"
+		};
+	}).filter((entry) => {
+		if (seen.has(entry.id)) return false;
+		seen.add(entry.id);
+		return true;
+	}).sort((a, b) => a.order - b.order || a.pkg.localeCompare(b.pkg));
+}
 function withoutReleased(released, id) {
 	return released.filter((item) => item !== id);
 }
@@ -2589,7 +2860,7 @@ var PLUGIN_PREFIX = "opencli-plugin-";
 function text(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
-function stringsOf(value) {
+function stringsOf$1(value) {
 	return Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
 }
 function manifestCommandsOf(raw) {
@@ -2620,7 +2891,7 @@ function manifestCommandsOf(raw) {
 			strategy: text(row["strategy"]).toLowerCase(),
 			browser: row["browser"] === true,
 			example: text(row["example"]),
-			columns: stringsOf(row["columns"])
+			columns: stringsOf$1(row["columns"])
 		});
 	}
 	return commands;
@@ -2712,7 +2983,7 @@ function reconOf(commands, plugins, keywords) {
 	};
 	return {
 		...withNext,
-		text: textOf$1(withNext)
+		text: textOf$2(withNext)
 	};
 }
 function nextOf(answer) {
@@ -2725,7 +2996,7 @@ function nextOf(answer) {
 	if (plugin !== void 0) return `这台机器另装的插件 ${plugin.name} 里有匹配：opencli ${plugin.name} --help 看全部命令`;
 	return "这台机器上没有现成的 —— 两条路：① 给这个站点写 adapter：opencli skills read opencli-adapter-author；② 只读一次：workbench_diy action=probe（script 读接口 / css 读 DOM）";
 }
-function textOf$1(answer) {
+function textOf$2(answer) {
 	const lines = [];
 	if (answer.sites.length > 0) {
 		lines.push(`opencli 自带这 ${String(answer.sites.length)} 组能力（不用装、不用点头）：`);
@@ -2770,7 +3041,7 @@ function installedPluginsOf(dir = vendorPluginsDir()) {
 }
 //#endregion
 //#region src/modules/panels/model/diy-tools.ts
-var ACTIONS$1 = [
+var ACTIONS$2 = [
 	"list",
 	"status",
 	"probe",
@@ -2907,7 +3178,7 @@ function registerDiyTools(ctx, market, panels) {
 				action: {
 					type: "string",
 					description: "list=工坊里有哪些模块（默认）；status=某个模块现在走到哪一步、下一步做什么；probe=在用户浏览器里探一条读；recon=先查 opencli 现成的能力（自带 adapter / 本机插件）；open=只把它在这个项目上板（不装）；install=装上并上板（第一次、会让用户点头）。",
-					enum: [...ACTIONS$1]
+					enum: [...ACTIONS$2]
 				},
 				unit: {
 					type: "string",
@@ -2966,7 +3237,7 @@ function registerDiyTools(ctx, market, panels) {
 		async execute(raw, exec) {
 			const args = asRecord$3(raw) ?? {};
 			const action = asText$1(args.action) || "list";
-			if (!ACTIONS$1.includes(action)) throw new Error(`不认识的 action：${action}（可用：${ACTIONS$1.join(" / ")}）`);
+			if (!ACTIONS$2.includes(action)) throw new Error(`不认识的 action：${action}（可用：${ACTIONS$2.join(" / ")}）`);
 			const packagesDir = workshopPackagesDir(ctx);
 			if (packagesDir === null) throw new Error("算不出 DIY 工坊在哪（这台机器没给出 dshHomePath）—— 让用户跑一次 dsh-workbench setup");
 			const session = sessionWorkspace(exec);
@@ -3895,9 +4166,45 @@ function createEnvDropper(options) {
 	};
 }
 //#endregion
+//#region src/modules/panels/model/market-registry.ts
+async function rememberInstalledSource(deps, manager, pkg, registry) {
+	const { registries, logger } = deps;
+	if (registries === void 0 || registry === void 0) return;
+	const scope = scopeOf(pkg);
+	if (scope === null) return;
+	const known = await manager.registries().catch(() => null);
+	if (known !== null && sameRegistry(known.resolved, registry)) return;
+	try {
+		const added = registries.remember([{
+			scope,
+			registry
+		}]);
+		if (added.length > 0) logger?.info?.(`[dsh-workbench] 把 ${added.join("、")} 记进 profile 的 .npmrc（卸载只认 pnpm 的配置）`);
+	} catch (error) {
+		logger?.warn?.(`[dsh-workbench] 记这个 scope 的源失败：${String(error)}`);
+	}
+}
+async function retryAfterRegistryFix(deps, manager, pkg, change) {
+	const { registries, logger } = deps;
+	if (registries === void 0 || !registryFailure(change)) return change;
+	const known = await manager.registries().catch(() => null);
+	const missing = registries.sources().filter((entry) => !sameRegistry(entry.registry, known?.resolved ?? null));
+	if (missing.length === 0) return change;
+	let added;
+	try {
+		added = registries.remember(missing);
+	} catch (error) {
+		logger?.warn?.(`[dsh-workbench] 卸 ${pkg} 撞上源，但补配置失败：${String(error)}`);
+		return change;
+	}
+	if (added.length === 0) return change;
+	logger?.warn?.(`[dsh-workbench] 卸 ${pkg} 撞上源：补 ${added.join("、")} 后重试一次`);
+	return await manager.remove(pkg).catch(() => null) ?? change;
+}
+//#endregion
 //#region src/modules/panels/model/market.ts
 function createMarketService(options) {
-	const { manifests, manifestsNow, probe, shell, logger, onInstalled, onUninstalled, isReleased, bundles, installed, modules, registries, ledger, references } = options;
+	const { manifests, manifestsNow, probe, shell, logger, onInstalled, onUninstalled, isReleased, bundles, installed, modules, workbench, registries, ledger, references } = options;
 	const command = options.command ?? "opencli";
 	const catalog = () => (manifestsNow?.() ?? manifests).filter((manifest) => (manifest.env?.plugins ?? []).length > 0 || (manifest.env?.libs ?? []).length > 0);
 	function requireEntry(unit) {
@@ -4042,44 +4349,16 @@ function createMarketService(options) {
 			};
 		}
 	}
-	async function rememberInstalledSource(manager, pkg, registry) {
-		if (registries === void 0 || registry === void 0) return;
-		const scope = scopeOf(pkg);
-		if (scope === null) return;
-		const known = await manager.registries().catch(() => null);
-		if (known !== null && sameRegistry(known.resolved, registry)) return;
-		try {
-			const added = registries.remember([{
-				scope,
-				registry
-			}]);
-			if (added.length > 0) logger?.info?.(`[dsh-workbench] 把 ${added.join("、")} 记进 profile 的 .npmrc（卸载只认 pnpm 的配置）`);
-		} catch (error) {
-			logger?.warn?.(`[dsh-workbench] 记这个 scope 的源失败：${String(error)}`);
-		}
-	}
-	async function retryAfterRegistryFix(manager, pkg, change) {
-		if (registries === void 0 || !registryFailure(change)) return change;
-		const known = await manager.registries().catch(() => null);
-		const missing = registries.sources().filter((entry) => !sameRegistry(entry.registry, known?.resolved ?? null));
-		if (missing.length === 0) return change;
-		let added;
-		try {
-			added = registries.remember(missing);
-		} catch (error) {
-			logger?.warn?.(`[dsh-workbench] 卸 ${pkg} 撞上源，但补配置失败：${String(error)}`);
-			return change;
-		}
-		if (added.length === 0) return change;
-		logger?.warn?.(`[dsh-workbench] 卸 ${pkg} 撞上源：补 ${added.join("、")} 后重试一次`);
-		return await manager.remove(pkg).catch(() => null) ?? change;
-	}
+	const registryFix = {
+		...registries === void 0 ? {} : { registries },
+		...logger === void 0 ? {} : { logger }
+	};
 	function routeDeps(manager) {
 		return {
 			manager,
 			command,
 			runAll,
-			rememberSource: rememberInstalledSource,
+			rememberSource: (manager, pkg, registry) => rememberInstalledSource(registryFix, manager, pkg, registry),
 			supplyAfter,
 			...shell === void 0 ? {} : { shell },
 			...installed === void 0 ? {} : { installed },
@@ -4225,7 +4504,7 @@ function createMarketService(options) {
 			const before = unit === void 0 ? void 0 : await capabilityOf(unit, true);
 			const first = await manager.remove(pkg);
 			if (first === null) throw new Error("插件管理器回的卸载结果看不懂。");
-			const change = await retryAfterRegistryFix(manager, pkg, first);
+			const change = await retryAfterRegistryFix(registryFix, manager, pkg, first);
 			if (change.application !== "applied" || unit === void 0) return {
 				change,
 				keptFor: []
@@ -4261,6 +4540,24 @@ function createMarketService(options) {
 			await service.update(unit).catch(() => void 0);
 			return outcome;
 		},
+		async updateWorkbench(pkg) {
+			const target = pkg.trim() === "" ? PLUGIN_ID : pkg.trim();
+			if (target !== "@dsh-workbench/core") throw new Error(`这条路只更新工作台自己那一份（${PLUGIN_ID}）：${target}`);
+			const read = workbench?.(target);
+			if (read === void 0) throw new Error(`读不到 profile 里装的 ${target} —— 没法判断装的是哪一份，更新做不了。`);
+			if (read.local === true) throw new Error("这份工作台是从本仓装进来的（开发副本），不从源上更新。");
+			const registry = read.registry;
+			const latest = shell === void 0 || registry === void 0 ? void 0 : await latestVersion({
+				shell,
+				name: read.pkg,
+				registry,
+				force: true
+			});
+			const spec = latest === void 0 ? `${read.pkg}@latest` : `${read.pkg}@${latest}`;
+			const outcome = await installDshBundle(routeDeps(requireBundles()), spec, { ...registry === void 0 ? {} : { registry } });
+			logger?.info?.(`[dsh-workbench] 已更新工作台 ${read.version} → ${latest ?? "最新版"}`);
+			return outcome;
+		},
 		async updatePlugin(pkg) {
 			const outcome = await plugins.update(pkg);
 			await reprobePlugin(pkg, outcome.name);
@@ -4325,6 +4622,11 @@ async function dispatchMarket(market, request) {
 		action: "cancel-install",
 		cancellation: await market.cancelInstall(request.requestId ?? "")
 	};
+	if (request.action === "update-workbench") return {
+		ok: true,
+		action: "update-workbench",
+		change: (await market.updateWorkbench(request.name ?? "")).change
+	};
 	if (request.action === "update-plugin") {
 		await market.updatePlugin(request.name ?? "");
 		return {
@@ -4419,12 +4721,16 @@ function describePluginUninstall(pkg, outcome) {
 	if (outcome.removed) return `已卸载 opencli 插件 ${pkg}：没人再用它，文件也删了。`;
 	return `已从「你装的插件」里去掉 ${pkg}。${outcome.kept === void 0 ? "" : pluginKeptText(outcome.kept)}`;
 }
+function describeWorkbenchUpdate(change) {
+	if (change.application === "failed" || change.application === "cancelled") return `没成功：${change.errorCode ?? change.application}`;
+	return change.application === "restart-required" ? "工作台更新到新版了 —— 这一版要重启一次 dsh 才生效（重启由用户来，别自己重启）。" : "工作台更新到新版了 —— 客户端与宿主自己换上，不用重启。";
+}
 function usersOf(shared, names) {
 	const hit = shared.find((item) => names.some((name) => name !== void 0 && name !== "" && item.id === `plugin:${name}`));
 	if (hit === void 0 || hit.usedBy.length === 0) return "";
 	return `它被 ${hit.usedBy.join("、")} 用着（动的是它们的供给，它们的状态跟着重探了一遍）`;
 }
-var ACTIONS = [
+var ACTIONS$1 = [
 	"list",
 	"install",
 	"update",
@@ -4432,7 +4738,8 @@ var ACTIONS = [
 	"install-bundle",
 	"update-dependency",
 	"update-plugin",
-	"uninstall-plugin"
+	"uninstall-plugin",
+	"update-workbench"
 ];
 function registerMarketTools(ctx, market) {
 	const tools = ctx.get("tools");
@@ -4442,14 +4749,14 @@ function registerMarketTools(ctx, market) {
 	}
 	const tool = {
 		name: "workbench_modules",
-		description: "看 / 装 / 升 / 卸工作台的面板模块，以及用户自己装的 opencli 插件。install-bundle 按 spec（包名，可带版本；git / tarball / 本地路径也行）把模块包装进 profile —— 装完会连带装它声明的 opencli 插件；其余 action 按模块 id 动它要的外部供给；update-plugin / uninstall-plugin 按包名或插件名动用户装的那份插件。卸载只动工作台运行时，不影响终端那套；共用依赖只有升级。",
+		description: "看 / 装 / 升 / 卸工作台的面板模块，以及用户自己装的 opencli 插件。install-bundle 按 spec（包名，可带版本；git / tarball / 本地路径也行）把模块包装进 profile —— 装完会连带装它声明的 opencli 插件；其余 action 按模块 id 动它要的外部供给；update-plugin / uninstall-plugin 按包名或插件名动用户装的那份插件；update-workbench 把工作台自己更新到源上的新版（客户端与宿主一般会自己换上；真要重启时结果里会说，重启由用户来，别自己重启）。卸载只动工作台运行时，不影响终端那套；共用依赖只有升级。",
 		parameters: {
 			type: "object",
 			properties: {
 				action: {
 					type: "string",
-					description: "install-bundle=按 spec 装模块包（要 spec），update-dependency=升级共用依赖（要 id），update-plugin / uninstall-plugin=动用户自己装的 opencli 插件（要 plugin），其余=对模块（要 id）。",
-					enum: [...ACTIONS]
+					description: "install-bundle=按 spec 装模块包（要 spec），update-dependency=升级共用依赖（要 id），update-plugin / uninstall-plugin=动用户自己装的 opencli 插件（要 plugin），update-workbench=把工作台自己更新到新版（不用别的参数），其余=对模块（要 id）。",
+					enum: [...ACTIONS$1]
 				},
 				id: {
 					type: "string",
@@ -4483,7 +4790,7 @@ function registerMarketTools(ctx, market) {
 		},
 		async execute(args) {
 			const action = args?.action ?? "list";
-			if (!ACTIONS.includes(action)) throw new Error(`不认识的 action：${action}（可用：${ACTIONS.join(" / ")}）`);
+			if (!ACTIONS$1.includes(action)) throw new Error(`不认识的 action：${action}（可用：${ACTIONS$1.join(" / ")}）`);
 			if (action === "list") {
 				const { modules, shared } = await market.list();
 				return {
@@ -4504,6 +4811,13 @@ function registerMarketTools(ctx, market) {
 					text: describeInstall(spec, outcome.module, outcome.supply, outcome.change)
 				};
 			}
+			if (action === "update-workbench") {
+				const outcome = await market.updateWorkbench("");
+				return {
+					change: outcome.change,
+					text: describeWorkbenchUpdate(outcome.change)
+				};
+			}
 			if (action === "update-plugin" || action === "uninstall-plugin") {
 				const plugin = args?.plugin?.trim() ?? "";
 				if (plugin === "") throw new Error(`${action} 需要一个 plugin：opencli 插件的包名或插件名 —— 就是市场「已安装 opencli 插件」那一段里的名字。`);
@@ -4554,53 +4868,70 @@ function registerMarketTools(ctx, market) {
 //#endregion
 //#region src/modules/panels/model/prefs.ts
 var PANELS_PREF_RESOURCE = "panels";
+var ACTIONS = [
+	"show",
+	"hide",
+	"move",
+	"reset",
+	"follow"
+];
 function parsePanelsPrefAction(payload) {
-	if (typeof payload !== "object" || payload === null) throw new Error("偏好写需要一个对象：{ action, id?, index?, path? }");
+	if (typeof payload !== "object" || payload === null) throw new Error("偏好写需要一个对象：{ action, id?, index?, path?, scope? }");
 	const value = payload;
 	const action = value.action;
-	if (action !== "show" && action !== "hide" && action !== "enable" && action !== "disable" && action !== "move" && action !== "reset") throw new Error(`不认识的 action：${String(action)}（可用：show / hide / enable / disable / move / reset）`);
+	if (typeof action !== "string" || !ACTIONS.includes(action)) throw new Error(`不认识的 action：${String(action)}（可用：${ACTIONS.join(" / ")}）`);
+	if (value.scope !== void 0 && value.scope !== "machine" && value.scope !== "workspace") throw new Error(`不认识的 scope：${String(value.scope)}（可用：workspace / machine）`);
 	return {
 		action,
 		...typeof value.id === "string" ? { id: value.id } : {},
 		...typeof value.index === "number" ? { index: value.index } : {},
-		...typeof value.path === "string" ? { path: value.path } : {}
+		...typeof value.path === "string" ? { path: value.path } : {},
+		...value.scope === void 0 ? {} : { scope: value.scope }
 	};
 }
 function applyPanelsPref(panels, payload) {
 	const action = parsePanelsPrefAction(payload);
 	const path = action.path ?? null;
+	const scope = action.scope ?? "workspace";
+	if (action.action === "follow") {
+		if (scope === "machine") throw new Error("机器级默认板没有\"回到跟随\"一说：它就是那份默认本身（要回到的是\"没配过\"）。");
+		return {
+			ok: true,
+			units: action.id === void 0 ? panels.follow(path) : panels.follow(path, action.id)
+		};
+	}
 	if (action.action === "reset") return {
 		ok: true,
-		units: panels.reset(path)
+		units: panels.reset(path, scope)
 	};
 	if (action.id === void 0) throw new Error(`${action.action} 需要一个 id（当前套件：${panels.list(path).map((entry) => entry.id).join(", ")}）`);
 	if (action.action === "show") return {
 		ok: true,
-		units: panels.show(action.id, path)
+		units: panels.show(action.id, path, scope)
 	};
 	if (action.action === "hide") return {
 		ok: true,
-		units: panels.hide(action.id, path)
+		units: panels.hide(action.id, path, scope)
 	};
 	return {
 		ok: true,
-		units: panels.move(action.id, action.index ?? 0, path)
+		units: panels.move(action.id, action.index ?? 0, path, scope)
 	};
 }
 //#endregion
 //#region src/modules/panels/model/handoff.ts
 var PANELS_FACT = "panels";
 var CAPABILITY_FACT = "capability";
-function textOf(value) {
+function textOf$1(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
 function actionOf(call) {
-	return textOf(call.args["action"]) || "list";
+	return textOf$1(call.args["action"]) || "list";
 }
 function requestOf(call) {
 	const action = actionOf(call);
 	if (!PROVISION_ACTIONS.includes(action)) return void 0;
-	const target = textOf(call.args["unit"]) || textOf(call.args["id"]);
+	const target = textOf$1(call.args["unit"]) || textOf$1(call.args["id"]);
 	if (target === "") return void 0;
 	const wanted = action;
 	return isDependencyAction(wanted) ? {
@@ -4612,7 +4943,7 @@ function requestOf(call) {
 	};
 }
 function panelsHandoffEntry(target = {}) {
-	const path = textOf(target.path);
+	const path = textOf$1(target.path);
 	return path === "" ? void 0 : {
 		fact: PANELS_FACT,
 		key: `path:${path}`
@@ -4623,6 +4954,7 @@ function panelsFactsOf(call, manifests) {
 	if (call.source === "workbench_diy" && actionOf(call) === "list") return [PANELS_FACT];
 	if (call.source !== "workbench_modules" && call.source !== "workbench_diy") return void 0;
 	if (actionOf(call) === "list") return [PANELS_FACT, CAPABILITY_FACT];
+	if (actionOf(call) === "update-workbench") return [PANELS_FACT, CAPABILITY_FACT];
 	const request = requestOf(call);
 	if (request === void 0) return void 0;
 	return [
@@ -4710,7 +5042,14 @@ function createPanelsService(options) {
 		const all = manifests();
 		if (!all.some((manifest) => manifest.id === id)) throw new Error(`没有这个套件：${id}（可用：${all.map((manifest) => manifest.id).join(", ")}）`);
 	}
+	function pluginRefs() {
+		return options.plugins?.() ?? [];
+	}
+	function pluginIds() {
+		return new Set(pluginRefs().map((plugin) => pluginPanelId(plugin.pkg)));
+	}
 	function requireSwitchable(id) {
+		if (pluginIds().has(id)) return;
 		requireKnown(id);
 		if (!manifests().some((manifest) => manifest.id === id && manifest.card !== null)) throw new Error(`${id} 没有卡片，不能收起（它是把别的套件放回来的入口）`);
 	}
@@ -4723,6 +5062,9 @@ function createPanelsService(options) {
 		list(workspace, target) {
 			return resolvePanels(manifests(), target === "machine" ? boardsOf(null) : boardsOf(workspace));
 		},
+		listPlugins(workspace, target) {
+			return resolvePluginPanels(pluginRefs(), target === "machine" ? boardsOf(null) : boardsOf(workspace));
+		},
 		boards(workspace) {
 			return boardsOf(workspace);
 		},
@@ -4780,6 +5122,24 @@ function createPanelsService(options) {
 		reset(workspace, target) {
 			const { folder, key } = targetOf(target ?? "workspace", workspace);
 			return withPersisted(folder, EMPTY_BOARD, key);
+		},
+		changedBy() {
+			const counts = /* @__PURE__ */ new Map();
+			for (const folder of store.scan(PANELS_MODULE_ID)) {
+				const board = readBoard(folder);
+				if (board === null) continue;
+				for (const id of /* @__PURE__ */ new Set([...board.shown, ...board.hidden])) counts.set(id, (counts.get(id) ?? 0) + 1);
+			}
+			return counts;
+		},
+		follow(workspace, id) {
+			const { folder, key } = targetOf("workspace", workspace);
+			if (id === void 0) {
+				folder.remove(PANELS_FILE);
+				notify();
+				return resolvePanels(manifests(), boardsOf(key));
+			}
+			return withPersisted(folder, withoutPanel(boardIn(folder), id), key);
 		}
 	};
 }
@@ -4790,13 +5150,15 @@ function panelRoutes(panels, values) {
 		const path = param(search, "path") ?? null;
 		const entry = panelsHandoffEntry(path === null ? {} : { path });
 		const handed = entry === void 0 ? void 0 : values?.take(entry);
-		if (handed !== void 0) return {
-			ok: true,
-			units: handed.value
-		};
+		const defaults = [...panels.list(null, "machine").filter((unit) => unit.shown).map((unit) => unit.id), ...panels.listPlugins(null, "machine").filter((plugin) => plugin.shown).map((plugin) => plugin.id)];
+		const own = panels.boards(path).workspace !== null;
 		return {
 			ok: true,
-			units: panels.list(path)
+			units: handed === void 0 ? panels.list(path) : handed.value,
+			plugins: panels.listPlugins(path),
+			defaults,
+			own,
+			changed: Object.fromEntries(panels.changedBy())
 		};
 	} };
 }
@@ -4855,6 +5217,18 @@ function createPluginLedger(options) {
 	};
 }
 //#endregion
+//#region src/modules/panels/model/plugin-panel.ts
+function pluginPanelRefs(ledger) {
+	return ledger.list().map((entry) => {
+		const name = pluginNameOf(entry);
+		return {
+			pkg: entry.package,
+			title: name ?? entry.package,
+			...name === void 0 ? {} : { name }
+		};
+	});
+}
+//#endregion
 //#region src/shared/api/installed-plugins.ts
 var INSTALLED_PLUGINS_ROUTE = "panels/plugins";
 //#endregion
@@ -4944,24 +5318,25 @@ function registerPanelTools(ctx, panels, values) {
 	}
 	const tool = {
 		name: "workbench_panels",
-		description: "看或调右侧面板：启用哪些套件、什么顺序。启用/收起 = 卡片与 agent 工具一起上下线（别的项目不受影响，不删数据）。收起是\"这个工作区明确不要它\"，连那些在机器级默认板上开着的套件也照样在这个工作区收起来，之后 show 能放回来。默认只动当前工作区（scope=workspace）；scope=machine 动的是\"机器级默认板\" —— 机器级默认板只是还没配过的工作区的默认值，已经自己配过的工作区保持自己的选择，不会被它改。在那份板上 hide = 明确写下\"不要它\"，这一笔比名单更管用：名单里还列着它也算不要，没配过的工作区因此看不到它；show 会把这笔划掉、把它放回去。",
+		description: "看或调右侧面板：启用哪些套件、什么顺序。启用/收起 = 卡片与 agent 工具一起上下线（别的项目不受影响，不删数据）。收起是\"这个工作区明确不要它\"，连那些在机器级默认板上开着的套件也照样在这个工作区收起来，之后 show 能放回来。默认只动当前工作区（scope=workspace）；scope=machine 动的是\"机器级默认板\" —— 机器级默认板只是还没配过的工作区的默认值，已经自己配过的工作区保持自己的选择，不会被它改。在那份板上 hide = 明确写下\"不要它\"，这一笔比名单更管用：名单里还列着它也算不要，没提过它的工作区因此看不到它；show 会把这笔划掉、把它放回去。本工作区那份板只记**改过的那几行**（逐行覆盖）：没提到的行跟着机器级默认板走，所以那份板以后改了，没改过的工作区会跟着变。workbench_panels 默认只动当前工作区，动机器级默认板要显式给 scope=machine。",
 		parameters: {
 			type: "object",
 			properties: {
 				action: {
 					type: "string",
-					description: "show=这个工作区要它（之前收起的也放回来）；hide=这个工作区明确不要它（卡片与工具一起下线，默认在机器上也开着的套件同样收起，别的项目不受影响）；move=调顺序；reset=这个工作区不再有自己的选择（之前收起、启用的都忘掉；它从此明确\"什么都不要\"，机器级默认板也管不到它，要哪一块用 show 放回来）。",
+					description: "show=这个工作区要它（之前收起的也放回来）；hide=这个工作区明确不要它（卡片与工具一起下线，默认在机器上也开着的套件同样收起，别的项目不受影响）；move=调顺序；reset=清掉这个工作区改过的那些行（改完就全部回到跟着机器级默认板走）；follow=把某一行放回跟随（带 id = 只放回那一行；不带 id = 全部放回）。",
 					enum: [
 						"list",
 						"show",
 						"hide",
 						"move",
-						"reset"
+						"reset",
+						"follow"
 					]
 				},
 				id: {
 					type: "string",
-					description: "show / hide / move 必填，如 coding-issues。"
+					description: "show / hide / move 必填；follow 可选（带 id = 只把那一行放回跟随）。"
 				},
 				index: {
 					type: "integer",
@@ -4997,8 +5372,9 @@ function registerPanelTools(ctx, panels, values) {
 				"show",
 				"hide",
 				"move",
-				"reset"
-			].includes(action)) throw new Error(`不认识的 action：${action}（可用：list / show / hide / move / reset）`);
+				"reset",
+				"follow"
+			].includes(action)) throw new Error(`不认识的 action：${action}（可用：list / show / hide / move / reset / follow）`);
 			if (action === "list") {
 				const units = list();
 				if (scope === "workspace") {
@@ -5010,11 +5386,19 @@ function registerPanelTools(ctx, panels, values) {
 					text: render(units, workspace, scope)
 				};
 			}
+			if (action === "follow") {
+				if (scope === "machine") throw new Error("机器级默认板没有\"放回跟随\"一说：它就是那份默认本身，直接 show / hide 写它。");
+				const units = panels.follow(workspace, id);
+				return {
+					units,
+					text: id === void 0 ? `这个工作区改过的行全部清掉 —— 每一行都回到跟着机器级默认板走（那份板以后改了，这里跟着变）。\n${render(units, workspace, scope)}` : `${id} 放回跟随 —— 它不再由这个工作区定，改跟机器级默认板走。\n${render(units, workspace, scope)}`
+				};
+			}
 			if (action === "reset") {
 				const units = panels.reset(workspace, scope);
 				return {
 					units,
-					text: scope === "machine" ? `机器级默认板已清空（是"配成空"，不是"没配过"）——还没配过的工作区从此默认什么都不开。${MACHINE_CAVEAT}\n${render(units, workspace, scope)}` : `这个工作区不再有自己的面板选择（之前收起、启用的都忘掉了；它从此明确"什么都不要"—— 机器级默认板也管不到它，要哪一块用 show 放回来）。\n${render(units, workspace, scope)}`
+					text: scope === "machine" ? `机器级默认板已清空 —— 从今往后，没在这一行改过的工作区默认什么都不开。${MACHINE_CAVEAT}\n${render(units, workspace, scope)}` : `这个工作区改过的行已全部清掉 —— 每一行都回到跟着机器级默认板走。\n${render(units, workspace, scope)}`
 				};
 			}
 			if (id === void 0) throw new Error(`${action} 需要一个 id（例如 coding-issues）。当前套件：${list().map((entry) => entry.id).join(", ")}`);
@@ -5047,19 +5431,20 @@ var OWNED = [{
 	unit: panelsUnit.id,
 	manifest: panelsUnit,
 	mount({ ctx, logger, manifests, ownedUnits, opencliCommand, probe, store, values }) {
+		const ledger = createPluginLedger({
+			store,
+			home: isolatedHome()
+		});
 		const panels = createPanelsService({
 			manifests,
 			store,
 			owned: ownedUnits,
+			plugins: () => pluginPanelRefs(ledger),
 			logger
 		});
 		ctx.provide(PANELS_SERVICE, panels);
 		const profileDir = profileDirOf(ctx);
 		const shell = ctx.get("shell");
-		const ledger = createPluginLedger({
-			store,
-			home: isolatedHome()
-		});
 		const market = createMarketService({
 			manifests: manifests(),
 			manifestsNow: manifests,
@@ -5069,6 +5454,7 @@ var OWNED = [{
 			bundles: readBundleManager(ctx),
 			installed: (pkg) => readInstalledModule(profileDir, pkg),
 			modules: () => profileModules(profileDir),
+			workbench: (pkg) => readProfilePackage(profileDir, pkg),
 			registries: createRegistryNotebook(profileDir),
 			ledger,
 			references: () => {
@@ -5448,6 +5834,24 @@ function bundleRegistriesHandler(ctx) {
 	};
 }
 var refusalLog = /* @__PURE__ */ new Map();
+async function workbenchVersion(input) {
+	const read = readProfilePackage(input.dir, PLUGIN_ID);
+	if (read === void 0) return void 0;
+	const registry = read.registry ?? input.fallback;
+	const queried = read.local === true || input.shell === void 0 || registry === void 0 ? void 0 : await latestVersion({
+		shell: input.shell,
+		name: read.pkg,
+		registry,
+		force: input.force
+	});
+	const latest = queried !== void 0 && isNewerVersion(queried, read.version) ? queried : void 0;
+	return {
+		pkg: read.pkg,
+		installed: read.version,
+		...latest === void 0 ? {} : { latest },
+		...read.local === true ? { local: true } : {}
+	};
+}
 function moduleVersionsHandler(ctx, shell) {
 	return async (search) => {
 		const manager = readBundleManager(ctx);
@@ -5460,36 +5864,44 @@ function moduleVersionsHandler(ctx, shell) {
 		const refusals = new Map((ctx.get("workbenchUnits")?.refusals() ?? []).filter((one) => one.unit !== "").map((one) => [one.unit, one.reasons]));
 		const force = param(search, "force") === "1";
 		const fallback = (await manager.registries())?.resolved ?? void 0;
+		const modules = await Promise.all(found.map(async (module) => {
+			const registry = module.registry ?? fallback;
+			const latest = shell === void 0 || registry === void 0 ? void 0 : await latestVersion({
+				shell,
+				name: module.pkg,
+				registry,
+				force
+			});
+			const raw = moduleDeclarationOf(dir, module.pkg);
+			const declared = raw === void 0 ? [] : declarationProblemsOf(module.pkg, raw);
+			const refused = refusals.get(module.unit) ?? (declared.length === 0 ? void 0 : declared);
+			if (refused === void 0) refusalLog.delete(module.pkg);
+			else {
+				const line = refused.join("；");
+				if (refusalLog.get(module.pkg) !== line) {
+					refusalLog.set(module.pkg, line);
+					ctx.logger?.warn?.(`[dsh-workbench] ${module.pkg} 装上了但用不了：${line}`);
+				}
+			}
+			return {
+				unit: module.unit,
+				pkg: module.pkg,
+				installed: module.version,
+				...latest === void 0 ? {} : { latest },
+				...module.local === true ? { local: true } : {},
+				...refused === void 0 ? {} : { refused }
+			};
+		}));
+		const workbench = await workbenchVersion({
+			dir,
+			shell,
+			fallback,
+			force
+		});
 		return {
 			ok: true,
-			modules: await Promise.all(found.map(async (module) => {
-				const registry = module.registry ?? fallback;
-				const latest = shell === void 0 || registry === void 0 ? void 0 : await latestVersion({
-					shell,
-					name: module.pkg,
-					registry,
-					force
-				});
-				const raw = moduleDeclarationOf(dir, module.pkg);
-				const declared = raw === void 0 ? [] : declarationProblemsOf(module.pkg, raw);
-				const refused = refusals.get(module.unit) ?? (declared.length === 0 ? void 0 : declared);
-				if (refused === void 0) refusalLog.delete(module.pkg);
-				else {
-					const line = refused.join("；");
-					if (refusalLog.get(module.pkg) !== line) {
-						refusalLog.set(module.pkg, line);
-						ctx.logger?.warn?.(`[dsh-workbench] ${module.pkg} 装上了但用不了：${line}`);
-					}
-				}
-				return {
-					unit: module.unit,
-					pkg: module.pkg,
-					installed: module.version,
-					...latest === void 0 ? {} : { latest },
-					...module.local === true ? { local: true } : {},
-					...refused === void 0 ? {} : { refused }
-				};
-			}))
+			modules,
+			...workbench === void 0 ? {} : { workbench }
 		};
 	};
 }
@@ -5516,15 +5928,26 @@ async function declarationRefusal(spec, inspection, ctx, manager) {
 	});
 	return refusedInspection(declarationRefusalOf(inspection.name, raw));
 }
-async function packageRefusal(spec, inspection, ctx, manager) {
-	if (inspection.status !== "accepted") return void 0;
+async function packageOverride(spec, inspection, ctx, manager, asked) {
 	const shell = ctx.get("shell");
-	const registry = typeof inspection.registry === "string" ? inspection.registry : (await manager.registries())?.resolved ?? void 0;
-	return (await packageRouteOf({
+	const registry = (inspection.status === "accepted" && typeof inspection.registry === "string" ? inspection.registry : void 0) ?? (typeof asked === "string" ? asked : (await manager.registries())?.resolved ?? void 0);
+	const route = await packageRouteOf({
 		spec,
 		...shell === void 0 ? {} : { shell },
 		...registry === void 0 ? {} : { registry }
-	}))?.kind === "neither" ? {
+	});
+	if (route?.kind === "opencli-plugin") {
+		if (inspection.status !== "refused") return void 0;
+		const ref = splitNpmSpec(spec);
+		return {
+			status: "plugin",
+			pkg: route.pkg ?? ref?.name ?? spec.trim(),
+			registry: registry ?? null,
+			...route.pluginName === void 0 ? {} : { pluginName: route.pluginName },
+			...ref?.version === void 0 ? {} : { version: ref.version }
+		};
+	}
+	return route?.kind === "neither" && inspection.status === "accepted" ? {
 		status: "refused",
 		problem: "not-a-module-or-plugin",
 		reason: refusalReason()
@@ -5548,7 +5971,8 @@ function bundleInspectHandler(ctx) {
 				message: "这个 profile 里没有插件管理器，装不了模块。"
 			}
 		};
-		const inspection = await manager.inspect(spec, registryOf(search));
+		const asked = registryOf(search);
+		const inspection = await manager.inspect(spec, asked);
 		if (inspection === null) return {
 			ok: false,
 			error: {
@@ -5558,7 +5982,7 @@ function bundleInspectHandler(ctx) {
 		};
 		return {
 			ok: true,
-			inspection: await packageRefusal(spec, inspection, ctx, manager) ?? await declarationRefusal(spec, inspection, ctx, manager) ?? inspection
+			inspection: await packageOverride(spec, inspection, ctx, manager, asked) ?? await declarationRefusal(spec, inspection, ctx, manager) ?? inspection
 		};
 	};
 }
@@ -6484,7 +6908,9 @@ function mountUnits(units, deps) {
 //#endregion
 //#region src/shared/api/host/unit-registry.ts
 function sourceLabel(source) {
-	return source.kind === "owned" ? "外壳自己" : source.pkg;
+	if (source.kind === "owned") return "外壳自己";
+	if (source.kind === "plugin") return "按已装 opencli 插件合成";
+	return source.pkg;
 }
 function createUnitRegistry(options) {
 	const refusals = [];
@@ -6544,6 +6970,14 @@ function createUnitRegistry(options) {
 				source: { kind: "owned" }
 			});
 		},
+		registerPlugin(face) {
+			return add({
+				unit: face.manifest.id,
+				manifest: face.manifest,
+				face,
+				source: { kind: "plugin" }
+			});
+		},
 		all: () => hosts,
 		owned: () => hosts.filter((host) => host.source.kind === "owned").map((host) => host.unit),
 		refusals: () => refusals,
@@ -6569,6 +7003,563 @@ function bindRosterFacts(options) {
 	});
 }
 //#endregion
+//#region src/shared/api/host/plugin-catalog.ts
+function recordOf(value) {
+	return typeof value === "object" && value !== null ? value : void 0;
+}
+function textOf(value) {
+	return typeof value === "string" ? value : "";
+}
+function stringsOf(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function argsOf(raw) {
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((item) => {
+		const record = recordOf(item);
+		if (record === void 0) return [];
+		const name = textOf(record["name"]).trim();
+		if (name === "") return [];
+		const fallback = record["default"];
+		return [{
+			name,
+			type: textOf(record["type"]) || "string",
+			required: record["required"] === true,
+			positional: record["positional"] === true,
+			valueRequired: record["valueRequired"] === true,
+			choices: stringsOf(record["choices"]),
+			...fallback === void 0 || fallback === null ? {} : { defaultValue: fallback },
+			help: textOf(record["help"])
+		}];
+	});
+}
+function parsePluginRows(stdout) {
+	const parsed = parseJsonLoose(stdout);
+	if (!Array.isArray(parsed)) return void 0;
+	const rows = [];
+	for (const item of parsed) {
+		const record = recordOf(item);
+		if (record === void 0) return void 0;
+		const name = textOf(record["name"]).trim();
+		if (name === "") return void 0;
+		rows.push({
+			name,
+			version: textOf(record["version"]),
+			commands: stringsOf(record["commands"])
+		});
+	}
+	return rows;
+}
+function parseCommandRows(stdout) {
+	const parsed = parseJsonLoose(stdout);
+	if (!Array.isArray(parsed)) return void 0;
+	const rows = [];
+	for (const item of parsed) {
+		const record = recordOf(item);
+		if (record === void 0) return void 0;
+		const site = textOf(record["site"]).trim();
+		const name = textOf(record["name"]).trim();
+		if (site === "" || name === "") return void 0;
+		rows.push({
+			site,
+			name,
+			description: textOf(record["description"]),
+			access: textOf(record["access"]),
+			...textOf(record["domain"]) === "" ? {} : { domain: textOf(record["domain"]) },
+			args: argsOf(record["args"])
+		});
+	}
+	return rows;
+}
+function commandOf(plugin, row) {
+	return {
+		plugin,
+		name: row.name,
+		description: row.description,
+		access: row.access,
+		args: row.args
+	};
+}
+function attributeCommands(plugins, rows) {
+	const bySite = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const site = bySite.get(row.site) ?? /* @__PURE__ */ new Map();
+		site.set(row.name, row);
+		bySite.set(row.site, site);
+	}
+	const sets = [];
+	const problems = [];
+	if (plugins.length > 0 && rows.length === 0) problems.push(`opencli 报了 ${String(plugins.length)} 个插件，但命令面（opencli list -f json）里一条命令都没有 —— 两份清单对不上`);
+	for (const plugin of plugins) {
+		const found = bySite.get(plugin.name) ?? /* @__PURE__ */ new Map();
+		if (found.size === 0) {
+			problems.push(`「${plugin.name}」在 opencli 插件清单里，但命令面里没有一条 site=${plugin.name} 的命令 —— 归属不了，它这次不合成工具`);
+			continue;
+		}
+		const declared = plugin.commands.length > 0 ? plugin.commands : [...found.keys()];
+		const missing = declared.filter((name) => !found.has(name));
+		if (missing.length > 0) problems.push(`「${plugin.name}」自己的清单里有 ${String(missing.length)} 条命令在命令面里找不到：${missing.join("、")}（插件版本旧或命令面没更新）`);
+		const commands = declared.flatMap((name) => {
+			const row = found.get(name);
+			return row === void 0 ? [] : [commandOf(plugin.name, row)];
+		});
+		if (commands.length === 0) {
+			problems.push(`「${plugin.name}」没有任何一条能归属的命令 —— 它这次不合成工具`);
+			continue;
+		}
+		sets.push({
+			plugin: plugin.name,
+			version: plugin.version,
+			commands
+		});
+	}
+	return {
+		sets,
+		problems
+	};
+}
+function fingerprintOf(plugins) {
+	return plugins.map((plugin) => `${plugin.name}@${plugin.version}:${[...plugin.commands].sort().join(",")}`).sort().join("|");
+}
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function createPluginCatalog(options) {
+	const timeoutMs = options.timeoutMs ?? 12e4;
+	let current = {
+		ok: false,
+		at: 0,
+		sets: [],
+		problems: ["还没探过 opencli 的插件命令面"]
+	};
+	let heavy;
+	async function read(line) {
+		const shell = options.shell;
+		if (shell === void 0) return {
+			ok: false,
+			problem: "没有执行缝（shell 服务不可用），探不了这个命令面"
+		};
+		try {
+			const result = await runShell(shell, line, { timeoutMs });
+			if (result.timedOut) return {
+				ok: false,
+				problem: `${line} 超过 ${String(Math.round(timeoutMs / 1e3))} 秒没返回`
+			};
+			if (result.exitCode !== 0) {
+				const tail = result.stderr.trim() || result.stdout.trim();
+				return {
+					ok: false,
+					problem: `${line} 退出码 ${String(result.exitCode)}${tail === "" ? "" : `：${tail.split("\n").slice(-3).join(" ")}`}`
+				};
+			}
+			return {
+				ok: true,
+				stdout: result.stdout
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				problem: `${line} 没跑起来：${messageOf(error)}`
+			};
+		}
+	}
+	function fail(problem) {
+		current = {
+			ok: false,
+			at: Date.now(),
+			sets: current.sets,
+			problems: [problem]
+		};
+		return current;
+	}
+	async function refresh(callOptions = {}) {
+		const pluginsRun = await read(`${options.command} plugin list -f json`);
+		if (!pluginsRun.ok) return fail(pluginsRun.problem);
+		const plugins = parsePluginRows(pluginsRun.stdout);
+		if (plugins === void 0) return fail("opencli plugin list -f json 的输出读不懂（不是带 name 的 JSON 数组）");
+		const fingerprint = fingerprintOf(plugins);
+		if (!callOptions.force && heavy !== void 0 && heavy.fingerprint === fingerprint) {
+			current = {
+				ok: true,
+				at: Date.now(),
+				sets: heavy.sets,
+				problems: heavy.problems
+			};
+			return current;
+		}
+		const commandsRun = await read(`${options.command} list -f json`);
+		if (!commandsRun.ok) return fail(commandsRun.problem);
+		const rows = parseCommandRows(commandsRun.stdout);
+		if (rows === void 0) return fail("opencli list -f json 的输出读不懂（不是带 site / name 的 JSON 数组）");
+		const attributed = attributeCommands(plugins, rows);
+		heavy = {
+			fingerprint,
+			sets: attributed.sets,
+			problems: attributed.problems
+		};
+		current = {
+			ok: true,
+			at: Date.now(),
+			sets: attributed.sets,
+			problems: attributed.problems
+		};
+		return current;
+	}
+	return {
+		refresh,
+		snapshot: () => current
+	};
+}
+//#endregion
+//#region src/shared/api/host/plugin-login-hint.ts
+var NOT_LOGGED_IN = /未登录|请先登录|not logged in/i;
+function propertyOf$1(error, key) {
+	return typeof error === "object" && error !== null ? error[key] : void 0;
+}
+function helpUrlOfError(error) {
+	const raw = propertyOf$1(error, "helpUrl");
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+function isAuthFailure(error, message) {
+	if (NOT_LOGGED_IN.test(message)) return true;
+	return propertyOf$1(error, "code") === "auth-required";
+}
+function loginUrlOfDomain(domain) {
+	const bare = (domain ?? "").trim().replace(/\/+$/, "");
+	if (bare === "" || bare.includes("*")) return void 0;
+	return /^https?:\/\//.test(bare) ? bare : `https://${bare}/login`;
+}
+function pluginLoginHint(error, domain) {
+	const message = error instanceof Error ? error.message : String(error);
+	if (!isAuthFailure(error, message)) return message;
+	const url = helpUrlOfError(error) ?? loginUrlOfDomain(domain);
+	if (url !== void 0) return `${message}\n在 opencli 那扇浏览器窗里打开 ${url} 登一次，然后重试。`;
+	return `${message}\n在 opencli 那扇浏览器窗里登录这个站点（插件没给出具体地址，工作台拼不出来）—— 或跑一次工作台的体检/预热，然后重试。`;
+}
+//#endregion
+//#region src/shared/api/host/plugin-tools.ts
+var SCHEMA_TYPE = {
+	int: "integer",
+	integer: "integer",
+	number: "number",
+	float: "number",
+	bool: "boolean",
+	boolean: "boolean",
+	string: "string"
+};
+var KEY_ARG_LIMIT = 3;
+function pluginToolName(plugin, command) {
+	return `${plugin}_${command}`.toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/_{2,}/g, "_").replace(/^_+|_+$/g, "");
+}
+function schemaTypeOf(arg) {
+	return SCHEMA_TYPE[arg.type.toLowerCase()] ?? "string";
+}
+function propertyOf(arg) {
+	const type = schemaTypeOf(arg);
+	const enumValues = arg.choices.length > 0 ? arg.choices.map((choice) => choice) : void 0;
+	return {
+		type,
+		...arg.help.trim() === "" ? {} : { description: arg.help.trim() },
+		...enumValues === void 0 ? {} : { enum: enumValues },
+		...arg.defaultValue === void 0 ? {} : { default: arg.defaultValue }
+	};
+}
+function pluginToolParameters(command) {
+	const properties = {};
+	for (const arg of command.args) properties[arg.name] = propertyOf(arg);
+	const required = command.args.filter((arg) => arg.required).map((arg) => arg.name);
+	return {
+		type: "object",
+		properties,
+		...required.length === 0 ? {} : { required },
+		additionalProperties: false
+	};
+}
+function pluginToolDescription(command) {
+	const described = command.description.trim();
+	return described === "" ? `${command.plugin} ${command.name}（opencli 命令）` : described;
+}
+function pluginToolWrites(command) {
+	return command.access !== "read";
+}
+function valuesOf(raw) {
+	return typeof raw === "object" && raw !== null ? raw : {};
+}
+function pluginToolArgv(command, raw) {
+	const values = valuesOf(raw);
+	const argv = [];
+	for (const arg of command.args) {
+		if (!arg.positional) continue;
+		const value = values[arg.name];
+		if (value === void 0 || value === null) continue;
+		argv.push(String(value));
+	}
+	for (const arg of command.args) {
+		if (arg.positional) continue;
+		const value = values[arg.name];
+		if (value === void 0 || value === null) continue;
+		if (typeof value === "boolean") argv.push(`--${arg.name}`, value ? "true" : "false");
+		else if (Array.isArray(value)) argv.push(`--${arg.name}`, value.map((item) => String(item)).join(","));
+		else argv.push(`--${arg.name}`, String(value));
+	}
+	return argv;
+}
+function pluginKeyArgs(command, raw) {
+	const values = valuesOf(raw);
+	const ordered = [...command.args.filter((arg) => arg.required), ...command.args.filter((arg) => !arg.required)];
+	const parts = [];
+	for (const arg of ordered) {
+		const value = values[arg.name];
+		if (value === void 0 || value === null || value === "") continue;
+		parts.push(`${arg.name}=${String(value)}`);
+		if (parts.length === KEY_ARG_LIMIT) break;
+	}
+	return parts.length === 0 ? "没有带参数" : parts.join("、");
+}
+function pluginApprovalQuestion(command, raw) {
+	const key = pluginKeyArgs(command, raw);
+	return {
+		zh: `允许执行 ${command.plugin} 的 ${command.name}（${key}）吗？`,
+		en: `Run ${command.plugin} ${command.name} (${key})?`
+	};
+}
+function pluginApprovalFor(command) {
+	const denied = command.access === "read";
+	return (call) => {
+		if (denied) return { kind: "read" };
+		const question = pluginApprovalQuestion(command, call.arguments);
+		return {
+			kind: "ask",
+			reason: command.access === "write" ? `${command.plugin} ${command.name} 在 opencli 里标着 write` : `${command.plugin} ${command.name} 没有拿到 access（fail-safe：按写处理）`,
+			question,
+			fallback: question
+		};
+	};
+}
+//#endregion
+//#region src/shared/api/host/plugin-units.ts
+var TOOL_OUTPUT_SCHEMA = {
+	type: "object",
+	properties: {},
+	additionalProperties: true
+};
+function signatureOf(version, commands) {
+	return [version, ...commands.map((command) => `${command.name}:${command.access}:${command.args.map((arg) => `${arg.name}${arg.required ? "!" : ""}`).join("+")}`)].join("|");
+}
+function toolsOf(plugin, commands, taken) {
+	const tools = [];
+	const problems = [];
+	const claimed = /* @__PURE__ */ new Set();
+	for (const command of commands) {
+		const name = pluginToolName(plugin, command.name);
+		if (taken.has(name) || claimed.has(name)) {
+			problems.push(`工具名 ${name}（${plugin} ${command.name}）已经被占着 —— 这条命令这次不合成（先来的那份说了算）`);
+			continue;
+		}
+		claimed.add(name);
+		tools.push({
+			name,
+			command
+		});
+	}
+	return {
+		tools,
+		problems
+	};
+}
+function planOf(options, registered) {
+	const sets = new Map(options.catalog.snapshot().sets.map((set) => [set.plugin, set]));
+	const mine = new Set([...registered.values()].flatMap((item) => item.tools));
+	const taken = new Set([...options.toolNames?.() ?? []].filter((name) => !mine.has(name)));
+	const units = [];
+	const rows = [];
+	const problems = [];
+	for (const row of options.rows()) {
+		const plugin = row.name?.trim() ?? "";
+		if (plugin === "") {
+			problems.push(`面板上的插件行 ${row.id}（${row.pkg}）没有 opencli 插件名 —— 认不出它，这次不给它合成工具`);
+			continue;
+		}
+		const set = sets.get(plugin);
+		if (set === void 0) {
+			problems.push(`已装插件「${plugin}」在 opencli 的插件清单 / 命令面里找不到 —— 归属不了，这次不给它合成工具`);
+			continue;
+		}
+		sets.delete(plugin);
+		const declared = options.declared(plugin);
+		const overlapped = set.commands.filter((command) => declared.has(command.name));
+		if (overlapped.length > 0) problems.push(`「${plugin}」有 ${overlapped.length} 条命令由已装模块自己提供（${overlapped.map((command) => command.name).join("、")}）—— 通用桥不重复合成`);
+		const commands = set.commands.filter((command) => !declared.has(command.name));
+		const built = toolsOf(plugin, commands, taken);
+		problems.push(...built.problems);
+		for (const tool of built.tools) taken.add(tool.name);
+		if (built.tools.length === 0 && commands.length === set.commands.length) problems.push(`「${plugin}」的命令一条都没能合成工具`);
+		rows.push({
+			plugin,
+			pkg: row.pkg,
+			version: set.version,
+			commands: set.commands.length,
+			synthesized: built.tools.length,
+			tools: built.tools.map((tool) => tool.name)
+		});
+		if (built.tools.length === 0) continue;
+		units.push({
+			id: row.id,
+			plugin,
+			pkg: row.pkg,
+			version: set.version,
+			signature: signatureOf(set.version, commands),
+			commands,
+			tools: built.tools
+		});
+	}
+	for (const set of sets.values()) problems.push(`opencli 里装着「${set.plugin}」（${String(set.commands.length)} 条命令），但它不在插件台账里（不是从市场装的）—— 面板上没有它的开关，它的命令这次不进工具面`);
+	return {
+		units,
+		rows,
+		problems
+	};
+}
+function faceOf(unit, opencliFor) {
+	const byTool = new Map(unit.tools.map((tool) => [tool.name, tool.command]));
+	const manifest = {
+		id: unit.id,
+		card: null,
+		tools: unit.tools.map((tool) => ({
+			name: tool.name,
+			writes: pluginToolWrites(tool.command)
+		})),
+		host: { inject: [] }
+	};
+	return {
+		unit: unit.id,
+		manifest,
+		mount(deps) {
+			const tools = deps.ctx.get("tools");
+			if (tools === void 0) {
+				deps.logger?.info?.(`[dsh-workbench] 没有 tools 服务，跳过 ${unit.plugin} 的命令工具注册`);
+				return {
+					routes: {},
+					registerTools: () => []
+				};
+			}
+			const opencli = opencliFor(unit.plugin);
+			const definitions = unit.tools.map((tool) => ({
+				name: tool.name,
+				description: pluginToolDescription(tool.command),
+				parameters: pluginToolParameters(tool.command),
+				output: {
+					schema: TOOL_OUTPUT_SCHEMA,
+					render: (_args, value) => textOutput(jsonText(value))
+				},
+				async execute(raw, exec) {
+					const workspace = sessionWorkspace(exec);
+					try {
+						return (await opencli.json([tool.command.name, ...pluginToolArgv(tool.command, raw)], workspace === null ? {} : { workdir: workspace })).value;
+					} catch (error) {
+						throw new Error(pluginLoginHint(error, tool.command.domain), { cause: error });
+					}
+				}
+			}));
+			return {
+				routes: {},
+				factsOf: () => [],
+				registerTools: () => definitions.map((definition) => tools.register(definition)),
+				needsApproval: (call) => {
+					const command = call.name === void 0 ? void 0 : byTool.get(call.name);
+					return command === void 0 ? void 0 : pluginApprovalFor(command)(call);
+				}
+			};
+		}
+	};
+}
+function reconcile(registered, units, options) {
+	const wanted = new Map(units.map((unit) => [unit.id, unit]));
+	for (const [id, item] of [...registered]) {
+		const next = wanted.get(id);
+		if (next !== void 0 && next.signature === item.signature) continue;
+		item.drop();
+		registered.delete(id);
+	}
+	for (const unit of units) {
+		if (registered.has(unit.id)) continue;
+		registered.set(unit.id, {
+			signature: unit.signature,
+			tools: unit.tools.map((tool) => tool.name),
+			drop: options.registry.registerPlugin(faceOf(unit, options.opencliFor))
+		});
+	}
+}
+function createPluginUnits(options) {
+	const registered = /* @__PURE__ */ new Map();
+	let report = {
+		ok: false,
+		at: 0,
+		plugins: [],
+		problems: ["还没探过 opencli 的插件命令面"]
+	};
+	let inflight;
+	let lastTouch = 0;
+	let warned = "";
+	function warn(problems) {
+		const text = [...problems].sort().join("\n");
+		if (text === "" || text === warned) return;
+		warned = text;
+		options.logger?.warn?.(`[dsh-workbench] opencli 插件命令面：\n${text}`);
+	}
+	async function run(force) {
+		const probed = await options.catalog.refresh(force ? { force: true } : {});
+		if (!probed.ok) {
+			const problems = [...probed.problems, "这次探测没成功：上面这些插件行的工具面维持在上一份（不是\"这些插件没有命令\"）"];
+			report = {
+				ok: false,
+				at: Date.now(),
+				plugins: report.plugins,
+				problems
+			};
+			warn(problems);
+			return report;
+		}
+		const plan = planOf(options, registered);
+		reconcile(registered, plan.units, options);
+		report = {
+			ok: true,
+			at: Date.now(),
+			plugins: plan.rows,
+			problems: plan.problems
+		};
+		warn(plan.problems);
+		return report;
+	}
+	function refresh(callOptions = {}) {
+		if (inflight !== void 0) return inflight;
+		const task = run(callOptions.force === true).finally(() => {
+			inflight = void 0;
+		});
+		inflight = task;
+		return task;
+	}
+	return {
+		refresh,
+		touch() {
+			const now = Date.now();
+			if (inflight !== void 0) return;
+			if (now - lastTouch < 3e4) return;
+			lastTouch = now;
+			refresh().catch((error) => {
+				options.logger?.warn?.(`[dsh-workbench] 探 opencli 插件命令面时抛了错：${String(error)}`);
+			});
+		},
+		report: () => report,
+		dispose() {
+			for (const item of registered.values()) item.drop();
+			registered.clear();
+		}
+	};
+}
+//#endregion
 //#region src/shared/api/host/tool-scope.ts
 function agentOf(value) {
 	return typeof value === "object" && value !== null ? value : void 0;
@@ -6755,6 +7746,23 @@ function apply(ctx) {
 		deniedTools: (workspace) => deniedNow(workspace),
 		logger: ctx.logger
 	});
+	const pluginTools = shell === void 0 ? void 0 : createPluginUnits({
+		registry: units,
+		catalog: createPluginCatalog({
+			shell,
+			command: opencli.command
+		}),
+		rows: () => ctx.get("workbenchPanels")?.listPlugins(null) ?? [],
+		declared: (plugin) => declaredPluginCommands(profileDir).get(plugin) ?? /* @__PURE__ */ new Set(),
+		opencliFor: (plugin) => createOpencli({
+			shell,
+			plugin,
+			command: opencli.command,
+			logger: ctx.logger
+		}),
+		toolNames: () => new Set(unitsOfTool().keys()),
+		logger: ctx.logger
+	});
 	const mounted = /* @__PURE__ */ new Map();
 	const mountFailures = /* @__PURE__ */ new Map();
 	const factsOfMap = /* @__PURE__ */ new Map();
@@ -6908,6 +7916,23 @@ function apply(ctx) {
 		});
 	}
 	sync();
+	if (pluginTools !== void 0) {
+		const health = routes.health;
+		routes.health = async (search) => ({
+			...await health?.(search),
+			pluginTools: pluginTools.report()
+		});
+		ctx.effect(() => {
+			pluginTools.refresh().catch((error) => {
+				warn(ctx, `探 opencli 插件的命令面时抛了错：${String(error)}`);
+			});
+			return () => pluginTools.dispose();
+		}, `${PLUGIN_ID}: 已装且上板的 opencli 插件各合成一个单元（工具面照旧由面板那道闸收窄）`);
+		ctx.effect(() => {
+			const off = ctx.get(PANELS_SERVICE)?.subscribe?.(() => pluginTools.touch());
+			return () => off?.();
+		}, `${PLUGIN_ID}: 面板配置一动就重探插件命令面（装上 / 收起都在那一条链上）`);
+	}
 	ctx.effect(() => () => {
 		for (const id of [...mounted.keys()]) unmountUnit(id);
 		for (const dispose of undoPost) dispose?.();
@@ -6937,11 +7962,15 @@ function apply(ctx) {
 		return () => off?.();
 	}, `${PLUGIN_ID}: 事实归属（读工具与写工具同一处声明）`);
 	ctx.effect(() => {
-		const off = ctx.on?.("agent/created", (payload) => toolScope.apply(payload?.agent));
+		const off = ctx.on?.("agent/created", (payload) => {
+			toolScope.apply(payload?.agent);
+			pluginTools?.touch();
+		});
 		return () => off?.();
 	}, `${PLUGIN_ID}: agent 的工具面按工作区收窄（创建时）`);
 	ctx.effect(() => {
 		const off = ctx.on?.("system-prompt/assemble", async (_assembly, context, next) => {
+			pluginTools?.touch();
 			const resolved = await next();
 			return toolScope.narrow(resolved, context?.scope);
 		});